Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem

Conflicts:
	net/ieee802154/6lowpan.c

220 files changed, 3087 insertions, 1501 deletions

diff --git a/drivers/bcma/driver_chipcommon_sflash.c b/drivers/bcma/driver_chipcommon_sflash.c
index 4d07cce9c5d9..7e11ef4cb7db 100644
--- a/drivers/bcma/driver_chipcommon_sflash.c
+++ b/drivers/bcma/driver_chipcommon_sflash.c
@@ -38,7 +38,7 @@ static const struct bcma_sflash_tbl_e bcma_sflash_st_tbl[] = {
         { "M25P32", 0x15, 0x10000, 64, },
         { "M25P64", 0x16, 0x10000, 128, },
         { "M25FL128", 0x17, 0x10000, 256, },
-        { 0 },
+        { NULL },
 };
 
 static const struct bcma_sflash_tbl_e bcma_sflash_sst_tbl[] = {
@@ -56,7 +56,7 @@ static const struct bcma_sflash_tbl_e bcma_sflash_sst_tbl[] = {
         { "SST25VF016", 0x41, 0x1000, 512, },
         { "SST25VF032", 0x4a, 0x1000, 1024, },
         { "SST25VF064", 0x4b, 0x1000, 2048, },
-        { 0 },
+        { NULL },
 };
 
 static const struct bcma_sflash_tbl_e bcma_sflash_at_tbl[] = {
@@ -67,7 +67,7 @@ static const struct bcma_sflash_tbl_e bcma_sflash_at_tbl[] = {
         { "AT45DB161", 0x2c, 512, 4096, },
         { "AT45DB321", 0x34, 512, 8192, },
         { "AT45DB642", 0x3c, 1024, 8192, },
-        { 0 },
+        { NULL },
 };
 
 static void bcma_sflash_cmd(struct bcma_drv_cc *cc, u32 opcode)
diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c
index b61440aaee65..83f6437dd91d 100644
--- a/drivers/bluetooth/btsdio.c
+++ b/drivers/bluetooth/btsdio.c
@@ -73,6 +73,7 @@ struct btsdio_data {
 #define REG_CL_INTRD 0x13       /* Interrupt Clear */
 #define REG_EN_INTRD 0x14       /* Interrupt Enable */
 #define REG_MD_STAT  0x20       /* Bluetooth Mode Status */
+#define REG_MD_SET   0x20       /* Bluetooth Mode Set */
 
 static int btsdio_tx_packet(struct btsdio_data *data, struct sk_buff *skb)
 {
@@ -212,7 +213,7 @@ static int btsdio_open(struct hci_dev *hdev)
         }
 
         if (data->func->class == SDIO_CLASS_BT_B)
-                sdio_writeb(data->func, 0x00, REG_MD_STAT, NULL);
+                sdio_writeb(data->func, 0x00, REG_MD_SET, NULL);
 
         sdio_writeb(data->func, 0x01, REG_EN_INTRD, NULL);
 
@@ -333,6 +334,9 @@ static int btsdio_probe(struct sdio_func *func,
         hdev->flush    = btsdio_flush;
         hdev->send     = btsdio_send_frame;
 
+        if (func->vendor == 0x0104 && func->device == 0x00c5)
+                set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
+
         err = hci_register_dev(hdev);
         if (err < 0) {
                 hci_free_dev(hdev);
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 9f7e539de510..baeaaed299e4 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -965,6 +965,45 @@ static int btusb_setup_bcm92035(struct hci_dev *hdev)
         return 0;
 }
 
+static int btusb_setup_csr(struct hci_dev *hdev)
+{
+        struct hci_rp_read_local_version *rp;
+        struct sk_buff *skb;
+        int ret;
+
+        BT_DBG("%s", hdev->name);
+
+        skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
+                             HCI_INIT_TIMEOUT);
+        if (IS_ERR(skb)) {
+                BT_ERR("Reading local version failed (%ld)", -PTR_ERR(skb));
+                return -PTR_ERR(skb);
+        }
+
+        rp = (struct hci_rp_read_local_version *) skb->data;
+
+        if (!rp->status) {
+                if (le16_to_cpu(rp->manufacturer) != 10) {
+                        /* Clear the reset quirk since this is not an actual
+                         * early Bluetooth 1.1 device from CSR.
+                         */
+                        clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
+
+                        /* These fake CSR controllers have all a broken
+                         * stored link key handling and so just disable it.
+                         */
+                        set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY,
+                                &hdev->quirks);
+                }
+        }
+
+        ret = -bt_to_errno(rp->status);
+
+        kfree_skb(skb);
+
+        return ret;
+}
+
 struct intel_version {
         u8 status;
         u8 hw_platform;
@@ -1465,10 +1504,15 @@ static int btusb_probe(struct usb_interface *intf,
 
         if (id->driver_info & BTUSB_CSR) {
                 struct usb_device *udev = data->udev;
+                u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice);
 
                 /* Old firmware would otherwise execute USB reset */
-                if (le16_to_cpu(udev->descriptor.bcdDevice) < 0x117)
+                if (bcdDevice < 0x117)
                         set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
+
+                /* Fake CSR devices with broken commands */
+                if (bcdDevice <= 0x100)
+                        hdev->setup = btusb_setup_csr;
         }
 
         if (id->driver_info & BTUSB_SNIFFER) {
diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c
index 7b167385a1c4..1ef6990a5c7e 100644
--- a/drivers/bluetooth/hci_vhci.c
+++ b/drivers/bluetooth/hci_vhci.c
@@ -141,22 +141,28 @@ static int vhci_create_device(struct vhci_data *data, __u8 dev_type)
 }
 
 static inline ssize_t vhci_get_user(struct vhci_data *data,
-                                    const char __user *buf, size_t count)
+                                    const struct iovec *iov,
+                                    unsigned long count)
 {
+        size_t len = iov_length(iov, count);
         struct sk_buff *skb;
         __u8 pkt_type, dev_type;
+        unsigned long i;
         int ret;
 
-        if (count < 2 || count > HCI_MAX_FRAME_SIZE)
+        if (len < 2 || len > HCI_MAX_FRAME_SIZE)
                 return -EINVAL;
 
-        skb = bt_skb_alloc(count, GFP_KERNEL);
+        skb = bt_skb_alloc(len, GFP_KERNEL);
         if (!skb)
                 return -ENOMEM;
 
-        if (copy_from_user(skb_put(skb, count), buf, count)) {
-                kfree_skb(skb);
-                return -EFAULT;
+        for (i = 0; i < count; i++) {
+                if (copy_from_user(skb_put(skb, iov[i].iov_len),
+                                   iov[i].iov_base, iov[i].iov_len)) {
+                        kfree_skb(skb);
+                        return -EFAULT;
+                }
         }
 
         pkt_type = *((__u8 *) skb->data);
@@ -205,7 +211,7 @@ static inline ssize_t vhci_get_user(struct vhci_data *data,
                 return -EINVAL;
         }
 
-        return (ret < 0) ? ret : count;
+        return (ret < 0) ? ret : len;
 }
 
 static inline ssize_t vhci_put_user(struct vhci_data *data,
@@ -272,12 +278,13 @@ static ssize_t vhci_read(struct file *file,
         return ret;
 }
 
-static ssize_t vhci_write(struct file *file,
-                          const char __user *buf, size_t count, loff_t *pos)
+static ssize_t vhci_write(struct kiocb *iocb, const struct iovec *iov,
+                          unsigned long count, loff_t pos)
 {
+        struct file *file = iocb->ki_filp;
         struct vhci_data *data = file->private_data;
 
-        return vhci_get_user(data, buf, count);
+        return vhci_get_user(data, iov, count);
 }
 
 static unsigned int vhci_poll(struct file *file, poll_table *wait)
@@ -342,7 +349,7 @@ static int vhci_release(struct inode *inode, struct file *file)
 static const struct file_operations vhci_fops = {
         .owner          = THIS_MODULE,
         .read           = vhci_read,
-        .write          = vhci_write,
+        .aio_write      = vhci_write,
         .poll           = vhci_poll,
         .open           = vhci_open,
         .release        = vhci_release,
diff --git a/drivers/net/wireless/adm8211.c b/drivers/net/wireless/adm8211.c
index 1d40c69cc4a9..55eda7afc041 100644
--- a/drivers/net/wireless/adm8211.c
+++ b/drivers/net/wireless/adm8211.c
@@ -15,7 +15,6 @@
  * more details.
  */
 
-#include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/if.h>
 #include <linux/skbuff.h>
diff --git a/drivers/net/wireless/airo_cs.c b/drivers/net/wireless/airo_cs.c
index 14128fd265ac..7e9ede6c5798 100644
--- a/drivers/net/wireless/airo_cs.c
+++ b/drivers/net/wireless/airo_cs.c
@@ -23,7 +23,6 @@
 #ifdef __IN_PCMCIA_PACKAGE__
 #include <pcmcia/k_compat.h>
 #endif
-#include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/ptrace.h>
diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index 34c8a33cac06..031d4ec64779 100644
--- a/drivers/net/wireless/at76c50x-usb.c
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -1721,7 +1721,7 @@ static void at76_mac80211_tx(struct ieee80211_hw *hw,
          * following workaround is necessary. If the TX frame is an
          * authentication frame extract the bssid and send the CMD_JOIN. */
         if (mgmt->frame_control & cpu_to_le16(IEEE80211_STYPE_AUTH)) {
-                if (!ether_addr_equal(priv->bssid, mgmt->bssid)) {
+                if (!ether_addr_equal_64bits(priv->bssid, mgmt->bssid)) {
                         memcpy(priv->bssid, mgmt->bssid, ETH_ALEN);
                         ieee80211_queue_work(hw, &priv->work_join_bssid);
                         dev_kfree_skb_any(skb);
diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
index 280fc3d53a36..8aa20df55e50 100644
--- a/drivers/net/wireless/ath/ar5523/ar5523.c
+++ b/drivers/net/wireless/ath/ar5523/ar5523.c
@@ -25,7 +25,6 @@
  * that and only has minimal functionality.
  */
 #include <linux/compiler.h>
-#include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/list.h>
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 69f58b073e85..6396ad4bce67 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -1245,7 +1245,7 @@ ath5k_check_ibss_tsf(struct ath5k_hw *ah, struct sk_buff *skb,
 
         if (ieee80211_is_beacon(mgmt->frame_control) &&
             le16_to_cpu(mgmt->u.beacon.capab_info) & WLAN_CAPABILITY_IBSS &&
-            ether_addr_equal(mgmt->bssid, common->curbssid)) {
+            ether_addr_equal_64bits(mgmt->bssid, common->curbssid)) {
                 /*
                  * Received an IBSS beacon with the same BSSID. Hardware *must*
                  * have updated the local TSF. We have to work around various
@@ -1309,7 +1309,7 @@ ath5k_update_beacon_rssi(struct ath5k_hw *ah, struct sk_buff *skb, int rssi)
 
         /* only beacons from our BSSID */
         if (!ieee80211_is_beacon(mgmt->frame_control) ||
-            !ether_addr_equal(mgmt->bssid, common->curbssid))
+            !ether_addr_equal_64bits(mgmt->bssid, common->curbssid))
                 return;
 
         ewma_add(&ah->ah_beacon_rssi_avg, rssi);
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
index 149aba3c7298..d480d2f3e185 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
@@ -383,6 +383,20 @@ void ar9002_hw_enable_async_fifo(struct ath_hw *ah)
         }
 }
 
+static void ar9002_hw_init_hang_checks(struct ath_hw *ah)
+{
+        if (AR_SREV_9100(ah) || AR_SREV_9160(ah)) {
+                ah->config.hw_hang_checks |= HW_BB_RIFS_HANG;
+                ah->config.hw_hang_checks |= HW_BB_DFS_HANG;
+        }
+
+        if (AR_SREV_9280(ah))
+                ah->config.hw_hang_checks |= HW_BB_RX_CLEAR_STUCK_HANG;
+
+        if (AR_SREV_5416(ah) || AR_SREV_9100(ah) || AR_SREV_9160(ah))
+                ah->config.hw_hang_checks |= HW_MAC_HANG;
+}
+
 /* Sets up the AR5008/AR9001/AR9002 hardware familiy callbacks */
 int ar9002_hw_attach_ops(struct ath_hw *ah)
 {
@@ -395,6 +409,7 @@ int ar9002_hw_attach_ops(struct ath_hw *ah)
                 return ret;
 
         priv_ops->init_mode_gain_regs = ar9002_hw_init_mode_gain_regs;
+        priv_ops->init_hang_checks = ar9002_hw_init_hang_checks;
 
         ops->config_pci_powersave = ar9002_hw_configpcipowersave;
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index 97e09d5f3a42..8c145cd98c1c 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -326,6 +326,224 @@ static void ar9003_hw_init_cal_settings(struct ath_hw *ah)
         ah->supp_cals = IQ_MISMATCH_CAL;
 }
 
+#define OFF_UPPER_LT 24
+#define OFF_LOWER_LT 7
+
+static bool ar9003_hw_dynamic_osdac_selection(struct ath_hw *ah,
+                                              bool txiqcal_done)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        int ch0_done, osdac_ch0, dc_off_ch0_i1, dc_off_ch0_q1, dc_off_ch0_i2,
+                dc_off_ch0_q2, dc_off_ch0_i3, dc_off_ch0_q3;
+        int ch1_done, osdac_ch1, dc_off_ch1_i1, dc_off_ch1_q1, dc_off_ch1_i2,
+                dc_off_ch1_q2, dc_off_ch1_i3, dc_off_ch1_q3;
+        int ch2_done, osdac_ch2, dc_off_ch2_i1, dc_off_ch2_q1, dc_off_ch2_i2,
+                dc_off_ch2_q2, dc_off_ch2_i3, dc_off_ch2_q3;
+        bool status;
+        u32 temp, val;
+
+        /*
+         * Clear offset and IQ calibration, run AGC cal.
+         */
+        REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL,
+                    AR_PHY_AGC_CONTROL_OFFSET_CAL);
+        REG_CLR_BIT(ah, AR_PHY_TX_IQCAL_CONTROL_0,
+                    AR_PHY_TX_IQCAL_CONTROL_0_ENABLE_TXIQ_CAL);
+        REG_WRITE(ah, AR_PHY_AGC_CONTROL,
+                  REG_READ(ah, AR_PHY_AGC_CONTROL) | AR_PHY_AGC_CONTROL_CAL);
+
+        status = ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL,
+                               AR_PHY_AGC_CONTROL_CAL,
+                               0, AH_WAIT_TIMEOUT);
+        if (!status) {
+                ath_dbg(common, CALIBRATE,
+                        "AGC cal without offset cal failed to complete in 1ms");
+                return false;
+        }
+
+        /*
+         * Allow only offset calibration and disable the others
+         * (Carrier Leak calibration, TX Filter calibration and
+         *  Peak Detector offset calibration).
+         */
+        REG_SET_BIT(ah, AR_PHY_AGC_CONTROL,
+                    AR_PHY_AGC_CONTROL_OFFSET_CAL);
+        REG_CLR_BIT(ah, AR_PHY_CL_CAL_CTL,
+                    AR_PHY_CL_CAL_ENABLE);
+        REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL,
+                    AR_PHY_AGC_CONTROL_FLTR_CAL);
+        REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL,
+                    AR_PHY_AGC_CONTROL_PKDET_CAL);
+
+        ch0_done = 0;
+        ch1_done = 0;
+        ch2_done = 0;
+
+        while ((ch0_done == 0) || (ch1_done == 0) || (ch2_done == 0)) {
+                osdac_ch0 = (REG_READ(ah, AR_PHY_65NM_CH0_BB1) >> 30) & 0x3;
+                osdac_ch1 = (REG_READ(ah, AR_PHY_65NM_CH1_BB1) >> 30) & 0x3;
+                osdac_ch2 = (REG_READ(ah, AR_PHY_65NM_CH2_BB1) >> 30) & 0x3;
+
+                REG_SET_BIT(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
+
+                REG_WRITE(ah, AR_PHY_AGC_CONTROL,
+                          REG_READ(ah, AR_PHY_AGC_CONTROL) | AR_PHY_AGC_CONTROL_CAL);
+
+                status = ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL,
+                                       AR_PHY_AGC_CONTROL_CAL,
+                                       0, AH_WAIT_TIMEOUT);
+                if (!status) {
+                        ath_dbg(common, CALIBRATE,
+                                "DC offset cal failed to complete in 1ms");
+                        return false;
+                }
+
+                REG_CLR_BIT(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
+
+                /*
+                 * High gain.
+                 */
+                REG_WRITE(ah, AR_PHY_65NM_CH0_BB3,
+                          ((REG_READ(ah, AR_PHY_65NM_CH0_BB3) & 0xfffffcff) | (1 << 8)));
+                REG_WRITE(ah, AR_PHY_65NM_CH1_BB3,
+                          ((REG_READ(ah, AR_PHY_65NM_CH1_BB3) & 0xfffffcff) | (1 << 8)));
+                REG_WRITE(ah, AR_PHY_65NM_CH2_BB3,
+                          ((REG_READ(ah, AR_PHY_65NM_CH2_BB3) & 0xfffffcff) | (1 << 8)));
+
+                temp = REG_READ(ah, AR_PHY_65NM_CH0_BB3);
+                dc_off_ch0_i1 = (temp >> 26) & 0x1f;
+                dc_off_ch0_q1 = (temp >> 21) & 0x1f;
+
+                temp = REG_READ(ah, AR_PHY_65NM_CH1_BB3);
+                dc_off_ch1_i1 = (temp >> 26) & 0x1f;
+                dc_off_ch1_q1 = (temp >> 21) & 0x1f;
+
+                temp = REG_READ(ah, AR_PHY_65NM_CH2_BB3);
+                dc_off_ch2_i1 = (temp >> 26) & 0x1f;
+                dc_off_ch2_q1 = (temp >> 21) & 0x1f;
+
+                /*
+                 * Low gain.
+                 */
+                REG_WRITE(ah, AR_PHY_65NM_CH0_BB3,
+                          ((REG_READ(ah, AR_PHY_65NM_CH0_BB3) & 0xfffffcff) | (2 << 8)));
+                REG_WRITE(ah, AR_PHY_65NM_CH1_BB3,
+                          ((REG_READ(ah, AR_PHY_65NM_CH1_BB3) & 0xfffffcff) | (2 << 8)));
+                REG_WRITE(ah, AR_PHY_65NM_CH2_BB3,
+                          ((REG_READ(ah, AR_PHY_65NM_CH2_BB3) & 0xfffffcff) | (2 << 8)));
+
+                temp = REG_READ(ah, AR_PHY_65NM_CH0_BB3);
+                dc_off_ch0_i2 = (temp >> 26) & 0x1f;
+                dc_off_ch0_q2 = (temp >> 21) & 0x1f;
+
+                temp = REG_READ(ah, AR_PHY_65NM_CH1_BB3);
+                dc_off_ch1_i2 = (temp >> 26) & 0x1f;
+                dc_off_ch1_q2 = (temp >> 21) & 0x1f;
+
+                temp = REG_READ(ah, AR_PHY_65NM_CH2_BB3);
+                dc_off_ch2_i2 = (temp >> 26) & 0x1f;
+                dc_off_ch2_q2 = (temp >> 21) & 0x1f;
+
+                /*
+                 * Loopback.
+                 */
+                REG_WRITE(ah, AR_PHY_65NM_CH0_BB3,
+                          ((REG_READ(ah, AR_PHY_65NM_CH0_BB3) & 0xfffffcff) | (3 << 8)));
+                REG_WRITE(ah, AR_PHY_65NM_CH1_BB3,
+                          ((REG_READ(ah, AR_PHY_65NM_CH1_BB3) & 0xfffffcff) | (3 << 8)));
+                REG_WRITE(ah, AR_PHY_65NM_CH2_BB3,
+                          ((REG_READ(ah, AR_PHY_65NM_CH2_BB3) & 0xfffffcff) | (3 << 8)));
+
+                temp = REG_READ(ah, AR_PHY_65NM_CH0_BB3);
+                dc_off_ch0_i3 = (temp >> 26) & 0x1f;
+                dc_off_ch0_q3 = (temp >> 21) & 0x1f;
+
+                temp = REG_READ(ah, AR_PHY_65NM_CH1_BB3);
+                dc_off_ch1_i3 = (temp >> 26) & 0x1f;
+                dc_off_ch1_q3 = (temp >> 21) & 0x1f;
+
+                temp = REG_READ(ah, AR_PHY_65NM_CH2_BB3);
+                dc_off_ch2_i3 = (temp >> 26) & 0x1f;
+                dc_off_ch2_q3 = (temp >> 21) & 0x1f;
+
+                if ((dc_off_ch0_i1 > OFF_UPPER_LT) || (dc_off_ch0_i1 < OFF_LOWER_LT) ||
+                    (dc_off_ch0_i2 > OFF_UPPER_LT) || (dc_off_ch0_i2 < OFF_LOWER_LT) ||
+                    (dc_off_ch0_i3 > OFF_UPPER_LT) || (dc_off_ch0_i3 < OFF_LOWER_LT) ||
+                    (dc_off_ch0_q1 > OFF_UPPER_LT) || (dc_off_ch0_q1 < OFF_LOWER_LT) ||
+                    (dc_off_ch0_q2 > OFF_UPPER_LT) || (dc_off_ch0_q2 < OFF_LOWER_LT) ||
+                    (dc_off_ch0_q3 > OFF_UPPER_LT) || (dc_off_ch0_q3 < OFF_LOWER_LT)) {
+                        if (osdac_ch0 == 3) {
+                                ch0_done = 1;
+                        } else {
+                                osdac_ch0++;
+
+                                val = REG_READ(ah, AR_PHY_65NM_CH0_BB1) & 0x3fffffff;
+                                val |= (osdac_ch0 << 30);
+                                REG_WRITE(ah, AR_PHY_65NM_CH0_BB1, val);
+
+                                ch0_done = 0;
+                        }
+                } else {
+                        ch0_done = 1;
+                }
+
+                if ((dc_off_ch1_i1 > OFF_UPPER_LT) || (dc_off_ch1_i1 < OFF_LOWER_LT) ||
+                    (dc_off_ch1_i2 > OFF_UPPER_LT) || (dc_off_ch1_i2 < OFF_LOWER_LT) ||
+                    (dc_off_ch1_i3 > OFF_UPPER_LT) || (dc_off_ch1_i3 < OFF_LOWER_LT) ||
+                    (dc_off_ch1_q1 > OFF_UPPER_LT) || (dc_off_ch1_q1 < OFF_LOWER_LT) ||
+                    (dc_off_ch1_q2 > OFF_UPPER_LT) || (dc_off_ch1_q2 < OFF_LOWER_LT) ||
+                    (dc_off_ch1_q3 > OFF_UPPER_LT) || (dc_off_ch1_q3 < OFF_LOWER_LT)) {
+                        if (osdac_ch1 == 3) {
+                                ch1_done = 1;
+                        } else {
+                                osdac_ch1++;
+
+                                val = REG_READ(ah, AR_PHY_65NM_CH1_BB1) & 0x3fffffff;
+                                val |= (osdac_ch1 << 30);
+                                REG_WRITE(ah, AR_PHY_65NM_CH1_BB1, val);
+
+                                ch1_done = 0;
+                        }
+                } else {
+                        ch1_done = 1;
+                }
+
+                if ((dc_off_ch2_i1 > OFF_UPPER_LT) || (dc_off_ch2_i1 < OFF_LOWER_LT) ||
+                    (dc_off_ch2_i2 > OFF_UPPER_LT) || (dc_off_ch2_i2 < OFF_LOWER_LT) ||
+                    (dc_off_ch2_i3 > OFF_UPPER_LT) || (dc_off_ch2_i3 < OFF_LOWER_LT) ||
+                    (dc_off_ch2_q1 > OFF_UPPER_LT) || (dc_off_ch2_q1 < OFF_LOWER_LT) ||
+                    (dc_off_ch2_q2 > OFF_UPPER_LT) || (dc_off_ch2_q2 < OFF_LOWER_LT) ||
+                    (dc_off_ch2_q3 > OFF_UPPER_LT) || (dc_off_ch2_q3 < OFF_LOWER_LT)) {
+                        if (osdac_ch2 == 3) {
+                                ch2_done = 1;
+                        } else {
+                                osdac_ch2++;
+
+                                val = REG_READ(ah, AR_PHY_65NM_CH2_BB1) & 0x3fffffff;
+                                val |= (osdac_ch2 << 30);
+                                REG_WRITE(ah, AR_PHY_65NM_CH2_BB1, val);
+
+                                ch2_done = 0;
+                        }
+                } else {
+                        ch2_done = 1;
+                }
+        }
+
+        REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL,
+                    AR_PHY_AGC_CONTROL_OFFSET_CAL);
+        REG_SET_BIT(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
+
+        /*
+         * We don't need to check txiqcal_done here since it is always
+         * set for AR9550.
+         */
+        REG_SET_BIT(ah, AR_PHY_TX_IQCAL_CONTROL_0,
+                    AR_PHY_TX_IQCAL_CONTROL_0_ENABLE_TXIQ_CAL);
+
+        return true;
+}
+
 /*
  * solve 4x4 linear equation used in loopback iq cal.
  */
@@ -1271,6 +1489,11 @@ static bool ar9003_hw_init_cal_soc(struct ath_hw *ah,
                 REG_WRITE(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
         }
 
+        if (AR_SREV_9550(ah) && IS_CHAN_2GHZ(chan)) {
+                if (!ar9003_hw_dynamic_osdac_selection(ah, txiqcal_done))
+                        return false;
+        }
+
 skip_tx_iqcal:
         if (run_agc_cal || !(ah->ah_flags & AH_FASTCC)) {
                 if (AR_SREV_9330_11(ah))
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index c8d22eccfef8..25243cbc07f0 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -3598,7 +3598,7 @@ static void ar9003_hw_ant_ctrl_apply(struct ath_hw *ah, bool is2ghz)
         if (AR_SREV_9462(ah) || AR_SREV_9565(ah)) {
                 REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM,
                                 AR_SWITCH_TABLE_COM_AR9462_ALL, value);
-        } else if (AR_SREV_9550(ah)) {
+        } else if (AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
                 REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM,
                                 AR_SWITCH_TABLE_COM_AR9550_ALL, value);
         } else
@@ -3975,7 +3975,7 @@ static void ar9003_hw_apply_tuning_caps(struct ath_hw *ah)
         struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
         u8 tuning_caps_param = eep->baseEepHeader.params_for_tuning_caps[0];
 
-        if (AR_SREV_9340(ah))
+        if (AR_SREV_9340(ah) || AR_SREV_9531(ah))
                 return;
 
         if (eep->baseEepHeader.featureEnable & 0x40) {
@@ -4030,7 +4030,10 @@ static void ar9003_hw_xpa_timing_control_apply(struct ath_hw *ah, bool is2ghz)
         if (!(eep->baseEepHeader.featureEnable & 0x80))
                 return;
 
-        if (!AR_SREV_9300(ah) && !AR_SREV_9340(ah) && !AR_SREV_9580(ah))
+        if (!AR_SREV_9300(ah) &&
+            !AR_SREV_9340(ah) &&
+            !AR_SREV_9580(ah) &&
+            !AR_SREV_9531(ah))
                 return;
 
         xpa_ctl = ar9003_modal_header(ah, is2ghz)->txFrameToXpaOn;
@@ -4163,7 +4166,7 @@ static void ath9k_hw_ar9300_set_board_values(struct ath_hw *ah,
         ar9003_hw_xlna_bias_strength_apply(ah, is2ghz);
         ar9003_hw_atten_apply(ah, chan);
         ar9003_hw_quick_drop_apply(ah, chan->channel);
-        if (!AR_SREV_9330(ah) && !AR_SREV_9340(ah))
+        if (!AR_SREV_9330(ah) && !AR_SREV_9340(ah) && !AR_SREV_9531(ah))
                 ar9003_hw_internal_regulator_apply(ah);
         ar9003_hw_apply_tuning_caps(ah);
         ar9003_hw_apply_minccapwr_thresh(ah, chan);
@@ -4788,7 +4791,7 @@ static void ar9003_hw_power_control_override(struct ath_hw *ah,
         }
 
 tempslope:
-        if (AR_SREV_9550(ah)) {
+        if (AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
                 /*
                  * AR955x has tempSlope register for each chain.
                  * Check whether temp_compensation feature is enabled or not.
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
index 29613ebbc5d7..ec1da0cc25f5 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
@@ -28,6 +28,7 @@
 #include "ar9462_2p1_initvals.h"
 #include "ar9565_1p0_initvals.h"
 #include "ar9565_1p1_initvals.h"
+#include "ar953x_initvals.h"
 
 /* General hardware code for the AR9003 hadware family */
 
@@ -308,6 +309,31 @@ static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
                 /* Fast clock modal settings */
                 INIT_INI_ARRAY(&ah->iniModesFastClock,
                                 ar955x_1p0_modes_fast_clock);
+        } else if (AR_SREV_9531(ah)) {
+                INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE],
+                               qca953x_1p0_mac_core);
+                INIT_INI_ARRAY(&ah->iniMac[ATH_INI_POST],
+                               qca953x_1p0_mac_postamble);
+                INIT_INI_ARRAY(&ah->iniBB[ATH_INI_CORE],
+                               qca953x_1p0_baseband_core);
+                INIT_INI_ARRAY(&ah->iniBB[ATH_INI_POST],
+                               qca953x_1p0_baseband_postamble);
+                INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_CORE],
+                               qca953x_1p0_radio_core);
+                INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_POST],
+                               qca953x_1p0_radio_postamble);
+                INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_PRE],
+                               qca953x_1p0_soc_preamble);
+                INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_POST],
+                               qca953x_1p0_soc_postamble);
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               qca953x_1p0_common_wo_xlna_rx_gain_table);
+                INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
+                               qca953x_1p0_common_wo_xlna_rx_gain_bounds);
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               qca953x_1p0_modes_no_xpa_tx_gain_table);
+                INIT_INI_ARRAY(&ah->iniModesFastClock,
+                               qca953x_1p0_modes_fast_clock);
         } else if (AR_SREV_9580(ah)) {
                 /* mac */
                 INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE],
@@ -485,6 +511,9 @@ static void ar9003_tx_gain_table_mode0(struct ath_hw *ah)
         else if (AR_SREV_9550(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar955x_1p0_modes_xpa_tx_gain_table);
+        else if (AR_SREV_9531(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                        qca953x_1p0_modes_xpa_tx_gain_table);
         else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9580_1p0_lowest_ob_db_tx_gain_table);
@@ -525,7 +554,14 @@ static void ar9003_tx_gain_table_mode1(struct ath_hw *ah)
         else if (AR_SREV_9550(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar955x_1p0_modes_no_xpa_tx_gain_table);
-        else if (AR_SREV_9462_21(ah))
+        else if (AR_SREV_9531(ah)) {
+                if (AR_SREV_9531_11(ah))
+                        INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                       qca953x_1p1_modes_no_xpa_tx_gain_table);
+                else
+                        INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                       qca953x_1p0_modes_no_xpa_tx_gain_table);
+        } else if (AR_SREV_9462_21(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9462_2p1_modes_high_ob_db_tx_gain);
         else if (AR_SREV_9462_20(ah))
@@ -699,6 +735,11 @@ static void ar9003_rx_gain_table_mode0(struct ath_hw *ah)
                                 ar955x_1p0_common_rx_gain_table);
                 INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
                                 ar955x_1p0_common_rx_gain_bounds);
+        } else if (AR_SREV_9531(ah)) {
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               qca953x_1p0_common_rx_gain_table);
+                INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
+                               qca953x_1p0_common_rx_gain_bounds);
         } else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                                 ar9580_1p0_rx_gain_table);
@@ -744,6 +785,11 @@ static void ar9003_rx_gain_table_mode1(struct ath_hw *ah)
                         ar955x_1p0_common_wo_xlna_rx_gain_table);
                 INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
                         ar955x_1p0_common_wo_xlna_rx_gain_bounds);
+        } else if (AR_SREV_9531(ah)) {
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               qca953x_1p0_common_wo_xlna_rx_gain_table);
+                INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
+                               qca953x_1p0_common_wo_xlna_rx_gain_bounds);
         } else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                         ar9580_1p0_wo_xlna_rx_gain_table);
@@ -872,6 +918,117 @@ static void ar9003_hw_configpcipowersave(struct ath_hw *ah,
         }
 }
 
+static void ar9003_hw_init_hang_checks(struct ath_hw *ah)
+{
+        /*
+         * All chips support detection of BB/MAC hangs.
+         */
+        ah->config.hw_hang_checks |= HW_BB_WATCHDOG;
+        ah->config.hw_hang_checks |= HW_MAC_HANG;
+
+        /*
+         * This is not required for AR9580 1.0
+         */
+        if (AR_SREV_9300_22(ah))
+                ah->config.hw_hang_checks |= HW_PHYRESTART_CLC_WAR;
+
+        if (AR_SREV_9330(ah))
+                ah->bb_watchdog_timeout_ms = 85;
+        else
+                ah->bb_watchdog_timeout_ms = 25;
+}
+
+/*
+ * MAC HW hang check
+ * =================
+ *
+ * Signature: dcu_chain_state is 0x6 and dcu_complete_state is 0x1.
+ *
+ * The state of each DCU chain (mapped to TX queues) is available from these
+ * DMA debug registers:
+ *
+ * Chain 0 state : Bits 4:0   of AR_DMADBG_4
+ * Chain 1 state : Bits 9:5   of AR_DMADBG_4
+ * Chain 2 state : Bits 14:10 of AR_DMADBG_4
+ * Chain 3 state : Bits 19:15 of AR_DMADBG_4
+ * Chain 4 state : Bits 24:20 of AR_DMADBG_4
+ * Chain 5 state : Bits 29:25 of AR_DMADBG_4
+ * Chain 6 state : Bits 4:0   of AR_DMADBG_5
+ * Chain 7 state : Bits 9:5   of AR_DMADBG_5
+ * Chain 8 state : Bits 14:10 of AR_DMADBG_5
+ * Chain 9 state : Bits 19:15 of AR_DMADBG_5
+ *
+ * The DCU chain state "0x6" means "WAIT_FRDONE" - wait for TX frame to be done.
+ */
+
+#define NUM_STATUS_READS 50
+
+static bool ath9k_hw_verify_hang(struct ath_hw *ah, unsigned int queue)
+{
+        u32 dma_dbg_chain, dma_dbg_complete;
+        u8 dcu_chain_state, dcu_complete_state;
+        int i;
+
+        for (i = 0; i < NUM_STATUS_READS; i++) {
+                if (queue < 6)
+                        dma_dbg_chain = REG_READ(ah, AR_DMADBG_4);
+                else
+                        dma_dbg_chain = REG_READ(ah, AR_DMADBG_5);
+
+                dma_dbg_complete = REG_READ(ah, AR_DMADBG_6);
+
+                dcu_chain_state = (dma_dbg_chain >> (5 * queue)) & 0x1f;
+                dcu_complete_state = dma_dbg_complete & 0x3;
+
+                if ((dcu_chain_state != 0x6) || (dcu_complete_state != 0x1))
+                        return false;
+        }
+
+        ath_dbg(ath9k_hw_common(ah), RESET,
+                "MAC Hang signature found for queue: %d\n", queue);
+
+        return true;
+}
+
+static bool ar9003_hw_detect_mac_hang(struct ath_hw *ah)
+{
+        u32 dma_dbg_4, dma_dbg_5, dma_dbg_6, chk_dbg;
+        u8 dcu_chain_state, dcu_complete_state;
+        bool dcu_wait_frdone = false;
+        unsigned long chk_dcu = 0;
+        unsigned int i = 0;
+
+        dma_dbg_4 = REG_READ(ah, AR_DMADBG_4);
+        dma_dbg_5 = REG_READ(ah, AR_DMADBG_5);
+        dma_dbg_6 = REG_READ(ah, AR_DMADBG_6);
+
+        dcu_complete_state = dma_dbg_6 & 0x3;
+        if (dcu_complete_state != 0x1)
+                goto exit;
+
+        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
+                if (i < 6)
+                        chk_dbg = dma_dbg_4;
+                else
+                        chk_dbg = dma_dbg_5;
+
+                dcu_chain_state = (chk_dbg >> (5 * i)) & 0x1f;
+                if (dcu_chain_state == 0x6) {
+                        dcu_wait_frdone = true;
+                        chk_dcu |= BIT(i);
+                }
+        }
+
+        if ((dcu_complete_state == 0x1) && dcu_wait_frdone) {
+                for_each_set_bit(i, &chk_dcu, ATH9K_NUM_TX_QUEUES) {
+                        if (ath9k_hw_verify_hang(ah, i))
+                                return true;
+                }
+        }
+exit:
+        return false;
+}
+
 /* Sets up the AR9003 hardware familiy callbacks */
 void ar9003_hw_attach_ops(struct ath_hw *ah)
 {
@@ -880,6 +1037,8 @@ void ar9003_hw_attach_ops(struct ath_hw *ah)
 
         ar9003_hw_init_mode_regs(ah);
         priv_ops->init_mode_gain_regs = ar9003_hw_init_mode_gain_regs;
+        priv_ops->init_hang_checks = ar9003_hw_init_hang_checks;
+        priv_ops->detect_mac_hang = ar9003_hw_detect_mac_hang;
 
         ops->config_pci_powersave = ar9003_hw_configpcipowersave;
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 9f051a08e143..09facba1dc6d 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -103,7 +103,7 @@ static int ar9003_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
                         } else {
                                 channelSel = CHANSEL_2G(freq) >> 1;
                         }
-                } else if (AR_SREV_9550(ah)) {
+                } else if (AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
                         if (ah->is_clk_25mhz)
                                 div = 75;
                         else
@@ -118,7 +118,7 @@ static int ar9003_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
                 /* Set to 2G mode */
                 bMode = 1;
         } else {
-                if ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) &&
+                if ((AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah)) &&
                     ah->is_clk_25mhz) {
                         channelSel = freq / 75;
                         chan_frac = ((freq % 75) * 0x20000) / 75;
@@ -810,10 +810,12 @@ static int ar9003_hw_process_ini(struct ath_hw *ah,
         /*
          * TXGAIN initvals.
          */
-        if (AR_SREV_9550(ah)) {
-                int modes_txgain_index;
+        if (AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
+                int modes_txgain_index = 1;
+
+                if (AR_SREV_9550(ah))
+                        modes_txgain_index = ar9550_hw_get_modes_txgain_index(ah, chan);
 
-                modes_txgain_index = ar9550_hw_get_modes_txgain_index(ah, chan);
                 if (modes_txgain_index < 0)
                         return -EINVAL;
 
@@ -1814,6 +1816,68 @@ void ar9003_hw_attach_phy_ops(struct ath_hw *ah)
         memcpy(ah->nf_regs, ar9300_cca_regs, sizeof(ah->nf_regs));
 }
 
+/*
+ * Baseband Watchdog signatures:
+ *
+ * 0x04000539: BB hang when operating in HT40 DFS Channel.
+ *             Full chip reset is not required, but a recovery
+ *             mechanism is needed.
+ *
+ * 0x1300000a: Related to CAC deafness.
+ *             Chip reset is not required.
+ *
+ * 0x0400000a: Related to CAC deafness.
+ *             Full chip reset is required.
+ *
+ * 0x04000b09: RX state machine gets into an illegal state
+ *             when a packet with unsupported rate is received.
+ *             Full chip reset is required and PHY_RESTART has
+ *             to be disabled.
+ *
+ * 0x04000409: Packet stuck on receive.
+ *             Full chip reset is required for all chips except AR9340.
+ */
+
+/*
+ * ar9003_hw_bb_watchdog_check(): Returns true if a chip reset is required.
+ */
+bool ar9003_hw_bb_watchdog_check(struct ath_hw *ah)
+{
+        u32 val;
+
+        switch(ah->bb_watchdog_last_status) {
+        case 0x04000539:
+                val = REG_READ(ah, AR_PHY_RADAR_0);
+                val &= (~AR_PHY_RADAR_0_FIRPWR);
+                val |= SM(0x7f, AR_PHY_RADAR_0_FIRPWR);
+                REG_WRITE(ah, AR_PHY_RADAR_0, val);
+                udelay(1);
+                val = REG_READ(ah, AR_PHY_RADAR_0);
+                val &= ~AR_PHY_RADAR_0_FIRPWR;
+                val |= SM(AR9300_DFS_FIRPWR, AR_PHY_RADAR_0_FIRPWR);
+                REG_WRITE(ah, AR_PHY_RADAR_0, val);
+
+                return false;
+        case 0x1300000a:
+                return false;
+        case 0x0400000a:
+        case 0x04000b09:
+                return true;
+        case 0x04000409:
+                if (AR_SREV_9340(ah) || AR_SREV_9531(ah))
+                        return false;
+                else
+                        return true;
+        default:
+                /*
+                 * For any other unknown signatures, do a
+                 * full chip reset.
+                 */
+                return true;
+        }
+}
+EXPORT_SYMBOL(ar9003_hw_bb_watchdog_check);
+
 void ar9003_hw_bb_watchdog_config(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
@@ -1930,6 +1994,7 @@ EXPORT_SYMBOL(ar9003_hw_bb_watchdog_dbg_info);
 
 void ar9003_hw_disable_phy_restart(struct ath_hw *ah)
 {
+        u8 result;
         u32 val;
 
         /* While receiving unsupported rate frame rx state machine
@@ -1937,15 +2002,13 @@ void ar9003_hw_disable_phy_restart(struct ath_hw *ah)
          * state, BB would go hang. If RXSM is in 0xb state after
          * first bb panic, ensure to disable the phy_restart.
          */
-        if (!((MS(ah->bb_watchdog_last_status,
-                  AR_PHY_WATCHDOG_RX_OFDM_SM) == 0xb) ||
-            ah->bb_hang_rx_ofdm))
-                return;
-
-        ah->bb_hang_rx_ofdm = true;
-        val = REG_READ(ah, AR_PHY_RESTART);
-        val &= ~AR_PHY_RESTART_ENA;
+        result = MS(ah->bb_watchdog_last_status, AR_PHY_WATCHDOG_RX_OFDM_SM);
 
-        REG_WRITE(ah, AR_PHY_RESTART, val);
+        if ((result == 0xb) || ah->bb_hang_rx_ofdm) {
+                ah->bb_hang_rx_ofdm = true;
+                val = REG_READ(ah, AR_PHY_RESTART);
+                val &= ~AR_PHY_RESTART_ENA;
+                REG_WRITE(ah, AR_PHY_RESTART, val);
+        }
 }
 EXPORT_SYMBOL(ar9003_hw_disable_phy_restart);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index 1b441715ba39..fd090b1f2d0f 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -338,9 +338,8 @@
 #define AR_PHY_CCA_NOM_VAL_9300_5GHZ          -115
 #define AR_PHY_CCA_MIN_GOOD_VAL_9300_2GHZ     -125
 #define AR_PHY_CCA_MIN_GOOD_VAL_9300_5GHZ     -125
-#define AR_PHY_CCA_MAX_GOOD_VAL_9300_2GHZ     -95
-#define AR_PHY_CCA_MAX_GOOD_VAL_9300_5GHZ     -100
-
+#define AR_PHY_CCA_MAX_GOOD_VAL_9300_2GHZ     -60
+#define AR_PHY_CCA_MAX_GOOD_VAL_9300_5GHZ     -60
 #define AR_PHY_CCA_MAX_GOOD_VAL_9300_FCC_2GHZ -95
 #define AR_PHY_CCA_MAX_GOOD_VAL_9300_FCC_5GHZ -100
 
