Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6

127 files changed, 13359 insertions, 5923 deletions

diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 7116a1aa20ce..e265ba14054b 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -5660,7 +5660,8 @@ static int airo_pci_suspend(struct pci_dev *pdev, pm_message_t state)
 
         pci_enable_wake(pdev, pci_choose_state(pdev, state), 1);
         pci_save_state(pdev);
-        return pci_set_power_state(pdev, pci_choose_state(pdev, state));
+        pci_set_power_state(pdev, pci_choose_state(pdev, state));
+        return 0;
 }
 
 static int airo_pci_resume(struct pci_dev *pdev)
diff --git a/drivers/net/wireless/ath/ar9170/ar9170.h b/drivers/net/wireless/ath/ar9170/ar9170.h
index ec034af26980..9f9459860d82 100644
--- a/drivers/net/wireless/ath/ar9170/ar9170.h
+++ b/drivers/net/wireless/ath/ar9170/ar9170.h
@@ -231,7 +231,7 @@ struct ar9170 {
         struct sk_buff_head tx_status_ampdu;
         spinlock_t tx_ampdu_list_lock;
         struct list_head tx_ampdu_list;
-        unsigned int tx_ampdu_pending;
+        atomic_t tx_ampdu_pending;
 
         /* rxstream mpdu merge */
         struct ar9170_rxstream_mpdu_merge rx_mpdu;
diff --git a/drivers/net/wireless/ath/ar9170/hw.h b/drivers/net/wireless/ath/ar9170/hw.h
index 88113148331c..701ddb7d8400 100644
--- a/drivers/net/wireless/ath/ar9170/hw.h
+++ b/drivers/net/wireless/ath/ar9170/hw.h
@@ -152,14 +152,14 @@ enum ar9170_cmd {
 #define         AR9170_MAC_REG_FTF_BIT14                BIT(14)
 #define         AR9170_MAC_REG_FTF_BIT15                BIT(15)
 #define         AR9170_MAC_REG_FTF_BAR                  BIT(24)
-#define         AR9170_MAC_REG_FTF_BIT25                BIT(25)
+#define         AR9170_MAC_REG_FTF_BA                   BIT(25)
 #define         AR9170_MAC_REG_FTF_PSPOLL               BIT(26)
 #define         AR9170_MAC_REG_FTF_RTS                  BIT(27)
 #define         AR9170_MAC_REG_FTF_CTS                  BIT(28)
 #define         AR9170_MAC_REG_FTF_ACK                  BIT(29)
 #define         AR9170_MAC_REG_FTF_CFE                  BIT(30)
 #define         AR9170_MAC_REG_FTF_CFE_ACK              BIT(31)
-#define         AR9170_MAC_REG_FTF_DEFAULTS             0x0500ffff
+#define         AR9170_MAC_REG_FTF_DEFAULTS             0x0700ffff
 #define         AR9170_MAC_REG_FTF_MONITOR              0xfd00ffff
 
 #define AR9170_MAC_REG_RX_TOTAL                 (AR9170_MAC_REG_BASE + 0x6A0)
diff --git a/drivers/net/wireless/ath/ar9170/main.c b/drivers/net/wireless/ath/ar9170/main.c
index de0ba2bf7691..7e59b82e64d3 100644
--- a/drivers/net/wireless/ath/ar9170/main.c
+++ b/drivers/net/wireless/ath/ar9170/main.c
@@ -414,9 +414,9 @@ static void ar9170_tx_ampdu_callback(struct ar9170 *ar, struct sk_buff *skb)
 
         skb_queue_tail(&ar->tx_status_ampdu, skb);
         ar9170_tx_fake_ampdu_status(ar);
-        ar->tx_ampdu_pending--;
 
-        if (!list_empty(&ar->tx_ampdu_list) && !ar->tx_ampdu_pending)
+        if (atomic_dec_and_test(&ar->tx_ampdu_pending) &&
+            !list_empty(&ar->tx_ampdu_list))
                 ar9170_tx_ampdu(ar);
 }
 
@@ -1248,6 +1248,7 @@ static int ar9170_op_start(struct ieee80211_hw *hw)
         ar->global_ampdu_density = 6;
         ar->global_ampdu_factor = 3;
 
+        atomic_set(&ar->tx_ampdu_pending, 0);
         ar->bad_hw_nagger = jiffies;
 
         err = ar->open(ar);
@@ -1773,7 +1774,7 @@ static void ar9170_tx(struct ar9170 *ar)
                                           msecs_to_jiffies(AR9170_TX_TIMEOUT);
 
                         if (arinfo->flags == AR9170_TX_FLAG_BLOCK_ACK)
-                                ar->tx_ampdu_pending++;
+                                atomic_inc(&ar->tx_ampdu_pending);
 
 #ifdef AR9170_QUEUE_DEBUG
                         printk(KERN_DEBUG "%s: send frame q:%d =>\n",
@@ -1784,7 +1785,7 @@ static void ar9170_tx(struct ar9170 *ar)
                         err = ar->tx(ar, skb);
                         if (unlikely(err)) {
                                 if (arinfo->flags == AR9170_TX_FLAG_BLOCK_ACK)
-                                        ar->tx_ampdu_pending--;
+                                        atomic_dec(&ar->tx_ampdu_pending);
 
                                 frames_failed++;
                                 dev_kfree_skb_any(skb);
@@ -1931,7 +1932,7 @@ int ar9170_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         if (info->flags & IEEE80211_TX_CTL_AMPDU) {
                 bool run = ar9170_tx_ampdu_queue(ar, skb);
 
-                if (run || !ar->tx_ampdu_pending)
+                if (run || !atomic_read(&ar->tx_ampdu_pending))
                         ar9170_tx_ampdu(ar);
         } else {
                 unsigned int queue = skb_get_queue_mapping(skb);
diff --git a/drivers/net/wireless/ath/ar9170/usb.c b/drivers/net/wireless/ath/ar9170/usb.c
index e974e5829e1a..6bdcdf6d1cc0 100644
--- a/drivers/net/wireless/ath/ar9170/usb.c
+++ b/drivers/net/wireless/ath/ar9170/usb.c
@@ -108,15 +108,15 @@ static void ar9170_usb_submit_urb(struct ar9170_usb *aru)
                 return ;
 
         spin_lock_irqsave(&aru->tx_urb_lock, flags);
-        if (aru->tx_submitted_urbs >= AR9170_NUM_TX_URBS) {
+        if (atomic_read(&aru->tx_submitted_urbs) >= AR9170_NUM_TX_URBS) {
                 spin_unlock_irqrestore(&aru->tx_urb_lock, flags);
                 return ;
         }
-        aru->tx_submitted_urbs++;
+        atomic_inc(&aru->tx_submitted_urbs);
 
         urb = usb_get_from_anchor(&aru->tx_pending);
         if (!urb) {
-                aru->tx_submitted_urbs--;
+                atomic_dec(&aru->tx_submitted_urbs);
                 spin_unlock_irqrestore(&aru->tx_urb_lock, flags);
 
                 return ;
@@ -133,7 +133,7 @@ static void ar9170_usb_submit_urb(struct ar9170_usb *aru)
                                 err);
 
                 usb_unanchor_urb(urb);
-                aru->tx_submitted_urbs--;
+                atomic_dec(&aru->tx_submitted_urbs);
                 ar9170_tx_callback(&aru->common, urb->context);
         }
 
@@ -151,7 +151,7 @@ static void ar9170_usb_tx_urb_complete_frame(struct urb *urb)
                 return ;
         }
 
-        aru->tx_submitted_urbs--;
+        atomic_dec(&aru->tx_submitted_urbs);
 
         ar9170_tx_callback(&aru->common, skb);
 
@@ -794,7 +794,7 @@ static int ar9170_usb_probe(struct usb_interface *intf,
         spin_lock_init(&aru->tx_urb_lock);
 
         aru->tx_pending_urbs = 0;
-        aru->tx_submitted_urbs = 0;
+        atomic_set(&aru->tx_submitted_urbs, 0);
 
         aru->common.stop = ar9170_usb_stop;
         aru->common.flush = ar9170_usb_flush;
diff --git a/drivers/net/wireless/ath/ar9170/usb.h b/drivers/net/wireless/ath/ar9170/usb.h
index d098f4d5d2f2..a2ce3b169ceb 100644
--- a/drivers/net/wireless/ath/ar9170/usb.h
+++ b/drivers/net/wireless/ath/ar9170/usb.h
@@ -67,7 +67,7 @@ struct ar9170_usb {
         bool req_one_stage_fw;
 
         spinlock_t tx_urb_lock;
-        unsigned int tx_submitted_urbs;
+        atomic_t tx_submitted_urbs;
         unsigned int tx_pending_urbs;
 
         struct completion cmd_wait;
diff --git a/drivers/net/wireless/ath/ath5k/ath5k.h b/drivers/net/wireless/ath/ath5k/ath5k.h
index 647d826bf5fb..6a2a96761111 100644
--- a/drivers/net/wireless/ath/ath5k/ath5k.h
+++ b/drivers/net/wireless/ath/ath5k/ath5k.h
@@ -198,6 +198,7 @@
 #define AR5K_TUNE_CWMAX_11B                     1023
 #define AR5K_TUNE_CWMAX_XR                      7
 #define AR5K_TUNE_NOISE_FLOOR                   -72
+#define AR5K_TUNE_CCA_MAX_GOOD_VALUE            -95
 #define AR5K_TUNE_MAX_TXPOWER                   63
 #define AR5K_TUNE_DEFAULT_TXPOWER               25
 #define AR5K_TUNE_TPC_TXPOWER                   false
@@ -1006,6 +1007,14 @@ struct ath5k_capabilities {
         } cap_queues;
 };
 
+/* size of noise floor history (keep it a power of two) */
+#define ATH5K_NF_CAL_HIST_MAX   8
+struct ath5k_nfcal_hist
+{
+        s16 index;                              /* current index into nfval */
+        s16 nfval[ATH5K_NF_CAL_HIST_MAX];       /* last few noise floors */
+};
+
 
 /***************************************\
   HARDWARE ABSTRACTION LAYER STRUCTURE
@@ -1112,6 +1121,8 @@ struct ath5k_hw {
                 struct ieee80211_channel r_last_channel;
         } ah_radar;
 
+        struct ath5k_nfcal_hist ah_nfcal_hist;
+
         /* noise floor from last periodic calibration */
         s32                     ah_noise_floor;
 
@@ -1274,8 +1285,10 @@ extern int ath5k_hw_rfgain_opt_init(struct ath5k_hw *ah);
 extern bool ath5k_channel_ok(struct ath5k_hw *ah, u16 freq, unsigned int flags);
 extern int ath5k_hw_channel(struct ath5k_hw *ah, struct ieee80211_channel *channel);
 /* PHY calibration */
+void ath5k_hw_init_nfcal_hist(struct ath5k_hw *ah);
 extern int ath5k_hw_phy_calibrate(struct ath5k_hw *ah, struct ieee80211_channel *channel);
 extern int ath5k_hw_noise_floor_calibration(struct ath5k_hw *ah, short freq);
+extern s16 ath5k_hw_get_noise_floor(struct ath5k_hw *ah);
 extern void ath5k_hw_calibration_poll(struct ath5k_hw *ah);
 /* Spur mitigation */
 bool ath5k_hw_chan_has_spur_noise(struct ath5k_hw *ah,
diff --git a/drivers/net/wireless/ath/ath5k/attach.c b/drivers/net/wireless/ath/ath5k/attach.c
index 92995adeb5cd..42284445b75e 100644
--- a/drivers/net/wireless/ath/ath5k/attach.c
+++ b/drivers/net/wireless/ath/ath5k/attach.c
@@ -331,6 +331,8 @@ int ath5k_hw_attach(struct ath5k_softc *sc)
 
         ath5k_hw_rfgain_opt_init(ah);
 
+        ath5k_hw_init_nfcal_hist(ah);
+
         /* turn on HW LEDs */
         ath5k_hw_set_ledstate(ah, AR5K_LED_INIT);
 
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index 1a039f2bd732..895990751d36 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -1124,77 +1124,148 @@ ath5k_hw_calibration_poll(struct ath5k_hw *ah)
                 ah->ah_swi_mask = AR5K_SWI_FULL_CALIBRATION;
                 AR5K_REG_ENABLE_BITS(ah, AR5K_CR, AR5K_CR_SWI);
         }
+}
 
+static int sign_extend(int val, const int nbits)
+{
+        int order = BIT(nbits-1);
+        return (val ^ order) - order;
 }
 
-/**
- * ath5k_hw_noise_floor_calibration - perform PHY noise floor calibration
- *
- * @ah: struct ath5k_hw pointer we are operating on
- * @freq: the channel frequency, just used for error logging
- *
- * This function performs a noise floor calibration of the PHY and waits for
- * it to complete. Then the noise floor value is compared to some maximum
- * noise floor we consider valid.
- *
- * Note that this is different from what the madwifi HAL does: it reads the
- * noise floor and afterwards initiates the calibration. Since the noise floor
- * calibration can take some time to finish, depending on the current channel
- * use, that avoids the occasional timeout warnings we are seeing now.
- *
- * See the following link for an Atheros patent on noise floor calibration:
- * http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PALL \
- * &p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.htm&r=1&f=G&l=50&s1=7245893.PN.&OS=PN/7
+static s32 ath5k_hw_read_measured_noise_floor(struct ath5k_hw *ah)
+{
+        s32 val;
+
+        val = ath5k_hw_reg_read(ah, AR5K_PHY_NF);
+        return sign_extend(AR5K_REG_MS(val, AR5K_PHY_NF_MINCCA_PWR), 9);
+}
+
+void ath5k_hw_init_nfcal_hist(struct ath5k_hw *ah)
+{
+        int i;
+
+        ah->ah_nfcal_hist.index = 0;
+        for (i = 0; i < ATH5K_NF_CAL_HIST_MAX; i++)
+                ah->ah_nfcal_hist.nfval[i] = AR5K_TUNE_CCA_MAX_GOOD_VALUE;
+}
+
+static void ath5k_hw_update_nfcal_hist(struct ath5k_hw *ah, s16 noise_floor)
+{
+        struct ath5k_nfcal_hist *hist = &ah->ah_nfcal_hist;
+        hist->index = (hist->index + 1) & (ATH5K_NF_CAL_HIST_MAX-1);
+        hist->nfval[hist->index] = noise_floor;
+}
+
+static s16 ath5k_hw_get_median_noise_floor(struct ath5k_hw *ah)
+{
+        s16 sort[ATH5K_NF_CAL_HIST_MAX];
+        s16 tmp;
+        int i, j;
+
+        memcpy(sort, ah->ah_nfcal_hist.nfval, sizeof(sort));
+        for (i = 0; i < ATH5K_NF_CAL_HIST_MAX - 1; i++) {
+                for (j = 1; j < ATH5K_NF_CAL_HIST_MAX - i; j++) {
+                        if (sort[j] > sort[j-1]) {
+                                tmp = sort[j];
+                                sort[j] = sort[j-1];
+                                sort[j-1] = tmp;
+                        }
+                }
+        }
+        for (i = 0; i < ATH5K_NF_CAL_HIST_MAX; i++) {
+                ATH5K_DBG(ah->ah_sc, ATH5K_DEBUG_CALIBRATE,
+                        "cal %d:%d\n", i, sort[i]);
+        }
+        return sort[(ATH5K_NF_CAL_HIST_MAX-1) / 2];
+}
+
+/*
+ * When we tell the hardware to perform a noise floor calibration
+ * by setting the AR5K_PHY_AGCCTL_NF bit, it will periodically
+ * sample-and-hold the minimum noise level seen at the antennas.
+ * This value is then stored in a ring buffer of recently measured
+ * noise floor values so we have a moving window of the last few
+ * samples.
  *
- * XXX: Since during noise floor calibration antennas are detached according to
- * the patent, we should stop tx queues here.
+ * The median of the values in the history is then loaded into the
+ * hardware for its own use for RSSI and CCA measurements.
  */
-int
-ath5k_hw_noise_floor_calibration(struct ath5k_hw *ah, short freq)
+void ath5k_hw_update_noise_floor(struct ath5k_hw *ah)
 {
-        int ret;
-        unsigned int i;
-        s32 noise_floor;
+        struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
+        u32 val;
+        s16 nf, threshold;
+        u8 ee_mode;
 
-        /*
-         * Enable noise floor calibration
-         */
-        AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_AGCCTL,
-                                AR5K_PHY_AGCCTL_NF);
+        /* keep last value if calibration hasn't completed */
+        if (ath5k_hw_reg_read(ah, AR5K_PHY_AGCCTL) & AR5K_PHY_AGCCTL_NF) {
+                ATH5K_DBG(ah->ah_sc, ATH5K_DEBUG_CALIBRATE,
+                        "NF did not complete in calibration window\n");
 
-        ret = ath5k_hw_register_timeout(ah, AR5K_PHY_AGCCTL,
-                        AR5K_PHY_AGCCTL_NF, 0, false);
-        if (ret) {
-                ATH5K_ERR(ah->ah_sc,
-                        "noise floor calibration timeout (%uMHz)\n", freq);
-                return -EAGAIN;
+                return;
         }
 
-        /* Wait until the noise floor is calibrated and read the value */
-        for (i = 20; i > 0; i--) {
-                mdelay(1);
-                noise_floor = ath5k_hw_reg_read(ah, AR5K_PHY_NF);
-                noise_floor = AR5K_PHY_NF_RVAL(noise_floor);
-                if (noise_floor & AR5K_PHY_NF_ACTIVE) {
-                        noise_floor = AR5K_PHY_NF_AVAL(noise_floor);
-
-                        if (noise_floor <= AR5K_TUNE_NOISE_FLOOR)
-                                break;
-                }
+        switch (ah->ah_current_channel->hw_value & CHANNEL_MODES) {
+        case CHANNEL_A:
+        case CHANNEL_T:
+        case CHANNEL_XR:
+                ee_mode = AR5K_EEPROM_MODE_11A;
+                break;
+        case CHANNEL_G:
+        case CHANNEL_TG:
+                ee_mode = AR5K_EEPROM_MODE_11G;
+                break;
+        default:
+        case CHANNEL_B:
+                ee_mode = AR5K_EEPROM_MODE_11B;
+                break;
         }
 
-        ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_CALIBRATE,
-                "noise floor %d\n", noise_floor);
 
-        if (noise_floor > AR5K_TUNE_NOISE_FLOOR) {
-                ATH5K_ERR(ah->ah_sc,
-                        "noise floor calibration failed (%uMHz)\n", freq);
-                return -EAGAIN;
+        /* completed NF calibration, test threshold */
+        nf = ath5k_hw_read_measured_noise_floor(ah);
+        threshold = ee->ee_noise_floor_thr[ee_mode];
+
+        if (nf > threshold) {
+                ATH5K_DBG(ah->ah_sc, ATH5K_DEBUG_CALIBRATE,
+                        "noise floor failure detected; "
+                        "read %d, threshold %d\n",
+                        nf, threshold);
+
+                nf = AR5K_TUNE_CCA_MAX_GOOD_VALUE;
         }
 
-        ah->ah_noise_floor = noise_floor;
+        ath5k_hw_update_nfcal_hist(ah, nf);
+        nf = ath5k_hw_get_median_noise_floor(ah);
 
-        return 0;
+        /* load noise floor (in .5 dBm) so the hardware will use it */
+        val = ath5k_hw_reg_read(ah, AR5K_PHY_NF) & ~AR5K_PHY_NF_M;
+        val |= (nf * 2) & AR5K_PHY_NF_M;
+        ath5k_hw_reg_write(ah, val, AR5K_PHY_NF);
+
+        AR5K_REG_MASKED_BITS(ah, AR5K_PHY_AGCCTL, AR5K_PHY_AGCCTL_NF,
+                ~(AR5K_PHY_AGCCTL_NF_EN | AR5K_PHY_AGCCTL_NF_NOUPDATE));
+
+        ath5k_hw_register_timeout(ah, AR5K_PHY_AGCCTL, AR5K_PHY_AGCCTL_NF,
+                0, false);
+
+        /*
+         * Load a high max CCA Power value (-50 dBm in .5 dBm units)
+         * so that we're not capped by the median we just loaded.
+         * This will be used as the initial value for the next noise
+         * floor calibration.
+         */
+        val = (val & ~AR5K_PHY_NF_M) | ((-50 * 2) & AR5K_PHY_NF_M);
+        ath5k_hw_reg_write(ah, val, AR5K_PHY_NF);
+        AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_AGCCTL,
+                AR5K_PHY_AGCCTL_NF_EN |
+                AR5K_PHY_AGCCTL_NF_NOUPDATE |
+                AR5K_PHY_AGCCTL_NF);
+
+        ah->ah_noise_floor = nf;
+
+        ATH5K_DBG(ah->ah_sc, ATH5K_DEBUG_CALIBRATE,
+                "noise floor calibrated: %d\n", nf);
 }
 
 /*
@@ -1287,7 +1358,7 @@ static int ath5k_hw_rf5110_calibrate(struct ath5k_hw *ah,
                 return ret;
         }
 
-        ath5k_hw_noise_floor_calibration(ah, channel->center_freq);
+        ath5k_hw_update_noise_floor(ah);
 
         /*
          * Re-enable RX/TX and beacons
@@ -1360,7 +1431,7 @@ done:
          * since noise floor calibration interrupts rx path while I/Q
          * calibration doesn't. We don't need to run noise floor calibration
          * as often as I/Q calibration.*/
-        ath5k_hw_noise_floor_calibration(ah, channel->center_freq);
+        ath5k_hw_update_noise_floor(ah);
 
         /* Initiate a gain_F calibration */
         ath5k_hw_request_rfgain_probe(ah);
diff --git a/drivers/net/wireless/ath/ath5k/reg.h b/drivers/net/wireless/ath/ath5k/reg.h
index 64227abe3c20..4cb9c5df9f46 100644
--- a/drivers/net/wireless/ath/ath5k/reg.h
+++ b/drivers/net/wireless/ath/ath5k/reg.h
@@ -2033,17 +2033,14 @@
 #define AR5K_PHY_AGCCTL_NF_NOUPDATE     0x00020000      /* Don't update nf automaticaly */
 
 /*
- * PHY noise floor status register
+ * PHY noise floor status register (CCA = Clear Channel Assessment)
  */
 #define AR5K_PHY_NF                     0x9864                  /* Register address */
-#define AR5K_PHY_NF_M                   0x000001ff      /* Noise floor mask */
-#define AR5K_PHY_NF_ACTIVE              0x00000100      /* Noise floor calibration still active */
-#define AR5K_PHY_NF_RVAL(_n)            (((_n) >> 19) & AR5K_PHY_NF_M)
-#define AR5K_PHY_NF_AVAL(_n)            (-((_n) ^ AR5K_PHY_NF_M) + 1)
-#define AR5K_PHY_NF_SVAL(_n)            (((_n) & AR5K_PHY_NF_M) | (1 << 9))
+#define AR5K_PHY_NF_M                   0x000001ff      /* Noise floor, written to hardware in 1/2 dBm units */
+#define AR5K_PHY_NF_SVAL(_n)           (((_n) & AR5K_PHY_NF_M) | (1 << 9))
 #define AR5K_PHY_NF_THRESH62            0x0007f000      /* Thresh62 -check ANI patent- (field) */
 #define AR5K_PHY_NF_THRESH62_S          12
-#define AR5K_PHY_NF_MINCCA_PWR          0x0ff80000      /* ??? */
+#define AR5K_PHY_NF_MINCCA_PWR          0x0ff80000      /* Minimum measured noise level, read from hardware in 1 dBm units */
 #define AR5K_PHY_NF_MINCCA_PWR_S        19
 
 /*
diff --git a/drivers/net/wireless/ath/ath5k/reset.c b/drivers/net/wireless/ath/ath5k/reset.c
index 3dab3d856d7b..62954fc77869 100644
--- a/drivers/net/wireless/ath/ath5k/reset.c
+++ b/drivers/net/wireless/ath/ath5k/reset.c
@@ -1293,7 +1293,7 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
          * out and/or noise floor calibration might timeout.
          */
         AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_AGCCTL,
-                                AR5K_PHY_AGCCTL_CAL);
+                                AR5K_PHY_AGCCTL_CAL | AR5K_PHY_AGCCTL_NF);
 
         /* At the same time start I/Q calibration for QAM constellation
          * -no need for CCK- */
@@ -1314,21 +1314,6 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
                         channel->center_freq);
         }
 
-        /*
-         * If we run NF calibration before AGC, it always times out.
-         * Binary HAL starts NF and AGC calibration at the same time
-         * and only waits for AGC to finish. Also if AGC or NF cal.
-         * times out, reset doesn't fail on binary HAL. I believe
-         * that's wrong because since rx path is routed to a detector,
-         * if cal. doesn't finish we won't have RX. Sam's HAL for AR5210/5211
-         * enables noise floor calibration after offset calibration and if noise
-         * floor calibration fails, reset fails. I believe that's
-         * a better approach, we just need to find a polling interval
-         * that suits best, even if reset continues we need to make
-         * sure that rx path is ready.
-         */
-        ath5k_hw_noise_floor_calibration(ah, channel->center_freq);
-
         /* Restore antenna mode */
         ath5k_hw_set_antenna_mode(ah, ah->ah_ant_mode);
 
diff --git a/drivers/net/wireless/ath/ath9k/ahb.c b/drivers/net/wireless/ath/ath9k/ahb.c
index 33c9e8167185..25531f231b67 100644
--- a/drivers/net/wireless/ath/ath9k/ahb.c
+++ b/drivers/net/wireless/ath/ath9k/ahb.c
@@ -29,15 +29,13 @@ static void ath_ahb_read_cachesize(struct ath_common *common, int *csz)
 
 static void ath_ahb_cleanup(struct ath_common *common)
 {
-        struct ath_hw *ah = (struct ath_hw *) common->ah;
-        struct ath_softc *sc = ah->ah_sc;
+        struct ath_softc *sc = (struct ath_softc *)common->priv;
         iounmap(sc->mem);
 }
 
 static bool ath_ahb_eeprom_read(struct ath_common *common, u32 off, u16 *data)
 {
-        struct ath_hw *ah = (struct ath_hw *) common->ah;
-        struct ath_softc *sc = ah->ah_sc;
+        struct ath_softc *sc = (struct ath_softc *)common->priv;
         struct platform_device *pdev = to_platform_device(sc->dev);
         struct ath9k_platform_data *pdata;
 
diff --git a/drivers/net/wireless/ath/ath9k/calib.c b/drivers/net/wireless/ath/ath9k/calib.c
index f46bd05df443..551f8801459f 100644
--- a/drivers/net/wireless/ath/ath9k/calib.c
+++ b/drivers/net/wireless/ath/ath9k/calib.c
@@ -813,7 +813,7 @@ static void ath9k_olc_temp_compensation(struct ath_hw *ah)
         }
 }
 
-static void ath9k_hw_9271_pa_cal(struct ath_hw *ah)
+static void ath9k_hw_9271_pa_cal(struct ath_hw *ah, bool is_reset)
 {
         u32 regVal;
         unsigned int i;
@@ -889,10 +889,19 @@ static void ath9k_hw_9271_pa_cal(struct ath_hw *ah)
                 REG_WRITE(ah, 0x7834, regVal);
         }
 
-        /*  Empirical offset correction  */
-#if 0
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G6, AR9271_AN_RF2G6_OFFS, 0x20);
-#endif
+        regVal = (regVal >>20) & 0x7f;
+
+        /* Update PA cal info */
+        if ((!is_reset) && (ah->pacal_info.prev_offset == regVal)) {
+                if (ah->pacal_info.max_skipcount < MAX_PACAL_SKIPCOUNT)
+                        ah->pacal_info.max_skipcount =
+                                2 * ah->pacal_info.max_skipcount;
+                ah->pacal_info.skipcount = ah->pacal_info.max_skipcount;
+        } else {
+                ah->pacal_info.max_skipcount = 1;
+                ah->pacal_info.skipcount = 0;
+                ah->pacal_info.prev_offset = regVal;
+        }
 
         regVal = REG_READ(ah, 0x7834);
         regVal |= 0x1;
@@ -1043,7 +1052,7 @@ bool ath9k_hw_calibrate(struct ath_hw *ah, struct ath9k_channel *chan,
         if (longcal) {
                 /* Do periodic PAOffset Cal */
                 if (AR_SREV_9271(ah))
-                        ath9k_hw_9271_pa_cal(ah);
+                        ath9k_hw_9271_pa_cal(ah, false);
                 else if (AR_SREV_9285_11_OR_LATER(ah)) {
                         if (!ah->pacal_info.skipcount)
                                 ath9k_hw_9285_pa_cal(ah, false);
@@ -1070,6 +1079,7 @@ bool ath9k_hw_calibrate(struct ath_hw *ah, struct ath9k_channel *chan,
 }
 EXPORT_SYMBOL(ath9k_hw_calibrate);
 
+/* Carrier leakage Calibration fix */
 static bool ar9285_clc(struct ath_hw *ah, struct ath9k_channel *chan)
 {
         struct ath_common *common = ath9k_hw_common(ah);
@@ -1115,7 +1125,7 @@ bool ath9k_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
 {
         struct ath_common *common = ath9k_hw_common(ah);
 
-        if (AR_SREV_9285_12_OR_LATER(ah)) {
+        if (AR_SREV_9271(ah) || AR_SREV_9285_12_OR_LATER(ah)) {
                 if (!ar9285_clc(ah, chan))
                         return false;
         } else {
@@ -1151,7 +1161,9 @@ bool ath9k_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
         }
 
         /* Do PA Calibration */
-        if (AR_SREV_9285_11_OR_LATER(ah))
+        if (AR_SREV_9271(ah))
+                ath9k_hw_9271_pa_cal(ah, true);
+        else if (AR_SREV_9285_11_OR_LATER(ah))
                 ath9k_hw_9285_pa_cal(ah, true);
 
         /* Do NF Calibration after DC offset and other calibrations */
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index a8620b1d091b..2a4efcbced60 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -2079,7 +2079,9 @@ static void ath_tx_complete_poll_work(struct work_struct *work)
         if (needreset) {
                 ath_print(ath9k_hw_common(sc->sc_ah), ATH_DBG_RESET,
                           "tx hung, resetting the chip\n");
+                ath9k_ps_wakeup(sc);
                 ath_reset(sc, false);
+                ath9k_ps_restore(sc);
         }
 
         ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work,
diff --git a/drivers/net/wireless/ath/regd.h b/drivers/net/wireless/ath/regd.h
index c1dd857697a7..a1c39526161a 100644
--- a/drivers/net/wireless/ath/regd.h
+++ b/drivers/net/wireless/ath/regd.h
@@ -65,10 +65,13 @@ enum CountryCode {
         CTRY_ALGERIA = 12,
         CTRY_ARGENTINA = 32,
         CTRY_ARMENIA = 51,
+        CTRY_ARUBA = 533,
         CTRY_AUSTRALIA = 36,
         CTRY_AUSTRIA = 40,
         CTRY_AZERBAIJAN = 31,
         CTRY_BAHRAIN = 48,
+        CTRY_BANGLADESH = 50,
+        CTRY_BARBADOS = 52,
         CTRY_BELARUS = 112,
         CTRY_BELGIUM = 56,
         CTRY_BELIZE = 84,
@@ -77,6 +80,7 @@ enum CountryCode {
         CTRY_BRAZIL = 76,
         CTRY_BRUNEI_DARUSSALAM = 96,
         CTRY_BULGARIA = 100,
+        CTRY_CAMBODIA = 116,
         CTRY_CANADA = 124,
         CTRY_CHILE = 152,
         CTRY_CHINA = 156,
@@ -97,7 +101,11 @@ enum CountryCode {
         CTRY_GEORGIA = 268,
         CTRY_GERMANY = 276,
         CTRY_GREECE = 300,
+        CTRY_GREENLAND = 304,
+        CTRY_GRENEDA = 308,
+        CTRY_GUAM = 316,
         CTRY_GUATEMALA = 320,
+        CTRY_HAITI = 332,
         CTRY_HONDURAS = 340,
         CTRY_HONG_KONG = 344,
         CTRY_HUNGARY = 348,
diff --git a/drivers/net/wireless/ath/regd_common.h b/drivers/net/wireless/ath/regd_common.h
index 9847af72208c..248c670fdfbe 100644
--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -288,13 +288,16 @@ static struct country_code_to_enum_rd allCountries[] = {
         {CTRY_DEFAULT, FCC1_FCCA, "CO"},
         {CTRY_ALBANIA, NULL1_WORLD, "AL"},
         {CTRY_ALGERIA, NULL1_WORLD, "DZ"},
-        {CTRY_ARGENTINA, APL3_WORLD, "AR"},
+        {CTRY_ARGENTINA, FCC3_WORLD, "AR"},
         {CTRY_ARMENIA, ETSI4_WORLD, "AM"},
+        {CTRY_ARUBA, ETSI1_WORLD, "AW"},
         {CTRY_AUSTRALIA, FCC2_WORLD, "AU"},
         {CTRY_AUSTRALIA2, FCC6_WORLD, "AU"},
         {CTRY_AUSTRIA, ETSI1_WORLD, "AT"},
         {CTRY_AZERBAIJAN, ETSI4_WORLD, "AZ"},
         {CTRY_BAHRAIN, APL6_WORLD, "BH"},
+        {CTRY_BANGLADESH, NULL1_WORLD, "BD"},
+        {CTRY_BARBADOS, FCC2_WORLD, "BB"},
         {CTRY_BELARUS, ETSI1_WORLD, "BY"},
         {CTRY_BELGIUM, ETSI1_WORLD, "BE"},
         {CTRY_BELGIUM2, ETSI4_WORLD, "BL"},
@@ -304,13 +307,14 @@ static struct country_code_to_enum_rd allCountries[] = {
         {CTRY_BRAZIL, FCC3_WORLD, "BR"},
         {CTRY_BRUNEI_DARUSSALAM, APL1_WORLD, "BN"},
         {CTRY_BULGARIA, ETSI6_WORLD, "BG"},
-        {CTRY_CANADA, FCC2_FCCA, "CA"},
+        {CTRY_CAMBODIA, ETSI1_WORLD, "KH"},
+        {CTRY_CANADA, FCC3_FCCA, "CA"},
         {CTRY_CANADA2, FCC6_FCCA, "CA"},
         {CTRY_CHILE, APL6_WORLD, "CL"},
         {CTRY_CHINA, APL1_WORLD, "CN"},
         {CTRY_COLOMBIA, FCC1_FCCA, "CO"},
         {CTRY_COSTA_RICA, FCC1_WORLD, "CR"},
-        {CTRY_CROATIA, ETSI3_WORLD, "HR"},
+        {CTRY_CROATIA, ETSI1_WORLD, "HR"},
         {CTRY_CYPRUS, ETSI1_WORLD, "CY"},
         {CTRY_CZECH, ETSI3_WORLD, "CZ"},
         {CTRY_DENMARK, ETSI1_WORLD, "DK"},
@@ -324,18 +328,22 @@ static struct country_code_to_enum_rd allCountries[] = {
         {CTRY_GEORGIA, ETSI4_WORLD, "GE"},
         {CTRY_GERMANY, ETSI1_WORLD, "DE"},
         {CTRY_GREECE, ETSI1_WORLD, "GR"},
+        {CTRY_GREENLAND, ETSI1_WORLD, "GL"},
+        {CTRY_GRENEDA, FCC3_FCCA, "GD"},
+        {CTRY_GUAM, FCC1_FCCA, "GU"},
         {CTRY_GUATEMALA, FCC1_FCCA, "GT"},
+        {CTRY_HAITI, ETSI1_WORLD, "HT"},
         {CTRY_HONDURAS, NULL1_WORLD, "HN"},
-        {CTRY_HONG_KONG, FCC2_WORLD, "HK"},
+        {CTRY_HONG_KONG, FCC3_WORLD, "HK"},
         {CTRY_HUNGARY, ETSI1_WORLD, "HU"},
         {CTRY_ICELAND, ETSI1_WORLD, "IS"},
         {CTRY_INDIA, APL6_WORLD, "IN"},
-        {CTRY_INDONESIA, APL1_WORLD, "ID"},
+        {CTRY_INDONESIA, NULL1_WORLD, "ID"},
         {CTRY_IRAN, APL1_WORLD, "IR"},
         {CTRY_IRELAND, ETSI1_WORLD, "IE"},
         {CTRY_ISRAEL, NULL1_WORLD, "IL"},
         {CTRY_ITALY, ETSI1_WORLD, "IT"},
-        {CTRY_JAMAICA, ETSI1_WORLD, "JM"},
+        {CTRY_JAMAICA, FCC3_WORLD, "JM"},
 
         {CTRY_JAPAN, MKK1_MKKA, "JP"},
         {CTRY_JAPAN1, MKK1_MKKB, "JP"},
@@ -402,7 +410,7 @@ static struct country_code_to_enum_rd allCountries[] = {
         {CTRY_KOREA_ROC, APL9_WORLD, "KR"},
         {CTRY_KOREA_ROC2, APL2_WORLD, "K2"},
         {CTRY_KOREA_ROC3, APL9_WORLD, "K3"},
-        {CTRY_KUWAIT, NULL1_WORLD, "KW"},
+        {CTRY_KUWAIT, ETSI3_WORLD, "KW"},
         {CTRY_LATVIA, ETSI1_WORLD, "LV"},
         {CTRY_LEBANON, NULL1_WORLD, "LB"},
         {CTRY_LIECHTENSTEIN, ETSI1_WORLD, "LI"},
@@ -414,13 +422,13 @@ static struct country_code_to_enum_rd allCountries[] = {
         {CTRY_MALTA, ETSI1_WORLD, "MT"},
         {CTRY_MEXICO, FCC1_FCCA, "MX"},
         {CTRY_MONACO, ETSI4_WORLD, "MC"},
-        {CTRY_MOROCCO, NULL1_WORLD, "MA"},
+        {CTRY_MOROCCO, APL4_WORLD, "MA"},
         {CTRY_NEPAL, APL1_WORLD, "NP"},
         {CTRY_NETHERLANDS, ETSI1_WORLD, "NL"},
         {CTRY_NETHERLANDS_ANTILLES, ETSI1_WORLD, "AN"},
         {CTRY_NEW_ZEALAND, FCC2_ETSIC, "NZ"},
         {CTRY_NORWAY, ETSI1_WORLD, "NO"},
-        {CTRY_OMAN, APL6_WORLD, "OM"},
+        {CTRY_OMAN, FCC3_WORLD, "OM"},
         {CTRY_PAKISTAN, NULL1_WORLD, "PK"},
         {CTRY_PANAMA, FCC1_FCCA, "PA"},
         {CTRY_PAPUA_NEW_GUINEA, FCC1_WORLD, "PG"},
@@ -429,7 +437,7 @@ static struct country_code_to_enum_rd allCountries[] = {
         {CTRY_POLAND, ETSI1_WORLD, "PL"},
         {CTRY_PORTUGAL, ETSI1_WORLD, "PT"},
         {CTRY_PUERTO_RICO, FCC1_FCCA, "PR"},
-        {CTRY_QATAR, NULL1_WORLD, "QA"},
+        {CTRY_QATAR, APL1_WORLD, "QA"},
         {CTRY_ROMANIA, NULL1_WORLD, "RO"},
         {CTRY_RUSSIA, NULL1_WORLD, "RU"},
         {CTRY_SAUDI_ARABIA, NULL1_WORLD, "SA"},
@@ -445,7 +453,7 @@ static struct country_code_to_enum_rd allCountries[] = {
         {CTRY_SYRIA, NULL1_WORLD, "SY"},
         {CTRY_TAIWAN, APL3_FCCA, "TW"},
         {CTRY_THAILAND, FCC3_WORLD, "TH"},
-        {CTRY_TRINIDAD_Y_TOBAGO, ETSI4_WORLD, "TT"},
+        {CTRY_TRINIDAD_Y_TOBAGO, FCC3_WORLD, "TT"},
         {CTRY_TUNISIA, ETSI3_WORLD, "TN"},
         {CTRY_TURKEY, ETSI3_WORLD, "TR"},
         {CTRY_UKRAINE, NULL1_WORLD, "UA"},
@@ -456,7 +464,7 @@ static struct country_code_to_enum_rd allCountries[] = {
          * would need to assign new special alpha2 to CRDA db as with the world
          * regdomain and use another alpha2 */
         {CTRY_UNITED_STATES_FCC49, FCC4_FCCA, "PS"},
-        {CTRY_URUGUAY, APL2_WORLD, "UY"},
+        {CTRY_URUGUAY, FCC3_WORLD, "UY"},
         {CTRY_UZBEKISTAN, FCC3_FCCA, "UZ"},
         {CTRY_VENEZUELA, APL2_ETSIC, "VE"},
         {CTRY_VIET_NAM, NULL1_WORLD, "VN"},
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index 660716214d49..65b23f725a04 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -749,12 +749,6 @@ struct b43_wldev {
 #endif
 };
 
-/*
- * Include goes here to avoid a dependency problem.
- * A better fix would be to integrate xmit.h into b43.h.
- */
-#include "xmit.h"
-
 /* Data structure for the WLAN parts (802.11 cores) of the b43 chip. */
 struct b43_wl {
         /* Pointer to the active wireless device on this chip */
@@ -830,13 +824,9 @@ struct b43_wl {
         struct b43_leds leds;
 
 #ifdef CONFIG_B43_PIO
-        /*
-         * RX/TX header/tail buffers used by the frame transmit functions.
-         */
-        struct b43_rxhdr_fw4 rxhdr;
-        struct b43_txhdr txhdr;
-        u8 rx_tail[4];
-        u8 tx_tail[4];
+        /* Kmalloc'ed scratch space for PIO TX/RX. Protected by wl->mutex. */
+        u8 pio_scratchspace[110] __attribute__((__aligned__(8)));
+        u8 pio_tailspace[4] __attribute__((__aligned__(8)));
 #endif /* CONFIG_B43_PIO */
 };
 