@@ -670,6 +669,16 @@
 #define AR_PHY_65NM_CH1_RXTX4       0x1650c
 #define AR_PHY_65NM_CH2_RXTX4       0x1690c
 
+#define AR_PHY_65NM_CH0_BB1         0x16140
+#define AR_PHY_65NM_CH0_BB2         0x16144
+#define AR_PHY_65NM_CH0_BB3         0x16148
+#define AR_PHY_65NM_CH1_BB1         0x16540
+#define AR_PHY_65NM_CH1_BB2         0x16544
+#define AR_PHY_65NM_CH1_BB3         0x16548
+#define AR_PHY_65NM_CH2_BB1         0x16940
+#define AR_PHY_65NM_CH2_BB2         0x16944
+#define AR_PHY_65NM_CH2_BB3         0x16948
+
 #define AR_PHY_65NM_CH0_SYNTH12_VREFMUL3           0x00780000
 #define AR_PHY_65NM_CH0_SYNTH12_VREFMUL3_S         19
 #define AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK         0x00000004
@@ -1334,4 +1343,6 @@
 #define AR_PHY_65NM_RXRF_AGC_AGC_OUT                   0x00000004
 #define AR_PHY_65NM_RXRF_AGC_AGC_OUT_S                 2
 
+#define AR9300_DFS_FIRPWR -28
+
 #endif  /* AR9003_PHY_H */
diff --git a/drivers/net/wireless/ath/ath9k/ar953x_initvals.h b/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
new file mode 100644
index 000000000000..3c9113d9b1bc
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
@@ -0,0 +1,718 @@
+/*
+ * Copyright (c) 2010-2011 Atheros Communications Inc.
+ * Copyright (c) 2011-2012 Qualcomm Atheros Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef INITVALS_953X_H
+#define INITVALS_953X_H
+
+#define qca953x_1p0_mac_postamble ar9300_2p2_mac_postamble
+
+#define qca953x_1p0_soc_postamble ar9300_2p2_soc_postamble
+
+#define qca953x_1p0_common_rx_gain_table ar9300Common_rx_gain_table_2p2
+
+#define qca953x_1p0_common_wo_xlna_rx_gain_table ar9300Common_wo_xlna_rx_gain_table_2p2
+
+#define qca953x_1p0_modes_fast_clock ar9300Modes_fast_clock_2p2
+
+static const u32 qca953x_1p0_mac_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00000008, 0x00000000},
+        {0x00000030, 0x00020085},
+        {0x00000034, 0x00000005},
+        {0x00000040, 0x00000000},
+        {0x00000044, 0x00000000},
+        {0x00000048, 0x00000008},
+        {0x0000004c, 0x00000010},
+        {0x00000050, 0x00000000},
+        {0x00001040, 0x002ffc0f},
+        {0x00001044, 0x002ffc0f},
+        {0x00001048, 0x002ffc0f},
+        {0x0000104c, 0x002ffc0f},
+        {0x00001050, 0x002ffc0f},
+        {0x00001054, 0x002ffc0f},
+        {0x00001058, 0x002ffc0f},
+        {0x0000105c, 0x002ffc0f},
+        {0x00001060, 0x002ffc0f},
+        {0x00001064, 0x002ffc0f},
+        {0x000010f0, 0x00000100},
+        {0x00001270, 0x00000000},
+        {0x000012b0, 0x00000000},
+        {0x000012f0, 0x00000000},
+        {0x0000143c, 0x00000000},
+        {0x0000147c, 0x00000000},
+        {0x00008000, 0x00000000},
+        {0x00008004, 0x00000000},
+        {0x00008008, 0x00000000},
+        {0x0000800c, 0x00000000},
+        {0x00008018, 0x00000000},
+        {0x00008020, 0x00000000},
+        {0x00008038, 0x00000000},
+        {0x0000803c, 0x00000000},
+        {0x00008040, 0x00000000},
+        {0x00008044, 0x00000000},
+        {0x00008048, 0x00000000},
+        {0x0000804c, 0xffffffff},
+        {0x00008054, 0x00000000},
+        {0x00008058, 0x00000000},
+        {0x0000805c, 0x000fc78f},
+        {0x00008060, 0x0000000f},
+        {0x00008064, 0x00000000},
+        {0x00008070, 0x00000310},
+        {0x00008074, 0x00000020},
+        {0x00008078, 0x00000000},
+        {0x0000809c, 0x0000000f},
+        {0x000080a0, 0x00000000},
+        {0x000080a4, 0x02ff0000},
+        {0x000080a8, 0x0e070605},
+        {0x000080ac, 0x0000000d},
+        {0x000080b0, 0x00000000},
+        {0x000080b4, 0x00000000},
+        {0x000080b8, 0x00000000},
+        {0x000080bc, 0x00000000},
+        {0x000080c0, 0x2a800000},
+        {0x000080c4, 0x06900168},
+        {0x000080c8, 0x13881c22},
+        {0x000080cc, 0x01f40000},
+        {0x000080d0, 0x00252500},
+        {0x000080d4, 0x00a00000},
+        {0x000080d8, 0x00400000},
+        {0x000080dc, 0x00000000},
+        {0x000080e0, 0xffffffff},
+        {0x000080e4, 0x0000ffff},
+        {0x000080e8, 0x3f3f3f3f},
+        {0x000080ec, 0x00000000},
+        {0x000080f0, 0x00000000},
+        {0x000080f4, 0x00000000},
+        {0x000080fc, 0x00020000},
+        {0x00008100, 0x00000000},
+        {0x00008108, 0x00000052},
+        {0x0000810c, 0x00000000},
+        {0x00008110, 0x00000000},
+        {0x00008114, 0x000007ff},
+        {0x00008118, 0x000000aa},
+        {0x0000811c, 0x00003210},
+        {0x00008124, 0x00000000},
+        {0x00008128, 0x00000000},
+        {0x0000812c, 0x00000000},
+        {0x00008130, 0x00000000},
+        {0x00008134, 0x00000000},
+        {0x00008138, 0x00000000},
+        {0x0000813c, 0x0000ffff},
+        {0x00008140, 0x000000fe},
+        {0x00008144, 0xffffffff},
+        {0x00008168, 0x00000000},
+        {0x0000816c, 0x00000000},
+        {0x000081c0, 0x00000000},
+        {0x000081c4, 0x33332210},
+        {0x000081ec, 0x00000000},
+        {0x000081f0, 0x00000000},
+        {0x000081f4, 0x00000000},
+        {0x000081f8, 0x00000000},
+        {0x000081fc, 0x00000000},
+        {0x00008240, 0x00100000},
+        {0x00008244, 0x0010f3d7},
+        {0x00008248, 0x00000852},
+        {0x0000824c, 0x0001e7ae},
+        {0x00008250, 0x00000000},
+        {0x00008254, 0x00000000},
+        {0x00008258, 0x00000000},
+        {0x0000825c, 0x40000000},
+        {0x00008260, 0x00080922},
+        {0x00008264, 0x9d400010},
+        {0x00008268, 0xffffffff},
+        {0x0000826c, 0x0000ffff},
+        {0x00008270, 0x00000000},
+        {0x00008274, 0x40000000},
+        {0x00008278, 0x003e4180},
+        {0x0000827c, 0x00000004},
+        {0x00008284, 0x0000002c},
+        {0x00008288, 0x0000002c},
+        {0x0000828c, 0x000000ff},
+        {0x00008294, 0x00000000},
+        {0x00008298, 0x00000000},
+        {0x0000829c, 0x00000000},
+        {0x00008300, 0x00001d40},
+        {0x00008314, 0x00000000},
+        {0x0000831c, 0x0000010d},
+        {0x00008328, 0x00000000},
+        {0x0000832c, 0x0000001f},
+        {0x00008330, 0x00000302},
+        {0x00008334, 0x00000700},
+        {0x00008338, 0xffff0000},
+        {0x0000833c, 0x02400000},
+        {0x00008340, 0x000107ff},
+        {0x00008344, 0xaa48107b},
+        {0x00008348, 0x008f0000},
+        {0x0000835c, 0x00000000},
+        {0x00008360, 0xffffffff},
+        {0x00008364, 0xffffffff},
+        {0x00008368, 0x00000000},
+        {0x00008370, 0x00000000},
+        {0x00008374, 0x000000ff},
+        {0x00008378, 0x00000000},
+        {0x0000837c, 0x00000000},
+        {0x00008380, 0xffffffff},
+        {0x00008384, 0xffffffff},
+        {0x00008390, 0xffffffff},
+        {0x00008394, 0xffffffff},
+        {0x00008398, 0x00000000},
+        {0x0000839c, 0x00000000},
+        {0x000083a0, 0x00000000},
+        {0x000083a4, 0x0000fa14},
+        {0x000083a8, 0x000f0c00},
+        {0x000083ac, 0x33332210},
+        {0x000083b0, 0x33332210},
+        {0x000083b4, 0x33332210},
+        {0x000083b8, 0x33332210},
+        {0x000083bc, 0x00000000},
+        {0x000083c0, 0x00000000},
+        {0x000083c4, 0x00000000},
+        {0x000083c8, 0x00000000},
+        {0x000083cc, 0x00000200},
+        {0x000083d0, 0x8c7901ff},
+};
+
+static const u32 qca953x_1p0_baseband_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00009800, 0xafe68e30},
+        {0x00009804, 0xfd14e000},
+        {0x00009808, 0x9c0a9f6b},
+        {0x0000980c, 0x04900000},
+        {0x00009814, 0x0280c00a},
+        {0x00009818, 0x00000000},
+        {0x0000981c, 0x00020028},
+        {0x00009834, 0x6400a190},
+        {0x00009838, 0x0108ecff},
+        {0x0000983c, 0x14000600},
+        {0x00009880, 0x201fff00},
+        {0x00009884, 0x00001042},
+        {0x000098a4, 0x00200400},
+        {0x000098b0, 0x32840bbe},
+        {0x000098bc, 0x00000002},
+        {0x000098d0, 0x004b6a8e},
+        {0x000098d4, 0x00000820},
+        {0x000098dc, 0x00000000},
+        {0x000098f0, 0x00000000},
+        {0x000098f4, 0x00000000},
+        {0x00009c04, 0xff55ff55},
+        {0x00009c08, 0x0320ff55},
+        {0x00009c0c, 0x00000000},
+        {0x00009c10, 0x00000000},
+        {0x00009c14, 0x00046384},
+        {0x00009c18, 0x05b6b440},
+        {0x00009c1c, 0x00b6b440},
+        {0x00009d00, 0xc080a333},
+        {0x00009d04, 0x40206c10},
+        {0x00009d08, 0x009c4060},
+        {0x00009d0c, 0x9883800a},
+        {0x00009d10, 0x01884061},
+        {0x00009d14, 0x00c0040b},
+        {0x00009d18, 0x00000000},
+        {0x00009e08, 0x0038230c},
+        {0x00009e24, 0x990bb515},
+        {0x00009e28, 0x0c6f0000},
+        {0x00009e30, 0x06336f77},
+        {0x00009e34, 0x6af6532f},
+        {0x00009e38, 0x0cc80c00},
+        {0x00009e40, 0x0d261820},
+        {0x00009e4c, 0x00001004},
+        {0x00009e50, 0x00ff03f1},
+        {0x00009fc0, 0x813e4788},
+        {0x00009fc4, 0x0001efb5},
+        {0x00009fcc, 0x40000014},
+        {0x00009fd0, 0x01193b91},
+        {0x0000a20c, 0x00000000},
+        {0x0000a220, 0x00000000},
+        {0x0000a224, 0x00000000},
+        {0x0000a228, 0x10002310},
+        {0x0000a23c, 0x00000000},
+        {0x0000a244, 0x0c000000},
+        {0x0000a248, 0x00000140},
+        {0x0000a2a0, 0x00000007},
+        {0x0000a2c0, 0x00000007},
+        {0x0000a2c8, 0x00000000},
+        {0x0000a2d4, 0x00000000},
+        {0x0000a2ec, 0x00000000},
+        {0x0000a2f0, 0x00000000},
+        {0x0000a2f4, 0x00000000},
+        {0x0000a2f8, 0x00000000},
+        {0x0000a344, 0x00000000},
+        {0x0000a34c, 0x00000000},
+        {0x0000a350, 0x0000a000},
+        {0x0000a364, 0x00000000},
+        {0x0000a370, 0x00000000},
+        {0x0000a390, 0x00000001},
+        {0x0000a394, 0x00000444},
+        {0x0000a398, 0x1f020503},
+        {0x0000a39c, 0x29180c03},
+        {0x0000a3a0, 0x9a8b6844},
+        {0x0000a3a4, 0x000000ff},
+        {0x0000a3a8, 0x6a6a6a6a},
+        {0x0000a3ac, 0x6a6a6a6a},
+        {0x0000a3b0, 0x00c8641a},
+        {0x0000a3b4, 0x0000001a},
+        {0x0000a3b8, 0x0088642a},
+        {0x0000a3bc, 0x000001fa},
+        {0x0000a3c0, 0x20202020},
+        {0x0000a3c4, 0x22222220},
+        {0x0000a3c8, 0x20200020},
+        {0x0000a3cc, 0x20202020},
+        {0x0000a3d0, 0x20202020},
+        {0x0000a3d4, 0x20202020},
+        {0x0000a3d8, 0x20202020},
+        {0x0000a3dc, 0x20202020},
+        {0x0000a3e0, 0x20202020},
+        {0x0000a3e4, 0x20202020},
+        {0x0000a3e8, 0x20202020},
+        {0x0000a3ec, 0x20202020},
+        {0x0000a3f0, 0x00000000},
+        {0x0000a3f4, 0x00000000},
+        {0x0000a3f8, 0x0c9bd380},
+        {0x0000a3fc, 0x000f0f01},
+        {0x0000a400, 0x8fa91f01},
+        {0x0000a404, 0x00000000},
+        {0x0000a408, 0x0e79e5c6},
+        {0x0000a40c, 0x00820820},
+        {0x0000a414, 0x1ce42108},
+        {0x0000a418, 0x2d001dce},
+        {0x0000a41c, 0x1ce73908},
+        {0x0000a420, 0x000001ce},
+        {0x0000a424, 0x1ce738e7},
+        {0x0000a428, 0x000001ce},
+        {0x0000a42c, 0x1ce739ce},
+        {0x0000a430, 0x1ce739ce},
+        {0x0000a434, 0x00000000},
+        {0x0000a438, 0x00001801},
+        {0x0000a43c, 0x00100000},
+        {0x0000a444, 0x00000000},
+        {0x0000a448, 0x05000080},
+        {0x0000a44c, 0x00000001},
+        {0x0000a450, 0x00010000},
+        {0x0000a458, 0x00000000},
+        {0x0000a644, 0xbfad9d74},
+        {0x0000a648, 0x0048060a},
+        {0x0000a64c, 0x00003c37},
+        {0x0000a670, 0x03020100},
+        {0x0000a674, 0x09080504},
+        {0x0000a678, 0x0d0c0b0a},
+        {0x0000a67c, 0x13121110},
+        {0x0000a680, 0x31301514},
+        {0x0000a684, 0x35343332},
+        {0x0000a688, 0x00000036},
+        {0x0000a690, 0x08000838},
+        {0x0000a7cc, 0x00000000},
+        {0x0000a7d0, 0x00000000},
+        {0x0000a7d4, 0x00000004},
+        {0x0000a7dc, 0x00000000},
+        {0x0000a8d0, 0x004b6a8e},
+        {0x0000a8d4, 0x00000820},
+        {0x0000a8dc, 0x00000000},
+        {0x0000a8f0, 0x00000000},
+        {0x0000a8f4, 0x00000000},
+        {0x0000b2d0, 0x00000080},
+        {0x0000b2d4, 0x00000000},
+        {0x0000b2ec, 0x00000000},
+        {0x0000b2f0, 0x00000000},
+        {0x0000b2f4, 0x00000000},
+        {0x0000b2f8, 0x00000000},
+        {0x0000b408, 0x0e79e5c0},
+        {0x0000b40c, 0x00820820},
+        {0x0000b420, 0x00000000},
+};
+
+static const u32 qca953x_1p0_baseband_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8011, 0xd00a8011},
+        {0x00009820, 0x206a022e, 0x206a022e, 0x206a012e, 0x206a012e},
+        {0x00009824, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0},
+        {0x00009828, 0x06903081, 0x06903081, 0x06903881, 0x06903881},
+        {0x0000982c, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4},
+        {0x00009830, 0x0000059c, 0x0000059c, 0x0000119c, 0x0000119c},
+        {0x00009c00, 0x000000c4, 0x000000c4, 0x000000c4, 0x000000c4},
+        {0x00009e00, 0x0372111a, 0x0372111a, 0x037216a0, 0x037216a0},
+        {0x00009e04, 0x001c2020, 0x001c2020, 0x001c2020, 0x001c2020},
+        {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000e2, 0x6c4000e2},
+        {0x00009e10, 0x7ec88d2e, 0x7ec88d2e, 0x7ec84d2e, 0x7ec84d2e},
+        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3379605e, 0x33795d5e},
+        {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
+        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
+        {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
+        {0x00009e3c, 0xcfa10820, 0xcfa10820, 0xcfa10822, 0xcfa10822},
+        {0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27},
+        {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
+        {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
+        {0x0000a204, 0x005c0ec0, 0x005c0ec4, 0x005c0ec4, 0x005c0ec0},
+        {0x0000a208, 0x00000104, 0x00000104, 0x00000004, 0x00000004},
+        {0x0000a22c, 0x07e26a2f, 0x07e26a2f, 0x01026a2f, 0x01026a2f},
+        {0x0000a230, 0x0000000a, 0x00000014, 0x00000016, 0x0000000b},
+        {0x0000a234, 0x00000fff, 0x10000fff, 0x10000fff, 0x00000fff},
+        {0x0000a238, 0xffb01018, 0xffb01018, 0xffb01018, 0xffb01018},
+        {0x0000a250, 0x00000000, 0x00000000, 0x00000210, 0x00000108},
+        {0x0000a254, 0x000007d0, 0x00000fa0, 0x00001130, 0x00000898},
+        {0x0000a258, 0x02020002, 0x02020002, 0x02020002, 0x02020002},
+        {0x0000a25c, 0x01000e0e, 0x01000e0e, 0x01010e0e, 0x01010e0e},
+        {0x0000a260, 0x0a021501, 0x0a021501, 0x3a021501, 0x3a021501},
+        {0x0000a264, 0x00000e0e, 0x00000e0e, 0x01000e0e, 0x01000e0e},
+        {0x0000a280, 0x00000007, 0x00000007, 0x0000000b, 0x0000000b},
+        {0x0000a284, 0x00000000, 0x00000000, 0x00000010, 0x00000010},
+        {0x0000a288, 0x00000110, 0x00000110, 0x00000110, 0x00000110},
+        {0x0000a28c, 0x00022222, 0x00022222, 0x00022222, 0x00022222},
+        {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00158d18, 0x00158d18},
+        {0x0000a2cc, 0x18c50033, 0x18c43433, 0x18c41033, 0x18c44c33},
+        {0x0000a2d0, 0x00041982, 0x00041982, 0x00041982, 0x00041982},
+        {0x0000a2d8, 0x7999a83b, 0x7999a83b, 0x7999a83b, 0x7999a83b},
+        {0x0000a358, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000ae04, 0x001c0000, 0x001c0000, 0x001c0000, 0x001c0000},
+        {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
+        {0x0000b284, 0x00000000, 0x00000000, 0x00000010, 0x00000010},
+};
+
+static const u32 qca953x_1p0_radio_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00016000, 0x36db6db6},
+        {0x00016004, 0x6db6db40},
+        {0x00016008, 0x73f00000},
+        {0x0001600c, 0x00000000},
+        {0x00016040, 0x3f80fff8},
+        {0x0001604c, 0x000f0278},
+        {0x00016050, 0x8036db6c},
+        {0x00016054, 0x6db60000},
+        {0x00016080, 0x00080000},
+        {0x00016084, 0x0e48048c},
+        {0x00016088, 0x14214514},
+        {0x0001608c, 0x119f080a},
+        {0x00016090, 0x24926490},
+        {0x00016094, 0x00000000},
+        {0x000160a0, 0xc2108ffe},
+        {0x000160a4, 0x812fc370},
+        {0x000160a8, 0x423c8000},
+        {0x000160b4, 0x92480080},
+        {0x000160c0, 0x006db6d8},
+        {0x000160c4, 0x24b6db6c},
+        {0x000160c8, 0x6db6db6c},
+        {0x000160cc, 0x6db6fb7c},
+        {0x000160d0, 0x6db6da44},
+        {0x00016100, 0x07ff8001},
+        {0x00016108, 0x00080010},
+        {0x00016144, 0x01884080},
+        {0x00016148, 0x000080d8},
+        {0x00016280, 0x01000901},
+        {0x00016284, 0x15d30000},
+        {0x00016288, 0x00318000},
+        {0x0001628c, 0x50000000},
+        {0x00016380, 0x00000000},
+        {0x00016384, 0x00000000},
+        {0x00016388, 0x00800700},
+        {0x0001638c, 0x00800700},
+        {0x00016390, 0x00800700},
+        {0x00016394, 0x00000000},
+        {0x00016398, 0x00000000},
+        {0x0001639c, 0x00000000},
+        {0x000163a0, 0x00000001},
+        {0x000163a4, 0x00000001},
+        {0x000163a8, 0x00000000},
+        {0x000163ac, 0x00000000},
+        {0x000163b0, 0x00000000},
+        {0x000163b4, 0x00000000},
+        {0x000163b8, 0x00000000},
+        {0x000163bc, 0x00000000},
+        {0x000163c0, 0x000000a0},
+        {0x000163c4, 0x000c0000},
+        {0x000163c8, 0x14021402},
+        {0x000163cc, 0x00001402},
+        {0x000163d0, 0x00000000},
+        {0x000163d4, 0x00000000},
+        {0x00016400, 0x36db6db6},
+        {0x00016404, 0x6db6db40},
+        {0x00016408, 0x73f00000},
+        {0x0001640c, 0x00000000},
+        {0x00016440, 0x3f80fff8},
+        {0x0001644c, 0x000f0278},
+        {0x00016450, 0x8036db6c},
+        {0x00016454, 0x6db60000},
+        {0x00016500, 0x07ff8001},
+        {0x00016508, 0x00080010},
+        {0x00016544, 0x01884080},
+        {0x00016548, 0x000080d8},
+        {0x00016780, 0x00000000},
+        {0x00016784, 0x00000000},
+        {0x00016788, 0x00800700},
+        {0x0001678c, 0x00800700},
+        {0x00016790, 0x00800700},
+        {0x00016794, 0x00000000},
+        {0x00016798, 0x00000000},
+        {0x0001679c, 0x00000000},
+        {0x000167a0, 0x00000001},
+        {0x000167a4, 0x00000001},
+        {0x000167a8, 0x00000000},
+        {0x000167ac, 0x00000000},
+        {0x000167b0, 0x00000000},
+        {0x000167b4, 0x00000000},
+        {0x000167b8, 0x00000000},
+        {0x000167bc, 0x00000000},
+        {0x000167c0, 0x000000a0},
+        {0x000167c4, 0x000c0000},
+        {0x000167c8, 0x14021402},
+        {0x000167cc, 0x00001402},
+        {0x000167d0, 0x00000000},
+        {0x000167d4, 0x00000000},
+};
+
+static const u32 qca953x_1p0_radio_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00016098, 0xd2dd5554, 0xd2dd5554, 0xc4128f5c, 0xc4128f5c},
+        {0x0001609c, 0x0a566f3a, 0x0a566f3a, 0x0fd08f25, 0x0fd08f25},
+        {0x000160ac, 0xa4647c00, 0xa4647c00, 0x24646800, 0x24646800},
+        {0x000160b0, 0x01885f52, 0x01885f52, 0x00fe7f46, 0x00fe7f46},
+        {0x00016104, 0xb7a00001, 0xb7a00001, 0xfff80005, 0xfff80005},
+        {0x0001610c, 0xc0000000, 0xc0000000, 0x00000000, 0x00000000},
+        {0x00016140, 0x10804008, 0x10804008, 0x50804000, 0x50804000},
+        {0x00016504, 0xb7a00001, 0xb7a00001, 0xfff80001, 0xfff80001},
+        {0x0001650c, 0xc0000000, 0xc0000000, 0x00000000, 0x00000000},
+        {0x00016540, 0x10804008, 0x10804008, 0x50804000, 0x50804000},
+};
+
+static const u32 qca953x_1p0_soc_preamble[][2] = {
+        /* Addr      allmodes  */
+        {0x00007000, 0x00000000},
+        {0x00007004, 0x00000000},
+        {0x00007008, 0x00000000},
+        {0x0000700c, 0x00000000},
+        {0x0000701c, 0x00000000},
+        {0x00007020, 0x00000000},
+        {0x00007024, 0x00000000},
+        {0x00007028, 0x00000000},
+        {0x0000702c, 0x00000000},
+        {0x00007030, 0x00000000},
+        {0x00007034, 0x00000002},
+        {0x00007038, 0x000004c2},
+        {0x00007048, 0x00000000},
+};
+
+static const u32 qca953x_1p0_common_rx_gain_bounds[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27},
+        {0x00009e48, 0x5030201a, 0x5030201a, 0x50302018, 0x50302018},
+};
+
+static const u32 qca953x_1p0_common_wo_xlna_rx_gain_bounds[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27},
+        {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
+};
+
+static const u32 qca953x_1p0_modes_xpa_tx_gain_table[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a2dc, 0xfffd5aaa},
+        {0x0000a2e0, 0xfffe9ccc},
+        {0x0000a2e4, 0xffffe0f0},
+        {0x0000a2e8, 0xfffcff00},
+        {0x0000a410, 0x000050da},
+        {0x0000a500, 0x00000000},
+        {0x0000a504, 0x04000002},
+        {0x0000a508, 0x08000004},
+        {0x0000a50c, 0x0c000006},
+        {0x0000a510, 0x0f00000a},
+        {0x0000a514, 0x1300000c},
+        {0x0000a518, 0x1700000e},
+        {0x0000a51c, 0x1b000064},
+        {0x0000a520, 0x1f000242},
+        {0x0000a524, 0x23000229},
+        {0x0000a528, 0x270002a2},
+        {0x0000a52c, 0x2c001203},
+        {0x0000a530, 0x30001803},
+        {0x0000a534, 0x33000881},
+        {0x0000a538, 0x38001809},
+        {0x0000a53c, 0x3a000814},
+        {0x0000a540, 0x3f001a0c},
+        {0x0000a544, 0x43001a0e},
+        {0x0000a548, 0x46001812},
+        {0x0000a54c, 0x49001884},
+        {0x0000a550, 0x4d001e84},
+        {0x0000a554, 0x50001e69},
+        {0x0000a558, 0x550006f4},
+        {0x0000a55c, 0x59000ad3},
+        {0x0000a560, 0x5e000ad5},
+        {0x0000a564, 0x61001ced},
+        {0x0000a568, 0x660018d4},
+        {0x0000a56c, 0x660018d4},
+        {0x0000a570, 0x660018d4},
+        {0x0000a574, 0x660018d4},
+        {0x0000a578, 0x660018d4},
+        {0x0000a57c, 0x660018d4},
+        {0x0000a600, 0x00000000},
+        {0x0000a604, 0x00000000},
+        {0x0000a608, 0x00000000},
+        {0x0000a60c, 0x03804000},
+        {0x0000a610, 0x0300ca02},
+        {0x0000a614, 0x00000e04},
+        {0x0000a618, 0x03014000},
+        {0x0000a61c, 0x00000000},
+        {0x0000a620, 0x00000000},
+        {0x0000a624, 0x03014000},
+        {0x0000a628, 0x03804c05},
+        {0x0000a62c, 0x0701de06},
+        {0x0000a630, 0x07819c07},
+        {0x0000a634, 0x0701dc07},
+        {0x0000a638, 0x0701dc07},
+        {0x0000a63c, 0x0701dc07},
+        {0x0000b2dc, 0xfffd5aaa},
+        {0x0000b2e0, 0xfffe9ccc},
+        {0x0000b2e4, 0xffffe0f0},
+        {0x0000b2e8, 0xfffcff00},
+        {0x00016044, 0x010002d4},
+        {0x00016048, 0x66482400},
+        {0x00016280, 0x01000015},
+        {0x00016444, 0x010002d4},
+        {0x00016448, 0x66482400},
+};
+
+static const u32 qca953x_1p0_modes_no_xpa_tx_gain_table[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a2dc, 0xffd5f552},
+        {0x0000a2e0, 0xffe60664},
+        {0x0000a2e4, 0xfff80780},
+        {0x0000a2e8, 0xfffff800},
+        {0x0000a410, 0x000050d6},
+        {0x0000a500, 0x00060020},
+        {0x0000a504, 0x04060060},
+        {0x0000a508, 0x080600a0},
+        {0x0000a50c, 0x0c068020},
+        {0x0000a510, 0x10068060},
+        {0x0000a514, 0x140680a0},
+        {0x0000a518, 0x18090040},
+        {0x0000a51c, 0x1b090080},
+        {0x0000a520, 0x1f0900c0},
+        {0x0000a524, 0x240c0041},
+        {0x0000a528, 0x280d0021},
+        {0x0000a52c, 0x2d0f0061},
+        {0x0000a530, 0x310f00a1},
+        {0x0000a534, 0x350e00a2},
+        {0x0000a538, 0x360e80a2},
+        {0x0000a53c, 0x380f00a2},
+        {0x0000a540, 0x3b0e00a3},
+        {0x0000a544, 0x3d110083},
+        {0x0000a548, 0x3e1100a3},
+        {0x0000a54c, 0x401100e3},
+        {0x0000a550, 0x421380e3},
+        {0x0000a554, 0x431780e3},
+        {0x0000a558, 0x461f80e3},
+        {0x0000a55c, 0x461f80e3},
+        {0x0000a560, 0x461f80e3},
+        {0x0000a564, 0x461f80e3},
+        {0x0000a568, 0x461f80e3},
+        {0x0000a56c, 0x461f80e3},
+        {0x0000a570, 0x461f80e3},
+        {0x0000a574, 0x461f80e3},
+        {0x0000a578, 0x461f80e3},
+        {0x0000a57c, 0x461f80e3},
+        {0x0000a600, 0x00000000},
+        {0x0000a604, 0x00000000},
+        {0x0000a608, 0x00000000},
+        {0x0000a60c, 0x00804201},
+        {0x0000a610, 0x01008201},
+        {0x0000a614, 0x0180c402},
+        {0x0000a618, 0x0180c603},
+        {0x0000a61c, 0x0180c603},
+        {0x0000a620, 0x01c10603},
+        {0x0000a624, 0x01c10704},
+        {0x0000a628, 0x02c18b05},
+        {0x0000a62c, 0x0301cc07},
+        {0x0000a630, 0x0301cc07},
+        {0x0000a634, 0x0301cc07},
+        {0x0000a638, 0x0301cc07},
+        {0x0000a63c, 0x0301cc07},
+        {0x0000b2dc, 0xffd5f552},
+        {0x0000b2e0, 0xffe60664},
+        {0x0000b2e4, 0xfff80780},
+        {0x0000b2e8, 0xfffff800},
+        {0x00016044, 0x049242db},
+        {0x00016048, 0x6c927a70},
+        {0x00016444, 0x049242db},
+        {0x00016448, 0x6c927a70},
+};
+
+static const u32 qca953x_1p1_modes_no_xpa_tx_gain_table[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a2dc, 0xffd5f552},
+        {0x0000a2e0, 0xffe60664},
+        {0x0000a2e4, 0xfff80780},
+        {0x0000a2e8, 0xfffff800},
+        {0x0000a410, 0x000050de},
+        {0x0000a500, 0x00000061},
+        {0x0000a504, 0x04000063},
+        {0x0000a508, 0x08000065},
+        {0x0000a50c, 0x0c000261},
+        {0x0000a510, 0x10000263},
+        {0x0000a514, 0x14000265},
+        {0x0000a518, 0x18000482},
+        {0x0000a51c, 0x1b000484},
+        {0x0000a520, 0x1f000486},
+        {0x0000a524, 0x240008c2},
+        {0x0000a528, 0x28000cc1},
+        {0x0000a52c, 0x2d000ce3},
+        {0x0000a530, 0x31000ce5},
+        {0x0000a534, 0x350010e5},
+        {0x0000a538, 0x360012e5},
+        {0x0000a53c, 0x380014e5},
+        {0x0000a540, 0x3b0018e5},
+        {0x0000a544, 0x3d001d04},
+        {0x0000a548, 0x3e001d05},
+        {0x0000a54c, 0x40001d07},
+        {0x0000a550, 0x42001f27},
+        {0x0000a554, 0x43001f67},
+        {0x0000a558, 0x46001fe7},
+        {0x0000a55c, 0x47001f2b},
+        {0x0000a560, 0x49001f0d},
+        {0x0000a564, 0x4b001ed2},
+        {0x0000a568, 0x4c001ed4},
+        {0x0000a56c, 0x4e001f15},
+        {0x0000a570, 0x4f001ff6},
+        {0x0000a574, 0x4f001ff6},
+        {0x0000a578, 0x4f001ff6},
+        {0x0000a57c, 0x4f001ff6},
+        {0x0000a600, 0x00000000},
+        {0x0000a604, 0x00000000},
+        {0x0000a608, 0x00000000},
+        {0x0000a60c, 0x00804201},
+        {0x0000a610, 0x01008201},
+        {0x0000a614, 0x0180c402},
+        {0x0000a618, 0x0180c603},
+        {0x0000a61c, 0x0180c603},
+        {0x0000a620, 0x01c10603},
+        {0x0000a624, 0x01c10704},
+        {0x0000a628, 0x02c18b05},
+        {0x0000a62c, 0x02c14c07},
+        {0x0000a630, 0x01008704},
+        {0x0000a634, 0x01c10402},
+        {0x0000a638, 0x0301cc07},
+        {0x0000a63c, 0x0301cc07},
+        {0x0000b2dc, 0xffd5f552},
+        {0x0000b2e0, 0xffe60664},
+        {0x0000b2e4, 0xfff80780},
+        {0x0000b2e8, 0xfffff800},
+        {0x00016044, 0x049242db},
+        {0x00016048, 0x6c927a70},
+        {0x00016444, 0x049242db},
+        {0x00016448, 0x6c927a70},
+};
+
+#endif /* INITVALS_953X_H */
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index f2202e78fa7b..f622a986c8cc 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -455,10 +455,8 @@ bool ath9k_csa_is_finished(struct ath_softc *sc);
 
 void ath_tx_complete_poll_work(struct work_struct *work);
 void ath_reset_work(struct work_struct *work);
-void ath_hw_check(struct work_struct *work);
+bool ath_hw_check(struct ath_softc *sc);
 void ath_hw_pll_work(struct work_struct *work);
-void ath_rx_poll(unsigned long data);
-void ath_start_rx_poll(struct ath_softc *sc, u8 nbeacon);
 void ath_paprd_calibrate(struct work_struct *work);
 void ath_ani_calibrate(unsigned long data);
 void ath_start_ani(struct ath_softc *sc);
@@ -722,12 +720,10 @@ struct ath_softc {
         spinlock_t sc_pcu_lock;
         struct mutex mutex;
         struct work_struct paprd_work;
-        struct work_struct hw_check_work;
         struct work_struct hw_reset_work;
         struct completion paprd_complete;
         wait_queue_head_t tx_wait;
 
-        unsigned int hw_busy_count;
         unsigned long sc_flags;
         unsigned long driver_data;
 
@@ -761,7 +757,6 @@ struct ath_softc {
         struct ath_beacon_config cur_beacon_conf;
         struct delayed_work tx_complete_work;
         struct delayed_work hw_pll_work;
-        struct timer_list rx_poll_timer;
         struct timer_list sleep_timer;
 
 #ifdef CONFIG_ATH9K_BTCOEX_SUPPORT
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index 112aff720e13..2e8bba0eb361 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -337,8 +337,14 @@ void ath9k_beacon_tasklet(unsigned long data)
 
                 ath9k_hw_check_nav(ah);
 
-                if (!ath9k_hw_check_alive(ah))
-                        ieee80211_queue_work(sc->hw, &sc->hw_check_work);
+                /*
+                 * If the previous beacon has not been transmitted
+                 * and a MAC/BB hang has been identified, return
+                 * here because a chip reset would have been
+                 * initiated.
+                 */
+                if (!ath_hw_check(sc))
+                        return;
 
                 if (sc->beacon.bmisscnt < BSTUCK_THRESH * sc->nbcnvifs) {
                         ath_dbg(common, BSTUCK,
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index c028df76b564..b41e008298dc 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -1077,7 +1077,7 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
 
         if (ieee80211_is_beacon(hdr->frame_control) &&
             !is_zero_ether_addr(common->curbssid) &&
-            ether_addr_equal(hdr->addr3, common->curbssid)) {
+            ether_addr_equal_64bits(hdr->addr3, common->curbssid)) {
                 s8 rssi = rxbuf->rxstatus.rs_rssi;
 
                 if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
diff --git a/drivers/net/wireless/ath/ath9k/hw-ops.h b/drivers/net/wireless/ath/ath9k/hw-ops.h
index cc58a8ee1223..a47ea8423f1e 100644
--- a/drivers/net/wireless/ath/ath9k/hw-ops.h
+++ b/drivers/net/wireless/ath/ath9k/hw-ops.h
@@ -107,6 +107,21 @@ static inline void ath9k_hw_set_bt_ant_diversity(struct ath_hw *ah, bool enable)
 
 /* Private hardware call ops */
 
+static inline void ath9k_hw_init_hang_checks(struct ath_hw *ah)
+{
+        ath9k_hw_private_ops(ah)->init_hang_checks(ah);
+}
+
+static inline bool ath9k_hw_detect_mac_hang(struct ath_hw *ah)
+{
+        return ath9k_hw_private_ops(ah)->detect_mac_hang(ah);
+}
+
+static inline bool ath9k_hw_detect_bb_hang(struct ath_hw *ah)
+{
+        return ath9k_hw_private_ops(ah)->detect_bb_hang(ah);
+}
+
 /* PHY ops */
 
 static inline int ath9k_hw_rf_set_freq(struct ath_hw *ah,
@@ -232,4 +247,31 @@ static inline void ath9k_hw_set_radar_params(struct ath_hw *ah)
         ath9k_hw_private_ops(ah)->set_radar_params(ah, &ah->radar_conf);
 }
 
+static inline void ath9k_hw_init_cal_settings(struct ath_hw *ah)
+{
+        ath9k_hw_private_ops(ah)->init_cal_settings(ah);
+}
+
+static inline u32 ath9k_hw_compute_pll_control(struct ath_hw *ah,
+                                               struct ath9k_channel *chan)
+{
+        return ath9k_hw_private_ops(ah)->compute_pll_control(ah, chan);
+}
+
+static inline void ath9k_hw_init_mode_gain_regs(struct ath_hw *ah)
+{
+        if (!ath9k_hw_private_ops(ah)->init_mode_gain_regs)
+                return;
+
+        ath9k_hw_private_ops(ah)->init_mode_gain_regs(ah);
+}
+
+static inline void ath9k_hw_ani_cache_ini_regs(struct ath_hw *ah)
+{
+        if (!ath9k_hw_private_ops(ah)->ani_cache_ini_regs)
+                return;
+
+        ath9k_hw_private_ops(ah)->ani_cache_ini_regs(ah);
+}
+
 #endif /* ATH9K_HW_OPS_H */
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index a4b1ae026216..ce41658a6003 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -37,57 +37,6 @@ MODULE_DESCRIPTION("Support for Atheros 802.11n wireless LAN cards.");
 MODULE_SUPPORTED_DEVICE("Atheros 802.11n WLAN cards");
 MODULE_LICENSE("Dual BSD/GPL");
 
-static int __init ath9k_init(void)
-{
-        return 0;
-}
-module_init(ath9k_init);
-
-static void __exit ath9k_exit(void)
-{
-        return;
-}
-module_exit(ath9k_exit);
-
-/* Private hardware callbacks */
-
-static void ath9k_hw_init_cal_settings(struct ath_hw *ah)
-{
-        ath9k_hw_private_ops(ah)->init_cal_settings(ah);
-}
-
-static u32 ath9k_hw_compute_pll_control(struct ath_hw *ah,
-                                        struct ath9k_channel *chan)
-{
-        return ath9k_hw_private_ops(ah)->compute_pll_control(ah, chan);
-}
-
-static void ath9k_hw_init_mode_gain_regs(struct ath_hw *ah)
-{
-        if (!ath9k_hw_private_ops(ah)->init_mode_gain_regs)
-                return;
-
-        ath9k_hw_private_ops(ah)->init_mode_gain_regs(ah);
-}
-
-static void ath9k_hw_ani_cache_ini_regs(struct ath_hw *ah)
-{
-        /* You will not have this callback if using the old ANI */
-        if (!ath9k_hw_private_ops(ah)->ani_cache_ini_regs)
-                return;
-
-        ath9k_hw_private_ops(ah)->ani_cache_ini_regs(ah);
-}
-
-/********************/
-/* Helper Functions */
-/********************/
-
-#ifdef CONFIG_ATH9K_DEBUGFS
-
-#endif
-
-
 static void ath9k_hw_set_clockrate(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
@@ -296,6 +245,9 @@ static void ath9k_hw_read_revisions(struct ath_hw *ah)
         case AR9300_DEVID_QCA955X:
                 ah->hw_version.macVersion = AR_SREV_VERSION_9550;
                 return;
+        case AR9300_DEVID_AR953X:
+                ah->hw_version.macVersion = AR_SREV_VERSION_9531;
+                return;
         }
 
         val = REG_READ(ah, AR_SREV) & AR_SREV_ID;
@@ -397,9 +349,10 @@ static bool ath9k_hw_chip_test(struct ath_hw *ah)
 
 static void ath9k_hw_init_config(struct ath_hw *ah)
 {
+        struct ath_common *common = ath9k_hw_common(ah);
+
         ah->config.dma_beacon_response_time = 1;
         ah->config.sw_beacon_response_time = 6;
-        ah->config.ack_6mb = 0x0;
         ah->config.cwm_ignore_extcca = 0;
         ah->config.analog_shiftreg = 1;
 
@@ -423,6 +376,24 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
          */
         if (num_possible_cpus() > 1)
                 ah->config.serialize_regmode = SER_REG_MODE_AUTO;
+
+        if (NR_CPUS > 1 && ah->config.serialize_regmode == SER_REG_MODE_AUTO) {
+                if (ah->hw_version.macVersion == AR_SREV_VERSION_5416_PCI ||
+                    ((AR_SREV_9160(ah) || AR_SREV_9280(ah) || AR_SREV_9287(ah)) &&
+                     !ah->is_pciexpress)) {
+                        ah->config.serialize_regmode = SER_REG_MODE_ON;
+                } else {
+                        ah->config.serialize_regmode = SER_REG_MODE_OFF;
+                }
+        }
+
+        ath_dbg(common, RESET, "serialize_regmode is %d\n",
+                ah->config.serialize_regmode);
+
+        if (AR_SREV_9285(ah) || AR_SREV_9271(ah))
+                ah->config.max_txtrig_level = MAX_TX_FIFO_THRESHOLD >> 1;
+        else
+                ah->config.max_txtrig_level = MAX_TX_FIFO_THRESHOLD;
 }
 
 static void ath9k_hw_init_defaults(struct ath_hw *ah)
@@ -435,15 +406,24 @@ static void ath9k_hw_init_defaults(struct ath_hw *ah)
         ah->hw_version.magic = AR5416_MAGIC;
         ah->hw_version.subvendorid = 0;
 
-        ah->sta_id1_defaults =
-                AR_STA_ID1_CRPT_MIC_ENABLE |
-                AR_STA_ID1_MCAST_KSRCH;
+        ah->sta_id1_defaults = AR_STA_ID1_CRPT_MIC_ENABLE |
+                               AR_STA_ID1_MCAST_KSRCH;
         if (AR_SREV_9100(ah))
                 ah->sta_id1_defaults |= AR_STA_ID1_AR9100_BA_FIX;
+
         ah->slottime = ATH9K_SLOT_TIME_9;
         ah->globaltxtimeout = (u32) -1;
         ah->power_mode = ATH9K_PM_UNDEFINED;
         ah->htc_reset_init = true;
+
+        ah->ani_function = ATH9K_ANI_ALL;
+        if (!AR_SREV_9300_20_OR_LATER(ah))
+                ah->ani_function &= ~ATH9K_ANI_MRC_CCK;
+
+        if (AR_SREV_9285(ah) || AR_SREV_9271(ah))
+                ah->tx_trig_level = (AR_FTRIG_256B >> AR_FTRIG_S);
+        else
+                ah->tx_trig_level = (AR_FTRIG_512B >> AR_FTRIG_S);
 }
 
 static int ath9k_hw_init_macaddr(struct ath_hw *ah)
@@ -525,6 +505,31 @@ static int __ath9k_hw_init(struct ath_hw *ah)
 
         ath9k_hw_read_revisions(ah);
 
+        switch (ah->hw_version.macVersion) {
+        case AR_SREV_VERSION_5416_PCI:
+        case AR_SREV_VERSION_5416_PCIE:
+        case AR_SREV_VERSION_9160:
+        case AR_SREV_VERSION_9100:
+        case AR_SREV_VERSION_9280:
+        case AR_SREV_VERSION_9285:
+        case AR_SREV_VERSION_9287:
+        case AR_SREV_VERSION_9271:
+        case AR_SREV_VERSION_9300:
+        case AR_SREV_VERSION_9330:
+        case AR_SREV_VERSION_9485:
+        case AR_SREV_VERSION_9340:
+        case AR_SREV_VERSION_9462:
+        case AR_SREV_VERSION_9550:
+        case AR_SREV_VERSION_9565:
+        case AR_SREV_VERSION_9531:
+                break;
+        default:
+                ath_err(common,
+                        "Mac Chip Rev 0x%02x.%x is not supported by this driver\n",
+                        ah->hw_version.macVersion, ah->hw_version.macRev);
+                return -EOPNOTSUPP;
+        }
+
         /*
          * Read back AR_WA into a permanent copy and set bits 14 and 17.
          * We need to do this to avoid RMW of this register. We cannot
@@ -558,50 +563,6 @@ static int __ath9k_hw_init(struct ath_hw *ah)
                 return -EIO;
         }
 
-        if (NR_CPUS > 1 && ah->config.serialize_regmode == SER_REG_MODE_AUTO) {
-                if (ah->hw_version.macVersion == AR_SREV_VERSION_5416_PCI ||
-                    ((AR_SREV_9160(ah) || AR_SREV_9280(ah) || AR_SREV_9287(ah)) &&
-                     !ah->is_pciexpress)) {
-                        ah->config.serialize_regmode =
-                                SER_REG_MODE_ON;
-                } else {
-                        ah->config.serialize_regmode =
-                                SER_REG_MODE_OFF;
-                }
-        }
-
-        ath_dbg(common, RESET, "serialize_regmode is %d\n",
-                ah->config.serialize_regmode);
-
-        if (AR_SREV_9285(ah) || AR_SREV_9271(ah))
-                ah->config.max_txtrig_level = MAX_TX_FIFO_THRESHOLD >> 1;
-        else
-                ah->config.max_txtrig_level = MAX_TX_FIFO_THRESHOLD;
-
-        switch (ah->hw_version.macVersion) {
-        case AR_SREV_VERSION_5416_PCI:
-        case AR_SREV_VERSION_5416_PCIE:
-        case AR_SREV_VERSION_9160:
-        case AR_SREV_VERSION_9100:
-        case AR_SREV_VERSION_9280:
-        case AR_SREV_VERSION_9285:
-        case AR_SREV_VERSION_9287:
-        case AR_SREV_VERSION_9271:
-        case AR_SREV_VERSION_9300:
-        case AR_SREV_VERSION_9330:
-        case AR_SREV_VERSION_9485:
-        case AR_SREV_VERSION_9340:
-        case AR_SREV_VERSION_9462:
-        case AR_SREV_VERSION_9550:
-        case AR_SREV_VERSION_9565:
-                break;
-        default:
-                ath_err(common,
-                        "Mac Chip Rev 0x%02x.%x is not supported by this driver\n",
-                        ah->hw_version.macVersion, ah->hw_version.macRev);
-                return -EOPNOTSUPP;
-        }
-
         if (AR_SREV_9271(ah) || AR_SREV_9100(ah) || AR_SREV_9340(ah) ||
             AR_SREV_9330(ah) || AR_SREV_9550(ah))
                 ah->is_pciexpress = false;
@@ -609,10 +570,6 @@ static int __ath9k_hw_init(struct ath_hw *ah)
         ah->hw_version.phyRev = REG_READ(ah, AR_PHY_CHIP_ID);
         ath9k_hw_init_cal_settings(ah);
 
-        ah->ani_function = ATH9K_ANI_ALL;
-        if (!AR_SREV_9300_20_OR_LATER(ah))
-                ah->ani_function &= ~ATH9K_ANI_MRC_CCK;
-
         if (!ah->is_pciexpress)
                 ath9k_hw_disablepcie(ah);
 
@@ -631,15 +588,7 @@ static int __ath9k_hw_init(struct ath_hw *ah)
                 return r;
         }
 
-        if (AR_SREV_9285(ah) || AR_SREV_9271(ah))
-                ah->tx_trig_level = (AR_FTRIG_256B >> AR_FTRIG_S);
-        else
-                ah->tx_trig_level = (AR_FTRIG_512B >> AR_FTRIG_S);
-
-        if (AR_SREV_9330(ah))
-                ah->bb_watchdog_timeout_ms = 85;
-        else
-                ah->bb_watchdog_timeout_ms = 25;
+        ath9k_hw_init_hang_checks(ah);
 
         common->state = ATH_HW_INITIALIZED;
 
@@ -672,6 +621,7 @@ int ath9k_hw_init(struct ath_hw *ah)
         case AR9300_DEVID_AR9462:
         case AR9485_DEVID_AR1111:
         case AR9300_DEVID_AR9565:
+        case AR9300_DEVID_AR953X:
                 break;
         default:
                 if (common->bus_ops->ath_bus_type == ATH_USB)
@@ -807,7 +757,7 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                 /* program BB PLL phase_shift */
                 REG_RMW_FIELD(ah, AR_CH0_BB_DPLL3,
                               AR_CH0_BB_DPLL3_PHASE_SHIFT, 0x1);
-        } else if (AR_SREV_9340(ah) || AR_SREV_9550(ah)) {
+        } else if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
                 u32 regval, pll2_divint, pll2_divfrac, refdiv;
 
                 REG_WRITE(ah, AR_RTC_PLL_CONTROL, 0x1142c);
@@ -817,9 +767,15 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                 udelay(100);
 
                 if (ah->is_clk_25mhz) {
-                        pll2_divint = 0x54;
-                        pll2_divfrac = 0x1eb85;
-                        refdiv = 3;
+                        if (AR_SREV_9531(ah)) {
+                                pll2_divint = 0x1c;
+                                pll2_divfrac = 0xa3d2;
+                                refdiv = 1;
+                        } else {
+                                pll2_divint = 0x54;
+                                pll2_divfrac = 0x1eb85;
+                                refdiv = 3;
+                        }
                 } else {
                         if (AR_SREV_9340(ah)) {
                                 pll2_divint = 88;
@@ -833,7 +789,10 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                 }
 
                 regval = REG_READ(ah, AR_PHY_PLL_MODE);
-                regval |= (0x1 << 16);
+                if (AR_SREV_9531(ah))
+                        regval |= (0x1 << 22);
+                else
+                        regval |= (0x1 << 16);
                 REG_WRITE(ah, AR_PHY_PLL_MODE, regval);
                 udelay(100);
 
@@ -843,14 +802,33 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
 
                 regval = REG_READ(ah, AR_PHY_PLL_MODE);
                 if (AR_SREV_9340(ah))
-                        regval = (regval & 0x80071fff) | (0x1 << 30) |
-                                 (0x1 << 13) | (0x4 << 26) | (0x18 << 19);
+                        regval = (regval & 0x80071fff) |
+                                (0x1 << 30) |
+                                (0x1 << 13) |
+                                (0x4 << 26) |
+                                (0x18 << 19);
+                else if (AR_SREV_9531(ah))
+                        regval = (regval & 0x01c00fff) |
+                                (0x1 << 31) |
+                                (0x2 << 29) |
+                                (0xa << 25) |
+                                (0x1 << 19) |
+                                (0x6 << 12);
                 else
-                        regval = (regval & 0x80071fff) | (0x3 << 30) |
-                                 (0x1 << 13) | (0x4 << 26) | (0x60 << 19);
+                        regval = (regval & 0x80071fff) |
+                                (0x3 << 30) |
+                                (0x1 << 13) |
+                                (0x4 << 26) |
+                                (0x60 << 19);
                 REG_WRITE(ah, AR_PHY_PLL_MODE, regval);
-                REG_WRITE(ah, AR_PHY_PLL_MODE,
-                          REG_READ(ah, AR_PHY_PLL_MODE) & 0xfffeffff);
+
+                if (AR_SREV_9531(ah))
+                        REG_WRITE(ah, AR_PHY_PLL_MODE,
+                                  REG_READ(ah, AR_PHY_PLL_MODE) & 0xffbfffff);
+                else
+                        REG_WRITE(ah, AR_PHY_PLL_MODE,
+                                  REG_READ(ah, AR_PHY_PLL_MODE) & 0xfffeffff);
+
                 udelay(1000);
         }
 
@@ -1532,76 +1510,6 @@ static void ath9k_hw_apply_gpio_override(struct ath_hw *ah)
         }
 }
 
-static bool ath9k_hw_check_dcs(u32 dma_dbg, u32 num_dcu_states,
-                               int *hang_state, int *hang_pos)
-{
-        static u32 dcu_chain_state[] = {5, 6, 9}; /* DCU chain stuck states */
-        u32 chain_state, dcs_pos, i;
-
-        for (dcs_pos = 0; dcs_pos < num_dcu_states; dcs_pos++) {
-                chain_state = (dma_dbg >> (5 * dcs_pos)) & 0x1f;
-                for (i = 0; i < 3; i++) {
-                        if (chain_state == dcu_chain_state[i]) {
-                                *hang_state = chain_state;
-                                *hang_pos = dcs_pos;
-                                return true;
-                        }
-                }
-        }
-        return false;
-}
-
-#define DCU_COMPLETE_STATE        1
-#define DCU_COMPLETE_STATE_MASK 0x3
-#define NUM_STATUS_READS         50
-static bool ath9k_hw_detect_mac_hang(struct ath_hw *ah)
-{
-        u32 chain_state, comp_state, dcs_reg = AR_DMADBG_4;
-        u32 i, hang_pos, hang_state, num_state = 6;
-
-        comp_state = REG_READ(ah, AR_DMADBG_6);
-
-        if ((comp_state & DCU_COMPLETE_STATE_MASK) != DCU_COMPLETE_STATE) {
-                ath_dbg(ath9k_hw_common(ah), RESET,
-                        "MAC Hang signature not found at DCU complete\n");
-                return false;
-        }
-
-        chain_state = REG_READ(ah, dcs_reg);
-        if (ath9k_hw_check_dcs(chain_state, num_state, &hang_state, &hang_pos))
-                goto hang_check_iter;
-
-        dcs_reg = AR_DMADBG_5;
-        num_state = 4;
-        chain_state = REG_READ(ah, dcs_reg);
-        if (ath9k_hw_check_dcs(chain_state, num_state, &hang_state, &hang_pos))
-                goto hang_check_iter;
-
-        ath_dbg(ath9k_hw_common(ah), RESET,
-                "MAC Hang signature 1 not found\n");
-        return false;
-
-hang_check_iter:
-        ath_dbg(ath9k_hw_common(ah), RESET,
-                "DCU registers: chain %08x complete %08x Hang: state %d pos %d\n",
-                chain_state, comp_state, hang_state, hang_pos);
-
-        for (i = 0; i < NUM_STATUS_READS; i++) {
-                chain_state = REG_READ(ah, dcs_reg);
-                chain_state = (chain_state >> (5 * hang_pos)) & 0x1f;
-                comp_state = REG_READ(ah, AR_DMADBG_6);
-
-                if (((comp_state & DCU_COMPLETE_STATE_MASK) !=
-                                        DCU_COMPLETE_STATE) ||
-                    (chain_state != hang_state))
-                        return false;
-        }
-
-        ath_dbg(ath9k_hw_common(ah), RESET, "MAC Hang signature 1 found\n");
-
-        return true;
-}
-
 void ath9k_hw_check_nav(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
@@ -1676,7 +1584,6 @@ static void ath9k_hw_reset_opmode(struct ath_hw *ah,
 
         REG_RMW(ah, AR_STA_ID1, macStaId1
                   | AR_STA_ID1_RTS_USE_DEF
-                  | (ah->config.ack_6mb ? AR_STA_ID1_ACKCTS_6MB : 0)
                   | ah->sta_id1_defaults,
                   ~AR_STA_ID1_SADH_MASK);
         ath_hw_setbssidmask(common);
@@ -1735,7 +1642,7 @@ static void ath9k_hw_init_desc(struct ath_hw *ah)
                 }
 #ifdef __BIG_ENDIAN
                 else if (AR_SREV_9330(ah) || AR_SREV_9340(ah) ||
-                         AR_SREV_9550(ah))
+                         AR_SREV_9550(ah) || AR_SREV_9531(ah))
                         REG_RMW(ah, AR_CFG, AR_CFG_SWRB | AR_CFG_SWTB, 0);
                 else
                         REG_WRITE(ah, AR_CFG, AR_CFG_SWTD | AR_CFG_SWRD);
@@ -1865,7 +1772,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         /* Save TSF before chip reset, a cold reset clears it */
         tsf = ath9k_hw_gettsf64(ah);
         getrawmonotonic(&ts);
-        usec = ts.tv_sec * 1000 + ts.tv_nsec / 1000;
+        usec = ts.tv_sec * 1000000ULL + ts.tv_nsec / 1000;
 
         saveLedState = REG_READ(ah, AR_CFG_LED) &
                 (AR_CFG_LED_ASSOC_CTL | AR_CFG_LED_MODE_SEL |
@@ -1899,7 +1806,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 
         /* Restore TSF */
         getrawmonotonic(&ts);
-        usec = ts.tv_sec * 1000 + ts.tv_nsec / 1000 - usec;
+        usec = ts.tv_sec * 1000000ULL + ts.tv_nsec / 1000 - usec;
         ath9k_hw_settsf64(ah, tsf + usec);
 
         if (AR_SREV_9280_20_OR_LATER(ah))
@@ -2008,10 +1915,11 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         ath9k_hw_loadnf(ah, chan);
         ath9k_hw_start_nfcal(ah, true);
 
-        if (AR_SREV_9300_20_OR_LATER(ah)) {
+        if (AR_SREV_9300_20_OR_LATER(ah))
                 ar9003_hw_bb_watchdog_config(ah);
+
+        if (ah->config.hw_hang_checks & HW_PHYRESTART_CLC_WAR)
                 ar9003_hw_disable_phy_restart(ah);
-        }
 
         ath9k_hw_apply_gpio_override(ah);
 
@@ -2135,7 +2043,11 @@ static bool ath9k_hw_set_power_awake(struct ath_hw *ah)
 
         REG_SET_BIT(ah, AR_RTC_FORCE_WAKE,
                     AR_RTC_FORCE_WAKE_EN);
-        udelay(50);
+
+        if (AR_SREV_9100(ah))
+                udelay(10000);
+        else
+                udelay(50);
 
         for (i = POWER_UP_TIME / 50; i > 0; i--) {
                 val = REG_READ(ah, AR_RTC_STATUS) & AR_RTC_STATUS_M;
@@ -2564,13 +2476,6 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
             ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
                         pCap->hw_caps |= ATH9K_HW_CAP_PAPRD;
 
-        /*
-         * Fast channel change across bands is available
-         * only for AR9462 and AR9565.
-         */
-        if (AR_SREV_9462(ah) || AR_SREV_9565(ah))
-                pCap->hw_caps |= ATH9K_HW_CAP_FCC_BAND_SWITCH;
-
         return 0;
 }
 
@@ -3084,14 +2989,14 @@ void ath_gen_timer_isr(struct ath_hw *ah)
         trigger_mask &= timer_table->timer_mask;
         thresh_mask &= timer_table->timer_mask;
 
-        trigger_mask &= ~thresh_mask;
-
         for_each_set_bit(index, &thresh_mask, ARRAY_SIZE(timer_table->timers)) {
                 timer = timer_table->timers[index];
                 if (!timer)
                     continue;
                 if (!timer->overflow)
                     continue;
+
+                trigger_mask &= ~BIT(index);
                 timer->overflow(timer->arg);
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 6132ffeb3048..e766399bdcda 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -52,6 +52,7 @@
 #define AR9300_DEVID_QCA955X    0x0038
 #define AR9485_DEVID_AR1111     0x0037
 #define AR9300_DEVID_AR9565     0x0036
+#define AR9300_DEVID_AR953X     0x003d
 
 #define AR5416_AR9100_DEVID     0x000b
 
@@ -277,10 +278,24 @@ struct ath9k_hw_capabilities {
         u8 txs_len;
 };
 
+#define AR_NO_SPUR              0x8000
+#define AR_BASE_FREQ_2GHZ       2300
+#define AR_BASE_FREQ_5GHZ       4900
+#define AR_SPUR_FEEQ_BOUND_HT40 19
+#define AR_SPUR_FEEQ_BOUND_HT20 10
+
+enum ath9k_hw_hang_checks {
+        HW_BB_WATCHDOG            = BIT(0),
+        HW_PHYRESTART_CLC_WAR     = BIT(1),
+        HW_BB_RIFS_HANG           = BIT(2),
+        HW_BB_DFS_HANG            = BIT(3),
+        HW_BB_RX_CLEAR_STUCK_HANG = BIT(4),
+        HW_MAC_HANG               = BIT(5),
+};
+
 struct ath9k_ops_config {
         int dma_beacon_response_time;
         int sw_beacon_response_time;
-        int ack_6mb;
         u32 cwm_ignore_extcca;
         u32 pcie_waen;
         u8 analog_shiftreg;
@@ -292,13 +307,9 @@ struct ath9k_ops_config {
         int serialize_regmode;
         bool rx_intr_mitigation;
         bool tx_intr_mitigation;
-#define AR_NO_SPUR              0x8000
-#define AR_BASE_FREQ_2GHZ       2300
-#define AR_BASE_FREQ_5GHZ       4900
-#define AR_SPUR_FEEQ_BOUND_HT40 19
-#define AR_SPUR_FEEQ_BOUND_HT20 10
         u8 max_txtrig_level;
         u16 ani_poll_interval; /* ANI poll interval in ms */
+        u16 hw_hang_checks;
 
         /* Platform specific config */
         u32 aspm_l1_fix;
@@ -573,6 +584,10 @@ struct ath_hw_radar_conf {
  *      register settings through the register initialization.
  */
 struct ath_hw_private_ops {
+        void (*init_hang_checks)(struct ath_hw *ah);
+        bool (*detect_mac_hang)(struct ath_hw *ah);
+        bool (*detect_bb_hang)(struct ath_hw *ah);
+
         /* Calibration ops */
         void (*init_cal_settings)(struct ath_hw *ah);
         bool (*init_cal)(struct ath_hw *ah, struct ath9k_channel *chan);
@@ -1029,6 +1044,7 @@ void ar9002_hw_enable_async_fifo(struct ath_hw *ah);
  * Code specific to AR9003, we stuff these here to avoid callbacks
  * for older families
  */
+bool ar9003_hw_bb_watchdog_check(struct ath_hw *ah);
 void ar9003_hw_bb_watchdog_config(struct ath_hw *ah);
 void ar9003_hw_bb_watchdog_read(struct ath_hw *ah);
 void ar9003_hw_bb_watchdog_dbg_info(struct ath_hw *ah);
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index e63465b7eab9..f2a17fcf1ae4 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -763,10 +763,8 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
 
         setup_timer(&sc->sleep_timer, ath_ps_full_sleep, (unsigned long)sc);
         INIT_WORK(&sc->hw_reset_work, ath_reset_work);
-        INIT_WORK(&sc->hw_check_work, ath_hw_check);
         INIT_WORK(&sc->paprd_work, ath_paprd_calibrate);
         INIT_DELAYED_WORK(&sc->hw_pll_work, ath_hw_pll_work);
-        setup_timer(&sc->rx_poll_timer, ath_rx_poll, (unsigned long)sc);
 
         /*
          * Cache line size is used to size and align various
diff --git a/drivers/net/wireless/ath/ath9k/link.c b/drivers/net/wireless/ath/ath9k/link.c
index aed7e29dc50f..30dcef5aba10 100644
--- a/drivers/net/wireless/ath/ath9k/link.c
+++ b/drivers/net/wireless/ath/ath9k/link.c
@@ -65,50 +65,26 @@ void ath_tx_complete_poll_work(struct work_struct *work)
 /*
  * Checks if the BB/MAC is hung.
  */
-void ath_hw_check(struct work_struct *work)
+bool ath_hw_check(struct ath_softc *sc)
 {
-        struct ath_softc *sc = container_of(work, struct ath_softc, hw_check_work);
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        unsigned long flags;
-        int busy;
-        u8 is_alive, nbeacon = 1;
         enum ath_reset_type type;
+        bool is_alive;
 
         ath9k_ps_wakeup(sc);
+
         is_alive = ath9k_hw_check_alive(sc->sc_ah);
 
-        if ((is_alive && !AR_SREV_9300(sc->sc_ah)) || sc->tx99_state)
-                goto out;
-        else if (!is_alive && AR_SREV_9300(sc->sc_ah)) {
+        if (!is_alive) {
                 ath_dbg(common, RESET,
-                        "DCU stuck is detected. Schedule chip reset\n");
+                        "HW hang detected, schedule chip reset\n");
                 type = RESET_TYPE_MAC_HANG;
-                goto sched_reset;
-        }
-
-        spin_lock_irqsave(&common->cc_lock, flags);
-        busy = ath_update_survey_stats(sc);
-        spin_unlock_irqrestore(&common->cc_lock, flags);
-
-        ath_dbg(common, RESET, "Possible baseband hang, busy=%d (try %d)\n",
-                busy, sc->hw_busy_count + 1);
-        if (busy >= 99) {
-                if (++sc->hw_busy_count >= 3) {
-                        type = RESET_TYPE_BB_HANG;
-                        goto sched_reset;
-                }
-        } else if (busy >= 0) {
-                sc->hw_busy_count = 0;
-                nbeacon = 3;
+                ath9k_queue_reset(sc, type);
         }
 
-        ath_start_rx_poll(sc, nbeacon);
-        goto out;
-
-sched_reset:
-        ath9k_queue_reset(sc, type);
-out:
         ath9k_ps_restore(sc);
+
+        return is_alive;
 }
 
 /*
@@ -162,29 +138,6 @@ void ath_hw_pll_work(struct work_struct *work)
 }
 
 /*
- * RX Polling - monitors baseband hangs.
- */
-void ath_start_rx_poll(struct ath_softc *sc, u8 nbeacon)
-{
-        if (!AR_SREV_9300(sc->sc_ah))
-                return;
-
-        if (!test_bit(SC_OP_PRIM_STA_VIF, &sc->sc_flags))
-                return;
-
-        mod_timer(&sc->rx_poll_timer, jiffies + msecs_to_jiffies
-                  (nbeacon * sc->cur_beacon_conf.beacon_interval));
-}
-
-void ath_rx_poll(unsigned long data)
-{
-        struct ath_softc *sc = (struct ath_softc *)data;
-
-        if (!test_bit(SC_OP_INVALID, &sc->sc_flags))
-                ieee80211_queue_work(sc->hw, &sc->hw_check_work);
-}
-
-/*
  * PA Pre-distortion.
  */
 static void ath_paprd_activate(struct ath_softc *sc)
@@ -409,10 +362,10 @@ void ath_ani_calibrate(unsigned long data)
 
         /* Call ANI routine if necessary */
         if (aniflag) {
-                spin_lock_irqsave(&common->cc_lock, flags);
+                spin_lock(&common->cc_lock);
                 ath9k_hw_ani_monitor(ah, ah->curchan);
                 ath_update_survey_stats(sc);
-                spin_unlock_irqrestore(&common->cc_lock, flags);
+                spin_unlock(&common->cc_lock);
         }
 
         /* Perform calibration if necessary */
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 89d7e206992b..5f727588ca27 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -922,11 +922,29 @@ void ath9k_hw_set_interrupts(struct ath_hw *ah)
                         mask2 |= AR_IMR_S2_CST;
         }
 
+        if (ah->config.hw_hang_checks & HW_BB_WATCHDOG) {
+                if (ints & ATH9K_INT_BB_WATCHDOG) {
+                        mask |= AR_IMR_BCNMISC;
+                        mask2 |= AR_IMR_S2_BB_WATCHDOG;
+                }
+        }
+
         ath_dbg(common, INTERRUPT, "new IMR 0x%x\n", mask);
         REG_WRITE(ah, AR_IMR, mask);
-        ah->imrs2_reg &= ~(AR_IMR_S2_TIM | AR_IMR_S2_DTIM | AR_IMR_S2_DTIMSYNC |
-                           AR_IMR_S2_CABEND | AR_IMR_S2_CABTO |
-                           AR_IMR_S2_TSFOOR | AR_IMR_S2_GTT | AR_IMR_S2_CST);
+        ah->imrs2_reg &= ~(AR_IMR_S2_TIM |
+                           AR_IMR_S2_DTIM |
+                           AR_IMR_S2_DTIMSYNC |
+                           AR_IMR_S2_CABEND |
+                           AR_IMR_S2_CABTO |
+                           AR_IMR_S2_TSFOOR |
+                           AR_IMR_S2_GTT |
+                           AR_IMR_S2_CST);
+
+        if (ah->config.hw_hang_checks & HW_BB_WATCHDOG) {
+                if (ints & ATH9K_INT_BB_WATCHDOG)
+                        ah->imrs2_reg &= ~AR_IMR_S2_BB_WATCHDOG;
+        }
+
         ah->imrs2_reg |= mask2;
         REG_WRITE(ah, AR_IMR_S2, ah->imrs2_reg);
 
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 21b764ba6400..d0c3aec7c74e 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -170,7 +170,6 @@ void ath9k_ps_restore(struct ath_softc *sc)
 static void __ath_cancel_work(struct ath_softc *sc)
 {
         cancel_work_sync(&sc->paprd_work);
-        cancel_work_sync(&sc->hw_check_work);
         cancel_delayed_work_sync(&sc->tx_complete_work);
         cancel_delayed_work_sync(&sc->hw_pll_work);
 
@@ -194,7 +193,6 @@ void ath_restart_work(struct ath_softc *sc)
                 ieee80211_queue_delayed_work(sc->hw, &sc->hw_pll_work,
                                      msecs_to_jiffies(ATH_PLL_WORK_INTERVAL));
 
-        ath_start_rx_poll(sc, 3);
         ath_start_ani(sc);
 }
 
@@ -204,11 +202,7 @@ static bool ath_prepare_reset(struct ath_softc *sc)
         bool ret = true;
 
         ieee80211_stop_queues(sc->hw);
-
-        sc->hw_busy_count = 0;
         ath_stop_ani(sc);
-        del_timer_sync(&sc->rx_poll_timer);
-
         ath9k_hw_disable_interrupts(ah);
 
         if (!ath_drain_all_txq(sc))
@@ -336,7 +330,6 @@ static int ath_set_channel(struct ath_softc *sc, struct cfg80211_chan_def *chand
         struct ieee80211_hw *hw = sc->hw;
         struct ath9k_channel *hchan;
         struct ieee80211_channel *chan = chandef->chan;
-        unsigned long flags;
         bool offchannel;
         int pos = chan->hw_value;
         int old_pos = -1;
@@ -354,9 +347,9 @@ static int ath_set_channel(struct ath_softc *sc, struct cfg80211_chan_def *chand
                 chan->center_freq, chandef->width);
 
         /* update survey stats for the old channel before switching */
-        spin_lock_irqsave(&common->cc_lock, flags);
+        spin_lock_bh(&common->cc_lock);
         ath_update_survey_stats(sc);
-        spin_unlock_irqrestore(&common->cc_lock, flags);
+        spin_unlock_bh(&common->cc_lock);
 
         ath9k_cmn_get_channel(hw, ah, chandef);
 
@@ -427,12 +420,6 @@ static void ath_node_attach(struct ath_softc *sc, struct ieee80211_sta *sta,
         an->vif = vif;
 
         ath_tx_node_init(sc, an);
-
-        if (sta->ht_cap.ht_supported) {
-                an->maxampdu = 1 << (IEEE80211_HT_MAX_AMPDU_FACTOR +
-                                     sta->ht_cap.ampdu_factor);
-                an->mpdudensity = ath9k_parse_mpdudensity(sta->ht_cap.ampdu_density);
-        }
 }
 
 static void ath_node_detach(struct ath_softc *sc, struct ieee80211_sta *sta)
@@ -454,14 +441,8 @@ void ath9k_tasklet(unsigned long data)
         ath9k_ps_wakeup(sc);
         spin_lock(&sc->sc_pcu_lock);
 
-        if ((status & ATH9K_INT_FATAL) ||
-            (status & ATH9K_INT_BB_WATCHDOG)) {
-
-                if (status & ATH9K_INT_FATAL)
-                        type = RESET_TYPE_FATAL_INT;
-                else
-                        type = RESET_TYPE_BB_WATCHDOG;
-
+        if (status & ATH9K_INT_FATAL) {
+                type = RESET_TYPE_FATAL_INT;
                 ath9k_queue_reset(sc, type);
 
                 /*
@@ -473,6 +454,28 @@ void ath9k_tasklet(unsigned long data)
                 goto out;
         }
 
+        if ((ah->config.hw_hang_checks & HW_BB_WATCHDOG) &&
+            (status & ATH9K_INT_BB_WATCHDOG)) {
+                spin_lock(&common->cc_lock);
+                ath_hw_cycle_counters_update(common);
+                ar9003_hw_bb_watchdog_dbg_info(ah);
+                spin_unlock(&common->cc_lock);
+
+                if (ar9003_hw_bb_watchdog_check(ah)) {
+                        type = RESET_TYPE_BB_WATCHDOG;
+                        ath9k_queue_reset(sc, type);
+
+                        /*
+                         * Increment the ref. counter here so that
+                         * interrupts are enabled in the reset routine.
+                         */
+                        atomic_inc(&ah->intr_ref_cnt);
+                        ath_dbg(common, ANY,
+                                "BB_WATCHDOG: Skipping interrupts\n");
+                        goto out;
+                }
+        }
+
         spin_lock_irqsave(&sc->sc_pm_lock, flags);
         if ((status & ATH9K_INT_TSFOOR) && sc->ps_enabled) {
                 /*
@@ -541,7 +544,7 @@ irqreturn_t ath_isr(int irq, void *dev)
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
         enum ath9k_int status;
-        u32 sync_cause;
+        u32 sync_cause = 0;
         bool sched = false;
 
         /*
@@ -593,16 +596,9 @@ irqreturn_t ath_isr(int irq, void *dev)
             !(ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)))
                 goto chip_reset;
 
-        if ((ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) &&
-            (status & ATH9K_INT_BB_WATCHDOG)) {
-
-                spin_lock(&common->cc_lock);
-                ath_hw_cycle_counters_update(common);
-                ar9003_hw_bb_watchdog_dbg_info(ah);
-                spin_unlock(&common->cc_lock);
-
+        if ((ah->config.hw_hang_checks & HW_BB_WATCHDOG) &&
+            (status & ATH9K_INT_BB_WATCHDOG))
                 goto chip_reset;
-        }
 
 #ifdef CONFIG_ATH9K_WOW
         if (status & ATH9K_INT_BMISS) {
@@ -732,11 +728,13 @@ static int ath9k_start(struct ieee80211_hw *hw)
 
         if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
                 ah->imask |= ATH9K_INT_RXHP |
-                             ATH9K_INT_RXLP |
-                             ATH9K_INT_BB_WATCHDOG;
+                             ATH9K_INT_RXLP;
         else
                 ah->imask |= ATH9K_INT_RX;
 
+        if (ah->config.hw_hang_checks & HW_BB_WATCHDOG)
+                ah->imask |= ATH9K_INT_BB_WATCHDOG;
+
         ah->imask |= ATH9K_INT_GTT;
 
         if (ah->caps.hw_caps & ATH9K_HW_CAP_HT)
@@ -860,7 +858,6 @@ static void ath9k_stop(struct ieee80211_hw *hw)
         mutex_lock(&sc->mutex);
 
         ath_cancel_work(sc);
-        del_timer_sync(&sc->rx_poll_timer);
 
         if (test_bit(SC_OP_INVALID, &sc->sc_flags)) {
                 ath_dbg(common, ANY, "Device not present\n");
@@ -1791,13 +1788,12 @@ static int ath9k_get_survey(struct ieee80211_hw *hw, int idx,
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ieee80211_supported_band *sband;
         struct ieee80211_channel *chan;
-        unsigned long flags;
         int pos;
 
         if (config_enabled(CONFIG_ATH9K_TX99))
                 return -EOPNOTSUPP;
 
-        spin_lock_irqsave(&common->cc_lock, flags);
+        spin_lock_bh(&common->cc_lock);
         if (idx == 0)
                 ath_update_survey_stats(sc);
 
@@ -1811,7 +1807,7 @@ static int ath9k_get_survey(struct ieee80211_hw *hw, int idx,
                 sband = hw->wiphy->bands[IEEE80211_BAND_5GHZ];
 
         if (!sband || idx >= sband->n_channels) {
-                spin_unlock_irqrestore(&common->cc_lock, flags);
+                spin_unlock_bh(&common->cc_lock);
                 return -ENOENT;
         }
 
@@ -1819,7 +1815,7 @@ static int ath9k_get_survey(struct ieee80211_hw *hw, int idx,
         pos = chan->hw_value;
         memcpy(survey, &sc->survey[pos], sizeof(*survey));
         survey->channel = chan;
-        spin_unlock_irqrestore(&common->cc_lock, flags);
+        spin_unlock_bh(&common->cc_lock);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index e9a585758941..55724b02316b 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -412,6 +412,16 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          0x11AD, /* LITEON */
+                         0x06B2),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
+                         0x0842),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
                          0x6671),
           .driver_data = ATH9K_PCI_AR9565_1ANT },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
@@ -424,6 +434,16 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
                          0x1B9A, /* XAVI */
                          0x2812),
           .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x1B9A, /* XAVI */
+                         0x28A1),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x218A),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
 
         /* WB335 1-ANT / Antenna Diversity */
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
@@ -469,22 +489,17 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          0x11AD, /* LITEON */
-                         0x0682),
+                         0x06A2),
           .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
-                         PCI_VENDOR_ID_AZWAVE,
-                         0x213A),
-          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
-        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
-                         0x0036,
-                         PCI_VENDOR_ID_LENOVO,
-                         0x3026),
+                         0x11AD, /* LITEON */
+                         0x0682),
           .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
-                         PCI_VENDOR_ID_LENOVO,
-                         0x4026),
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x213A),
           .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
@@ -504,37 +519,35 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          PCI_VENDOR_ID_DELL,
-                         0x020E),
+                         0x020C),
           .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
 
-        /* WB335 2-ANT */
+        /* WB335 2-ANT / Antenna-Diversity */
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          PCI_VENDOR_ID_SAMSUNG,
                          0x411A),
-          .driver_data = ATH9K_PCI_AR9565_2ANT },
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          PCI_VENDOR_ID_SAMSUNG,
                          0x411B),
-          .driver_data = ATH9K_PCI_AR9565_2ANT },
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          PCI_VENDOR_ID_SAMSUNG,
                          0x411C),
-          .driver_data = ATH9K_PCI_AR9565_2ANT },
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          PCI_VENDOR_ID_SAMSUNG,
                          0x411D),
-          .driver_data = ATH9K_PCI_AR9565_2ANT },
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          PCI_VENDOR_ID_SAMSUNG,
                          0x411E),
-          .driver_data = ATH9K_PCI_AR9565_2ANT },
-
-        /* WB335 2-ANT / Antenna-Diversity */
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          PCI_VENDOR_ID_ATHEROS,
@@ -562,11 +575,31 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         0x11AD, /* LITEON */
+                         0x0832),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
+                         0x0692),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          PCI_VENDOR_ID_AZWAVE,
                          0x2130),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x213B),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x2182),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          0x144F, /* ASKEY */
                          0x7202),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
@@ -577,6 +610,11 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         0x1B9A, /* XAVI */
+                         0x28A2),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          0x185F, /* WNC */
                          0x3027),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
@@ -590,6 +628,31 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
                          PCI_VENDOR_ID_FOXCONN,
                          0xE07F),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_FOXCONN,
+                         0xE081),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_LENOVO,
+                         0x3026),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_LENOVO,
+                         0x4026),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_ASUSTEK,
+                         0x85F2),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_DELL,
+                         0x020E),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
 
         /* PCI-E AR9565 (WB335) */
         { PCI_VDEVICE(ATHEROS, 0x0036),
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 3692b2a501a2..f7cc5b37a18f 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -419,7 +419,7 @@ u32 ath_calcrxfilter(struct ath_softc *sc)
                 rfilt |= ATH9K_RX_FILTER_MCAST_BCAST_ALL;
         }
 
-        if (AR_SREV_9550(sc->sc_ah))
+        if (AR_SREV_9550(sc->sc_ah) || AR_SREV_9531(sc->sc_ah))
                 rfilt |= ATH9K_RX_FILTER_4ADDRESS;
 
         return rfilt;
@@ -850,20 +850,15 @@ static int ath9k_process_rate(struct ath_common *common,
         enum ieee80211_band band;
         unsigned int i = 0;
         struct ath_softc __maybe_unused *sc = common->priv;
+        struct ath_hw *ah = sc->sc_ah;
 
-        band = hw->conf.chandef.chan->band;
+        band = ah->curchan->chan->band;
         sband = hw->wiphy->bands[band];
 
-        switch (hw->conf.chandef.width) {
-        case NL80211_CHAN_WIDTH_5:
+        if (IS_CHAN_QUARTER_RATE(ah->curchan))
                 rxs->flag |= RX_FLAG_5MHZ;
-                break;
-        case NL80211_CHAN_WIDTH_10:
+        else if (IS_CHAN_HALF_RATE(ah->curchan))
                 rxs->flag |= RX_FLAG_10MHZ;
-                break;
-        default:
-                break;
-        }
 
         if (rx_stats->rs_rate & 0x80) {
                 /* HT rate */
@@ -982,7 +977,7 @@ static bool ath9k_is_mybeacon(struct ath_softc *sc, struct ieee80211_hdr *hdr)
         if (ieee80211_is_beacon(hdr->frame_control)) {
                 RX_STAT_INC(rx_beacons);
                 if (!is_zero_ether_addr(common->curbssid) &&
-                    ether_addr_equal(hdr->addr3, common->curbssid))
+                    ether_addr_equal_64bits(hdr->addr3, common->curbssid))
                         return true;
         }
 
@@ -1077,9 +1072,13 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
         }
 
         rx_stats->is_mybeacon = ath9k_is_mybeacon(sc, hdr);
-        if (rx_stats->is_mybeacon) {
-                sc->hw_busy_count = 0;
-                ath_start_rx_poll(sc, 3);
+
+        /*
+         * This shouldn't happen, but have a safety check anyway.
+         */
+        if (WARN_ON(!ah->curchan)) {
+                ret = -EINVAL;
+                goto exit;
         }
 
         if (ath9k_process_rate(common, hw, rx_stats, rx_status)) {
@@ -1089,8 +1088,8 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
 
         ath9k_process_rssi(common, hw, rx_stats, rx_status);
 
-        rx_status->band = hw->conf.chandef.chan->band;
-        rx_status->freq = hw->conf.chandef.chan->center_freq;
+        rx_status->band = ah->curchan->chan->band;
+        rx_status->freq = ah->curchan->chan->center_freq;
         rx_status->antenna = rx_stats->rs_antenna;
         rx_status->flag |= RX_FLAG_MACTIME_END;
 
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index 9ad007312c9d..b1fd3fa84983 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -304,6 +304,7 @@
 #define AR_IMR_S2              0x00ac
 #define AR_IMR_S2_QCU_TXURN    0x000003FF
 #define AR_IMR_S2_QCU_TXURN_S  0
+#define AR_IMR_S2_BB_WATCHDOG  0x00010000
 #define AR_IMR_S2_CST          0x00400000
 #define AR_IMR_S2_GTT          0x00800000
 #define AR_IMR_S2_TIM          0x01000000
@@ -812,6 +813,9 @@
 #define AR_SREV_REVISION_9565_101       1
 #define AR_SREV_REVISION_9565_11        2
 #define AR_SREV_VERSION_9550            0x400
+#define AR_SREV_VERSION_9531            0x500
+#define AR_SREV_REVISION_9531_10        0
+#define AR_SREV_REVISION_9531_11        1
 
 #define AR_SREV_5416(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_5416_PCI) || \
@@ -945,11 +949,19 @@
 #define AR_SREV_9580(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9580) && \
         ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9580_10))
-
 #define AR_SREV_9580_10(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9580) && \
         ((_ah)->hw_version.macRev == AR_SREV_REVISION_9580_10))
 
+#define AR_SREV_9531(_ah) \
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9531))
+#define AR_SREV_9531_10(_ah) \
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9531) && \
+         ((_ah)->hw_version.macRev == AR_SREV_REVISION_9531_10))
+#define AR_SREV_9531_11(_ah) \
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9531) && \
+         ((_ah)->hw_version.macRev == AR_SREV_REVISION_9531_11))
+
 /* NOTE: When adding chips newer than Peacock, add chip check here */
 #define AR_SREV_9580_10_OR_LATER(_ah) \
         (AR_SREV_9580(_ah))
diff --git a/drivers/net/wireless/ath/ath9k/spectral.c b/drivers/net/wireless/ath/ath9k/spectral.c
index 11adb5eb51cc..99f4de95c264 100644
--- a/drivers/net/wireless/ath/ath9k/spectral.c
+++ b/drivers/net/wireless/ath/ath9k/spectral.c
@@ -497,7 +497,7 @@ static int remove_buf_file_handler(struct dentry *dentry)
         return 0;
 }
 