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index df6b26a0c05e..751017b4c3d3 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -4671,7 +4671,7 @@ static int b43_wireless_core_attach(struct b43_wldev *dev)
 {
         struct b43_wl *wl = dev->wl;
         struct ssb_bus *bus = dev->dev->bus;
-        struct pci_dev *pdev = bus->host_pci;
+        struct pci_dev *pdev = (bus->bustype == SSB_BUSTYPE_PCI) ? bus->host_pci : NULL;
         int err;
         bool have_2ghz_phy = 0, have_5ghz_phy = 0;
         u32 tmp;
@@ -4804,7 +4804,7 @@ static int b43_one_core_attach(struct ssb_device *dev, struct b43_wl *wl)
 
         if (!list_empty(&wl->devlist)) {
                 /* We are not the first core on this chip. */
-                pdev = dev->bus->host_pci;
+                pdev = (dev->bus->bustype == SSB_BUSTYPE_PCI) ? dev->bus->host_pci : NULL;
                 /* Only special chips support more than one wireless
                  * core, although some of the other chips have more than
                  * one wireless core as well. Check for this and
diff --git a/drivers/net/wireless/b43/pio.c b/drivers/net/wireless/b43/pio.c
index dbbf0d11e18e..3105f235303a 100644
--- a/drivers/net/wireless/b43/pio.c
+++ b/drivers/net/wireless/b43/pio.c
@@ -341,12 +341,15 @@ static u16 tx_write_2byte_queue(struct b43_pio_txqueue *q,
                         q->mmio_base + B43_PIO_TXDATA,
                         sizeof(u16));
         if (data_len & 1) {
+                u8 *tail = wl->pio_tailspace;
+                BUILD_BUG_ON(sizeof(wl->pio_tailspace) < 2);
+
                 /* Write the last byte. */
                 ctl &= ~B43_PIO_TXCTL_WRITEHI;
                 b43_piotx_write16(q, B43_PIO_TXCTL, ctl);
-                wl->tx_tail[0] = data[data_len - 1];
-                wl->tx_tail[1] = 0;
-                ssb_block_write(dev->dev, wl->tx_tail, 2,
+                tail[0] = data[data_len - 1];
+                tail[1] = 0;
+                ssb_block_write(dev->dev, tail, 2,
                                 q->mmio_base + B43_PIO_TXDATA,
                                 sizeof(u16));
         }
@@ -392,31 +395,31 @@ static u32 tx_write_4byte_queue(struct b43_pio_txqueue *q,
                         q->mmio_base + B43_PIO8_TXDATA,
                         sizeof(u32));
         if (data_len & 3) {
-                wl->tx_tail[3] = 0;
+                u8 *tail = wl->pio_tailspace;
+                BUILD_BUG_ON(sizeof(wl->pio_tailspace) < 4);
+
+                memset(tail, 0, 4);
                 /* Write the last few bytes. */
                 ctl &= ~(B43_PIO8_TXCTL_8_15 | B43_PIO8_TXCTL_16_23 |
                          B43_PIO8_TXCTL_24_31);
                 switch (data_len & 3) {
                 case 3:
                         ctl |= B43_PIO8_TXCTL_16_23 | B43_PIO8_TXCTL_8_15;
-                        wl->tx_tail[0] = data[data_len - 3];
-                        wl->tx_tail[1] = data[data_len - 2];
-                        wl->tx_tail[2] = data[data_len - 1];
+                        tail[0] = data[data_len - 3];
+                        tail[1] = data[data_len - 2];
+                        tail[2] = data[data_len - 1];
                         break;
                 case 2:
                         ctl |= B43_PIO8_TXCTL_8_15;
-                        wl->tx_tail[0] = data[data_len - 2];
-                        wl->tx_tail[1] = data[data_len - 1];
-                        wl->tx_tail[2] = 0;
+                        tail[0] = data[data_len - 2];
+                        tail[1] = data[data_len - 1];
                         break;
                 case 1:
-                        wl->tx_tail[0] = data[data_len - 1];
-                        wl->tx_tail[1] = 0;
-                        wl->tx_tail[2] = 0;
+                        tail[0] = data[data_len - 1];
                         break;
                 }
                 b43_piotx_write32(q, B43_PIO8_TXCTL, ctl);
-                ssb_block_write(dev->dev, wl->tx_tail, 4,
+                ssb_block_write(dev->dev, tail, 4,
                                 q->mmio_base + B43_PIO8_TXDATA,
                                 sizeof(u32));
         }
@@ -455,6 +458,7 @@ static int pio_tx_frame(struct b43_pio_txqueue *q,
         int err;
         unsigned int hdrlen;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct b43_txhdr *txhdr = (struct b43_txhdr *)wl->pio_scratchspace;
 
         B43_WARN_ON(list_empty(&q->packets_list));
         pack = list_entry(q->packets_list.next,
@@ -462,7 +466,9 @@ static int pio_tx_frame(struct b43_pio_txqueue *q,
 
         cookie = generate_cookie(q, pack);
         hdrlen = b43_txhdr_size(dev);
-        err = b43_generate_txhdr(dev, (u8 *)&wl->txhdr, skb,
+        BUILD_BUG_ON(sizeof(wl->pio_scratchspace) < sizeof(struct b43_txhdr));
+        B43_WARN_ON(sizeof(wl->pio_scratchspace) < hdrlen);
+        err = b43_generate_txhdr(dev, (u8 *)txhdr, skb,
                                  info, cookie);
         if (err)
                 return err;
@@ -476,9 +482,9 @@ static int pio_tx_frame(struct b43_pio_txqueue *q,
 
         pack->skb = skb;
         if (q->rev >= 8)
-                pio_tx_frame_4byte_queue(pack, (const u8 *)&wl->txhdr, hdrlen);
+                pio_tx_frame_4byte_queue(pack, (const u8 *)txhdr, hdrlen);
         else
-                pio_tx_frame_2byte_queue(pack, (const u8 *)&wl->txhdr, hdrlen);
+                pio_tx_frame_2byte_queue(pack, (const u8 *)txhdr, hdrlen);
 
         /* Remove it from the list of available packet slots.
          * It will be put back when we receive the status report. */
@@ -624,8 +630,11 @@ static bool pio_rx_frame(struct b43_pio_rxqueue *q)
         unsigned int i, padding;
         struct sk_buff *skb;
         const char *err_msg = NULL;
+        struct b43_rxhdr_fw4 *rxhdr =
+                (struct b43_rxhdr_fw4 *)wl->pio_scratchspace;
 
-        memset(&wl->rxhdr, 0, sizeof(wl->rxhdr));
+        BUILD_BUG_ON(sizeof(wl->pio_scratchspace) < sizeof(*rxhdr));
+        memset(rxhdr, 0, sizeof(*rxhdr));
 
         /* Check if we have data and wait for it to get ready. */
         if (q->rev >= 8) {
@@ -663,16 +672,16 @@ data_ready:
 
         /* Get the preamble (RX header) */
         if (q->rev >= 8) {
-                ssb_block_read(dev->dev, &wl->rxhdr, sizeof(wl->rxhdr),
+                ssb_block_read(dev->dev, rxhdr, sizeof(*rxhdr),
                                q->mmio_base + B43_PIO8_RXDATA,
                                sizeof(u32));
         } else {
-                ssb_block_read(dev->dev, &wl->rxhdr, sizeof(wl->rxhdr),
+                ssb_block_read(dev->dev, rxhdr, sizeof(*rxhdr),
                                q->mmio_base + B43_PIO_RXDATA,
                                sizeof(u16));
         }
         /* Sanity checks. */
-        len = le16_to_cpu(wl->rxhdr.frame_len);
+        len = le16_to_cpu(rxhdr->frame_len);
         if (unlikely(len > 0x700)) {
                 err_msg = "len > 0x700";
                 goto rx_error;
@@ -682,7 +691,7 @@ data_ready:
                 goto rx_error;
         }
 
-        macstat = le32_to_cpu(wl->rxhdr.mac_status);
+        macstat = le32_to_cpu(rxhdr->mac_status);
         if (macstat & B43_RX_MAC_FCSERR) {
                 if (!(q->dev->wl->filter_flags & FIF_FCSFAIL)) {
                         /* Drop frames with failed FCS. */
@@ -707,22 +716,25 @@ data_ready:
                                q->mmio_base + B43_PIO8_RXDATA,
                                sizeof(u32));
                 if (len & 3) {
+                        u8 *tail = wl->pio_tailspace;
+                        BUILD_BUG_ON(sizeof(wl->pio_tailspace) < 4);
+
                         /* Read the last few bytes. */
-                        ssb_block_read(dev->dev, wl->rx_tail, 4,
+                        ssb_block_read(dev->dev, tail, 4,
                                        q->mmio_base + B43_PIO8_RXDATA,
                                        sizeof(u32));
                         switch (len & 3) {
                         case 3:
-                                skb->data[len + padding - 3] = wl->rx_tail[0];
-                                skb->data[len + padding - 2] = wl->rx_tail[1];
-                                skb->data[len + padding - 1] = wl->rx_tail[2];
+                                skb->data[len + padding - 3] = tail[0];
+                                skb->data[len + padding - 2] = tail[1];
+                                skb->data[len + padding - 1] = tail[2];
                                 break;
                         case 2:
-                                skb->data[len + padding - 2] = wl->rx_tail[0];
-                                skb->data[len + padding - 1] = wl->rx_tail[1];
+                                skb->data[len + padding - 2] = tail[0];
+                                skb->data[len + padding - 1] = tail[1];
                                 break;
                         case 1:
-                                skb->data[len + padding - 1] = wl->rx_tail[0];
+                                skb->data[len + padding - 1] = tail[0];
                                 break;
                         }
                 }
@@ -731,15 +743,18 @@ data_ready:
                                q->mmio_base + B43_PIO_RXDATA,
                                sizeof(u16));
                 if (len & 1) {
+                        u8 *tail = wl->pio_tailspace;
+                        BUILD_BUG_ON(sizeof(wl->pio_tailspace) < 2);
+
                         /* Read the last byte. */
-                        ssb_block_read(dev->dev, wl->rx_tail, 2,
+                        ssb_block_read(dev->dev, tail, 2,
                                        q->mmio_base + B43_PIO_RXDATA,
                                        sizeof(u16));
-                        skb->data[len + padding - 1] = wl->rx_tail[0];
+                        skb->data[len + padding - 1] = tail[0];
                 }
         }
 
-        b43_rx(q->dev, skb, &wl->rxhdr);
+        b43_rx(q->dev, skb, rxhdr);
 
         return 1;
 
diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index f4e9695ec186..7a5e294be2bc 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -27,7 +27,7 @@
 
 */
 
-#include "b43.h"
+#include "xmit.h"
 #include "phy_common.h"
 #include "dma.h"
 #include "pio.h"
@@ -690,10 +690,7 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
         }
 
         memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
-
-        local_bh_disable();
-        ieee80211_rx(dev->wl->hw, skb);
-        local_bh_enable();
+        ieee80211_rx_ni(dev->wl->hw, skb);
 
 #if B43_DEBUG
         dev->rx_count++;
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index 1d9223b3d4c4..0983406f4630 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -3592,7 +3592,7 @@ static int b43legacy_wireless_core_attach(struct b43legacy_wldev *dev)
 {
         struct b43legacy_wl *wl = dev->wl;
         struct ssb_bus *bus = dev->dev->bus;
-        struct pci_dev *pdev = bus->host_pci;
+        struct pci_dev *pdev = (bus->bustype == SSB_BUSTYPE_PCI) ? bus->host_pci : NULL;
         int err;
         int have_bphy = 0;
         int have_gphy = 0;
@@ -3706,7 +3706,7 @@ static int b43legacy_one_core_attach(struct ssb_device *dev,
 
         if (!list_empty(&wl->devlist)) {
                 /* We are not the first core on this chip. */
-                pdev = dev->bus->host_pci;
+                pdev = (dev->bus->bustype == SSB_BUSTYPE_PCI) ? dev->bus->host_pci : NULL;
                 /* Only special chips support more than one wireless
                  * core, although some of the other chips have more than
                  * one wireless core as well. Check for this and
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index 679a67ff76eb..3a645e485dda 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -110,8 +110,7 @@ static struct iwl_lib_ops iwl1000_lib = {
         .send_tx_power = iwl5000_send_tx_power,
         .update_chain_flags = iwl_update_chain_flags,
         .apm_ops = {
-                .init = iwl5000_apm_init,
-                .reset = iwl5000_apm_reset,
+                .init = iwl_apm_init,
                 .stop = iwl_apm_stop,
                 .config = iwl1000_nic_config,
                 .set_pwr_src = iwl_set_pwr_src,
@@ -159,15 +158,20 @@ struct iwl_cfg iwl1000_bgn_cfg = {
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_1000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_A,
         .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = true,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = false,
+        .use_bsm = false,
         .max_ll_items = OTP_MAX_LL_ITEMS_1000,
         .shadow_ram_support = false,
         .ht_greenfield_support = true,
         .led_compensation = 51,
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .support_ct_kill_exit = true,
 };
 
 struct iwl_cfg iwl1000_bg_cfg = {
@@ -180,15 +184,20 @@ struct iwl_cfg iwl1000_bg_cfg = {
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_1000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_A,
         .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = true,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = false,
+        .use_bsm = false,
         .max_ll_items = OTP_MAX_LL_ITEMS_1000,
         .shadow_ram_support = false,
         .ht_greenfield_support = true,
         .led_compensation = 51,
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .support_ct_kill_exit = true,
 };
 
 MODULE_FIRMWARE(IWL1000_MODULE_FIRMWARE(IWL1000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
index 16772780c5b0..6fd10d443ba3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
@@ -71,12 +71,6 @@
 
 #include "iwl-eeprom.h"
 
-/*
- * uCode queue management definitions ...
- * Queue #4 is the command queue for 3945 and 4965.
- */
-#define IWL_CMD_QUEUE_NUM       4
-
 /* Time constants */
 #define SHORT_SLOT_TIME 9
 #define LONG_SLOT_TIME 20
@@ -254,12 +248,6 @@ struct iwl3945_eeprom {
 #define TFD_CTL_PAD_SET(n)         (n << 28)
 #define TFD_CTL_PAD_GET(ctl)       (ctl >> 28)
 
-/*
- * RX related structures and functions
- */
-#define RX_FREE_BUFFERS 64
-#define RX_LOW_WATERMARK 8
-
 /* Sizes and addresses for instruction and data memory (SRAM) in
  * 3945's embedded processor.  Driver access is via HBUS_TARG_MEM_* regs. */
 #define IWL39_RTC_INST_LOWER_BOUND              (0x000000)
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index 4115672e2338..09a7bd2c0be4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -293,7 +293,7 @@ static void iwl3945_tx_queue_reclaim(struct iwl_priv *priv,
 static void iwl3945_rx_reply_tx(struct iwl_priv *priv,
                             struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         u16 sequence = le16_to_cpu(pkt->hdr.sequence);
         int txq_id = SEQ_TO_QUEUE(sequence);
         int index = SEQ_TO_INDEX(sequence);
@@ -353,16 +353,12 @@ static void iwl3945_rx_reply_tx(struct iwl_priv *priv,
 void iwl3945_hw_rx_statistics(struct iwl_priv *priv,
                 struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         IWL_DEBUG_RX(priv, "Statistics notification received (%d vs %d).\n",
                      (int)sizeof(struct iwl3945_notif_statistics),
                      le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
 
         memcpy(&priv->statistics_39, pkt->u.raw, sizeof(priv->statistics_39));
-
-        iwl_leds_background(priv);
-
-        priv->last_statistics_time = jiffies;
 }
 
 /******************************************************************************
@@ -545,14 +541,18 @@ static void iwl3945_pass_packet_to_mac80211(struct iwl_priv *priv,
                                    struct iwl_rx_mem_buffer *rxb,
                                    struct ieee80211_rx_status *stats)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)IWL_RX_DATA(pkt);
         struct iwl3945_rx_frame_hdr *rx_hdr = IWL_RX_HDR(pkt);
         struct iwl3945_rx_frame_end *rx_end = IWL_RX_END(pkt);
-        short len = le16_to_cpu(rx_hdr->len);
+        u16 len = le16_to_cpu(rx_hdr->len);
+        struct sk_buff *skb;
+        int ret;
+        __le16 fc = hdr->frame_control;
 
         /* We received data from the HW, so stop the watchdog */
-        if (unlikely((len + IWL39_RX_FRAME_SIZE) > skb_tailroom(rxb->skb))) {
+        if (unlikely(len + IWL39_RX_FRAME_SIZE >
+                     PAGE_SIZE << priv->hw_params.rx_page_order)) {
                 IWL_DEBUG_DROP(priv, "Corruption detected!\n");
                 return;
         }
@@ -564,20 +564,49 @@ static void iwl3945_pass_packet_to_mac80211(struct iwl_priv *priv,
                 return;
         }
 
-        skb_reserve(rxb->skb, (void *)rx_hdr->payload - (void *)pkt);
-        /* Set the size of the skb to the size of the frame */
-        skb_put(rxb->skb, le16_to_cpu(rx_hdr->len));
+        skb = alloc_skb(IWL_LINK_HDR_MAX, GFP_ATOMIC);
+        if (!skb) {
+                IWL_ERR(priv, "alloc_skb failed\n");
+                return;
+        }
 
         if (!iwl3945_mod_params.sw_crypto)
                 iwl_set_decrypted_flag(priv,
-                                       (struct ieee80211_hdr *)rxb->skb->data,
+                                       (struct ieee80211_hdr *)rxb_addr(rxb),
                                        le32_to_cpu(rx_end->status), stats);
 
-        iwl_update_stats(priv, false, hdr->frame_control, len);
+        skb_add_rx_frag(skb, 0, rxb->page,
+                        (void *)rx_hdr->payload - (void *)pkt, len);
+
+        /* mac80211 currently doesn't support paged SKB. Convert it to
+         * linear SKB for management frame and data frame requires
+         * software decryption or software defragementation. */
+        if (ieee80211_is_mgmt(fc) ||
+            ieee80211_has_protected(fc) ||
+            ieee80211_has_morefrags(fc) ||
+            le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG)
+                ret = skb_linearize(skb);
+        else
+                ret = __pskb_pull_tail(skb, min_t(u16, IWL_LINK_HDR_MAX, len)) ?
+                        0 : -ENOMEM;
+
+        if (ret) {
+                kfree_skb(skb);
+                goto out;
+        }
+
+        /*
+         * XXX: We cannot touch the page and its virtual memory (pkt) after
+         * here. It might have already been freed by the above skb change.
+         */
+
+        iwl_update_stats(priv, false, fc, len);
+        memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
 
-        memcpy(IEEE80211_SKB_RXCB(rxb->skb), stats, sizeof(*stats));
-        ieee80211_rx_irqsafe(priv->hw, rxb->skb);
-        rxb->skb = NULL;
+        ieee80211_rx(priv->hw, skb);
+ out:
+        priv->alloc_rxb_page--;
+        rxb->page = NULL;
 }
 
 #define IWL_DELAY_NEXT_SCAN_AFTER_ASSOC (HZ*6)
@@ -587,7 +616,7 @@ static void iwl3945_rx_reply_rx(struct iwl_priv *priv,
 {
         struct ieee80211_hdr *header;
         struct ieee80211_rx_status rx_status;
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl3945_rx_frame_stats *rx_stats = IWL_RX_STATS(pkt);
         struct iwl3945_rx_frame_hdr *rx_hdr = IWL_RX_HDR(pkt);
         struct iwl3945_rx_frame_end *rx_end = IWL_RX_END(pkt);
@@ -787,29 +816,31 @@ void iwl3945_hw_build_tx_cmd_rate(struct iwl_priv *priv,
         u8 data_retry_limit;
         __le32 tx_flags;
         __le16 fc = hdr->frame_control;
-        struct iwl3945_tx_cmd *tx = (struct iwl3945_tx_cmd *)cmd->cmd.payload;
+        struct iwl3945_tx_cmd *tx_cmd = (struct iwl3945_tx_cmd *)cmd->cmd.payload;
 
         rate = iwl3945_rates[rate_index].plcp;
-        tx_flags = tx->tx_flags;
+        tx_flags = tx_cmd->tx_flags;
 
         /* We need to figure out how to get the sta->supp_rates while
          * in this running context */
         rate_mask = IWL_RATES_MASK;
 
+
+        /* Set retry limit on DATA packets and Probe Responses*/
+        if (ieee80211_is_probe_resp(fc))
+                data_retry_limit = 3;
+        else
+                data_retry_limit = IWL_DEFAULT_TX_RETRY;
+        tx_cmd->data_retry_limit = data_retry_limit;
+
         if (tx_id >= IWL_CMD_QUEUE_NUM)
                 rts_retry_limit = 3;
         else
                 rts_retry_limit = 7;
 
-        if (ieee80211_is_probe_resp(fc)) {
-                data_retry_limit = 3;
-                if (data_retry_limit < rts_retry_limit)
-                        rts_retry_limit = data_retry_limit;
-        } else
-                data_retry_limit = IWL_DEFAULT_TX_RETRY;
-
-        if (priv->data_retry_limit != -1)
-                data_retry_limit = priv->data_retry_limit;
+        if (data_retry_limit < rts_retry_limit)
+                rts_retry_limit = data_retry_limit;
+        tx_cmd->rts_retry_limit = rts_retry_limit;
 
         if (ieee80211_is_mgmt(fc)) {
                 switch (fc & cpu_to_le16(IEEE80211_FCTL_STYPE)) {
@@ -827,22 +858,20 @@ void iwl3945_hw_build_tx_cmd_rate(struct iwl_priv *priv,
                 }
         }
 
-        tx->rts_retry_limit = rts_retry_limit;
-        tx->data_retry_limit = data_retry_limit;
-        tx->rate = rate;
-        tx->tx_flags = tx_flags;
+        tx_cmd->rate = rate;
+        tx_cmd->tx_flags = tx_flags;
 
         /* OFDM */
-        tx->supp_rates[0] =
+        tx_cmd->supp_rates[0] =
            ((rate_mask & IWL_OFDM_RATES_MASK) >> IWL_FIRST_OFDM_RATE) & 0xFF;
 
         /* CCK */
-        tx->supp_rates[1] = (rate_mask & 0xF);
+        tx_cmd->supp_rates[1] = (rate_mask & 0xF);
 
         IWL_DEBUG_RATE(priv, "Tx sta id: %d, rate: %d (plcp), flags: 0x%4X "
                        "cck/ofdm mask: 0x%x/0x%x\n", sta_id,
-                       tx->rate, le32_to_cpu(tx->tx_flags),
-                       tx->supp_rates[1], tx->supp_rates[0]);
+                       tx_cmd->rate, le32_to_cpu(tx_cmd->tx_flags),
+                       tx_cmd->supp_rates[1], tx_cmd->supp_rates[0]);
 }
 
 u8 iwl3945_sync_sta(struct iwl_priv *priv, int sta_id, u16 tx_rate, u8 flags)
@@ -958,6 +987,11 @@ static int iwl3945_txq_ctx_reset(struct iwl_priv *priv)
 
         iwl3945_hw_txq_ctx_free(priv);
 
+        /* allocate tx queue structure */
+        rc = iwl_alloc_txq_mem(priv);
+        if (rc)
+                return rc;
+
         /* Tx CMD queue */
         rc = iwl3945_tx_reset(priv);
         if (rc)
@@ -982,42 +1016,25 @@ static int iwl3945_txq_ctx_reset(struct iwl_priv *priv)
         return rc;
 }
 
+
+/*
+ * Start up 3945's basic functionality after it has been reset
+ * (e.g. after platform boot, or shutdown via iwl_apm_stop())
+ * NOTE:  This does not load uCode nor start the embedded processor
+ */
 static int iwl3945_apm_init(struct iwl_priv *priv)
 {
-        int ret;
-
-        iwl_power_initialize(priv);
+        int ret = iwl_apm_init(priv);
 
-        iwl_set_bit(priv, CSR_GIO_CHICKEN_BITS,
-                          CSR_GIO_CHICKEN_BITS_REG_BIT_DIS_L0S_EXIT_TIMER);
-
-        /* disable L0s without affecting L1 :don't wait for ICH L0s bug W/A) */
-        iwl_set_bit(priv, CSR_GIO_CHICKEN_BITS,
-                          CSR_GIO_CHICKEN_BITS_REG_BIT_L1A_NO_L0S_RX);
-
-        /* set "initialization complete" bit to move adapter
-        * D0U* --> D0A* state */
-        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
-
-        ret = iwl_poll_bit(priv, CSR_GP_CNTRL,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
-        if (ret < 0) {
-                IWL_DEBUG_INFO(priv, "Failed to init the card\n");
-                goto out;
-        }
-
-        /* enable DMA */
-        iwl_write_prph(priv, APMG_CLK_CTRL_REG, APMG_CLK_VAL_DMA_CLK_RQT |
-                                                APMG_CLK_VAL_BSM_CLK_RQT);
-
-        udelay(20);
+        /* Clear APMG (NIC's internal power management) interrupts */
+        iwl_write_prph(priv, APMG_RTC_INT_MSK_REG, 0x0);
+        iwl_write_prph(priv, APMG_RTC_INT_STT_REG, 0xFFFFFFFF);
 
-        /* disable L1-Active */
-        iwl_set_bits_prph(priv, APMG_PCIDEV_STT_REG,
-                          APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
+        /* Reset radio chip */
+        iwl_set_bits_prph(priv, APMG_PS_CTRL_REG, APMG_PS_CTRL_VAL_RESET_REQ);
+        udelay(5);
+        iwl_clear_bits_prph(priv, APMG_PS_CTRL_REG, APMG_PS_CTRL_VAL_RESET_REQ);
 
-out:
         return ret;
 }
 
@@ -1142,12 +1159,16 @@ void iwl3945_hw_txq_ctx_free(struct iwl_priv *priv)
         int txq_id;
 
         /* Tx queues */
-        for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++)
-                if (txq_id == IWL_CMD_QUEUE_NUM)
-                        iwl_cmd_queue_free(priv);
-                else
-                        iwl_tx_queue_free(priv, txq_id);
+        if (priv->txq)
+                for (txq_id = 0; txq_id < priv->hw_params.max_txq_num;
+                     txq_id++)
+                        if (txq_id == IWL_CMD_QUEUE_NUM)
+                                iwl_cmd_queue_free(priv);
+                        else
+                                iwl_tx_queue_free(priv, txq_id);
 
+        /* free tx queue structure */
+        iwl_free_txq_mem(priv);
 }
 
 void iwl3945_hw_txq_ctx_stop(struct iwl_priv *priv)
@@ -1156,6 +1177,7 @@ void iwl3945_hw_txq_ctx_stop(struct iwl_priv *priv)
 
         /* stop SCD */
         iwl_write_prph(priv, ALM_SCD_MODE_REG, 0);
+        iwl_write_prph(priv, ALM_SCD_TXFACT_REG, 0);
 
         /* reset TFD queues */
         for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++) {
@@ -1168,47 +1190,6 @@ void iwl3945_hw_txq_ctx_stop(struct iwl_priv *priv)
         iwl3945_hw_txq_ctx_free(priv);
 }
 
-static int iwl3945_apm_reset(struct iwl_priv *priv)
-{
-        iwl_apm_stop_master(priv);
-
-
-        iwl_set_bit(priv, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
-        udelay(10);
-
-        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
-
-        iwl_poll_bit(priv, CSR_GP_CNTRL,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
-
-        iwl_write_prph(priv, APMG_CLK_CTRL_REG,
-                                APMG_CLK_VAL_BSM_CLK_RQT);
-
-        iwl_write_prph(priv, APMG_RTC_INT_MSK_REG, 0x0);
-        iwl_write_prph(priv, APMG_RTC_INT_STT_REG,
-                                        0xFFFFFFFF);
-
-        /* enable DMA */
-        iwl_write_prph(priv, APMG_CLK_EN_REG,
-                                APMG_CLK_VAL_DMA_CLK_RQT |
-                                APMG_CLK_VAL_BSM_CLK_RQT);
-        udelay(10);
-
-        iwl_set_bits_prph(priv, APMG_PS_CTRL_REG,
-                                APMG_PS_CTRL_VAL_RESET_REQ);
-        udelay(5);
-        iwl_clear_bits_prph(priv, APMG_PS_CTRL_REG,
-                                APMG_PS_CTRL_VAL_RESET_REQ);
-
-        /* Clear the 'host command active' bit... */
-        clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
-
-        wake_up_interruptible(&priv->wait_command_queue);
-
-        return 0;
-}
-
 /**
  * iwl3945_hw_reg_adjust_power_by_temp
  * return index delta into power gain settings table
@@ -1817,7 +1798,7 @@ int iwl3945_hw_reg_set_txpower(struct iwl_priv *priv, s8 power)
 static int iwl3945_send_rxon_assoc(struct iwl_priv *priv)
 {
         int rc = 0;
-        struct iwl_rx_packet *res = NULL;
+        struct iwl_rx_packet *pkt;
         struct iwl3945_rxon_assoc_cmd rxon_assoc;
         struct iwl_host_cmd cmd = {
                 .id = REPLY_RXON_ASSOC,
@@ -1846,14 +1827,14 @@ static int iwl3945_send_rxon_assoc(struct iwl_priv *priv)
         if (rc)
                 return rc;
 
-        res = (struct iwl_rx_packet *)cmd.reply_skb->data;
-        if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
+        pkt = (struct iwl_rx_packet *)cmd.reply_page;
+        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
                 IWL_ERR(priv, "Bad return from REPLY_RXON_ASSOC command\n");
                 rc = -EIO;
         }
 
-        priv->alloc_rxb_skb--;
-        dev_kfree_skb_any(cmd.reply_skb);
+        priv->alloc_rxb_page--;
+        free_pages(cmd.reply_page, priv->hw_params.rx_page_order);
 
         return rc;
 }
@@ -2001,12 +1982,6 @@ static int iwl3945_commit_rxon(struct iwl_priv *priv)
         return 0;
 }
 
-/* will add 3945 channel switch cmd handling later */
-int iwl3945_hw_channel_switch(struct iwl_priv *priv, u16 channel)
-{
-        return 0;
-}
-
 /**
  * iwl3945_reg_txpower_periodic -  called when time to check our temperature.
  *
@@ -2516,11 +2491,10 @@ int iwl3945_hw_set_hw_params(struct iwl_priv *priv)
         }
 
         /* Assign number of Usable TX queues */
-        priv->hw_params.max_txq_num = IWL39_NUM_QUEUES;
+        priv->hw_params.max_txq_num = priv->cfg->num_of_queues;
 
         priv->hw_params.tfd_size = sizeof(struct iwl3945_tfd);
-        priv->hw_params.rx_buf_size = IWL_RX_BUF_SIZE_3K;
-        priv->hw_params.max_pkt_size = 2342;
+        priv->hw_params.rx_page_order = get_order(IWL_RX_BUF_SIZE_3K);
         priv->hw_params.max_rxq_size = RX_QUEUE_SIZE;
         priv->hw_params.max_rxq_log = RX_QUEUE_SIZE_LOG;
         priv->hw_params.max_stations = IWL3945_STATION_COUNT;
@@ -2803,7 +2777,6 @@ static struct iwl_lib_ops iwl3945_lib = {
         .dump_nic_error_log = iwl3945_dump_nic_error_log,
         .apm_ops = {
                 .init = iwl3945_apm_init,
-                .reset = iwl3945_apm_reset,
                 .stop = iwl_apm_stop,
                 .config = iwl3945_nic_config,
                 .set_pwr_src = iwl3945_set_pwr_src,
@@ -2833,6 +2806,7 @@ static struct iwl_lib_ops iwl3945_lib = {
 static struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
         .get_hcmd_size = iwl3945_get_hcmd_size,
         .build_addsta_hcmd = iwl3945_build_addsta_hcmd,
+        .rts_tx_cmd_flag = iwlcore_rts_tx_cmd_flag,
 };
 
 static struct iwl_ops iwl3945_ops = {
@@ -2852,7 +2826,11 @@ static struct iwl_cfg iwl3945_bg_cfg = {
         .eeprom_size = IWL3945_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_3945_EEPROM_VERSION,
         .ops = &iwl3945_ops,
+        .num_of_queues = IWL39_NUM_QUEUES,
         .mod_params = &iwl3945_mod_params,
+        .pll_cfg_val = CSR39_ANA_PLL_CFG_VAL,
+        .set_l0s = false,
+        .use_bsm = true,
         .use_isr_legacy = true,
         .ht_greenfield_support = false,
         .led_compensation = 64,
@@ -2867,6 +2845,7 @@ static struct iwl_cfg iwl3945_abg_cfg = {
         .eeprom_size = IWL3945_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_3945_EEPROM_VERSION,
         .ops = &iwl3945_ops,
+        .num_of_queues = IWL39_NUM_QUEUES,
         .mod_params = &iwl3945_mod_params,
         .use_isr_legacy = true,
         .ht_greenfield_support = false,
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.h b/drivers/net/wireless/iwlwifi/iwl-3945.h
index f3907c1079f5..ebb999a51b58 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.h
@@ -130,12 +130,6 @@ struct iwl3945_frame {
 #define SN_TO_SEQ(ssn) (((ssn) << 4) & IEEE80211_SCTL_SEQ)
 #define MAX_SN ((IEEE80211_SCTL_SEQ) >> 4)
 
-/*
- * RX related structures and functions
- */
-#define RX_FREE_BUFFERS 64
-#define RX_LOW_WATERMARK 8
-
 #define SUP_RATE_11A_MAX_NUM_CHANNELS  8
 #define SUP_RATE_11B_MAX_NUM_CHANNELS  4
 #define SUP_RATE_11G_MAX_NUM_CHANNELS  12
@@ -280,8 +274,6 @@ extern void iwl3945_config_ap(struct iwl_priv *priv);
  */
 extern u8 iwl3945_hw_find_station(struct iwl_priv *priv, const u8 *bssid);
 
-extern int iwl3945_hw_channel_switch(struct iwl_priv *priv, u16 channel);
-
 /*
  * Forward declare iwl-3945.c functions for iwl-base.c
  */
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965-hw.h b/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
index b34322a32458..c606366b582c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
@@ -76,12 +76,9 @@
 
 /*
  * uCode queue management definitions ...
- * Queue #4 is the command queue for 3945 and 4965; map it to Tx FIFO chnl 4.
  * The first queue used for block-ack aggregation is #7 (4965 only).
  * All block-ack aggregation queues should map to Tx DMA/FIFO channel 7.
  */
-#define IWL_CMD_QUEUE_NUM       4
-#define IWL_CMD_FIFO_NUM        4
 #define IWL49_FIRST_AMPDU_QUEUE 7
 
 /* Time constants */
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index f8eed9a4abc1..1ff465ad40d8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -62,8 +62,6 @@ static int iwl4965_hw_get_temperature(struct iwl_priv *priv);
 
 /* module parameters */
 static struct iwl_mod_params iwl4965_mod_params = {
-        .num_of_queues = IWL49_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL49_NUM_AMPDU_QUEUES,
         .amsdu_size_8K = 1,
         .restart_fw = 1,
         /* the rest are 0 by default */
@@ -319,64 +317,13 @@ static void iwl4965_txq_set_sched(struct iwl_priv *priv, u32 mask)
         iwl_write_prph(priv, IWL49_SCD_TXFACT, mask);
 }
 
-static int iwl4965_apm_init(struct iwl_priv *priv)
-{
-        int ret = 0;
-
-        iwl_set_bit(priv, CSR_GIO_CHICKEN_BITS,
-                          CSR_GIO_CHICKEN_BITS_REG_BIT_DIS_L0S_EXIT_TIMER);
-
-        /* disable L0s without affecting L1 :don't wait for ICH L0s bug W/A) */
-        iwl_set_bit(priv, CSR_GIO_CHICKEN_BITS,
-                          CSR_GIO_CHICKEN_BITS_REG_BIT_L1A_NO_L0S_RX);
-
-        /* set "initialization complete" bit to move adapter
-         * D0U* --> D0A* state */
-        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
-
-        /* wait for clock stabilization */
-        ret = iwl_poll_bit(priv, CSR_GP_CNTRL,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
-        if (ret < 0) {
-                IWL_DEBUG_INFO(priv, "Failed to init the card\n");
-                goto out;
-        }
-
-        /* enable DMA */
-        iwl_write_prph(priv, APMG_CLK_CTRL_REG, APMG_CLK_VAL_DMA_CLK_RQT |
-                                                APMG_CLK_VAL_BSM_CLK_RQT);
-
-        udelay(20);
-
-        /* disable L1-Active */
-        iwl_set_bits_prph(priv, APMG_PCIDEV_STT_REG,
-                          APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
-
-out:
-        return ret;
-}
-
-
 static void iwl4965_nic_config(struct iwl_priv *priv)
 {
         unsigned long flags;
         u16 radio_cfg;
-        u16 lctl;
 
         spin_lock_irqsave(&priv->lock, flags);
 
-        lctl = iwl_pcie_link_ctl(priv);
-
-        /* HW bug W/A - negligible power consumption */
-        /* L1-ASPM is enabled by BIOS */
-        if ((lctl & PCI_CFG_LINK_CTRL_VAL_L1_EN) == PCI_CFG_LINK_CTRL_VAL_L1_EN)
-                /* L1-ASPM enabled: disable L0S  */
-                iwl_set_bit(priv, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED);
-        else
-                /* L1-ASPM disabled: enable L0S */
-                iwl_clear_bit(priv, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED);
-
         radio_cfg = iwl_eeprom_query16(priv, EEPROM_RADIO_CONFIG);
 
         /* write radio config values to register */
@@ -397,46 +344,6 @@ static void iwl4965_nic_config(struct iwl_priv *priv)
         spin_unlock_irqrestore(&priv->lock, flags);
 }
 
-static int iwl4965_apm_reset(struct iwl_priv *priv)
-{
-        int ret = 0;
-
-        iwl_apm_stop_master(priv);
-
-
-        iwl_set_bit(priv, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
-
-        udelay(10);
-
-        /* FIXME: put here L1A -L0S w/a */
-
-        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
-
-        ret = iwl_poll_bit(priv, CSR_GP_CNTRL,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
-        if (ret < 0)
-                goto out;
-
-        udelay(10);
-
-        /* Enable DMA and BSM Clock */
-        iwl_write_prph(priv, APMG_CLK_EN_REG, APMG_CLK_VAL_DMA_CLK_RQT |
-                                              APMG_CLK_VAL_BSM_CLK_RQT);
-
-        udelay(10);
-
-        /* disable L1A */
-        iwl_set_bits_prph(priv, APMG_PCIDEV_STT_REG,
-                          APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
-
-        clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
-        wake_up_interruptible(&priv->wait_command_queue);
-
-out:
-        return ret;
-}
-
 /* Reset differential Rx gains in NIC to prepare for chain noise calibration.
  * Called after every association, but this runs only once!
  *  ... once chain noise is calibrated the first time, it's good forever.  */
@@ -526,18 +433,6 @@ static void iwl4965_gain_computation(struct iwl_priv *priv,
         data->beacon_count = 0;
 }
 
-static void iwl4965_rts_tx_cmd_flag(struct ieee80211_tx_info *info,
-                        __le32 *tx_flags)
-{
-        if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) {
-                *tx_flags |= TX_CMD_FLG_RTS_MSK;
-                *tx_flags &= ~TX_CMD_FLG_CTS_MSK;
-        } else if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
-                *tx_flags &= ~TX_CMD_FLG_RTS_MSK;
-                *tx_flags |= TX_CMD_FLG_CTS_MSK;
-        }
-}
-
 static void iwl4965_bg_txpower_work(struct work_struct *work)
 {
         struct iwl_priv *priv = container_of(work, struct iwl_priv,
@@ -718,6 +613,10 @@ static struct iwl_sensitivity_ranges iwl4965_sensitivity = {
 
         .nrg_th_cck = 100,
         .nrg_th_ofdm = 100,
+
+        .barker_corr_th_min = 190,
+        .barker_corr_th_min_mrc = 390,
+        .nrg_th_cca = 62,
 };
 
 static void iwl4965_set_ct_threshold(struct iwl_priv *priv)
@@ -734,19 +633,16 @@ static void iwl4965_set_ct_threshold(struct iwl_priv *priv)
  */
 static int iwl4965_hw_set_hw_params(struct iwl_priv *priv)
 {
+        if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
+            priv->cfg->mod_params->num_of_queues <= IWL49_NUM_QUEUES)
+                priv->cfg->num_of_queues =
+                        priv->cfg->mod_params->num_of_queues;
 
-        if ((priv->cfg->mod_params->num_of_queues > IWL49_NUM_QUEUES) ||
-            (priv->cfg->mod_params->num_of_queues < IWL_MIN_NUM_QUEUES)) {
-                IWL_ERR(priv,
-                        "invalid queues_num, should be between %d and %d\n",
-                        IWL_MIN_NUM_QUEUES, IWL49_NUM_QUEUES);
-                return -EINVAL;
-        }
-
-        priv->hw_params.max_txq_num = priv->cfg->mod_params->num_of_queues;
+        priv->hw_params.max_txq_num = priv->cfg->num_of_queues;
         priv->hw_params.dma_chnl_num = FH49_TCSR_CHNL_NUM;
         priv->hw_params.scd_bc_tbls_size =
-                        IWL49_NUM_QUEUES * sizeof(struct iwl4965_scd_bc_tbl);
+                        priv->cfg->num_of_queues *
+                        sizeof(struct iwl4965_scd_bc_tbl);
         priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
         priv->hw_params.max_stations = IWL4965_STATION_COUNT;
         priv->hw_params.bcast_sta_id = IWL4965_BROADCAST_ID;
@@ -757,10 +653,10 @@ static int iwl4965_hw_set_hw_params(struct iwl_priv *priv)
 
         priv->hw_params.rx_wrt_ptr_reg = FH_RSCSR_CHNL0_WPTR;
 
-        priv->hw_params.tx_chains_num = 2;
-        priv->hw_params.rx_chains_num = 2;
-        priv->hw_params.valid_tx_ant = ANT_A | ANT_B;
-        priv->hw_params.valid_rx_ant = ANT_A | ANT_B;
+        priv->hw_params.tx_chains_num = num_of_ant(priv->cfg->valid_tx_ant);
+        priv->hw_params.rx_chains_num = num_of_ant(priv->cfg->valid_rx_ant);
+        priv->hw_params.valid_tx_ant = priv->cfg->valid_tx_ant;
+        priv->hw_params.valid_rx_ant = priv->cfg->valid_rx_ant;
         if (priv->cfg->ops->lib->temp_ops.set_ct_kill)
                 priv->cfg->ops->lib->temp_ops.set_ct_kill(priv);
 
@@ -1537,14 +1433,13 @@ static int iwl4965_send_rxon_assoc(struct iwl_priv *priv)
         return ret;
 }
 