-struct rchan_callbacks rfs_spec_scan_cb = {
+static struct rchan_callbacks rfs_spec_scan_cb = {
         .create_buf_file = create_buf_file_handler,
         .remove_buf_file = remove_buf_file_handler,
 };
diff --git a/drivers/net/wireless/ath/ath9k/wow.c b/drivers/net/wireless/ath/ath9k/wow.c
index f1cde81bb7a2..1b3230fa3651 100644
--- a/drivers/net/wireless/ath/ath9k/wow.c
+++ b/drivers/net/wireless/ath/ath9k/wow.c
@@ -197,7 +197,6 @@ int ath9k_suspend(struct ieee80211_hw *hw,
 
         ath_cancel_work(sc);
         ath_stop_ani(sc);
-        del_timer_sync(&sc->rx_poll_timer);
 
         if (test_bit(SC_OP_INVALID, &sc->sc_flags)) {
                 ath_dbg(common, ANY, "Device not present\n");
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 9d735c55a0f3..e8d0e7fc77da 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -774,11 +774,6 @@ static u32 ath_lookup_rate(struct ath_softc *sc, struct ath_buf *bf,
         if (bt_aggr_limit)
                 aggr_limit = bt_aggr_limit;
 
-        /*
-         * h/w can accept aggregates up to 16 bit lengths (65535).
-         * The IE, however can hold up to 65536, which shows up here
-         * as zero. Ignore 65536 since we  are constrained by hw.
-         */
         if (tid->an->maxampdu)
                 aggr_limit = min(aggr_limit, tid->an->maxampdu);
 
@@ -1403,8 +1398,8 @@ int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
          * has already been added.
          */
         if (sta->ht_cap.ht_supported) {
-                an->maxampdu = 1 << (IEEE80211_HT_MAX_AMPDU_FACTOR +
-                                     sta->ht_cap.ampdu_factor);
+                an->maxampdu = (1 << (IEEE80211_HT_MAX_AMPDU_FACTOR +
+                                      sta->ht_cap.ampdu_factor)) - 1;
                 density = ath9k_parse_mpdudensity(sta->ht_cap.ampdu_density);
                 an->mpdudensity = density;
         }
diff --git a/drivers/net/wireless/ath/carl9170/debug.c b/drivers/net/wireless/ath/carl9170/debug.c
index 3d70cd277fd7..1c0af9cd9a85 100644
--- a/drivers/net/wireless/ath/carl9170/debug.c
+++ b/drivers/net/wireless/ath/carl9170/debug.c
@@ -37,7 +37,6 @@
  *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/seq_file.h>
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 349fa22a921a..4c3f576c3144 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -37,7 +37,6 @@
  *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/etherdevice.h>
diff --git a/drivers/net/wireless/ath/carl9170/rx.c b/drivers/net/wireless/ath/carl9170/rx.c
index e935f61c7fad..1b1b20751ead 100644
--- a/drivers/net/wireless/ath/carl9170/rx.c
+++ b/drivers/net/wireless/ath/carl9170/rx.c
@@ -37,7 +37,6 @@
  *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/etherdevice.h>
@@ -536,7 +535,7 @@ static void carl9170_ps_beacon(struct ar9170 *ar, void *data, unsigned int len)
                 return;
 
         /* and only beacons from the associated BSSID, please */
-        if (!ether_addr_equal(hdr->addr3, ar->common.curbssid) ||
+        if (!ether_addr_equal_64bits(hdr->addr3, ar->common.curbssid) ||
             !ar->common.curaid)
                 return;
 
@@ -602,8 +601,8 @@ static void carl9170_ba_check(struct ar9170 *ar, void *data, unsigned int len)
 
                 if (bar->start_seq_num == entry_bar->start_seq_num &&
                     TID_CHECK(bar->control, entry_bar->control) &&
-                    ether_addr_equal(bar->ra, entry_bar->ta) &&
-                    ether_addr_equal(bar->ta, entry_bar->ra)) {
+                    ether_addr_equal_64bits(bar->ra, entry_bar->ta) &&
+                    ether_addr_equal_64bits(bar->ta, entry_bar->ra)) {
                         struct ieee80211_tx_info *tx_info;
 
                         tx_info = IEEE80211_SKB_CB(entry_skb);
diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
index e3f696ee4d23..4cadfd48ffdf 100644
--- a/drivers/net/wireless/ath/carl9170/tx.c
+++ b/drivers/net/wireless/ath/carl9170/tx.c
@@ -37,7 +37,6 @@
  *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/etherdevice.h>
diff --git a/drivers/net/wireless/ath/wil6210/interrupt.c b/drivers/net/wireless/ath/wil6210/interrupt.c
index 8205d3e4ab66..10919f95a83c 100644
--- a/drivers/net/wireless/ath/wil6210/interrupt.c
+++ b/drivers/net/wireless/ath/wil6210/interrupt.c
@@ -156,6 +156,19 @@ void wil6210_enable_irq(struct wil6210_priv *wil)
         iowrite32(WIL_ICR_ICC_VALUE, wil->csr + HOSTADDR(RGF_DMA_EP_MISC_ICR) +
                   offsetof(struct RGF_ICR, ICC));
 
+        /* interrupt moderation parameters */
+        if (wil->wdev->iftype == NL80211_IFTYPE_MONITOR) {
+                /* disable interrupt moderation for monitor
+                 * to get better timestamp precision
+                 */
+                iowrite32(0, wil->csr + HOSTADDR(RGF_DMA_ITR_CNT_CRL));
+        } else {
+                iowrite32(WIL6210_ITR_TRSH,
+                          wil->csr + HOSTADDR(RGF_DMA_ITR_CNT_TRSH));
+                iowrite32(BIT_DMA_ITR_CNT_CRL_EN,
+                          wil->csr + HOSTADDR(RGF_DMA_ITR_CNT_CRL));
+        }
+
         wil6210_unmask_irq_pseudo(wil);
         wil6210_unmask_irq_tx(wil);
         wil6210_unmask_irq_rx(wil);
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index d505b2676a73..9b88440ef05b 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -21,6 +21,7 @@
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <net/ipv6.h>
+#include <asm/processor.h>
 
 #include "wil6210.h"
 #include "wmi.h"
@@ -377,6 +378,8 @@ static struct sk_buff *wil_vring_reap_rx(struct wil6210_priv *wil,
         }
         skb_trim(skb, dmalen);
 
+        prefetch(skb->data);
+
         wil_hex_dump_txrx("Rx ", DUMP_PREFIX_OFFSET, 16, 1,
                           skb->data, skb_headlen(skb), false);
 
@@ -673,9 +676,12 @@ static int wil_tx_desc_offload_cksum_set(struct wil6210_priv *wil,
         if (skb->ip_summed != CHECKSUM_PARTIAL)
                 return 0;
 
+        d->dma.b11 = ETH_HLEN; /* MAC header length */
+
         switch (skb->protocol) {
         case cpu_to_be16(ETH_P_IP):
                 protocol = ip_hdr(skb)->protocol;
+                d->dma.b11 |= BIT(DMA_CFG_DESC_TX_OFFLOAD_CFG_L3T_IPV4_POS);
                 break;
         case cpu_to_be16(ETH_P_IPV6):
                 protocol = ipv6_hdr(skb)->nexthdr;
@@ -701,8 +707,6 @@ static int wil_tx_desc_offload_cksum_set(struct wil6210_priv *wil,
         }
 
         d->dma.ip_length = skb_network_header_len(skb);
-        d->dma.b11 = ETH_HLEN; /* MAC header length */
-        d->dma.b11 |= BIT(DMA_CFG_DESC_TX_OFFLOAD_CFG_L3T_IPV4_POS);
         /* Enable TCP/UDP checksum */
         d->dma.d0 |= BIT(DMA_CFG_DESC_TX_0_TCP_UDP_CHECKSUM_EN_POS);
         /* Calculate pseudo-header */
diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
index c4a51638736a..1f91eaf95bbe 100644
--- a/drivers/net/wireless/ath/wil6210/wil6210.h
+++ b/drivers/net/wireless/ath/wil6210/wil6210.h
@@ -39,6 +39,7 @@ static inline u32 WIL_GET_BITS(u32 x, int b0, int b1)
 #define WIL6210_MAX_TX_RINGS    (24) /* HW limit */
 #define WIL6210_MAX_CID         (8) /* HW limit */
 #define WIL6210_NAPI_BUDGET     (16) /* arbitrary */
+#define WIL6210_ITR_TRSH        (10000) /* arbitrary - about 15 IRQs/msec */
 
 /* Hardware definitions begin */
 
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index b73b7e3e2196..bf93ea859f2d 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -39,7 +39,6 @@
 
 ******************************************************************************/
 
-#include <linux/init.h>
 #include <linux/interrupt.h>
 
 #include <linux/kernel.h>
diff --git a/drivers/net/wireless/atmel_cs.c b/drivers/net/wireless/atmel_cs.c
index 5e2749dd1124..4cfb4d99ced0 100644
--- a/drivers/net/wireless/atmel_cs.c
+++ b/drivers/net/wireless/atmel_cs.c
@@ -32,7 +32,6 @@
 #ifdef __IN_PCMCIA_PACKAGE__
 #include <pcmcia/k_compat.h>
 #endif
-#include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/ptrace.h>
diff --git a/drivers/net/wireless/atmel_pci.c b/drivers/net/wireless/atmel_pci.c
index 64d5973ec28b..5cd97e3cbee3 100644
--- a/drivers/net/wireless/atmel_pci.c
+++ b/drivers/net/wireless/atmel_pci.c
@@ -22,7 +22,6 @@
 #include <linux/pci.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/netdevice.h>
 #include "atmel.h"
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
index 12c27d13df7f..c229210d50ba 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
@@ -41,9 +41,6 @@ struct brcmf_proto_bcdc_dcmd {
         __le32 status;  /* status code returned from the device */
 };
 
-/* Max valid buffer size that can be sent to the dongle */
-#define BCDC_MAX_MSG_SIZE       (ETH_FRAME_LEN+ETH_FCS_LEN)
-
 /* BCDC flag definitions */
 #define BCDC_DCMD_ERROR         0x01            /* 1=cmd failed */
 #define BCDC_DCMD_SET           0x02            /* 0=get, 1=set cmd */
@@ -133,9 +130,12 @@ brcmf_proto_bcdc_msg(struct brcmf_pub *drvr, int ifidx, uint cmd, void *buf,
         if (buf)
                 memcpy(bcdc->buf, buf, len);
 
+        len += sizeof(*msg);
+        if (len > BRCMF_TX_IOCTL_MAX_MSG_SIZE)
+                len = BRCMF_TX_IOCTL_MAX_MSG_SIZE;
+
         /* Send request */
-        return brcmf_bus_txctl(drvr->bus_if, (unsigned char *)&bcdc->msg,
-                               len + sizeof(struct brcmf_proto_bcdc_dcmd));
+        return brcmf_bus_txctl(drvr->bus_if, (unsigned char *)&bcdc->msg, len);
 }
 
 static int brcmf_proto_bcdc_cmplt(struct brcmf_pub *drvr, u32 id, u32 len)
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
index 2b5cde67e728..34c993dd0602 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
@@ -47,8 +47,6 @@
 
 #define SDIOH_API_ACCESS_RETRY_LIMIT    2
 
-#define SDIO_VENDOR_ID_BROADCOM         0x02d0
-
 #define DMA_ALIGN_MASK  0x03
 
 #define SDIO_FUNC1_BLOCKSIZE            64
@@ -216,94 +214,104 @@ static inline int brcmf_sdiod_f0_writeb(struct sdio_func *func,
         return err_ret;
 }
 
-static int brcmf_sdiod_request_byte(struct brcmf_sdio_dev *sdiodev, uint rw,
-                                    uint func, uint regaddr, u8 *byte)
+static int brcmf_sdiod_request_data(struct brcmf_sdio_dev *sdiodev, u8 fn,
+                                    u32 addr, u8 regsz, void *data, bool write)
 {
-        int err_ret;
+        struct sdio_func *func;
+        int ret;
 
-        brcmf_dbg(SDIO, "rw=%d, func=%d, addr=0x%05x\n", rw, func, regaddr);
+        brcmf_dbg(SDIO, "rw=%d, func=%d, addr=0x%05x, nbytes=%d\n",
+                  write, fn, addr, regsz);
 
-        brcmf_sdiod_pm_resume_wait(sdiodev, &sdiodev->request_byte_wait);
+        brcmf_sdiod_pm_resume_wait(sdiodev, &sdiodev->request_word_wait);
         if (brcmf_sdiod_pm_resume_error(sdiodev))
                 return -EIO;
 
-        if (rw && func == 0) {
-                /* handle F0 separately */
-                err_ret = brcmf_sdiod_f0_writeb(sdiodev->func[func],
-                                                regaddr, *byte);
-        } else {
-                if (rw) /* CMD52 Write */
-                        sdio_writeb(sdiodev->func[func], *byte, regaddr,
-                                    &err_ret);
-                else if (func == 0) {
-                        *byte = sdio_f0_readb(sdiodev->func[func], regaddr,
-                                              &err_ret);
+        /* only allow byte access on F0 */
+        if (WARN_ON(regsz > 1 && !fn))
+                return -EINVAL;
+        func = sdiodev->func[fn];
+
+        switch (regsz) {
+        case sizeof(u8):
+                if (write) {
+                        if (fn)
+                                sdio_writeb(func, *(u8 *)data, addr, &ret);
+                        else
+                                ret = brcmf_sdiod_f0_writeb(func, addr,
+                                                            *(u8 *)data);
                 } else {
-                        *byte = sdio_readb(sdiodev->func[func], regaddr,
-                                           &err_ret);
+                        if (fn)
+                                *(u8 *)data = sdio_readb(func, addr, &ret);
+                        else
+                                *(u8 *)data = sdio_f0_readb(func, addr, &ret);
                 }
+                break;
+        case sizeof(u16):
+                if (write)
+                        sdio_writew(func, *(u16 *)data, addr, &ret);
+                else
+                        *(u16 *)data = sdio_readw(func, addr, &ret);
+                break;
+        case sizeof(u32):
+                if (write)
+                        sdio_writel(func, *(u32 *)data, addr, &ret);
+                else
+                        *(u32 *)data = sdio_readl(func, addr, &ret);
+                break;
+        default:
+                brcmf_err("invalid size: %d\n", regsz);
+                break;
         }
 
-        if (err_ret) {
+        if (ret) {
                 /*
                  * SleepCSR register access can fail when
                  * waking up the device so reduce this noise
                  * in the logs.
                  */
-                if (regaddr != SBSDIO_FUNC1_SLEEPCSR)
-                        brcmf_err("Failed to %s byte F%d:@0x%05x=%02x, Err: %d\n",
-                                  rw ? "write" : "read", func, regaddr, *byte,
-                                  err_ret);
+                if (addr != SBSDIO_FUNC1_SLEEPCSR)
+                        brcmf_err("failed to %s data F%d@0x%05x, err: %d\n",
+                                  write ? "write" : "read", fn, addr, ret);
                 else
-                        brcmf_dbg(SDIO, "Failed to %s byte F%d:@0x%05x=%02x, Err: %d\n",
-                                  rw ? "write" : "read", func, regaddr, *byte,
-                                  err_ret);
+                        brcmf_dbg(SDIO, "failed to %s data F%d@0x%05x, err: %d\n",
+                                  write ? "write" : "read", fn, addr, ret);
         }
-        return err_ret;
+        return ret;
 }
 
-static int brcmf_sdiod_request_word(struct brcmf_sdio_dev *sdiodev, uint rw,
-                                    uint func, uint addr, u32 *word,
-                                    uint nbytes)
+static int brcmf_sdiod_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
+                                   u8 regsz, void *data, bool write)
 {
-        int err_ret = -EIO;
-
-        if (func == 0) {
-                brcmf_err("Only CMD52 allowed to F0\n");
-                return -EINVAL;
-        }
-
-        brcmf_dbg(SDIO, "rw=%d, func=%d, addr=0x%05x, nbytes=%d\n",
-                  rw, func, addr, nbytes);
+        u8 func_num;
+        s32 retry = 0;
+        int ret;
 
-        brcmf_sdiod_pm_resume_wait(sdiodev, &sdiodev->request_word_wait);
-        if (brcmf_sdiod_pm_resume_error(sdiodev))
-                return -EIO;
+        /*
+         * figure out how to read the register based on address range
+         * 0x00 ~ 0x7FF: function 0 CCCR and FBR
+         * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
+         * The rest: function 1 silicon backplane core registers
+         */
+        if ((addr & ~REG_F0_REG_MASK) == 0)
+                func_num = SDIO_FUNC_0;
+        else
+                func_num = SDIO_FUNC_1;
 
-        if (rw) {               /* CMD52 Write */
-                if (nbytes == 4)
-                        sdio_writel(sdiodev->func[func], *word, addr,
-                                    &err_ret);
-                else if (nbytes == 2)
-                        sdio_writew(sdiodev->func[func], (*word & 0xFFFF),
-                                    addr, &err_ret);
-                else
-                        brcmf_err("Invalid nbytes: %d\n", nbytes);
-        } else {                /* CMD52 Read */
-                if (nbytes == 4)
-                        *word = sdio_readl(sdiodev->func[func], addr, &err_ret);
-                else if (nbytes == 2)
-                        *word = sdio_readw(sdiodev->func[func], addr,
-                                           &err_ret) & 0xFFFF;
-                else
-                        brcmf_err("Invalid nbytes: %d\n", nbytes);
-        }
+        do {
+                if (!write)
+                        memset(data, 0, regsz);
+                /* for retry wait for 1 ms till bus get settled down */
+                if (retry)
+                        usleep_range(1000, 2000);
+                ret = brcmf_sdiod_request_data(sdiodev, func_num, addr, regsz,
+                                               data, write);
+        } while (ret != 0 && retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
 
-        if (err_ret)
-                brcmf_err("Failed to %s word, Err: 0x%08x\n",
-                          rw ? "write" : "read", err_ret);
+        if (ret != 0)
+                brcmf_err("failed with %d\n", ret);
 
-        return err_ret;
+        return ret;
 }
 
 static int
@@ -311,24 +319,17 @@ brcmf_sdiod_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev, u32 address)
 {
         int err = 0, i;
         u8 addr[3];
-        s32 retry;
 
         addr[0] = (address >> 8) & SBSDIO_SBADDRLOW_MASK;
         addr[1] = (address >> 16) & SBSDIO_SBADDRMID_MASK;
         addr[2] = (address >> 24) & SBSDIO_SBADDRHIGH_MASK;
 
         for (i = 0; i < 3; i++) {
-                retry = 0;
-                do {
-                        if (retry)
-                                usleep_range(1000, 2000);
-                        err = brcmf_sdiod_request_byte(sdiodev, SDIOH_WRITE,
-                                        SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRLOW + i,
-                                        &addr[i]);
-                } while (err != 0 && retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
-
+                err = brcmf_sdiod_regrw_helper(sdiodev,
+                                               SBSDIO_FUNC1_SBADDRLOW + i,
+                                               sizeof(u8), &addr[i], true);
                 if (err) {
-                        brcmf_err("failed at addr:0x%0x\n",
+                        brcmf_err("failed at addr: 0x%0x\n",
                                   SBSDIO_FUNC1_SBADDRLOW + i);
                         break;
                 }
@@ -359,61 +360,14 @@ brcmf_sdiod_addrprep(struct brcmf_sdio_dev *sdiodev, uint width, u32 *addr)
         return 0;
 }
 
-static int brcmf_sdiod_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
-                                    void *data, bool write)
-{
-        u8 func_num, reg_size;
-        s32 retry = 0;
-        int ret;
-
-        /*
-         * figure out how to read the register based on address range
-         * 0x00 ~ 0x7FF: function 0 CCCR and FBR
-         * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
-         * The rest: function 1 silicon backplane core registers
-         */
-        if ((addr & ~REG_F0_REG_MASK) == 0) {
-                func_num = SDIO_FUNC_0;
-                reg_size = 1;
-        } else if ((addr & ~REG_F1_MISC_MASK) == 0) {
-                func_num = SDIO_FUNC_1;
-                reg_size = 1;
-        } else {
-                func_num = SDIO_FUNC_1;
-                reg_size = 4;
-
-                ret = brcmf_sdiod_addrprep(sdiodev, reg_size, &addr);
-                if (ret)
-                        goto done;
-        }
-
-        do {
-                if (!write)
-                        memset(data, 0, reg_size);
-                if (retry)      /* wait for 1 ms till bus get settled down */
-                        usleep_range(1000, 2000);
-                if (reg_size == 1)
-                        ret = brcmf_sdiod_request_byte(sdiodev, write,
-                                                       func_num, addr, data);
-                else
-                        ret = brcmf_sdiod_request_word(sdiodev, write,
-                                                       func_num, addr, data, 4);
-        } while (ret != 0 && retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
-
-done:
-        if (ret != 0)
-                brcmf_err("failed with %d\n", ret);
-
-        return ret;
-}
-
 u8 brcmf_sdiod_regrb(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
 {
         u8 data;
         int retval;
 
         brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
-        retval = brcmf_sdiod_regrw_helper(sdiodev, addr, &data, false);
+        retval = brcmf_sdiod_regrw_helper(sdiodev, addr, sizeof(data), &data,
+                                          false);
         brcmf_dbg(SDIO, "data:0x%02x\n", data);
 
         if (ret)
@@ -428,9 +382,14 @@ u32 brcmf_sdiod_regrl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
         int retval;
 
         brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
-        retval = brcmf_sdiod_regrw_helper(sdiodev, addr, &data, false);
+        retval = brcmf_sdiod_addrprep(sdiodev, sizeof(data), &addr);
+        if (retval)
+                goto done;
+        retval = brcmf_sdiod_regrw_helper(sdiodev, addr, sizeof(data), &data,
+                                          false);
         brcmf_dbg(SDIO, "data:0x%08x\n", data);
 
+done:
         if (ret)
                 *ret = retval;
 
@@ -443,8 +402,8 @@ void brcmf_sdiod_regwb(struct brcmf_sdio_dev *sdiodev, u32 addr,
         int retval;
 
         brcmf_dbg(SDIO, "addr:0x%08x, data:0x%02x\n", addr, data);
-        retval = brcmf_sdiod_regrw_helper(sdiodev, addr, &data, true);
-
+        retval = brcmf_sdiod_regrw_helper(sdiodev, addr, sizeof(data), &data,
+                                          true);
         if (ret)
                 *ret = retval;
 }
@@ -455,8 +414,13 @@ void brcmf_sdiod_regwl(struct brcmf_sdio_dev *sdiodev, u32 addr,
         int retval;
 
         brcmf_dbg(SDIO, "addr:0x%08x, data:0x%08x\n", addr, data);
-        retval = brcmf_sdiod_regrw_helper(sdiodev, addr, &data, true);
+        retval = brcmf_sdiod_addrprep(sdiodev, sizeof(data), &addr);
+        if (retval)
+                goto done;
+        retval = brcmf_sdiod_regrw_helper(sdiodev, addr, sizeof(data), &data,
+                                          true);
 
+done:
         if (ret)
                 *ret = retval;
 }
@@ -879,8 +843,8 @@ int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, uint fn)
         brcmf_dbg(SDIO, "Enter\n");
 
         /* issue abort cmd52 command through F0 */
-        brcmf_sdiod_request_byte(sdiodev, SDIOH_WRITE, SDIO_FUNC_0,
-                                 SDIO_CCCR_ABORT, &t_func);
+        brcmf_sdiod_request_data(sdiodev, SDIO_FUNC_0, SDIO_CCCR_ABORT,
+                                 sizeof(t_func), &t_func, true);
 
         brcmf_dbg(SDIO, "Exit\n");
         return 0;
@@ -981,6 +945,7 @@ static const struct sdio_device_id brcmf_sdmmc_ids[] = {
         {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4329)},
         {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4330)},
         {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4334)},
+        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_43362)},
         {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM,
                      SDIO_DEVICE_ID_BROADCOM_4335_4339)},
         { /* end: all zeroes */ },
@@ -1037,7 +1002,6 @@ static int brcmf_ops_sdio_probe(struct sdio_func *func,
         sdiodev->pdata = brcmfmac_sdio_pdata;
 
         atomic_set(&sdiodev->suspend, false);
-        init_waitqueue_head(&sdiodev->request_byte_wait);
         init_waitqueue_head(&sdiodev->request_word_wait);
         init_waitqueue_head(&sdiodev->request_buffer_wait);
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
index 252024bcbc3b..939d6b132922 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
@@ -21,8 +21,6 @@
 #ifndef _BRCMF_H_
 #define _BRCMF_H_
 
-#define BRCMF_VERSION_STR               "4.218.248.5"
-
 #include "fweh.h"
 
 #define TOE_TX_CSUM_OL          0x00000001
@@ -39,6 +37,11 @@
 #define BRCMF_DCMD_MEDLEN       1536
 #define BRCMF_DCMD_MAXLEN       8192
 
+/* IOCTL from host to device are limited in lenght. A device can only handle
+ * ethernet frame size. This limitation is to be applied by protocol layer.
+ */
+#define BRCMF_TX_IOCTL_MAX_MSG_SIZE     (ETH_FRAME_LEN+ETH_FCS_LEN)
+
 #define BRCMF_AMPDU_RX_REORDER_MAXFLOWS         256
 
 /* Length of firmware version string stored for
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
index 548dbb5542c6..6a8983a1fb9c 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
@@ -32,15 +32,6 @@
 #define BRCMF_DEFAULT_SCAN_UNASSOC_TIME 40
 #define BRCMF_DEFAULT_PACKET_FILTER     "100 0 0 0 0x01 0x00"
 
-#ifdef DEBUG
-static const char brcmf_version[] =
-        "Dongle Host Driver, version " BRCMF_VERSION_STR "\nCompiled on "
-        __DATE__ " at " __TIME__;
-#else
-static const char brcmf_version[] =
-        "Dongle Host Driver, version " BRCMF_VERSION_STR;
-#endif
-
 
 bool brcmf_c_prec_enq(struct device *dev, struct pktq *q,
                       struct sk_buff *pkt, int prec)
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index bce0b8e511fd..af39edae8c62 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -702,7 +702,7 @@ int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked)
 
         brcmf_dbg(INFO, "%s: Broadcom Dongle Host Driver\n", ndev->name);
 
-        ndev->destructor = free_netdev;
+        ndev->destructor = brcmf_cfg80211_free_netdev;
         return 0;
 
 fail:
@@ -859,8 +859,6 @@ void brcmf_del_if(struct brcmf_pub *drvr, s32 bssidx)
                 }
                 /* unregister will take care of freeing it */
                 unregister_netdev(ifp->ndev);
-                if (bssidx == 0)
-                        brcmf_cfg80211_detach(drvr->config);
         } else {
                 kfree(ifp);
         }
@@ -963,8 +961,7 @@ int brcmf_bus_start(struct device *dev)
 fail:
         if (ret < 0) {
                 brcmf_err("failed: %d\n", ret);
-                if (drvr->config)
-                        brcmf_cfg80211_detach(drvr->config);
+                brcmf_cfg80211_detach(drvr->config);
                 if (drvr->fws) {
                         brcmf_fws_del_interface(ifp);
                         brcmf_fws_deinit(drvr);
@@ -1039,6 +1036,8 @@ void brcmf_detach(struct device *dev)
                         brcmf_del_if(drvr, i);
                 }
 
+        brcmf_cfg80211_detach(drvr->config);
+
         brcmf_bus_detach(drvr);
 
         brcmf_proto_detach(drvr);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index f214510e3bee..9c7f08a13105 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -509,6 +509,8 @@ enum brcmf_sdio_frmtype {
 #define BCM4334_NVRAM_NAME              "brcm/brcmfmac4334-sdio.txt"
 #define BCM4335_FIRMWARE_NAME           "brcm/brcmfmac4335-sdio.bin"
 #define BCM4335_NVRAM_NAME              "brcm/brcmfmac4335-sdio.txt"
+#define BCM43362_FIRMWARE_NAME          "brcm/brcmfmac43362-sdio.bin"
+#define BCM43362_NVRAM_NAME             "brcm/brcmfmac43362-sdio.txt"
 #define BCM4339_FIRMWARE_NAME           "brcm/brcmfmac4339-sdio.bin"
 #define BCM4339_NVRAM_NAME              "brcm/brcmfmac4339-sdio.txt"
 
@@ -526,6 +528,8 @@ MODULE_FIRMWARE(BCM4334_FIRMWARE_NAME);
 MODULE_FIRMWARE(BCM4334_NVRAM_NAME);
 MODULE_FIRMWARE(BCM4335_FIRMWARE_NAME);
 MODULE_FIRMWARE(BCM4335_NVRAM_NAME);
+MODULE_FIRMWARE(BCM43362_FIRMWARE_NAME);
+MODULE_FIRMWARE(BCM43362_NVRAM_NAME);
 MODULE_FIRMWARE(BCM4339_FIRMWARE_NAME);
 MODULE_FIRMWARE(BCM4339_NVRAM_NAME);
 
@@ -552,6 +556,7 @@ static const struct brcmf_firmware_names brcmf_fwname_data[] = {
         { BCM4330_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4330) },
         { BCM4334_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4334) },
         { BCM4335_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4335) },
+        { BCM43362_CHIP_ID, 0xFFFFFFFE, BRCMF_FIRMWARE_NVRAM(BCM43362) },
         { BCM4339_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4339) }
 };
 
@@ -3384,7 +3389,8 @@ err:
 
 static bool brcmf_sdio_sr_capable(struct brcmf_sdio *bus)
 {
-        u32 addr, reg;
+        u32 addr, reg, pmu_cc3_mask = ~0;
+        int err;
 
         brcmf_dbg(TRACE, "Enter\n");
 
@@ -3392,13 +3398,27 @@ static bool brcmf_sdio_sr_capable(struct brcmf_sdio *bus)
         if (bus->ci->pmurev < 17)
                 return false;
 
-        /* read PMU chipcontrol register 3*/
-        addr = CORE_CC_REG(bus->ci->c_inf[0].base, chipcontrol_addr);
-        brcmf_sdiod_regwl(bus->sdiodev, addr, 3, NULL);
-        addr = CORE_CC_REG(bus->ci->c_inf[0].base, chipcontrol_data);
-        reg = brcmf_sdiod_regrl(bus->sdiodev, addr, NULL);
+        switch (bus->ci->chip) {
+        case BCM43241_CHIP_ID:
+        case BCM4335_CHIP_ID:
+        case BCM4339_CHIP_ID:
+                /* read PMU chipcontrol register 3 */
+                addr = CORE_CC_REG(bus->ci->c_inf[0].base, chipcontrol_addr);
+                brcmf_sdiod_regwl(bus->sdiodev, addr, 3, NULL);
+                addr = CORE_CC_REG(bus->ci->c_inf[0].base, chipcontrol_data);
+                reg = brcmf_sdiod_regrl(bus->sdiodev, addr, NULL);
+                return (reg & pmu_cc3_mask) != 0;
+        default:
+                addr = CORE_CC_REG(bus->ci->c_inf[0].base, pmucapabilities_ext);
+                reg = brcmf_sdiod_regrl(bus->sdiodev, addr, &err);
+                if ((reg & PCAPEXT_SR_SUPPORTED_MASK) == 0)
+                        return false;
 
-        return (bool)reg;
+                addr = CORE_CC_REG(bus->ci->c_inf[0].base, retention_ctl);
+                reg = brcmf_sdiod_regrl(bus->sdiodev, addr, NULL);
+                return (reg & (PMU_RCTL_MACPHY_DISABLE_MASK |
+                               PMU_RCTL_LOGIC_DISABLE_MASK)) == 0;
+        }
 }
 
 static void brcmf_sdio_sr_init(struct brcmf_sdio *bus)
@@ -3615,7 +3635,7 @@ static int brcmf_sdio_bus_init(struct device *dev)
         }
 
         /* If we didn't come up, turn off backplane clock */
-        if (bus_if->state != BRCMF_BUS_DATA)
+        if (ret != 0)
                 brcmf_sdio_clkctl(bus, CLK_NONE, false);
 
 exit:
@@ -3750,31 +3770,6 @@ static void brcmf_sdio_dataworker(struct work_struct *work)
         }
 }
 
-static void brcmf_sdio_release_malloc(struct brcmf_sdio *bus)
-{
-        brcmf_dbg(TRACE, "Enter\n");
-
-        kfree(bus->rxbuf);
-        bus->rxctl = bus->rxbuf = NULL;
-        bus->rxlen = 0;
-}
-
-static bool brcmf_sdio_probe_malloc(struct brcmf_sdio *bus)
-{
-        brcmf_dbg(TRACE, "Enter\n");
-
-        if (bus->sdiodev->bus_if->maxctl) {
-                bus->rxblen =
-                    roundup((bus->sdiodev->bus_if->maxctl + SDPCM_HDRLEN),
-                            ALIGNMENT) + bus->head_align;
-                bus->rxbuf = kmalloc(bus->rxblen, GFP_ATOMIC);
-                if (!(bus->rxbuf))
-                        return false;
-        }
-
-        return true;
-}
-
 static bool
 brcmf_sdio_probe_attach(struct brcmf_sdio *bus)
 {
@@ -3888,39 +3883,6 @@ fail:
         return false;
 }
 
-static bool brcmf_sdio_probe_init(struct brcmf_sdio *bus)
-{
-        brcmf_dbg(TRACE, "Enter\n");
-
-        sdio_claim_host(bus->sdiodev->func[1]);
-
-        /* Disable F2 to clear any intermediate frame state on the dongle */
-        sdio_disable_func(bus->sdiodev->func[SDIO_FUNC_2]);
-
-        bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
-        bus->rxflow = false;
-
-        /* Done with backplane-dependent accesses, can drop clock... */
-        brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
-
-        sdio_release_host(bus->sdiodev->func[1]);
-
-        /* ...and initialize clock/power states */
-        bus->clkstate = CLK_SDONLY;
-        bus->idletime = BRCMF_IDLE_INTERVAL;
-        bus->idleclock = BRCMF_IDLE_ACTIVE;
-
-        /* Query the F2 block size, set roundup accordingly */
-        bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
-        bus->roundup = min(max_roundup, bus->blocksize);
-
-        /* SR state */
-        bus->sleeping = false;
-        bus->sr_enabled = false;
-
-        return true;
-}
-
 static int
 brcmf_sdio_watchdog_thread(void *data)
 {
@@ -3955,24 +3917,6 @@ brcmf_sdio_watchdog(unsigned long data)
         }
 }
 
-static void brcmf_sdio_release_dongle(struct brcmf_sdio *bus)
-{
-        brcmf_dbg(TRACE, "Enter\n");
-
-        if (bus->ci) {
-                sdio_claim_host(bus->sdiodev->func[1]);
-                brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
-                brcmf_sdio_clkctl(bus, CLK_NONE, false);
-                sdio_release_host(bus->sdiodev->func[1]);
-                brcmf_sdio_chip_detach(&bus->ci);
-                if (bus->vars && bus->varsz)
-                        kfree(bus->vars);
-                bus->vars = NULL;
-        }
-
-        brcmf_dbg(TRACE, "Disconnected\n");
-}
-
 static struct brcmf_bus_ops brcmf_sdio_bus_ops = {
         .stop = brcmf_sdio_bus_stop,
         .preinit = brcmf_sdio_bus_preinit,
@@ -4066,15 +4010,42 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
         }
 
         /* Allocate buffers */
-        if (!(brcmf_sdio_probe_malloc(bus))) {
-                brcmf_err("brcmf_sdio_probe_malloc failed\n");
-                goto fail;
+        if (bus->sdiodev->bus_if->maxctl) {
+                bus->rxblen =
+                    roundup((bus->sdiodev->bus_if->maxctl + SDPCM_HDRLEN),
+                            ALIGNMENT) + bus->head_align;
+                bus->rxbuf = kmalloc(bus->rxblen, GFP_ATOMIC);
+                if (!(bus->rxbuf)) {
+                        brcmf_err("rxbuf allocation failed\n");
+                        goto fail;
+                }
         }
 
-        if (!(brcmf_sdio_probe_init(bus))) {
-                brcmf_err("brcmf_sdio_probe_init failed\n");
-                goto fail;
-        }
+        sdio_claim_host(bus->sdiodev->func[1]);
+
+        /* Disable F2 to clear any intermediate frame state on the dongle */
+        sdio_disable_func(bus->sdiodev->func[SDIO_FUNC_2]);
+
+        bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
+        bus->rxflow = false;
+
+        /* Done with backplane-dependent accesses, can drop clock... */
+        brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
+
+        sdio_release_host(bus->sdiodev->func[1]);
+
+        /* ...and initialize clock/power states */
+        bus->clkstate = CLK_SDONLY;
+        bus->idletime = BRCMF_IDLE_INTERVAL;
+        bus->idleclock = BRCMF_IDLE_ACTIVE;
+
+        /* Query the F2 block size, set roundup accordingly */
+        bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
+        bus->roundup = min(max_roundup, bus->blocksize);
+
+        /* SR state */
+        bus->sleeping = false;
+        bus->sr_enabled = false;
 
         brcmf_sdio_debugfs_create(bus);
         brcmf_dbg(INFO, "completed!!\n");
@@ -4108,12 +4079,20 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus)
 
                 if (bus->sdiodev->bus_if->drvr) {
                         brcmf_detach(bus->sdiodev->dev);
-                        brcmf_sdio_release_dongle(bus);
+                }
+
+                if (bus->ci) {
+                        sdio_claim_host(bus->sdiodev->func[1]);
+                        brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
+                        brcmf_sdio_clkctl(bus, CLK_NONE, false);
+                        sdio_release_host(bus->sdiodev->func[1]);
+                        brcmf_sdio_chip_detach(&bus->ci);
                 }
 
                 brcmu_pkt_buf_free_skb(bus->txglom_sgpad);
-                brcmf_sdio_release_malloc(bus);
+                kfree(bus->rxbuf);
                 kfree(bus->hdrbuf);
+                kfree(bus->vars);
                 kfree(bus);
         }
 
@@ -4131,7 +4110,7 @@ void brcmf_sdio_wd_timer(struct brcmf_sdio *bus, uint wdtick)
         }
 
         /* don't start the wd until fw is loaded */
-        if (bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN)
+        if (bus->sdiodev->bus_if->state != BRCMF_BUS_DATA)
                 return;
 
         if (wdtick) {
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
index 7918c1033662..c3e7d76dbf35 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
@@ -1873,7 +1873,7 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
         brcmf_dbg(DATA, "tx proto=0x%X\n", ntohs(eh->h_proto));
         /* determine the priority */
         if (!skb->priority)
-                skb->priority = cfg80211_classify8021d(skb);
+                skb->priority = cfg80211_classify8021d(skb, NULL);
 
         drvr->tx_multicast += !!multicast;
         if (pae)
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
index 185af8a84c9a..fc4f98b275d7 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
@@ -1955,21 +1955,21 @@ s32 brcmf_p2p_attach(struct brcmf_cfg80211_info *cfg)
                 err = brcmf_fil_iovar_int_set(pri_ifp, "p2p_disc", 1);
                 if (err < 0) {
                         brcmf_err("set p2p_disc error\n");
-                        brcmf_free_vif(cfg, p2p_vif);
+                        brcmf_free_vif(p2p_vif);
                         goto exit;
                 }
                 /* obtain bsscfg index for P2P discovery */
                 err = brcmf_fil_iovar_int_get(pri_ifp, "p2p_dev", &bssidx);
                 if (err < 0) {
                         brcmf_err("retrieving discover bsscfg index failed\n");
-                        brcmf_free_vif(cfg, p2p_vif);
+                        brcmf_free_vif(p2p_vif);
                         goto exit;
                 }
                 /* Verify that firmware uses same bssidx as driver !! */
                 if (p2p_ifp->bssidx != bssidx) {
                         brcmf_err("Incorrect bssidx=%d, compared to p2p_ifp->bssidx=%d\n",
                                   bssidx, p2p_ifp->bssidx);
-                        brcmf_free_vif(cfg, p2p_vif);
+                        brcmf_free_vif(p2p_vif);
                         goto exit;
                 }
 
@@ -1997,7 +1997,7 @@ void brcmf_p2p_detach(struct brcmf_p2p_info *p2p)
                 brcmf_p2p_cancel_remain_on_channel(vif->ifp);
                 brcmf_p2p_deinit_discovery(p2p);
                 /* remove discovery interface */
-                brcmf_free_vif(p2p->cfg, vif);
+                brcmf_free_vif(vif);
                 p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
         }
         /* just set it all to zero */
@@ -2222,7 +2222,7 @@ static struct wireless_dev *brcmf_p2p_create_p2pdev(struct brcmf_p2p_info *p2p,
         return &p2p_vif->wdev;
 
 fail:
-        brcmf_free_vif(p2p->cfg, p2p_vif);
+        brcmf_free_vif(p2p_vif);
         return ERR_PTR(err);
 }
 
@@ -2231,31 +2231,12 @@ fail:
  *
  * @vif: virtual interface object to delete.
  */
-static void brcmf_p2p_delete_p2pdev(struct brcmf_cfg80211_info *cfg,
+static void brcmf_p2p_delete_p2pdev(struct brcmf_p2p_info *p2p,
                                     struct brcmf_cfg80211_vif *vif)
 {
         cfg80211_unregister_wdev(&vif->wdev);
-        cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
-        brcmf_free_vif(cfg, vif);
-}
-
-/**
- * brcmf_p2p_free_p2p_if() - free up net device related data.
- *
- * @ndev: net device that needs to be freed.
- */
-static void brcmf_p2p_free_p2p_if(struct net_device *ndev)
-{
-        struct brcmf_cfg80211_info *cfg;
-        struct brcmf_cfg80211_vif *vif;
-        struct brcmf_if *ifp;
-
-        ifp = netdev_priv(ndev);
-        cfg = ifp->drvr->config;
-        vif = ifp->vif;
-
-        brcmf_free_vif(cfg, vif);
-        free_netdev(ifp->ndev);
+        p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
+        brcmf_free_vif(vif);
 }
 
 /**
@@ -2335,8 +2316,6 @@ struct wireless_dev *brcmf_p2p_add_vif(struct wiphy *wiphy, const char *name,
                 brcmf_err("Registering netdevice failed\n");
                 goto fail;
         }
-        /* override destructor */
-        ifp->ndev->destructor = brcmf_p2p_free_p2p_if;
 
         cfg->p2p.bss_idx[P2PAPI_BSSCFG_CONNECTION].vif = vif;
         /* Disable firmware roaming for P2P interface  */
@@ -2349,7 +2328,7 @@ struct wireless_dev *brcmf_p2p_add_vif(struct wiphy *wiphy, const char *name,
         return &ifp->vif->wdev;
 
 fail:
-        brcmf_free_vif(cfg, vif);
+        brcmf_free_vif(vif);
         return ERR_PTR(err);
 }
 
@@ -2358,8 +2337,6 @@ fail:
  *
  * @wiphy: wiphy device of interface.
  * @wdev: wireless device of interface.
- *
- * TODO: not yet supported.
  */
 int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
 {
@@ -2385,7 +2362,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
                 break;
 
         case NL80211_IFTYPE_P2P_DEVICE:
-                brcmf_p2p_delete_p2pdev(cfg, vif);
+                brcmf_p2p_delete_p2pdev(p2p, vif);
                 return 0;
         default:
                 return -ENOTSUPP;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
index 5f39f28e6efb..9fd40675f18e 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
@@ -19,6 +19,7 @@
 #include <linux/netdevice.h>
 #include <linux/mmc/card.h>
 #include <linux/mmc/sdio_func.h>
+#include <linux/mmc/sdio_ids.h>
 #include <linux/ssb/ssb_regs.h>
 #include <linux/bcma/bcma.h>
 