-#ifdef IEEE80211_CONF_CHANNEL_SWITCH
 static int iwl4965_hw_channel_switch(struct iwl_priv *priv, u16 channel)
 {
         int rc;
         u8 band = 0;
         bool is_ht40 = false;
         u8 ctrl_chan_high = 0;
-        struct iwl4965_channel_switch_cmd cmd = { 0 };
+        struct iwl4965_channel_switch_cmd cmd;
         const struct iwl_channel_info *ch_info;
 
         band = priv->band == IEEE80211_BAND_2GHZ;
@@ -1565,8 +1460,11 @@ static int iwl4965_hw_channel_switch(struct iwl_priv *priv, u16 channel)
         cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
         if (ch_info)
                 cmd.expect_beacon = is_channel_radar(ch_info);
-        else
-                cmd.expect_beacon = 1;
+        else {
+                IWL_ERR(priv, "invalid channel switch from %u to %u\n",
+                        priv->active_rxon.channel, channel);
+                return -EFAULT;
+        }
 
         rc = iwl4965_fill_txpower_tbl(priv, band, channel, is_ht40,
                                       ctrl_chan_high, &cmd.tx_power);
@@ -1578,7 +1476,6 @@ static int iwl4965_hw_channel_switch(struct iwl_priv *priv, u16 channel)
         rc = iwl_send_cmd_pdu(priv, REPLY_CHANNEL_SWITCH, sizeof(cmd), &cmd);
         return rc;
 }
-#endif
 
 /**
  * iwl4965_txq_update_byte_cnt_tbl - Set up entry in Tx byte-count array
@@ -1775,11 +1672,13 @@ static int iwl4965_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
                                    u16 ssn_idx, u8 tx_fifo)
 {
         if ((IWL49_FIRST_AMPDU_QUEUE > txq_id) ||
-            (IWL49_FIRST_AMPDU_QUEUE + IWL49_NUM_AMPDU_QUEUES <= txq_id)) {
+            (IWL49_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
+             <= txq_id)) {
                 IWL_WARN(priv,
                         "queue number out of range: %d, must be %d to %d\n",
                         txq_id, IWL49_FIRST_AMPDU_QUEUE,
-                        IWL49_FIRST_AMPDU_QUEUE + IWL49_NUM_AMPDU_QUEUES - 1);
+                        IWL49_FIRST_AMPDU_QUEUE +
+                        priv->cfg->num_of_ampdu_queues - 1);
                 return -EINVAL;
         }
 
@@ -1840,11 +1739,13 @@ static int iwl4965_txq_agg_enable(struct iwl_priv *priv, int txq_id,
         u16 ra_tid;
 
         if ((IWL49_FIRST_AMPDU_QUEUE > txq_id) ||
-            (IWL49_FIRST_AMPDU_QUEUE + IWL49_NUM_AMPDU_QUEUES <= txq_id)) {
+            (IWL49_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
+             <= txq_id)) {
                 IWL_WARN(priv,
                         "queue number out of range: %d, must be %d to %d\n",
                         txq_id, IWL49_FIRST_AMPDU_QUEUE,
-                        IWL49_FIRST_AMPDU_QUEUE + IWL49_NUM_AMPDU_QUEUES - 1);
+                        IWL49_FIRST_AMPDU_QUEUE +
+                        priv->cfg->num_of_ampdu_queues - 1);
                 return -EINVAL;
         }
 
@@ -2048,7 +1949,7 @@ static int iwl4965_tx_status_reply_tx(struct iwl_priv *priv,
 static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
                                 struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         u16 sequence = le16_to_cpu(pkt->hdr.sequence);
         int txq_id = SEQ_TO_QUEUE(sequence);
         int index = SEQ_TO_INDEX(sequence);
@@ -2249,7 +2150,7 @@ static struct iwl_hcmd_utils_ops iwl4965_hcmd_utils = {
         .build_addsta_hcmd = iwl4965_build_addsta_hcmd,
         .chain_noise_reset = iwl4965_chain_noise_reset,
         .gain_computation = iwl4965_gain_computation,
-        .rts_tx_cmd_flag = iwl4965_rts_tx_cmd_flag,
+        .rts_tx_cmd_flag = iwlcore_rts_tx_cmd_flag,
         .calc_rssi = iwl4965_calc_rssi,
 };
 
@@ -2271,9 +2172,9 @@ static struct iwl_lib_ops iwl4965_lib = {
         .load_ucode = iwl4965_load_bsm,
         .dump_nic_event_log = iwl_dump_nic_event_log,
         .dump_nic_error_log = iwl_dump_nic_error_log,
+        .set_channel_switch = iwl4965_hw_channel_switch,
         .apm_ops = {
-                .init = iwl4965_apm_init,
-                .reset = iwl4965_apm_reset,
+                .init = iwl_apm_init,
                 .stop = iwl_apm_stop,
                 .config = iwl4965_nic_config,
                 .set_pwr_src = iwl_set_pwr_src,
@@ -2323,7 +2224,14 @@ struct iwl_cfg iwl4965_agn_cfg = {
         .eeprom_ver = EEPROM_4965_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_4965_TX_POWER_VERSION,
         .ops = &iwl4965_ops,
+        .num_of_queues = IWL49_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL49_NUM_AMPDU_QUEUES,
         .mod_params = &iwl4965_mod_params,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
+        .pll_cfg_val = 0,
+        .set_l0s = true,
+        .use_bsm = true,
         .use_isr_legacy = true,
         .ht_greenfield_support = false,
         .broken_powersave = true,
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 8cc3d50e7f59..d256fecc6cda 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -72,115 +72,14 @@ static const u16 iwl5000_default_queue_to_tx_fifo[] = {
         IWL_TX_FIFO_HCCA_2
 };
 
-int iwl5000_apm_init(struct iwl_priv *priv)
-{
-        int ret = 0;
-
-        iwl_set_bit(priv, CSR_GIO_CHICKEN_BITS,
-                    CSR_GIO_CHICKEN_BITS_REG_BIT_DIS_L0S_EXIT_TIMER);
-
-        /* disable L0s without affecting L1 :don't wait for ICH L0s bug W/A) */
-        iwl_set_bit(priv, CSR_GIO_CHICKEN_BITS,
-                    CSR_GIO_CHICKEN_BITS_REG_BIT_L1A_NO_L0S_RX);
-
-        /* Set FH wait threshold to maximum (HW error during stress W/A) */
-        iwl_set_bit(priv, CSR_DBG_HPET_MEM_REG, CSR_DBG_HPET_MEM_REG_VAL);
-
-        /* enable HAP INTA to move device L1a -> L0s */
-        iwl_set_bit(priv, CSR_HW_IF_CONFIG_REG,
-                    CSR_HW_IF_CONFIG_REG_BIT_HAP_WAKE_L1A);
-
-        if (priv->cfg->need_pll_cfg)
-                iwl_set_bit(priv, CSR_ANA_PLL_CFG, CSR50_ANA_PLL_CFG_VAL);
-
-        /* set "initialization complete" bit to move adapter
-         * D0U* --> D0A* state */
-        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
-
-        /* wait for clock stabilization */
-        ret = iwl_poll_bit(priv, CSR_GP_CNTRL,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
-        if (ret < 0) {
-                IWL_DEBUG_INFO(priv, "Failed to init the card\n");
-                return ret;
-        }
-
-        /* enable DMA */
-        iwl_write_prph(priv, APMG_CLK_EN_REG, APMG_CLK_VAL_DMA_CLK_RQT);
-
-        udelay(20);
-
-        /* disable L1-Active */
-        iwl_set_bits_prph(priv, APMG_PCIDEV_STT_REG,
-                          APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
-
-        return ret;
-}
-
-int iwl5000_apm_reset(struct iwl_priv *priv)
-{
-        int ret = 0;
-
-        iwl_apm_stop_master(priv);
-
-        iwl_set_bit(priv, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
-
-        udelay(10);
-
-
-        /* FIXME: put here L1A -L0S w/a */
-
-        if (priv->cfg->need_pll_cfg)
-                iwl_set_bit(priv, CSR_ANA_PLL_CFG, CSR50_ANA_PLL_CFG_VAL);
-
-        /* set "initialization complete" bit to move adapter
-         * D0U* --> D0A* state */
-        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
-
-        /* wait for clock stabilization */
-        ret = iwl_poll_bit(priv, CSR_GP_CNTRL,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
-        if (ret < 0) {
-                IWL_DEBUG_INFO(priv, "Failed to init the card\n");
-                goto out;
-        }
-
-        /* enable DMA */
-        iwl_write_prph(priv, APMG_CLK_EN_REG, APMG_CLK_VAL_DMA_CLK_RQT);
-
-        udelay(20);
-
-        /* disable L1-Active */
-        iwl_set_bits_prph(priv, APMG_PCIDEV_STT_REG,
-                          APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
-out:
-
-        return ret;
-}
-
-
 /* NIC configuration for 5000 series */
 void iwl5000_nic_config(struct iwl_priv *priv)
 {
         unsigned long flags;
         u16 radio_cfg;
-        u16 lctl;
 
         spin_lock_irqsave(&priv->lock, flags);
 
-        lctl = iwl_pcie_link_ctl(priv);
-
-        /* HW bug W/A */
-        /* L1-ASPM is enabled by BIOS */
-        if ((lctl & PCI_CFG_LINK_CTRL_VAL_L1_EN) == PCI_CFG_LINK_CTRL_VAL_L1_EN)
-                /* L1-APSM enabled: disable L0S  */
-                iwl_set_bit(priv, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED);
-        else
-                /* L1-ASPM disabled: enable L0S */
-                iwl_clear_bit(priv, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED);
-
         radio_cfg = iwl_eeprom_query16(priv, EEPROM_RADIO_CONFIG);
 
         /* write radio config values to register */
@@ -279,7 +178,7 @@ static void iwl5000_gain_computation(struct iwl_priv *priv,
                         data->delta_gain_code[i] = 0;
                         continue;
                 }
-                delta_g = (1000 * ((s32)average_noise[0] -
+                delta_g = (1000 * ((s32)average_noise[default_chain] -
                         (s32)average_noise[i])) / 1500;
                 /* bound gain by 2 bits value max, 3rd bit is sign */
                 data->delta_gain_code[i] =
@@ -372,6 +271,10 @@ static struct iwl_sensitivity_ranges iwl5000_sensitivity = {
         .auto_corr_max_cck_mrc = 400,
         .nrg_th_cck = 95,
         .nrg_th_ofdm = 95,
+
+        .barker_corr_th_min = 190,
+        .barker_corr_th_min_mrc = 390,
+        .nrg_th_cca = 62,
 };
 
 static struct iwl_sensitivity_ranges iwl5150_sensitivity = {
@@ -394,6 +297,10 @@ static struct iwl_sensitivity_ranges iwl5150_sensitivity = {
         .auto_corr_max_cck_mrc = 400,
         .nrg_th_cck = 95,
         .nrg_th_ofdm = 95,
+
+        .barker_corr_th_min = 190,
+        .barker_corr_th_min_mrc = 390,
+        .nrg_th_cca = 62,
 };
 
 const u8 *iwl5000_eeprom_query_addr(const struct iwl_priv *priv,
@@ -458,7 +365,7 @@ static int iwl5000_send_calib_cfg(struct iwl_priv *priv)
 static void iwl5000_rx_calib_result(struct iwl_priv *priv,
                              struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_calib_hdr *hdr = (struct iwl_calib_hdr *)pkt->u.raw;
         int len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
         int index;
@@ -784,18 +691,16 @@ int iwl5000_alive_notify(struct iwl_priv *priv)
 
 int iwl5000_hw_set_hw_params(struct iwl_priv *priv)
 {
-        if ((priv->cfg->mod_params->num_of_queues > IWL50_NUM_QUEUES) ||
-            (priv->cfg->mod_params->num_of_queues < IWL_MIN_NUM_QUEUES)) {
-                IWL_ERR(priv,
-                        "invalid queues_num, should be between %d and %d\n",
-                        IWL_MIN_NUM_QUEUES, IWL50_NUM_QUEUES);
-                return -EINVAL;
-        }
+        if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
+            priv->cfg->mod_params->num_of_queues <= IWL50_NUM_QUEUES)
+                priv->cfg->num_of_queues =
+                        priv->cfg->mod_params->num_of_queues;
 
-        priv->hw_params.max_txq_num = priv->cfg->mod_params->num_of_queues;
+        priv->hw_params.max_txq_num = priv->cfg->num_of_queues;
         priv->hw_params.dma_chnl_num = FH50_TCSR_CHNL_NUM;
         priv->hw_params.scd_bc_tbls_size =
-                        IWL50_NUM_QUEUES * sizeof(struct iwl5000_scd_bc_tbl);
+                        priv->cfg->num_of_queues *
+                        sizeof(struct iwl5000_scd_bc_tbl);
         priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
         priv->hw_params.max_stations = IWL5000_STATION_COUNT;
         priv->hw_params.bcast_sta_id = IWL5000_BROADCAST_ID;
@@ -947,11 +852,13 @@ int iwl5000_txq_agg_enable(struct iwl_priv *priv, int txq_id,
         u16 ra_tid;
 
         if ((IWL50_FIRST_AMPDU_QUEUE > txq_id) ||
-            (IWL50_FIRST_AMPDU_QUEUE + IWL50_NUM_AMPDU_QUEUES <= txq_id)) {
+            (IWL50_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
+             <= txq_id)) {
                 IWL_WARN(priv,
                         "queue number out of range: %d, must be %d to %d\n",
                         txq_id, IWL50_FIRST_AMPDU_QUEUE,
-                        IWL50_FIRST_AMPDU_QUEUE + IWL50_NUM_AMPDU_QUEUES - 1);
+                        IWL50_FIRST_AMPDU_QUEUE +
+                        priv->cfg->num_of_ampdu_queues - 1);
                 return -EINVAL;
         }
 
@@ -1005,11 +912,13 @@ int iwl5000_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
                                    u16 ssn_idx, u8 tx_fifo)
 {
         if ((IWL50_FIRST_AMPDU_QUEUE > txq_id) ||
-            (IWL50_FIRST_AMPDU_QUEUE + IWL50_NUM_AMPDU_QUEUES <= txq_id)) {
+            (IWL50_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
+             <= txq_id)) {
                 IWL_ERR(priv,
                         "queue number out of range: %d, must be %d to %d\n",
                         txq_id, IWL50_FIRST_AMPDU_QUEUE,
-                        IWL50_FIRST_AMPDU_QUEUE + IWL50_NUM_AMPDU_QUEUES - 1);
+                        IWL50_FIRST_AMPDU_QUEUE +
+                        priv->cfg->num_of_ampdu_queues - 1);
                 return -EINVAL;
         }
 
@@ -1176,7 +1085,7 @@ static int iwl5000_tx_status_reply_tx(struct iwl_priv *priv,
 static void iwl5000_rx_reply_tx(struct iwl_priv *priv,
                                 struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         u16 sequence = le16_to_cpu(pkt->hdr.sequence);
         int txq_id = SEQ_TO_QUEUE(sequence);
         int index = SEQ_TO_INDEX(sequence);
@@ -1473,6 +1382,36 @@ IWL5000_UCODE_GET(init_size);
 IWL5000_UCODE_GET(init_data_size);
 IWL5000_UCODE_GET(boot_size);
 
+static int iwl5000_hw_channel_switch(struct iwl_priv *priv, u16 channel)
+{
+        struct iwl5000_channel_switch_cmd cmd;
+        const struct iwl_channel_info *ch_info;
+        struct iwl_host_cmd hcmd = {
+                .id = REPLY_CHANNEL_SWITCH,
+                .len = sizeof(cmd),
+                .flags = CMD_SIZE_HUGE,
+                .data = &cmd,
+        };
+
+        IWL_DEBUG_11H(priv, "channel switch from %d to %d\n",
+                priv->active_rxon.channel, channel);
+        cmd.band = priv->band == IEEE80211_BAND_2GHZ;
+        cmd.channel = cpu_to_le16(channel);
+        cmd.rxon_flags = priv->active_rxon.flags;
+        cmd.rxon_filter_flags = priv->active_rxon.filter_flags;
+        cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
+        ch_info = iwl_get_channel_info(priv, priv->band, channel);
+        if (ch_info)
+                cmd.expect_beacon = is_channel_radar(ch_info);
+        else {
+                IWL_ERR(priv, "invalid channel switch from %u to %u\n",
+                        priv->active_rxon.channel, channel);
+                return -EFAULT;
+        }
+
+        return iwl_send_cmd_sync(priv, &hcmd);
+}
+
 struct iwl_hcmd_ops iwl5000_hcmd = {
         .rxon_assoc = iwl5000_send_rxon_assoc,
         .commit_rxon = iwl_commit_rxon,
@@ -1520,9 +1459,9 @@ struct iwl_lib_ops iwl5000_lib = {
         .alive_notify = iwl5000_alive_notify,
         .send_tx_power = iwl5000_send_tx_power,
         .update_chain_flags = iwl_update_chain_flags,
+        .set_channel_switch = iwl5000_hw_channel_switch,
         .apm_ops = {
-                .init = iwl5000_apm_init,
-                .reset = iwl5000_apm_reset,
+                .init = iwl_apm_init,
                 .stop = iwl_apm_stop,
                 .config = iwl5000_nic_config,
                 .set_pwr_src = iwl_set_pwr_src,
@@ -1572,9 +1511,9 @@ static struct iwl_lib_ops iwl5150_lib = {
         .alive_notify = iwl5000_alive_notify,
         .send_tx_power = iwl5000_send_tx_power,
         .update_chain_flags = iwl_update_chain_flags,
+        .set_channel_switch = iwl5000_hw_channel_switch,
         .apm_ops = {
-                .init = iwl5000_apm_init,
-                .reset = iwl5000_apm_reset,
+                .init = iwl_apm_init,
                 .stop = iwl_apm_stop,
                 .config = iwl5000_nic_config,
                 .set_pwr_src = iwl_set_pwr_src,
@@ -1621,8 +1560,6 @@ static struct iwl_ops iwl5150_ops = {
 };
 
 struct iwl_mod_params iwl50_mod_params = {
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .amsdu_size_8K = 1,
         .restart_fw = 1,
         /* the rest are 0 by default */
@@ -1639,10 +1576,14 @@ struct iwl_cfg iwl5300_agn_cfg = {
         .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_ABC,
         .valid_rx_ant = ANT_ABC,
-        .need_pll_cfg = true,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = true,
+        .use_bsm = false,
         .ht_greenfield_support = true,
         .led_compensation = 51,
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
@@ -1658,10 +1599,14 @@ struct iwl_cfg iwl5100_bg_cfg = {
         .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_B,
         .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = true,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = true,
+        .use_bsm = false,
         .ht_greenfield_support = true,
         .led_compensation = 51,
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
@@ -1677,10 +1622,14 @@ struct iwl_cfg iwl5100_abg_cfg = {
         .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_B,
         .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = true,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = true,
+        .use_bsm = false,
         .ht_greenfield_support = true,
         .led_compensation = 51,
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
@@ -1696,10 +1645,14 @@ struct iwl_cfg iwl5100_agn_cfg = {
         .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_B,
         .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = true,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = true,
+        .use_bsm = false,
         .ht_greenfield_support = true,
         .led_compensation = 51,
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
@@ -1715,10 +1668,14 @@ struct iwl_cfg iwl5350_agn_cfg = {
         .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_ABC,
         .valid_rx_ant = ANT_ABC,
-        .need_pll_cfg = true,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = true,
+        .use_bsm = false,
         .ht_greenfield_support = true,
         .led_compensation = 51,
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
@@ -1734,10 +1691,14 @@ struct iwl_cfg iwl5150_agn_cfg = {
         .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_A,
         .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = true,
+        .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
+        .set_l0s = true,
+        .use_bsm = false,
         .ht_greenfield_support = true,
         .led_compensation = 51,
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index d1f0b0b4ad0c..32466d38d1ae 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -52,8 +52,8 @@
 #define IWL6050_UCODE_API_MAX 4
 
 /* Lowest firmware API version supported */
-#define IWL6000_UCODE_API_MIN 1
-#define IWL6050_UCODE_API_MIN 1
+#define IWL6000_UCODE_API_MIN 4
+#define IWL6050_UCODE_API_MIN 4
 
 #define IWL6000_FW_PRE "iwlwifi-6000-"
 #define _IWL6000_MODULE_FIRMWARE(api) IWL6000_FW_PRE #api ".ucode"
@@ -121,22 +121,24 @@ static struct iwl_sensitivity_ranges iwl6000_sensitivity = {
         .auto_corr_max_cck_mrc = 310,
         .nrg_th_cck = 97,
         .nrg_th_ofdm = 100,
+
+        .barker_corr_th_min = 190,
+        .barker_corr_th_min_mrc = 390,
+        .nrg_th_cca = 62,
 };
 
 static int iwl6000_hw_set_hw_params(struct iwl_priv *priv)
 {
-        if ((priv->cfg->mod_params->num_of_queues > IWL50_NUM_QUEUES) ||
-            (priv->cfg->mod_params->num_of_queues < IWL_MIN_NUM_QUEUES)) {
-                IWL_ERR(priv,
-                        "invalid queues_num, should be between %d and %d\n",
-                        IWL_MIN_NUM_QUEUES, IWL50_NUM_QUEUES);
-                return -EINVAL;
-        }
+        if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
+            priv->cfg->mod_params->num_of_queues <= IWL50_NUM_QUEUES)
+                priv->cfg->num_of_queues =
+                        priv->cfg->mod_params->num_of_queues;
 
-        priv->hw_params.max_txq_num = priv->cfg->mod_params->num_of_queues;
+        priv->hw_params.max_txq_num = priv->cfg->num_of_queues;
         priv->hw_params.dma_chnl_num = FH50_TCSR_CHNL_NUM;
         priv->hw_params.scd_bc_tbls_size =
-                        IWL50_NUM_QUEUES * sizeof(struct iwl5000_scd_bc_tbl);
+                        priv->cfg->num_of_queues *
+                        sizeof(struct iwl5000_scd_bc_tbl);
         priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
         priv->hw_params.max_stations = IWL5000_STATION_COUNT;
         priv->hw_params.bcast_sta_id = IWL5000_BROADCAST_ID;
@@ -170,6 +172,37 @@ static int iwl6000_hw_set_hw_params(struct iwl_priv *priv)
         return 0;
 }
 
+static int iwl6000_hw_channel_switch(struct iwl_priv *priv, u16 channel)
+{
+        struct iwl6000_channel_switch_cmd cmd;
+        const struct iwl_channel_info *ch_info;
+        struct iwl_host_cmd hcmd = {
+                .id = REPLY_CHANNEL_SWITCH,
+                .len = sizeof(cmd),
+                .flags = CMD_SIZE_HUGE,
+                .data = &cmd,
+        };
+
+        IWL_DEBUG_11H(priv, "channel switch from %d to %d\n",
+                priv->active_rxon.channel, channel);
+
+        cmd.band = priv->band == IEEE80211_BAND_2GHZ;
+        cmd.channel = cpu_to_le16(channel);
+        cmd.rxon_flags = priv->active_rxon.flags;
+        cmd.rxon_filter_flags = priv->active_rxon.filter_flags;
+        cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time);
+        ch_info = iwl_get_channel_info(priv, priv->band, channel);
+        if (ch_info)
+                cmd.expect_beacon = is_channel_radar(ch_info);
+        else {
+                IWL_ERR(priv, "invalid channel switch from %u to %u\n",
+                        priv->active_rxon.channel, channel);
+                return -EFAULT;
+        }
+
+        return iwl_send_cmd_sync(priv, &hcmd);
+}
+
 static struct iwl_lib_ops iwl6000_lib = {
         .set_hw_params = iwl6000_hw_set_hw_params,
         .txq_update_byte_cnt_tbl = iwl5000_txq_update_byte_cnt_tbl,
@@ -190,9 +223,9 @@ static struct iwl_lib_ops iwl6000_lib = {
         .alive_notify = iwl5000_alive_notify,
         .send_tx_power = iwl5000_send_tx_power,
         .update_chain_flags = iwl_update_chain_flags,
+        .set_channel_switch = iwl6000_hw_channel_switch,
         .apm_ops = {
-                .init = iwl5000_apm_init,
-                .reset = iwl5000_apm_reset,
+                .init = iwl_apm_init,
                 .stop = iwl_apm_stop,
                 .config = iwl6000_nic_config,
                 .set_pwr_src = iwl_set_pwr_src,
@@ -231,6 +264,21 @@ static struct iwl_ops iwl6000_ops = {
         .led = &iwlagn_led_ops,
 };
 
+static struct iwl_hcmd_utils_ops iwl6050_hcmd_utils = {
+        .get_hcmd_size = iwl5000_get_hcmd_size,
+        .build_addsta_hcmd = iwl5000_build_addsta_hcmd,
+        .rts_tx_cmd_flag = iwl5000_rts_tx_cmd_flag,
+        .calc_rssi = iwl5000_calc_rssi,
+};
+
+static struct iwl_ops iwl6050_ops = {
+        .ucode = &iwl5000_ucode,
+        .lib = &iwl6000_lib,
+        .hcmd = &iwl5000_hcmd,
+        .utils = &iwl6050_hcmd_utils,
+        .led = &iwlagn_led_ops,
+};
+
 
 /*
  * "h": Hybrid configuration, use both internal and external Power Amplifier
@@ -245,10 +293,14 @@ struct iwl_cfg iwl6000h_2agn_cfg = {
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = false,
+        .pll_cfg_val = 0,
+        .set_l0s = false,
+        .use_bsm = false,
         .pa_type = IWL_PA_HYBRID,
         .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
         .shadow_ram_support = true,
@@ -257,6 +309,8 @@ struct iwl_cfg iwl6000h_2agn_cfg = {
         .use_rts_for_ht = true, /* use rts/cts protection */
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
 };
 
 struct iwl_cfg iwl6000h_2abg_cfg = {
@@ -269,10 +323,14 @@ struct iwl_cfg iwl6000h_2abg_cfg = {
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = false,
+        .pll_cfg_val = 0,
+        .set_l0s = false,
+        .use_bsm = false,
         .pa_type = IWL_PA_HYBRID,
         .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
         .shadow_ram_support = true,
@@ -280,6 +338,8 @@ struct iwl_cfg iwl6000h_2abg_cfg = {
         .led_compensation = 51,
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
 };
 
 struct iwl_cfg iwl6000h_2bg_cfg = {
@@ -292,10 +352,14 @@ struct iwl_cfg iwl6000h_2bg_cfg = {
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = false,
+        .pll_cfg_val = 0,
+        .set_l0s = false,
+        .use_bsm = false,
         .pa_type = IWL_PA_HYBRID,
         .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
         .shadow_ram_support = true,
@@ -303,6 +367,8 @@ struct iwl_cfg iwl6000h_2bg_cfg = {
         .led_compensation = 51,
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
 };
 
 /*
@@ -318,10 +384,14 @@ struct iwl_cfg iwl6000i_2agn_cfg = {
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_BC,
         .valid_rx_ant = ANT_BC,
-        .need_pll_cfg = false,
+        .pll_cfg_val = 0,
+        .set_l0s = false,
+        .use_bsm = false,
         .pa_type = IWL_PA_INTERNAL,
         .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
         .shadow_ram_support = true,
@@ -330,6 +400,8 @@ struct iwl_cfg iwl6000i_2agn_cfg = {
         .use_rts_for_ht = true, /* use rts/cts protection */
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
 };
 
 struct iwl_cfg iwl6000i_2abg_cfg = {
@@ -342,10 +414,14 @@ struct iwl_cfg iwl6000i_2abg_cfg = {
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_BC,
         .valid_rx_ant = ANT_BC,
-        .need_pll_cfg = false,
+        .pll_cfg_val = 0,
+        .set_l0s = false,
+        .use_bsm = false,
         .pa_type = IWL_PA_INTERNAL,
         .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
         .shadow_ram_support = true,
@@ -353,6 +429,8 @@ struct iwl_cfg iwl6000i_2abg_cfg = {
         .led_compensation = 51,
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
 };
 
 struct iwl_cfg iwl6000i_2bg_cfg = {
@@ -365,10 +443,14 @@ struct iwl_cfg iwl6000i_2bg_cfg = {
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_BC,
         .valid_rx_ant = ANT_BC,
-        .need_pll_cfg = false,
+        .pll_cfg_val = 0,
+        .set_l0s = false,
+        .use_bsm = false,
         .pa_type = IWL_PA_INTERNAL,
         .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
         .shadow_ram_support = true,
@@ -376,6 +458,8 @@ struct iwl_cfg iwl6000i_2bg_cfg = {
         .led_compensation = 51,
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
 };
 
 struct iwl_cfg iwl6050_2agn_cfg = {
@@ -384,22 +468,28 @@ struct iwl_cfg iwl6050_2agn_cfg = {
         .ucode_api_max = IWL6050_UCODE_API_MAX,
         .ucode_api_min = IWL6050_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
-        .ops = &iwl6000_ops,
+        .ops = &iwl6050_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
-        .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
+        .eeprom_ver = EEPROM_6050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = false,
+        .pll_cfg_val = 0,
+        .set_l0s = false,
+        .use_bsm = false,
         .pa_type = IWL_PA_SYSTEM,
-        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+        .max_ll_items = OTP_MAX_LL_ITEMS_6x50,
         .shadow_ram_support = true,
         .ht_greenfield_support = true,
         .led_compensation = 51,
         .use_rts_for_ht = true, /* use rts/cts protection */
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
 };
 
 struct iwl_cfg iwl6050_2abg_cfg = {
@@ -408,21 +498,27 @@ struct iwl_cfg iwl6050_2abg_cfg = {
         .ucode_api_max = IWL6050_UCODE_API_MAX,
         .ucode_api_min = IWL6050_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G,
-        .ops = &iwl6000_ops,
+        .ops = &iwl6050_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
-        .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
+        .eeprom_ver = EEPROM_6050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_AB,
-        .need_pll_cfg = false,
+        .pll_cfg_val = 0,
+        .set_l0s = false,
+        .use_bsm = false,
         .pa_type = IWL_PA_SYSTEM,
-        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+        .max_ll_items = OTP_MAX_LL_ITEMS_6x50,
         .shadow_ram_support = true,
         .ht_greenfield_support = true,
         .led_compensation = 51,
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
 };
 
 struct iwl_cfg iwl6000_3agn_cfg = {
@@ -435,10 +531,14 @@ struct iwl_cfg iwl6000_3agn_cfg = {
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_ABC,
         .valid_rx_ant = ANT_ABC,
-        .need_pll_cfg = false,
+        .pll_cfg_val = 0,
+        .set_l0s = false,
+        .use_bsm = false,
         .pa_type = IWL_PA_SYSTEM,
         .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
         .shadow_ram_support = true,
@@ -447,6 +547,8 @@ struct iwl_cfg iwl6000_3agn_cfg = {
         .use_rts_for_ht = true, /* use rts/cts protection */
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
 };
 
 struct iwl_cfg iwl6050_3agn_cfg = {
@@ -455,22 +557,28 @@ struct iwl_cfg iwl6050_3agn_cfg = {
         .ucode_api_max = IWL6050_UCODE_API_MAX,
         .ucode_api_min = IWL6050_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
-        .ops = &iwl6000_ops,
+        .ops = &iwl6050_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
-        .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
+        .eeprom_ver = EEPROM_6050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
+        .num_of_queues = IWL50_NUM_QUEUES,
+        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
         .mod_params = &iwl50_mod_params,
         .valid_tx_ant = ANT_ABC,
         .valid_rx_ant = ANT_ABC,
-        .need_pll_cfg = false,
+        .pll_cfg_val = 0,
+        .set_l0s = false,
+        .use_bsm = false,
         .pa_type = IWL_PA_SYSTEM,
-        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+        .max_ll_items = OTP_MAX_LL_ITEMS_6x50,
         .shadow_ram_support = true,
         .ht_greenfield_support = true,
         .led_compensation = 51,
         .use_rts_for_ht = true, /* use rts/cts protection */
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
 };
 
 MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index a07be29cc5e5..27d4ece4d467 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -75,106 +75,6 @@ static const u8 ant_toggle_lookup[] = {
         /*ANT_ABC  -> */ ANT_ABC,
 };
 
-/**
- * struct iwl_rate_scale_data -- tx success history for one rate
- */
-struct iwl_rate_scale_data {
-        u64 data;               /* bitmap of successful frames */
-        s32 success_counter;    /* number of frames successful */
-        s32 success_ratio;      /* per-cent * 128  */
-        s32 counter;            /* number of frames attempted */
-        s32 average_tpt;        /* success ratio * expected throughput */
-        unsigned long stamp;
-};
-
-/**
- * struct iwl_scale_tbl_info -- tx params and success history for all rates
- *
- * There are two of these in struct iwl_lq_sta,
- * one for "active", and one for "search".
- */
-struct iwl_scale_tbl_info {
-        enum iwl_table_type lq_type;
-        u8 ant_type;
-        u8 is_SGI;      /* 1 = short guard interval */
-        u8 is_ht40;     /* 1 = 40 MHz channel width */
-        u8 is_dup;      /* 1 = duplicated data streams */
-        u8 action;      /* change modulation; IWL_[LEGACY/SISO/MIMO]_SWITCH_* */
-        u8 max_search;  /* maximun number of tables we can search */
-        s32 *expected_tpt;      /* throughput metrics; expected_tpt_G, etc. */
-        u32 current_rate;  /* rate_n_flags, uCode API format */
-        struct iwl_rate_scale_data win[IWL_RATE_COUNT]; /* rate histories */
-};
-
-struct iwl_traffic_load {
-        unsigned long time_stamp;       /* age of the oldest statistics */
-        u32 packet_count[TID_QUEUE_MAX_SIZE];   /* packet count in this time
-                                                 * slice */
-        u32 total;                      /* total num of packets during the
-                                         * last TID_MAX_TIME_DIFF */
-        u8 queue_count;                 /* number of queues that has
-                                         * been used since the last cleanup */
-        u8 head;                        /* start of the circular buffer */
-};
-
-/**
- * struct iwl_lq_sta -- driver's rate scaling private structure
- *
- * Pointer to this gets passed back and forth between driver and mac80211.
- */
-struct iwl_lq_sta {
-        u8 active_tbl;          /* index of active table, range 0-1 */
-        u8 enable_counter;      /* indicates HT mode */
-        u8 stay_in_tbl;         /* 1: disallow, 0: allow search for new mode */
-        u8 search_better_tbl;   /* 1: currently trying alternate mode */
-        s32 last_tpt;
-
-        /* The following determine when to search for a new mode */
-        u32 table_count_limit;
-        u32 max_failure_limit;  /* # failed frames before new search */
-        u32 max_success_limit;  /* # successful frames before new search */
-        u32 table_count;
-        u32 total_failed;       /* total failed frames, any/all rates */
-        u32 total_success;      /* total successful frames, any/all rates */
-        u64 flush_timer;        /* time staying in mode before new search */
-
-        u8 action_counter;      /* # mode-switch actions tried */
-        u8 is_green;
-        u8 is_dup;
-        enum ieee80211_band band;
-        u8 ibss_sta_added;
-
-        /* The following are bitmaps of rates; IWL_RATE_6M_MASK, etc. */
-        u32 supp_rates;
-        u16 active_legacy_rate;
-        u16 active_siso_rate;
-        u16 active_mimo2_rate;
-        u16 active_mimo3_rate;
-        u16 active_rate_basic;
-        s8 max_rate_idx;     /* Max rate set by user */
-        u8 missed_rate_counter;
-
-        struct iwl_link_quality_cmd lq;
-        struct iwl_scale_tbl_info lq_info[LQ_SIZE]; /* "active", "search" */
-        struct iwl_traffic_load load[TID_MAX_LOAD_COUNT];
-        u8 tx_agg_tid_en;
-#ifdef CONFIG_MAC80211_DEBUGFS
-        struct dentry *rs_sta_dbgfs_scale_table_file;
-        struct dentry *rs_sta_dbgfs_stats_table_file;
-        struct dentry *rs_sta_dbgfs_rate_scale_data_file;
-        struct dentry *rs_sta_dbgfs_tx_agg_tid_en_file;
-        u32 dbg_fixed_rate;
-#endif
-        struct iwl_priv *drv;
-
-        /* used to be in sta_info */
-        int last_txrate_idx;
-        /* last tx rate_n_flags */
-        u32 last_rate_n_flags;
-        /* packets destined for this STA are aggregated */
-        u8 is_agg;
-};
-
 static void rs_rate_scale_perform(struct iwl_priv *priv,
                                    struct sk_buff *skb,
                                    struct ieee80211_sta *sta,
@@ -2575,19 +2475,17 @@ static void *rs_alloc_sta(void *priv_rate, struct ieee80211_sta *sta,
                           gfp_t gfp)
 {
         struct iwl_lq_sta *lq_sta;
+        struct iwl_station_priv *sta_priv = (struct iwl_station_priv *) sta->drv_priv;
         struct iwl_priv *priv;
         int i, j;
 
         priv = (struct iwl_priv *)priv_rate;
         IWL_DEBUG_RATE(priv, "create station rate scale window\n");
 
-        lq_sta = kzalloc(sizeof(struct iwl_lq_sta), gfp);
+        lq_sta = &sta_priv->lq_sta;
 
-        if (lq_sta == NULL)
-                return NULL;
         lq_sta->lq.sta_id = 0xff;
 
-
         for (j = 0; j < LQ_SIZE; j++)
                 for (i = 0; i < IWL_RATE_COUNT; i++)
                         rs_rate_scale_clear_window(&lq_sta->lq_info[j].win[i]);
@@ -2819,11 +2717,9 @@ static void rs_free(void *priv_rate)
 static void rs_free_sta(void *priv_r, struct ieee80211_sta *sta,
                         void *priv_sta)
 {
-        struct iwl_lq_sta *lq_sta = priv_sta;
         struct iwl_priv *priv __maybe_unused = priv_r;
 
         IWL_DEBUG_RATE(priv, "enter\n");
-        kfree(lq_sta);
         IWL_DEBUG_RATE(priv, "leave\n");
 }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.h b/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
index 9fac530cfb7e..affc0c5a2f2c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
@@ -54,6 +54,7 @@ struct iwl3945_rate_info {
         u8 prev_table_rs;       /* prev in rate table cmd */
 };
 
+
 /*
  * These serve as indexes into
  * struct iwl_rate_info iwl_rates[IWL_RATE_COUNT];
@@ -335,6 +336,106 @@ struct iwl_rate_mcs_info {
         char    mcs[IWL_MAX_MCS_DISPLAY_SIZE];
 };
 
+/**
+ * struct iwl_rate_scale_data -- tx success history for one rate
+ */
+struct iwl_rate_scale_data {
+        u64 data;               /* bitmap of successful frames */
+        s32 success_counter;    /* number of frames successful */
+        s32 success_ratio;      /* per-cent * 128  */
+        s32 counter;            /* number of frames attempted */
+        s32 average_tpt;        /* success ratio * expected throughput */
+        unsigned long stamp;
+};
+
+/**
+ * struct iwl_scale_tbl_info -- tx params and success history for all rates
+ *
+ * There are two of these in struct iwl_lq_sta,
+ * one for "active", and one for "search".
+ */
+struct iwl_scale_tbl_info {
+        enum iwl_table_type lq_type;
+        u8 ant_type;
+        u8 is_SGI;      /* 1 = short guard interval */
+        u8 is_ht40;     /* 1 = 40 MHz channel width */
+        u8 is_dup;      /* 1 = duplicated data streams */
+        u8 action;      /* change modulation; IWL_[LEGACY/SISO/MIMO]_SWITCH_* */
+        u8 max_search;  /* maximun number of tables we can search */
+        s32 *expected_tpt;      /* throughput metrics; expected_tpt_G, etc. */
+        u32 current_rate;  /* rate_n_flags, uCode API format */
+        struct iwl_rate_scale_data win[IWL_RATE_COUNT]; /* rate histories */
+};
+
+struct iwl_traffic_load {
+        unsigned long time_stamp;       /* age of the oldest statistics */
+        u32 packet_count[TID_QUEUE_MAX_SIZE];   /* packet count in this time
+                                                 * slice */
+        u32 total;                      /* total num of packets during the
+                                         * last TID_MAX_TIME_DIFF */
+        u8 queue_count;                 /* number of queues that has
+                                         * been used since the last cleanup */
+        u8 head;                        /* start of the circular buffer */
+};
+
+/**
+ * struct iwl_lq_sta -- driver's rate scaling private structure
+ *
+ * Pointer to this gets passed back and forth between driver and mac80211.
+ */
+struct iwl_lq_sta {
+        u8 active_tbl;          /* index of active table, range 0-1 */
+        u8 enable_counter;      /* indicates HT mode */
+        u8 stay_in_tbl;         /* 1: disallow, 0: allow search for new mode */
+        u8 search_better_tbl;   /* 1: currently trying alternate mode */
+        s32 last_tpt;
+
+        /* The following determine when to search for a new mode */
+        u32 table_count_limit;
+        u32 max_failure_limit;  /* # failed frames before new search */
+        u32 max_success_limit;  /* # successful frames before new search */
+        u32 table_count;
+        u32 total_failed;       /* total failed frames, any/all rates */
+        u32 total_success;      /* total successful frames, any/all rates */
+        u64 flush_timer;        /* time staying in mode before new search */
+
+        u8 action_counter;      /* # mode-switch actions tried */
+        u8 is_green;
+        u8 is_dup;
+        enum ieee80211_band band;
+        u8 ibss_sta_added;
+
+        /* The following are bitmaps of rates; IWL_RATE_6M_MASK, etc. */
+        u32 supp_rates;
+        u16 active_legacy_rate;
+        u16 active_siso_rate;
+        u16 active_mimo2_rate;
+        u16 active_mimo3_rate;
+        u16 active_rate_basic;
+        s8 max_rate_idx;     /* Max rate set by user */
+        u8 missed_rate_counter;
+
+        struct iwl_link_quality_cmd lq;
+        struct iwl_scale_tbl_info lq_info[LQ_SIZE]; /* "active", "search" */
+        struct iwl_traffic_load load[TID_MAX_LOAD_COUNT];
+        u8 tx_agg_tid_en;
+#ifdef CONFIG_MAC80211_DEBUGFS
+        struct dentry *rs_sta_dbgfs_scale_table_file;
+        struct dentry *rs_sta_dbgfs_stats_table_file;
+        struct dentry *rs_sta_dbgfs_rate_scale_data_file;
+        struct dentry *rs_sta_dbgfs_tx_agg_tid_en_file;
+        u32 dbg_fixed_rate;
+#endif
+        struct iwl_priv *drv;
+
+        /* used to be in sta_info */
+        int last_txrate_idx;
+        /* last tx rate_n_flags */
+        u32 last_rate_n_flags;
+        /* packets destined for this STA are aggregated */
+        u8 is_agg;
+};
+
 static inline u8 num_of_ant(u8 mask)
 {
         return  !!((mask) & ANT_A) +
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 8d7bc38fe005..fa1672e99e4b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -524,7 +524,7 @@ int iwl_hw_tx_queue_init(struct iwl_priv *priv,
 static void iwl_rx_reply_alive(struct iwl_priv *priv,
                                 struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_alive_resp *palive;
         struct delayed_work *pwork;
 