@@ -83,6 +84,24 @@ static const struct sdiod_drive_str sdiod_drvstr_tab1_1v8[] = {
         {0, 0x1}
 };
 
+/* SDIO Drive Strength to sel value table for PMU Rev 13 (1.8v) */
+static const struct sdiod_drive_str sdiod_drive_strength_tab5_1v8[] = {
+        {6, 0x7},
+        {5, 0x6},
+        {4, 0x5},
+        {3, 0x4},
+        {2, 0x2},
+        {1, 0x1},
+        {0, 0x0}
+};
+
+/* SDIO Drive Strength to sel value table for PMU Rev 17 (1.8v) */
+static const struct sdiod_drive_str sdiod_drvstr_tab6_1v8[] = {
+        {3, 0x3},
+        {2, 0x2},
+        {1, 0x1},
+        {0, 0x0} };
+
 /* SDIO Drive Strength to sel value table for 43143 PMU Rev 17 (3.3V) */
 static const struct sdiod_drive_str sdiod_drvstr_tab2_3v3[] = {
         {16, 0x7},
@@ -569,6 +588,23 @@ static int brcmf_sdio_chip_recognition(struct brcmf_sdio_dev *sdiodev,
                 ci->ramsize = 0xc0000;
                 ci->rambase = 0x180000;
                 break;
+        case BCM43362_CHIP_ID:
+                ci->c_inf[0].wrapbase = 0x18100000;
+                ci->c_inf[0].cib = 0x27004211;
+                ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
+                ci->c_inf[1].base = 0x18002000;
+                ci->c_inf[1].wrapbase = 0x18102000;
+                ci->c_inf[1].cib = 0x0a004211;
+                ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
+                ci->c_inf[2].base = 0x18004000;
+                ci->c_inf[2].wrapbase = 0x18104000;
+                ci->c_inf[2].cib = 0x08080401;
+                ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
+                ci->c_inf[3].base = 0x18003000;
+                ci->c_inf[3].wrapbase = 0x18103000;
+                ci->c_inf[3].cib = 0x03004211;
+                ci->ramsize = 0x3C000;
+                break;
         default:
                 brcmf_err("chipid 0x%x is not supported\n", ci->chip);
                 return -ENODEV;
@@ -757,6 +793,11 @@ brcmf_sdio_chip_drivestrengthinit(struct brcmf_sdio_dev *sdiodev,
                 str_mask = 0x00003800;
                 str_shift = 11;
                 break;
+        case SDIOD_DRVSTR_KEY(BCM4334_CHIP_ID, 17):
+                str_tab = sdiod_drvstr_tab6_1v8;
+                str_mask = 0x00001800;
+                str_shift = 11;
+                break;
         case SDIOD_DRVSTR_KEY(BCM43143_CHIP_ID, 17):
                 /* note: 43143 does not support tristate */
                 i = ARRAY_SIZE(sdiod_drvstr_tab2_3v3) - 1;
@@ -769,6 +810,11 @@ brcmf_sdio_chip_drivestrengthinit(struct brcmf_sdio_dev *sdiodev,
                                   brcmf_sdio_chip_name(ci->chip, chn, 8),
                                   drivestrength);
                 break;
+        case SDIOD_DRVSTR_KEY(BCM43362_CHIP_ID, 13):
+                str_tab = sdiod_drive_strength_tab5_1v8;
+                str_mask = 0x00003800;
+                str_shift = 11;
+                break;
         default:
                 brcmf_err("No SDIO Drive strength init done for chip %s rev %d pmurev %d\n",
                           brcmf_sdio_chip_name(ci->chip, chn, 8),
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h
index d0f4b45b24c7..7ea424e20773 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h
@@ -54,14 +54,6 @@
 
 #define BRCMF_MAX_CORENUM       6
 
-/* SDIO device ID */
-#define SDIO_DEVICE_ID_BROADCOM_43143           43143
-#define SDIO_DEVICE_ID_BROADCOM_43241           0x4324
-#define SDIO_DEVICE_ID_BROADCOM_4329            0x4329
-#define SDIO_DEVICE_ID_BROADCOM_4330            0x4330
-#define SDIO_DEVICE_ID_BROADCOM_4334            0x4334
-#define SDIO_DEVICE_ID_BROADCOM_4335_4339       0x4335
-
 struct chip_core_info {
         u16 id;
         u16 rev;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h b/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
index a0981b32c729..092e9c824992 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
@@ -167,7 +167,6 @@ struct brcmf_sdio_dev {
         u32 sbwad;                      /* Save backplane window address */
         struct brcmf_sdio *bus;
         atomic_t suspend;               /* suspend flag */
-        wait_queue_head_t request_byte_wait;
         wait_queue_head_t request_word_wait;
         wait_queue_head_t request_buffer_wait;
         struct device *dev;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index 3966fe0fcfd9..aad83aef7d93 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -1095,10 +1095,10 @@ static void brcmf_link_down(struct brcmf_cfg80211_vif *vif)
                                              BRCMF_C_DISASSOC, NULL, 0);
                 if (err) {
                         brcmf_err("WLC_DISASSOC failed (%d)\n", err);
-                        cfg80211_disconnected(vif->wdev.netdev, 0,
-                                              NULL, 0, GFP_KERNEL);
                 }
                 clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state);
+                cfg80211_disconnected(vif->wdev.netdev, 0, NULL, 0, GFP_KERNEL);
+
         }
         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
@@ -1758,6 +1758,7 @@ brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
                 return -EIO;
 
         clear_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
+        cfg80211_disconnected(ndev, reason_code, NULL, 0, GFP_KERNEL);
 
         memcpy(&scbval.ea, &profile->bssid, ETH_ALEN);
         scbval.val = cpu_to_le32(reason_code);
@@ -4359,9 +4360,6 @@ struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
 {
         struct brcmf_cfg80211_vif *vif;
 
-        if (cfg->vif_cnt == BRCMF_IFACE_MAX_CNT)
-                return ERR_PTR(-ENOSPC);
-
         brcmf_dbg(TRACE, "allocating virtual interface (size=%zu)\n",
                   sizeof(*vif));
         vif = kzalloc(sizeof(*vif), GFP_KERNEL);
@@ -4378,21 +4376,25 @@ struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
         brcmf_init_prof(&vif->profile);
 
         list_add_tail(&vif->list, &cfg->vif_list);
-        cfg->vif_cnt++;
         return vif;
 }
 
-void brcmf_free_vif(struct brcmf_cfg80211_info *cfg,
-                    struct brcmf_cfg80211_vif *vif)
+void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
 {
         list_del(&vif->list);
-        cfg->vif_cnt--;
-
         kfree(vif);
-        if (!cfg->vif_cnt) {
-                wiphy_unregister(cfg->wiphy);
-                wiphy_free(cfg->wiphy);
-        }
+}
+
+void brcmf_cfg80211_free_netdev(struct net_device *ndev)
+{
+        struct brcmf_cfg80211_vif *vif;
+        struct brcmf_if *ifp;
+
+        ifp = netdev_priv(ndev);
+        vif = ifp->vif;
+
+        brcmf_free_vif(vif);
+        free_netdev(ndev);
 }
 
 static bool brcmf_is_linkup(const struct brcmf_event_msg *e)
@@ -4979,20 +4981,20 @@ cfg80211_p2p_attach_out:
         wl_deinit_priv(cfg);
 
 cfg80211_attach_out:
-        brcmf_free_vif(cfg, vif);
+        brcmf_free_vif(vif);
         return NULL;
 }
 
 void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
 {
-        struct brcmf_cfg80211_vif *vif;
-        struct brcmf_cfg80211_vif *tmp;
+        if (!cfg)
+                return;
 
-        wl_deinit_priv(cfg);
+        WARN_ON(!list_empty(&cfg->vif_list));
+        wiphy_unregister(cfg->wiphy);
         brcmf_btcoex_detach(cfg);
-        list_for_each_entry_safe(vif, tmp, &cfg->vif_list, list) {
-                brcmf_free_vif(cfg, vif);
-        }
+        wl_deinit_priv(cfg);
+        wiphy_free(cfg->wiphy);
 }
 
 static s32
@@ -5087,7 +5089,8 @@ dongle_scantime_out:
 }
 
 
-static s32 brcmf_construct_reginfo(struct brcmf_cfg80211_info *cfg, u32 bw_cap)
+static s32 brcmf_construct_reginfo(struct brcmf_cfg80211_info *cfg,
+                                   u32 bw_cap[])
 {
         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
         struct ieee80211_channel *band_chan_arr;
@@ -5100,7 +5103,6 @@ static s32 brcmf_construct_reginfo(struct brcmf_cfg80211_info *cfg, u32 bw_cap)
         enum ieee80211_band band;
         u32 channel;
         u32 *n_cnt;
-        bool ht40_allowed;
         u32 index;
         u32 ht40_flag;
         bool update;
@@ -5133,18 +5135,17 @@ static s32 brcmf_construct_reginfo(struct brcmf_cfg80211_info *cfg, u32 bw_cap)
                         array_size = ARRAY_SIZE(__wl_2ghz_channels);
                         n_cnt = &__wl_band_2ghz.n_channels;
                         band = IEEE80211_BAND_2GHZ;
-                        ht40_allowed = (bw_cap == WLC_N_BW_40ALL);
                 } else if (ch.band == BRCMU_CHAN_BAND_5G) {
                         band_chan_arr = __wl_5ghz_a_channels;
                         array_size = ARRAY_SIZE(__wl_5ghz_a_channels);
                         n_cnt = &__wl_band_5ghz_a.n_channels;
                         band = IEEE80211_BAND_5GHZ;
-                        ht40_allowed = !(bw_cap == WLC_N_BW_20ALL);
                 } else {
-                        brcmf_err("Invalid channel Sepc. 0x%x.\n", ch.chspec);
+                        brcmf_err("Invalid channel Spec. 0x%x.\n", ch.chspec);
                         continue;
                 }
-                if (!ht40_allowed && ch.bw == BRCMU_CHAN_BW_40)
+                if (!(bw_cap[band] & WLC_BW_40MHZ_BIT) &&
+                    ch.bw == BRCMU_CHAN_BW_40)
                         continue;
                 update = false;
                 for (j = 0; (j < *n_cnt && (*n_cnt < array_size)); j++) {
@@ -5162,7 +5163,10 @@ static s32 brcmf_construct_reginfo(struct brcmf_cfg80211_info *cfg, u32 bw_cap)
                                 ieee80211_channel_to_frequency(ch.chnum, band);
                         band_chan_arr[index].hw_value = ch.chnum;
 
-                        if (ch.bw == BRCMU_CHAN_BW_40 && ht40_allowed) {
+                        brcmf_err("channel %d: f=%d bw=%d sb=%d\n",
+                                  ch.chnum, band_chan_arr[index].center_freq,
+                                  ch.bw, ch.sb);
+                        if (ch.bw == BRCMU_CHAN_BW_40) {
                                 /* assuming the order is HT20, HT40 Upper,
                                  * HT40 lower from chanspecs
                                  */
@@ -5213,6 +5217,46 @@ exit:
         return err;
 }
 
+static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
+{
+        u32 band, mimo_bwcap;
+        int err;
+
+        band = WLC_BAND_2G;
+        err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
+        if (!err) {
+                bw_cap[IEEE80211_BAND_2GHZ] = band;
+                band = WLC_BAND_5G;
+                err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
+                if (!err) {
+                        bw_cap[IEEE80211_BAND_5GHZ] = band;
+                        return;
+                }
+                WARN_ON(1);
+                return;
+        }
+        brcmf_dbg(INFO, "fallback to mimo_bw_cap info\n");
+        mimo_bwcap = 0;
+        err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &mimo_bwcap);
+        if (err)
+                /* assume 20MHz if firmware does not give a clue */
+                mimo_bwcap = WLC_N_BW_20ALL;
+
+        switch (mimo_bwcap) {
+        case WLC_N_BW_40ALL:
+                bw_cap[IEEE80211_BAND_2GHZ] |= WLC_BW_40MHZ_BIT;
+                /* fall-thru */
+        case WLC_N_BW_20IN2G_40IN5G:
+                bw_cap[IEEE80211_BAND_5GHZ] |= WLC_BW_40MHZ_BIT;
+                /* fall-thru */
+        case WLC_N_BW_20ALL:
+                bw_cap[IEEE80211_BAND_2GHZ] |= WLC_BW_20MHZ_BIT;
+                bw_cap[IEEE80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
+                break;
+        default:
+                brcmf_err("invalid mimo_bw_cap value\n");
+        }
+}
 
 static s32 brcmf_update_wiphybands(struct brcmf_cfg80211_info *cfg)
 {
@@ -5221,13 +5265,13 @@ static s32 brcmf_update_wiphybands(struct brcmf_cfg80211_info *cfg)
         s32 phy_list;
         u32 band_list[3];
         u32 nmode;
-        u32 bw_cap = 0;
+        u32 bw_cap[2] = { 0, 0 };
         s8 phy;
         s32 err;
         u32 nband;
         s32 i;
-        struct ieee80211_supported_band *bands[IEEE80211_NUM_BANDS];
-        s32 index;
+        struct ieee80211_supported_band *bands[2] = { NULL, NULL };
+        struct ieee80211_supported_band *band;
 
         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_PHYLIST,
                                      &phy_list, sizeof(phy_list));
@@ -5253,11 +5297,10 @@ static s32 brcmf_update_wiphybands(struct brcmf_cfg80211_info *cfg)
         if (err) {
                 brcmf_err("nmode error (%d)\n", err);
         } else {
-                err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &bw_cap);
-                if (err)
-                        brcmf_err("mimo_bw_cap error (%d)\n", err);
+                brcmf_get_bwcap(ifp, bw_cap);
         }
-        brcmf_dbg(INFO, "nmode=%d, mimo_bw_cap=%d\n", nmode, bw_cap);
+        brcmf_dbg(INFO, "nmode=%d, bw_cap=(%d, %d)\n", nmode,
+                  bw_cap[IEEE80211_BAND_2GHZ], bw_cap[IEEE80211_BAND_5GHZ]);
 
         err = brcmf_construct_reginfo(cfg, bw_cap);
         if (err) {
@@ -5266,40 +5309,33 @@ static s32 brcmf_update_wiphybands(struct brcmf_cfg80211_info *cfg)
         }
 
         nband = band_list[0];
-        memset(bands, 0, sizeof(bands));
 
         for (i = 1; i <= nband && i < ARRAY_SIZE(band_list); i++) {
-                index = -1;
+                band = NULL;
                 if ((band_list[i] == WLC_BAND_5G) &&
-                    (__wl_band_5ghz_a.n_channels > 0)) {
-                        index = IEEE80211_BAND_5GHZ;
-                        bands[index] = &__wl_band_5ghz_a;
-                        if ((bw_cap == WLC_N_BW_40ALL) ||
-                            (bw_cap == WLC_N_BW_20IN2G_40IN5G))
-                                bands[index]->ht_cap.cap |=
-                                                        IEEE80211_HT_CAP_SGI_40;
-                } else if ((band_list[i] == WLC_BAND_2G) &&
-                           (__wl_band_2ghz.n_channels > 0)) {
-                        index = IEEE80211_BAND_2GHZ;
-                        bands[index] = &__wl_band_2ghz;
-                        if (bw_cap == WLC_N_BW_40ALL)
-                                bands[index]->ht_cap.cap |=
-                                                        IEEE80211_HT_CAP_SGI_40;
-                }
+                    (__wl_band_5ghz_a.n_channels > 0))
+                        band = &__wl_band_5ghz_a;
+                else if ((band_list[i] == WLC_BAND_2G) &&
+                         (__wl_band_2ghz.n_channels > 0))
+                        band = &__wl_band_2ghz;
+                else
+                        continue;
 
-                if ((index >= 0) && nmode) {
-                        bands[index]->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
-                        bands[index]->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
-                        bands[index]->ht_cap.ht_supported = true;
-                        bands[index]->ht_cap.ampdu_factor =
-                                                IEEE80211_HT_MAX_AMPDU_64K;
-                        bands[index]->ht_cap.ampdu_density =
-                                                IEEE80211_HT_MPDU_DENSITY_16;
-                        /* An HT shall support all EQM rates for one spatial
-                         * stream
-                         */
-                        bands[index]->ht_cap.mcs.rx_mask[0] = 0xff;
+                if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
+                        band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
+                        band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
                 }
+                band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
+                band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
+                band->ht_cap.ht_supported = true;
+                band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
+                band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
+                /* An HT shall support all EQM rates for one spatial
+                 * stream
+                 */
+                band->ht_cap.mcs.rx_mask[0] = 0xff;
+                band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
+                bands[band->band] = band;
         }
 
         wiphy = cfg_to_wiphy(cfg);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
index d9bdaf9a72d0..2dc6a074e8ed 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
@@ -412,7 +412,6 @@ struct brcmf_cfg80211_info {
         struct work_struct escan_timeout_work;
         u8 *escan_ioctl_buf;
         struct list_head vif_list;
-        u8 vif_cnt;
         struct brcmf_cfg80211_vif_event vif_event;
         struct completion vif_disabled;
         struct brcmu_d11inf d11inf;
@@ -487,8 +486,7 @@ enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp);
 struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
                                            enum nl80211_iftype type,
                                            bool pm_block);
-void brcmf_free_vif(struct brcmf_cfg80211_info *cfg,
-                    struct brcmf_cfg80211_vif *vif);
+void brcmf_free_vif(struct brcmf_cfg80211_vif *vif);
 
 s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
                           const u8 *vndr_ie_buf, u32 vndr_ie_len);
@@ -507,5 +505,6 @@ s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
                                 bool fw_abort);
 void brcmf_set_mpc(struct brcmf_if *ndev, int mpc);
 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg);
+void brcmf_cfg80211_free_netdev(struct net_device *ndev);
 
 #endif                          /* _wl_cfg80211_h_ */
diff --git a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
index 84113ea16f84..6fa5d4863782 100644
--- a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
+++ b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
@@ -41,6 +41,7 @@
 #define BCM4331_CHIP_ID         0x4331
 #define BCM4334_CHIP_ID         0x4334
 #define BCM4335_CHIP_ID         0x4335
+#define BCM43362_CHIP_ID        43362
 #define BCM4339_CHIP_ID         0x4339
 
 #endif                          /* _BRCM_HW_IDS_H_ */
diff --git a/drivers/net/wireless/brcm80211/include/brcmu_wifi.h b/drivers/net/wireless/brcm80211/include/brcmu_wifi.h
index 0505cc065e0d..7ca2aa1035b2 100644
--- a/drivers/net/wireless/brcm80211/include/brcmu_wifi.h
+++ b/drivers/net/wireless/brcm80211/include/brcmu_wifi.h
@@ -82,6 +82,20 @@
 #define WLC_N_BW_40ALL                  1
 #define WLC_N_BW_20IN2G_40IN5G          2
 
+#define WLC_BW_20MHZ_BIT                BIT(0)
+#define WLC_BW_40MHZ_BIT                BIT(1)
+#define WLC_BW_80MHZ_BIT                BIT(2)
+#define WLC_BW_160MHZ_BIT               BIT(3)
+
+/* Bandwidth capabilities */
+#define WLC_BW_CAP_20MHZ                (WLC_BW_20MHZ_BIT)
+#define WLC_BW_CAP_40MHZ                (WLC_BW_40MHZ_BIT|WLC_BW_20MHZ_BIT)
+#define WLC_BW_CAP_80MHZ                (WLC_BW_80MHZ_BIT|WLC_BW_40MHZ_BIT| \
+                                         WLC_BW_20MHZ_BIT)
+#define WLC_BW_CAP_160MHZ               (WLC_BW_160MHZ_BIT|WLC_BW_80MHZ_BIT| \
+                                         WLC_BW_40MHZ_BIT|WLC_BW_20MHZ_BIT)
+#define WLC_BW_CAP_UNRESTRICTED         0xFF
+
 /* band types */
 #define WLC_BAND_AUTO                   0       /* auto-select */
 #define WLC_BAND_5G                     1       /* 5 Ghz */
diff --git a/drivers/net/wireless/cw1200/fwio.c b/drivers/net/wireless/cw1200/fwio.c
index acdff0f7f952..5a9ffd3a6a6c 100644
--- a/drivers/net/wireless/cw1200/fwio.c
+++ b/drivers/net/wireless/cw1200/fwio.c
@@ -14,7 +14,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/vmalloc.h>
 #include <linux/sched.h>
 #include <linux/firmware.h>
diff --git a/drivers/net/wireless/cw1200/main.c b/drivers/net/wireless/cw1200/main.c
index 090f01577dd2..d1270da4dfea 100644
--- a/drivers/net/wireless/cw1200/main.c
+++ b/drivers/net/wireless/cw1200/main.c
@@ -21,7 +21,6 @@
  */
 
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/firmware.h>
 #include <linux/etherdevice.h>
 #include <linux/vmalloc.h>
diff --git a/drivers/net/wireless/cw1200/pm.c b/drivers/net/wireless/cw1200/pm.c
index b37abb9f0453..6907c8fd4578 100644
--- a/drivers/net/wireless/cw1200/pm.c
+++ b/drivers/net/wireless/cw1200/pm.c
@@ -225,7 +225,7 @@ int cw1200_wow_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
                 cw1200_set_pm(priv, &priv->powersave_mode);
                 if (wait_event_interruptible_timeout(priv->ps_mode_switch_done,
                                                      !priv->ps_mode_switch_in_progress, 1*HZ) <= 0) {
-                        goto revert3;
+                        goto revert4;
                 }
         }
 
@@ -254,11 +254,11 @@ int cw1200_wow_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
 
         /* Stop serving thread */
         if (cw1200_bh_suspend(priv))
-                goto revert4;
+                goto revert5;
 
         ret = timer_pending(&priv->mcast_timeout);
         if (ret)
-                goto revert5;
+                goto revert6;
 
         /* Store suspend state */
         pm_state->suspend_state = state;
@@ -280,9 +280,9 @@ int cw1200_wow_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
 
         return 0;
 
-revert5:
+revert6:
         WARN_ON(cw1200_bh_resume(priv));
-revert4:
+revert5:
         cw1200_resume_work(priv, &priv->bss_loss_work,
                            state->bss_loss_tmo);
         cw1200_resume_work(priv, &priv->join_timeout,
@@ -291,6 +291,7 @@ revert4:
                            state->direct_probe);
         cw1200_resume_work(priv, &priv->link_id_gc_work,
                            state->link_id_gc);
+revert4:
         kfree(state);
 revert3:
         wsm_set_udp_port_filter(priv, &cw1200_udp_port_filter_off);
diff --git a/drivers/net/wireless/hostap/hostap_cs.c b/drivers/net/wireless/hostap/hostap_cs.c
index 56cd01ca8ad0..9f825f2620da 100644
--- a/drivers/net/wireless/hostap/hostap_cs.c
+++ b/drivers/net/wireless/hostap/hostap_cs.c
@@ -1,7 +1,6 @@
 #define PRISM2_PCCARD
 
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/if.h>
 #include <linux/slab.h>
 #include <linux/wait.h>
diff --git a/drivers/net/wireless/hostap/hostap_ioctl.c b/drivers/net/wireless/hostap/hostap_ioctl.c
index 2454a740ea50..3e5fa7872b64 100644
--- a/drivers/net/wireless/hostap/hostap_ioctl.c
+++ b/drivers/net/wireless/hostap/hostap_ioctl.c
@@ -2567,7 +2567,7 @@ static int prism2_ioctl_priv_prism2_param(struct net_device *dev,
                 local->passive_scan_interval = value;
                 if (timer_pending(&local->passive_scan_timer))
                         del_timer(&local->passive_scan_timer);
-                if (value > 0) {
+                if (value > 0 && value < INT_MAX / HZ) {
                         local->passive_scan_timer.expires = jiffies +
                                 local->passive_scan_interval * HZ;
                         add_timer(&local->passive_scan_timer);
diff --git a/drivers/net/wireless/hostap/hostap_pci.c b/drivers/net/wireless/hostap/hostap_pci.c
index 05ca3402dca7..91158e2e961c 100644
--- a/drivers/net/wireless/hostap/hostap_pci.c
+++ b/drivers/net/wireless/hostap/hostap_pci.c
@@ -5,7 +5,6 @@
  * Andy Warner <andyw@pobox.com> */
 
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/if.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
diff --git a/drivers/net/wireless/hostap/hostap_plx.c b/drivers/net/wireless/hostap/hostap_plx.c
index c3d067ee4db9..3bf530d9a40f 100644
--- a/drivers/net/wireless/hostap/hostap_plx.c
+++ b/drivers/net/wireless/hostap/hostap_plx.c
@@ -8,7 +8,6 @@
 
 
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/if.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.h b/drivers/net/wireless/ipw2x00/ipw2200.h
index 570d6fb88967..aa301d1eee3c 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.h
+++ b/drivers/net/wireless/ipw2x00/ipw2200.h
@@ -29,7 +29,6 @@
 
 #include <linux/module.h>
 #include <linux/moduleparam.h>
-#include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/mutex.h>
 
diff --git a/drivers/net/wireless/ipw2x00/libipw_rx.c b/drivers/net/wireless/ipw2x00/libipw_rx.c
index 5c6253811c52..a586a85bfcfe 100644
--- a/drivers/net/wireless/ipw2x00/libipw_rx.c
+++ b/drivers/net/wireless/ipw2x00/libipw_rx.c
@@ -1468,7 +1468,7 @@ static inline int is_same_network(struct libipw_network *src,
          * as one network */
         return ((src->ssid_len == dst->ssid_len) &&
                 (src->channel == dst->channel) &&
-                ether_addr_equal(src->bssid, dst->bssid) &&
+                ether_addr_equal_64bits(src->bssid, dst->bssid) &&
                 !memcmp(src->ssid, dst->ssid, src->ssid_len));
 }
 
diff --git a/drivers/net/wireless/iwlegacy/3945-rs.c b/drivers/net/wireless/iwlegacy/3945-rs.c
index aea667b430c3..9a45f6f626f6 100644
--- a/drivers/net/wireless/iwlegacy/3945-rs.c
+++ b/drivers/net/wireless/iwlegacy/3945-rs.c
@@ -25,7 +25,6 @@
  *****************************************************************************/
 
 #include <linux/kernel.h>
-#include <linux/init.h>
 #include <linux/skbuff.h>
 #include <linux/slab.h>
 #include <net/mac80211.h>
diff --git a/drivers/net/wireless/iwlegacy/3945.c b/drivers/net/wireless/iwlegacy/3945.c
index f09e257759d5..d37a6fd90d40 100644
--- a/drivers/net/wireless/iwlegacy/3945.c
+++ b/drivers/net/wireless/iwlegacy/3945.c
@@ -26,7 +26,6 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
@@ -466,10 +465,10 @@ il3945_is_network_packet(struct il_priv *il, struct ieee80211_hdr *header)
         switch (il->iw_mode) {
         case NL80211_IFTYPE_ADHOC:      /* Header: Dest. | Source    | BSSID */
                 /* packets to our IBSS update information */
-                return ether_addr_equal(header->addr3, il->bssid);
+                return ether_addr_equal_64bits(header->addr3, il->bssid);
         case NL80211_IFTYPE_STATION:    /* Header: Dest. | AP{BSSID} | Source */
                 /* packets to our IBSS update information */
-                return ether_addr_equal(header->addr2, il->bssid);
+                return ether_addr_equal_64bits(header->addr2, il->bssid);
         default:
                 return 1;
         }
diff --git a/drivers/net/wireless/iwlegacy/4965-rs.c b/drivers/net/wireless/iwlegacy/4965-rs.c
index 3ccbaf791b48..4d5e33259ca8 100644
--- a/drivers/net/wireless/iwlegacy/4965-rs.c
+++ b/drivers/net/wireless/iwlegacy/4965-rs.c
@@ -24,7 +24,6 @@
  *
  *****************************************************************************/
 #include <linux/kernel.h>
-#include <linux/init.h>
 #include <linux/skbuff.h>
 #include <linux/slab.h>
 #include <net/mac80211.h>
diff --git a/drivers/net/wireless/iwlegacy/4965.c b/drivers/net/wireless/iwlegacy/4965.c
index 777a578294bd..fe47db9c20cd 100644
--- a/drivers/net/wireless/iwlegacy/4965.c
+++ b/drivers/net/wireless/iwlegacy/4965.c
@@ -26,7 +26,6 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
 #include <linux/delay.h>
diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c
index a27b14cfeaec..02e8233ccf29 100644
--- a/drivers/net/wireless/iwlegacy/common.c
+++ b/drivers/net/wireless/iwlegacy/common.c
@@ -33,7 +33,6 @@
 #include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/lockdep.h>
-#include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
 #include <linux/delay.h>
@@ -3746,10 +3745,10 @@ il_full_rxon_required(struct il_priv *il)
 
         /* These items are only settable from the full RXON command */
         CHK(!il_is_associated(il));
-        CHK(!ether_addr_equal(staging->bssid_addr, active->bssid_addr));
-        CHK(!ether_addr_equal(staging->node_addr, active->node_addr));
-        CHK(!ether_addr_equal(staging->wlap_bssid_addr,
-                              active->wlap_bssid_addr));
+        CHK(!ether_addr_equal_64bits(staging->bssid_addr, active->bssid_addr));
+        CHK(!ether_addr_equal_64bits(staging->node_addr, active->node_addr));
+        CHK(!ether_addr_equal_64bits(staging->wlap_bssid_addr,
+                                     active->wlap_bssid_addr));
         CHK_NEQ(staging->dev_type, active->dev_type);
         CHK_NEQ(staging->channel, active->channel);
         CHK_NEQ(staging->air_propagation, active->air_propagation);
diff --git a/drivers/net/wireless/iwlwifi/dvm/agn.h b/drivers/net/wireless/iwlwifi/dvm/agn.h
index 23d5f0275ce9..562772d85102 100644
--- a/drivers/net/wireless/iwlwifi/dvm/agn.h
+++ b/drivers/net/wireless/iwlwifi/dvm/agn.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/dvm/calib.c b/drivers/net/wireless/iwlwifi/dvm/calib.c
index 1b0f0d502568..be1086c87157 100644
--- a/drivers/net/wireless/iwlwifi/dvm/calib.c
+++ b/drivers/net/wireless/iwlwifi/dvm/calib.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/dvm/calib.h b/drivers/net/wireless/iwlwifi/dvm/calib.h
index cfddde194940..aeae4e80ea40 100644
--- a/drivers/net/wireless/iwlwifi/dvm/calib.h
+++ b/drivers/net/wireless/iwlwifi/dvm/calib.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/dvm/commands.h b/drivers/net/wireless/iwlwifi/dvm/commands.h
index ebdac909f0cd..751ae1d10b7f 100644
--- a/drivers/net/wireless/iwlwifi/dvm/commands.h
+++ b/drivers/net/wireless/iwlwifi/dvm/commands.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/dvm/debugfs.c b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
index f69301e505ee..d2fe2596d54e 100644
--- a/drivers/net/wireless/iwlwifi/dvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
@@ -2,7 +2,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/dvm/dev.h b/drivers/net/wireless/iwlwifi/dvm/dev.h
index 7434d9edf3b7..3441f70d0ff9 100644
--- a/drivers/net/wireless/iwlwifi/dvm/dev.h
+++ b/drivers/net/wireless/iwlwifi/dvm/dev.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/dvm/devices.c b/drivers/net/wireless/iwlwifi/dvm/devices.c
index 352c6cb7b4f1..7b140e487deb 100644
--- a/drivers/net/wireless/iwlwifi/dvm/devices.c
+++ b/drivers/net/wireless/iwlwifi/dvm/devices.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/dvm/led.c b/drivers/net/wireless/iwlwifi/dvm/led.c
index 33c7e15d24f5..ca4d6692cc4e 100644
--- a/drivers/net/wireless/iwlwifi/dvm/led.c
+++ b/drivers/net/wireless/iwlwifi/dvm/led.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -27,7 +27,6 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/delay.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
diff --git a/drivers/net/wireless/iwlwifi/dvm/led.h b/drivers/net/wireless/iwlwifi/dvm/led.h
index 8749dcfe695f..6a0817d9c4fa 100644
--- a/drivers/net/wireless/iwlwifi/dvm/led.h
+++ b/drivers/net/wireless/iwlwifi/dvm/led.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/dvm/lib.c b/drivers/net/wireless/iwlwifi/dvm/lib.c
index 3d5bdc4217a8..576f7ee38ca5 100644
--- a/drivers/net/wireless/iwlwifi/dvm/lib.c
+++ b/drivers/net/wireless/iwlwifi/dvm/lib.c
@@ -2,7 +2,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -29,7 +29,6 @@
 #include <linux/etherdevice.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/sched.h>
 #include <net/mac80211.h>
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index 9f4239d31c08..40eb5e691475 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -28,7 +28,6 @@
  *****************************************************************************/
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/dma-mapping.h>
 #include <linux/delay.h>
diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
index fd9f6cf96cfd..ba1b1ea54252 100644
--- a/drivers/net/wireless/iwlwifi/dvm/main.c
+++ b/drivers/net/wireless/iwlwifi/dvm/main.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
diff --git a/drivers/net/wireless/iwlwifi/dvm/power.c b/drivers/net/wireless/iwlwifi/dvm/power.c
index 77cb59712235..b4e61417013a 100644
--- a/drivers/net/wireless/iwlwifi/dvm/power.c
+++ b/drivers/net/wireless/iwlwifi/dvm/power.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -30,7 +30,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/slab.h>
-#include <linux/init.h>
 #include <net/mac80211.h>
 #include "iwl-io.h"
 #include "iwl-debug.h"
diff --git a/drivers/net/wireless/iwlwifi/dvm/power.h b/drivers/net/wireless/iwlwifi/dvm/power.h
index 7b03e1342d47..570d3a5e4670 100644
--- a/drivers/net/wireless/iwlwifi/dvm/power.h
+++ b/drivers/net/wireless/iwlwifi/dvm/power.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
diff --git a/drivers/net/wireless/iwlwifi/dvm/rs.c b/drivers/net/wireless/iwlwifi/dvm/rs.c
index b647e506564c..0977d93b529d 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rs.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -24,7 +24,6 @@
  *
  *****************************************************************************/
 #include <linux/kernel.h>
-#include <linux/init.h>
 #include <linux/skbuff.h>
 #include <linux/slab.h>
 #include <net/mac80211.h>
diff --git a/drivers/net/wireless/iwlwifi/dvm/rs.h b/drivers/net/wireless/iwlwifi/dvm/rs.h
index 41988f4b8a5a..bdd5644a400b 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rs.h
+++ b/drivers/net/wireless/iwlwifi/dvm/rs.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/dvm/rx.c b/drivers/net/wireless/iwlwifi/dvm/rx.c
index d71776dd1e6a..b68bb2f4d2c2 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rx.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portionhelp of the ieee80211 subsystem header files.
diff --git a/drivers/net/wireless/iwlwifi/dvm/rxon.c b/drivers/net/wireless/iwlwifi/dvm/rxon.c
index d7ce2f12a907..503a81e58185 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rxon.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rxon.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/dvm/scan.c b/drivers/net/wireless/iwlwifi/dvm/scan.c
index 928f8640a0a7..be98b913ed58 100644
--- a/drivers/net/wireless/iwlwifi/dvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/dvm/scan.c
@@ -2,7 +2,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/dvm/sta.c b/drivers/net/wireless/iwlwifi/dvm/sta.c
index c3c13ce96eb0..c0d070c5df5e 100644
--- a/drivers/net/wireless/iwlwifi/dvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/dvm/sta.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
diff --git a/drivers/net/wireless/iwlwifi/dvm/tt.c b/drivers/net/wireless/iwlwifi/dvm/tt.c
index fbeee081ee2f..058c5892c427 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tt.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tt.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -30,7 +30,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/slab.h>
-#include <linux/init.h>
 #include <net/mac80211.h>
 #include "iwl-io.h"
 #include "iwl-modparams.h"
diff --git a/drivers/net/wireless/iwlwifi/dvm/tt.h b/drivers/net/wireless/iwlwifi/dvm/tt.h
index 9356c4b908ca..507726534b84 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tt.h
+++ b/drivers/net/wireless/iwlwifi/dvm/tt.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index e12b1a63c484..a6839dfcb82d 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -2,7 +2,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -29,7 +29,6 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/sched.h>
 #include <linux/ieee80211.h>
 #include "iwl-io.h"
diff --git a/drivers/net/wireless/iwlwifi/dvm/ucode.c b/drivers/net/wireless/iwlwifi/dvm/ucode.c
index 63637949a146..f59709a9b79d 100644
--- a/drivers/net/wireless/iwlwifi/dvm/ucode.c
+++ b/drivers/net/wireless/iwlwifi/dvm/ucode.c
@@ -2,7 +2,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -28,7 +28,6 @@
  *****************************************************************************/
 
 #include <linux/kernel.h>
-#include <linux/init.h>
 
 #include "iwl-io.h"
 #include "iwl-agn-hw.h"
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index 0d2afe098afc..854ba84ccb73 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/iwl-2000.c b/drivers/net/wireless/iwlwifi/iwl-2000.c
index c727ec7c90a6..3e63323637f3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-2000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-2000.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index ecc01e1a61a1..6674f2c4541c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 8ac305be68f4..8048de90233f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
index 5fb37724c096..2a59da2ff87a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-hw.h b/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
index 6d73f943cefa..7f37fb86837b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h
index e05440ff5cd4..1ced525157dc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/iwlwifi/iwl-config.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index da4eca8b3007..9d325516c42d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -198,7 +198,8 @@
                                  CSR_INT_BIT_RF_KILL | \
                                  CSR_INT_BIT_SW_RX   | \
                                  CSR_INT_BIT_WAKEUP  | \
-                                 CSR_INT_BIT_ALIVE)
+                                 CSR_INT_BIT_ALIVE   | \
+                                 CSR_INT_BIT_RX_PERIODIC)
 
 /* interrupt flags in FH (flow handler) (PCI busmaster DMA) */
 #define CSR_FH_INT_BIT_ERR       (1 << 31) /* Error */
diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.h b/drivers/net/wireless/iwlwifi/iwl-debug.h
index b2bb32a781dd..a75aac986a23 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debug.h
+++ b/drivers/net/wireless/iwlwifi/iwl-debug.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project.
  *
diff --git a/drivers/net/wireless/iwlwifi/iwl-devtrace.c b/drivers/net/wireless/iwlwifi/iwl-devtrace.c
index 8f61c717f619..23e7351e02de 100644
--- a/drivers/net/wireless/iwlwifi/iwl-devtrace.c
+++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2009 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2009 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/iwl-devtrace.h b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
index 684c416d3493..78bd41bf34b0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-devtrace.h
+++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2009 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2009 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index 4bebfb58fc7b..c3728163be46 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.h b/drivers/net/wireless/iwlwifi/iwl-drv.h
index 429337a2b9a1..592c01e11013 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.h
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -67,7 +67,7 @@
 /* for all modules */
 #define DRV_NAME        "iwlwifi"
 #define IWLWIFI_VERSION "in-tree:"
-#define DRV_COPYRIGHT   "Copyright(c) 2003-2013 Intel Corporation"
+#define DRV_COPYRIGHT   "Copyright(c) 2003- 2014 Intel Corporation"
 #define DRV_AUTHOR     "<ilw@linux.intel.com>"
 
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c
index 4380c16580eb..c44cf1149648 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.h b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.h
index d73304a23ec2..e3c7deafabe6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom-read.c b/drivers/net/wireless/iwlwifi/iwl-eeprom-read.c
index e5f2e362ab0b..25d0105741db 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom-read.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom-read.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom-read.h b/drivers/net/wireless/iwlwifi/iwl-eeprom-read.h
index 8e941f8bd7d6..a6d3bdf82cdd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom-read.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom-read.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-fh.h b/drivers/net/wireless/iwlwifi/iwl-fh.h
index 484d318245fb..9564ae173d06 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fh.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fh.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw-file.h b/drivers/net/wireless/iwlwifi/iwl-fw-file.h
index 4f95734b2811..88e2d6eb569f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw-file.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw-file.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw.h b/drivers/net/wireless/iwlwifi/iwl-fw.h
index 8704e3042ca1..5f1493c44097 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-io.c b/drivers/net/wireless/iwlwifi/iwl-io.c
index ad8e19a56eca..f98175a0d35b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-io.c
+++ b/drivers/net/wireless/iwlwifi/iwl-io.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project.
  *
diff --git a/drivers/net/wireless/iwlwifi/iwl-io.h b/drivers/net/wireless/iwlwifi/iwl-io.h
index 63d10ec08dbc..c339c1bed080 100644
--- a/drivers/net/wireless/iwlwifi/iwl-io.h
+++ b/drivers/net/wireless/iwlwifi/iwl-io.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project.
  *
diff --git a/drivers/net/wireless/iwlwifi/iwl-modparams.h b/drivers/net/wireless/iwlwifi/iwl-modparams.h
index a1f580c0c6c6..0a84ade7edac 100644
--- a/drivers/net/wireless/iwlwifi/iwl-modparams.h
+++ b/drivers/net/wireless/iwlwifi/iwl-modparams.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-notif-wait.c b/drivers/net/wireless/iwlwifi/iwl-notif-wait.c
index 940b8a9d5285..b5bc959b1dfe 100644
--- a/drivers/net/wireless/iwlwifi/iwl-notif-wait.c
+++ b/drivers/net/wireless/iwlwifi/iwl-notif-wait.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-notif-wait.h b/drivers/net/wireless/iwlwifi/iwl-notif-wait.h
index 2e2f1c8c99f9..95af97a6c2cf 100644
--- a/drivers/net/wireless/iwlwifi/iwl-notif-wait.h
+++ b/drivers/net/wireless/iwlwifi/iwl-notif-wait.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
index a48decc6c68f..1b61cb529948 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.h b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.h
index 3325059c52d4..0c4399aba8c6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.h
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-op-mode.h b/drivers/net/wireless/iwlwifi/iwl-op-mode.h
index f50e6c62ebc5..b5be51f3cd3d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-op-mode.h
+++ b/drivers/net/wireless/iwlwifi/iwl-op-mode.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-phy-db.c b/drivers/net/wireless/iwlwifi/iwl-phy-db.c
index 1a405ae6a9c5..fa77d63a277a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-phy-db.c
+++ b/drivers/net/wireless/iwlwifi/iwl-phy-db.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-phy-db.h b/drivers/net/wireless/iwlwifi/iwl-phy-db.h
index ce983af79644..9ee18d0d2d01 100644
--- a/drivers/net/wireless/iwlwifi/iwl-phy-db.h
+++ b/drivers/net/wireless/iwlwifi/iwl-phy-db.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index f6412dae2659..d69b0fb0a434 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index 0c3647858909..8d1b5ed3502a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -622,6 +622,10 @@ static inline int iwl_trans_send_cmd(struct iwl_trans *trans,
 {
         int ret;
 
+        if (unlikely(!(cmd->flags & CMD_SEND_IN_RFKILL) &&
+                     test_bit(STATUS_RFKILL, &trans->status)))
+                return -ERFKILL;
+
         if (unlikely(test_bit(STATUS_FW_ERROR, &trans->status)))
                 return -EIO;
 
@@ -684,9 +688,6 @@ static inline void iwl_trans_reclaim(struct iwl_trans *trans, int queue,
 
 static inline void iwl_trans_txq_disable(struct iwl_trans *trans, int queue)
 {
-        if (unlikely(trans->state != IWL_TRANS_FW_ALIVE))
-                IWL_ERR(trans, "%s bad state = %d", __func__, trans->state);
-
         trans->ops->txq_disable(trans, queue);
 }
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/binding.c b/drivers/net/wireless/iwlwifi/mvm/binding.c
index 57d3eed86efa..a1376539d2dc 100644
--- a/drivers/net/wireless/iwlwifi/mvm/binding.c
+++ b/drivers/net/wireless/iwlwifi/mvm/binding.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
index d126245c48de..76cde6ce6551 100644
--- a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -294,9 +294,9 @@ static const __le64 iwl_ci_mask[][3] = {
                 cpu_to_le64(0x0)
         },
         {
-                cpu_to_le64(0xFE00000000ULL),
+                cpu_to_le64(0xFFC0000000ULL),
                 cpu_to_le64(0x0ULL),
-                cpu_to_le64(0x0)
+                cpu_to_le64(0x0ULL)
         },
 };
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/constants.h b/drivers/net/wireless/iwlwifi/mvm/constants.h
index 4b6d670c3509..036857698565 100644
--- a/drivers/net/wireless/iwlwifi/mvm/constants.h
+++ b/drivers/net/wireless/iwlwifi/mvm/constants.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index 665f87e788d6..f04d2f4d80cd 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c b/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c
index b8667575bc10..0e29cd83a06a 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index e8f62a6a1b57..76cdce9edf55 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -123,51 +123,31 @@ static ssize_t iwl_dbgfs_sram_read(struct file *file, char __user *user_buf,
 {
         struct iwl_mvm *mvm = file->private_data;
         const struct fw_img *img;
-        int ofs, len, pos = 0;
-        size_t bufsz, ret;
-        char *buf;
+        unsigned int ofs, len;
+        size_t ret;
         u8 *ptr;
 
         if (!mvm->ucode_loaded)
                 return -EINVAL;
 
         /* default is to dump the entire data segment */
+        img = &mvm->fw->img[mvm->cur_ucode];
+        ofs = img->sec[IWL_UCODE_SECTION_DATA].offset;
+        len = img->sec[IWL_UCODE_SECTION_DATA].len;
+
         if (!mvm->dbgfs_sram_offset && !mvm->dbgfs_sram_len) {
-                img = &mvm->fw->img[mvm->cur_ucode];
-                ofs = img->sec[IWL_UCODE_SECTION_DATA].offset;
-                len = img->sec[IWL_UCODE_SECTION_DATA].len;
-        } else {
                 ofs = mvm->dbgfs_sram_offset;
                 len = mvm->dbgfs_sram_len;
         }
 
-        bufsz = len * 4 + 256;
-        buf = kzalloc(bufsz, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
-
         ptr = kzalloc(len, GFP_KERNEL);
-        if (!ptr) {
-                kfree(buf);
+        if (!ptr)
                 return -ENOMEM;
-        }
-
-        pos += scnprintf(buf + pos, bufsz - pos, "sram_len: 0x%x\n", len);
-        pos += scnprintf(buf + pos, bufsz - pos, "sram_offset: 0x%x\n", ofs);
 
         iwl_trans_read_mem_bytes(mvm->trans, ofs, ptr, len);
-        for (ofs = 0; ofs < len; ofs += 16) {
-                pos += scnprintf(buf + pos, bufsz - pos, "0x%.4x ", ofs);
-                hex_dump_to_buffer(ptr + ofs, 16, 16, 1, buf + pos,
-                                   bufsz - pos, false);
-                pos += strlen(buf + pos);
-                if (bufsz - pos > 0)
-                        buf[pos++] = '\n';
-        }
 
-        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        ret = simple_read_from_buffer(user_buf, count, ppos, ptr, len);
 
-        kfree(buf);
         kfree(ptr);
 
         return ret;
@@ -176,11 +156,24 @@ static ssize_t iwl_dbgfs_sram_read(struct file *file, char __user *user_buf,
 static ssize_t iwl_dbgfs_sram_write(struct iwl_mvm *mvm, char *buf,
                                     size_t count, loff_t *ppos)
 {
+        const struct fw_img *img;
         u32 offset, len;
+        u32 img_offset, img_len;
+
+        if (!mvm->ucode_loaded)
+                return -EINVAL;
+
+        img = &mvm->fw->img[mvm->cur_ucode];
+        img_offset = img->sec[IWL_UCODE_SECTION_DATA].offset;
+        img_len = img->sec[IWL_UCODE_SECTION_DATA].len;
 
         if (sscanf(buf, "%x,%x", &offset, &len) == 2) {
                 if ((offset & 0x3) || (len & 0x3))
                         return -EINVAL;
+
+                if (offset + len > img_offset + img_len)
+                        return -EINVAL;
+
                 mvm->dbgfs_sram_offset = offset;
                 mvm->dbgfs_sram_len = len;
         } else {
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.h b/drivers/net/wireless/iwlwifi/mvm/debugfs.h
index 85f9f958bfd2..e3a9774af495 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.h
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-bt-coex.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-bt-coex.h
index af500996bbf1..1b4e54d416b0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-bt-coex.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-bt-coex.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h
index 4e7dd8cf87dc..8415ff312d0e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-mac.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-mac.h
index 39c3148bdfa8..c405cda1025f 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-mac.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-mac.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
index cb78e5539357..884c08725308 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h
index 532312c7b937..85057219cc43 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
index b3ed59237cba..73cbba7424f2 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-sta.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-sta.h
index 8c73ba74b6fd..6bbbad453a3b 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-sta.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-sta.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
index 22864671d66c..b674c2a2b51c 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api.h b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
index 1c3079714c2b..989d7dbdca6c 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw.c b/drivers/net/wireless/iwlwifi/mvm/fw.c
index 27ba104a3540..c03d39541f9e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/iwlwifi/mvm/fw.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/led.c b/drivers/net/wireless/iwlwifi/mvm/led.c
index 2269a9e5cc67..6b4ea6bf8ffe 100644
--- a/drivers/net/wireless/iwlwifi/mvm/led.c
+++ b/drivers/net/wireless/iwlwifi/mvm/led.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -103,7 +103,7 @@ int iwl_mvm_leds_init(struct iwl_mvm *mvm)
                 return 0;
         default:
                 return -EINVAL;
-        };
+        }
 
         mvm->led.name = kasprintf(GFP_KERNEL, "%s-led",
                                    wiphy_name(mvm->hw->wiphy));
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
index fb93961da750..ba723d50939a 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -69,10 +69,10 @@
 #include "mvm.h"
 
 const u8 iwl_mvm_ac_to_tx_fifo[] = {
-        IWL_MVM_TX_FIFO_BK,
-        IWL_MVM_TX_FIFO_BE,
-        IWL_MVM_TX_FIFO_VI,
         IWL_MVM_TX_FIFO_VO,
+        IWL_MVM_TX_FIFO_VI,
+        IWL_MVM_TX_FIFO_BE,
+        IWL_MVM_TX_FIFO_BK,
 };
 
 struct iwl_mvm_mac_iface_iterator_data {
@@ -85,35 +85,15 @@ struct iwl_mvm_mac_iface_iterator_data {
         bool found_vif;
 };
 
-static void iwl_mvm_mac_iface_iterator(void *_data, u8 *mac,
-                                       struct ieee80211_vif *vif)
+static void iwl_mvm_mac_tsf_id_iter(void *_data, u8 *mac,
+                                    struct ieee80211_vif *vif)
 {
         struct iwl_mvm_mac_iface_iterator_data *data = _data;
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        u32 ac;
 
-        /* Iterator may already find the interface being added -- skip it */
-        if (vif == data->vif) {
-                data->found_vif = true;
+        /* Skip the interface for which we are trying to assign a tsf_id  */
+        if (vif == data->vif)
                 return;
-        }
-
-        /* Mark the queues used by the vif */
-        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
-                if (vif->hw_queue[ac] != IEEE80211_INVAL_HW_QUEUE)
-                        __set_bit(vif->hw_queue[ac], data->used_hw_queues);
-
-        if (vif->cab_queue != IEEE80211_INVAL_HW_QUEUE)
-                __set_bit(vif->cab_queue, data->used_hw_queues);
-
-        /*
-         * Mark MAC IDs as used by clearing the available bit, and
-         * (below) mark TSFs as used if their existing use is not
-         * compatible with the new interface type.
-         * No locking or atomic bit operations are needed since the
-         * data is on the stack of the caller function.
-         */
-        __clear_bit(mvmvif->id, data->available_mac_ids);
 
         /*
          * The TSF is a hardware/firmware resource, there are 4 and
@@ -135,21 +115,26 @@ static void iwl_mvm_mac_iface_iterator(void *_data, u8 *mac,
         case NL80211_IFTYPE_STATION:
                 /*
                  * The new interface is client, so if the existing one
-                 * we're iterating is an AP, the TSF should be used to
+                 * we're iterating is an AP, and both interfaces have the
+                 * same beacon interval, the same TSF should be used to
                  * avoid drift between the new client and existing AP,
                  * the existing AP will get drift updates from the new
                  * client context in this case
                  */
                 if (vif->type == NL80211_IFTYPE_AP) {
                         if (data->preferred_tsf == NUM_TSF_IDS &&
-                            test_bit(mvmvif->tsf_id, data->available_tsf_ids))
+                            test_bit(mvmvif->tsf_id, data->available_tsf_ids) &&
+                            (vif->bss_conf.beacon_int ==
+                             data->vif->bss_conf.beacon_int)) {
                                 data->preferred_tsf = mvmvif->tsf_id;
-                        return;
+                                return;
+                        }
                 }
                 break;
         case NL80211_IFTYPE_AP:
                 /*
-                 * The new interface is AP/GO, so should get drift
+                 * The new interface is AP/GO, so in case both interfaces
+                 * have the same beacon interval, it should get drift
                  * updates from an existing client or use the same
                  * TSF as an existing GO. There's no drift between
                  * TSFs internally but if they used different TSFs
@@ -159,9 +144,12 @@ static void iwl_mvm_mac_iface_iterator(void *_data, u8 *mac,
                 if (vif->type == NL80211_IFTYPE_STATION ||
                     vif->type == NL80211_IFTYPE_AP) {
                         if (data->preferred_tsf == NUM_TSF_IDS &&
-                            test_bit(mvmvif->tsf_id, data->available_tsf_ids))
+                            test_bit(mvmvif->tsf_id, data->available_tsf_ids) &&
+                            (vif->bss_conf.beacon_int ==
+                             data->vif->bss_conf.beacon_int)) {
                                 data->preferred_tsf = mvmvif->tsf_id;
-                        return;
+                                return;
+                        }
                 }
                 break;
         default:
@@ -187,6 +175,39 @@ static void iwl_mvm_mac_iface_iterator(void *_data, u8 *mac,
                 data->preferred_tsf = NUM_TSF_IDS;
 }
 
+static void iwl_mvm_mac_iface_iterator(void *_data, u8 *mac,
+                                       struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_mac_iface_iterator_data *data = _data;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        u32 ac;
+
+        /* Iterator may already find the interface being added -- skip it */
+        if (vif == data->vif) {
+                data->found_vif = true;
+                return;
+        }
+
+        /* Mark the queues used by the vif */
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
+                if (vif->hw_queue[ac] != IEEE80211_INVAL_HW_QUEUE)
+                        __set_bit(vif->hw_queue[ac], data->used_hw_queues);
+
+        if (vif->cab_queue != IEEE80211_INVAL_HW_QUEUE)
+                __set_bit(vif->cab_queue, data->used_hw_queues);
+
+        /* Mark MAC IDs as used by clearing the available bit, and
+         * (below) mark TSFs as used if their existing use is not
+         * compatible with the new interface type.
+         * No locking or atomic bit operations are needed since the
+         * data is on the stack of the caller function.
+         */
+        __clear_bit(mvmvif->id, data->available_mac_ids);
+
+        /* find a suitable tsf_id */
+        iwl_mvm_mac_tsf_id_iter(_data, mac, vif);
+}
+
 /*
  * Get the mask of the queus used by the vif
  */
@@ -205,6 +226,29 @@ u32 iwl_mvm_mac_get_queues_mask(struct iwl_mvm *mvm,
         return qmask;
 }
 
+void iwl_mvm_mac_ctxt_recalc_tsf_id(struct iwl_mvm *mvm,
+                                    struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_mvm_mac_iface_iterator_data data = {
+                .mvm = mvm,
+                .vif = vif,
+                .available_tsf_ids = { (1 << NUM_TSF_IDS) - 1 },
+                /* no preference yet */
+                .preferred_tsf = NUM_TSF_IDS,
+        };
+
+        ieee80211_iterate_active_interfaces_atomic(
+                mvm->hw, IEEE80211_IFACE_ITER_RESUME_ALL,
+                iwl_mvm_mac_tsf_id_iter, &data);
+
+        if (data.preferred_tsf != NUM_TSF_IDS)
+                mvmvif->tsf_id = data.preferred_tsf;
+        else if (!test_bit(mvmvif->tsf_id, data.available_tsf_ids))
+                mvmvif->tsf_id = find_first_bit(data.available_tsf_ids,
+                                                NUM_TSF_IDS);
+}
+
 static int iwl_mvm_mac_ctxt_allocate_resources(struct iwl_mvm *mvm,
                                                struct ieee80211_vif *vif)
 {
@@ -586,18 +630,23 @@ static void iwl_mvm_mac_ctxt_cmd_common(struct iwl_mvm *mvm,
                 cpu_to_le32(vif->bss_conf.use_short_slot ?
                             MAC_FLG_SHORT_SLOT : 0);
 
-        for (i = 0; i < AC_NUM; i++) {
-                cmd->ac[i].cw_min = cpu_to_le16(mvmvif->queue_params[i].cw_min);
-                cmd->ac[i].cw_max = cpu_to_le16(mvmvif->queue_params[i].cw_max);
-                cmd->ac[i].aifsn = mvmvif->queue_params[i].aifs;
-                cmd->ac[i].edca_txop =
+        for (i = 0; i < IEEE80211_NUM_ACS; i++) {
+                u8 txf = iwl_mvm_ac_to_tx_fifo[i];
+
+                cmd->ac[txf].cw_min =
+                        cpu_to_le16(mvmvif->queue_params[i].cw_min);
+                cmd->ac[txf].cw_max =
+                        cpu_to_le16(mvmvif->queue_params[i].cw_max);
+                cmd->ac[txf].edca_txop =
                         cpu_to_le16(mvmvif->queue_params[i].txop * 32);
-                cmd->ac[i].fifos_mask = BIT(iwl_mvm_ac_to_tx_fifo[i]);
+                cmd->ac[txf].aifsn = mvmvif->queue_params[i].aifs;
+                cmd->ac[txf].fifos_mask = BIT(txf);
         }
 
         /* in AP mode, the MCAST FIFO takes the EDCA params from VO */
         if (vif->type == NL80211_IFTYPE_AP)
-                cmd->ac[AC_VO].fifos_mask |= BIT(IWL_MVM_TX_FIFO_MCAST);
+                cmd->ac[IWL_MVM_TX_FIFO_VO].fifos_mask |=
+                        BIT(IWL_MVM_TX_FIFO_MCAST);
 
         if (vif->bss_conf.qos)
                 cmd->qos_flags |= cpu_to_le32(MAC_QOS_FLG_UPDATE_EDCA);
@@ -1007,7 +1056,7 @@ static void iwl_mvm_mac_ctxt_cmd_fill_ap(struct iwl_mvm *mvm,
                         iwl_mvm_mac_ap_iterator, &data);
 
                 if (data.beacon_device_ts) {
-                        u32 rand = (prandom_u32() % (80 - 20)) + 20;
+                        u32 rand = (prandom_u32() % (64 - 36)) + 36;
                         mvmvif->ap_beacon_time = data.beacon_device_ts +
                                 ieee80211_tu_to_usec(data.beacon_int * rand /
                                                      100);
@@ -1186,10 +1235,18 @@ int iwl_mvm_rx_beacon_notif(struct iwl_mvm *mvm,
 static void iwl_mvm_beacon_loss_iterator(void *_data, u8 *mac,
                                          struct ieee80211_vif *vif)
 {
-        u16 *id = _data;
+        struct iwl_missed_beacons_notif *missed_beacons = _data;
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 
-        if (mvmvif->id == *id)
+        if (mvmvif->id != (u16)le32_to_cpu(missed_beacons->mac_id))
+                return;
+
+        /*
+         * TODO: the threshold should be adjusted based on latency conditions,
+         * and/or in case of a CS flow on one of the other AP vifs.
+         */
+        if (le32_to_cpu(missed_beacons->consec_missed_beacons_since_last_rx) >
+             IWL_MVM_MISSED_BEACONS_THRESHOLD)
                 ieee80211_beacon_loss(vif);
 }
 
@@ -1198,12 +1255,19 @@ int iwl_mvm_rx_missed_beacons_notif(struct iwl_mvm *mvm,
                                     struct iwl_device_cmd *cmd)
 {
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
-        struct iwl_missed_beacons_notif *missed_beacons = (void *)pkt->data;
-        u16 id = (u16)le32_to_cpu(missed_beacons->mac_id);
+        struct iwl_missed_beacons_notif *mb = (void *)pkt->data;
+
+        IWL_DEBUG_INFO(mvm,
+                       "missed bcn mac_id=%u, consecutive=%u (%u, %u, %u)\n",
+                       le32_to_cpu(mb->mac_id),
+                       le32_to_cpu(mb->consec_missed_beacons),
+                       le32_to_cpu(mb->consec_missed_beacons_since_last_rx),
+                       le32_to_cpu(mb->num_recvd_beacons),
+                       le32_to_cpu(mb->num_expected_beacons));
 
         ieee80211_iterate_active_interfaces_atomic(mvm->hw,
                                                    IEEE80211_IFACE_ITER_NORMAL,
                                                    iwl_mvm_beacon_loss_iterator,
-                                                   &id);
+                                                   mb);
         return 0;
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 2f5269359dce..b41177eb4888 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -262,7 +262,7 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         mvm->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
 
         /* currently FW API supports only one optional cipher scheme */
-        if (mvm->fw->cs && mvm->fw->cs->cipher) {
+        if (mvm->fw->cs->cipher) {
                 mvm->hw->n_cipher_schemes = 1;
                 mvm->hw->cipher_schemes = mvm->fw->cs;
         }
@@ -866,6 +866,14 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         int ret;
 
+        /*
+         * Re-calculate the tsf id, as the master-slave relations depend on the
+         * beacon interval, which was not known when the station interface was
+         * added.
+         */
+        if (changes & BSS_CHANGED_ASSOC && bss_conf->assoc)
+                iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
+
         ret = iwl_mvm_mac_ctxt_changed(mvm, vif);
         if (ret)
                 IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
@@ -979,6 +987,13 @@ static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
         if (ret)
                 goto out_unlock;
 
+        /*
+         * Re-calculate the tsf id, as the master-slave relations depend on the
+         * beacon interval, which was not known when the AP interface was added.
+         */
+        if (vif->type == NL80211_IFTYPE_AP)
+                iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
+
         /* Add the mac context */
         ret = iwl_mvm_mac_ctxt_add(mvm, vif);
         if (ret)
@@ -1671,7 +1686,8 @@ static void iwl_mvm_change_chanctx(struct ieee80211_hw *hw,
         if (WARN_ONCE((phy_ctxt->ref > 1) &&
                       (changed & ~(IEEE80211_CHANCTX_CHANGE_WIDTH |
                                    IEEE80211_CHANCTX_CHANGE_RX_CHAINS |
-                                   IEEE80211_CHANCTX_CHANGE_RADAR)),
+                                   IEEE80211_CHANCTX_CHANGE_RADAR |
+                                   IEEE80211_CHANCTX_CHANGE_MIN_WIDTH)),
                       "Cannot change PHY. Ref=%d, changed=0x%X\n",
                       phy_ctxt->ref, changed))
                 return;
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index 84edf3649ad2..e4ead86f06d6 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -81,6 +81,7 @@
 #define IWL_MVM_MAX_ADDRESSES           5
 /* RSSI offset for WkP */
 #define IWL_RSSI_OFFSET 50
+#define IWL_MVM_MISSED_BEACONS_THRESHOLD 8
 
 enum iwl_mvm_tx_fifo {
         IWL_MVM_TX_FIFO_BK = 0,
@@ -711,6 +712,8 @@ int iwl_mvm_rx_beacon_notif(struct iwl_mvm *mvm,
 int iwl_mvm_rx_missed_beacons_notif(struct iwl_mvm *mvm,
                                     struct iwl_rx_cmd_buffer *rxb,
                                     struct iwl_device_cmd *cmd);
+void iwl_mvm_mac_ctxt_recalc_tsf_id(struct iwl_mvm *mvm,
+                                    struct ieee80211_vif *vif);
 
 /* Bindings */
 int iwl_mvm_binding_add_vif(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
diff --git a/drivers/net/wireless/iwlwifi/mvm/nvm.c b/drivers/net/wireless/iwlwifi/mvm/nvm.c
index 48089b1625ff..c6beb0f842d5 100644
--- a/drivers/net/wireless/iwlwifi/mvm/nvm.c
+++ b/drivers/net/wireless/iwlwifi/mvm/nvm.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -367,16 +367,17 @@ static int iwl_mvm_read_external_nvm(struct iwl_mvm *mvm)
                         break;
                 }
 
+                if (WARN(section_id >= NVM_NUM_OF_SECTIONS,
+                         "Invalid NVM section ID %d\n", section_id)) {
+                        ret = -EINVAL;
+                        break;
+                }
+
                 temp = kmemdup(file_sec->data, section_size, GFP_KERNEL);
                 if (!temp) {
                         ret = -ENOMEM;
                         break;
                 }
-                if (WARN_ON(section_id >= NVM_NUM_OF_SECTIONS)) {
-                        IWL_ERR(mvm, "Invalid NVM section ID\n");
-                        ret = -EINVAL;
-                        break;
-                }
                 mvm->nvm_sections[section_id].data = temp;
                 mvm->nvm_sections[section_id].length = section_size;
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
index a362430477a0..552c76a926ed 100644
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -665,6 +665,8 @@ static void iwl_mvm_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
         else
                 clear_bit(IWL_MVM_STATUS_HW_RFKILL, &mvm->status);
 
+        if (state && mvm->cur_ucode != IWL_UCODE_INIT)
+                iwl_trans_stop_device(mvm->trans);
         wiphy_rfkill_set_hw_state(mvm->hw->wiphy, iwl_mvm_is_radio_killed(mvm));
 }
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
index a8652ddd6bed..b7268c0b3333 100644
--- a/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/power.c b/drivers/net/wireless/iwlwifi/mvm/power.c
index 483ecc67501f..d9eab3b7bb9f 100644
--- a/drivers/net/wireless/iwlwifi/mvm/power.c
+++ b/drivers/net/wireless/iwlwifi/mvm/power.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -64,7 +64,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/slab.h>
-#include <linux/init.h>
 
 #include <net/mac80211.h>
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/power_legacy.c b/drivers/net/wireless/iwlwifi/mvm/power_legacy.c
index 2ce79bad5845..ef712ae5bc62 100644
--- a/drivers/net/wireless/iwlwifi/mvm/power_legacy.c
+++ b/drivers/net/wireless/iwlwifi/mvm/power_legacy.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/quota.c b/drivers/net/wireless/iwlwifi/mvm/quota.c
index 38165eba2a17..ce5db6c4ef7e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/quota.c
+++ b/drivers/net/wireless/iwlwifi/mvm/quota.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
index d6d28d7b442b..ba078a3322b8 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -24,7 +24,6 @@
  *
  *****************************************************************************/
 #include <linux/kernel.h>
-#include <linux/init.h>
 #include <linux/skbuff.h>
 #include <linux/slab.h>
 #include <net/mac80211.h>
@@ -700,7 +699,7 @@ static int rs_rate_from_ucode_rate(const u32 ucode_rate,
         u8 num_of_ant = get_num_of_ant_from_rate(ucode_rate);
         u8 nss;
 
-        memset(rate, 0, sizeof(struct rs_rate));
+        memset(rate, 0, sizeof(*rate));
         rate->index = iwl_hwrate_to_plcp_idx(ucode_rate);
 
         if (rate->index == IWL_RATE_INVALID) {
@@ -2121,7 +2120,7 @@ static void rs_initialize_lq(struct iwl_mvm *mvm,
                 tbl->column = RS_COLUMN_LEGACY_ANT_B;
 
         rs_set_expected_tpt_table(lq_sta, tbl);
-        rs_fill_lq_cmd(NULL, NULL, lq_sta, rate);
+        rs_fill_lq_cmd(mvm, sta, lq_sta, rate);
         /* TODO restore station should remember the lq cmd */
         iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, init);
 }
@@ -2446,10 +2445,9 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
         struct iwl_lq_cmd *lq_cmd = &lq_sta->lq;
         bool toggle_ant = false;
 
-        memcpy(&rate, initial_rate, sizeof(struct rs_rate));
+        memcpy(&rate, initial_rate, sizeof(rate));
 
-        if (mvm)
-                valid_tx_ant = iwl_fw_valid_tx_ant(mvm->fw);
+        valid_tx_ant = iwl_fw_valid_tx_ant(mvm->fw);
 
         if (is_siso(&rate)) {
                 num_rates = RS_INITIAL_SISO_NUM_RATES;
@@ -2623,7 +2621,7 @@ static void rs_program_fix_rate(struct iwl_mvm *mvm,
                 struct rs_rate rate;
                 rs_rate_from_ucode_rate(lq_sta->dbg_fixed_rate,
                                         lq_sta->band, &rate);
-                rs_fill_lq_cmd(NULL, NULL, lq_sta, &rate);
+                rs_fill_lq_cmd(mvm, NULL, lq_sta, &rate);
                 iwl_mvm_send_lq_cmd(lq_sta->drv, &lq_sta->lq, false);
         }
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.h b/drivers/net/wireless/iwlwifi/mvm/rs.h
index c31aa59728ea..7bc6404f6986 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.h
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/mvm/rx.c b/drivers/net/wireless/iwlwifi/mvm/rx.c
index 454341cc3b27..a85b60f7e67e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rx.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 4ce9bb581144..0e0007960612 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -473,13 +473,18 @@ void iwl_mvm_cancel_scan(struct iwl_mvm *mvm)
         if (mvm->scan_status == IWL_MVM_SCAN_NONE)
                 return;
 
+        if (iwl_mvm_is_radio_killed(mvm)) {
+                ieee80211_scan_completed(mvm->hw, true);
+                mvm->scan_status = IWL_MVM_SCAN_NONE;
+                return;
+        }
+
         iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_abort,
                                    scan_abort_notif,
                                    ARRAY_SIZE(scan_abort_notif),
                                    iwl_mvm_scan_abort_notif, NULL);
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, SCAN_ABORT_CMD,
-                                   CMD_SYNC | CMD_SEND_IN_RFKILL, 0, NULL);
+        ret = iwl_mvm_send_cmd_pdu(mvm, SCAN_ABORT_CMD, CMD_SYNC, 0, NULL);
         if (ret) {
                 IWL_ERR(mvm, "Couldn't send SCAN_ABORT_CMD: %d\n", ret);
                 /* mac80211's state will be cleaned in the fw_restart flow */
diff --git a/drivers/net/wireless/iwlwifi/mvm/sf.c b/drivers/net/wireless/iwlwifi/mvm/sf.c
index 97bb3c3e75ce..8401627c0030 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sf.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sf.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index 0a8af2083ddc..ec1812133235 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.h b/drivers/net/wireless/iwlwifi/mvm/sta.h
index b34941148a98..4968d0237dc5 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/testmode.h b/drivers/net/wireless/iwlwifi/mvm/testmode.h
index eb74391d91ca..0241665925f7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/testmode.h
+++ b/drivers/net/wireless/iwlwifi/mvm/testmode.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index 95ce4b601fef..50f3d7f560bc 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.h b/drivers/net/wireless/iwlwifi/mvm/time-event.h
index d9c8d6cfa2db..4a61c8c02372 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.h
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/tt.c b/drivers/net/wireless/iwlwifi/mvm/tt.c
index a0ec7b3473bd..3afa6b6bf835 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tt.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 735f86da7985..3c575a39987b 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c
index f4aff56a36da..487d61b25359 100644
--- a/drivers/net/wireless/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/iwlwifi/mvm/utils.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 2e97a3995333..e58b8af56c04 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index 674c75b0d002..e851f26fd44c 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -262,6 +262,7 @@ iwl_pcie_get_scratchbuf_dma(struct iwl_txq *txq, int idx)
  * @rx_page_order: page order for receive buffer size
  * @wd_timeout: queue watchdog timeout (jiffies)
  * @reg_lock: protect hw register access
+ * @cmd_in_flight: true when we have a host command in flight
  */
 struct iwl_trans_pcie {
         struct iwl_rxq rxq;
@@ -273,7 +274,6 @@ struct iwl_trans_pcie {
         __le32 *ict_tbl;
         dma_addr_t ict_tbl_dma;
         int ict_index;
-        u32 inta;
         bool use_ict;
         struct isr_statistics isr_stats;
 
@@ -311,6 +311,7 @@ struct iwl_trans_pcie {
 
         /*protect hw register */
         spinlock_t reg_lock;
+        bool cmd_in_flight;
 };
 
 #define IWL_TRANS_GET_PCIE_TRANS(_iwl_trans) \
@@ -343,7 +344,7 @@ void iwl_pcie_rx_free(struct iwl_trans *trans);
 /*****************************************************
 * ICT - interrupt handling
 ******************************************************/
-irqreturn_t iwl_pcie_isr_ict(int irq, void *data);
+irqreturn_t iwl_pcie_isr(int irq, void *data);
 int iwl_pcie_alloc_ict(struct iwl_trans *trans);
 void iwl_pcie_free_ict(struct iwl_trans *trans);
 void iwl_pcie_reset_ict(struct iwl_trans *trans);
@@ -397,13 +398,17 @@ static inline void iwl_enable_interrupts(struct iwl_trans *trans)
 
         IWL_DEBUG_ISR(trans, "Enabling interrupts\n");
         set_bit(STATUS_INT_ENABLED, &trans->status);
+        trans_pcie->inta_mask = CSR_INI_SET_MASK;
         iwl_write32(trans, CSR_INT_MASK, trans_pcie->inta_mask);
 }
 
 static inline void iwl_enable_rfkill_int(struct iwl_trans *trans)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+
         IWL_DEBUG_ISR(trans, "Enabling rfkill interrupt\n");
-        iwl_write32(trans, CSR_INT_MASK, CSR_INT_BIT_RF_KILL);
+        trans_pcie->inta_mask = CSR_INT_BIT_RF_KILL;
+        iwl_write32(trans, CSR_INT_MASK, trans_pcie->inta_mask);
 }
 
 static inline void iwl_wake_queue(struct iwl_trans *trans,
@@ -456,4 +461,31 @@ static inline bool iwl_is_rfkill_set(struct iwl_trans *trans)
                 CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW);
 }
 
+static inline void __iwl_trans_pcie_set_bits_mask(struct iwl_trans *trans,
+                                                  u32 reg, u32 mask, u32 value)
+{
+        u32 v;
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+        WARN_ON_ONCE(value & ~mask);
+#endif
+
+        v = iwl_read32(trans, reg);
+        v &= ~mask;
+        v |= value;
+        iwl_write32(trans, reg, v);
+}
+
+static inline void __iwl_trans_pcie_clear_bit(struct iwl_trans *trans,
+                                              u32 reg, u32 mask)
+{
+        __iwl_trans_pcie_set_bits_mask(trans, reg, mask, 0);
+}
+
+static inline void __iwl_trans_pcie_set_bit(struct iwl_trans *trans,
+                                            u32 reg, u32 mask)
+{
+        __iwl_trans_pcie_set_bits_mask(trans, reg, mask, mask);
+}
+
 #endif /* __iwl_trans_int_pcie_h__ */
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index 7aeec5ccefa5..1890ea29c264 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -148,10 +148,9 @@ int iwl_pcie_rx_stop(struct iwl_trans *trans)
 static void iwl_pcie_rxq_inc_wr_ptr(struct iwl_trans *trans,
                                     struct iwl_rxq *rxq)
 {
-        unsigned long flags;
         u32 reg;
 
-        spin_lock_irqsave(&rxq->lock, flags);
+        spin_lock(&rxq->lock);
 
         if (rxq->need_update == 0)
                 goto exit_unlock;
@@ -190,7 +189,7 @@ static void iwl_pcie_rxq_inc_wr_ptr(struct iwl_trans *trans,
         rxq->need_update = 0;
 
  exit_unlock:
-        spin_unlock_irqrestore(&rxq->lock, flags);
+        spin_unlock(&rxq->lock);
 }
 
 /*
@@ -209,7 +208,6 @@ static void iwl_pcie_rxq_restock(struct iwl_trans *trans)
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_rxq *rxq = &trans_pcie->rxq;
         struct iwl_rx_mem_buffer *rxb;
-        unsigned long flags;
 
         /*
          * If the device isn't enabled - not need to try to add buffers...
@@ -222,7 +220,7 @@ static void iwl_pcie_rxq_restock(struct iwl_trans *trans)
         if (!test_bit(STATUS_DEVICE_ENABLED, &trans->status))
                 return;
 
-        spin_lock_irqsave(&rxq->lock, flags);
+        spin_lock(&rxq->lock);
         while ((iwl_rxq_space(rxq) > 0) && (rxq->free_count)) {
                 /* The overwritten rxb must be a used one */
                 rxb = rxq->queue[rxq->write];
@@ -239,7 +237,7 @@ static void iwl_pcie_rxq_restock(struct iwl_trans *trans)
                 rxq->write = (rxq->write + 1) & RX_QUEUE_MASK;
                 rxq->free_count--;
         }
-        spin_unlock_irqrestore(&rxq->lock, flags);
+        spin_unlock(&rxq->lock);
         /* If the pre-allocated buffer pool is dropping low, schedule to
          * refill it */
         if (rxq->free_count <= RX_LOW_WATERMARK)
@@ -248,9 +246,9 @@ static void iwl_pcie_rxq_restock(struct iwl_trans *trans)
         /* If we've added more space for the firmware to place data, tell it.
          * Increment device's write pointer in multiples of 8. */
         if (rxq->write_actual != (rxq->write & ~0x7)) {
-                spin_lock_irqsave(&rxq->lock, flags);
+                spin_lock(&rxq->lock);
                 rxq->need_update = 1;
-                spin_unlock_irqrestore(&rxq->lock, flags);
+                spin_unlock(&rxq->lock);
                 iwl_pcie_rxq_inc_wr_ptr(trans, rxq);
         }
 }
@@ -270,16 +268,15 @@ static void iwl_pcie_rxq_alloc_rbs(struct iwl_trans *trans, gfp_t priority)
         struct iwl_rxq *rxq = &trans_pcie->rxq;
         struct iwl_rx_mem_buffer *rxb;
         struct page *page;
-        unsigned long flags;
         gfp_t gfp_mask = priority;
 
         while (1) {
-                spin_lock_irqsave(&rxq->lock, flags);
+                spin_lock(&rxq->lock);
                 if (list_empty(&rxq->rx_used)) {
-                        spin_unlock_irqrestore(&rxq->lock, flags);
+                        spin_unlock(&rxq->lock);
                         return;
                 }
-                spin_unlock_irqrestore(&rxq->lock, flags);
+                spin_unlock(&rxq->lock);
 
                 if (rxq->free_count > RX_LOW_WATERMARK)
                         gfp_mask |= __GFP_NOWARN;
@@ -308,17 +305,17 @@ static void iwl_pcie_rxq_alloc_rbs(struct iwl_trans *trans, gfp_t priority)
                         return;
                 }
 
-                spin_lock_irqsave(&rxq->lock, flags);
+                spin_lock(&rxq->lock);
 
                 if (list_empty(&rxq->rx_used)) {
-                        spin_unlock_irqrestore(&rxq->lock, flags);
+                        spin_unlock(&rxq->lock);
                         __free_pages(page, trans_pcie->rx_page_order);
                         return;
                 }
                 rxb = list_first_entry(&rxq->rx_used, struct iwl_rx_mem_buffer,
                                        list);
                 list_del(&rxb->list);
-                spin_unlock_irqrestore(&rxq->lock, flags);
+                spin_unlock(&rxq->lock);
 
                 BUG_ON(rxb->page);
                 rxb->page = page;
@@ -329,9 +326,9 @@ static void iwl_pcie_rxq_alloc_rbs(struct iwl_trans *trans, gfp_t priority)
                                      DMA_FROM_DEVICE);
                 if (dma_mapping_error(trans->dev, rxb->page_dma)) {
                         rxb->page = NULL;
-                        spin_lock_irqsave(&rxq->lock, flags);
+                        spin_lock(&rxq->lock);
                         list_add(&rxb->list, &rxq->rx_used);
-                        spin_unlock_irqrestore(&rxq->lock, flags);
+                        spin_unlock(&rxq->lock);
                         __free_pages(page, trans_pcie->rx_page_order);
                         return;
                 }
@@ -340,12 +337,12 @@ static void iwl_pcie_rxq_alloc_rbs(struct iwl_trans *trans, gfp_t priority)
                 /* and also 256 byte aligned! */
                 BUG_ON(rxb->page_dma & DMA_BIT_MASK(8));
 
-                spin_lock_irqsave(&rxq->lock, flags);
+                spin_lock(&rxq->lock);
 
                 list_add_tail(&rxb->list, &rxq->rx_free);
                 rxq->free_count++;
 
-                spin_unlock_irqrestore(&rxq->lock, flags);
+                spin_unlock(&rxq->lock);
         }
 }
 
@@ -379,13 +376,12 @@ static void iwl_pcie_rxq_free_rbs(struct iwl_trans *trans)
 static void iwl_pcie_rx_replenish(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        unsigned long flags;
 
         iwl_pcie_rxq_alloc_rbs(trans, GFP_KERNEL);
 
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+        spin_lock(&trans_pcie->irq_lock);
         iwl_pcie_rxq_restock(trans);
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+        spin_unlock(&trans_pcie->irq_lock);
 }
 
 static void iwl_pcie_rx_replenish_now(struct iwl_trans *trans)
@@ -511,7 +507,6 @@ int iwl_pcie_rx_init(struct iwl_trans *trans)
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_rxq *rxq = &trans_pcie->rxq;
         int i, err;
-        unsigned long flags;
 
         if (!rxq->bd) {
                 err = iwl_pcie_rx_alloc(trans);
@@ -519,7 +514,7 @@ int iwl_pcie_rx_init(struct iwl_trans *trans)
                         return err;
         }
 
-        spin_lock_irqsave(&rxq->lock, flags);
+        spin_lock(&rxq->lock);
 
         INIT_WORK(&trans_pcie->rx_replenish, iwl_pcie_rx_replenish_work);
 
@@ -535,16 +530,16 @@ int iwl_pcie_rx_init(struct iwl_trans *trans)
         rxq->read = rxq->write = 0;
         rxq->write_actual = 0;
         memset(rxq->rb_stts, 0, sizeof(*rxq->rb_stts));
-        spin_unlock_irqrestore(&rxq->lock, flags);
+        spin_unlock(&rxq->lock);
 
         iwl_pcie_rx_replenish(trans);
 
         iwl_pcie_rx_hw_init(trans, rxq);
 
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+        spin_lock(&trans_pcie->irq_lock);
         rxq->need_update = 1;
         iwl_pcie_rxq_inc_wr_ptr(trans, rxq);
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+        spin_unlock(&trans_pcie->irq_lock);
 
         return 0;
 }
@@ -553,7 +548,6 @@ void iwl_pcie_rx_free(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_rxq *rxq = &trans_pcie->rxq;
-        unsigned long flags;
 
         /*if rxq->bd is NULL, it means that nothing has been allocated,
          * exit now */
@@ -564,9 +558,9 @@ void iwl_pcie_rx_free(struct iwl_trans *trans)
 
         cancel_work_sync(&trans_pcie->rx_replenish);
 
-        spin_lock_irqsave(&rxq->lock, flags);
+        spin_lock(&rxq->lock);
         iwl_pcie_rxq_free_rbs(trans);
-        spin_unlock_irqrestore(&rxq->lock, flags);
+        spin_unlock(&rxq->lock);
 
         dma_free_coherent(trans->dev, sizeof(__le32) * RX_QUEUE_SIZE,
                           rxq->bd, rxq->bd_dma);
@@ -589,7 +583,6 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_rxq *rxq = &trans_pcie->rxq;
         struct iwl_txq *txq = &trans_pcie->txq[trans_pcie->cmd_queue];
-        unsigned long flags;
         bool page_stolen = false;
         int max_len = PAGE_SIZE << trans_pcie->rx_page_order;
         u32 offset = 0;
@@ -691,7 +684,7 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
         /* Reuse the page if possible. For notification packets and
          * SKBs that fail to Rx correctly, add them back into the
          * rx_free list for reuse later. */
-        spin_lock_irqsave(&rxq->lock, flags);
+        spin_lock(&rxq->lock);
         if (rxb->page != NULL) {
                 rxb->page_dma =
                         dma_map_page(trans->dev, rxb->page, 0,
@@ -712,7 +705,7 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
                 }
         } else
                 list_add_tail(&rxb->list, &rxq->rx_used);
-        spin_unlock_irqrestore(&rxq->lock, flags);
+        spin_unlock(&rxq->lock);
 }
 
 /*
@@ -807,6 +800,87 @@ static void iwl_pcie_irq_handle_error(struct iwl_trans *trans)
         wake_up(&trans_pcie->wait_command_queue);
 }
 
+static u32 iwl_pcie_int_cause_non_ict(struct iwl_trans *trans)
+{
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        u32 inta;
+
+        lockdep_assert_held(&trans_pcie->irq_lock);
+
+        trace_iwlwifi_dev_irq(trans->dev);
+
+        /* Discover which interrupts are active/pending */
+        inta = iwl_read32(trans, CSR_INT);
+
+        /* the thread will service interrupts and re-enable them */
+        return inta;
+}
+
+/* a device (PCI-E) page is 4096 bytes long */
+#define ICT_SHIFT       12
+#define ICT_SIZE        (1 << ICT_SHIFT)
+#define ICT_COUNT       (ICT_SIZE / sizeof(u32))
+
+/* interrupt handler using ict table, with this interrupt driver will
+ * stop using INTA register to get device's interrupt, reading this register
+ * is expensive, device will write interrupts in ICT dram table, increment
+ * index then will fire interrupt to driver, driver will OR all ICT table
+ * entries from current index up to table entry with 0 value. the result is
+ * the interrupt we need to service, driver will set the entries back to 0 and
+ * set index.
+ */
+static u32 iwl_pcie_int_cause_ict(struct iwl_trans *trans)
+{
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        u32 inta;
+        u32 val = 0;
+        u32 read;
+
+        trace_iwlwifi_dev_irq(trans->dev);
+
+        /* Ignore interrupt if there's nothing in NIC to service.
+         * This may be due to IRQ shared with another device,
+         * or due to sporadic interrupts thrown from our NIC. */
+        read = le32_to_cpu(trans_pcie->ict_tbl[trans_pcie->ict_index]);
+        trace_iwlwifi_dev_ict_read(trans->dev, trans_pcie->ict_index, read);
+        if (!read)
+                return 0;
+
+        /*
+         * Collect all entries up to the first 0, starting from ict_index;
+         * note we already read at ict_index.
+         */
+        do {
+                val |= read;
+                IWL_DEBUG_ISR(trans, "ICT index %d value 0x%08X\n",
+                                trans_pcie->ict_index, read);
+                trans_pcie->ict_tbl[trans_pcie->ict_index] = 0;
+                trans_pcie->ict_index =
+                        iwl_queue_inc_wrap(trans_pcie->ict_index, ICT_COUNT);
+
+                read = le32_to_cpu(trans_pcie->ict_tbl[trans_pcie->ict_index]);
+                trace_iwlwifi_dev_ict_read(trans->dev, trans_pcie->ict_index,
+                                           read);
+        } while (read);
+
+        /* We should not get this value, just ignore it. */
+        if (val == 0xffffffff)
+                val = 0;
+
+        /*
+         * this is a w/a for a h/w bug. the h/w bug may cause the Rx bit
+         * (bit 15 before shifting it to 31) to clear when using interrupt
+         * coalescing. fortunately, bits 18 and 19 stay set when this happens
+         * so we use them to decide on the real state of the Rx bit.
+         * In order words, bit 15 is set if bit 18 or bit 19 are set.
+         */
+        if (val & 0xC0000)
+                val |= 0x8000;
+
+        inta = (0xff & val) | ((0xff00 & val) << 16);
+        return inta;
+}
+
 irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
 {
         struct iwl_trans *trans = dev_id;
@@ -814,12 +888,61 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
         struct isr_statistics *isr_stats = &trans_pcie->isr_stats;
         u32 inta = 0;
         u32 handled = 0;
-        unsigned long flags;
         u32 i;
 
         lock_map_acquire(&trans->sync_cmd_lockdep_map);
 