@@ -610,7 +610,7 @@ static void iwl_rx_beacon_notif(struct iwl_priv *priv,
                                 struct iwl_rx_mem_buffer *rxb)
 {
 #ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl4965_beacon_notif *beacon =
                 (struct iwl4965_beacon_notif *)pkt->u.raw;
         u8 rate = iwl_hw_get_rate(beacon->beacon_notify_hdr.rate_n_flags);
@@ -634,7 +634,7 @@ static void iwl_rx_beacon_notif(struct iwl_priv *priv,
 static void iwl_rx_card_state_notif(struct iwl_priv *priv,
                                     struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         u32 flags = le32_to_cpu(pkt->u.card_state_notif.flags);
         unsigned long status = priv->status;
 
@@ -769,7 +769,7 @@ void iwl_rx_handle(struct iwl_priv *priv)
                 IWL_DEBUG_RX(priv, "r = %d, i = %d\n", r, i);
 
         /* calculate total frames need to be restock after handling RX */
-        total_empty = r - priv->rxq.write_actual;
+        total_empty = r - rxq->write_actual;
         if (total_empty < 0)
                 total_empty += RX_QUEUE_SIZE;
 
@@ -786,10 +786,10 @@ void iwl_rx_handle(struct iwl_priv *priv)
 
                 rxq->queue[i] = NULL;
 
-                pci_unmap_single(priv->pci_dev, rxb->real_dma_addr,
-                                 priv->hw_params.rx_buf_size + 256,
-                                 PCI_DMA_FROMDEVICE);
-                pkt = (struct iwl_rx_packet *)rxb->skb->data;
+                pci_unmap_page(priv->pci_dev, rxb->page_dma,
+                               PAGE_SIZE << priv->hw_params.rx_page_order,
+                               PCI_DMA_FROMDEVICE);
+                pkt = rxb_addr(rxb);
 
                 trace_iwlwifi_dev_rx(priv, pkt,
                         le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
@@ -814,8 +814,8 @@ void iwl_rx_handle(struct iwl_priv *priv)
                 if (priv->rx_handlers[pkt->hdr.cmd]) {
                         IWL_DEBUG_RX(priv, "r = %d, i = %d, %s, 0x%02x\n", r,
                                 i, get_cmd_string(pkt->hdr.cmd), pkt->hdr.cmd);
-                        priv->rx_handlers[pkt->hdr.cmd] (priv, rxb);
                         priv->isr_stats.rx_handlers[pkt->hdr.cmd]++;
+                        priv->rx_handlers[pkt->hdr.cmd] (priv, rxb);
                 } else {
                         /* No handling needed */
                         IWL_DEBUG_RX(priv,
@@ -824,35 +824,45 @@ void iwl_rx_handle(struct iwl_priv *priv)
                                 pkt->hdr.cmd);
                 }
 
+                /*
+                 * XXX: After here, we should always check rxb->page
+                 * against NULL before touching it or its virtual
+                 * memory (pkt). Because some rx_handler might have
+                 * already taken or freed the pages.
+                 */
+
                 if (reclaim) {
-                        /* Invoke any callbacks, transfer the skb to caller, and
-                         * fire off the (possibly) blocking iwl_send_cmd()
+                        /* Invoke any callbacks, transfer the buffer to caller,
+                         * and fire off the (possibly) blocking iwl_send_cmd()
                          * as we reclaim the driver command queue */
-                        if (rxb && rxb->skb)
+                        if (rxb->page)
                                 iwl_tx_cmd_complete(priv, rxb);
                         else
                                 IWL_WARN(priv, "Claim null rxb?\n");
                 }
 
-                /* For now we just don't re-use anything.  We can tweak this
-                 * later to try and re-use notification packets and SKBs that
-                 * fail to Rx correctly */
-                if (rxb->skb != NULL) {
-                        priv->alloc_rxb_skb--;
-                        dev_kfree_skb_any(rxb->skb);
-                        rxb->skb = NULL;
-                }
-
+                /* Reuse the page if possible. For notification packets and
+                 * SKBs that fail to Rx correctly, add them back into the
+                 * rx_free list for reuse later. */
                 spin_lock_irqsave(&rxq->lock, flags);
-                list_add_tail(&rxb->list, &priv->rxq.rx_used);
+                if (rxb->page != NULL) {
+                        rxb->page_dma = pci_map_page(priv->pci_dev, rxb->page,
+                                0, PAGE_SIZE << priv->hw_params.rx_page_order,
+                                PCI_DMA_FROMDEVICE);
+                        list_add_tail(&rxb->list, &rxq->rx_free);
+                        rxq->free_count++;
+                } else
+                        list_add_tail(&rxb->list, &rxq->rx_used);
+
                 spin_unlock_irqrestore(&rxq->lock, flags);
+
                 i = (i + 1) & RX_QUEUE_MASK;
                 /* If there are a lot of unused frames,
                  * restock the Rx queue so ucode wont assert. */
                 if (fill_rx) {
                         count++;
                         if (count >= 8) {
-                                priv->rxq.read = i;
+                                rxq->read = i;
                                 iwl_rx_replenish_now(priv);
                                 count = 0;
                         }
@@ -860,7 +870,7 @@ void iwl_rx_handle(struct iwl_priv *priv)
         }
 
         /* Backtrack one entry */
-        priv->rxq.read = i;
+        rxq->read = i;
         if (fill_rx)
                 iwl_rx_replenish_now(priv);
         else
@@ -907,6 +917,8 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
         }
 #endif
 
+        spin_unlock_irqrestore(&priv->lock, flags);
+
         /* Since CSR_INT and CSR_FH_INT_STATUS reads and clears are not
          * atomic, make sure that inta covers all the interrupts that
          * we've discovered, even if FH interrupt came in just after
@@ -928,8 +940,6 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
 
                 handled |= CSR_INT_BIT_HW_ERR;
 
-                spin_unlock_irqrestore(&priv->lock, flags);
-
                 return;
         }
 
@@ -1019,6 +1029,7 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
         if (inta & (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX)) {
                 iwl_rx_handle(priv);
                 priv->isr_stats.rx++;
+                iwl_leds_background(priv);
                 handled |= (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX);
         }
 
@@ -1056,7 +1067,6 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
                         "flags 0x%08lx\n", inta, inta_mask, inta_fh, flags);
         }
 #endif
-        spin_unlock_irqrestore(&priv->lock, flags);
 }
 
 /* tasklet for iwlagn interrupt */
@@ -1086,6 +1096,9 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
                                 inta, inta_mask);
         }
 #endif
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+
         /* saved interrupt in inta variable now we can reset priv->inta */
         priv->inta = 0;
 
@@ -1101,8 +1114,6 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
 
                 handled |= CSR_INT_BIT_HW_ERR;
 
-                spin_unlock_irqrestore(&priv->lock, flags);
-
                 return;
         }
 
@@ -1220,6 +1231,7 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
                                     CSR_INT_PERIODIC_ENA);
 
                 priv->isr_stats.rx++;
+                iwl_leds_background(priv);
         }
 
         if (inta & CSR_INT_BIT_FH_TX) {
@@ -1242,14 +1254,10 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
                          inta & ~priv->inta_mask);
         }
 
-
         /* Re-enable all interrupts */
         /* only Re-enable if diabled by irq */
         if (test_bit(STATUS_INT_ENABLED, &priv->status))
                 iwl_enable_interrupts(priv);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-
 }
 
 
@@ -1899,11 +1907,9 @@ static void __iwl_down(struct iwl_priv *priv)
 
         udelay(5);
 
-        /* FIXME: apm_ops.suspend(priv) */
-        if (exit_pending)
-                priv->cfg->ops->lib->apm_ops.stop(priv);
-        else
-                priv->cfg->ops->lib->apm_ops.reset(priv);
+        /* Stop the device, and put it in low power state */
+        priv->cfg->ops->lib->apm_ops.stop(priv);
+
  exit:
         memset(&priv->card_alive, 0, sizeof(struct iwl_alive_resp));
 
@@ -2290,6 +2296,69 @@ void iwl_post_associate(struct iwl_priv *priv)
 
 #define UCODE_READY_TIMEOUT     (4 * HZ)
 
+/*
+ * Not a mac80211 entry point function, but it fits in with all the
+ * other mac80211 functions grouped here.
+ */
+static int iwl_setup_mac(struct iwl_priv *priv)
+{
+        int ret;
+        struct ieee80211_hw *hw = priv->hw;
+        hw->rate_control_algorithm = "iwl-agn-rs";
+
+        /* Tell mac80211 our characteristics */
+        hw->flags = IEEE80211_HW_SIGNAL_DBM |
+                    IEEE80211_HW_NOISE_DBM |
+                    IEEE80211_HW_AMPDU_AGGREGATION |
+                    IEEE80211_HW_SPECTRUM_MGMT;
+
+        if (!priv->cfg->broken_powersave)
+                hw->flags |= IEEE80211_HW_SUPPORTS_PS |
+                             IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
+
+        hw->sta_data_size = sizeof(struct iwl_station_priv);
+        hw->wiphy->interface_modes =
+                BIT(NL80211_IFTYPE_STATION) |
+                BIT(NL80211_IFTYPE_ADHOC);
+
+        hw->wiphy->custom_regulatory = true;
+
+        /* Firmware does not support this */
+        hw->wiphy->disable_beacon_hints = true;
+
+        /*
+         * For now, disable PS by default because it affects
+         * RX performance significantly.
+         */
+        hw->wiphy->ps_default = false;
+
+        hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
+        /* we create the 802.11 header and a zero-length SSID element */
+        hw->wiphy->max_scan_ie_len = IWL_MAX_PROBE_REQUEST - 24 - 2;
+
+        /* Default value; 4 EDCA QOS priorities */
+        hw->queues = 4;
+
+        hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
+
+        if (priv->bands[IEEE80211_BAND_2GHZ].n_channels)
+                priv->hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
+                        &priv->bands[IEEE80211_BAND_2GHZ];
+        if (priv->bands[IEEE80211_BAND_5GHZ].n_channels)
+                priv->hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
+                        &priv->bands[IEEE80211_BAND_5GHZ];
+
+        ret = ieee80211_register_hw(priv->hw);
+        if (ret) {
+                IWL_ERR(priv, "Failed to register hw (error %d)\n", ret);
+                return ret;
+        }
+        priv->mac80211_registered = 1;
+
+        return 0;
+}
+
+
 static int iwl_mac_start(struct ieee80211_hw *hw)
 {
         struct iwl_priv *priv = hw->priv;
@@ -3187,6 +3256,15 @@ static void __devexit iwl_pci_remove(struct pci_dev *pdev)
                 iwl_down(priv);
         }
 
+        /*
+         * Make sure device is reset to low power before unloading driver.
+         * This may be redundant with iwl_down(), but there are paths to
+         * run iwl_down() without calling apm_ops.stop(), and there are
+         * paths to avoid running iwl_down() at all before leaving driver.
+         * This (inexpensive) call *makes sure* device is reset.
+         */
+        priv->cfg->ops->lib->apm_ops.stop(priv);
+
         iwl_tt_exit(priv);
 
         /* make sure we flush any pending irq or
diff --git a/drivers/net/wireless/iwlwifi/iwl-calib.c b/drivers/net/wireless/iwlwifi/iwl-calib.c
index 69a80d7c2e44..1f801eb9fbff 100644
--- a/drivers/net/wireless/iwlwifi/iwl-calib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-calib.c
@@ -447,11 +447,11 @@ static int iwl_sensitivity_write(struct iwl_priv *priv)
                                 cpu_to_le16((u16)data->nrg_th_ofdm);
 
         cmd.table[HD_BARKER_CORR_TH_ADD_MIN_INDEX] =
-                                cpu_to_le16(190);
+                                cpu_to_le16(data->barker_corr_th_min);
         cmd.table[HD_BARKER_CORR_TH_ADD_MIN_MRC_INDEX] =
-                                cpu_to_le16(390);
+                                cpu_to_le16(data->barker_corr_th_min_mrc);
         cmd.table[HD_OFDM_ENERGY_TH_IN_INDEX] =
-                                cpu_to_le16(62);
+                                cpu_to_le16(data->nrg_th_cca);
 
         IWL_DEBUG_CALIB(priv, "ofdm: ac %u mrc %u x1 %u mrc_x1 %u thresh %u\n",
                         data->auto_corr_ofdm, data->auto_corr_ofdm_mrc,
@@ -524,6 +524,9 @@ void iwl_init_sensitivity(struct iwl_priv *priv)
         data->auto_corr_cck_mrc = ranges->auto_corr_min_cck_mrc;
         data->nrg_th_cck = ranges->nrg_th_cck;
         data->nrg_th_ofdm = ranges->nrg_th_ofdm;
+        data->barker_corr_th_min = ranges->barker_corr_th_min;
+        data->barker_corr_th_min_mrc = ranges->barker_corr_th_min_mrc;
+        data->nrg_th_cca = ranges->nrg_th_cca;
 
         data->last_bad_plcp_cnt_ofdm = 0;
         data->last_fa_cnt_ofdm = 0;
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index ba3e4c837d87..954bad60355d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -109,11 +109,12 @@ enum {
         REPLY_TX_LINK_QUALITY_CMD = 0x4e, /* 4965 only */
 
         /* WiMAX coexistence */
-        COEX_PRIORITY_TABLE_CMD = 0x5a, /*5000 only */
+        COEX_PRIORITY_TABLE_CMD = 0x5a, /* for 5000 series and up */
         COEX_MEDIUM_NOTIFICATION = 0x5b,
         COEX_EVENT_CMD = 0x5c,
 
         /* Calibration */
+        TEMPERATURE_NOTIFICATION = 0x62,
         CALIBRATION_CFG_CMD = 0x65,
         CALIBRATION_RES_NOTIFICATION = 0x66,
         CALIBRATION_COMPLETE_NOTIFICATION = 0x67,
@@ -353,6 +354,9 @@ struct iwl3945_power_per_rate {
 #define POWER_TABLE_NUM_HT_OFDM_ENTRIES         32
 #define POWER_TABLE_CCK_ENTRY                   32
 
+#define IWL_PWR_NUM_HT_OFDM_ENTRIES             24
+#define IWL_PWR_CCK_ENTRIES                     2
+
 /**
  * union iwl4965_tx_power_dual_stream
  *
@@ -803,7 +807,7 @@ struct iwl3945_channel_switch_cmd {
         struct iwl3945_power_per_rate power[IWL_MAX_RATES];
 } __attribute__ ((packed));
 
-struct iwl_channel_switch_cmd {
+struct iwl4965_channel_switch_cmd {
         u8 band;
         u8 expect_beacon;
         __le16 channel;
@@ -813,6 +817,48 @@ struct iwl_channel_switch_cmd {
         struct iwl4965_tx_power_db tx_power;
 } __attribute__ ((packed));
 
+/**
+ * struct iwl5000_channel_switch_cmd
+ * @band: 0- 5.2GHz, 1- 2.4GHz
+ * @expect_beacon: 0- resume transmits after channel switch
+ *                 1- wait for beacon to resume transmits
+ * @channel: new channel number
+ * @rxon_flags: Rx on flags
+ * @rxon_filter_flags: filtering parameters
+ * @switch_time: switch time in extended beacon format
+ * @reserved: reserved bytes
+ */
+struct iwl5000_channel_switch_cmd {
+        u8 band;
+        u8 expect_beacon;
+        __le16 channel;
+        __le32 rxon_flags;
+        __le32 rxon_filter_flags;
+        __le32 switch_time;
+        __le32 reserved[2][IWL_PWR_NUM_HT_OFDM_ENTRIES + IWL_PWR_CCK_ENTRIES];
+} __attribute__ ((packed));
+
+/**
+ * struct iwl6000_channel_switch_cmd
+ * @band: 0- 5.2GHz, 1- 2.4GHz
+ * @expect_beacon: 0- resume transmits after channel switch
+ *                 1- wait for beacon to resume transmits
+ * @channel: new channel number
+ * @rxon_flags: Rx on flags
+ * @rxon_filter_flags: filtering parameters
+ * @switch_time: switch time in extended beacon format
+ * @reserved: reserved bytes
+ */
+struct iwl6000_channel_switch_cmd {
+        u8 band;
+        u8 expect_beacon;
+        __le16 channel;
+        __le32 rxon_flags;
+        __le32 rxon_filter_flags;
+        __le32 switch_time;
+        __le32 reserved[3][IWL_PWR_NUM_HT_OFDM_ENTRIES + IWL_PWR_CCK_ENTRIES];
+} __attribute__ ((packed));
+
 /*
  * CHANNEL_SWITCH_NOTIFICATION = 0x73 (notification only, not a command)
  */
@@ -2172,6 +2218,19 @@ struct iwl_link_quality_cmd {
         __le32 reserved2;
 } __attribute__ ((packed));
 
+#define BT_COEX_DISABLE (0x0)
+#define BT_COEX_MODE_2W (0x1)
+#define BT_COEX_MODE_3W (0x2)
+#define BT_COEX_MODE_4W (0x3)
+
+#define BT_LEAD_TIME_MIN (0x0)
+#define BT_LEAD_TIME_DEF (0x1E)
+#define BT_LEAD_TIME_MAX (0xFF)
+
+#define BT_MAX_KILL_MIN (0x1)
+#define BT_MAX_KILL_DEF (0x5)
+#define BT_MAX_KILL_MAX (0xFF)
+
 /*
  * REPLY_BT_CONFIG = 0x9b (command, has simple generic response)
  *
@@ -3247,12 +3306,6 @@ struct iwl_missed_beacon_notif {
  *   Lower values mean higher energy; this means making sure that the value
  *   in HD_MIN_ENERGY_CCK_DET_INDEX is at or *above* "Max cck energy".
  *
- * Driver should set the following entries to fixed values:
- *
- *   HD_MIN_ENERGY_OFDM_DET_INDEX               100
- *   HD_BARKER_CORR_TH_ADD_MIN_INDEX            190
- *   HD_BARKER_CORR_TH_ADD_MIN_MRC_INDEX        390
- *   HD_OFDM_ENERGY_TH_IN_INDEX                  62
  */
 
 /*
@@ -3505,6 +3558,16 @@ struct iwl_wimax_coex_cmd {
  *****************************************************************************/
 
 struct iwl_rx_packet {
+        /*
+         * The first 4 bytes of the RX frame header contain both the RX frame
+         * size and some flags.
+         * Bit fields:
+         * 31:    flag flush RB request
+         * 30:    flag ignore TC (terminal counter) request
+         * 29:    flag fast IRQ request
+         * 28-14: Reserved
+         * 13-00: RX frame size
+         */
         __le32 len_n_flags;
         struct iwl_cmd_header hdr;
         union {
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index dc7fd87bed98..d2b56baf98fb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -604,6 +604,23 @@ void iwlcore_free_geos(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwlcore_free_geos);
 
+/*
+ *  iwlcore_rts_tx_cmd_flag: Set rts/cts. 3945 and 4965 only share this
+ *  function.
+ */
+void iwlcore_rts_tx_cmd_flag(struct ieee80211_tx_info *info,
+                                __le32 *tx_flags)
+{
+        if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) {
+                *tx_flags |= TX_CMD_FLG_RTS_MSK;
+                *tx_flags &= ~TX_CMD_FLG_CTS_MSK;
+        } else if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
+                *tx_flags &= ~TX_CMD_FLG_RTS_MSK;
+                *tx_flags |= TX_CMD_FLG_CTS_MSK;
+        }
+}
+EXPORT_SYMBOL(iwlcore_rts_tx_cmd_flag);
+
 static bool is_single_rx_stream(struct iwl_priv *priv)
 {
         return !priv->current_ht_config.is_ht ||
@@ -1264,13 +1281,18 @@ static void iwl_set_rate(struct iwl_priv *priv)
 
 void iwl_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_rxon_cmd *rxon = (void *)&priv->active_rxon;
         struct iwl_csa_notification *csa = &(pkt->u.csa_notif);
-        IWL_DEBUG_11H(priv, "CSA notif: channel %d, status %d\n",
-                      le16_to_cpu(csa->channel), le32_to_cpu(csa->status));
-        rxon->channel = csa->channel;
-        priv->staging_rxon.channel = csa->channel;
+
+        if (!le32_to_cpu(csa->status)) {
+                rxon->channel = csa->channel;
+                priv->staging_rxon.channel = csa->channel;
+                IWL_DEBUG_11H(priv, "CSA notif: channel %d\n",
+                      le16_to_cpu(csa->channel));
+        } else
+                IWL_ERR(priv, "CSA notif (fail) : channel %d\n",
+                      le16_to_cpu(csa->channel));
 }
 EXPORT_SYMBOL(iwl_rx_csa);
 
@@ -1352,6 +1374,8 @@ void iwl_apm_stop(struct iwl_priv *priv)
 {
         unsigned long flags;
 
+        IWL_DEBUG_INFO(priv, "Stop card, put in low power state\n");
+
         iwl_apm_stop_master(priv);
 
         spin_lock_irqsave(&priv->lock, flags);
@@ -1365,6 +1389,118 @@ void iwl_apm_stop(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_apm_stop);
 
+
+/*
+ * Start up NIC's basic functionality after it has been reset
+ * (e.g. after platform boot, or shutdown via iwl_apm_stop())
+ * NOTE:  This does not load uCode nor start the embedded processor
+ */
+int iwl_apm_init(struct iwl_priv *priv)
+{
+        int ret = 0;
+        u16 lctl;
+
+        IWL_DEBUG_INFO(priv, "Init card's basic functions\n");
+
+        /*
+         * Use "set_bit" below rather than "write", to preserve any hardware
+         * bits already set by default after reset.
+         */
+
+        /* Disable L0S exit timer (platform NMI Work/Around) */
+        iwl_set_bit(priv, CSR_GIO_CHICKEN_BITS,
+                          CSR_GIO_CHICKEN_BITS_REG_BIT_DIS_L0S_EXIT_TIMER);
+
+        /*
+         * Disable L0s without affecting L1;
+         *  don't wait for ICH L0s (ICH bug W/A)
+         */
+        iwl_set_bit(priv, CSR_GIO_CHICKEN_BITS,
+                          CSR_GIO_CHICKEN_BITS_REG_BIT_L1A_NO_L0S_RX);
+
+        /* Set FH wait threshold to maximum (HW error during stress W/A) */
+        iwl_set_bit(priv, CSR_DBG_HPET_MEM_REG, CSR_DBG_HPET_MEM_REG_VAL);
+
+        /*
+         * Enable HAP INTA (interrupt from management bus) to
+         * wake device's PCI Express link L1a -> L0s
+         * NOTE:  This is no-op for 3945 (non-existant bit)
+         */
+        iwl_set_bit(priv, CSR_HW_IF_CONFIG_REG,
+                                    CSR_HW_IF_CONFIG_REG_BIT_HAP_WAKE_L1A);
+
+        /*
+         * HW bug W/A - costs negligible power consumption ...
+         * Check if BIOS (or OS) enabled L1-ASPM on this device
+         */
+        if (priv->cfg->set_l0s) {
+                lctl = iwl_pcie_link_ctl(priv);
+                if ((lctl & PCI_CFG_LINK_CTRL_VAL_L1_EN) ==
+                                        PCI_CFG_LINK_CTRL_VAL_L1_EN) {
+                        /* L1-ASPM enabled; disable(!) L0S  */
+                        iwl_set_bit(priv, CSR_GIO_REG,
+                                        CSR_GIO_REG_VAL_L0S_ENABLED);
+                        IWL_DEBUG_POWER(priv, "L1 Enabled; Disabling L0S\n");
+                } else {
+                        /* L1-ASPM disabled; enable(!) L0S */
+                        iwl_clear_bit(priv, CSR_GIO_REG,
+                                        CSR_GIO_REG_VAL_L0S_ENABLED);
+                        IWL_DEBUG_POWER(priv, "L1 Disabled; Enabling L0S\n");
+                }
+        }
+
+        /* Configure analog phase-lock-loop before activating to D0A */
+        if (priv->cfg->pll_cfg_val)
+                iwl_set_bit(priv, CSR_ANA_PLL_CFG, priv->cfg->pll_cfg_val);
+
+        /*
+         * Set "initialization complete" bit to move adapter from
+         * D0U* --> D0A* (powered-up active) state.
+         */
+        iwl_set_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
+
+        /*
+         * Wait for clock stabilization; once stabilized, access to
+         * device-internal resources is supported, e.g. iwl_write_prph()
+         * and accesses to uCode SRAM.
+         */
+        ret = iwl_poll_bit(priv, CSR_GP_CNTRL,
+                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
+                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
+        if (ret < 0) {
+                IWL_DEBUG_INFO(priv, "Failed to init the card\n");
+                goto out;
+        }
+
+        /*
+         * Enable DMA and BSM (if used) clocks, wait for them to stabilize.
+         * BSM (Boostrap State Machine) is only in 3945 and 4965;
+         * later devices (i.e. 5000 and later) have non-volatile SRAM,
+         * and don't need BSM to restore data after power-saving sleep.
+         *
+         * Write to "CLK_EN_REG"; "1" bits enable clocks, while "0" bits
+         * do not disable clocks.  This preserves any hardware bits already
+         * set by default in "CLK_CTRL_REG" after reset.
+         */
+        if (priv->cfg->use_bsm)
+                iwl_write_prph(priv, APMG_CLK_EN_REG,
+                        APMG_CLK_VAL_DMA_CLK_RQT | APMG_CLK_VAL_BSM_CLK_RQT);
+        else
+                iwl_write_prph(priv, APMG_CLK_EN_REG,
+                        APMG_CLK_VAL_DMA_CLK_RQT);
+        udelay(20);
+
+        /* Disable L1-Active */
+        iwl_set_bits_prph(priv, APMG_PCIDEV_STT_REG,
+                          APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
+
+out:
+        return ret;
+}
+EXPORT_SYMBOL(iwl_apm_init);
+
+
+
 void iwl_configure_filter(struct ieee80211_hw *hw,
                           unsigned int changed_flags,
                           unsigned int *total_flags,
@@ -1412,73 +1548,14 @@ void iwl_configure_filter(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL(iwl_configure_filter);
 
-int iwl_setup_mac(struct iwl_priv *priv)
-{
-        int ret;
-        struct ieee80211_hw *hw = priv->hw;
-        hw->rate_control_algorithm = "iwl-agn-rs";
-
-        /* Tell mac80211 our characteristics */
-        hw->flags = IEEE80211_HW_SIGNAL_DBM |
-                    IEEE80211_HW_NOISE_DBM |
-                    IEEE80211_HW_AMPDU_AGGREGATION |
-                    IEEE80211_HW_SPECTRUM_MGMT;
-
-        if (!priv->cfg->broken_powersave)
-                hw->flags |= IEEE80211_HW_SUPPORTS_PS |
-                             IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
-
-        hw->wiphy->interface_modes =
-                BIT(NL80211_IFTYPE_STATION) |
-                BIT(NL80211_IFTYPE_ADHOC);
-
-        hw->wiphy->custom_regulatory = true;
-
-        /* Firmware does not support this */
-        hw->wiphy->disable_beacon_hints = true;
-
-        /*
-         * For now, disable PS by default because it affects
-         * RX performance significantly.
-         */
-        hw->wiphy->ps_default = false;
-
-        hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
-        /* we create the 802.11 header and a zero-length SSID element */
-        hw->wiphy->max_scan_ie_len = IWL_MAX_PROBE_REQUEST - 24 - 2;
-
-        /* Default value; 4 EDCA QOS priorities */
-        hw->queues = 4;
-
-        hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
-
-        if (priv->bands[IEEE80211_BAND_2GHZ].n_channels)
-                priv->hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
-                        &priv->bands[IEEE80211_BAND_2GHZ];
-        if (priv->bands[IEEE80211_BAND_5GHZ].n_channels)
-                priv->hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
-                        &priv->bands[IEEE80211_BAND_5GHZ];
-
-        ret = ieee80211_register_hw(priv->hw);
-        if (ret) {
-                IWL_ERR(priv, "Failed to register hw (error %d)\n", ret);
-                return ret;
-        }
-        priv->mac80211_registered = 1;
-
-        return 0;
-}
-EXPORT_SYMBOL(iwl_setup_mac);
-
 int iwl_set_hw_params(struct iwl_priv *priv)
 {
         priv->hw_params.max_rxq_size = RX_QUEUE_SIZE;
         priv->hw_params.max_rxq_log = RX_QUEUE_SIZE_LOG;
         if (priv->cfg->mod_params->amsdu_size_8K)
-                priv->hw_params.rx_buf_size = IWL_RX_BUF_SIZE_8K;
+                priv->hw_params.rx_page_order = get_order(IWL_RX_BUF_SIZE_8K);
         else
-                priv->hw_params.rx_buf_size = IWL_RX_BUF_SIZE_4K;
-        priv->hw_params.max_pkt_size = priv->hw_params.rx_buf_size - 256;
+                priv->hw_params.rx_page_order = get_order(IWL_RX_BUF_SIZE_4K);
 
         priv->hw_params.max_beacon_itrvl = IWL_MAX_UCODE_BEACON_INTERVAL;
 
@@ -1507,7 +1584,6 @@ int iwl_init_drv(struct iwl_priv *priv)
         /* Clear the driver's (not device's) station table */
         iwl_clear_stations_table(priv);
 
-        priv->data_retry_limit = -1;
         priv->ieee_channels = NULL;
         priv->ieee_rates = NULL;
         priv->band = IEEE80211_BAND_2GHZ;
@@ -1932,9 +2008,9 @@ EXPORT_SYMBOL(iwl_isr_legacy);
 int iwl_send_bt_config(struct iwl_priv *priv)
 {
         struct iwl_bt_cmd bt_cmd = {
-                .flags = 3,
-                .lead_time = 0xAA,
-                .max_kill = 1,
+                .flags = BT_COEX_MODE_4W,
+                .lead_time = BT_LEAD_TIME_DEF,
+                .max_kill = BT_MAX_KILL_DEF,
                 .kill_ack_mask = 0,
                 .kill_cts_mask = 0,
         };
@@ -2094,10 +2170,7 @@ void iwl_rf_kill_ct_config(struct iwl_priv *priv)
         spin_unlock_irqrestore(&priv->lock, flags);
         priv->thermal_throttle.ct_kill_toggle = false;
 
-        switch (priv->hw_rev & CSR_HW_REV_TYPE_MSK) {
-        case CSR_HW_REV_TYPE_1000:
-        case CSR_HW_REV_TYPE_6x00:
-        case CSR_HW_REV_TYPE_6x50:
+        if (priv->cfg->support_ct_kill_exit) {
                 adv_cmd.critical_temperature_enter =
                         cpu_to_le32(priv->hw_params.ct_kill_threshold);
                 adv_cmd.critical_temperature_exit =
@@ -2114,8 +2187,7 @@ void iwl_rf_kill_ct_config(struct iwl_priv *priv)
                                         "exit is %d\n",
                                        priv->hw_params.ct_kill_threshold,
                                        priv->hw_params.ct_kill_exit_threshold);
-                break;
-        default:
+        } else {
                 cmd.critical_temperature_R =
                         cpu_to_le32(priv->hw_params.ct_kill_threshold);
 
@@ -2128,7 +2200,6 @@ void iwl_rf_kill_ct_config(struct iwl_priv *priv)
                                         "succeeded, "
                                         "critical temperature is %d\n",
                                         priv->hw_params.ct_kill_threshold);
-                break;
         }
 }
 EXPORT_SYMBOL(iwl_rf_kill_ct_config);
@@ -2160,7 +2231,7 @@ void iwl_rx_pm_sleep_notif(struct iwl_priv *priv,
                            struct iwl_rx_mem_buffer *rxb)
 {
 #ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_sleep_notification *sleep = &(pkt->u.sleep_notif);
         IWL_DEBUG_RX(priv, "sleep mode: %d, src: %d\n",
                      sleep->pm_sleep_mode, sleep->pm_wakeup_src);
@@ -2171,7 +2242,7 @@ EXPORT_SYMBOL(iwl_rx_pm_sleep_notif);
 void iwl_rx_pm_debug_statistics_notif(struct iwl_priv *priv,
                                       struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         u32 len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
         IWL_DEBUG_RADIO(priv, "Dumping %d bytes of unhandled "
                         "notification for %s:\n", len,
@@ -2183,7 +2254,7 @@ EXPORT_SYMBOL(iwl_rx_pm_debug_statistics_notif);
 void iwl_rx_reply_error(struct iwl_priv *priv,
                         struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
 
         IWL_ERR(priv, "Error Reply type 0x%08X cmd %s (0x%02X) "
                 "seq 0x%04X ser 0x%08X\n",
@@ -2648,6 +2719,14 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
                         goto set_ch_out;
                 }
 
+                if (iwl_is_associated(priv) &&
+                    (le16_to_cpu(priv->active_rxon.channel) != ch) &&
+                    priv->cfg->ops->lib->set_channel_switch) {
+                        ret = priv->cfg->ops->lib->set_channel_switch(priv,
+                                ch);
+                        goto out;
+                }
+
                 spin_lock_irqsave(&priv->lock, flags);
 
                 /* Configure HT40 channels */
@@ -2826,6 +2905,27 @@ void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
 }
 EXPORT_SYMBOL(iwl_mac_reset_tsf);
 
+int iwl_alloc_txq_mem(struct iwl_priv *priv)
+{
+        if (!priv->txq)
+                priv->txq = kzalloc(
+                        sizeof(struct iwl_tx_queue) * priv->cfg->num_of_queues,
+                        GFP_KERNEL);
+        if (!priv->txq) {
+                IWL_ERR(priv, "Not enough memory for txq \n");
+                return -ENOMEM;
+        }
+        return 0;
+}
+EXPORT_SYMBOL(iwl_alloc_txq_mem);
+
+void iwl_free_txq_mem(struct iwl_priv *priv)
+{
+        kfree(priv->txq);
+        priv->txq = NULL;
+}
+EXPORT_SYMBOL(iwl_free_txq_mem);
+
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 
 #define IWL_TRAFFIC_DUMP_SIZE   (IWL_TRAFFIC_ENTRY_SIZE * IWL_TRAFFIC_ENTRIES)
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 6688b6944200..b875dcfca2d6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -109,7 +109,6 @@ struct iwl_hcmd_utils_ops {
 
 struct iwl_apm_ops {
         int (*init)(struct iwl_priv *priv);
-        int (*reset)(struct iwl_priv *priv);
         void (*stop)(struct iwl_priv *priv);
         void (*config)(struct iwl_priv *priv);
         int (*set_pwr_src)(struct iwl_priv *priv, enum iwl_pwr_src src);
@@ -170,6 +169,7 @@ struct iwl_lib_ops {
         int (*load_ucode)(struct iwl_priv *priv);
         void (*dump_nic_event_log)(struct iwl_priv *priv);
         void (*dump_nic_error_log)(struct iwl_priv *priv);
+        int (*set_channel_switch)(struct iwl_priv *priv, u16 channel);
         /* power management */
         struct iwl_apm_ops apm_ops;
 
@@ -205,7 +205,6 @@ struct iwl_mod_params {
         int sw_crypto;          /* def: 0 = using hardware encryption */
         int disable_hw_scan;    /* def: 0 = use h/w scan */
         int num_of_queues;      /* def: HW dependent */
-        int num_of_ampdu_queues;/* def: HW dependent */
         int disable_11n;        /* def: 0 = 11n capabilities enabled */
         int amsdu_size_8K;      /* def: 1 = enable 8K amsdu size */
         int antenna;            /* def: 0 = both antennas (use diversity) */
@@ -227,6 +226,8 @@ struct iwl_mod_params {
  *      The detail algorithm is described in iwl-led.c
  * @use_rts_for_ht: use rts/cts protection for HT traffic
  * @chain_noise_num_beacons: number of beacons used to compute chain noise
+ * @adv_thermal_throttle: support advance thermal throttle
+ * @support_ct_kill_exit: support ct kill exit condition
  *
  * We enable the driver to be backward compatible wrt API version. The
  * driver specifies which APIs it supports (with @ucode_api_max being the
@@ -258,11 +259,18 @@ struct iwl_cfg {
         int eeprom_size;
         u16  eeprom_ver;
         u16  eeprom_calib_ver;
+        int num_of_queues;      /* def: HW dependent */
+        int num_of_ampdu_queues;/* def: HW dependent */
         const struct iwl_ops *ops;
         const struct iwl_mod_params *mod_params;
         u8   valid_tx_ant;
         u8   valid_rx_ant;
-        bool need_pll_cfg;
+
+        /* for iwl_apm_init() */
+        u32 pll_cfg_val;
+        bool set_l0s;
+        bool use_bsm;
+
         bool use_isr_legacy;
         enum iwl_pa_type pa_type;
         const u16 max_ll_items;
@@ -273,6 +281,8 @@ struct iwl_cfg {
         bool use_rts_for_ht;
         int chain_noise_num_beacons;
         const bool supports_idle;
+        bool adv_thermal_throttle;
+        bool support_ct_kill_exit;
 };
 
 /***************************
@@ -305,7 +315,6 @@ void iwl_configure_filter(struct ieee80211_hw *hw,
                           unsigned int changed_flags,
                           unsigned int *total_flags, u64 multicast);
 int iwl_hw_nic_init(struct iwl_priv *priv);
-int iwl_setup_mac(struct iwl_priv *priv);
 int iwl_set_hw_params(struct iwl_priv *priv);
 int iwl_init_drv(struct iwl_priv *priv);
 void iwl_uninit_drv(struct iwl_priv *priv);
@@ -327,6 +336,10 @@ void iwl_config_ap(struct iwl_priv *priv);
 int iwl_mac_get_tx_stats(struct ieee80211_hw *hw,
                          struct ieee80211_tx_queue_stats *stats);
 void iwl_mac_reset_tsf(struct ieee80211_hw *hw);
+int iwl_alloc_txq_mem(struct iwl_priv *priv);
+void iwl_free_txq_mem(struct iwl_priv *priv);
+void iwlcore_rts_tx_cmd_flag(struct ieee80211_tx_info *info,
+                                __le32 *tx_flags);
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 int iwl_alloc_traffic_mem(struct iwl_priv *priv);
 void iwl_free_traffic_mem(struct iwl_priv *priv);
@@ -527,7 +540,7 @@ int iwl_send_cmd_pdu_async(struct iwl_priv *priv, u8 id, u16 len,
                            const void *data,
                            void (*callback)(struct iwl_priv *priv,
                                             struct iwl_device_cmd *cmd,
-                                            struct sk_buff *skb));
+                                            struct iwl_rx_packet *pkt));
 
 int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd);
 
@@ -660,6 +673,7 @@ void iwl_rx_reply_compressed_ba(struct iwl_priv *priv,
                                            struct iwl_rx_mem_buffer *rxb);
 void iwl_apm_stop(struct iwl_priv *priv);
 int iwl_apm_stop_master(struct iwl_priv *priv);
+int iwl_apm_init(struct iwl_priv *priv);
 
 void iwl_setup_rxon_timing(struct iwl_priv *priv);
 static inline int iwl_send_rxon_assoc(struct iwl_priv *priv)
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index 8f183e0fa512..b6ed5a3147a1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -109,8 +109,9 @@
  * Bit fields:
  *  3-2:  0 = A, 1 = B, 2 = C, 3 = D step
  */
-#define CSR_HW_REV_WA_REG       (CSR_BASE+0x22C)
-#define CSR_DBG_HPET_MEM_REG    (CSR_BASE+0x240)
+#define CSR_HW_REV_WA_REG               (CSR_BASE+0x22C)
+#define CSR_DBG_HPET_MEM_REG            (CSR_BASE+0x240)
+#define CSR_DBG_LINK_PWR_MGMT_REG       (CSR_BASE+0x250)
 
 /* Bits for CSR_HW_IF_CONFIG_REG */
 #define CSR49_HW_IF_CONFIG_REG_BIT_4965_R       (0x00000010)
@@ -195,6 +196,7 @@
 #define CSR_RESET_REG_FLAG_SW_RESET                  (0x00000080)
 #define CSR_RESET_REG_FLAG_MASTER_DISABLED           (0x00000100)
 #define CSR_RESET_REG_FLAG_STOP_MASTER               (0x00000200)
+#define CSR_RESET_LINK_PWR_MGMT_DISABLED             (0x80000000)
 
 /* GP (general purpose) CONTROL */
 #define CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY        (0x00000001)
@@ -235,6 +237,11 @@
 #define CSR_OTP_GP_REG_OTP_ACCESS_MODE  (0x00020000) /* 0 - absolute, 1 - relative */
 #define CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK          (0x00100000) /* bit 20 */
 #define CSR_OTP_GP_REG_ECC_UNCORR_STATUS_MSK        (0x00200000) /* bit 21 */
+#define CSR_GP_REG_POWER_SAVE_STATUS_MSK            (0x03000000) /* bit 24/25 */
+#define CSR_GP_REG_NO_POWER_SAVE            (0x00000000)
+#define CSR_GP_REG_MAC_POWER_SAVE           (0x01000000)
+#define CSR_GP_REG_PHY_POWER_SAVE           (0x02000000)
+#define CSR_GP_REG_POWER_SAVE_ERROR         (0x03000000)
 
 /* EEPROM signature */
 #define CSR_EEPROM_GP_BAD_SIGNATURE_BOTH_EEP_AND_OTP    (0x00000000)
diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.h b/drivers/net/wireless/iwlwifi/iwl-debug.h
index b9ca475cc61c..96c92eab692a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debug.h
+++ b/drivers/net/wireless/iwlwifi/iwl-debug.h
@@ -106,6 +106,7 @@ struct iwl_debugfs {
                 struct dentry *file_sensitivity;
                 struct dentry *file_chain_noise;
                 struct dentry *file_tx_power;
+                struct dentry *file_power_save_status;
         } dbgfs_debug_files;
         u32 sram_offset;
         u32 sram_len;
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index 1794b9c4e6ac..8784911fd56e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -801,15 +801,20 @@ static ssize_t iwl_dbgfs_sleep_level_override_write(struct file *file,
          * valid here. However, let's not confuse them and present
          * IWL_POWER_INDEX_1 as "1", not "0".
          */
-        if (value > 0)
+        if (value == 0)
+                return -EINVAL;
+        else if (value > 0)
                 value -= 1;
 
         if (value != -1 && (value < 0 || value >= IWL_POWER_NUM))
                 return -EINVAL;
 
+        if (!iwl_is_ready_rf(priv))
+                return -EAGAIN;
+
         priv->power_data.debug_sleep_level_override = value;
 
-        iwl_power_update_mode(priv, false);
+        iwl_power_update_mode(priv, true);
 
         return count;
 }
@@ -882,10 +887,14 @@ static ssize_t iwl_dbgfs_traffic_log_read(struct file *file,
         struct iwl_rx_queue *rxq = &priv->rxq;
         char *buf;
         int bufsz = ((IWL_TRAFFIC_ENTRIES * IWL_TRAFFIC_ENTRY_SIZE * 64) * 2) +
-                (IWL_MAX_NUM_QUEUES * 32 * 8) + 400;
+                (priv->cfg->num_of_queues * 32 * 8) + 400;
         const u8 *ptr;
         ssize_t ret;
 
+        if (!priv->txq) {
+                IWL_ERR(priv, "txq not ready\n");
+                return -EAGAIN;
+        }
         buf = kzalloc(bufsz, GFP_KERNEL);
         if (!buf) {
                 IWL_ERR(priv, "Can not allocate buffer\n");
@@ -977,8 +986,12 @@ static ssize_t iwl_dbgfs_tx_queue_read(struct file *file,
         int pos = 0;
         int cnt;
         int ret;
-        const size_t bufsz = sizeof(char) * 60 * IWL_MAX_NUM_QUEUES;
+        const size_t bufsz = sizeof(char) * 60 * priv->cfg->num_of_queues;
 
+        if (!priv->txq) {
+                IWL_ERR(priv, "txq not ready\n");
+                return -EAGAIN;
+        }
         buf = kzalloc(bufsz, GFP_KERNEL);
         if (!buf)
                 return -ENOMEM;
@@ -1069,10 +1082,10 @@ static ssize_t iwl_dbgfs_ucode_rx_stats_read(struct file *file,
                 sizeof(struct statistics_rx_non_phy) * 20 +
                 sizeof(struct statistics_rx_ht_phy) * 20 + 400;
         ssize_t ret;
-        struct statistics_rx_phy *ofdm;
-        struct statistics_rx_phy *cck;
-        struct statistics_rx_non_phy *general;
-        struct statistics_rx_ht_phy *ht;
+        struct statistics_rx_phy *ofdm, *accum_ofdm;
+        struct statistics_rx_phy *cck, *accum_cck;
+        struct statistics_rx_non_phy *general, *accum_general;
+        struct statistics_rx_ht_phy *ht, *accum_ht;
 
         if (!iwl_is_alive(priv))
                 return -EAGAIN;
@@ -1101,155 +1114,268 @@ static ssize_t iwl_dbgfs_ucode_rx_stats_read(struct file *file,
         cck = &priv->statistics.rx.cck;
         general = &priv->statistics.rx.general;
         ht = &priv->statistics.rx.ofdm_ht;
+        accum_ofdm = &priv->accum_statistics.rx.ofdm;
+        accum_cck = &priv->accum_statistics.rx.cck;
+        accum_general = &priv->accum_statistics.rx.general;
+        accum_ht = &priv->accum_statistics.rx.ofdm_ht;
         pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
         pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - OFDM:\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "ina_cnt: %u\n",
-                         le32_to_cpu(ofdm->ina_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "fina_cnt: %u\n",
-                         le32_to_cpu(ofdm->fina_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "plcp_err: %u\n",
-                         le32_to_cpu(ofdm->plcp_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "crc32_err: %u\n",
-                         le32_to_cpu(ofdm->crc32_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "overrun_err: %u\n",
-                         le32_to_cpu(ofdm->overrun_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "early_overrun_err: %u\n",
-                         le32_to_cpu(ofdm->early_overrun_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "crc32_good: %u\n",
-                         le32_to_cpu(ofdm->crc32_good));
-        pos += scnprintf(buf + pos, bufsz - pos, "false_alarm_cnt: %u\n",
-                         le32_to_cpu(ofdm->false_alarm_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "fina_sync_err_cnt: %u\n",
-                         le32_to_cpu(ofdm->fina_sync_err_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "sfd_timeout: %u\n",
-                         le32_to_cpu(ofdm->sfd_timeout));
-        pos += scnprintf(buf + pos, bufsz - pos, "fina_timeout: %u\n",
-                         le32_to_cpu(ofdm->fina_timeout));
-        pos += scnprintf(buf + pos, bufsz - pos, "unresponded_rts: %u\n",
-                         le32_to_cpu(ofdm->unresponded_rts));
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "rxe_frame_limit_overrun: %u\n",
-                        le32_to_cpu(ofdm->rxe_frame_limit_overrun));
-        pos += scnprintf(buf + pos, bufsz - pos, "sent_ack_cnt: %u\n",
-                         le32_to_cpu(ofdm->sent_ack_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "sent_cts_cnt: %u\n",
-                         le32_to_cpu(ofdm->sent_cts_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "sent_ba_rsp_cnt: %u\n",
-                         le32_to_cpu(ofdm->sent_ba_rsp_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "dsp_self_kill: %u\n",
-                         le32_to_cpu(ofdm->dsp_self_kill));
-        pos += scnprintf(buf + pos, bufsz - pos, "mh_format_err: %u\n",
-                         le32_to_cpu(ofdm->mh_format_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "re_acq_main_rssi_sum: %u\n",
-                         le32_to_cpu(ofdm->re_acq_main_rssi_sum));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "\t\t\tcurrent\t\t\taccumulative\n");
+        pos += scnprintf(buf + pos, bufsz - pos, "ina_cnt:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->ina_cnt), accum_ofdm->ina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, "fina_cnt:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->fina_cnt), accum_ofdm->fina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, "plcp_err:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->plcp_err), accum_ofdm->plcp_err);
+        pos += scnprintf(buf + pos, bufsz - pos, "crc32_err:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->crc32_err), accum_ofdm->crc32_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "overrun_err:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->overrun_err),
+                         accum_ofdm->overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "early_overrun_err:\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->early_overrun_err),
+                         accum_ofdm->early_overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos, "crc32_good:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->crc32_good),
+                         accum_ofdm->crc32_good);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "false_alarm_cnt:\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->false_alarm_cnt),
+                         accum_ofdm->false_alarm_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "fina_sync_err_cnt:\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->fina_sync_err_cnt),
+                         accum_ofdm->fina_sync_err_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "sfd_timeout:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->sfd_timeout),
+                         accum_ofdm->sfd_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "fina_timeout:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->fina_timeout),
+                         accum_ofdm->fina_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "unresponded_rts:\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->unresponded_rts),
+                         accum_ofdm->unresponded_rts);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "rxe_frame_lmt_ovrun:\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->rxe_frame_limit_overrun),
+                         accum_ofdm->rxe_frame_limit_overrun);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "sent_ack_cnt:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->sent_ack_cnt),
+                         accum_ofdm->sent_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "sent_cts_cnt:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->sent_cts_cnt),
+                         accum_ofdm->sent_cts_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "sent_ba_rsp_cnt:\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->sent_ba_rsp_cnt),
+                         accum_ofdm->sent_ba_rsp_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "dsp_self_kill:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->dsp_self_kill),
+                         accum_ofdm->dsp_self_kill);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "mh_format_err:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->mh_format_err),
+                         accum_ofdm->mh_format_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "re_acq_main_rssi_sum:\t%u\t\t\t%u\n",
+                         le32_to_cpu(ofdm->re_acq_main_rssi_sum),
+                         accum_ofdm->re_acq_main_rssi_sum);
 
         pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - CCK:\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "ina_cnt: %u\n",
-                         le32_to_cpu(cck->ina_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "fina_cnt: %u\n",
-                         le32_to_cpu(cck->fina_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "plcp_err: %u\n",
-                         le32_to_cpu(cck->plcp_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "crc32_err: %u\n",
-                         le32_to_cpu(cck->crc32_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "overrun_err: %u\n",
-                         le32_to_cpu(cck->overrun_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "early_overrun_err: %u\n",
-                         le32_to_cpu(cck->early_overrun_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "crc32_good: %u\n",
-                         le32_to_cpu(cck->crc32_good));
-        pos += scnprintf(buf + pos, bufsz - pos, "false_alarm_cnt: %u\n",
-                         le32_to_cpu(cck->false_alarm_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "fina_sync_err_cnt: %u\n",
-                         le32_to_cpu(cck->fina_sync_err_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "sfd_timeout: %u\n",
-                         le32_to_cpu(cck->sfd_timeout));
-        pos += scnprintf(buf + pos, bufsz - pos, "fina_timeout: %u\n",
-                         le32_to_cpu(cck->fina_timeout));
-        pos += scnprintf(buf + pos, bufsz - pos, "unresponded_rts: %u\n",
-                         le32_to_cpu(cck->unresponded_rts));
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "rxe_frame_limit_overrun: %u\n",
-                        le32_to_cpu(cck->rxe_frame_limit_overrun));
-        pos += scnprintf(buf + pos, bufsz - pos, "sent_ack_cnt: %u\n",
-                         le32_to_cpu(cck->sent_ack_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "sent_cts_cnt: %u\n",
-                         le32_to_cpu(cck->sent_cts_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "sent_ba_rsp_cnt: %u\n",
-                         le32_to_cpu(cck->sent_ba_rsp_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "dsp_self_kill: %u\n",
-                         le32_to_cpu(cck->dsp_self_kill));
-        pos += scnprintf(buf + pos, bufsz - pos, "mh_format_err: %u\n",
-                         le32_to_cpu(cck->mh_format_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "re_acq_main_rssi_sum: %u\n",
-                         le32_to_cpu(cck->re_acq_main_rssi_sum));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "\t\t\tcurrent\t\t\taccumulative\n");
+        pos += scnprintf(buf + pos, bufsz - pos, "ina_cnt:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->ina_cnt), accum_cck->ina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, "fina_cnt:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->fina_cnt), accum_cck->fina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, "plcp_err:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->plcp_err), accum_cck->plcp_err);
+        pos += scnprintf(buf + pos, bufsz - pos, "crc32_err:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->crc32_err), accum_cck->crc32_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "overrun_err:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->overrun_err),
+                         accum_cck->overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "early_overrun_err:\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->early_overrun_err),
+                         accum_cck->early_overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos, "crc32_good:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->crc32_good), accum_cck->crc32_good);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "false_alarm_cnt:\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->false_alarm_cnt),
+                         accum_cck->false_alarm_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "fina_sync_err_cnt:\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->fina_sync_err_cnt),
+                         accum_cck->fina_sync_err_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "sfd_timeout:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->sfd_timeout),
+                         accum_cck->sfd_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "fina_timeout:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->fina_timeout),
+                         accum_cck->fina_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "unresponded_rts:\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->unresponded_rts),
+                         accum_cck->unresponded_rts);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "rxe_frame_lmt_ovrun:\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->rxe_frame_limit_overrun),
+                         accum_cck->rxe_frame_limit_overrun);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "sent_ack_cnt:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->sent_ack_cnt),
+                         accum_cck->sent_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "sent_cts_cnt:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->sent_cts_cnt),
+                         accum_cck->sent_cts_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "sent_ba_rsp_cnt:\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->sent_ba_rsp_cnt),
+                         accum_cck->sent_ba_rsp_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "dsp_self_kill:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->dsp_self_kill),
+                         accum_cck->dsp_self_kill);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "mh_format_err:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->mh_format_err),
+                         accum_cck->mh_format_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "re_acq_main_rssi_sum:\t%u\t\t\t%u\n",
+                         le32_to_cpu(cck->re_acq_main_rssi_sum),
+                         accum_cck->re_acq_main_rssi_sum);
 
         pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - GENERAL:\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "bogus_cts: %u\n",
-                         le32_to_cpu(general->bogus_cts));
-        pos += scnprintf(buf + pos, bufsz - pos, "bogus_ack: %u\n",
-                         le32_to_cpu(general->bogus_ack));
-        pos += scnprintf(buf + pos, bufsz - pos, "non_bssid_frames: %u\n",
-                         le32_to_cpu(general->non_bssid_frames));
-        pos += scnprintf(buf + pos, bufsz - pos, "filtered_frames: %u\n",
-                         le32_to_cpu(general->filtered_frames));
-        pos += scnprintf(buf + pos, bufsz - pos, "non_channel_beacons: %u\n",
-                         le32_to_cpu(general->non_channel_beacons));
-        pos += scnprintf(buf + pos, bufsz - pos, "channel_beacons: %u\n",
-                         le32_to_cpu(general->channel_beacons));
-        pos += scnprintf(buf + pos, bufsz - pos, "num_missed_bcon: %u\n",
-                         le32_to_cpu(general->num_missed_bcon));
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "adc_rx_saturation_time: %u\n",
-                        le32_to_cpu(general->adc_rx_saturation_time));
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "ina_detection_search_time: %u\n",
-                        le32_to_cpu(general->ina_detection_search_time));
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_silence_rssi_a: %u\n",
-                         le32_to_cpu(general->beacon_silence_rssi_a));
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_silence_rssi_b: %u\n",
-                         le32_to_cpu(general->beacon_silence_rssi_b));
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_silence_rssi_c: %u\n",
-                         le32_to_cpu(general->beacon_silence_rssi_c));
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "interference_data_flag: %u\n",
-                        le32_to_cpu(general->interference_data_flag));
-        pos += scnprintf(buf + pos, bufsz - pos, "channel_load: %u\n",
-                         le32_to_cpu(general->channel_load));
-        pos += scnprintf(buf + pos, bufsz - pos, "dsp_false_alarms: %u\n",
-                         le32_to_cpu(general->dsp_false_alarms));
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_rssi_a: %u\n",
-                         le32_to_cpu(general->beacon_rssi_a));
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_rssi_b: %u\n",
-                         le32_to_cpu(general->beacon_rssi_b));
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_rssi_c: %u\n",
-                         le32_to_cpu(general->beacon_rssi_c));
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_energy_a: %u\n",
-                         le32_to_cpu(general->beacon_energy_a));
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_energy_b: %u\n",
-                         le32_to_cpu(general->beacon_energy_b));
-        pos += scnprintf(buf + pos, bufsz - pos, "beacon_energy_c: %u\n",
-                         le32_to_cpu(general->beacon_energy_c));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "\t\t\tcurrent\t\t\taccumulative\n");
+        pos += scnprintf(buf + pos, bufsz - pos, "bogus_cts:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->bogus_cts),
+                         accum_general->bogus_cts);
+        pos += scnprintf(buf + pos, bufsz - pos, "bogus_ack:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->bogus_ack),
+                         accum_general->bogus_ack);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "non_bssid_frames:\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->non_bssid_frames),
+                         accum_general->non_bssid_frames);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "filtered_frames:\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->filtered_frames),
+                         accum_general->filtered_frames);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "non_channel_beacons:\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->non_channel_beacons),
+                         accum_general->non_channel_beacons);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "channel_beacons:\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->channel_beacons),
+                         accum_general->channel_beacons);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "num_missed_bcon:\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->num_missed_bcon),
+                         accum_general->num_missed_bcon);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "adc_rx_saturation_time:\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->adc_rx_saturation_time),
+                         accum_general->adc_rx_saturation_time);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "ina_detect_search_tm:\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->ina_detection_search_time),
+                         accum_general->ina_detection_search_time);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "beacon_silence_rssi_a:\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->beacon_silence_rssi_a),
+                         accum_general->beacon_silence_rssi_a);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "beacon_silence_rssi_b:\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->beacon_silence_rssi_b),
+                         accum_general->beacon_silence_rssi_b);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "beacon_silence_rssi_c:\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->beacon_silence_rssi_c),
+                         accum_general->beacon_silence_rssi_c);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "interference_data_flag:\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->interference_data_flag),
+                         accum_general->interference_data_flag);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "channel_load:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->channel_load),
+                         accum_general->channel_load);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "dsp_false_alarms:\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->dsp_false_alarms),
+                         accum_general->dsp_false_alarms);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "beacon_rssi_a:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->beacon_rssi_a),
+                         accum_general->beacon_rssi_a);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "beacon_rssi_b:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->beacon_rssi_b),
+                         accum_general->beacon_rssi_b);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "beacon_rssi_c:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->beacon_rssi_c),
+                         accum_general->beacon_rssi_c);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "beacon_energy_a:\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->beacon_energy_a),
+                         accum_general->beacon_energy_a);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "beacon_energy_b:\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->beacon_energy_b),
+                         accum_general->beacon_energy_b);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "beacon_energy_c:\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->beacon_energy_c),
+                         accum_general->beacon_energy_c);
 
         pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - OFDM_HT:\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "plcp_err: %u\n",
-                         le32_to_cpu(ht->plcp_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "overrun_err: %u\n",
-                         le32_to_cpu(ht->overrun_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "early_overrun_err: %u\n",
-                         le32_to_cpu(ht->early_overrun_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "crc32_good: %u\n",
-                         le32_to_cpu(ht->crc32_good));
-        pos += scnprintf(buf + pos, bufsz - pos, "crc32_err: %u\n",
-                         le32_to_cpu(ht->crc32_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "mh_format_err: %u\n",
-                         le32_to_cpu(ht->mh_format_err));
-        pos += scnprintf(buf + pos, bufsz - pos, "agg_crc32_good: %u\n",
-                         le32_to_cpu(ht->agg_crc32_good));
-        pos += scnprintf(buf + pos, bufsz - pos, "agg_mpdu_cnt: %u\n",
-                         le32_to_cpu(ht->agg_mpdu_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "agg_cnt: %u\n",
-                         le32_to_cpu(ht->agg_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "\t\t\tcurrent\t\t\taccumulative\n");
+        pos += scnprintf(buf + pos, bufsz - pos, "plcp_err:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ht->plcp_err), accum_ht->plcp_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "overrun_err:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ht->overrun_err), accum_ht->overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "early_overrun_err:\t%u\t\t\t%u\n",
+                         le32_to_cpu(ht->early_overrun_err),
+                         accum_ht->early_overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos, "crc32_good:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ht->crc32_good), accum_ht->crc32_good);
+        pos += scnprintf(buf + pos, bufsz - pos, "crc32_err:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ht->crc32_err), accum_ht->crc32_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "mh_format_err:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ht->mh_format_err),
+                         accum_ht->mh_format_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "agg_crc32_good:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ht->agg_crc32_good),
+                         accum_ht->agg_crc32_good);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "agg_mpdu_cnt:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ht->agg_mpdu_cnt),
+                         accum_ht->agg_mpdu_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos, "agg_cnt:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(ht->agg_cnt), accum_ht->agg_cnt);
 
         ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
         kfree(buf);
@@ -1265,7 +1391,7 @@ static ssize_t iwl_dbgfs_ucode_tx_stats_read(struct file *file,
         char *buf;
         int bufsz = (sizeof(struct statistics_tx) * 24) + 250;
         ssize_t ret;
-        struct statistics_tx *tx;
+        struct statistics_tx *tx, *accum_tx;
 
         if (!iwl_is_alive(priv))
                 return -EAGAIN;
@@ -1291,62 +1417,107 @@ static ssize_t iwl_dbgfs_ucode_tx_stats_read(struct file *file,
          * might not reflect the current uCode activity
          */
         tx = &priv->statistics.tx;
+        accum_tx = &priv->accum_statistics.tx;
         pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
         pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Tx:\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "preamble: %u\n",
-                         le32_to_cpu(tx->preamble_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "rx_detected_cnt: %u\n",
-                         le32_to_cpu(tx->rx_detected_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "bt_prio_defer_cnt: %u\n",
-                         le32_to_cpu(tx->bt_prio_defer_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "bt_prio_kill_cnt: %u\n",
-                         le32_to_cpu(tx->bt_prio_kill_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "few_bytes_cnt: %u\n",
-                         le32_to_cpu(tx->few_bytes_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "cts_timeout: %u\n",
-                         le32_to_cpu(tx->cts_timeout));
-        pos += scnprintf(buf + pos, bufsz - pos, "ack_timeout: %u\n",
-                         le32_to_cpu(tx->ack_timeout));
-        pos += scnprintf(buf + pos, bufsz - pos, "expected_ack_cnt: %u\n",
-                         le32_to_cpu(tx->expected_ack_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "actual_ack_cnt: %u\n",
-                         le32_to_cpu(tx->actual_ack_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "dump_msdu_cnt: %u\n",
-                         le32_to_cpu(tx->dump_msdu_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "burst_abort_next_frame_mismatch_cnt: %u\n",
-                        le32_to_cpu(tx->burst_abort_next_frame_mismatch_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "burst_abort_missing_next_frame_cnt: %u\n",
-                        le32_to_cpu(tx->burst_abort_missing_next_frame_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "cts_timeout_collision: %u\n",
-                         le32_to_cpu(tx->cts_timeout_collision));
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "ack_or_ba_timeout_collision: %u\n",
-                        le32_to_cpu(tx->ack_or_ba_timeout_collision));
-        pos += scnprintf(buf + pos, bufsz - pos, "agg ba_timeout: %u\n",
-                         le32_to_cpu(tx->agg.ba_timeout));
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "agg ba_reschedule_frames: %u\n",
-                        le32_to_cpu(tx->agg.ba_reschedule_frames));
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "agg scd_query_agg_frame_cnt: %u\n",
-                        le32_to_cpu(tx->agg.scd_query_agg_frame_cnt));
-        pos += scnprintf(buf + pos, bufsz - pos, "agg scd_query_no_agg: %u\n",
-                         le32_to_cpu(tx->agg.scd_query_no_agg));
-        pos += scnprintf(buf + pos, bufsz - pos, "agg scd_query_agg: %u\n",
-                         le32_to_cpu(tx->agg.scd_query_agg));
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "agg scd_query_mismatch: %u\n",
-                        le32_to_cpu(tx->agg.scd_query_mismatch));
-        pos += scnprintf(buf + pos, bufsz - pos, "agg frame_not_ready: %u\n",
-                         le32_to_cpu(tx->agg.frame_not_ready));
-        pos += scnprintf(buf + pos, bufsz - pos, "agg underrun: %u\n",
-                         le32_to_cpu(tx->agg.underrun));
-        pos += scnprintf(buf + pos, bufsz - pos, "agg bt_prio_kill: %u\n",
-                         le32_to_cpu(tx->agg.bt_prio_kill));
-        pos += scnprintf(buf + pos, bufsz - pos, "agg rx_ba_rsp_cnt: %u\n",
-                         le32_to_cpu(tx->agg.rx_ba_rsp_cnt));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "\t\t\tcurrent\t\t\taccumulative\n");
+        pos += scnprintf(buf + pos, bufsz - pos, "preamble:\t\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->preamble_cnt),
+                         accum_tx->preamble_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "rx_detected_cnt:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->rx_detected_cnt),
+                         accum_tx->rx_detected_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "bt_prio_defer_cnt:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->bt_prio_defer_cnt),
+                         accum_tx->bt_prio_defer_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "bt_prio_kill_cnt:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->bt_prio_kill_cnt),
+                         accum_tx->bt_prio_kill_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "few_bytes_cnt:\t\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->few_bytes_cnt),
+                         accum_tx->few_bytes_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "cts_timeout:\t\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->cts_timeout), accum_tx->cts_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "ack_timeout:\t\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->ack_timeout),
+                         accum_tx->ack_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "expected_ack_cnt:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->expected_ack_cnt),
+                         accum_tx->expected_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "actual_ack_cnt:\t\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->actual_ack_cnt),
+                         accum_tx->actual_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "dump_msdu_cnt:\t\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->dump_msdu_cnt),
+                         accum_tx->dump_msdu_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "abort_nxt_frame_mismatch:"
+                         "\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->burst_abort_next_frame_mismatch_cnt),
+                         accum_tx->burst_abort_next_frame_mismatch_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "abort_missing_nxt_frame:"
+                         "\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->burst_abort_missing_next_frame_cnt),
+                         accum_tx->burst_abort_missing_next_frame_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "cts_timeout_collision:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->cts_timeout_collision),
+                         accum_tx->cts_timeout_collision);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "ack_ba_timeout_collision:\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->ack_or_ba_timeout_collision),
+                         accum_tx->ack_or_ba_timeout_collision);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "agg ba_timeout:\t\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->agg.ba_timeout),
+                         accum_tx->agg.ba_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "agg ba_resched_frames:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->agg.ba_reschedule_frames),
+                         accum_tx->agg.ba_reschedule_frames);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "agg scd_query_agg_frame:\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->agg.scd_query_agg_frame_cnt),
+                         accum_tx->agg.scd_query_agg_frame_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "agg scd_query_no_agg:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->agg.scd_query_no_agg),
+                         accum_tx->agg.scd_query_no_agg);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "agg scd_query_agg:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->agg.scd_query_agg),
+                         accum_tx->agg.scd_query_agg);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "agg scd_query_mismatch:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->agg.scd_query_mismatch),
+                         accum_tx->agg.scd_query_mismatch);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "agg frame_not_ready:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->agg.frame_not_ready),
+                         accum_tx->agg.frame_not_ready);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "agg underrun:\t\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->agg.underrun),
+                         accum_tx->agg.underrun);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "agg bt_prio_kill:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->agg.bt_prio_kill),
+                         accum_tx->agg.bt_prio_kill);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "agg rx_ba_rsp_cnt:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(tx->agg.rx_ba_rsp_cnt),
+                         accum_tx->agg.rx_ba_rsp_cnt);
 
         ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
         kfree(buf);
@@ -1362,9 +1533,9 @@ static ssize_t iwl_dbgfs_ucode_general_stats_read(struct file *file,
         char *buf;
         int bufsz = sizeof(struct statistics_general) * 4 + 250;
         ssize_t ret;
-        struct statistics_general *general;
-        struct statistics_dbg *dbg;
-        struct statistics_div *div;
+        struct statistics_general *general, *accum_general;
+        struct statistics_dbg *dbg, *accum_dbg;
+        struct statistics_div *div, *accum_div;
 
         if (!iwl_is_alive(priv))
                 return -EAGAIN;
@@ -1392,34 +1563,53 @@ static ssize_t iwl_dbgfs_ucode_general_stats_read(struct file *file,
         general = &priv->statistics.general;
         dbg = &priv->statistics.general.dbg;
         div = &priv->statistics.general.div;
+        accum_general = &priv->accum_statistics.general;
+        accum_dbg = &priv->accum_statistics.general.dbg;
+        accum_div = &priv->accum_statistics.general.div;
         pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
         pos += scnprintf(buf + pos, bufsz - pos, "Statistics_General:\n");
-        pos += scnprintf(buf + pos, bufsz - pos, "temperature: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
+                        "\t\t\tcurrent\t\t\taccumulative\n");
+        pos += scnprintf(buf + pos, bufsz - pos, "temperature:\t\t\t%u\n",
                          le32_to_cpu(general->temperature));
-        pos += scnprintf(buf + pos, bufsz - pos, "temperature_m: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos, "temperature_m:\t\t\t%u\n",
                          le32_to_cpu(general->temperature_m));
-        pos += scnprintf(buf + pos, bufsz - pos, "burst_check: %u\n",
-                         le32_to_cpu(dbg->burst_check));
-        pos += scnprintf(buf + pos, bufsz - pos, "burst_count: %u\n",
-                         le32_to_cpu(dbg->burst_count));
-        pos += scnprintf(buf + pos, bufsz - pos, "sleep_time: %u\n",
-                         le32_to_cpu(general->sleep_time));
-        pos += scnprintf(buf + pos, bufsz - pos, "slots_out: %u\n",
-                         le32_to_cpu(general->slots_out));
-        pos += scnprintf(buf + pos, bufsz - pos, "slots_idle: %u\n",
-                         le32_to_cpu(general->slots_idle));
-        pos += scnprintf(buf + pos, bufsz - pos, "ttl_timestamp: %u\n",
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "burst_check:\t\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(dbg->burst_check),
+                         accum_dbg->burst_check);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "burst_count:\t\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(dbg->burst_count),
+                         accum_dbg->burst_count);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "sleep_time:\t\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->sleep_time),
+                         accum_general->sleep_time);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "slots_out:\t\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->slots_out),
+                         accum_general->slots_out);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "slots_idle:\t\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->slots_idle),
+                         accum_general->slots_idle);
+        pos += scnprintf(buf + pos, bufsz - pos, "ttl_timestamp:\t\t\t%u\n",
                          le32_to_cpu(general->ttl_timestamp));
-        pos += scnprintf(buf + pos, bufsz - pos, "tx_on_a: %u\n",
-                         le32_to_cpu(div->tx_on_a));
-        pos += scnprintf(buf + pos, bufsz - pos, "tx_on_b: %u\n",
-                         le32_to_cpu(div->tx_on_b));
-        pos += scnprintf(buf + pos, bufsz - pos, "exec_time: %u\n",
-                         le32_to_cpu(div->exec_time));
-        pos += scnprintf(buf + pos, bufsz - pos, "probe_time: %u\n",
-                         le32_to_cpu(div->probe_time));
-        pos += scnprintf(buf + pos, bufsz - pos, "rx_enable_counter: %u\n",
-                         le32_to_cpu(general->rx_enable_counter));
+        pos += scnprintf(buf + pos, bufsz - pos, "tx_on_a:\t\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(div->tx_on_a), accum_div->tx_on_a);
+        pos += scnprintf(buf + pos, bufsz - pos, "tx_on_b:\t\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(div->tx_on_b), accum_div->tx_on_b);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "exec_time:\t\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(div->exec_time), accum_div->exec_time);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "probe_time:\t\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(div->probe_time), accum_div->probe_time);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "rx_enable_counter:\t\t%u\t\t\t%u\n",
+                         le32_to_cpu(general->rx_enable_counter),
+                         accum_general->rx_enable_counter);
         ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
         kfree(buf);
         return ret;
@@ -1615,6 +1805,29 @@ static ssize_t iwl_dbgfs_tx_power_read(struct file *file,
         return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
+static ssize_t iwl_dbgfs_power_save_status_read(struct file *file,
+                                                    char __user *user_buf,
+                                                    size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        char buf[60];
+        int pos = 0;
+        const size_t bufsz = sizeof(buf);
+        u32 pwrsave_status;
+
+        pwrsave_status = iwl_read32(priv, CSR_GP_CNTRL) &
+                        CSR_GP_REG_POWER_SAVE_STATUS_MSK;
+
+        pos += scnprintf(buf + pos, bufsz - pos, "Power Save Status: ");
+        pos += scnprintf(buf + pos, bufsz - pos, "%s\n",
+                (pwrsave_status == CSR_GP_REG_NO_POWER_SAVE) ? "none" :
+                (pwrsave_status == CSR_GP_REG_MAC_POWER_SAVE) ? "MAC" :
+                (pwrsave_status == CSR_GP_REG_PHY_POWER_SAVE) ? "PHY" :
+                "error");
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+}
+
 DEBUGFS_READ_WRITE_FILE_OPS(rx_statistics);
 DEBUGFS_READ_WRITE_FILE_OPS(tx_statistics);
 DEBUGFS_READ_WRITE_FILE_OPS(traffic_log);
@@ -1626,6 +1839,7 @@ DEBUGFS_READ_FILE_OPS(ucode_general_stats);
 DEBUGFS_READ_FILE_OPS(sensitivity);
 DEBUGFS_READ_FILE_OPS(chain_noise);
 DEBUGFS_READ_FILE_OPS(tx_power);
+DEBUGFS_READ_FILE_OPS(power_save_status);
 
 /*
  * Create the debugfs files and directories
@@ -1673,6 +1887,7 @@ int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
         DEBUGFS_ADD_FILE(rx_queue, debug);
         DEBUGFS_ADD_FILE(tx_queue, debug);
         DEBUGFS_ADD_FILE(tx_power, debug);
+        DEBUGFS_ADD_FILE(power_save_status, debug);
         if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) != CSR_HW_REV_TYPE_3945) {
                 DEBUGFS_ADD_FILE(ucode_rx_stats, debug);
                 DEBUGFS_ADD_FILE(ucode_tx_stats, debug);
@@ -1725,6 +1940,7 @@ void iwl_dbgfs_unregister(struct iwl_priv *priv)
         DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_rx_queue);
         DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_tx_queue);
         DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_tx_power);
+        DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.file_power_save_status);
         if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) != CSR_HW_REV_TYPE_3945) {
                 DEBUGFS_REMOVE(priv->dbgfs->dbgfs_debug_files.
                         file_ucode_rx_stats);
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 72946c144be7..e7ce67387662 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -85,8 +85,6 @@ extern void iwl5000_rts_tx_cmd_flag(struct ieee80211_tx_info *info,
                                     __le32 *tx_flags);
 extern int iwl5000_calc_rssi(struct iwl_priv *priv,
                              struct iwl_rx_phy_res *rx_resp);
-extern int iwl5000_apm_init(struct iwl_priv *priv);
-extern int iwl5000_apm_reset(struct iwl_priv *priv);
 extern void iwl5000_nic_config(struct iwl_priv *priv);
 extern u16 iwl5000_eeprom_calib_version(struct iwl_priv *priv);
 extern const u8 *iwl5000_eeprom_query_addr(const struct iwl_priv *priv,
@@ -147,12 +145,13 @@ extern void iwl5000_temperature(struct iwl_priv *priv);
 #define DEFAULT_LONG_RETRY_LIMIT  4U
 
 struct iwl_rx_mem_buffer {
-        dma_addr_t real_dma_addr;
-        dma_addr_t aligned_dma_addr;
-        struct sk_buff *skb;
+        dma_addr_t page_dma;
+        struct page *page;
         struct list_head list;
 };
 
+#define rxb_addr(r) page_address(r->page)
+
 /* defined below */
 struct iwl_device_cmd;
 
@@ -168,7 +167,7 @@ struct iwl_cmd_meta {
          */
         void (*callback)(struct iwl_priv *priv,
                          struct iwl_device_cmd *cmd,
-                         struct sk_buff *skb);
+                         struct iwl_rx_packet *pkt);
 
         /* The CMD_SIZE_HUGE flag bit indicates that the command
          * structure is stored at the end of the shared queue memory. */
@@ -324,6 +323,12 @@ struct iwl_channel_info {
  * queue, 2 (unused) HCCA queues, and 4 HT queues (one for each AC) */
 #define IWL_MIN_NUM_QUEUES      10
 
+/*
+ * uCode queue management definitions ...
+ * Queue #4 is the command queue for 3945/4965/5x00/1000/6x00.
+ */
+#define IWL_CMD_QUEUE_NUM       4
+
 /* Power management (not Tx power) structures */
 
 enum iwl_pwr_src {
@@ -359,7 +364,14 @@ enum {
         CMD_WANT_SKB = (1 << 2),
 };
 
-#define IWL_CMD_MAX_PAYLOAD 320
+#define DEF_CMD_PAYLOAD_SIZE 320
+
+/*
+ * IWL_LINK_HDR_MAX should include ieee80211_hdr, radiotap header,
+ * SNAP header and alignment. It should also be big enough for 802.11
+ * control frames.
+ */
+#define IWL_LINK_HDR_MAX 64
 
 /**
  * struct iwl_device_cmd
@@ -376,7 +388,8 @@ struct iwl_device_cmd {
                 u16 val16;
                 u32 val32;
                 struct iwl_tx_cmd tx;
-                u8 payload[IWL_CMD_MAX_PAYLOAD];
+                struct iwl6000_channel_switch_cmd chswitch;
+                u8 payload[DEF_CMD_PAYLOAD_SIZE];
         } __attribute__ ((packed)) cmd;
 } __attribute__ ((packed));
 
@@ -385,21 +398,15 @@ struct iwl_device_cmd {
 
 struct iwl_host_cmd {
         const void *data;
-        struct sk_buff *reply_skb;
+        unsigned long reply_page;
         void (*callback)(struct iwl_priv *priv,
                          struct iwl_device_cmd *cmd,
-                         struct sk_buff *skb);
+                         struct iwl_rx_packet *pkt);
         u32 flags;
         u16 len;
         u8 id;
 };
 
-/*
- * RX related structures and functions
- */
-#define RX_FREE_BUFFERS 64
-#define RX_LOW_WATERMARK 8
-
 #define SUP_RATE_11A_MAX_NUM_CHANNELS  8
 #define SUP_RATE_11B_MAX_NUM_CHANNELS  4
 #define SUP_RATE_11G_MAX_NUM_CHANNELS  12
@@ -563,6 +570,19 @@ struct iwl_station_entry {
         struct iwl_hw_key keyinfo;
 };
 
+/*
+ * iwl_station_priv: Driver's private station information
+ *
+ * When mac80211 creates a station it reserves some space (hw->sta_data_size)
+ * in the structure for use by driver. This structure is places in that
+ * space.
+ *
+ * At the moment use it for the station's rate scaling information.
+ */
+struct iwl_station_priv {
+        struct iwl_lq_sta lq_sta;
+};
+
 /* one for each uCode image (inst/data, boot/init/runtime) */
 struct fw_desc {
         void *v_addr;           /* access by driver */
@@ -624,6 +644,10 @@ struct iwl_sensitivity_ranges {
         u16 auto_corr_max_cck_mrc;
         u16 auto_corr_min_cck;
         u16 auto_corr_min_cck_mrc;
+
+        u16 barker_corr_th_min;
+        u16 barker_corr_th_min_mrc;
+        u16 nrg_th_cca;
 };
 
 
@@ -641,7 +665,7 @@ struct iwl_sensitivity_ranges {
  * @valid_tx/rx_ant: usable antennas
  * @max_rxq_size: Max # Rx frames in Rx queue (must be power-of-2)
  * @max_rxq_log: Log-base-2 of max_rxq_size
- * @rx_buf_size: Rx buffer size
+ * @rx_page_order: Rx buffer page order
  * @rx_wrt_ptr_reg: FH{39}_RSCSR_CHNL0_WPTR
  * @max_stations:
  * @bcast_sta_id:
@@ -664,9 +688,8 @@ struct iwl_hw_params {
         u8  valid_rx_ant;
         u16 max_rxq_size;
         u16 max_rxq_log;
-        u32 rx_buf_size;
+        u32 rx_page_order;
         u32 rx_wrt_ptr_reg;
-        u32 max_pkt_size;
         u8  max_stations;
         u8  bcast_sta_id;
         u8  ht40_channel;
@@ -713,7 +736,11 @@ static inline int iwl_queue_used(const struct iwl_queue *q, int i)
 
 static inline u8 get_cmd_index(struct iwl_queue *q, u32 index, int is_huge)
 {
-        /* This is for scan command, the big buffer at end of command array */
+        /*
+         * This is for init calibration result and scan command which
+         * required buffer > TFD_MAX_PAYLOAD_SIZE,
+         * the big buffer at end of command array
+         */
         if (is_huge)
                 return q->n_window;     /* must be power of 2 */
 
@@ -845,6 +872,10 @@ struct iwl_sensitivity_data {
         s32 nrg_auto_corr_silence_diff;
         u32 num_in_cck_no_fa;
         u32 nrg_th_ofdm;
+
+        u16 barker_corr_th_min;
+        u16 barker_corr_th_min_mrc;
+        u16 nrg_th_cca;
 };
 
 /* Chain noise (differential Rx gain) calib data */
@@ -961,8 +992,6 @@ struct traffic_stats {
 };
 #endif
 
-#define IWL_MAX_NUM_QUEUES      20 /* FIXME: do dynamic allocation */
-
 struct iwl_priv {
 
         /* ieee device used by generic ieee processing code */
@@ -976,7 +1005,7 @@ struct iwl_priv {
         int frames_count;
 
         enum ieee80211_band band;
-        int alloc_rxb_skb;
+        int alloc_rxb_page;
 
         void (*rx_handlers[REPLY_MAX])(struct iwl_priv *priv,
                                        struct iwl_rx_mem_buffer *rxb);
@@ -1081,7 +1110,6 @@ struct iwl_priv {
         u8 last_phy_res[100];
 
         /* Rate scaling data */
-        s8 data_retry_limit;
         u8 retry_rate;
 
         wait_queue_head_t wait_command_queue;
@@ -1090,7 +1118,7 @@ struct iwl_priv {
 
         /* Rx and Tx DMA processing queues */
         struct iwl_rx_queue rxq;
-        struct iwl_tx_queue txq[IWL_MAX_NUM_QUEUES];
+        struct iwl_tx_queue *txq;
         unsigned long txq_ctx_active_msk;
         struct iwl_dma_ptr  kw; /* keep warm address */
         struct iwl_dma_ptr  scd_bc_tbls;
@@ -1113,7 +1141,9 @@ struct iwl_priv {
         struct iwl_tt_mgmt thermal_throttle;
 
         struct iwl_notif_statistics statistics;
-        unsigned long last_statistics_time;
+#ifdef CONFIG_IWLWIFI_DEBUG
+        struct iwl_notif_statistics accum_statistics;
+#endif
 
         /* context information */
         u16 rates_mask;
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
index 2e8c40576d22..9429cb1c69bd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
@@ -358,6 +358,14 @@ static int iwl_init_otp_access(struct iwl_priv *priv)
                 udelay(5);
                 iwl_clear_bits_prph(priv, APMG_PS_CTRL_REG,
                                     APMG_PS_CTRL_VAL_RESET_REQ);
+
+                /*
+                 * CSR auto clock gate disable bit -
+                 * this is only applicable for HW with OTP shadow RAM
+                 */
+                if (priv->cfg->shadow_ram_support)
+                        iwl_set_bit(priv, CSR_DBG_LINK_PWR_MGMT_REG,
+                                CSR_RESET_LINK_PWR_MGMT_DISABLED);
         }
         return ret;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
index b363c96fd6c6..5ba5a4e9e49a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -261,9 +261,12 @@ struct iwl_eeprom_enhanced_txpwr {
 /* 1000 Specific */
 #define EEPROM_1000_EEPROM_VERSION      (0x15C)
 
-/* 60x0 Specific */
+/* 6x00 Specific */
 #define EEPROM_6000_EEPROM_VERSION      (0x434)
 
+/* 6x50 Specific */
+#define EEPROM_6050_EEPROM_VERSION      (0x532)
+
 /* OTP */
 /* lower blocks contain EEPROM image and calibration data */
 #define OTP_LOW_IMAGE_SIZE              (2 * 512 * sizeof(u16)) /* 2 KB */
diff --git a/drivers/net/wireless/iwlwifi/iwl-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
index 532c8d6cd8da..f2a60dc4109f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-hcmd.c
+++ b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
@@ -92,6 +92,8 @@ const char *get_cmd_string(u8 cmd)
                 IWL_CMD(CALIBRATION_RES_NOTIFICATION);
                 IWL_CMD(CALIBRATION_COMPLETE_NOTIFICATION);
                 IWL_CMD(REPLY_TX_POWER_DBM_CMD);
+                IWL_CMD(TEMPERATURE_NOTIFICATION);
+                IWL_CMD(TX_ANT_CONFIGURATION_CMD);
         default:
                 return "UNKNOWN";
 