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+        spin_lock(&trans_pcie->irq_lock);
+
+        /* dram interrupt table not set yet,
+         * use legacy interrupt.
+         */
+        if (likely(trans_pcie->use_ict))
+                inta = iwl_pcie_int_cause_ict(trans);
+        else
+                inta = iwl_pcie_int_cause_non_ict(trans);
+
+        if (iwl_have_debug_level(IWL_DL_ISR)) {
+                IWL_DEBUG_ISR(trans,
+                              "ISR inta 0x%08x, enabled 0x%08x(sw), enabled(hw) 0x%08x, fh 0x%08x\n",
+                              inta, trans_pcie->inta_mask,
+                              iwl_read32(trans, CSR_INT_MASK),
+                              iwl_read32(trans, CSR_FH_INT_STATUS));
+                if (inta & (~trans_pcie->inta_mask))
+                        IWL_DEBUG_ISR(trans,
+                                      "We got a masked interrupt (0x%08x)\n",
+                                      inta & (~trans_pcie->inta_mask));
+        }
+
+        inta &= trans_pcie->inta_mask;
+
+        /*
+         * Ignore interrupt if there's nothing in NIC to service.
+         * This may be due to IRQ shared with another device,
+         * or due to sporadic interrupts thrown from our NIC.
+         */
+        if (unlikely(!inta)) {
+                IWL_DEBUG_ISR(trans, "Ignore interrupt, inta == 0\n");
+                /*
+                 * Re-enable interrupts here since we don't
+                 * have anything to service
+                 */
+                if (test_bit(STATUS_INT_ENABLED, &trans->status))
+                        iwl_enable_interrupts(trans);
+                spin_unlock(&trans_pcie->irq_lock);
+                lock_map_release(&trans->sync_cmd_lockdep_map);
+                return IRQ_NONE;
+        }
+
+        if (unlikely(inta == 0xFFFFFFFF || (inta & 0xFFFFFFF0) == 0xa5a5a5a0)) {
+                /*
+                 * Hardware disappeared. It might have
+                 * already raised an interrupt.
+                 */
+                IWL_WARN(trans, "HARDWARE GONE?? INTA == 0x%08x\n", inta);
+                spin_unlock(&trans_pcie->irq_lock);
+                goto out;
+        }
 
         /* Ack/clear/reset pending uCode interrupts.
          * Note:  Some bits in CSR_INT are "OR" of bits in CSR_FH_INT_STATUS,
@@ -832,19 +955,13 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
          * hardware bugs here by ACKing all the possible interrupts so that
          * interrupt coalescing can still be achieved.
          */
-        iwl_write32(trans, CSR_INT,
-                    trans_pcie->inta | ~trans_pcie->inta_mask);
-
-        inta = trans_pcie->inta;
+        iwl_write32(trans, CSR_INT, inta | ~trans_pcie->inta_mask);
 
         if (iwl_have_debug_level(IWL_DL_ISR))
                 IWL_DEBUG_ISR(trans, "inta 0x%08x, enabled 0x%08x\n",
                               inta, iwl_read32(trans, CSR_INT_MASK));
 
-        /* saved interrupt in inta variable now we can reset trans_pcie->inta */
-        trans_pcie->inta = 0;
-
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+        spin_unlock(&trans_pcie->irq_lock);
 
         /* Now service all interrupt bits discovered above. */
         if (inta & CSR_INT_BIT_HW_ERR) {
@@ -1019,11 +1136,6 @@ out:
  *
  ******************************************************************************/
 
-/* a device (PCI-E) page is 4096 bytes long */
-#define ICT_SHIFT       12
-#define ICT_SIZE        (1 << ICT_SHIFT)
-#define ICT_COUNT       (ICT_SIZE / sizeof(u32))
-
 /* Free dram table */
 void iwl_pcie_free_ict(struct iwl_trans *trans)
 {
@@ -1048,7 +1160,7 @@ int iwl_pcie_alloc_ict(struct iwl_trans *trans)
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
 
         trans_pcie->ict_tbl =
-                dma_alloc_coherent(trans->dev, ICT_SIZE,
+                dma_zalloc_coherent(trans->dev, ICT_SIZE,
                                    &trans_pcie->ict_tbl_dma,
                                    GFP_KERNEL);
         if (!trans_pcie->ict_tbl)
@@ -1060,17 +1172,10 @@ int iwl_pcie_alloc_ict(struct iwl_trans *trans)
                 return -EINVAL;
         }
 
-        IWL_DEBUG_ISR(trans, "ict dma addr %Lx\n",
-                      (unsigned long long)trans_pcie->ict_tbl_dma);
-
-        IWL_DEBUG_ISR(trans, "ict vir addr %p\n", trans_pcie->ict_tbl);
+        IWL_DEBUG_ISR(trans, "ict dma addr %Lx ict vir addr %p\n",
+                      (unsigned long long)trans_pcie->ict_tbl_dma,
+                      trans_pcie->ict_tbl);
 
-        /* reset table and index to all 0 */
-        memset(trans_pcie->ict_tbl, 0, ICT_SIZE);
-        trans_pcie->ict_index = 0;
-
-        /* add periodic RX interrupt */
-        trans_pcie->inta_mask |= CSR_INT_BIT_RX_PERIODIC;
         return 0;
 }
 
@@ -1081,12 +1186,11 @@ void iwl_pcie_reset_ict(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         u32 val;
-        unsigned long flags;
 
         if (!trans_pcie->ict_tbl)
                 return;
 
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+        spin_lock(&trans_pcie->irq_lock);
         iwl_disable_interrupts(trans);
 
         memset(trans_pcie->ict_tbl, 0, ICT_SIZE);
@@ -1103,120 +1207,26 @@ void iwl_pcie_reset_ict(struct iwl_trans *trans)
         trans_pcie->ict_index = 0;
         iwl_write32(trans, CSR_INT, trans_pcie->inta_mask);
         iwl_enable_interrupts(trans);
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+        spin_unlock(&trans_pcie->irq_lock);
 }
 
 /* Device is going down disable ict interrupt usage */
 void iwl_pcie_disable_ict(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        unsigned long flags;
 
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+        spin_lock(&trans_pcie->irq_lock);
         trans_pcie->use_ict = false;
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
-}
-
-/* legacy (non-ICT) ISR. Assumes that trans_pcie->irq_lock is held */
-static irqreturn_t iwl_pcie_isr(int irq, void *data)
-{
-        struct iwl_trans *trans = data;
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        u32 inta, inta_mask;
-
-        lockdep_assert_held(&trans_pcie->irq_lock);
-
-        trace_iwlwifi_dev_irq(trans->dev);
-
-        /* Disable (but don't clear!) interrupts here to avoid
-         *    back-to-back ISRs and sporadic interrupts from our NIC.
-         * If we have something to service, the irq thread will re-enable ints.
-         * If we *don't* have something, we'll re-enable before leaving here. */
-        inta_mask = iwl_read32(trans, CSR_INT_MASK);
-        iwl_write32(trans, CSR_INT_MASK, 0x00000000);
-
-        /* Discover which interrupts are active/pending */
-        inta = iwl_read32(trans, CSR_INT);
-
-        if (inta & (~inta_mask)) {
-                IWL_DEBUG_ISR(trans,
-                              "We got a masked interrupt (0x%08x)...Ack and ignore\n",
-                              inta & (~inta_mask));
-                iwl_write32(trans, CSR_INT, inta & (~inta_mask));
-                inta &= inta_mask;
-        }
-
-        /* Ignore interrupt if there's nothing in NIC to service.
-         * This may be due to IRQ shared with another device,
-         * or due to sporadic interrupts thrown from our NIC. */
-        if (!inta) {
-                IWL_DEBUG_ISR(trans, "Ignore interrupt, inta == 0\n");
-                /*
-                 * Re-enable interrupts here since we don't have anything to
-                 * service, but only in case the handler won't run. Note that
-                 * the handler can be scheduled because of a previous
-                 * interrupt.
-                 */
-                if (test_bit(STATUS_INT_ENABLED, &trans->status) &&
-                    !trans_pcie->inta)
-                        iwl_enable_interrupts(trans);
-                return IRQ_NONE;
-        }
-
-        if ((inta == 0xFFFFFFFF) || ((inta & 0xFFFFFFF0) == 0xa5a5a5a0)) {
-                /* Hardware disappeared. It might have already raised
-                 * an interrupt */
-                IWL_WARN(trans, "HARDWARE GONE?? INTA == 0x%08x\n", inta);
-                return IRQ_HANDLED;
-        }
-
-        if (iwl_have_debug_level(IWL_DL_ISR))
-                IWL_DEBUG_ISR(trans,
-                              "ISR inta 0x%08x, enabled 0x%08x, fh 0x%08x\n",
-                              inta, inta_mask,
-                              iwl_read32(trans, CSR_FH_INT_STATUS));
-
-        trans_pcie->inta |= inta;
-        /* the thread will service interrupts and re-enable them */
-        return IRQ_WAKE_THREAD;
+        spin_unlock(&trans_pcie->irq_lock);
 }
 
-/* interrupt handler using ict table, with this interrupt driver will
- * stop using INTA register to get device's interrupt, reading this register
- * is expensive, device will write interrupts in ICT dram table, increment
- * index then will fire interrupt to driver, driver will OR all ICT table
- * entries from current index up to table entry with 0 value. the result is
- * the interrupt we need to service, driver will set the entries back to 0 and
- * set index.
- */
-irqreturn_t iwl_pcie_isr_ict(int irq, void *data)
+irqreturn_t iwl_pcie_isr(int irq, void *data)
 {
         struct iwl_trans *trans = data;
-        struct iwl_trans_pcie *trans_pcie;
-        u32 inta;
-        u32 val = 0;
-        u32 read;
-        unsigned long flags;
-        irqreturn_t ret = IRQ_NONE;
 
         if (!trans)
                 return IRQ_NONE;
 
-        trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
-
-        /* dram interrupt table not set yet,
-         * use legacy interrupt.
-         */
-        if (unlikely(!trans_pcie->use_ict)) {
-                ret = iwl_pcie_isr(irq, data);
-                spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
-                return ret;
-        }
-
-        trace_iwlwifi_dev_irq(trans->dev);
-
         /* Disable (but don't clear!) interrupts here to avoid
          * back-to-back ISRs and sporadic interrupts from our NIC.
          * If we have something to service, the tasklet will re-enable ints.
@@ -1224,73 +1234,5 @@ irqreturn_t iwl_pcie_isr_ict(int irq, void *data)
          */
         iwl_write32(trans, CSR_INT_MASK, 0x00000000);
 
-        /* Ignore interrupt if there's nothing in NIC to service.
-         * This may be due to IRQ shared with another device,
-         * or due to sporadic interrupts thrown from our NIC. */
-        read = le32_to_cpu(trans_pcie->ict_tbl[trans_pcie->ict_index]);
-        trace_iwlwifi_dev_ict_read(trans->dev, trans_pcie->ict_index, read);
-        if (!read) {
-                IWL_DEBUG_ISR(trans, "Ignore interrupt, inta == 0\n");
-                goto none;
-        }
-
-        /*
-         * Collect all entries up to the first 0, starting from ict_index;
-         * note we already read at ict_index.
-         */
-        do {
-                val |= read;
-                IWL_DEBUG_ISR(trans, "ICT index %d value 0x%08X\n",
-                                trans_pcie->ict_index, read);
-                trans_pcie->ict_tbl[trans_pcie->ict_index] = 0;
-                trans_pcie->ict_index =
-                        iwl_queue_inc_wrap(trans_pcie->ict_index, ICT_COUNT);
-
-                read = le32_to_cpu(trans_pcie->ict_tbl[trans_pcie->ict_index]);
-                trace_iwlwifi_dev_ict_read(trans->dev, trans_pcie->ict_index,
-                                           read);
-        } while (read);
-
-        /* We should not get this value, just ignore it. */
-        if (val == 0xffffffff)
-                val = 0;
-
-        /*
-         * this is a w/a for a h/w bug. the h/w bug may cause the Rx bit
-         * (bit 15 before shifting it to 31) to clear when using interrupt
-         * coalescing. fortunately, bits 18 and 19 stay set when this happens
-         * so we use them to decide on the real state of the Rx bit.
-         * In order words, bit 15 is set if bit 18 or bit 19 are set.
-         */
-        if (val & 0xC0000)
-                val |= 0x8000;
-
-        inta = (0xff & val) | ((0xff00 & val) << 16);
-        IWL_DEBUG_ISR(trans, "ISR inta 0x%08x, enabled(sw) 0x%08x ict 0x%08x\n",
-                      inta, trans_pcie->inta_mask, val);
-        if (iwl_have_debug_level(IWL_DL_ISR))
-                IWL_DEBUG_ISR(trans, "enabled(hw) 0x%08x\n",
-                              iwl_read32(trans, CSR_INT_MASK));
-
-        inta &= trans_pcie->inta_mask;
-        trans_pcie->inta |= inta;
-
-        /* iwl_pcie_tasklet() will service interrupts and re-enable them */
-        if (likely(inta)) {
-                spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
-                return IRQ_WAKE_THREAD;
-        }
-
-        ret = IRQ_HANDLED;
-
- none:
-        /* re-enable interrupts here since we don't have anything to service.
-         * only Re-enable if disabled by irq.
-         */
-        if (test_bit(STATUS_INT_ENABLED, &trans->status) &&
-            !trans_pcie->inta)
-                iwl_enable_interrupts(trans);
-
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
-        return ret;
+        return IRQ_WAKE_THREAD;
 }
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index eecd38e3f15f..16f66c1a23de 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -75,33 +75,6 @@
 #include "iwl-agn-hw.h"
 #include "internal.h"
 
-static void __iwl_trans_pcie_set_bits_mask(struct iwl_trans *trans,
-                                                  u32 reg, u32 mask, u32 value)
-{
-        u32 v;
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-        WARN_ON_ONCE(value & ~mask);
-#endif
-
-        v = iwl_read32(trans, reg);
-        v &= ~mask;
-        v |= value;
-        iwl_write32(trans, reg, v);
-}
-
-static inline void __iwl_trans_pcie_clear_bit(struct iwl_trans *trans,
-                                              u32 reg, u32 mask)
-{
-        __iwl_trans_pcie_set_bits_mask(trans, reg, mask, 0);
-}
-
-static inline void __iwl_trans_pcie_set_bit(struct iwl_trans *trans,
-                                            u32 reg, u32 mask)
-{
-        __iwl_trans_pcie_set_bits_mask(trans, reg, mask, mask);
-}
-
 static void iwl_pcie_set_pwr(struct iwl_trans *trans, bool vaux)
 {
         if (vaux && pci_pme_capable(to_pci_dev(trans->dev), PCI_D3cold))
@@ -271,13 +244,12 @@ static void iwl_pcie_apm_stop(struct iwl_trans *trans)
 static int iwl_pcie_nic_init(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        unsigned long flags;
 
         /* nic_init */
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+        spin_lock(&trans_pcie->irq_lock);
         iwl_pcie_apm_init(trans);
 
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+        spin_unlock(&trans_pcie->irq_lock);
 
         iwl_pcie_set_pwr(trans, false);
 
@@ -635,13 +607,14 @@ static void iwl_trans_pcie_fw_alive(struct iwl_trans *trans, u32 scd_addr)
 static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        unsigned long flags;
-        bool hw_rfkill;
+        bool hw_rfkill, was_hw_rfkill;
+
+        was_hw_rfkill = iwl_is_rfkill_set(trans);
 
         /* tell the device to stop sending interrupts */
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+        spin_lock(&trans_pcie->irq_lock);
         iwl_disable_interrupts(trans);
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+        spin_unlock(&trans_pcie->irq_lock);
 
         /* device going down, Stop using ICT table */
         iwl_pcie_disable_ict(trans);
@@ -673,9 +646,9 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
         /* Upon stop, the APM issues an interrupt if HW RF kill is set.
          * Clean again the interrupt here
          */
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+        spin_lock(&trans_pcie->irq_lock);
         iwl_disable_interrupts(trans);
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+        spin_unlock(&trans_pcie->irq_lock);
 
         /* stop and reset the on-board processor */
         iwl_write32(trans, CSR_RESET, CSR_RESET_REG_FLAG_NEVO_RESET);
@@ -698,13 +671,20 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
          * all the interrupts were disabled, in this case we couldn't
          * receive the RF kill interrupt and update the state in the
          * op_mode.
+         * Don't call the op_mode if the rkfill state hasn't changed.
+         * This allows the op_mode to call stop_device from the rfkill
+         * notification without endless recursion. Under very rare
+         * circumstances, we might have a small recursion if the rfkill
+         * state changed exactly now while we were called from stop_device.
+         * This is very unlikely but can happen and is supported.
          */
         hw_rfkill = iwl_is_rfkill_set(trans);
         if (hw_rfkill)
                 set_bit(STATUS_RFKILL, &trans->status);
         else
                 clear_bit(STATUS_RFKILL, &trans->status);
-        iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
+        if (hw_rfkill != was_hw_rfkill)
+                iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
 }
 
 static void iwl_trans_pcie_d3_suspend(struct iwl_trans *trans, bool test)
@@ -799,7 +779,7 @@ static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
         }
 
         /* Reset the entire device */
-        iwl_set_bit(trans, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
+        iwl_write32(trans, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
 
         usleep_range(10, 15);
 
@@ -821,18 +801,17 @@ static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
 static void iwl_trans_pcie_op_mode_leave(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        unsigned long flags;
 
         /* disable interrupts - don't enable HW RF kill interrupt */
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+        spin_lock(&trans_pcie->irq_lock);
         iwl_disable_interrupts(trans);
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+        spin_unlock(&trans_pcie->irq_lock);
 
         iwl_pcie_apm_stop(trans);
 
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+        spin_lock(&trans_pcie->irq_lock);
         iwl_disable_interrupts(trans);
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+        spin_unlock(&trans_pcie->irq_lock);
 
         iwl_pcie_disable_ict(trans);
 }
@@ -932,6 +911,9 @@ static bool iwl_trans_pcie_grab_nic_access(struct iwl_trans *trans, bool silent,
 
         spin_lock_irqsave(&trans_pcie->reg_lock, *flags);
 
+        if (trans_pcie->cmd_in_flight)
+                goto out;
+
         /* this bit wakes up the NIC */
         __iwl_trans_pcie_set_bit(trans, CSR_GP_CNTRL,
                                  CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
@@ -971,6 +953,7 @@ static bool iwl_trans_pcie_grab_nic_access(struct iwl_trans *trans, bool silent,
                 }
         }
 
+out:
         /*
          * Fool sparse by faking we release the lock - sparse will
          * track nic_access anyway.
@@ -992,6 +975,9 @@ static void iwl_trans_pcie_release_nic_access(struct iwl_trans *trans,
          */
         __acquire(&trans_pcie->reg_lock);
 
+        if (trans_pcie->cmd_in_flight)
+                goto out;
+
         __iwl_trans_pcie_clear_bit(trans, CSR_GP_CNTRL,
                                    CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
         /*
@@ -1001,6 +987,7 @@ static void iwl_trans_pcie_release_nic_access(struct iwl_trans *trans,
          * scheduled on different CPUs (after we drop reg_lock).
          */
         mmiowb();
+out:
         spin_unlock_irqrestore(&trans_pcie->reg_lock, *flags);
 }
 
@@ -1597,7 +1584,7 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
         if (iwl_pcie_alloc_ict(trans))
                 goto out_free_cmd_pool;
 
-        err = request_threaded_irq(pdev->irq, iwl_pcie_isr_ict,
+        err = request_threaded_irq(pdev->irq, iwl_pcie_isr,
                                    iwl_pcie_irq_handler,
                                    IRQF_SHARED, DRV_NAME, trans);
         if (err) {
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 8df24787c141..3b14fa8abfc7 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -737,10 +737,9 @@ int iwl_pcie_tx_stop(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         int ch, txq_id, ret;
-        unsigned long flags;
 
         /* Turn off all Tx DMA fifos */
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+        spin_lock(&trans_pcie->irq_lock);
 
         iwl_pcie_txq_set_sched(trans, 0);
 
@@ -757,13 +756,19 @@ int iwl_pcie_tx_stop(struct iwl_trans *trans)
                                 iwl_read_direct32(trans,
                                                   FH_TSSR_TX_STATUS_REG));
         }
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+        spin_unlock(&trans_pcie->irq_lock);
 
-        if (!trans_pcie->txq) {
-                IWL_WARN(trans,
-                         "Stopping tx queues that aren't allocated...\n");
+        /*
+         * This function can be called before the op_mode disabled the
+         * queues. This happens when we have an rfkill interrupt.
+         * Since we stop Tx altogether - mark the queues as stopped.
+         */
+        memset(trans_pcie->queue_stopped, 0, sizeof(trans_pcie->queue_stopped));
+        memset(trans_pcie->queue_used, 0, sizeof(trans_pcie->queue_used));
+
+        /* This can happen: start_hw, stop_device */
+        if (!trans_pcie->txq)
                 return 0;
-        }
 
         /* Unmap DMA from host system and free skb's */
         for (txq_id = 0; txq_id < trans->cfg->base_params->num_of_queues;
@@ -865,7 +870,6 @@ int iwl_pcie_tx_init(struct iwl_trans *trans)
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         int ret;
         int txq_id, slots_num;
-        unsigned long flags;
         bool alloc = false;
 
         if (!trans_pcie->txq) {
@@ -875,7 +879,7 @@ int iwl_pcie_tx_init(struct iwl_trans *trans)
                 alloc = true;
         }
 
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+        spin_lock(&trans_pcie->irq_lock);
 
         /* Turn off all Tx DMA fifos */
         iwl_write_prph(trans, SCD_TXFACT, 0);
@@ -884,7 +888,7 @@ int iwl_pcie_tx_init(struct iwl_trans *trans)
         iwl_write_direct32(trans, FH_KW_MEM_ADDR_REG,
                            trans_pcie->kw.dma >> 4);
 
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+        spin_unlock(&trans_pcie->irq_lock);
 
         /* Alloc and init all Tx queues, including the command queue (#4/#9) */
         for (txq_id = 0; txq_id < trans->cfg->base_params->num_of_queues;
@@ -1003,6 +1007,7 @@ static void iwl_pcie_cmdq_reclaim(struct iwl_trans *trans, int txq_id, int idx)
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_txq *txq = &trans_pcie->txq[txq_id];
         struct iwl_queue *q = &txq->q;
+        unsigned long flags;
         int nfreed = 0;
 
         lockdep_assert_held(&txq->lock);
@@ -1025,6 +1030,16 @@ static void iwl_pcie_cmdq_reclaim(struct iwl_trans *trans, int txq_id, int idx)
                 }
         }
 
+        if (q->read_ptr == q->write_ptr) {
+                spin_lock_irqsave(&trans_pcie->reg_lock, flags);
+                WARN_ON(!trans_pcie->cmd_in_flight);
+                trans_pcie->cmd_in_flight = false;
+                __iwl_trans_pcie_clear_bit(trans,
+                                           CSR_GP_CNTRL,
+                                           CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
+                spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
+        }
+
         iwl_pcie_txq_progress(trans_pcie, txq);
 }
 
@@ -1141,8 +1156,15 @@ void iwl_trans_pcie_txq_disable(struct iwl_trans *trans, int txq_id)
                         SCD_TX_STTS_QUEUE_OFFSET(txq_id);
         static const u32 zero_val[4] = {};
 
+        /*
+         * Upon HW Rfkill - we stop the device, and then stop the queues
+         * in the op_mode. Just for the sake of the simplicity of the op_mode,
+         * allow the op_mode to call txq_disable after it already called
+         * stop_device.
+         */
         if (!test_and_clear_bit(txq_id, trans_pcie->queue_used)) {
-                WARN_ONCE(1, "queue %d not used", txq_id);
+                WARN_ONCE(test_bit(STATUS_DEVICE_ENABLED, &trans->status),
+                          "queue %d not used", txq_id);
                 return;
         }
 
@@ -1176,12 +1198,13 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
         struct iwl_queue *q = &txq->q;
         struct iwl_device_cmd *out_cmd;
         struct iwl_cmd_meta *out_meta;
+        unsigned long flags;
         void *dup_buf = NULL;
         dma_addr_t phys_addr;
         int idx;
         u16 copy_size, cmd_size, scratch_size;
         bool had_nocopy = false;
-        int i;
+        int i, ret;
         u32 cmd_pos;
         const u8 *cmddata[IWL_MAX_CMD_TBS_PER_TFD];
         u16 cmdlen[IWL_MAX_CMD_TBS_PER_TFD];
@@ -1379,10 +1402,38 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
         if (q->read_ptr == q->write_ptr && trans_pcie->wd_timeout)
                 mod_timer(&txq->stuck_timer, jiffies + trans_pcie->wd_timeout);
 
+        spin_lock_irqsave(&trans_pcie->reg_lock, flags);
+
+        /*
+         * wake up the NIC to make sure that the firmware will see the host
+         * command - we will let the NIC sleep once all the host commands
+         * returned.
+         */
+        if (!trans_pcie->cmd_in_flight) {
+                trans_pcie->cmd_in_flight = true;
+                __iwl_trans_pcie_set_bit(trans, CSR_GP_CNTRL,
+                                         CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
+                ret = iwl_poll_bit(trans, CSR_GP_CNTRL,
+                                   CSR_GP_CNTRL_REG_VAL_MAC_ACCESS_EN,
+                                   (CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY |
+                                    CSR_GP_CNTRL_REG_FLAG_GOING_TO_SLEEP),
+                                   15000);
+                if (ret < 0) {
+                        __iwl_trans_pcie_clear_bit(trans, CSR_GP_CNTRL,
+                                   CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
+                        spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
+                        trans_pcie->cmd_in_flight = false;
+                        idx = -EIO;
+                        goto out;
+                }
+        }
+
         /* Increment and update queue's write index */
         q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
         iwl_pcie_txq_inc_wr_ptr(trans, txq);
 
+        spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
+
  out:
         spin_unlock_bh(&txq->lock);
  free_dup_buf:
@@ -1464,7 +1515,6 @@ void iwl_pcie_hcmd_complete(struct iwl_trans *trans,
 }
 
 #define HOST_COMPLETE_TIMEOUT   (2 * HZ)
-#define COMMAND_POKE_TIMEOUT    (HZ / 10)
 
 static int iwl_pcie_send_hcmd_async(struct iwl_trans *trans,
                                     struct iwl_host_cmd *cmd)
@@ -1492,7 +1542,6 @@ static int iwl_pcie_send_hcmd_sync(struct iwl_trans *trans,
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         int cmd_idx;
         int ret;
-        int timeout = HOST_COMPLETE_TIMEOUT;
 
         IWL_DEBUG_INFO(trans, "Attempting to send sync command %s\n",
                        get_cmd_string(trans_pcie, cmd->id));
@@ -1516,29 +1565,10 @@ static int iwl_pcie_send_hcmd_sync(struct iwl_trans *trans,
                 return ret;
         }
 
-        while (timeout > 0) {
-                unsigned long flags;
-
-                timeout -= COMMAND_POKE_TIMEOUT;
-                ret = wait_event_timeout(trans_pcie->wait_command_queue,
-                                         !test_bit(STATUS_SYNC_HCMD_ACTIVE,
-                                                   &trans->status),
-                                         COMMAND_POKE_TIMEOUT);
-                if (ret)
-                        break;
-                /* poke the device - it may have lost the command */
-                if (iwl_trans_grab_nic_access(trans, true, &flags)) {
-                        iwl_trans_release_nic_access(trans, &flags);
-                        IWL_DEBUG_INFO(trans,
-                                       "Tried to wake NIC for command %s\n",
-                                       get_cmd_string(trans_pcie, cmd->id));
-                } else {
-                        IWL_ERR(trans, "Failed to poke NIC for command %s\n",
-                                get_cmd_string(trans_pcie, cmd->id));
-                        break;
-                }
-        }
-
+        ret = wait_event_timeout(trans_pcie->wait_command_queue,
+                                 !test_bit(STATUS_SYNC_HCMD_ACTIVE,
+                                           &trans->status),
+                                 HOST_COMPLETE_TIMEOUT);
         if (!ret) {
                 struct iwl_txq *txq = &trans_pcie->txq[trans_pcie->cmd_queue];
                 struct iwl_queue *q = &txq->q;
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index b994679abce0..e7c81abf108e 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -563,14 +563,7 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy,
                 memcpy(adapter->country_code, request->alpha2,
                        sizeof(request->alpha2));
                 mwifiex_send_domain_info_cmd_fw(wiphy);
-
-                if (adapter->dt_node) {
-                        char txpwr[] = {"marvell,00_txpwrlimit"};
-
-                        memcpy(&txpwr[8], adapter->country_code, 2);
-                        mwifiex_dnld_dt_cfgdata(priv, adapter->dt_node,
-                                                txpwr);
-                }
+                mwifiex_dnld_txpwr_table(priv);
         }
 }
 
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 6bf58aba51d2..2d6f5e1721cf 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -749,7 +749,7 @@ static struct net_device_stats *mwifiex_get_stats(struct net_device *dev)
 static u16
 mwifiex_netdev_select_wmm_queue(struct net_device *dev, struct sk_buff *skb)
 {
-        skb->priority = cfg80211_classify8021d(skb);
+        skb->priority = cfg80211_classify8021d(skb, NULL);
         return mwifiex_1d_to_wmm_queue[skb->priority];
 }
 
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index ab3416449bfd..d8ad554ce39f 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -1155,6 +1155,7 @@ void mwifiex_11h_process_join(struct mwifiex_private *priv, u8 **buffer,
 int mwifiex_11h_handle_event_chanswann(struct mwifiex_private *priv);
 int mwifiex_dnld_dt_cfgdata(struct mwifiex_private *priv,
                             struct device_node *node, const char *prefix);
+void mwifiex_dnld_txpwr_table(struct mwifiex_private *priv);
 
 extern const struct ethtool_ops mwifiex_ethtool_ops;
 
diff --git a/drivers/net/wireless/mwifiex/sta_cmd.c b/drivers/net/wireless/mwifiex/sta_cmd.c
index 9c2404cd755f..9208a8816b80 100644
--- a/drivers/net/wireless/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/mwifiex/sta_cmd.c
@@ -1170,8 +1170,9 @@ int mwifiex_dnld_dt_cfgdata(struct mwifiex_private *priv,
                     strncmp(prop->name, prefix, len))
                         continue;
 
-                /* property header is 6 bytes */
-                if (prop && prop->value && prop->length > 6) {
+                /* property header is 6 bytes, data must fit in cmd buffer */
+                if (prop && prop->value && prop->length > 6 &&
+                    prop->length <= MWIFIEX_SIZE_OF_CMD_BUFFER - S_DS_GEN) {
                         ret = mwifiex_send_cmd_sync(priv, HostCmd_CMD_CFG_DATA,
                                                     HostCmd_ACT_GEN_SET, 0,
                                                     prop);
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index 3edc92fad319..c5cb2ed19ec2 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -184,6 +184,16 @@ int mwifiex_fill_new_bss_desc(struct mwifiex_private *priv,
         return mwifiex_update_bss_desc_with_ie(priv->adapter, bss_desc);
 }
 
+void mwifiex_dnld_txpwr_table(struct mwifiex_private *priv)
+{
+        if (priv->adapter->dt_node) {
+                char txpwr[] = {"marvell,00_txpwrlimit"};
+
+                memcpy(&txpwr[8], priv->adapter->country_code, 2);
+                mwifiex_dnld_dt_cfgdata(priv, priv->adapter->dt_node, txpwr);
+        }
+}
+
 static int mwifiex_process_country_ie(struct mwifiex_private *priv,
                                       struct cfg80211_bss *bss)
 {
@@ -234,12 +244,7 @@ static int mwifiex_process_country_ie(struct mwifiex_private *priv,
                 return -1;
         }
 
-        if (priv->adapter->dt_node) {
-                char txpwr[] = {"marvell,00_txpwrlimit"};
-
-                memcpy(&txpwr[8], priv->adapter->country_code, 2);
-                mwifiex_dnld_dt_cfgdata(priv, priv->adapter->dt_node, txpwr);
-        }
+        mwifiex_dnld_txpwr_table(priv);
 
         return 0;
 }
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index b953ad621e0b..63dbde5c3713 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -9,7 +9,6 @@
  * warranty of any kind, whether express or implied.
  */
 
-#include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
@@ -1258,7 +1257,7 @@ mwl8k_capture_bssid(struct mwl8k_priv *priv, struct ieee80211_hdr *wh)
 {
         return priv->capture_beacon &&
                 ieee80211_is_beacon(wh->frame_control) &&
-                ether_addr_equal(wh->addr3, priv->capture_bssid);
+                ether_addr_equal_64bits(wh->addr3, priv->capture_bssid);
 }
 
 static inline void mwl8k_save_beacon(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/orinoco/hermes.c b/drivers/net/wireless/orinoco/hermes.c
index 75c15bc7b34c..43790fbea0e0 100644
--- a/drivers/net/wireless/orinoco/hermes.c
+++ b/drivers/net/wireless/orinoco/hermes.c
@@ -40,7 +40,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/init.h>
 #include <linux/delay.h>
 
 #include "hermes.h"
diff --git a/drivers/net/wireless/orinoco/orinoco_cs.c b/drivers/net/wireless/orinoco/orinoco_cs.c
index d21d95939316..c0a27377d9e2 100644
--- a/drivers/net/wireless/orinoco/orinoco_cs.c
+++ b/drivers/net/wireless/orinoco/orinoco_cs.c
@@ -15,7 +15,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/init.h>
 #include <linux/delay.h>
 #include <pcmcia/cistpl.h>
 #include <pcmcia/cisreg.h>
diff --git a/drivers/net/wireless/orinoco/orinoco_usb.c b/drivers/net/wireless/orinoco/orinoco_usb.c
index bdfe637953f4..f9805c9353d2 100644
--- a/drivers/net/wireless/orinoco/orinoco_usb.c
+++ b/drivers/net/wireless/orinoco/orinoco_usb.c
@@ -52,7 +52,6 @@
 #include <linux/signal.h>
 #include <linux/errno.h>
 #include <linux/poll.h>
-#include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/fcntl.h>
 #include <linux/spinlock.h>
diff --git a/drivers/net/wireless/orinoco/spectrum_cs.c b/drivers/net/wireless/orinoco/spectrum_cs.c
index e2264bc12ebf..b60048c95e0a 100644
--- a/drivers/net/wireless/orinoco/spectrum_cs.c
+++ b/drivers/net/wireless/orinoco/spectrum_cs.c
@@ -23,7 +23,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/init.h>
 #include <linux/delay.h>
 #include <pcmcia/cistpl.h>
 #include <pcmcia/cisreg.h>
diff --git a/drivers/net/wireless/p54/eeprom.c b/drivers/net/wireless/p54/eeprom.c
index d43e3740e45d..0fe67d2da208 100644
--- a/drivers/net/wireless/p54/eeprom.c
+++ b/drivers/net/wireless/p54/eeprom.c
@@ -16,7 +16,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/firmware.h>
 #include <linux/etherdevice.h>
 #include <linux/sort.h>
diff --git a/drivers/net/wireless/p54/fwio.c b/drivers/net/wireless/p54/fwio.c
index b3879fbf5368..bc065e8e348b 100644
--- a/drivers/net/wireless/p54/fwio.c
+++ b/drivers/net/wireless/p54/fwio.c
@@ -16,7 +16,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/firmware.h>
 #include <linux/etherdevice.h>
diff --git a/drivers/net/wireless/p54/led.c b/drivers/net/wireless/p54/led.c
index 3837e1eec5f4..1f6fd5ff5531 100644
--- a/drivers/net/wireless/p54/led.c
+++ b/drivers/net/wireless/p54/led.c
@@ -16,7 +16,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/firmware.h>
 #include <linux/etherdevice.h>
 
diff --git a/drivers/net/wireless/p54/main.c b/drivers/net/wireless/p54/main.c
index 067e6f2fd050..80d93cba5150 100644
--- a/drivers/net/wireless/p54/main.c
+++ b/drivers/net/wireless/p54/main.c
@@ -16,7 +16,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/firmware.h>
 #include <linux/etherdevice.h>
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index f9a07b0d83ac..d411de409050 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -13,7 +13,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/slab.h>
 #include <linux/firmware.h>
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index e328d3058c41..6e635cfa24c8 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -12,7 +12,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/usb.h>
 #include <linux/pci.h>
 #include <linux/slab.h>
diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
index f95de0d16216..9c96831c0b5c 100644
--- a/drivers/net/wireless/p54/txrx.c
+++ b/drivers/net/wireless/p54/txrx.c
@@ -17,7 +17,6 @@
  */
 
 #include <linux/export.h>
-#include <linux/init.h>
 #include <linux/firmware.h>
 #include <linux/etherdevice.h>
 #include <asm/div64.h>
@@ -308,7 +307,7 @@ static void p54_pspoll_workaround(struct p54_common *priv, struct sk_buff *skb)
                 return;
 
         /* only consider beacons from the associated BSSID */
-        if (!ether_addr_equal(hdr->addr3, priv->bssid))
+        if (!ether_addr_equal_64bits(hdr->addr3, priv->bssid))
                 return;
 
         tim = p54_find_ie(skb, WLAN_EID_TIM);
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index c3cdda1252de..5028557aa18a 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -26,7 +26,6 @@
 // #define      VERBOSE                 // more; success messages
 
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/ethtool.h>
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index 4ad0de9d1d08..4ccfef5094e0 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -24,7 +24,6 @@
 
 #include <linux/delay.h>
 #include <linux/etherdevice.h>
-#include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/pci.h>
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 4f61ffbcd2f1..abc5f56f29fe 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -24,7 +24,6 @@
 
 #include <linux/delay.h>
 #include <linux/etherdevice.h>
-#include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/pci.h>
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 1bb76935da71..9f16824cd1bc 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -24,7 +24,6 @@
 
 #include <linux/delay.h>
 #include <linux/etherdevice.h>
-#include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/slab.h>
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 49ff178a0b46..5c5c4906c6b6 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -29,7 +29,6 @@
 
 #include <linux/delay.h>
 #include <linux/etherdevice.h>
-#include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/usb.h>
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 00c3fae6fa3c..2bde6729f5e6 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -565,10 +565,10 @@ static void rt2x00lib_rxdone_check_ba(struct rt2x00_dev *rt2x00dev,
 
 #undef TID_CHECK
 
-                if (!ether_addr_equal(ba->ra, entry->ta))
+                if (!ether_addr_equal_64bits(ba->ra, entry->ta))
                         continue;
 
-                if (!ether_addr_equal(ba->ta, entry->ra))
+                if (!ether_addr_equal_64bits(ba->ta, entry->ra))
                         continue;
 
                 /* Mark BAR since we received the according BA */
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index b76f6049ad9a..24402984ee57 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -25,7 +25,6 @@
 #include <linux/crc-itu-t.h>
 #include <linux/delay.h>
 #include <linux/etherdevice.h>
-#include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/slab.h>
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index ade88d7e089c..a140170b1eb3 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -25,7 +25,6 @@
 #include <linux/crc-itu-t.h>
 #include <linux/delay.h>
 #include <linux/etherdevice.h>
-#include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/slab.h>
diff --git a/drivers/net/wireless/rtl818x/rtl8180/dev.c b/drivers/net/wireless/rtl818x/rtl8180/dev.c
index a91506b12a62..8ec17aad0e52 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/dev.c
@@ -15,7 +15,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/pci.h>
 #include <linux/slab.h>
diff --git a/drivers/net/wireless/rtl818x/rtl8180/grf5101.c b/drivers/net/wireless/rtl818x/rtl8180/grf5101.c
index dc845693f321..b1bfee738937 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/grf5101.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/grf5101.c
@@ -19,7 +19,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/delay.h>
 #include <net/mac80211.h>
diff --git a/drivers/net/wireless/rtl818x/rtl8180/max2820.c b/drivers/net/wireless/rtl818x/rtl8180/max2820.c
index a63c443c3c6f..eebf23976524 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/max2820.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/max2820.c
@@ -18,7 +18,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/delay.h>
 #include <net/mac80211.h>
diff --git a/drivers/net/wireless/rtl818x/rtl8180/rtl8225.c b/drivers/net/wireless/rtl818x/rtl8180/rtl8225.c
index ee638d0749d6..d60a5f399022 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/rtl8225.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/rtl8225.c
@@ -15,7 +15,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/delay.h>
 #include <net/mac80211.h>
diff --git a/drivers/net/wireless/rtl818x/rtl8180/sa2400.c b/drivers/net/wireless/rtl818x/rtl8180/sa2400.c
index 7614d9ccc729..959b049827de 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/sa2400.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/sa2400.c
@@ -19,7 +19,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/delay.h>
 #include <net/mac80211.h>
diff --git a/drivers/net/wireless/rtl818x/rtl8187/dev.c b/drivers/net/wireless/rtl818x/rtl8187/dev.c
index ec9aa5b67381..fd78df813a85 100644
--- a/drivers/net/wireless/rtl818x/rtl8187/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187/dev.c
@@ -20,7 +20,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/usb.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
diff --git a/drivers/net/wireless/rtl818x/rtl8187/rtl8225.c b/drivers/net/wireless/rtl818x/rtl8187/rtl8225.c
index a26193a04447..5ecf18ed67b8 100644
--- a/drivers/net/wireless/rtl818x/rtl8187/rtl8225.c
+++ b/drivers/net/wireless/rtl818x/rtl8187/rtl8225.c
@@ -16,7 +16,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/usb.h>
 #include <net/mac80211.h>
 
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index fcf9b621918c..d63a12cc5de8 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -1293,7 +1293,7 @@ void rtl_beacon_statistic(struct ieee80211_hw *hw, struct sk_buff *skb)
                 return;
 
         /* and only beacons from the associated BSSID, please */
-        if (!ether_addr_equal(hdr->addr3, rtlpriv->mac80211.bssid))
+        if (!ether_addr_equal_64bits(hdr->addr3, rtlpriv->mac80211.bssid))
                 return;
 
         rtlpriv->link_info.bcn_rx_inperiod++;
@@ -1781,7 +1781,7 @@ void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len)
                 return;
 