@@ -103,17 +105,8 @@ EXPORT_SYMBOL(get_cmd_string);
 
 static void iwl_generic_cmd_callback(struct iwl_priv *priv,
                                      struct iwl_device_cmd *cmd,
-                                     struct sk_buff *skb)
+                                     struct iwl_rx_packet *pkt)
 {
-        struct iwl_rx_packet *pkt = NULL;
-
-        if (!skb) {
-                IWL_ERR(priv, "Error: Response NULL in %s.\n",
-                                get_cmd_string(cmd->hdr.cmd));
-                return;
-        }
-
-        pkt = (struct iwl_rx_packet *)skb->data;
         if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
                 IWL_ERR(priv, "Bad return from %s (0x%08X)\n",
                         get_cmd_string(cmd->hdr.cmd), pkt->hdr.flags);
@@ -215,7 +208,7 @@ int iwl_send_cmd_sync(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
                 ret = -EIO;
                 goto fail;
         }
-        if ((cmd->flags & CMD_WANT_SKB) && !cmd->reply_skb) {
+        if ((cmd->flags & CMD_WANT_SKB) && !cmd->reply_page) {
                 IWL_ERR(priv, "Error: Response NULL in '%s'\n",
                           get_cmd_string(cmd->id));
                 ret = -EIO;
@@ -237,9 +230,9 @@ cancel:
                                                         ~CMD_WANT_SKB;
         }
 fail:
-        if (cmd->reply_skb) {
-                dev_kfree_skb_any(cmd->reply_skb);
-                cmd->reply_skb = NULL;
+        if (cmd->reply_page) {
+                free_pages(cmd->reply_page, priv->hw_params.rx_page_order);
+                cmd->reply_page = 0;
         }
 out:
         clear_bit(STATUS_HCMD_SYNC_ACTIVE, &priv->status);
@@ -272,7 +265,7 @@ int iwl_send_cmd_pdu_async(struct iwl_priv *priv,
                            u8 id, u16 len, const void *data,
                            void (*callback)(struct iwl_priv *priv,
                                             struct iwl_device_cmd *cmd,
-                                            struct sk_buff *skb))
+                                            struct iwl_rx_packet *pkt))
 {
         struct iwl_host_cmd cmd = {
                 .id = id,
diff --git a/drivers/net/wireless/iwlwifi/iwl-power.c b/drivers/net/wireless/iwlwifi/iwl-power.c
index 9c6b14952061..9bce2c1625e3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-power.c
+++ b/drivers/net/wireless/iwlwifi/iwl-power.c
@@ -66,7 +66,7 @@ MODULE_PARM_DESC(no_sleep_autoadjust,
 
 struct iwl_power_vec_entry {
         struct iwl_powertable_cmd cmd;
-        u8 no_dtim;
+        u8 no_dtim;     /* number of skip dtim */
 };
 
 #define IWL_DTIM_RANGE_0_MAX    2
@@ -83,8 +83,9 @@ struct iwl_power_vec_entry {
                                      cpu_to_le32(X4)}
 /* default power management (not Tx power) table values */
 /* for DTIM period 0 through IWL_DTIM_RANGE_0_MAX */
+/* DTIM 0 - 2 */
 static const struct iwl_power_vec_entry range_0[IWL_POWER_NUM] = {
-        {{SLP, SLP_TOUT(200), SLP_TOUT(500), SLP_VEC(1, 2, 2, 2, 0xFF)}, 0},
+        {{SLP, SLP_TOUT(200), SLP_TOUT(500), SLP_VEC(1, 1, 2, 2, 0xFF)}, 0},
         {{SLP, SLP_TOUT(200), SLP_TOUT(300), SLP_VEC(1, 2, 2, 2, 0xFF)}, 0},
         {{SLP, SLP_TOUT(50), SLP_TOUT(100), SLP_VEC(2, 2, 2, 2, 0xFF)}, 0},
         {{SLP, SLP_TOUT(50), SLP_TOUT(25), SLP_VEC(2, 2, 4, 4, 0xFF)}, 1},
@@ -93,15 +94,17 @@ static const struct iwl_power_vec_entry range_0[IWL_POWER_NUM] = {
 
 
 /* for DTIM period IWL_DTIM_RANGE_0_MAX + 1 through IWL_DTIM_RANGE_1_MAX */
+/* DTIM 3 - 10 */
 static const struct iwl_power_vec_entry range_1[IWL_POWER_NUM] = {
         {{SLP, SLP_TOUT(200), SLP_TOUT(500), SLP_VEC(1, 2, 3, 4, 4)}, 0},
         {{SLP, SLP_TOUT(200), SLP_TOUT(300), SLP_VEC(1, 2, 3, 4, 7)}, 0},
         {{SLP, SLP_TOUT(50), SLP_TOUT(100), SLP_VEC(2, 4, 6, 7, 9)}, 0},
         {{SLP, SLP_TOUT(50), SLP_TOUT(25), SLP_VEC(2, 4, 6, 9, 10)}, 1},
-        {{SLP, SLP_TOUT(25), SLP_TOUT(25), SLP_VEC(2, 4, 7, 10, 10)}, 2}
+        {{SLP, SLP_TOUT(25), SLP_TOUT(25), SLP_VEC(2, 4, 6, 10, 10)}, 2}
 };
 
 /* for DTIM period > IWL_DTIM_RANGE_1_MAX */
+/* DTIM 11 - */
 static const struct iwl_power_vec_entry range_2[IWL_POWER_NUM] = {
         {{SLP, SLP_TOUT(200), SLP_TOUT(500), SLP_VEC(1, 2, 3, 4, 0xFF)}, 0},
         {{SLP, SLP_TOUT(200), SLP_TOUT(300), SLP_VEC(2, 4, 6, 7, 0xFF)}, 0},
@@ -115,13 +118,15 @@ static void iwl_static_sleep_cmd(struct iwl_priv *priv,
                                  enum iwl_power_level lvl, int period)
 {
         const struct iwl_power_vec_entry *table;
-        int max_sleep, i;
-        bool skip;
+        int max_sleep[IWL_POWER_VEC_SIZE] = { 0 };
+        int i;
+        u8 skip;
+        u32 slp_itrvl;
 
         table = range_2;
-        if (period < IWL_DTIM_RANGE_1_MAX)
+        if (period <= IWL_DTIM_RANGE_1_MAX)
                 table = range_1;
-        if (period < IWL_DTIM_RANGE_0_MAX)
+        if (period <= IWL_DTIM_RANGE_0_MAX)
                 table = range_0;
 
         BUG_ON(lvl < 0 || lvl >= IWL_POWER_NUM);
@@ -129,34 +134,60 @@ static void iwl_static_sleep_cmd(struct iwl_priv *priv,
         *cmd = table[lvl].cmd;
 
         if (period == 0) {
-                skip = false;
+                skip = 0;
                 period = 1;
+                for (i = 0; i < IWL_POWER_VEC_SIZE; i++)
+                        max_sleep[i] =  1;
+
         } else {
-                skip = !!table[lvl].no_dtim;
+                skip = table[lvl].no_dtim;
+                for (i = 0; i < IWL_POWER_VEC_SIZE; i++)
+                        max_sleep[i] = le32_to_cpu(cmd->sleep_interval[i]);
+                max_sleep[IWL_POWER_VEC_SIZE - 1] = skip + 1;
         }
 
-        if (skip) {
-                __le32 slp_itrvl = cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1];
-                max_sleep = le32_to_cpu(slp_itrvl);
-                if (max_sleep == 0xFF)
-                        max_sleep = period * (skip + 1);
-                else if (max_sleep > period)
-                        max_sleep = (le32_to_cpu(slp_itrvl) / period) * period;
+        slp_itrvl = le32_to_cpu(cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1]);
+        /* figure out the listen interval based on dtim period and skip */
+        if (slp_itrvl == 0xFF)
+                cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1] =
+                        cpu_to_le32(period * (skip + 1));
+
+        slp_itrvl = le32_to_cpu(cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1]);
+        if (slp_itrvl > period)
+                cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1] =
+                        cpu_to_le32((slp_itrvl / period) * period);
+
+        if (skip)
                 cmd->flags |= IWL_POWER_SLEEP_OVER_DTIM_MSK;
-        } else {
-                max_sleep = period;
+        else
                 cmd->flags &= ~IWL_POWER_SLEEP_OVER_DTIM_MSK;
-        }
 
-        for (i = 0; i < IWL_POWER_VEC_SIZE; i++)
-                if (le32_to_cpu(cmd->sleep_interval[i]) > max_sleep)
-                        cmd->sleep_interval[i] = cpu_to_le32(max_sleep);
+        slp_itrvl = le32_to_cpu(cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1]);
+        if (slp_itrvl > IWL_CONN_MAX_LISTEN_INTERVAL)
+                cmd->sleep_interval[IWL_POWER_VEC_SIZE - 1] =
+                        cpu_to_le32(IWL_CONN_MAX_LISTEN_INTERVAL);
+
+        /* enforce max sleep interval */
+        for (i = IWL_POWER_VEC_SIZE - 1; i >= 0 ; i--) {
+                if (le32_to_cpu(cmd->sleep_interval[i]) >
+                    (max_sleep[i] * period))
+                        cmd->sleep_interval[i] =
+                                cpu_to_le32(max_sleep[i] * period);
+                if (i != (IWL_POWER_VEC_SIZE - 1)) {
+                        if (le32_to_cpu(cmd->sleep_interval[i]) >
+                            le32_to_cpu(cmd->sleep_interval[i+1]))
+                                cmd->sleep_interval[i] =
+                                        cmd->sleep_interval[i+1];
+                }
+        }
 
         if (priv->power_data.pci_pm)
                 cmd->flags |= IWL_POWER_PCI_PM_MSK;
         else
                 cmd->flags &= ~IWL_POWER_PCI_PM_MSK;
 
+        IWL_DEBUG_POWER(priv, "numSkipDtim = %u, dtimPeriod = %d\n",
+                        skip, period);
         IWL_DEBUG_POWER(priv, "Sleep command for index %d\n", lvl + 1);
 }
 
@@ -862,9 +893,7 @@ void iwl_tt_initialize(struct iwl_priv *priv)
         INIT_WORK(&priv->ct_enter, iwl_bg_ct_enter);
         INIT_WORK(&priv->ct_exit, iwl_bg_ct_exit);
 
-        switch (priv->hw_rev & CSR_HW_REV_TYPE_MSK) {
-        case CSR_HW_REV_TYPE_6x00:
-        case CSR_HW_REV_TYPE_6x50:
+        if (priv->cfg->adv_thermal_throttle) {
                 IWL_DEBUG_POWER(priv, "Advanced Thermal Throttling\n");
                 tt->restriction = kzalloc(sizeof(struct iwl_tt_restriction) *
                                          IWL_TI_STATE_MAX, GFP_KERNEL);
@@ -897,11 +926,9 @@ void iwl_tt_initialize(struct iwl_priv *priv)
                                 &restriction_range[0], size);
                         priv->thermal_throttle.advanced_tt = true;
                 }
-                break;
-        default:
+        } else {
                 IWL_DEBUG_POWER(priv, "Legacy Thermal Throttling\n");
                 priv->thermal_throttle.advanced_tt = false;
-                break;
         }
 }
 EXPORT_SYMBOL(iwl_tt_initialize);
diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index 493626bcd3ec..e5339c9ad13e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -200,7 +200,7 @@ int iwl_rx_queue_restock(struct iwl_priv *priv)
                 list_del(element);
 
                 /* Point to Rx buffer via next RBD in circular buffer */
-                rxq->bd[rxq->write] = iwl_dma_addr2rbd_ptr(priv, rxb->aligned_dma_addr);
+                rxq->bd[rxq->write] = iwl_dma_addr2rbd_ptr(priv, rxb->page_dma);
                 rxq->queue[rxq->write] = rxb;
                 rxq->write = (rxq->write + 1) & RX_QUEUE_MASK;
                 rxq->free_count--;
@@ -239,8 +239,9 @@ void iwl_rx_allocate(struct iwl_priv *priv, gfp_t priority)
         struct iwl_rx_queue *rxq = &priv->rxq;
         struct list_head *element;
         struct iwl_rx_mem_buffer *rxb;
-        struct sk_buff *skb;
+        struct page *page;
         unsigned long flags;
+        gfp_t gfp_mask = priority;
 
         while (1) {
                 spin_lock_irqsave(&rxq->lock, flags);
@@ -251,30 +252,35 @@ void iwl_rx_allocate(struct iwl_priv *priv, gfp_t priority)
                 spin_unlock_irqrestore(&rxq->lock, flags);
 
                 if (rxq->free_count > RX_LOW_WATERMARK)
-                        priority |= __GFP_NOWARN;
-                /* Alloc a new receive buffer */
-                skb = alloc_skb(priv->hw_params.rx_buf_size + 256,
-                                                priority);
+                        gfp_mask |= __GFP_NOWARN;
+
+                if (priv->hw_params.rx_page_order > 0)
+                        gfp_mask |= __GFP_COMP;
 
-                if (!skb) {
+                /* Alloc a new receive buffer */
+                page = alloc_pages(gfp_mask, priv->hw_params.rx_page_order);
+                if (!page) {
                         if (net_ratelimit())
-                                IWL_DEBUG_INFO(priv, "Failed to allocate SKB buffer.\n");
+                                IWL_DEBUG_INFO(priv, "alloc_pages failed, "
+                                               "order: %d\n",
+                                               priv->hw_params.rx_page_order);
+
                         if ((rxq->free_count <= RX_LOW_WATERMARK) &&
                             net_ratelimit())
-                                IWL_CRIT(priv, "Failed to allocate SKB buffer with %s. Only %u free buffers remaining.\n",
+                                IWL_CRIT(priv, "Failed to alloc_pages with %s. Only %u free buffers remaining.\n",
                                          priority == GFP_ATOMIC ?  "GFP_ATOMIC" : "GFP_KERNEL",
                                          rxq->free_count);
                         /* We don't reschedule replenish work here -- we will
                          * call the restock method and if it still needs
                          * more buffers it will schedule replenish */
-                        break;
+                        return;
                 }
 
                 spin_lock_irqsave(&rxq->lock, flags);
 
                 if (list_empty(&rxq->rx_used)) {
                         spin_unlock_irqrestore(&rxq->lock, flags);
-                        dev_kfree_skb_any(skb);
+                        __free_pages(page, priv->hw_params.rx_page_order);
                         return;
                 }
                 element = rxq->rx_used.next;
@@ -283,24 +289,21 @@ void iwl_rx_allocate(struct iwl_priv *priv, gfp_t priority)
 
                 spin_unlock_irqrestore(&rxq->lock, flags);
 
-                rxb->skb = skb;
-                /* Get physical address of RB/SKB */
-                rxb->real_dma_addr = pci_map_single(
-                                        priv->pci_dev,
-                                        rxb->skb->data,
-                                        priv->hw_params.rx_buf_size + 256,
-                                        PCI_DMA_FROMDEVICE);
+                rxb->page = page;
+                /* Get physical address of the RB */
+                rxb->page_dma = pci_map_page(priv->pci_dev, page, 0,
+                                PAGE_SIZE << priv->hw_params.rx_page_order,
+                                PCI_DMA_FROMDEVICE);
                 /* dma address must be no more than 36 bits */
-                BUG_ON(rxb->real_dma_addr & ~DMA_BIT_MASK(36));
+                BUG_ON(rxb->page_dma & ~DMA_BIT_MASK(36));
                 /* and also 256 byte aligned! */
-                rxb->aligned_dma_addr = ALIGN(rxb->real_dma_addr, 256);
-                skb_reserve(rxb->skb, rxb->aligned_dma_addr - rxb->real_dma_addr);
+                BUG_ON(rxb->page_dma & DMA_BIT_MASK(8));
 
                 spin_lock_irqsave(&rxq->lock, flags);
 
                 list_add_tail(&rxb->list, &rxq->rx_free);
                 rxq->free_count++;
-                priv->alloc_rxb_skb++;
+                priv->alloc_rxb_page++;
 
                 spin_unlock_irqrestore(&rxq->lock, flags);
         }
@@ -336,12 +339,14 @@ void iwl_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
 {
         int i;
         for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
-                if (rxq->pool[i].skb != NULL) {
-                        pci_unmap_single(priv->pci_dev,
-                                         rxq->pool[i].real_dma_addr,
-                                         priv->hw_params.rx_buf_size + 256,
-                                         PCI_DMA_FROMDEVICE);
-                        dev_kfree_skb(rxq->pool[i].skb);
+                if (rxq->pool[i].page != NULL) {
+                        pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
+                                PAGE_SIZE << priv->hw_params.rx_page_order,
+                                PCI_DMA_FROMDEVICE);
+                        __free_pages(rxq->pool[i].page,
+                                     priv->hw_params.rx_page_order);
+                        rxq->pool[i].page = NULL;
+                        priv->alloc_rxb_page--;
                 }
         }
 
@@ -405,14 +410,14 @@ void iwl_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
         for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
                 /* In the reset function, these buffers may have been allocated
                  * to an SKB, so we need to unmap and free potential storage */
-                if (rxq->pool[i].skb != NULL) {
-                        pci_unmap_single(priv->pci_dev,
-                                         rxq->pool[i].real_dma_addr,
-                                         priv->hw_params.rx_buf_size + 256,
-                                         PCI_DMA_FROMDEVICE);
-                        priv->alloc_rxb_skb--;
-                        dev_kfree_skb(rxq->pool[i].skb);
-                        rxq->pool[i].skb = NULL;
+                if (rxq->pool[i].page != NULL) {
+                        pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
+                                PAGE_SIZE << priv->hw_params.rx_page_order,
+                                PCI_DMA_FROMDEVICE);
+                        priv->alloc_rxb_page--;
+                        __free_pages(rxq->pool[i].page,
+                                     priv->hw_params.rx_page_order);
+                        rxq->pool[i].page = NULL;
                 }
                 list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
         }
@@ -491,7 +496,7 @@ void iwl_rx_missed_beacon_notif(struct iwl_priv *priv,
                                 struct iwl_rx_mem_buffer *rxb)
 
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_missed_beacon_notif *missed_beacon;
 
         missed_beacon = &pkt->u.missed_beacon;
@@ -548,13 +553,51 @@ static void iwl_rx_calc_noise(struct iwl_priv *priv)
                         priv->last_rx_noise);
 }
 
+#ifdef CONFIG_IWLWIFI_DEBUG
+/*
+ *  based on the assumption of all statistics counter are in DWORD
+ *  FIXME: This function is for debugging, do not deal with
+ *  the case of counters roll-over.
+ */
+static void iwl_accumulative_statistics(struct iwl_priv *priv,
+                                        __le32 *stats)
+{
+        int i;
+        __le32 *prev_stats;
+        u32 *accum_stats;
+
+        prev_stats = (__le32 *)&priv->statistics;
+        accum_stats = (u32 *)&priv->accum_statistics;
+
+        for (i = sizeof(__le32); i < sizeof(struct iwl_notif_statistics);
+             i += sizeof(__le32), stats++, prev_stats++, accum_stats++)
+                if (le32_to_cpu(*stats) > le32_to_cpu(*prev_stats))
+                        *accum_stats += (le32_to_cpu(*stats) -
+                                le32_to_cpu(*prev_stats));
+
+        /* reset accumulative statistics for "no-counter" type statistics */
+        priv->accum_statistics.general.temperature =
+                priv->statistics.general.temperature;
+        priv->accum_statistics.general.temperature_m =
+                priv->statistics.general.temperature_m;
+        priv->accum_statistics.general.ttl_timestamp =
+                priv->statistics.general.ttl_timestamp;
+        priv->accum_statistics.tx.tx_power.ant_a =
+                priv->statistics.tx.tx_power.ant_a;
+        priv->accum_statistics.tx.tx_power.ant_b =
+                priv->statistics.tx.tx_power.ant_b;
+        priv->accum_statistics.tx.tx_power.ant_c =
+                priv->statistics.tx.tx_power.ant_c;
+}
+#endif
+
 #define REG_RECALIB_PERIOD (60)
 
 void iwl_rx_statistics(struct iwl_priv *priv,
                               struct iwl_rx_mem_buffer *rxb)
 {
         int change;
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
 
         IWL_DEBUG_RX(priv, "Statistics notification received (%d vs %d).\n",
                      (int)sizeof(priv->statistics),
@@ -566,6 +609,9 @@ void iwl_rx_statistics(struct iwl_priv *priv,
                     STATISTICS_REPLY_FLG_HT40_MODE_MSK) !=
                    (pkt->u.stats.flag & STATISTICS_REPLY_FLG_HT40_MODE_MSK)));
 
+#ifdef CONFIG_IWLWIFI_DEBUG
+        iwl_accumulative_statistics(priv, (__le32 *)&pkt->u.stats);
+#endif
         memcpy(&priv->statistics, &pkt->u.stats, sizeof(priv->statistics));
 
         set_bit(STATUS_STATISTICS, &priv->status);
@@ -582,9 +628,6 @@ void iwl_rx_statistics(struct iwl_priv *priv,
                 iwl_rx_calc_noise(priv);
                 queue_work(priv->workqueue, &priv->run_time_calib_work);
         }
-
-        iwl_leds_background(priv);
-
         if (priv->cfg->ops->lib->temp_ops.temperature && change)
                 priv->cfg->ops->lib->temp_ops.temperature(priv);
 }
@@ -878,6 +921,10 @@ static void iwl_pass_packet_to_mac80211(struct iwl_priv *priv,
                                         struct iwl_rx_mem_buffer *rxb,
                                         struct ieee80211_rx_status *stats)
 {
+        struct sk_buff *skb;
+        int ret = 0;
+        __le16 fc = hdr->frame_control;
+
         /* We only process data packets if the interface is open */
         if (unlikely(!priv->is_open)) {
                 IWL_DEBUG_DROP_LIMIT(priv,
@@ -890,15 +937,43 @@ static void iwl_pass_packet_to_mac80211(struct iwl_priv *priv,
             iwl_set_decrypted_flag(priv, hdr, ampdu_status, stats))
                 return;
 
-        /* Resize SKB from mac header to end of packet */
-        skb_reserve(rxb->skb, (void *)hdr - (void *)rxb->skb->data);
-        skb_put(rxb->skb, len);
+        skb = alloc_skb(IWL_LINK_HDR_MAX, GFP_ATOMIC);
+        if (!skb) {
+                IWL_ERR(priv, "alloc_skb failed\n");
+                return;
+        }
+
+        skb_add_rx_frag(skb, 0, rxb->page, (void *)hdr - rxb_addr(rxb), len);
+
+        /* mac80211 currently doesn't support paged SKB. Convert it to
+         * linear SKB for management frame and data frame requires
+         * software decryption or software defragementation. */
+        if (ieee80211_is_mgmt(fc) ||
+            ieee80211_has_protected(fc) ||
+            ieee80211_has_morefrags(fc) ||
+            le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG)
+                ret = skb_linearize(skb);
+        else
+                ret = __pskb_pull_tail(skb, min_t(u16, IWL_LINK_HDR_MAX, len)) ?
+                         0 : -ENOMEM;
+
+        if (ret) {
+                kfree_skb(skb);
+                goto out;
+        }
+
+        /*
+         * XXX: We cannot touch the page and its virtual memory (hdr) after
+         * here. It might have already been freed by the above skb change.
+         */
+
+        iwl_update_stats(priv, false, fc, len);
+        memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
 
-        iwl_update_stats(priv, false, hdr->frame_control, len);
-        memcpy(IEEE80211_SKB_RXCB(rxb->skb), stats, sizeof(*stats));
-        ieee80211_rx_irqsafe(priv->hw, rxb->skb);
-        priv->alloc_rxb_skb--;
-        rxb->skb = NULL;
+        ieee80211_rx(priv->hw, skb);
+ out:
+        priv->alloc_rxb_page--;
+        rxb->page = NULL;
 }
 
 /* This is necessary only for a number of statistics, see the caller. */
@@ -926,7 +1001,7 @@ void iwl_rx_reply_rx(struct iwl_priv *priv,
 {
         struct ieee80211_hdr *header;
         struct ieee80211_rx_status rx_status;
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_rx_phy_res *phy_res;
         __le32 rx_pkt_status;
         struct iwl4965_rx_mpdu_res_start *amsdu;
@@ -1087,7 +1162,7 @@ EXPORT_SYMBOL(iwl_rx_reply_rx);
 void iwl_rx_reply_rx_phy(struct iwl_priv *priv,
                                     struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         priv->last_phy_res[0] = 1;
         memcpy(&priv->last_phy_res[1], &(pkt->u.raw[0]),
                sizeof(struct iwl_rx_phy_res));
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 41f9a0621250..4fca65a2fe9c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -111,7 +111,7 @@ EXPORT_SYMBOL(iwl_scan_cancel_timeout);
 static int iwl_send_scan_abort(struct iwl_priv *priv)
 {
         int ret = 0;
-        struct iwl_rx_packet *res;
+        struct iwl_rx_packet *pkt;
         struct iwl_host_cmd cmd = {
                 .id = REPLY_SCAN_ABORT_CMD,
                 .flags = CMD_WANT_SKB,
@@ -131,21 +131,21 @@ static int iwl_send_scan_abort(struct iwl_priv *priv)
                 return ret;
         }
 
-        res = (struct iwl_rx_packet *)cmd.reply_skb->data;
-        if (res->u.status != CAN_ABORT_STATUS) {
+        pkt = (struct iwl_rx_packet *)cmd.reply_page;
+        if (pkt->u.status != CAN_ABORT_STATUS) {
                 /* The scan abort will return 1 for success or
                  * 2 for "failure".  A failure condition can be
                  * due to simply not being in an active scan which
                  * can occur if we send the scan abort before we
                  * the microcode has notified us that a scan is
                  * completed. */
-                IWL_DEBUG_INFO(priv, "SCAN_ABORT returned %d.\n", res->u.status);
+                IWL_DEBUG_INFO(priv, "SCAN_ABORT returned %d.\n", pkt->u.status);
                 clear_bit(STATUS_SCAN_ABORTING, &priv->status);
                 clear_bit(STATUS_SCAN_HW, &priv->status);
         }
 
-        priv->alloc_rxb_skb--;
-        dev_kfree_skb_any(cmd.reply_skb);
+        priv->alloc_rxb_page--;
+        free_pages(cmd.reply_page, priv->hw_params.rx_page_order);
 
         return ret;
 }
@@ -155,7 +155,7 @@ static void iwl_rx_reply_scan(struct iwl_priv *priv,
                               struct iwl_rx_mem_buffer *rxb)
 {
 #ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_scanreq_notification *notif =
             (struct iwl_scanreq_notification *)pkt->u.raw;
 
@@ -167,7 +167,7 @@ static void iwl_rx_reply_scan(struct iwl_priv *priv,
 static void iwl_rx_scan_start_notif(struct iwl_priv *priv,
                                     struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_scanstart_notification *notif =
             (struct iwl_scanstart_notification *)pkt->u.raw;
         priv->scan_start_tsf = le32_to_cpu(notif->tsf_low);
@@ -186,7 +186,7 @@ static void iwl_rx_scan_results_notif(struct iwl_priv *priv,
                                       struct iwl_rx_mem_buffer *rxb)
 {
 #ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_scanresults_notification *notif =
             (struct iwl_scanresults_notification *)pkt->u.raw;
 
@@ -213,7 +213,7 @@ static void iwl_rx_scan_complete_notif(struct iwl_priv *priv,
                                        struct iwl_rx_mem_buffer *rxb)
 {
 #ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_scancomplete_notification *scan_notif = (void *)pkt->u.raw;
 
         IWL_DEBUG_SCAN(priv, "Scan complete: %d channels (TSF 0x%08X:%08X) - %d\n",
diff --git a/drivers/net/wireless/iwlwifi/iwl-spectrum.c b/drivers/net/wireless/iwlwifi/iwl-spectrum.c
index 022bcf115731..1ea5cd345fe8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-spectrum.c
+++ b/drivers/net/wireless/iwlwifi/iwl-spectrum.c
@@ -177,7 +177,7 @@ static int iwl_get_measurement(struct iwl_priv *priv,
 static void iwl_rx_spectrum_measure_notif(struct iwl_priv *priv,
                                           struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_spectrum_notification *report = &(pkt->u.spectrum_notif);
 
         if (!report->state) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index c6633fec8216..dc74c16d36a8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -99,32 +99,25 @@ static void iwl_sta_ucode_activate(struct iwl_priv *priv, u8 sta_id)
 
 static void iwl_add_sta_callback(struct iwl_priv *priv,
                                  struct iwl_device_cmd *cmd,
-                                 struct sk_buff *skb)
+                                 struct iwl_rx_packet *pkt)
 {
-        struct iwl_rx_packet *res = NULL;
         struct iwl_addsta_cmd *addsta =
                 (struct iwl_addsta_cmd *)cmd->cmd.payload;
         u8 sta_id = addsta->sta.sta_id;
 
-        if (!skb) {
-                IWL_ERR(priv, "Error: Response NULL in REPLY_ADD_STA.\n");
-                return;
-        }
-
-        res = (struct iwl_rx_packet *)skb->data;
-        if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
+        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
                 IWL_ERR(priv, "Bad return from REPLY_ADD_STA (0x%08X)\n",
-                          res->hdr.flags);
+                          pkt->hdr.flags);
                 return;
         }
 
-        switch (res->u.add_sta.status) {
+        switch (pkt->u.add_sta.status) {
         case ADD_STA_SUCCESS_MSK:
                 iwl_sta_ucode_activate(priv, sta_id);
                  /* fall through */
         default:
                 IWL_DEBUG_HC(priv, "Received REPLY_ADD_STA:(0x%08X)\n",
-                             res->u.add_sta.status);
+                             pkt->u.add_sta.status);
                 break;
         }
 }
@@ -132,7 +125,7 @@ static void iwl_add_sta_callback(struct iwl_priv *priv,
 int iwl_send_add_sta(struct iwl_priv *priv,
                      struct iwl_addsta_cmd *sta, u8 flags)
 {
-        struct iwl_rx_packet *res = NULL;
+        struct iwl_rx_packet *pkt = NULL;
         int ret = 0;
         u8 data[sizeof(*sta)];
         struct iwl_host_cmd cmd = {
@@ -152,15 +145,15 @@ int iwl_send_add_sta(struct iwl_priv *priv,
         if (ret || (flags & CMD_ASYNC))
                 return ret;
 
-        res = (struct iwl_rx_packet *)cmd.reply_skb->data;
-        if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
+        pkt = (struct iwl_rx_packet *)cmd.reply_page;
+        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
                 IWL_ERR(priv, "Bad return from REPLY_ADD_STA (0x%08X)\n",
-                          res->hdr.flags);
+                          pkt->hdr.flags);
                 ret = -EIO;
         }
 
         if (ret == 0) {
-                switch (res->u.add_sta.status) {
+                switch (pkt->u.add_sta.status) {
                 case ADD_STA_SUCCESS_MSK:
                         iwl_sta_ucode_activate(priv, sta->sta.sta_id);
                         IWL_DEBUG_INFO(priv, "REPLY_ADD_STA PASSED\n");
@@ -172,8 +165,8 @@ int iwl_send_add_sta(struct iwl_priv *priv,
                 }
         }
 
-        priv->alloc_rxb_skb--;
-        dev_kfree_skb_any(cmd.reply_skb);
+        priv->alloc_rxb_page--;
+        free_pages(cmd.reply_page, priv->hw_params.rx_page_order);
 
         return ret;
 }
@@ -324,26 +317,19 @@ static void iwl_sta_ucode_deactivate(struct iwl_priv *priv, const char *addr)
 
 static void iwl_remove_sta_callback(struct iwl_priv *priv,
                                     struct iwl_device_cmd *cmd,
-                                    struct sk_buff *skb)
+                                    struct iwl_rx_packet *pkt)
 {
-        struct iwl_rx_packet *res = NULL;
         struct iwl_rem_sta_cmd *rm_sta =
-                 (struct iwl_rem_sta_cmd *)cmd->cmd.payload;
+                        (struct iwl_rem_sta_cmd *)cmd->cmd.payload;
         const char *addr = rm_sta->addr;
 
-        if (!skb) {
-                IWL_ERR(priv, "Error: Response NULL in REPLY_REMOVE_STA.\n");
-                return;
-        }
-
-        res = (struct iwl_rx_packet *)skb->data;
-        if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
+        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
                 IWL_ERR(priv, "Bad return from REPLY_REMOVE_STA (0x%08X)\n",
-                res->hdr.flags);
+                pkt->hdr.flags);
                 return;
         }
 
-        switch (res->u.rem_sta.status) {
+        switch (pkt->u.rem_sta.status) {
         case REM_STA_SUCCESS_MSK:
                 iwl_sta_ucode_deactivate(priv, addr);
                 break;
@@ -356,7 +342,7 @@ static void iwl_remove_sta_callback(struct iwl_priv *priv,
 static int iwl_send_remove_station(struct iwl_priv *priv, const u8 *addr,
                                    u8 flags)
 {
-        struct iwl_rx_packet *res = NULL;
+        struct iwl_rx_packet *pkt;
         int ret;
 
         struct iwl_rem_sta_cmd rm_sta_cmd;
@@ -381,15 +367,15 @@ static int iwl_send_remove_station(struct iwl_priv *priv, const u8 *addr,
         if (ret || (flags & CMD_ASYNC))
                 return ret;
 
-        res = (struct iwl_rx_packet *)cmd.reply_skb->data;
-        if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
+        pkt = (struct iwl_rx_packet *)cmd.reply_page;
+        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
                 IWL_ERR(priv, "Bad return from REPLY_REMOVE_STA (0x%08X)\n",
-                          res->hdr.flags);
+                          pkt->hdr.flags);
                 ret = -EIO;
         }
 
         if (!ret) {
-                switch (res->u.rem_sta.status) {
+                switch (pkt->u.rem_sta.status) {
                 case REM_STA_SUCCESS_MSK:
                         iwl_sta_ucode_deactivate(priv, addr);
                         IWL_DEBUG_ASSOC(priv, "REPLY_REMOVE_STA PASSED\n");
@@ -401,8 +387,8 @@ static int iwl_send_remove_station(struct iwl_priv *priv, const u8 *addr,
                 }
         }
 
-        priv->alloc_rxb_skb--;
-        dev_kfree_skb_any(cmd.reply_skb);
+        priv->alloc_rxb_page--;
+        free_pages(cmd.reply_page, priv->hw_params.rx_page_order);
 
         return ret;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index c832ba085dba..8ae4c9b614e7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -131,7 +131,7 @@ void iwl_tx_queue_free(struct iwl_priv *priv, int txq_id)
         struct iwl_tx_queue *txq = &priv->txq[txq_id];
         struct iwl_queue *q = &txq->q;
         struct pci_dev *dev = priv->pci_dev;
-        int i, len;
+        int i;
 
         if (q->n_bd == 0)
                 return;
@@ -141,8 +141,6 @@ void iwl_tx_queue_free(struct iwl_priv *priv, int txq_id)
              q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd))
                 priv->cfg->ops->lib->txq_free_tfd(priv, txq);
 
-        len = sizeof(struct iwl_device_cmd) * q->n_window;
-
         /* De-alloc array of command/tx buffers */
         for (i = 0; i < TFD_TX_CMD_SLOTS; i++)
                 kfree(txq->cmd[i]);
@@ -180,14 +178,11 @@ void iwl_cmd_queue_free(struct iwl_priv *priv)
         struct iwl_tx_queue *txq = &priv->txq[IWL_CMD_QUEUE_NUM];
         struct iwl_queue *q = &txq->q;
         struct pci_dev *dev = priv->pci_dev;
-        int i, len;
+        int i;
 
         if (q->n_bd == 0)
                 return;
 
-        len = sizeof(struct iwl_device_cmd) * q->n_window;
-        len += IWL_MAX_SCAN_SIZE;
-
         /* De-alloc array of command/tx buffers */
         for (i = 0; i <= TFD_CMD_SLOTS; i++)
                 kfree(txq->cmd[i]);
@@ -405,15 +400,19 @@ void iwl_hw_txq_ctx_free(struct iwl_priv *priv)
         int txq_id;
 
         /* Tx queues */
-        for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++)
-                if (txq_id == IWL_CMD_QUEUE_NUM)
-                        iwl_cmd_queue_free(priv);
-                else
-                        iwl_tx_queue_free(priv, txq_id);
-
+        if (priv->txq)
+                for (txq_id = 0; txq_id < priv->hw_params.max_txq_num;
+                     txq_id++)
+                        if (txq_id == IWL_CMD_QUEUE_NUM)
+                                iwl_cmd_queue_free(priv);
+                        else
+                                iwl_tx_queue_free(priv, txq_id);
         iwl_free_dma_ptr(priv, &priv->kw);
 
         iwl_free_dma_ptr(priv, &priv->scd_bc_tbls);
+
+        /* free tx queue structure */
+        iwl_free_txq_mem(priv);
 }
 EXPORT_SYMBOL(iwl_hw_txq_ctx_free);
 
@@ -445,6 +444,12 @@ int iwl_txq_ctx_reset(struct iwl_priv *priv)
                 IWL_ERR(priv, "Keep Warm allocation failed\n");
                 goto error_kw;
         }
+
+        /* allocate tx queue structure */
+        ret = iwl_alloc_txq_mem(priv);
+        if (ret)
+                goto error;
+
         spin_lock_irqsave(&priv->lock, flags);
 
         /* Turn off all Tx DMA fifos */
@@ -581,9 +586,7 @@ static void iwl_tx_cmd_build_rate(struct iwl_priv *priv,
         u8 rate_plcp;
 
         /* Set retry limit on DATA packets and Probe Responses*/
-        if (priv->data_retry_limit != -1)
-                data_retry_limit = priv->data_retry_limit;
-        else if (ieee80211_is_probe_resp(fc))
+        if (ieee80211_is_probe_resp(fc))
                 data_retry_limit = 3;
         else
                 data_retry_limit = IWL_DEFAULT_TX_RETRY;
@@ -1145,7 +1148,7 @@ static void iwl_hcmd_queue_reclaim(struct iwl_priv *priv, int txq_id,
  */
 void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         u16 sequence = le16_to_cpu(pkt->hdr.sequence);
         int txq_id = SEQ_TO_QUEUE(sequence);
         int index = SEQ_TO_INDEX(sequence);
@@ -1172,10 +1175,10 @@ void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
 
         /* Input error checking is done when commands are added to queue. */
         if (meta->flags & CMD_WANT_SKB) {
-                meta->source->reply_skb = rxb->skb;
-                rxb->skb = NULL;
+                meta->source->reply_page = (unsigned long)rxb_addr(rxb);
+                rxb->page = NULL;
         } else if (meta->callback)
-                meta->callback(priv, cmd, rxb->skb);
+                meta->callback(priv, cmd, pkt);
 
         iwl_hcmd_queue_reclaim(priv, txq_id, index, cmd_index);
 
@@ -1434,7 +1437,7 @@ static int iwl_tx_status_reply_compressed_ba(struct iwl_priv *priv,
 void iwl_rx_reply_compressed_ba(struct iwl_priv *priv,
                                            struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (struct iwl_rx_packet *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_compressed_ba_resp *ba_resp = &pkt->u.compressed_ba;
         struct iwl_tx_queue *txq = NULL;
         struct iwl_ht_agg *agg;
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index c347d6631d85..bfd7f497157f 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -88,7 +88,6 @@ MODULE_LICENSE("GPL");
 
  /* module parameters */
 struct iwl_mod_params iwl3945_mod_params = {
-        .num_of_queues = IWL39_NUM_QUEUES, /* Not used */
         .sw_crypto = 1,
         .restart_fw = 1,
         /* the rest are 0 by default */
@@ -366,13 +365,13 @@ static void iwl3945_build_tx_cmd_hwcrypto(struct iwl_priv *priv,
                                       struct sk_buff *skb_frag,
                                       int sta_id)
 {
-        struct iwl3945_tx_cmd *tx = (struct iwl3945_tx_cmd *)cmd->cmd.payload;
+        struct iwl3945_tx_cmd *tx_cmd = (struct iwl3945_tx_cmd *)cmd->cmd.payload;
         struct iwl_hw_key *keyinfo = &priv->stations[sta_id].keyinfo;
 
         switch (keyinfo->alg) {
         case ALG_CCMP:
-                tx->sec_ctl = TX_CMD_SEC_CCM;
-                memcpy(tx->key, keyinfo->key, keyinfo->keylen);
+                tx_cmd->sec_ctl = TX_CMD_SEC_CCM;
+                memcpy(tx_cmd->key, keyinfo->key, keyinfo->keylen);
                 IWL_DEBUG_TX(priv, "tx_cmd with AES hwcrypto\n");
                 break;
 
@@ -380,13 +379,13 @@ static void iwl3945_build_tx_cmd_hwcrypto(struct iwl_priv *priv,
                 break;
 
         case ALG_WEP:
-                tx->sec_ctl = TX_CMD_SEC_WEP |
+                tx_cmd->sec_ctl = TX_CMD_SEC_WEP |
                     (info->control.hw_key->hw_key_idx & TX_CMD_SEC_MSK) << TX_CMD_SEC_SHIFT;
 
                 if (keyinfo->keylen == 13)
-                        tx->sec_ctl |= TX_CMD_SEC_KEY128;
+                        tx_cmd->sec_ctl |= TX_CMD_SEC_KEY128;
 
-                memcpy(&tx->key[3], keyinfo->key, keyinfo->keylen);
+                memcpy(&tx_cmd->key[3], keyinfo->key, keyinfo->keylen);
 
                 IWL_DEBUG_TX(priv, "Configuring packet for WEP encryption "
                              "with key %d\n", info->control.hw_key->hw_key_idx);
@@ -406,12 +405,11 @@ static void iwl3945_build_tx_cmd_basic(struct iwl_priv *priv,
                                   struct ieee80211_tx_info *info,
                                   struct ieee80211_hdr *hdr, u8 std_id)
 {
-        struct iwl3945_tx_cmd *tx = (struct iwl3945_tx_cmd *)cmd->cmd.payload;
-        __le32 tx_flags = tx->tx_flags;
+        struct iwl3945_tx_cmd *tx_cmd = (struct iwl3945_tx_cmd *)cmd->cmd.payload;
+        __le32 tx_flags = tx_cmd->tx_flags;
         __le16 fc = hdr->frame_control;
-        u8 rc_flags = info->control.rates[0].flags;
 
-        tx->stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
+        tx_cmd->stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
         if (!(info->flags & IEEE80211_TX_CTL_NO_ACK)) {
                 tx_flags |= TX_CMD_FLG_ACK_MSK;
                 if (ieee80211_is_mgmt(fc))
@@ -424,25 +422,19 @@ static void iwl3945_build_tx_cmd_basic(struct iwl_priv *priv,
                 tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
         }
 
-        tx->sta_id = std_id;
+        tx_cmd->sta_id = std_id;
         if (ieee80211_has_morefrags(fc))
                 tx_flags |= TX_CMD_FLG_MORE_FRAG_MSK;
 
         if (ieee80211_is_data_qos(fc)) {
                 u8 *qc = ieee80211_get_qos_ctl(hdr);
-                tx->tid_tspec = qc[0] & 0xf;
+                tx_cmd->tid_tspec = qc[0] & 0xf;
                 tx_flags &= ~TX_CMD_FLG_SEQ_CTL_MSK;
         } else {
                 tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
         }
 
-        if (rc_flags & IEEE80211_TX_RC_USE_RTS_CTS) {
-                tx_flags |= TX_CMD_FLG_RTS_MSK;
-                tx_flags &= ~TX_CMD_FLG_CTS_MSK;
-        } else if (rc_flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
-                tx_flags &= ~TX_CMD_FLG_RTS_MSK;
-                tx_flags |= TX_CMD_FLG_CTS_MSK;
-        }
+        priv->cfg->ops->utils->rts_tx_cmd_flag(info, &tx_flags);
 
         if ((tx_flags & TX_CMD_FLG_RTS_MSK) || (tx_flags & TX_CMD_FLG_CTS_MSK))
                 tx_flags |= TX_CMD_FLG_FULL_TXOP_PROT_MSK;
@@ -450,16 +442,16 @@ static void iwl3945_build_tx_cmd_basic(struct iwl_priv *priv,
         tx_flags &= ~(TX_CMD_FLG_ANT_SEL_MSK);
         if (ieee80211_is_mgmt(fc)) {
                 if (ieee80211_is_assoc_req(fc) || ieee80211_is_reassoc_req(fc))
-                        tx->timeout.pm_frame_timeout = cpu_to_le16(3);
+                        tx_cmd->timeout.pm_frame_timeout = cpu_to_le16(3);
                 else
-                        tx->timeout.pm_frame_timeout = cpu_to_le16(2);
+                        tx_cmd->timeout.pm_frame_timeout = cpu_to_le16(2);
         } else {
-                tx->timeout.pm_frame_timeout = 0;
+                tx_cmd->timeout.pm_frame_timeout = 0;
         }
 
-        tx->driver_txop = 0;
-        tx->tx_flags = tx_flags;
-        tx->next_frame_len = 0;
+        tx_cmd->driver_txop = 0;
+        tx_cmd->tx_flags = tx_flags;
+        tx_cmd->next_frame_len = 0;
 }
 
 /*
@@ -469,7 +461,7 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        struct iwl3945_tx_cmd *tx;
+        struct iwl3945_tx_cmd *tx_cmd;
         struct iwl_tx_queue *txq = NULL;
         struct iwl_queue *q = NULL;
         struct iwl_device_cmd *out_cmd;
@@ -568,9 +560,9 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         /* Init first empty entry in queue's array of Tx/cmd buffers */
         out_cmd = txq->cmd[idx];
         out_meta = &txq->meta[idx];
-        tx = (struct iwl3945_tx_cmd *)out_cmd->cmd.payload;
+        tx_cmd = (struct iwl3945_tx_cmd *)out_cmd->cmd.payload;
         memset(&out_cmd->hdr, 0, sizeof(out_cmd->hdr));
-        memset(tx, 0, sizeof(*tx));
+        memset(tx_cmd, 0, sizeof(*tx_cmd));
 
         /*
          * Set up the Tx-command (not MAC!) header.
@@ -583,7 +575,7 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                                 INDEX_TO_SEQ(q->write_ptr)));
 
         /* Copy MAC header from skb into command buffer */
-        memcpy(tx->hdr, hdr, hdr_len);
+        memcpy(tx_cmd->hdr, hdr, hdr_len);
 
 
         if (info->control.hw_key)
@@ -597,12 +589,12 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
         /* Total # bytes to be transmitted */
         len = (u16)skb->len;
-        tx->len = cpu_to_le16(len);
+        tx_cmd->len = cpu_to_le16(len);
 
         iwl_dbg_log_tx_data_frame(priv, len, hdr);
         iwl_update_stats(priv, true, fc, len);
-        tx->tx_flags &= ~TX_CMD_FLG_ANT_A_MSK;
-        tx->tx_flags &= ~TX_CMD_FLG_ANT_B_MSK;
+        tx_cmd->tx_flags &= ~TX_CMD_FLG_ANT_A_MSK;
+        tx_cmd->tx_flags &= ~TX_CMD_FLG_ANT_B_MSK;
 
         if (!ieee80211_has_morefrags(hdr->frame_control)) {
                 txq->need_update = 1;
@@ -615,9 +607,9 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
         IWL_DEBUG_TX(priv, "sequence nr = 0X%x \n",
                      le16_to_cpu(out_cmd->hdr.sequence));
-        IWL_DEBUG_TX(priv, "tx_flags = 0X%x \n", le32_to_cpu(tx->tx_flags));
-        iwl_print_hex_dump(priv, IWL_DL_TX, tx, sizeof(*tx));
-        iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx->hdr,
+        IWL_DEBUG_TX(priv, "tx_flags = 0X%x \n", le32_to_cpu(tx_cmd->tx_flags));
+        iwl_print_hex_dump(priv, IWL_DL_TX, tx_cmd, sizeof(*tx_cmd));
+        iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd->hdr,
                            ieee80211_hdrlen(fc));
 
         /*
@@ -753,7 +745,7 @@ static int iwl3945_get_measurement(struct iwl_priv *priv,
                                u8 type)
 {
         struct iwl_spectrum_cmd spectrum;
-        struct iwl_rx_packet *res;
+        struct iwl_rx_packet *pkt;
         struct iwl_host_cmd cmd = {
                 .id = REPLY_SPECTRUM_MEASUREMENT_CMD,
                 .data = (void *)&spectrum,
@@ -798,18 +790,18 @@ static int iwl3945_get_measurement(struct iwl_priv *priv,
         if (rc)
                 return rc;
 
-        res = (struct iwl_rx_packet *)cmd.reply_skb->data;
-        if (res->hdr.flags & IWL_CMD_FAILED_MSK) {
+        pkt = (struct iwl_rx_packet *)cmd.reply_page;
+        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
                 IWL_ERR(priv, "Bad return from REPLY_RX_ON_ASSOC command\n");
                 rc = -EIO;
         }
 
-        spectrum_resp_status = le16_to_cpu(res->u.spectrum.status);
+        spectrum_resp_status = le16_to_cpu(pkt->u.spectrum.status);
         switch (spectrum_resp_status) {
         case 0:         /* Command will be handled */
-                if (res->u.spectrum.id != 0xff) {
+                if (pkt->u.spectrum.id != 0xff) {
                         IWL_DEBUG_INFO(priv, "Replaced existing measurement: %d\n",
-                                                res->u.spectrum.id);
+                                                pkt->u.spectrum.id);
                         priv->measurement_status &= ~MEASUREMENT_READY;
                 }
                 priv->measurement_status |= MEASUREMENT_ACTIVE;
@@ -821,7 +813,7 @@ static int iwl3945_get_measurement(struct iwl_priv *priv,
                 break;
         }
 
-        dev_kfree_skb_any(cmd.reply_skb);
+        free_pages(cmd.reply_page, priv->hw_params.rx_page_order);
 
         return rc;
 }
@@ -830,7 +822,7 @@ static int iwl3945_get_measurement(struct iwl_priv *priv,
 static void iwl3945_rx_reply_alive(struct iwl_priv *priv,
                                struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_alive_resp *palive;
         struct delayed_work *pwork;
 
@@ -867,7 +859,7 @@ static void iwl3945_rx_reply_add_sta(struct iwl_priv *priv,
                                  struct iwl_rx_mem_buffer *rxb)
 {
 #ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
 #endif
 
         IWL_DEBUG_RX(priv, "Received REPLY_ADD_STA: 0x%02X\n", pkt->u.status);
@@ -903,7 +895,7 @@ static void iwl3945_rx_beacon_notif(struct iwl_priv *priv,
                                 struct iwl_rx_mem_buffer *rxb)
 {
 #ifdef CONFIG_IWLWIFI_DEBUG
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl3945_beacon_notif *beacon = &(pkt->u.beacon_status);
         u8 rate = beacon->beacon_notify_hdr.rate;
 
@@ -926,7 +918,7 @@ static void iwl3945_rx_beacon_notif(struct iwl_priv *priv,
 static void iwl3945_rx_card_state_notif(struct iwl_priv *priv,
                                     struct iwl_rx_mem_buffer *rxb)
 {
-        struct iwl_rx_packet *pkt = (void *)rxb->skb->data;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
         u32 flags = le32_to_cpu(pkt->u.card_state_notif.flags);
         unsigned long status = priv->status;
 
@@ -1090,7 +1082,7 @@ static int iwl3945_rx_queue_restock(struct iwl_priv *priv)
                 list_del(element);
 
                 /* Point to Rx buffer via next RBD in circular buffer */
-                rxq->bd[rxq->write] = iwl3945_dma_addr2rbd_ptr(priv, rxb->real_dma_addr);
+                rxq->bd[rxq->write] = iwl3945_dma_addr2rbd_ptr(priv, rxb->page_dma);
                 rxq->queue[rxq->write] = rxb;
                 rxq->write = (rxq->write + 1) & RX_QUEUE_MASK;
                 rxq->free_count--;
@@ -1130,8 +1122,9 @@ static void iwl3945_rx_allocate(struct iwl_priv *priv, gfp_t priority)
         struct iwl_rx_queue *rxq = &priv->rxq;
         struct list_head *element;
         struct iwl_rx_mem_buffer *rxb;
-        struct sk_buff *skb;
+        struct page *page;
         unsigned long flags;
+        gfp_t gfp_mask = priority;
 
         while (1) {
                 spin_lock_irqsave(&rxq->lock, flags);
@@ -1143,10 +1136,14 @@ static void iwl3945_rx_allocate(struct iwl_priv *priv, gfp_t priority)
                 spin_unlock_irqrestore(&rxq->lock, flags);
 
                 if (rxq->free_count > RX_LOW_WATERMARK)
-                        priority |= __GFP_NOWARN;
+                        gfp_mask |= __GFP_NOWARN;
+
+                if (priv->hw_params.rx_page_order > 0)
+                        gfp_mask |= __GFP_COMP;
+
                 /* Alloc a new receive buffer */
-                skb = alloc_skb(priv->hw_params.rx_buf_size, priority);
-                if (!skb) {
+                page = alloc_pages(gfp_mask, priv->hw_params.rx_page_order);
+                if (!page) {
                         if (net_ratelimit())
                                 IWL_DEBUG_INFO(priv, "Failed to allocate SKB buffer.\n");
                         if ((rxq->free_count <= RX_LOW_WATERMARK) &&
@@ -1163,7 +1160,7 @@ static void iwl3945_rx_allocate(struct iwl_priv *priv, gfp_t priority)
                 spin_lock_irqsave(&rxq->lock, flags);
                 if (list_empty(&rxq->rx_used)) {
                         spin_unlock_irqrestore(&rxq->lock, flags);
-                        dev_kfree_skb_any(skb);
+                        __free_pages(page, priv->hw_params.rx_page_order);
                         return;
                 }
                 element = rxq->rx_used.next;
@@ -1171,26 +1168,18 @@ static void iwl3945_rx_allocate(struct iwl_priv *priv, gfp_t priority)
                 list_del(element);
                 spin_unlock_irqrestore(&rxq->lock, flags);
 
-                rxb->skb = skb;
-
-                /* If radiotap head is required, reserve some headroom here.
-                 * The physical head count is a variable rx_stats->phy_count.
-                 * We reserve 4 bytes here. Plus these extra bytes, the
-                 * headroom of the physical head should be enough for the
-                 * radiotap head that iwl3945 supported. See iwl3945_rt.
-                 */
-                skb_reserve(rxb->skb, 4);
-
+                rxb->page = page;
                 /* Get physical address of RB/SKB */
-                rxb->real_dma_addr = pci_map_single(priv->pci_dev,
-                                                rxb->skb->data,
-                                                priv->hw_params.rx_buf_size,
-                                                PCI_DMA_FROMDEVICE);
+                rxb->page_dma = pci_map_page(priv->pci_dev, page, 0,
+                                PAGE_SIZE << priv->hw_params.rx_page_order,
+                                PCI_DMA_FROMDEVICE);
 
                 spin_lock_irqsave(&rxq->lock, flags);
+
                 list_add_tail(&rxb->list, &rxq->rx_free);
-                priv->alloc_rxb_skb++;
                 rxq->free_count++;
+                priv->alloc_rxb_page++;
+
                 spin_unlock_irqrestore(&rxq->lock, flags);
         }
 }
@@ -1206,14 +1195,14 @@ void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
         for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
                 /* In the reset function, these buffers may have been allocated
                  * to an SKB, so we need to unmap and free potential storage */
-                if (rxq->pool[i].skb != NULL) {
-                        pci_unmap_single(priv->pci_dev,
-                                         rxq->pool[i].real_dma_addr,
-                                         priv->hw_params.rx_buf_size,
-                                         PCI_DMA_FROMDEVICE);
-                        priv->alloc_rxb_skb--;
-                        dev_kfree_skb(rxq->pool[i].skb);
-                        rxq->pool[i].skb = NULL;
+                if (rxq->pool[i].page != NULL) {
+                        pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
+                                PAGE_SIZE << priv->hw_params.rx_page_order,
+                                PCI_DMA_FROMDEVICE);
+                        priv->alloc_rxb_page--;
+                        __free_pages(rxq->pool[i].page,
+                                     priv->hw_params.rx_page_order);
+                        rxq->pool[i].page = NULL;
                 }
                 list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
         }
@@ -1221,8 +1210,8 @@ void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
         /* Set us so that we have processed and used all buffers, but have
          * not restocked the Rx queue with fresh buffers */
         rxq->read = rxq->write = 0;
-        rxq->free_count = 0;
         rxq->write_actual = 0;
+        rxq->free_count = 0;
         spin_unlock_irqrestore(&rxq->lock, flags);
 }
 
@@ -1255,12 +1244,14 @@ static void iwl3945_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rx
 {
         int i;
         for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
-                if (rxq->pool[i].skb != NULL) {
-                        pci_unmap_single(priv->pci_dev,
-                                         rxq->pool[i].real_dma_addr,
-                                         priv->hw_params.rx_buf_size,
-                                         PCI_DMA_FROMDEVICE);
-                        dev_kfree_skb(rxq->pool[i].skb);
+                if (rxq->pool[i].page != NULL) {
+                        pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
+                                PAGE_SIZE << priv->hw_params.rx_page_order,
+                                PCI_DMA_FROMDEVICE);
+                        __free_pages(rxq->pool[i].page,
+                                     priv->hw_params.rx_page_order);
+                        rxq->pool[i].page = NULL;
+                        priv->alloc_rxb_page--;
                 }
         }
 
@@ -1376,7 +1367,7 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
         i = rxq->read;
 
         /* calculate total frames need to be restock after handling RX */
-        total_empty = r - priv->rxq.write_actual;
+        total_empty = r - rxq->write_actual;
         if (total_empty < 0)
                 total_empty += RX_QUEUE_SIZE;
 
@@ -1396,10 +1387,10 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
 
                 rxq->queue[i] = NULL;
 
-                pci_unmap_single(priv->pci_dev, rxb->real_dma_addr,
-                                priv->hw_params.rx_buf_size,
-                                PCI_DMA_FROMDEVICE);
-                pkt = (struct iwl_rx_packet *)rxb->skb->data;
+                pci_unmap_page(priv->pci_dev, rxb->page_dma,
+                               PAGE_SIZE << priv->hw_params.rx_page_order,
+                               PCI_DMA_FROMDEVICE);
+                pkt = rxb_addr(rxb);
 
                 trace_iwlwifi_dev_rx(priv, pkt,
                         le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
@@ -1420,44 +1411,55 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
                 if (priv->rx_handlers[pkt->hdr.cmd]) {
                         IWL_DEBUG_RX(priv, "r = %d, i = %d, %s, 0x%02x\n", r, i,
                                 get_cmd_string(pkt->hdr.cmd), pkt->hdr.cmd);
-                        priv->rx_handlers[pkt->hdr.cmd] (priv, rxb);
                         priv->isr_stats.rx_handlers[pkt->hdr.cmd]++;
+                        priv->rx_handlers[pkt->hdr.cmd] (priv, rxb);
                 } else {
                         /* No handling needed */
-                        IWL_DEBUG_RX(priv, "r %d i %d No handler needed for %s, 0x%02x\n",
+                        IWL_DEBUG_RX(priv,
+                                "r %d i %d No handler needed for %s, 0x%02x\n",
                                 r, i, get_cmd_string(pkt->hdr.cmd),
                                 pkt->hdr.cmd);
                 }
 
+                /*
+                 * XXX: After here, we should always check rxb->page
+                 * against NULL before touching it or its virtual
+                 * memory (pkt). Because some rx_handler might have
+                 * already taken or freed the pages.
+                 */
+
                 if (reclaim) {
-                        /* Invoke any callbacks, transfer the skb to caller, and
-                         * fire off the (possibly) blocking iwl_send_cmd()
+                        /* Invoke any callbacks, transfer the buffer to caller,
+                         * and fire off the (possibly) blocking iwl_send_cmd()
                          * as we reclaim the driver command queue */
-                        if (rxb && rxb->skb)
+                        if (rxb->page)
                                 iwl_tx_cmd_complete(priv, rxb);
                         else
                                 IWL_WARN(priv, "Claim null rxb?\n");
                 }
 
-                /* For now we just don't re-use anything.  We can tweak this
-                 * later to try and re-use notification packets and SKBs that
-                 * fail to Rx correctly */
-                if (rxb->skb != NULL) {
-                        priv->alloc_rxb_skb--;
-                        dev_kfree_skb_any(rxb->skb);
-                        rxb->skb = NULL;
-                }
-
+                /* Reuse the page if possible. For notification packets and
+                 * SKBs that fail to Rx correctly, add them back into the
+                 * rx_free list for reuse later. */
                 spin_lock_irqsave(&rxq->lock, flags);
-                list_add_tail(&rxb->list, &priv->rxq.rx_used);
+                if (rxb->page != NULL) {
+                        rxb->page_dma = pci_map_page(priv->pci_dev, rxb->page,
+                                0, PAGE_SIZE << priv->hw_params.rx_page_order,
+                                PCI_DMA_FROMDEVICE);
+                        list_add_tail(&rxb->list, &rxq->rx_free);
+                        rxq->free_count++;
+                } else
+                        list_add_tail(&rxb->list, &rxq->rx_used);
+
                 spin_unlock_irqrestore(&rxq->lock, flags);
+
                 i = (i + 1) & RX_QUEUE_MASK;
                 /* If there are a lot of unused frames,
                  * restock the Rx queue so ucode won't assert. */
                 if (fill_rx) {
                         count++;
                         if (count >= 8) {
-                                priv->rxq.read = i;
+                                rxq->read = i;
                                 iwl3945_rx_replenish_now(priv);
                                 count = 0;
                         }
@@ -1465,7 +1467,7 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
         }
 
         /* Backtrack one entry */
-        priv->rxq.read = i;
+        rxq->read = i;
         if (fill_rx)
                 iwl3945_rx_replenish_now(priv);
         else
@@ -1686,6 +1688,8 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
         }
 #endif
 
+        spin_unlock_irqrestore(&priv->lock, flags);
+
         /* Since CSR_INT and CSR_FH_INT_STATUS reads and clears are not
          * atomic, make sure that inta covers all the interrupts that
          * we've discovered, even if FH interrupt came in just after
@@ -1707,8 +1711,6 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
 
                 handled |= CSR_INT_BIT_HW_ERR;
 
-                spin_unlock_irqrestore(&priv->lock, flags);
-
                 return;
         }
 
@@ -1800,7 +1802,6 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
                         "flags 0x%08lx\n", inta, inta_mask, inta_fh, flags);
         }
 #endif
-        spin_unlock_irqrestore(&priv->lock, flags);
 }
 
 static int iwl3945_get_channels_for_scan(struct iwl_priv *priv,
@@ -2563,11 +2564,6 @@ static void __iwl3945_down(struct iwl_priv *priv)
                         test_bit(STATUS_EXIT_PENDING, &priv->status) <<
                                 STATUS_EXIT_PENDING;
 
-        priv->cfg->ops->lib->apm_ops.reset(priv);
-        spin_lock_irqsave(&priv->lock, flags);
-        iwl_clear_bit(priv, CSR_GP_CNTRL, CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
-        spin_unlock_irqrestore(&priv->lock, flags);
-
         iwl3945_hw_txq_ctx_stop(priv);
         iwl3945_hw_rxq_stop(priv);
 
@@ -2576,10 +2572,8 @@ static void __iwl3945_down(struct iwl_priv *priv)
 
         udelay(5);
 
-        if (exit_pending)
-                priv->cfg->ops->lib->apm_ops.stop(priv);
-        else
-                priv->cfg->ops->lib->apm_ops.reset(priv);
+        /* Stop the device, and put it in low power state */
+        priv->cfg->ops->lib->apm_ops.stop(priv);
 
  exit:
         memset(&priv->card_alive, 0, sizeof(struct iwl_alive_resp));
@@ -2724,19 +2718,34 @@ static void iwl3945_bg_alive_start(struct work_struct *data)
         mutex_unlock(&priv->mutex);
 }
 
+/*
+ * 3945 cannot interrupt driver when hardware rf kill switch toggles;
+ * driver must poll CSR_GP_CNTRL_REG register for change.  This register
+ * *is* readable even when device has been SW_RESET into low power mode
+ * (e.g. during RF KILL).
+ */
 static void iwl3945_rfkill_poll(struct work_struct *data)
 {
         struct iwl_priv *priv =
             container_of(data, struct iwl_priv, rfkill_poll.work);
+        bool old_rfkill = test_bit(STATUS_RF_KILL_HW, &priv->status);
+        bool new_rfkill = !(iwl_read32(priv, CSR_GP_CNTRL)
+                        & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW);
 
-        if (iwl_read32(priv, CSR_GP_CNTRL) & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW)
-                clear_bit(STATUS_RF_KILL_HW, &priv->status);
-        else
-                set_bit(STATUS_RF_KILL_HW, &priv->status);
+        if (new_rfkill != old_rfkill) {
+                if (new_rfkill)
+                        set_bit(STATUS_RF_KILL_HW, &priv->status);
+                else
+                        clear_bit(STATUS_RF_KILL_HW, &priv->status);
 
-        wiphy_rfkill_set_hw_state(priv->hw->wiphy,
-                        test_bit(STATUS_RF_KILL_HW, &priv->status));
+                wiphy_rfkill_set_hw_state(priv->hw->wiphy, new_rfkill);
 
+                IWL_DEBUG_RF_KILL(priv, "RF_KILL bit toggled to %s.\n",
+                                new_rfkill ? "disable radio" : "enable radio");
+        }
+
+        /* Keep this running, even if radio now enabled.  This will be
+         * cancelled in mac_start() if system decides to start again */
         queue_delayed_work(priv->workqueue, &priv->rfkill_poll,
                            round_jiffies_relative(2 * HZ));
 
@@ -3797,7 +3806,6 @@ static int iwl3945_init_drv(struct iwl_priv *priv)
         /* Clear the driver's (not device's) station table */
         iwl_clear_stations_table(priv);
 
-        priv->data_retry_limit = -1;
         priv->ieee_channels = NULL;
         priv->ieee_rates = NULL;
         priv->band = IEEE80211_BAND_2GHZ;
@@ -4056,6 +4064,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
                              &priv->bands[IEEE80211_BAND_2GHZ].channels[5]);
         iwl3945_setup_deferred_work(priv);
         iwl3945_setup_rx_handlers(priv);
+        iwl_power_initialize(priv);
 
         /*********************************
          * 8. Setup and Register mac80211
@@ -4126,6 +4135,15 @@ static void __devexit iwl3945_pci_remove(struct pci_dev *pdev)
                 iwl3945_down(priv);
         }
 
+        /*
+         * Make sure device is reset to low power before unloading driver.
+         * This may be redundant with iwl_down(), but there are paths to
+         * run iwl_down() without calling apm_ops.stop(), and there are
+         * paths to avoid running iwl_down() at all before leaving driver.
+         * This (inexpensive) call *makes sure* device is reset.
+         */
+        priv->cfg->ops->lib->apm_ops.stop(priv);
+
         /* make sure we flush any pending irq or
          * tasklet for the driver
          */
diff --git a/drivers/net/wireless/iwmc3200wifi/cfg80211.c b/drivers/net/wireless/iwmc3200wifi/cfg80211.c
index a56a2b0ac99a..af72cc746f15 100644
--- a/drivers/net/wireless/iwmc3200wifi/cfg80211.c
+++ b/drivers/net/wireless/iwmc3200wifi/cfg80211.c
@@ -404,39 +404,21 @@ static int iwm_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
 {
         struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
         struct ieee80211_channel *chan = params->channel;
-        struct cfg80211_bss *bss;
 
         if (!test_bit(IWM_STATUS_READY, &iwm->status))
                 return -EIO;
 
-        /* UMAC doesn't support creating IBSS network with specified bssid.
-         * This should be removed after we have join only mode supported. */
+        /* UMAC doesn't support creating or joining an IBSS network
+         * with specified bssid. */
         if (params->bssid)
                 return -EOPNOTSUPP;
 
-        bss = cfg80211_get_ibss(iwm_to_wiphy(iwm), NULL,
-                                params->ssid, params->ssid_len);
-        if (!bss) {
-                iwm_scan_one_ssid(iwm, params->ssid, params->ssid_len);
-                schedule_timeout_interruptible(2 * HZ);
-                bss = cfg80211_get_ibss(iwm_to_wiphy(iwm), NULL,
-                                        params->ssid, params->ssid_len);
-        }
-        /* IBSS join only mode is not supported by UMAC ATM */
-        if (bss) {
-                cfg80211_put_bss(bss);
-                return -EOPNOTSUPP;
-        }
-
         iwm->channel = ieee80211_frequency_to_channel(chan->center_freq);
         iwm->umac_profile->ibss.band = chan->band;
         iwm->umac_profile->ibss.channel = iwm->channel;
         iwm->umac_profile->ssid.ssid_len = params->ssid_len;
         memcpy(iwm->umac_profile->ssid.ssid, params->ssid, params->ssid_len);
 
-        if (params->bssid)
-                memcpy(&iwm->umac_profile->bssid[0], params->bssid, ETH_ALEN);
-
         return iwm_send_mlme_profile(iwm);
 }
 
@@ -489,12 +471,12 @@ static int iwm_set_wpa_version(struct iwm_priv *iwm, u32 wpa_version)
                 return 0;
         }
 
+        if (wpa_version & NL80211_WPA_VERSION_1)
+                iwm->umac_profile->sec.flags = UMAC_SEC_FLG_WPA_ON_MSK;
+
         if (wpa_version & NL80211_WPA_VERSION_2)
                 iwm->umac_profile->sec.flags = UMAC_SEC_FLG_RSNA_ON_MSK;
 
-        if (wpa_version & NL80211_WPA_VERSION_1)
-                iwm->umac_profile->sec.flags |= UMAC_SEC_FLG_WPA_ON_MSK;
-
         return 0;
 }
 
@@ -645,6 +627,13 @@ static int iwm_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
                 iwm->default_key = sme->key_idx;
         }
 
+        /* WPA and open AUTH type from wpa_s means WPS (a.k.a. WSC) */
+        if ((iwm->umac_profile->sec.flags &
+             (UMAC_SEC_FLG_WPA_ON_MSK | UMAC_SEC_FLG_RSNA_ON_MSK)) &&
+            iwm->umac_profile->sec.auth_type == UMAC_AUTH_TYPE_OPEN) {
+                        iwm->umac_profile->sec.flags = UMAC_SEC_FLG_WSC_ON_MSK;
+        }
+
         ret = iwm_send_mlme_profile(iwm);
 
         if (iwm->umac_profile->sec.auth_type != UMAC_AUTH_TYPE_LEGACY_PSK ||
@@ -681,9 +670,19 @@ static int iwm_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *dev,
 static int iwm_cfg80211_set_txpower(struct wiphy *wiphy,
                                     enum tx_power_setting type, int dbm)
 {
+        struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
+        int ret;
+
         switch (type) {
         case TX_POWER_AUTOMATIC:
                 return 0;
+        case TX_POWER_FIXED:
+                ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_CFG_FIX,
+                                              CFG_TX_PWR_LIMIT_USR, dbm * 2);
+                if (ret < 0)
+                        return ret;
+
+                return iwm_tx_power_trigger(iwm);
         default:
                 return -EOPNOTSUPP;
         }
@@ -695,7 +694,7 @@ static int iwm_cfg80211_get_txpower(struct wiphy *wiphy, int *dbm)
 {
         struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
 
-        *dbm = iwm->txpower;
+        *dbm = iwm->txpower >> 1;
 
         return 0;
 }
diff --git a/drivers/net/wireless/iwmc3200wifi/commands.c b/drivers/net/wireless/iwmc3200wifi/commands.c
index 23b52fa2605f..cad511afd907 100644
--- a/drivers/net/wireless/iwmc3200wifi/commands.c
+++ b/drivers/net/wireless/iwmc3200wifi/commands.c
@@ -76,6 +76,11 @@ int iwm_send_wifi_if_cmd(struct iwm_priv *iwm, void *payload, u16 payload_size,
         int ret;
         u8 oid = hdr->oid;
 
+        if (!test_bit(IWM_STATUS_READY, &iwm->status)) {
+                IWM_ERR(iwm, "Interface is not ready yet");
+                return -EAGAIN;
+        }
+
         umac_cmd.id = UMAC_CMD_OPCODE_WIFI_IF_WRAPPER;
         umac_cmd.resp = resp;
 
@@ -274,6 +279,17 @@ int iwm_send_calib_results(struct iwm_priv *iwm)
         return ret;
 }
 
+int iwm_send_ct_kill_cfg(struct iwm_priv *iwm, u8 entry, u8 exit)
+{
+        struct iwm_ct_kill_cfg_cmd cmd;
+
+        cmd.entry_threshold = entry;
+        cmd.exit_threshold = exit;
+
+        return iwm_send_lmac_ptrough_cmd(iwm, REPLY_CT_KILL_CONFIG_CMD, &cmd,
+                                         sizeof(struct iwm_ct_kill_cfg_cmd), 0);
+}
+
 int iwm_send_umac_reset(struct iwm_priv *iwm, __le32 reset_flags, bool resp)
 {
         struct iwm_udma_wifi_cmd udma_cmd = UDMA_UMAC_INIT;
@@ -777,11 +793,24 @@ int iwm_invalidate_mlme_profile(struct iwm_priv *iwm)
                 return ret;
 
         ret = wait_event_interruptible_timeout(iwm->mlme_queue,
-                                (iwm->umac_profile_active == 0), 2 * HZ);
+                                (iwm->umac_profile_active == 0), 5 * HZ);
 
         return ret ? 0 : -EBUSY;
 }
 
+int iwm_tx_power_trigger(struct iwm_priv *iwm)
+{
+        struct iwm_umac_pwr_trigger pwr_trigger;
+
+        pwr_trigger.hdr.oid = UMAC_WIFI_IF_CMD_TX_PWR_TRIGGER;
+        pwr_trigger.hdr.buf_size =
+                cpu_to_le16(sizeof(struct iwm_umac_pwr_trigger) -
+                            sizeof(struct iwm_umac_wifi_if));
+
+
+        return iwm_send_wifi_if_cmd(iwm, &pwr_trigger, sizeof(pwr_trigger), 1);
+}
+
 int iwm_send_umac_stats_req(struct iwm_priv *iwm, u32 flags)
 {
         struct iwm_udma_wifi_cmd udma_cmd = UDMA_UMAC_INIT;
diff --git a/drivers/net/wireless/iwmc3200wifi/commands.h b/drivers/net/wireless/iwmc3200wifi/commands.h
index e24d5b633997..b36be2b23a3c 100644
--- a/drivers/net/wireless/iwmc3200wifi/commands.h
+++ b/drivers/net/wireless/iwmc3200wifi/commands.h
@@ -102,7 +102,6 @@ enum {
         CFG_SCAN_NUM_PASSIVE_CHAN_PER_PARTIAL_SCAN,
         CFG_TLC_SUPPORTED_TX_HT_RATES,
         CFG_TLC_SUPPORTED_TX_RATES,
-        CFG_TLC_VALID_ANTENNA,
         CFG_TLC_SPATIAL_STREAM_SUPPORTED,
         CFG_TLC_RETRY_PER_RATE,
         CFG_TLC_RETRY_PER_HT_RATE,
@@ -136,6 +135,10 @@ enum {
         CFG_TLC_RENEW_ADDBA_DELAY,
         CFG_TLC_NUM_OF_MULTISEC_TO_COUN_LOAD,
         CFG_TLC_IS_STABLE_IN_HT,
+        CFG_TLC_SR_SIC_1ST_FAIL,
+        CFG_TLC_SR_SIC_1ST_PASS,
+        CFG_TLC_SR_SIC_TOTAL_FAIL,
+        CFG_TLC_SR_SIC_TOTAL_PASS,
         CFG_RLC_CHAIN_CTRL,
         CFG_TRK_TABLE_OP_MODE,
         CFG_TRK_TABLE_RSSI_THRESHOLD,
@@ -147,6 +150,58 @@ enum {
         CFG_MLME_DBG_NOTIF_BLOCK,
         CFG_BT_OFF_BECONS_INTERVALS,
         CFG_BT_FRAG_DURATION,
+        CFG_ACTIVE_CHAINS,
+        CFG_CALIB_CTRL,
+        CFG_CAPABILITY_SUPPORTED_HT_RATES,
+        CFG_HT_MAC_PARAM_INFO,
+        CFG_MIMO_PS_MODE,
+        CFG_HT_DEFAULT_CAPABILIES_INFO,
+        CFG_LED_SC_RESOLUTION_FACTOR,
+        CFG_PTAM_ENERGY_CCK_DET_DEFAULT,
+        CFG_PTAM_CORR40_4_TH_ADD_MIN_MRC_DEFAULT,
+        CFG_PTAM_CORR40_4_TH_ADD_MIN_DEFAULT,
+        CFG_PTAM_CORR32_4_TH_ADD_MIN_MRC_DEFAULT,
+        CFG_PTAM_CORR32_4_TH_ADD_MIN_DEFAULT,
+        CFG_PTAM_CORR32_1_TH_ADD_MIN_MRC_DEFAULT,
+        CFG_PTAM_CORR32_1_TH_ADD_MIN_DEFAULT,
+        CFG_PTAM_ENERGY_CCK_DET_MIN_VAL,
+        CFG_PTAM_CORR40_4_TH_ADD_MIN_MRC_MIN_VAL,
+        CFG_PTAM_CORR40_4_TH_ADD_MIN_MIN_VAL,
+        CFG_PTAM_CORR32_4_TH_ADD_MIN_MRC_MIN_VAL,
+        CFG_PTAM_CORR32_4_TH_ADD_MIN_MIN_VAL,
+        CFG_PTAM_CORR32_1_TH_ADD_MIN_MRC_MIN_VAL,
+        CFG_PTAM_CORR32_1_TH_ADD_MIN_MIN_VAL,
+        CFG_PTAM_ENERGY_CCK_DET_MAX_VAL,
+        CFG_PTAM_CORR40_4_TH_ADD_MIN_MRC_MAX_VAL,
+        CFG_PTAM_CORR40_4_TH_ADD_MIN_MAX_VAL,
+        CFG_PTAM_CORR32_4_TH_ADD_MIN_MRC_MAX_VAL,
+        CFG_PTAM_CORR32_4_TH_ADD_MIN_MAX_VAL,
+        CFG_PTAM_CORR32_1_TH_ADD_MIN_MRC_MAX_VAL,
+        CFG_PTAM_CORR32_1_TH_ADD_MIN_MAX_VAL,
+        CFG_PTAM_ENERGY_CCK_DET_STEP_VAL,
+        CFG_PTAM_CORR40_4_TH_ADD_MIN_MRC_STEP_VAL,
+        CFG_PTAM_CORR40_4_TH_ADD_MIN_STEP_VAL,
+        CFG_PTAM_CORR32_4_TH_ADD_MIN_MRC_STEP_VAL,
+        CFG_PTAM_CORR32_4_TH_ADD_MIN_STEP_VAL,
+        CFG_PTAM_CORR32_1_TH_ADD_MIN_MRC_STEP_VAL,
+        CFG_PTAM_CORR32_1_TH_ADD_MIN_STEP_VAL,
+        CFG_PTAM_LINK_SENS_FA_OFDM_MAX,
+        CFG_PTAM_LINK_SENS_FA_OFDM_MIN,
+        CFG_PTAM_LINK_SENS_FA_CCK_MAX,
+        CFG_PTAM_LINK_SENS_FA_CCK_MIN,
+        CFG_PTAM_LINK_SENS_NRG_DIFF,
+        CFG_PTAM_LINK_SENS_NRG_MARGIN,
+        CFG_PTAM_LINK_SENS_MAX_NUMBER_OF_TIMES_IN_CCK_NO_FA,
+        CFG_PTAM_LINK_SENS_AUTO_CORR_MAX_TH_CCK,
+        CFG_AGG_MGG_TID_LOAD_ADDBA_THRESHOLD,
+        CFG_AGG_MGG_TID_LOAD_DELBA_THRESHOLD,
+        CFG_AGG_MGG_ADDBA_BUF_SIZE,
+        CFG_AGG_MGG_ADDBA_INACTIVE_TIMEOUT,
+        CFG_AGG_MGG_ADDBA_DEBUG_FLAGS,
+        CFG_SCAN_PERIODIC_RSSI_HIGH_THRESHOLD,
+        CFG_SCAN_PERIODIC_COEF_RSSI_HIGH,
+        CFG_11D_ENABLED,
+        CFG_11H_FEATURE_FLAGS,
 
         /* <-- LAST --> */
         CFG_TBL_FIX_LAST
@@ -155,7 +210,8 @@ enum {
 /* variable size table */
 enum {
         CFG_NET_ADDR = 0,
-        CFG_PROFILE,
+        CFG_LED_PATTERN_TABLE,
+
         /* <-- LAST --> */
         CFG_TBL_VAR_LAST
 };
@@ -288,6 +344,9 @@ struct iwm_umac_cmd_scan_request {
 /* iwm_umac_security.flag is WSC mode on -- bits [2:2] */
 #define UMAC_SEC_FLG_WSC_ON_POS         2
 #define UMAC_SEC_FLG_WSC_ON_SEED        1
+#define UMAC_SEC_FLG_WSC_ON_MSK         (UMAC_SEC_FLG_WSC_ON_SEED << \
+                                         UMAC_SEC_FLG_WSC_ON_POS)
+
 
 /* Legacy profile can use only WEP40 and WEP104 for encryption and
  * OPEN or PSK for authentication */
@@ -382,6 +441,11 @@ struct iwm_umac_tx_key_id {
         u8 reserved[3];
 } __attribute__ ((packed));
 
+struct iwm_umac_pwr_trigger {
+        struct iwm_umac_wifi_if hdr;
+        __le32 reseved;
+} __attribute__ ((packed));
+
 struct iwm_umac_cmd_stats_req {
         __le32 flags;
 } __attribute__ ((packed));
@@ -393,6 +457,7 @@ int iwm_send_init_calib_cfg(struct iwm_priv *iwm, u8 calib_requested);
 int iwm_send_periodic_calib_cfg(struct iwm_priv *iwm, u8 calib_requested);
 int iwm_send_calib_results(struct iwm_priv *iwm);
 int iwm_store_rxiq_calib_result(struct iwm_priv *iwm);
+int iwm_send_ct_kill_cfg(struct iwm_priv *iwm, u8 entry, u8 exit);
 
 /* UMAC commands */
 int iwm_send_wifi_if_cmd(struct iwm_priv *iwm, void *payload, u16 payload_size,
@@ -407,6 +472,7 @@ int iwm_invalidate_mlme_profile(struct iwm_priv *iwm);
 int iwm_send_packet(struct iwm_priv *iwm, struct sk_buff *skb, int pool_id);
 int iwm_set_tx_key(struct iwm_priv *iwm, u8 key_idx);
 int iwm_set_key(struct iwm_priv *iwm, bool remove, struct iwm_key *key);
+int iwm_tx_power_trigger(struct iwm_priv *iwm);
 int iwm_send_umac_stats_req(struct iwm_priv *iwm, u32 flags);
 int iwm_send_umac_channel_list(struct iwm_priv *iwm);
 int iwm_scan_ssids(struct iwm_priv *iwm, struct cfg80211_ssid *ssids,
diff --git a/drivers/net/wireless/iwmc3200wifi/fw.c b/drivers/net/wireless/iwmc3200wifi/fw.c
index 6b0bcad758ca..49067092d336 100644
--- a/drivers/net/wireless/iwmc3200wifi/fw.c
+++ b/drivers/net/wireless/iwmc3200wifi/fw.c
@@ -217,6 +217,13 @@ static int iwm_load_img(struct iwm_priv *iwm, const char *img_name)
                  IWM_BUILD_YEAR(build_date), IWM_BUILD_MONTH(build_date),
                  IWM_BUILD_DAY(build_date));
 