         /* and only beacons from the associated BSSID, please */
-        if (!ether_addr_equal(hdr->addr3, rtlpriv->mac80211.bssid))
+        if (!ether_addr_equal_64bits(hdr->addr3, rtlpriv->mac80211.bssid))
                 return;
 
         if (rtl_find_221_ie(hw, data, len))
diff --git a/drivers/net/wireless/rtlwifi/ps.c b/drivers/net/wireless/rtlwifi/ps.c
index 0d81f766fd0f..deedae3c5449 100644
--- a/drivers/net/wireless/rtlwifi/ps.c
+++ b/drivers/net/wireless/rtlwifi/ps.c
@@ -478,7 +478,7 @@ void rtl_swlps_beacon(struct ieee80211_hw *hw, void *data, unsigned int len)
                 return;
 
         /* and only beacons from the associated BSSID, please */
-        if (!ether_addr_equal(hdr->addr3, rtlpriv->mac80211.bssid))
+        if (!ether_addr_equal_64bits(hdr->addr3, rtlpriv->mac80211.bssid))
                 return;
 
         rtlpriv->psc.last_beacon = jiffies;
@@ -923,7 +923,7 @@ void rtl_p2p_info(struct ieee80211_hw *hw, void *data, unsigned int len)
                 return;
 
         /* and only beacons from the associated BSSID, please */
-        if (!ether_addr_equal(hdr->addr3, rtlpriv->mac80211.bssid))
+        if (!ether_addr_equal_64bits(hdr->addr3, rtlpriv->mac80211.bssid))
                 return;
 
         /* check if this really is a beacon */
diff --git a/drivers/net/wireless/ti/wl1251/acx.c b/drivers/net/wireless/ti/wl1251/acx.c
index 374268d5ac6a..5a4ec56c83d0 100644
--- a/drivers/net/wireless/ti/wl1251/acx.c
+++ b/drivers/net/wireless/ti/wl1251/acx.c
@@ -194,7 +194,7 @@ out:
         return ret;
 }
 
-int wl1251_acx_feature_cfg(struct wl1251 *wl)
+int wl1251_acx_feature_cfg(struct wl1251 *wl, u32 data_flow_options)
 {
         struct acx_feature_config *feature;
         int ret;
@@ -205,8 +205,8 @@ int wl1251_acx_feature_cfg(struct wl1251 *wl)
         if (!feature)
                 return -ENOMEM;
 
-        /* DF_ENCRYPTION_DISABLE and DF_SNIFF_MODE_ENABLE are disabled */
-        feature->data_flow_options = 0;
+        /* DF_ENCRYPTION_DISABLE and DF_SNIFF_MODE_ENABLE can be set */
+        feature->data_flow_options = data_flow_options;
         feature->options = 0;
 
         ret = wl1251_cmd_configure(wl, ACX_FEATURE_CFG,
@@ -381,7 +381,8 @@ out:
         return ret;
 }
 
-int wl1251_acx_group_address_tbl(struct wl1251 *wl)
+int wl1251_acx_group_address_tbl(struct wl1251 *wl, bool enable,
+                                 void *mc_list, u32 mc_list_len)
 {
         struct acx_dot11_grp_addr_tbl *acx;
         int ret;
@@ -393,9 +394,9 @@ int wl1251_acx_group_address_tbl(struct wl1251 *wl)
                 return -ENOMEM;
 
         /* MAC filtering */
-        acx->enabled = 0;
-        acx->num_groups = 0;
-        memset(acx->mac_table, 0, ADDRESS_GROUP_MAX_LEN);
+        acx->enabled = enable;
+        acx->num_groups = mc_list_len;
+        memcpy(acx->mac_table, mc_list, mc_list_len * ETH_ALEN);
 
         ret = wl1251_cmd_configure(wl, DOT11_GROUP_ADDRESS_TBL,
                                    acx, sizeof(*acx));
@@ -846,12 +847,18 @@ int wl1251_acx_rate_policies(struct wl1251 *wl)
                 return -ENOMEM;
 
         /* configure one default (one-size-fits-all) rate class */
-        acx->rate_class_cnt = 1;
+        acx->rate_class_cnt = 2;
         acx->rate_class[0].enabled_rates = ACX_RATE_MASK_UNSPECIFIED;
         acx->rate_class[0].short_retry_limit = ACX_RATE_RETRY_LIMIT;
         acx->rate_class[0].long_retry_limit = ACX_RATE_RETRY_LIMIT;
         acx->rate_class[0].aflags = 0;
 
+        /* no-retry rate class */
+        acx->rate_class[1].enabled_rates = ACX_RATE_MASK_UNSPECIFIED;
+        acx->rate_class[1].short_retry_limit = 0;
+        acx->rate_class[1].long_retry_limit = 0;
+        acx->rate_class[1].aflags = 0;
+
         ret = wl1251_cmd_configure(wl, ACX_RATE_POLICY, acx, sizeof(*acx));
         if (ret < 0) {
                 wl1251_warning("Setting of rate policies failed: %d", ret);
@@ -960,6 +967,32 @@ out:
         return ret;
 }
 
+int wl1251_acx_arp_ip_filter(struct wl1251 *wl, bool enable, __be32 address)
+{
+        struct wl1251_acx_arp_filter *acx;
+        int ret;
+
+        wl1251_debug(DEBUG_ACX, "acx arp ip filter, enable: %d", enable);
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx)
+                return -ENOMEM;
+
+        acx->version = ACX_IPV4_VERSION;
+        acx->enable = enable;
+
+        if (enable)
+                memcpy(acx->address, &address, ACX_IPV4_ADDR_SIZE);
+
+        ret = wl1251_cmd_configure(wl, ACX_ARP_IP_FILTER,
+                                   acx, sizeof(*acx));
+        if (ret < 0)
+                wl1251_warning("failed to set arp ip filter: %d", ret);
+
+        kfree(acx);
+        return ret;
+}
+
 int wl1251_acx_ac_cfg(struct wl1251 *wl, u8 ac, u8 cw_min, u16 cw_max,
                       u8 aifs, u16 txop)
 {
diff --git a/drivers/net/wireless/ti/wl1251/acx.h b/drivers/net/wireless/ti/wl1251/acx.h
index c2ba100f9b1a..2bdec38699f4 100644
--- a/drivers/net/wireless/ti/wl1251/acx.h
+++ b/drivers/net/wireless/ti/wl1251/acx.h
@@ -350,8 +350,8 @@ struct acx_slot {
 } __packed;
 
 
-#define ADDRESS_GROUP_MAX       (8)
-#define ADDRESS_GROUP_MAX_LEN   (ETH_ALEN * ADDRESS_GROUP_MAX)
+#define ACX_MC_ADDRESS_GROUP_MAX        (8)
+#define ACX_MC_ADDRESS_GROUP_MAX_LEN    (ETH_ALEN * ACX_MC_ADDRESS_GROUP_MAX)
 
 struct acx_dot11_grp_addr_tbl {
         struct acx_header header;
@@ -359,7 +359,7 @@ struct acx_dot11_grp_addr_tbl {
         u8 enabled;
         u8 num_groups;
         u8 pad[2];
-        u8 mac_table[ADDRESS_GROUP_MAX_LEN];
+        u8 mac_table[ACX_MC_ADDRESS_GROUP_MAX_LEN];
 } __packed;
 
 
@@ -1232,6 +1232,20 @@ struct wl1251_acx_bet_enable {
         u8 padding[2];
 } __packed;
 
+#define ACX_IPV4_VERSION 4
+#define ACX_IPV6_VERSION 6
+#define ACX_IPV4_ADDR_SIZE 4
+struct wl1251_acx_arp_filter {
+        struct acx_header header;
+        u8 version;     /* The IP version: 4 - IPv4, 6 - IPv6.*/
+        u8 enable;      /* 1 - ARP filtering is enabled, 0 - disabled */
+        u8 padding[2];
+        u8 address[16]; /* The IP address used to filter ARP packets.
+                           ARP packets that do not match this address are
+                           dropped. When the IP Version is 4, the last 12
+                           bytes of the the address are ignored. */
+} __attribute__((packed));
+
 struct wl1251_acx_ac_cfg {
         struct acx_header header;
 
@@ -1440,7 +1454,7 @@ int wl1251_acx_wake_up_conditions(struct wl1251 *wl, u8 wake_up_event,
 int wl1251_acx_sleep_auth(struct wl1251 *wl, u8 sleep_auth);
 int wl1251_acx_fw_version(struct wl1251 *wl, char *buf, size_t len);
 int wl1251_acx_tx_power(struct wl1251 *wl, int power);
-int wl1251_acx_feature_cfg(struct wl1251 *wl);
+int wl1251_acx_feature_cfg(struct wl1251 *wl, u32 data_flow_options);
 int wl1251_acx_mem_map(struct wl1251 *wl,
                        struct acx_header *mem_map, size_t len);
 int wl1251_acx_data_path_params(struct wl1251 *wl,
@@ -1449,7 +1463,8 @@ int wl1251_acx_rx_msdu_life_time(struct wl1251 *wl, u32 life_time);
 int wl1251_acx_rx_config(struct wl1251 *wl, u32 config, u32 filter);
 int wl1251_acx_pd_threshold(struct wl1251 *wl);
 int wl1251_acx_slot(struct wl1251 *wl, enum acx_slot_type slot_time);
-int wl1251_acx_group_address_tbl(struct wl1251 *wl);
+int wl1251_acx_group_address_tbl(struct wl1251 *wl, bool enable,
+                                 void *mc_list, u32 mc_list_len);
 int wl1251_acx_service_period_timeout(struct wl1251 *wl);
 int wl1251_acx_rts_threshold(struct wl1251 *wl, u16 rts_threshold);
 int wl1251_acx_beacon_filter_opt(struct wl1251 *wl, bool enable_filter);
@@ -1473,6 +1488,7 @@ int wl1251_acx_mem_cfg(struct wl1251 *wl);
 int wl1251_acx_wr_tbtt_and_dtim(struct wl1251 *wl, u16 tbtt, u8 dtim);
 int wl1251_acx_bet_enable(struct wl1251 *wl, enum wl1251_acx_bet_mode mode,
                           u8 max_consecutive);
+int wl1251_acx_arp_ip_filter(struct wl1251 *wl, bool enable, __be32 address);
 int wl1251_acx_ac_cfg(struct wl1251 *wl, u8 ac, u8 cw_min, u16 cw_max,
                       u8 aifs, u16 txop);
 int wl1251_acx_tid_cfg(struct wl1251 *wl, u8 queue,
diff --git a/drivers/net/wireless/ti/wl1251/boot.c b/drivers/net/wireless/ti/wl1251/boot.c
index a2e5241382da..2000cd536077 100644
--- a/drivers/net/wireless/ti/wl1251/boot.c
+++ b/drivers/net/wireless/ti/wl1251/boot.c
@@ -299,7 +299,8 @@ int wl1251_boot_run_firmware(struct wl1251 *wl)
                 ROAMING_TRIGGER_LOW_RSSI_EVENT_ID |
                 ROAMING_TRIGGER_REGAINED_RSSI_EVENT_ID |
                 REGAINED_BSS_EVENT_ID | BT_PTA_SENSE_EVENT_ID |
-                BT_PTA_PREDICTION_EVENT_ID | JOIN_EVENT_COMPLETE_ID;
+                BT_PTA_PREDICTION_EVENT_ID | JOIN_EVENT_COMPLETE_ID |
+                PS_REPORT_EVENT_ID;
 
         ret = wl1251_event_unmask(wl);
         if (ret < 0) {
diff --git a/drivers/net/wireless/ti/wl1251/cmd.c b/drivers/net/wireless/ti/wl1251/cmd.c
index 6822b845efc1..223649bcaa5a 100644
--- a/drivers/net/wireless/ti/wl1251/cmd.c
+++ b/drivers/net/wireless/ti/wl1251/cmd.c
@@ -3,6 +3,7 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/crc7.h>
+#include <linux/etherdevice.h>
 
 #include "wl1251.h"
 #include "reg.h"
@@ -203,11 +204,11 @@ out:
         return ret;
 }
 
-int wl1251_cmd_data_path(struct wl1251 *wl, u8 channel, bool enable)
+int wl1251_cmd_data_path_rx(struct wl1251 *wl, u8 channel, bool enable)
 {
         struct cmd_enabledisable_path *cmd;
         int ret;
-        u16 cmd_rx, cmd_tx;
+        u16 cmd_rx;
 
         wl1251_debug(DEBUG_CMD, "cmd data path");
 
@@ -219,13 +220,10 @@ int wl1251_cmd_data_path(struct wl1251 *wl, u8 channel, bool enable)
 
         cmd->channel = channel;
 
-        if (enable) {
+        if (enable)
                 cmd_rx = CMD_ENABLE_RX;
-                cmd_tx = CMD_ENABLE_TX;
-        } else {
+        else
                 cmd_rx = CMD_DISABLE_RX;
-                cmd_tx = CMD_DISABLE_TX;
-        }
 
         ret = wl1251_cmd_send(wl, cmd_rx, cmd, sizeof(*cmd));
         if (ret < 0) {
@@ -237,17 +235,38 @@ int wl1251_cmd_data_path(struct wl1251 *wl, u8 channel, bool enable)
         wl1251_debug(DEBUG_BOOT, "rx %s cmd channel %d",
                      enable ? "start" : "stop", channel);
 
+out:
+        kfree(cmd);
+        return ret;
+}
+
+int wl1251_cmd_data_path_tx(struct wl1251 *wl, u8 channel, bool enable)
+{
+        struct cmd_enabledisable_path *cmd;
+        int ret;
+        u16 cmd_tx;
+
+        wl1251_debug(DEBUG_CMD, "cmd data path");
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd)
+                return -ENOMEM;
+
+        cmd->channel = channel;
+
+        if (enable)
+                cmd_tx = CMD_ENABLE_TX;
+        else
+                cmd_tx = CMD_DISABLE_TX;
+
         ret = wl1251_cmd_send(wl, cmd_tx, cmd, sizeof(*cmd));
-        if (ret < 0) {
+        if (ret < 0)
                 wl1251_error("tx %s cmd for channel %d failed",
                              enable ? "start" : "stop", channel);
-                goto out;
-        }
-
-        wl1251_debug(DEBUG_BOOT, "tx %s cmd channel %d",
-                     enable ? "start" : "stop", channel);
+        else
+                wl1251_debug(DEBUG_BOOT, "tx %s cmd channel %d",
+                             enable ? "start" : "stop", channel);
 
-out:
         kfree(cmd);
         return ret;
 }
@@ -410,7 +429,9 @@ int wl1251_cmd_scan(struct wl1251 *wl, u8 *ssid, size_t ssid_len,
         struct wl1251_cmd_scan *cmd;
         int i, ret = 0;
 
-        wl1251_debug(DEBUG_CMD, "cmd scan");
+        wl1251_debug(DEBUG_CMD, "cmd scan channels %d", n_channels);
+
+        WARN_ON(n_channels > SCAN_MAX_NUM_OF_CHANNELS);
 
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
         if (!cmd)
@@ -421,6 +442,13 @@ int wl1251_cmd_scan(struct wl1251 *wl, u8 *ssid, size_t ssid_len,
                                                     CFG_RX_MGMT_EN |
                                                     CFG_RX_BCN_EN);
         cmd->params.scan_options = 0;
+        /*
+         * Use high priority scan when not associated to prevent fw issue
+         * causing never-ending scans (sometimes 20+ minutes).
+         * Note: This bug may be caused by the fw's DTIM handling.
+         */
+        if (is_zero_ether_addr(wl->bssid))
+                cmd->params.scan_options |= WL1251_SCAN_OPT_PRIORITY_HIGH;
         cmd->params.num_channels = n_channels;
         cmd->params.num_probe_requests = n_probes;
         cmd->params.tx_rate = cpu_to_le16(1 << 1); /* 2 Mbps */
diff --git a/drivers/net/wireless/ti/wl1251/cmd.h b/drivers/net/wireless/ti/wl1251/cmd.h
index ee4f2b391822..d824ff978311 100644
--- a/drivers/net/wireless/ti/wl1251/cmd.h
+++ b/drivers/net/wireless/ti/wl1251/cmd.h
@@ -35,7 +35,8 @@ int wl1251_cmd_interrogate(struct wl1251 *wl, u16 id, void *buf, size_t len);
 int wl1251_cmd_configure(struct wl1251 *wl, u16 id, void *buf, size_t len);
 int wl1251_cmd_vbm(struct wl1251 *wl, u8 identity,
                    void *bitmap, u16 bitmap_len, u8 bitmap_control);
-int wl1251_cmd_data_path(struct wl1251 *wl, u8 channel, bool enable);
+int wl1251_cmd_data_path_rx(struct wl1251 *wl, u8 channel, bool enable);
+int wl1251_cmd_data_path_tx(struct wl1251 *wl, u8 channel, bool enable);
 int wl1251_cmd_join(struct wl1251 *wl, u8 bss_type, u8 channel,
                     u16 beacon_interval, u8 dtim_interval);
 int wl1251_cmd_ps_mode(struct wl1251 *wl, u8 ps_mode);
@@ -167,6 +168,11 @@ struct cmd_read_write_memory {
 #define CMDMBOX_HEADER_LEN 4
 #define CMDMBOX_INFO_ELEM_HEADER_LEN 4
 
+#define WL1251_SCAN_OPT_PASSIVE         1
+#define WL1251_SCAN_OPT_5GHZ_BAND       2
+#define WL1251_SCAN_OPT_TRIGGERD_SCAN   4
+#define WL1251_SCAN_OPT_PRIORITY_HIGH   8
+
 #define WL1251_SCAN_MIN_DURATION 30000
 #define WL1251_SCAN_MAX_DURATION 60000
 
diff --git a/drivers/net/wireless/ti/wl1251/event.c b/drivers/net/wireless/ti/wl1251/event.c
index 74ae8e1c2e33..db0105313745 100644
--- a/drivers/net/wireless/ti/wl1251/event.c
+++ b/drivers/net/wireless/ti/wl1251/event.c
@@ -46,6 +46,43 @@ static int wl1251_event_scan_complete(struct wl1251 *wl,
         return ret;
 }
 
+#define WL1251_PSM_ENTRY_RETRIES  3
+static int wl1251_event_ps_report(struct wl1251 *wl,
+                                  struct event_mailbox *mbox)
+{
+        int ret = 0;
+
+        wl1251_debug(DEBUG_EVENT, "ps status: %x", mbox->ps_status);
+
+        switch (mbox->ps_status) {
+        case EVENT_ENTER_POWER_SAVE_FAIL:
+                wl1251_debug(DEBUG_PSM, "PSM entry failed");
+
+                if (wl->station_mode != STATION_POWER_SAVE_MODE) {
+                        /* remain in active mode */
+                        wl->psm_entry_retry = 0;
+                        break;
+                }
+
+                if (wl->psm_entry_retry < WL1251_PSM_ENTRY_RETRIES) {
+                        wl->psm_entry_retry++;
+                        ret = wl1251_ps_set_mode(wl, STATION_POWER_SAVE_MODE);
+                } else {
+                        wl1251_error("Power save entry failed, giving up");
+                        wl->psm_entry_retry = 0;
+                }
+                break;
+        case EVENT_ENTER_POWER_SAVE_SUCCESS:
+        case EVENT_EXIT_POWER_SAVE_FAIL:
+        case EVENT_EXIT_POWER_SAVE_SUCCESS:
+        default:
+                wl->psm_entry_retry = 0;
+                break;
+        }
+
+        return 0;
+}
+
 static void wl1251_event_mbox_dump(struct event_mailbox *mbox)
 {
         wl1251_debug(DEBUG_EVENT, "MBOX DUMP:");
@@ -80,7 +117,14 @@ static int wl1251_event_process(struct wl1251 *wl, struct event_mailbox *mbox)
                 }
         }
 
-        if (vector & SYNCHRONIZATION_TIMEOUT_EVENT_ID) {
+        if (vector & PS_REPORT_EVENT_ID) {
+                wl1251_debug(DEBUG_EVENT, "PS_REPORT_EVENT");
+                ret = wl1251_event_ps_report(wl, mbox);
+                if (ret < 0)
+                        return ret;
+        }
+
+        if (wl->vif && vector & SYNCHRONIZATION_TIMEOUT_EVENT_ID) {
                 wl1251_debug(DEBUG_EVENT, "SYNCHRONIZATION_TIMEOUT_EVENT");
 
                 /* indicate to the stack, that beacons have been lost */
diff --git a/drivers/net/wireless/ti/wl1251/event.h b/drivers/net/wireless/ti/wl1251/event.h
index 30eb5d150bf7..88570a5cd042 100644
--- a/drivers/net/wireless/ti/wl1251/event.h
+++ b/drivers/net/wireless/ti/wl1251/event.h
@@ -112,6 +112,13 @@ struct event_mailbox {
         u8 padding[19];
 } __packed;
 
+enum {
+        EVENT_ENTER_POWER_SAVE_FAIL = 0,
+        EVENT_ENTER_POWER_SAVE_SUCCESS,
+        EVENT_EXIT_POWER_SAVE_FAIL,
+        EVENT_EXIT_POWER_SAVE_SUCCESS,
+};
+
 int wl1251_event_unmask(struct wl1251 *wl);
 void wl1251_event_mbox_config(struct wl1251 *wl);
 int wl1251_event_handle(struct wl1251 *wl, u8 mbox);
diff --git a/drivers/net/wireless/ti/wl1251/init.c b/drivers/net/wireless/ti/wl1251/init.c
index 89b43d35473c..1d799bffaa9f 100644
--- a/drivers/net/wireless/ti/wl1251/init.c
+++ b/drivers/net/wireless/ti/wl1251/init.c
@@ -33,7 +33,7 @@ int wl1251_hw_init_hwenc_config(struct wl1251 *wl)
 {
         int ret;
 
-        ret = wl1251_acx_feature_cfg(wl);
+        ret = wl1251_acx_feature_cfg(wl, 0);
         if (ret < 0) {
                 wl1251_warning("couldn't set feature config");
                 return ret;
@@ -127,7 +127,7 @@ int wl1251_hw_init_phy_config(struct wl1251 *wl)
         if (ret < 0)
                 return ret;
 
-        ret = wl1251_acx_group_address_tbl(wl);
+        ret = wl1251_acx_group_address_tbl(wl, true, NULL, 0);
         if (ret < 0)
                 return ret;
 
@@ -394,8 +394,13 @@ int wl1251_hw_init(struct wl1251 *wl)
         if (ret < 0)
                 goto out_free_data_path;
 
-        /* Enable data path */
-        ret = wl1251_cmd_data_path(wl, wl->channel, 1);
+        /* Enable rx data path */
+        ret = wl1251_cmd_data_path_rx(wl, wl->channel, 1);
+        if (ret < 0)
+                goto out_free_data_path;
+
+        /* Enable tx data path */
+        ret = wl1251_cmd_data_path_tx(wl, wl->channel, 1);
         if (ret < 0)
                 goto out_free_data_path;
 
diff --git a/drivers/net/wireless/ti/wl1251/main.c b/drivers/net/wireless/ti/wl1251/main.c
index b8a360b43e76..119c148f7740 100644
--- a/drivers/net/wireless/ti/wl1251/main.c
+++ b/drivers/net/wireless/ti/wl1251/main.c
@@ -28,6 +28,7 @@
 #include <linux/etherdevice.h>
 #include <linux/vmalloc.h>
 #include <linux/slab.h>
+#include <linux/netdevice.h>
 
 #include "wl1251.h"
 #include "wl12xx_80211.h"
@@ -479,10 +480,13 @@ static void wl1251_op_stop(struct ieee80211_hw *hw)
         wl->next_tx_complete = 0;
         wl->elp = false;
         wl->station_mode = STATION_ACTIVE_MODE;
+        wl->psm_entry_retry = 0;
         wl->tx_queue_stopped = false;
         wl->power_level = WL1251_DEFAULT_POWER_LEVEL;
         wl->rssi_thold = 0;
         wl->channel = WL1251_DEFAULT_CHANNEL;
+        wl->monitor_present = false;
+        wl->joined = false;
 
         wl1251_debugfs_reset(wl);
 
@@ -542,6 +546,7 @@ static void wl1251_op_remove_interface(struct ieee80211_hw *hw,
         mutex_lock(&wl->mutex);
         wl1251_debug(DEBUG_MAC80211, "mac80211 remove interface");
         wl->vif = NULL;
+        memset(wl->bssid, 0, ETH_ALEN);
         mutex_unlock(&wl->mutex);
 }
 
@@ -566,6 +571,11 @@ static int wl1251_build_qos_null_data(struct wl1251 *wl)
                                        sizeof(template));
 }
 
+static bool wl1251_can_do_pm(struct ieee80211_conf *conf, struct wl1251 *wl)
+{
+        return (conf->flags & IEEE80211_CONF_PS) && !wl->monitor_present;
+}
+
 static int wl1251_op_config(struct ieee80211_hw *hw, u32 changed)
 {
         struct wl1251 *wl = hw->priv;
@@ -575,8 +585,10 @@ static int wl1251_op_config(struct ieee80211_hw *hw, u32 changed)
         channel = ieee80211_frequency_to_channel(
                         conf->chandef.chan->center_freq);
 
-        wl1251_debug(DEBUG_MAC80211, "mac80211 config ch %d psm %s power %d",
+        wl1251_debug(DEBUG_MAC80211,
+                     "mac80211 config ch %d monitor %s psm %s power %d",
                      channel,
+                     conf->flags & IEEE80211_CONF_MONITOR ? "on" : "off",
                      conf->flags & IEEE80211_CONF_PS ? "on" : "off",
                      conf->power_level);
 
@@ -586,16 +598,44 @@ static int wl1251_op_config(struct ieee80211_hw *hw, u32 changed)
         if (ret < 0)
                 goto out;
 
+        if (changed & IEEE80211_CONF_CHANGE_MONITOR) {
+                u32 mode;
+
+                if (conf->flags & IEEE80211_CONF_MONITOR) {
+                        wl->monitor_present = true;
+                        mode = DF_SNIFF_MODE_ENABLE | DF_ENCRYPTION_DISABLE;
+                } else {
+                        wl->monitor_present = false;
+                        mode = 0;
+                }
+
+                ret = wl1251_acx_feature_cfg(wl, mode);
+                if (ret < 0)
+                        goto out_sleep;
+        }
+
         if (channel != wl->channel) {
                 wl->channel = channel;
 
-                ret = wl1251_join(wl, wl->bss_type, wl->channel,
-                                  wl->beacon_int, wl->dtim_period);
+                /*
+                 * Use ENABLE_RX command for channel switching when no
+                 * interface is present (monitor mode only).
+                 * This leaves the tx path disabled in firmware, whereas
+                 * the usual JOIN command seems to transmit some frames
+                 * at firmware level.
+                 */
+                if (wl->vif == NULL) {
+                        wl->joined = false;
+                        ret = wl1251_cmd_data_path_rx(wl, wl->channel, 1);
+                } else {
+                        ret = wl1251_join(wl, wl->bss_type, wl->channel,
+                                          wl->beacon_int, wl->dtim_period);
+                }
                 if (ret < 0)
                         goto out_sleep;
         }
 
-        if (conf->flags & IEEE80211_CONF_PS && !wl->psm_requested) {
+        if (wl1251_can_do_pm(conf, wl) && !wl->psm_requested) {
                 wl1251_debug(DEBUG_PSM, "psm enabled");
 
                 wl->psm_requested = true;
@@ -611,8 +651,7 @@ static int wl1251_op_config(struct ieee80211_hw *hw, u32 changed)
                 ret = wl1251_ps_set_mode(wl, STATION_POWER_SAVE_MODE);
                 if (ret < 0)
                         goto out_sleep;
-        } else if (!(conf->flags & IEEE80211_CONF_PS) &&
-                   wl->psm_requested) {
+        } else if (!wl1251_can_do_pm(conf, wl) && wl->psm_requested) {
                 wl1251_debug(DEBUG_PSM, "psm disabled");
 
                 wl->psm_requested = false;
@@ -648,6 +687,16 @@ static int wl1251_op_config(struct ieee80211_hw *hw, u32 changed)
                 wl->power_level = conf->power_level;
         }
 
+        /*
+         * Tell stack that connection is lost because hw encryption isn't
+         * supported in monitor mode.
+         * This requires temporary enabling of the hw connection monitor flag
+         */
+        if ((changed & IEEE80211_CONF_CHANGE_MONITOR) && wl->vif) {
+                wl->hw->flags |= IEEE80211_HW_CONNECTION_MONITOR;
+                ieee80211_connection_loss(wl->vif);
+        }
+
 out_sleep:
         wl1251_ps_elp_sleep(wl);
 
@@ -657,6 +706,44 @@ out:
         return ret;
 }
 
+struct wl1251_filter_params {
+        bool enabled;
+        int mc_list_length;
+        u8 mc_list[ACX_MC_ADDRESS_GROUP_MAX][ETH_ALEN];
+};
+
+static u64 wl1251_op_prepare_multicast(struct ieee80211_hw *hw,
+                                       struct netdev_hw_addr_list *mc_list)
+{
+        struct wl1251_filter_params *fp;
+        struct netdev_hw_addr *ha;
+        struct wl1251 *wl = hw->priv;
+
+        if (unlikely(wl->state == WL1251_STATE_OFF))
+                return 0;
+
+        fp = kzalloc(sizeof(*fp), GFP_ATOMIC);
+        if (!fp) {
+                wl1251_error("Out of memory setting filters.");
+                return 0;
+        }
+
+        /* update multicast filtering parameters */
+        fp->mc_list_length = 0;
+        if (netdev_hw_addr_list_count(mc_list) > ACX_MC_ADDRESS_GROUP_MAX) {
+                fp->enabled = false;
+        } else {
+                fp->enabled = true;
+                netdev_hw_addr_list_for_each(ha, mc_list) {
+                        memcpy(fp->mc_list[fp->mc_list_length],
+                                        ha->addr, ETH_ALEN);
+                        fp->mc_list_length++;
+                }
+        }
+
+        return (u64)(unsigned long)fp;
+}
+
 #define WL1251_SUPPORTED_FILTERS (FIF_PROMISC_IN_BSS | \
                                   FIF_ALLMULTI | \
                                   FIF_FCSFAIL | \
@@ -667,8 +754,9 @@ out:
 
 static void wl1251_op_configure_filter(struct ieee80211_hw *hw,
                                        unsigned int changed,
-                                       unsigned int *total,u64 multicast)
+                                       unsigned int *total, u64 multicast)
 {
+        struct wl1251_filter_params *fp = (void *)(unsigned long)multicast;
         struct wl1251 *wl = hw->priv;
         int ret;
 
@@ -677,9 +765,11 @@ static void wl1251_op_configure_filter(struct ieee80211_hw *hw,
         *total &= WL1251_SUPPORTED_FILTERS;
         changed &= WL1251_SUPPORTED_FILTERS;
 
-        if (changed == 0)
+        if (changed == 0) {
                 /* no filters which we support changed */
+                kfree(fp);
                 return;
+        }
 
         mutex_lock(&wl->mutex);
 
@@ -716,6 +806,15 @@ static void wl1251_op_configure_filter(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out;
 
+        if (*total & FIF_ALLMULTI || *total & FIF_PROMISC_IN_BSS)
+                ret = wl1251_acx_group_address_tbl(wl, false, NULL, 0);
+        else if (fp)
+                ret = wl1251_acx_group_address_tbl(wl, fp->enabled,
+                                                   fp->mc_list,
+                                                   fp->mc_list_length);
+        if (ret < 0)
+                goto out;
+
         /* send filters to firmware */
         wl1251_acx_rx_config(wl, wl->rx_config, wl->rx_filter);
 
@@ -723,6 +822,7 @@ static void wl1251_op_configure_filter(struct ieee80211_hw *hw,
 
 out:
         mutex_unlock(&wl->mutex);
+        kfree(fp);
 }
 
 /* HW encryption */
@@ -802,12 +902,12 @@ static int wl1251_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 
         mutex_lock(&wl->mutex);
 
-        ret = wl1251_ps_elp_wakeup(wl);
-        if (ret < 0)
-                goto out_unlock;
-
         switch (cmd) {
         case SET_KEY:
+                if (wl->monitor_present) {
+                        ret = -EOPNOTSUPP;
+                        goto out_unlock;
+                }
                 wl_cmd->key_action = KEY_ADD_OR_REPLACE;
                 break;
         case DISABLE_KEY:
@@ -818,6 +918,10 @@ static int wl1251_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 break;
         }
 
+        ret = wl1251_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out_unlock;
+
         ret = wl1251_set_key_type(wl, wl_cmd, cmd, key, addr);
         if (ret < 0) {
                 wl1251_error("Set KEY type failed");
@@ -930,6 +1034,7 @@ static int wl1251_op_hw_scan(struct ieee80211_hw *hw,
         ret = wl1251_cmd_scan(wl, ssid, ssid_len, req->channels,
                               req->n_channels, WL1251_SCAN_NUM_PROBES);
         if (ret < 0) {
+                wl1251_debug(DEBUG_SCAN, "scan failed %d", ret);
                 wl->scanning = false;
                 goto out_idle;
         }
@@ -977,6 +1082,7 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
 {
         struct wl1251 *wl = hw->priv;
         struct sk_buff *beacon, *skb;
+        bool enable;
         int ret;
 
         wl1251_debug(DEBUG_MAC80211, "mac80211 bss info changed");
@@ -1023,6 +1129,9 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
         }
 
         if (changed & BSS_CHANGED_ASSOC) {
+                /* Disable temporary enabled hw connection monitor flag */
+                wl->hw->flags &= ~IEEE80211_HW_CONNECTION_MONITOR;
+
                 if (bss_conf->assoc) {
                         wl->beacon_int = bss_conf->beacon_int;
 
@@ -1075,6 +1184,17 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
                 }
         }
 
+        if (changed & BSS_CHANGED_ARP_FILTER) {
+                __be32 addr = bss_conf->arp_addr_list[0];
+                WARN_ON(wl->bss_type != BSS_TYPE_STA_BSS);
+
+                enable = bss_conf->arp_addr_cnt == 1 && bss_conf->assoc;
+                wl1251_acx_arp_ip_filter(wl, enable, addr);
+
+                if (ret < 0)
+                        goto out_sleep;
+        }
+
         if (changed & BSS_CHANGED_BEACON) {
                 beacon = ieee80211_beacon_get(hw, vif);
                 if (!beacon)
@@ -1245,6 +1365,7 @@ static const struct ieee80211_ops wl1251_ops = {
         .add_interface = wl1251_op_add_interface,
         .remove_interface = wl1251_op_remove_interface,
         .config = wl1251_op_config,
+        .prepare_multicast = wl1251_op_prepare_multicast,
         .configure_filter = wl1251_op_configure_filter,
         .tx = wl1251_op_tx,
         .set_key = wl1251_op_set_key,
@@ -1401,7 +1522,10 @@ struct ieee80211_hw *wl1251_alloc_hw(void)
 
         INIT_DELAYED_WORK(&wl->elp_work, wl1251_elp_work);
         wl->channel = WL1251_DEFAULT_CHANNEL;
+        wl->monitor_present = false;
+        wl->joined = false;
         wl->scanning = false;
+        wl->bss_type = MAX_BSS_TYPE;
         wl->default_key = 0;
         wl->listen_int = 1;
         wl->rx_counter = 0;
@@ -1413,6 +1537,7 @@ struct ieee80211_hw *wl1251_alloc_hw(void)
         wl->elp = false;
         wl->station_mode = STATION_ACTIVE_MODE;
         wl->psm_requested = false;
+        wl->psm_entry_retry = 0;
         wl->tx_queue_stopped = false;
         wl->power_level = WL1251_DEFAULT_POWER_LEVEL;
         wl->rssi_thold = 0;
@@ -1478,3 +1603,4 @@ MODULE_DESCRIPTION("TI wl1251 Wireles LAN Driver Core");
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Kalle Valo <kvalo@adurom.com>");
 MODULE_FIRMWARE(WL1251_FW_NAME);
+MODULE_FIRMWARE(WL1251_NVS_NAME);
diff --git a/drivers/net/wireless/ti/wl1251/rx.c b/drivers/net/wireless/ti/wl1251/rx.c
index 23289d49dd31..123c4bb50e0a 100644
--- a/drivers/net/wireless/ti/wl1251/rx.c
+++ b/drivers/net/wireless/ti/wl1251/rx.c
@@ -83,7 +83,7 @@ static void wl1251_rx_status(struct wl1251 *wl,
 
         status->flag |= RX_FLAG_MACTIME_START;
 
-        if (desc->flags & RX_DESC_ENCRYPTION_MASK) {
+        if (!wl->monitor_present && (desc->flags & RX_DESC_ENCRYPTION_MASK)) {
                 status->flag |= RX_FLAG_IV_STRIPPED | RX_FLAG_MMIC_STRIPPED;
 
                 if (likely(!(desc->flags & RX_DESC_DECRYPT_FAIL)))
diff --git a/drivers/net/wireless/ti/wl1251/tx.c b/drivers/net/wireless/ti/wl1251/tx.c
index 28121c590a2b..81de83c6fcf6 100644
--- a/drivers/net/wireless/ti/wl1251/tx.c
+++ b/drivers/net/wireless/ti/wl1251/tx.c
@@ -28,6 +28,7 @@
 #include "tx.h"
 #include "ps.h"
 #include "io.h"
+#include "event.h"
 
 static bool wl1251_tx_double_buffer_busy(struct wl1251 *wl, u32 data_out_count)
 {
@@ -89,8 +90,12 @@ static void wl1251_tx_control(struct tx_double_buffer_desc *tx_hdr,
         /* 802.11 packets */
         tx_hdr->control.packet_type = 0;
 
-        if (control->flags & IEEE80211_TX_CTL_NO_ACK)
+        /* Also disable retry and ACK policy for injected packets */
+        if ((control->flags & IEEE80211_TX_CTL_NO_ACK) ||
+            (control->flags & IEEE80211_TX_CTL_INJECTED)) {
+                tx_hdr->control.rate_policy = 1;
                 tx_hdr->control.ack_policy = 1;
+        }
 
         tx_hdr->control.tx_complete = 1;
 
@@ -277,6 +282,26 @@ static void wl1251_tx_trigger(struct wl1251 *wl)
                 TX_STATUS_DATA_OUT_COUNT_MASK;
 }
 
+static void enable_tx_for_packet_injection(struct wl1251 *wl)
+{
+        int ret;
+
+        ret = wl1251_cmd_join(wl, BSS_TYPE_STA_BSS, wl->channel,
+                              wl->beacon_int, wl->dtim_period);
+        if (ret < 0) {
+                wl1251_warning("join failed");
+                return;
+        }
+
+        ret = wl1251_event_wait(wl, JOIN_EVENT_COMPLETE_ID, 100);
+        if (ret < 0) {
+                wl1251_warning("join timeout");
+                return;
+        }
+
+        wl->joined = true;
+}
+
 /* caller must hold wl->mutex */
 static int wl1251_tx_frame(struct wl1251 *wl, struct sk_buff *skb)
 {
@@ -287,6 +312,9 @@ static int wl1251_tx_frame(struct wl1251 *wl, struct sk_buff *skb)
         info = IEEE80211_SKB_CB(skb);
 
         if (info->control.hw_key) {
+                if (unlikely(wl->monitor_present))
+                        return -EINVAL;
+
                 idx = info->control.hw_key->hw_key_idx;
                 if (unlikely(wl->default_key != idx)) {
                         ret = wl1251_acx_default_key(wl, idx);
@@ -295,6 +323,10 @@ static int wl1251_tx_frame(struct wl1251 *wl, struct sk_buff *skb)
                 }
         }
 
+        /* Enable tx path in monitor mode for packet injection */
+        if ((wl->vif == NULL) && !wl->joined)
+                enable_tx_for_packet_injection(wl);
+
         ret = wl1251_tx_path_status(wl);
         if (ret < 0)
                 return ret;
@@ -394,6 +426,7 @@ static void wl1251_tx_packet_cb(struct wl1251 *wl,
         info = IEEE80211_SKB_CB(skb);
 
         if (!(info->flags & IEEE80211_TX_CTL_NO_ACK) &&
+            !(info->flags & IEEE80211_TX_CTL_INJECTED) &&
             (result->status == TX_SUCCESS))
                 info->flags |= IEEE80211_TX_STAT_ACK;
 
diff --git a/drivers/net/wireless/ti/wl1251/wl1251.h b/drivers/net/wireless/ti/wl1251/wl1251.h
index 2c3bd1bff3f6..235617a7716d 100644
--- a/drivers/net/wireless/ti/wl1251/wl1251.h
+++ b/drivers/net/wireless/ti/wl1251/wl1251.h
@@ -93,6 +93,7 @@ enum {
         } while (0)
 
 #define WL1251_DEFAULT_RX_CONFIG (CFG_UNI_FILTER_EN |   \
+                                  CFG_MC_FILTER_EN |    \
                                   CFG_BSSID_FILTER_EN)
 
 #define WL1251_DEFAULT_RX_FILTER (CFG_RX_PRSP_EN |  \
@@ -303,6 +304,8 @@ struct wl1251 {
         u8 bss_type;
         u8 listen_int;
         int channel;
+        bool monitor_present;
+        bool joined;
 
         void *target_mem_map;
         struct acx_data_path_params_resp *data_path;
@@ -368,6 +371,9 @@ struct wl1251 {
         /* PSM mode requested */
         bool psm_requested;
 
+        /* retry counter for PSM entries */
+        u8 psm_entry_retry;
+
         u16 beacon_int;
         u8 dtim_period;
 
diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c
index 1477d7f05905..d24d4a958c67 100644
--- a/drivers/net/wireless/wl3501_cs.c
+++ b/drivers/net/wireless/wl3501_cs.c
@@ -29,7 +29,6 @@
 
 #include <linux/delay.h>
 #include <linux/types.h>
-#include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/in.h>
 #include <linux/kernel.h>
diff --git a/drivers/ssb/driver_chipcommon_sflash.c b/drivers/ssb/driver_chipcommon_sflash.c
index 50328de712fa..937fc31971a7 100644
--- a/drivers/ssb/driver_chipcommon_sflash.c
+++ b/drivers/ssb/driver_chipcommon_sflash.c
@@ -37,7 +37,7 @@ static const struct ssb_sflash_tbl_e ssb_sflash_st_tbl[] = {
         { "M25P32", 0x15, 0x10000, 64, },
         { "M25P64", 0x16, 0x10000, 128, },
         { "M25FL128", 0x17, 0x10000, 256, },
-        { 0 },
+        { NULL },
 };
 
 static const struct ssb_sflash_tbl_e ssb_sflash_sst_tbl[] = {
@@ -55,7 +55,7 @@ static const struct ssb_sflash_tbl_e ssb_sflash_sst_tbl[] = {
         { "SST25VF016", 0x41, 0x1000, 512, },
         { "SST25VF032", 0x4a, 0x1000, 1024, },
         { "SST25VF064", 0x4b, 0x1000, 2048, },
-        { 0 },
+        { NULL },
 };
 
 static const struct ssb_sflash_tbl_e ssb_sflash_at_tbl[] = {
@@ -66,7 +66,7 @@ static const struct ssb_sflash_tbl_e ssb_sflash_at_tbl[] = {
         { "AT45DB161", 0x2c, 512, 4096, },
         { "AT45DB321", 0x34, 512, 8192, },
         { "AT45DB642", 0x3c, 1024, 8192, },
-        { 0 },
+        { NULL },
 };
 
 static void ssb_sflash_cmd(struct ssb_chipcommon *cc, u32 opcode)