+        if (!strcmp(img_name, iwm->bus_ops->umac_name))
+                sprintf(iwm->umac_version, "%02X.%02X",
+                        ver->major, ver->minor);
+
+        if (!strcmp(img_name, iwm->bus_ops->lmac_name))
+                sprintf(iwm->lmac_version, "%02X.%02X",
+                        ver->major, ver->minor);
 
  err_release_fw:
         release_firmware(fw);
@@ -398,6 +405,8 @@ int iwm_load_fw(struct iwm_priv *iwm)
         iwm_send_prio_table(iwm);
         iwm_send_calib_results(iwm);
         iwm_send_periodic_calib_cfg(iwm, periodic_calib_map);
+        iwm_send_ct_kill_cfg(iwm, iwm->conf.ct_kill_entry,
+                             iwm->conf.ct_kill_exit);
 
         return 0;
 
diff --git a/drivers/net/wireless/iwmc3200wifi/iwm.h b/drivers/net/wireless/iwmc3200wifi/iwm.h
index 1b02a4e2a1ac..a9bf6bc97bea 100644
--- a/drivers/net/wireless/iwmc3200wifi/iwm.h
+++ b/drivers/net/wireless/iwmc3200wifi/iwm.h
@@ -65,6 +65,8 @@ struct iwm_conf {
         u32 sdio_ior_timeout;
         unsigned long calib_map;
         unsigned long expected_calib_map;
+        u8 ct_kill_entry;
+        u8 ct_kill_exit;
         bool reset_on_fatal_err;
         bool auto_connect;
         bool wimax_not_present;
@@ -276,12 +278,14 @@ struct iwm_priv {
         struct iw_statistics wstats;
         struct delayed_work stats_request;
         struct delayed_work disconnect;
+        struct delayed_work ct_kill_delay;
 
         struct iwm_debugfs dbg;
 
         u8 *eeprom;
         struct timer_list watchdog;
         struct work_struct reset_worker;
+        struct work_struct auth_retry_worker;
         struct mutex mutex;
 
         u8 *req_ie;
@@ -290,6 +294,8 @@ struct iwm_priv {
         int resp_ie_len;
 
         struct iwm_fw_error_hdr *last_fw_err;
+        char umac_version[8];
+        char lmac_version[8];
 
         char private[0] __attribute__((__aligned__(NETDEV_ALIGN)));
 };
diff --git a/drivers/net/wireless/iwmc3200wifi/lmac.h b/drivers/net/wireless/iwmc3200wifi/lmac.h
index 6c1a14c4480f..a3a79b5e2898 100644
--- a/drivers/net/wireless/iwmc3200wifi/lmac.h
+++ b/drivers/net/wireless/iwmc3200wifi/lmac.h
@@ -187,6 +187,14 @@ struct iwm_coex_prio_table_cmd {
                                      COEX_EVT_FLAG_MEDIUM_ACTV_NTFY_MSK | \
                                      COEX_EVT_FLAG_DELAY_MEDIUM_FREE_NTFY_MSK)
 
+/* CT kill config command */
+struct iwm_ct_kill_cfg_cmd {
+        u32 exit_threshold;
+        u32 reserved;
+        u32 entry_threshold;
+} __attribute__ ((packed));
+
+
 /* LMAC OP CODES */
 #define REPLY_PAD                       0x0
 #define REPLY_ALIVE                     0x1
diff --git a/drivers/net/wireless/iwmc3200wifi/main.c b/drivers/net/wireless/iwmc3200wifi/main.c
index 170f33706490..f93e9139b0f2 100644
--- a/drivers/net/wireless/iwmc3200wifi/main.c
+++ b/drivers/net/wireless/iwmc3200wifi/main.c
@@ -63,6 +63,8 @@ static struct iwm_conf def_iwm_conf = {
                                   BIT(PHY_CALIBRATE_TX_IQ_CMD)  |
                                   BIT(PHY_CALIBRATE_RX_IQ_CMD)  |
                                   BIT(SHILOH_PHY_CALIBRATE_BASE_BAND_CMD),
+        .ct_kill_entry          = 110,
+        .ct_kill_exit           = 110,
         .reset_on_fatal_err     = 1,
         .auto_connect           = 1,
         .wimax_not_present      = 0,
@@ -133,6 +135,17 @@ static void iwm_disconnect_work(struct work_struct *work)
         cfg80211_disconnected(iwm_to_ndev(iwm), 0, NULL, 0, GFP_KERNEL);
 }
 
+static void iwm_ct_kill_work(struct work_struct *work)
+{
+        struct iwm_priv *iwm =
+                container_of(work, struct iwm_priv, ct_kill_delay.work);
+        struct wiphy *wiphy = iwm_to_wiphy(iwm);
+
+        IWM_INFO(iwm, "CT kill delay timeout\n");
+
+        wiphy_rfkill_set_hw_state(wiphy, false);
+}
+
 static int __iwm_up(struct iwm_priv *iwm);
 static int __iwm_down(struct iwm_priv *iwm);
 
@@ -194,6 +207,33 @@ static void iwm_reset_worker(struct work_struct *work)
         mutex_unlock(&iwm->mutex);
 }
 
+static void iwm_auth_retry_worker(struct work_struct *work)
+{
+        struct iwm_priv *iwm;
+        int i, ret;
+
+        iwm = container_of(work, struct iwm_priv, auth_retry_worker);
+        if (iwm->umac_profile_active) {
+                ret = iwm_invalidate_mlme_profile(iwm);
+                if (ret < 0)
+                        return;
+        }
+
+        iwm->umac_profile->sec.auth_type = UMAC_AUTH_TYPE_LEGACY_PSK;
+
+        ret = iwm_send_mlme_profile(iwm);
+        if (ret < 0)
+                return;
+
+        for (i = 0; i < IWM_NUM_KEYS; i++)
+                if (iwm->keys[i].key_len)
+                        iwm_set_key(iwm, 0, &iwm->keys[i]);
+
+        iwm_set_tx_key(iwm, iwm->default_key);
+}
+
+
+
 static void iwm_watchdog(unsigned long data)
 {
         struct iwm_priv *iwm = (struct iwm_priv *)data;
@@ -225,7 +265,9 @@ int iwm_priv_init(struct iwm_priv *iwm)
         iwm->scan_id = 1;
         INIT_DELAYED_WORK(&iwm->stats_request, iwm_statistics_request);
         INIT_DELAYED_WORK(&iwm->disconnect, iwm_disconnect_work);
+        INIT_DELAYED_WORK(&iwm->ct_kill_delay, iwm_ct_kill_work);
         INIT_WORK(&iwm->reset_worker, iwm_reset_worker);
+        INIT_WORK(&iwm->auth_retry_worker, iwm_auth_retry_worker);
         INIT_LIST_HEAD(&iwm->bss_list);
 
         skb_queue_head_init(&iwm->rx_list);
@@ -586,6 +628,7 @@ static int __iwm_up(struct iwm_priv *iwm)
 {
         int ret;
         struct iwm_notif *notif_reboot, *notif_ack = NULL;
+        struct wiphy *wiphy = iwm_to_wiphy(iwm);
 
         ret = iwm_bus_enable(iwm);
         if (ret) {
@@ -647,6 +690,9 @@ static int __iwm_up(struct iwm_priv *iwm)
                 goto err_disable;
         }
 
+        snprintf(wiphy->fw_version, sizeof(wiphy->fw_version), "L%s_U%s",
+                 iwm->lmac_version, iwm->umac_version);
+
         /* We configure the UMAC and enable the wifi module */
         ret = iwm_send_umac_config(iwm,
                         cpu_to_le32(UMAC_RST_CTRL_FLG_WIFI_CORE_EN) |
diff --git a/drivers/net/wireless/iwmc3200wifi/netdev.c b/drivers/net/wireless/iwmc3200wifi/netdev.c
index 35ec006c2d2c..4f8dbdd7b917 100644
--- a/drivers/net/wireless/iwmc3200wifi/netdev.c
+++ b/drivers/net/wireless/iwmc3200wifi/netdev.c
@@ -152,6 +152,7 @@ void iwm_if_free(struct iwm_priv *iwm)
         if (!iwm_to_ndev(iwm))
                 return;
 
+        cancel_delayed_work_sync(&iwm->ct_kill_delay);
         free_netdev(iwm_to_ndev(iwm));
         iwm_priv_deinit(iwm);
         kfree(iwm->umac_profile);
diff --git a/drivers/net/wireless/iwmc3200wifi/rx.c b/drivers/net/wireless/iwmc3200wifi/rx.c
index 40dbcbc16593..3ad95dc0dd8d 100644
--- a/drivers/net/wireless/iwmc3200wifi/rx.c
+++ b/drivers/net/wireless/iwmc3200wifi/rx.c
@@ -422,7 +422,9 @@ static int iwm_ntf_rx_ticket(struct iwm_priv *iwm, u8 *buf,
                         if (IS_ERR(ticket_node))
                                 return PTR_ERR(ticket_node);
 
-                        IWM_DBG_RX(iwm, DBG, "TICKET RELEASE(%d)\n",
+                        IWM_DBG_RX(iwm, DBG, "TICKET %s(%d)\n",
+                                   ticket->action ==  IWM_RX_TICKET_RELEASE ?
+                                   "RELEASE" : "DROP",
                                    ticket->id);
                         list_add_tail(&ticket_node->node, &iwm->rx_tickets);
 
@@ -499,6 +501,18 @@ static int iwm_mlme_assoc_start(struct iwm_priv *iwm, u8 *buf,
         return 0;
 }
 
+static u8 iwm_is_open_wep_profile(struct iwm_priv *iwm)
+{
+        if ((iwm->umac_profile->sec.ucast_cipher == UMAC_CIPHER_TYPE_WEP_40 ||
+             iwm->umac_profile->sec.ucast_cipher == UMAC_CIPHER_TYPE_WEP_104) &&
+            (iwm->umac_profile->sec.ucast_cipher ==
+             iwm->umac_profile->sec.mcast_cipher) &&
+            (iwm->umac_profile->sec.auth_type == UMAC_AUTH_TYPE_OPEN))
+               return 1;
+
+       return 0;
+}
+
 static int iwm_mlme_assoc_complete(struct iwm_priv *iwm, u8 *buf,
                                    unsigned long buf_size,
                                    struct iwm_wifi_cmd *cmd)
@@ -564,11 +578,17 @@ static int iwm_mlme_assoc_complete(struct iwm_priv *iwm, u8 *buf,
                         goto ibss;
 
                 if (!test_bit(IWM_STATUS_RESETTING, &iwm->status))
-                        cfg80211_connect_result(iwm_to_ndev(iwm),
-                                                complete->bssid,
-                                                NULL, 0, NULL, 0,
-                                                WLAN_STATUS_UNSPECIFIED_FAILURE,
-                                                GFP_KERNEL);
+                        if (!iwm_is_open_wep_profile(iwm)) {
+                                cfg80211_connect_result(iwm_to_ndev(iwm),
+                                               complete->bssid,
+                                               NULL, 0, NULL, 0,
+                                               WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                               GFP_KERNEL);
+                        } else {
+                                /* Let's try shared WEP auth */
+                                IWM_ERR(iwm, "Trying WEP shared auth\n");
+                                schedule_work(&iwm->auth_retry_worker);
+                        }
                 else
                         cfg80211_disconnected(iwm_to_ndev(iwm), 0, NULL, 0,
                                               GFP_KERNEL);
@@ -712,6 +732,19 @@ static int iwm_mlme_update_sta_table(struct iwm_priv *iwm, u8 *buf,
         return 0;
 }
 
+static int iwm_mlme_medium_lost(struct iwm_priv *iwm, u8 *buf,
+                                unsigned long buf_size,
+                                struct iwm_wifi_cmd *cmd)
+{
+        struct wiphy *wiphy = iwm_to_wiphy(iwm);
+
+        IWM_DBG_NTF(iwm, DBG, "WiFi/WiMax coexistence radio is OFF\n");
+
+        wiphy_rfkill_set_hw_state(wiphy, true);
+
+        return 0;
+}
+
 static int iwm_mlme_update_bss_table(struct iwm_priv *iwm, u8 *buf,
                                      unsigned long buf_size,
                                      struct iwm_wifi_cmd *cmd)
@@ -898,6 +931,8 @@ static int iwm_ntf_mlme(struct iwm_priv *iwm, u8 *buf,
         case WIFI_IF_NTFY_EXTENDED_IE_REQUIRED:
                 IWM_DBG_MLME(iwm, DBG, "Extended IE required\n");
                 break;
+        case WIFI_IF_NTFY_RADIO_PREEMPTION:
+                return iwm_mlme_medium_lost(iwm, buf, buf_size, cmd);
         case WIFI_IF_NTFY_BSS_TRK_TABLE_CHANGED:
                 return iwm_mlme_update_bss_table(iwm, buf, buf_size, cmd);
         case WIFI_IF_NTFY_BSS_TRK_ENTRIES_REMOVED:
@@ -1055,8 +1090,14 @@ static int iwm_ntf_wifi_if_wrapper(struct iwm_priv *iwm, u8 *buf,
                                    unsigned long buf_size,
                                    struct iwm_wifi_cmd *cmd)
 {
-        struct iwm_umac_wifi_if *hdr =
-                        (struct iwm_umac_wifi_if *)cmd->buf.payload;
+        struct iwm_umac_wifi_if *hdr;
+
+        if (cmd == NULL) {
+                IWM_ERR(iwm, "Couldn't find expected wifi command\n");
+                return -EINVAL;
+        }
+
+        hdr = (struct iwm_umac_wifi_if *)cmd->buf.payload;
 
         IWM_DBG_NTF(iwm, DBG, "WIFI_IF_WRAPPER cmd is delivered to UMAC: "
                     "oid is 0x%x\n", hdr->oid);
@@ -1078,6 +1119,7 @@ static int iwm_ntf_wifi_if_wrapper(struct iwm_priv *iwm, u8 *buf,
         return 0;
 }
 
+#define CT_KILL_DELAY (30 * HZ)
 static int iwm_ntf_card_state(struct iwm_priv *iwm, u8 *buf,
                               unsigned long buf_size, struct iwm_wifi_cmd *cmd)
 {
@@ -1090,7 +1132,20 @@ static int iwm_ntf_card_state(struct iwm_priv *iwm, u8 *buf,
                  flags & IWM_CARD_STATE_HW_DISABLED ? "ON" : "OFF",
                  flags & IWM_CARD_STATE_CTKILL_DISABLED ? "ON" : "OFF");
 
-        wiphy_rfkill_set_hw_state(wiphy, flags & IWM_CARD_STATE_HW_DISABLED);
+        if (flags & IWM_CARD_STATE_CTKILL_DISABLED) {
+                /*
+                 * We got a CTKILL event: We bring the interface down in
+                 * oder to cool the device down, and try to bring it up
+                 * 30 seconds later. If it's still too hot, we'll go through
+                 * this code path again.
+                 */
+                cancel_delayed_work_sync(&iwm->ct_kill_delay);
+                schedule_delayed_work(&iwm->ct_kill_delay, CT_KILL_DELAY);
+        }
+
+        wiphy_rfkill_set_hw_state(wiphy, flags &
+                                  (IWM_CARD_STATE_HW_DISABLED |
+                                   IWM_CARD_STATE_CTKILL_DISABLED));
 
         return 0;
 }
@@ -1281,6 +1336,14 @@ int iwm_rx_handle(struct iwm_priv *iwm, u8 *buf, unsigned long buf_size)
 
         switch (le32_to_cpu(hdr->cmd)) {
         case UMAC_REBOOT_BARKER:
+                if (test_bit(IWM_STATUS_READY, &iwm->status)) {
+                        IWM_ERR(iwm, "Unexpected BARKER\n");
+
+                        schedule_work(&iwm->reset_worker);
+
+                        return 0;
+                }
+
                 return iwm_notif_send(iwm, NULL, IWM_BARKER_REBOOT_NOTIFICATION,
                                       IWM_SRC_UDMA, buf, buf_size);
         case UMAC_ACK_BARKER:
@@ -1443,7 +1506,8 @@ static void iwm_rx_process_packet(struct iwm_priv *iwm,
                 }
                 break;
         case IWM_RX_TICKET_DROP:
-                IWM_DBG_RX(iwm, DBG, "DROP packet\n");
+                IWM_DBG_RX(iwm, DBG, "DROP packet: 0x%x\n",
+                           le16_to_cpu(ticket_node->ticket->flags));
                 kfree_skb(packet->skb);
                 break;
         default:
diff --git a/drivers/net/wireless/iwmc3200wifi/sdio.c b/drivers/net/wireless/iwmc3200wifi/sdio.c
index 8b1de84003ca..cf86294f719b 100644
--- a/drivers/net/wireless/iwmc3200wifi/sdio.c
+++ b/drivers/net/wireless/iwmc3200wifi/sdio.c
@@ -224,8 +224,6 @@ static int if_sdio_disable(struct iwm_priv *iwm)
         struct iwm_sdio_priv *hw = iwm_to_if_sdio(iwm);
         int ret;
 
-        iwm_reset(iwm);
-
         sdio_claim_host(hw->func);
         sdio_writeb(hw->func, 0, IWM_SDIO_INTR_ENABLE_ADDR, &ret);
         if (ret < 0)
@@ -237,6 +235,8 @@ static int if_sdio_disable(struct iwm_priv *iwm)
 
         iwm_sdio_rx_free(hw);
 
+        iwm_reset(iwm);
+
         IWM_DBG_SDIO(iwm, INFO, "IWM SDIO disable\n");
 
         return 0;
@@ -493,8 +493,10 @@ static void iwm_sdio_remove(struct sdio_func *func)
 }
 
 static const struct sdio_device_id iwm_sdio_ids[] = {
-        { SDIO_DEVICE(SDIO_VENDOR_ID_INTEL,
-                      SDIO_DEVICE_ID_INTEL_IWMC3200WIFI) },
+        /* Global/AGN SKU */
+        { SDIO_DEVICE(SDIO_VENDOR_ID_INTEL, 0x1403) },
+        /* BGN SKU */
+        { SDIO_DEVICE(SDIO_VENDOR_ID_INTEL, 0x1408) },
         { /* end: all zeroes */ },
 };
 MODULE_DEVICE_TABLE(sdio, iwm_sdio_ids);
diff --git a/drivers/net/wireless/iwmc3200wifi/umac.h b/drivers/net/wireless/iwmc3200wifi/umac.h
index c5a14ae3160a..be903543bb47 100644
--- a/drivers/net/wireless/iwmc3200wifi/umac.h
+++ b/drivers/net/wireless/iwmc3200wifi/umac.h
@@ -687,6 +687,9 @@ struct iwm_umac_notif_rx_ticket {
 /* Tx/Rx rates window (number of max of last update window per second) */
 #define UMAC_NTF_RATE_SAMPLE_NR 4
 
+/* Max numbers of bits required to go through all antennae in bitmasks */
+#define UMAC_PHY_NUM_CHAINS     3
+
 #define IWM_UMAC_MGMT_TID       8
 #define IWM_UMAC_TID_NR         8
 
@@ -697,9 +700,11 @@ struct iwm_umac_notif_stats {
         __le16 tid_load[IWM_UMAC_TID_NR + 2]; /* 1 non-QoS + 1 dword align */
         __le16 tx_rate[UMAC_NTF_RATE_SAMPLE_NR];
         __le16 rx_rate[UMAC_NTF_RATE_SAMPLE_NR];
+        __le32 chain_energy[UMAC_PHY_NUM_CHAINS];
         s32 rssi_dbm;
         s32 noise_dbm;
         __le32 supp_rates;
+        __le32 supp_ht_rates;
         __le32 missed_beacons;
         __le32 rx_beacons;
         __le32 rx_dir_pkts;
diff --git a/drivers/net/wireless/libertas/11d.c b/drivers/net/wireless/libertas/11d.c
deleted file mode 100644
index 5c6968101f0d..000000000000
--- a/drivers/net/wireless/libertas/11d.c
+++ /dev/null
@@ -1,696 +0,0 @@
-/**
-  * This file contains functions for 802.11D.
-  */
-#include <linux/ctype.h>
-#include <linux/kernel.h>
-#include <linux/wireless.h>
-
-#include "host.h"
-#include "decl.h"
-#include "11d.h"
-#include "dev.h"
-#include "wext.h"
-
-#define TX_PWR_DEFAULT  10
-
-static struct region_code_mapping region_code_mapping[] = {
-        {"US ", 0x10},          /* US FCC      */
-        {"CA ", 0x10},          /* IC Canada   */
-        {"SG ", 0x10},          /* Singapore   */
-        {"EU ", 0x30},          /* ETSI        */
-        {"AU ", 0x30},          /* Australia   */
-        {"KR ", 0x30},          /* Republic Of Korea */
-        {"ES ", 0x31},          /* Spain       */
-        {"FR ", 0x32},          /* France      */
-        {"JP ", 0x40},          /* Japan       */
-};
-
-/* Following 2 structure defines the supported channels */
-static struct chan_freq_power channel_freq_power_UN_BG[] = {
-        {1, 2412, TX_PWR_DEFAULT},
-        {2, 2417, TX_PWR_DEFAULT},
-        {3, 2422, TX_PWR_DEFAULT},
-        {4, 2427, TX_PWR_DEFAULT},
-        {5, 2432, TX_PWR_DEFAULT},
-        {6, 2437, TX_PWR_DEFAULT},
-        {7, 2442, TX_PWR_DEFAULT},
-        {8, 2447, TX_PWR_DEFAULT},
-        {9, 2452, TX_PWR_DEFAULT},
-        {10, 2457, TX_PWR_DEFAULT},
-        {11, 2462, TX_PWR_DEFAULT},
-        {12, 2467, TX_PWR_DEFAULT},
-        {13, 2472, TX_PWR_DEFAULT},
-        {14, 2484, TX_PWR_DEFAULT}
-};
-
-static u8 lbs_region_2_code(u8 *region)
-{
-        u8 i;
-
-        for (i = 0; i < COUNTRY_CODE_LEN && region[i]; i++)
-                region[i] = toupper(region[i]);
-
-        for (i = 0; i < ARRAY_SIZE(region_code_mapping); i++) {
-                if (!memcmp(region, region_code_mapping[i].region,
-                            COUNTRY_CODE_LEN))
-                        return (region_code_mapping[i].code);
-        }
-
-        /* default is US */
-        return (region_code_mapping[0].code);
-}
-
-static u8 *lbs_code_2_region(u8 code)
-{
-        u8 i;
-
-        for (i = 0; i < ARRAY_SIZE(region_code_mapping); i++) {
-                if (region_code_mapping[i].code == code)
-                        return (region_code_mapping[i].region);
-        }
-        /* default is US */
-        return (region_code_mapping[0].region);
-}
-
-/**
- *  @brief This function finds the nrchan-th chan after the firstchan
- *  @param band       band
- *  @param firstchan  first channel number
- *  @param nrchan   number of channels
- *  @return           the nrchan-th chan number
-*/
-static u8 lbs_get_chan_11d(u8 firstchan, u8 nrchan, u8 *chan)
-/*find the nrchan-th chan after the firstchan*/
-{
-        u8 i;
-        struct chan_freq_power *cfp;
-        u8 cfp_no;
-
-        cfp = channel_freq_power_UN_BG;
-        cfp_no = ARRAY_SIZE(channel_freq_power_UN_BG);
-
-        for (i = 0; i < cfp_no; i++) {
-                if ((cfp + i)->channel == firstchan) {
-                        lbs_deb_11d("firstchan found\n");
-                        break;
-                }
-        }
-
-        if (i < cfp_no) {
-                /*if beyond the boundary */
-                if (i + nrchan < cfp_no) {
-                        *chan = (cfp + i + nrchan)->channel;
-                        return 1;
-                }
-        }
-
-        return 0;
-}
-
-/**
- *  @brief This function Checks if chan txpwr is learned from AP/IBSS
- *  @param chan                 chan number
- *  @param parsed_region_chan   pointer to parsed_region_chan_11d
- *  @return                     TRUE; FALSE
-*/
-static u8 lbs_channel_known_11d(u8 chan,
-                          struct parsed_region_chan_11d * parsed_region_chan)
-{
-        struct chan_power_11d *chanpwr = parsed_region_chan->chanpwr;
-        u8 nr_chan = parsed_region_chan->nr_chan;
-        u8 i = 0;
-
-        lbs_deb_hex(LBS_DEB_11D, "parsed_region_chan", (char *)chanpwr,
-                sizeof(struct chan_power_11d) * nr_chan);
-
-        for (i = 0; i < nr_chan; i++) {
-                if (chan == chanpwr[i].chan) {
-                        lbs_deb_11d("found chan %d\n", chan);
-                        return 1;
-                }
-        }
-
-        lbs_deb_11d("chan %d not found\n", chan);
-        return 0;
-}
-
-u32 lbs_chan_2_freq(u8 chan)
-{
-        struct chan_freq_power *cf;
-        u16 i;
-        u32 freq = 0;
-
-        cf = channel_freq_power_UN_BG;
-
-        for (i = 0; i < ARRAY_SIZE(channel_freq_power_UN_BG); i++) {
-                if (chan == cf[i].channel)
-                        freq = cf[i].freq;
-        }
-
-        return freq;
-}
-
-static int generate_domain_info_11d(struct parsed_region_chan_11d
-                                  *parsed_region_chan,
-                                  struct lbs_802_11d_domain_reg *domaininfo)
-{
-        u8 nr_subband = 0;
-
-        u8 nr_chan = parsed_region_chan->nr_chan;
-        u8 nr_parsedchan = 0;
-
-        u8 firstchan = 0, nextchan = 0, maxpwr = 0;
-
-        u8 i, flag = 0;
-
-        memcpy(domaininfo->countrycode, parsed_region_chan->countrycode,
-               COUNTRY_CODE_LEN);
-
-        lbs_deb_11d("nrchan %d\n", nr_chan);
-        lbs_deb_hex(LBS_DEB_11D, "parsed_region_chan", (char *)parsed_region_chan,
-                sizeof(struct parsed_region_chan_11d));
-
-        for (i = 0; i < nr_chan; i++) {
-                if (!flag) {
-                        flag = 1;
-                        nextchan = firstchan =
-                            parsed_region_chan->chanpwr[i].chan;
-                        maxpwr = parsed_region_chan->chanpwr[i].pwr;
-                        nr_parsedchan = 1;
-                        continue;
-                }
-
-                if (parsed_region_chan->chanpwr[i].chan == nextchan + 1 &&
-                    parsed_region_chan->chanpwr[i].pwr == maxpwr) {
-                        nextchan++;
-                        nr_parsedchan++;
-                } else {
-                        domaininfo->subband[nr_subband].firstchan = firstchan;
-                        domaininfo->subband[nr_subband].nrchan =
-                            nr_parsedchan;
-                        domaininfo->subband[nr_subband].maxtxpwr = maxpwr;
-                        nr_subband++;
-                        nextchan = firstchan =
-                            parsed_region_chan->chanpwr[i].chan;
-                        maxpwr = parsed_region_chan->chanpwr[i].pwr;
-                }
-        }
-
-        if (flag) {
-                domaininfo->subband[nr_subband].firstchan = firstchan;
-                domaininfo->subband[nr_subband].nrchan = nr_parsedchan;
-                domaininfo->subband[nr_subband].maxtxpwr = maxpwr;
-                nr_subband++;
-        }
-        domaininfo->nr_subband = nr_subband;
-
-        lbs_deb_11d("nr_subband=%x\n", domaininfo->nr_subband);
-        lbs_deb_hex(LBS_DEB_11D, "domaininfo", (char *)domaininfo,
-                COUNTRY_CODE_LEN + 1 +
-                sizeof(struct ieee_subbandset) * nr_subband);
-        return 0;
-}
-
-/**
- *  @brief This function generates parsed_region_chan from Domain Info learned from AP/IBSS
- *  @param region_chan          pointer to struct region_channel
- *  @param *parsed_region_chan  pointer to parsed_region_chan_11d
- *  @return                     N/A
-*/
-static void lbs_generate_parsed_region_chan_11d(struct region_channel *region_chan,
-                                          struct parsed_region_chan_11d *
-                                          parsed_region_chan)
-{
-        u8 i;
-        struct chan_freq_power *cfp;
-
-        if (region_chan == NULL) {
-                lbs_deb_11d("region_chan is NULL\n");
-                return;
-        }
-
-        cfp = region_chan->CFP;
-        if (cfp == NULL) {
-                lbs_deb_11d("cfp is NULL \n");
-                return;
-        }
-
-        parsed_region_chan->band = region_chan->band;
-        parsed_region_chan->region = region_chan->region;
-        memcpy(parsed_region_chan->countrycode,
-               lbs_code_2_region(region_chan->region), COUNTRY_CODE_LEN);
-
-        lbs_deb_11d("region 0x%x, band %d\n", parsed_region_chan->region,
-               parsed_region_chan->band);
-
-        for (i = 0; i < region_chan->nrcfp; i++, cfp++) {
-                parsed_region_chan->chanpwr[i].chan = cfp->channel;
-                parsed_region_chan->chanpwr[i].pwr = cfp->maxtxpower;
-                lbs_deb_11d("chan %d, pwr %d\n",
-                       parsed_region_chan->chanpwr[i].chan,
-                       parsed_region_chan->chanpwr[i].pwr);
-        }
-        parsed_region_chan->nr_chan = region_chan->nrcfp;
-
-        lbs_deb_11d("nrchan %d\n", parsed_region_chan->nr_chan);
-
-        return;
-}
-
-/**
- *  @brief generate parsed_region_chan from Domain Info learned from AP/IBSS
- *  @param region               region ID
- *  @param band                 band
- *  @param chan                 chan
- *  @return                     TRUE;FALSE
-*/
-static u8 lbs_region_chan_supported_11d(u8 region, u8 chan)
-{
-        struct chan_freq_power *cfp;
-        int cfp_no;
-        u8 idx;
-        int ret = 0;
-
-        lbs_deb_enter(LBS_DEB_11D);
-
-        cfp = lbs_get_region_cfp_table(region, &cfp_no);
-        if (cfp == NULL)
-                return 0;
-
-        for (idx = 0; idx < cfp_no; idx++) {
-                if (chan == (cfp + idx)->channel) {
-                        /* If Mrvl Chip Supported? */
-                        if ((cfp + idx)->unsupported) {
-                                ret = 0;
-                        } else {
-                                ret = 1;
-                        }
-                        goto done;
-                }
-        }
-
-        /*chan is not in the region table */
-
-done:
-        lbs_deb_leave_args(LBS_DEB_11D, "ret %d", ret);
-        return ret;
-}
-
-/**
- *  @brief This function checks if chan txpwr is learned from AP/IBSS
- *  @param chan                 chan number
- *  @param parsed_region_chan   pointer to parsed_region_chan_11d
- *  @return                     0
-*/
-static int parse_domain_info_11d(struct ieee_ie_country_info_full_set *countryinfo,
-                                 u8 band,
-                                 struct parsed_region_chan_11d *parsed_region_chan)
-{
-        u8 nr_subband, nrchan;
-        u8 lastchan, firstchan;
-        u8 region;
-        u8 curchan = 0;
-
-        u8 idx = 0;             /*chan index in parsed_region_chan */
-
-        u8 j, i;
-
-        lbs_deb_enter(LBS_DEB_11D);
-
-        /*validation Rules:
-           1. valid region Code
-           2. First Chan increment
-           3. channel range no overlap
-           4. channel is valid?
-           5. channel is supported by region?
-           6. Others
-         */
-
-        lbs_deb_hex(LBS_DEB_11D, "countryinfo", (u8 *) countryinfo, 30);
-
-        if ((*(countryinfo->countrycode)) == 0
-            || (countryinfo->header.len <= COUNTRY_CODE_LEN)) {
-                /* No region Info or Wrong region info: treat as No 11D info */
-                goto done;
-        }
-
-        /*Step1: check region_code */
-        parsed_region_chan->region = region =
-            lbs_region_2_code(countryinfo->countrycode);
-
-        lbs_deb_11d("regioncode=%x\n", (u8) parsed_region_chan->region);
-        lbs_deb_hex(LBS_DEB_11D, "countrycode", (char *)countryinfo->countrycode,
-                COUNTRY_CODE_LEN);
-
-        parsed_region_chan->band = band;
-
-        memcpy(parsed_region_chan->countrycode, countryinfo->countrycode,
-               COUNTRY_CODE_LEN);
-
-        nr_subband = (countryinfo->header.len - COUNTRY_CODE_LEN) /
-            sizeof(struct ieee_subbandset);
-
-        for (j = 0, lastchan = 0; j < nr_subband; j++) {
-
-                if (countryinfo->subband[j].firstchan <= lastchan) {
-                        /*Step2&3. Check First Chan Num increment and no overlap */
-                        lbs_deb_11d("chan %d>%d, overlap\n",
-                               countryinfo->subband[j].firstchan, lastchan);
-                        continue;
-                }
-
-                firstchan = countryinfo->subband[j].firstchan;
-                nrchan = countryinfo->subband[j].nrchan;
-
-                for (i = 0; idx < MAX_NO_OF_CHAN && i < nrchan; i++) {
-                        /*step4: channel is supported? */
-
-                        if (!lbs_get_chan_11d(firstchan, i, &curchan)) {
-                                /* Chan is not found in UN table */
-                                lbs_deb_11d("chan is not supported: %d \n", i);
-                                break;
-                        }
-
-                        lastchan = curchan;
-
-                        if (lbs_region_chan_supported_11d(region, curchan)) {
-                                /*step5: Check if curchan is supported by mrvl in region */
-                                parsed_region_chan->chanpwr[idx].chan = curchan;
-                                parsed_region_chan->chanpwr[idx].pwr =
-                                    countryinfo->subband[j].maxtxpwr;
-                                idx++;
-                        } else {
-                                /*not supported and ignore the chan */
-                                lbs_deb_11d(
-                                       "i %d, chan %d unsupported in region %x, band %d\n",
-                                       i, curchan, region, band);
-                        }
-                }
-
-                /*Step6: Add other checking if any */
-
-        }
-
-        parsed_region_chan->nr_chan = idx;
-
-        lbs_deb_11d("nrchan=%x\n", parsed_region_chan->nr_chan);
-        lbs_deb_hex(LBS_DEB_11D, "parsed_region_chan", (u8 *) parsed_region_chan,
-                2 + COUNTRY_CODE_LEN + sizeof(struct parsed_region_chan_11d) * idx);
-
-done:
-        lbs_deb_enter(LBS_DEB_11D);
-        return 0;
-}
-
-/**
- *  @brief This function calculates the scan type for channels
- *  @param chan                 chan number
- *  @param parsed_region_chan   pointer to parsed_region_chan_11d
- *  @return                     PASSIVE if chan is unknown; ACTIVE if chan is known
-*/
-u8 lbs_get_scan_type_11d(u8 chan,
-                          struct parsed_region_chan_11d * parsed_region_chan)
-{
-        u8 scan_type = CMD_SCAN_TYPE_PASSIVE;
-
-        lbs_deb_enter(LBS_DEB_11D);
-
-        if (lbs_channel_known_11d(chan, parsed_region_chan)) {
-                lbs_deb_11d("found, do active scan\n");
-                scan_type = CMD_SCAN_TYPE_ACTIVE;
-        } else {
-                lbs_deb_11d("not found, do passive scan\n");
-        }
-
-        lbs_deb_leave_args(LBS_DEB_11D, "ret scan_type %d", scan_type);
-        return scan_type;
-
-}
-
-void lbs_init_11d(struct lbs_private *priv)
-{
-        priv->enable11d = 0;
-        memset(&(priv->parsed_region_chan), 0,
-               sizeof(struct parsed_region_chan_11d));
-        return;
-}
-
-/**
- *  @brief This function sets DOMAIN INFO to FW
- *  @param priv       pointer to struct lbs_private
- *  @return           0; -1
-*/
-static int set_domain_info_11d(struct lbs_private *priv)
-{
-        int ret;
-
-        if (!priv->enable11d) {
-                lbs_deb_11d("dnld domain Info with 11d disabled\n");
-                return 0;
-        }
-
-        ret = lbs_prepare_and_send_command(priv, CMD_802_11D_DOMAIN_INFO,
-                                    CMD_ACT_SET,
-                                    CMD_OPTION_WAITFORRSP, 0, NULL);
-        if (ret)
-                lbs_deb_11d("fail to dnld domain info\n");
-
-        return ret;
-}
-
-/**
- *  @brief This function setups scan channels
- *  @param priv       pointer to struct lbs_private
- *  @param band       band
- *  @return           0
-*/
-int lbs_set_universaltable(struct lbs_private *priv, u8 band)
-{
-        u16 size = sizeof(struct chan_freq_power);
-        u16 i = 0;
-
-        memset(priv->universal_channel, 0,
-               sizeof(priv->universal_channel));
-
-        priv->universal_channel[i].nrcfp =
-            sizeof(channel_freq_power_UN_BG) / size;
-        lbs_deb_11d("BG-band nrcfp %d\n",
-               priv->universal_channel[i].nrcfp);
-
-        priv->universal_channel[i].CFP = channel_freq_power_UN_BG;
-        priv->universal_channel[i].valid = 1;
-        priv->universal_channel[i].region = UNIVERSAL_REGION_CODE;
-        priv->universal_channel[i].band = band;
-        i++;
-
-        return 0;
-}
-
-/**
- *  @brief This function implements command CMD_802_11D_DOMAIN_INFO
- *  @param priv       pointer to struct lbs_private
- *  @param cmd        pointer to cmd buffer
- *  @param cmdno      cmd ID
- *  @param cmdOption  cmd action
- *  @return           0
-*/
-int lbs_cmd_802_11d_domain_info(struct lbs_private *priv,
-                                 struct cmd_ds_command *cmd, u16 cmdno,
-                                 u16 cmdoption)
-{
-        struct cmd_ds_802_11d_domain_info *pdomaininfo =
-            &cmd->params.domaininfo;
-        struct mrvl_ie_domain_param_set *domain = &pdomaininfo->domain;
-        u8 nr_subband = priv->domainreg.nr_subband;
-
-        lbs_deb_enter(LBS_DEB_11D);
-
-        lbs_deb_11d("nr_subband=%x\n", nr_subband);
-
-        cmd->command = cpu_to_le16(cmdno);
-        pdomaininfo->action = cpu_to_le16(cmdoption);
-        if (cmdoption == CMD_ACT_GET) {
-                cmd->size =
-                    cpu_to_le16(sizeof(pdomaininfo->action) + S_DS_GEN);
-                lbs_deb_hex(LBS_DEB_11D, "802_11D_DOMAIN_INFO", (u8 *) cmd,
-                        le16_to_cpu(cmd->size));
-                goto done;
-        }
-
-        domain->header.type = cpu_to_le16(TLV_TYPE_DOMAIN);
-        memcpy(domain->countrycode, priv->domainreg.countrycode,
-               sizeof(domain->countrycode));
-
-        domain->header.len =
-            cpu_to_le16(nr_subband * sizeof(struct ieee_subbandset) +
-                             sizeof(domain->countrycode));
-
-        if (nr_subband) {
-                memcpy(domain->subband, priv->domainreg.subband,
-                       nr_subband * sizeof(struct ieee_subbandset));
-
-                cmd->size = cpu_to_le16(sizeof(pdomaininfo->action) +
-                                             le16_to_cpu(domain->header.len) +
-                                             sizeof(struct mrvl_ie_header) +
-                                             S_DS_GEN);
-        } else {
-                cmd->size =
-                    cpu_to_le16(sizeof(pdomaininfo->action) + S_DS_GEN);
-        }
-
-        lbs_deb_hex(LBS_DEB_11D, "802_11D_DOMAIN_INFO", (u8 *) cmd, le16_to_cpu(cmd->size));
-
-done:
-        lbs_deb_enter(LBS_DEB_11D);
-        return 0;
-}
-
-/**
- *  @brief This function parses countryinfo from AP and download country info to FW
- *  @param priv    pointer to struct lbs_private
- *  @param resp    pointer to command response buffer
- *  @return        0; -1
- */
-int lbs_ret_802_11d_domain_info(struct cmd_ds_command *resp)
-{
-        struct cmd_ds_802_11d_domain_info *domaininfo = &resp->params.domaininforesp;
-        struct mrvl_ie_domain_param_set *domain = &domaininfo->domain;
-        u16 action = le16_to_cpu(domaininfo->action);
-        s16 ret = 0;
-        u8 nr_subband = 0;
-
-        lbs_deb_enter(LBS_DEB_11D);
-
-        lbs_deb_hex(LBS_DEB_11D, "domain info resp", (u8 *) resp,
-                (int)le16_to_cpu(resp->size));
-
-        nr_subband = (le16_to_cpu(domain->header.len) - COUNTRY_CODE_LEN) /
-                      sizeof(struct ieee_subbandset);
-
-        lbs_deb_11d("domain info resp: nr_subband %d\n", nr_subband);
-
-        if (nr_subband > MRVDRV_MAX_SUBBAND_802_11D) {
-                lbs_deb_11d("Invalid Numrer of Subband returned!!\n");
-                return -1;
-        }
-
-        switch (action) {
-        case CMD_ACT_SET:       /*Proc Set action */
-                break;
-
-        case CMD_ACT_GET:
-                break;
-        default:
-                lbs_deb_11d("Invalid action:%d\n", domaininfo->action);
-                ret = -1;
-                break;
-        }
-
-        lbs_deb_leave_args(LBS_DEB_11D, "ret %d", ret);
-        return ret;
-}
-
-/**
- *  @brief This function parses countryinfo from AP and download country info to FW
- *  @param priv    pointer to struct lbs_private
- *  @return        0; -1
- */
-int lbs_parse_dnld_countryinfo_11d(struct lbs_private *priv,
-                                        struct bss_descriptor * bss)
-{
-        int ret;
-
-        lbs_deb_enter(LBS_DEB_11D);
-        if (priv->enable11d) {
-                memset(&priv->parsed_region_chan, 0,
-                       sizeof(struct parsed_region_chan_11d));
-                ret = parse_domain_info_11d(&bss->countryinfo, 0,
-                                               &priv->parsed_region_chan);
-
-                if (ret == -1) {
-                        lbs_deb_11d("error parsing domain_info from AP\n");
-                        goto done;
-                }
-
-                memset(&priv->domainreg, 0,
-                       sizeof(struct lbs_802_11d_domain_reg));
-                generate_domain_info_11d(&priv->parsed_region_chan,
-                                      &priv->domainreg);
-
-                ret = set_domain_info_11d(priv);
-
-                if (ret) {
-                        lbs_deb_11d("error setting domain info\n");
-                        goto done;
-                }
-        }
-        ret = 0;
-
-done:
-        lbs_deb_leave_args(LBS_DEB_11D, "ret %d", ret);
-        return ret;
-}
-
-/**
- *  @brief This function generates 11D info from user specified regioncode and download to FW
- *  @param priv    pointer to struct lbs_private
- *  @return        0; -1
- */
-int lbs_create_dnld_countryinfo_11d(struct lbs_private *priv)
-{
-        int ret;
-        struct region_channel *region_chan;
-        u8 j;
-
-        lbs_deb_enter(LBS_DEB_11D);
-        lbs_deb_11d("curbssparams.band %d\n", priv->curbssparams.band);
-
-        if (priv->enable11d) {
-                /* update parsed_region_chan_11; dnld domaininf to FW */
-
-                for (j = 0; j < ARRAY_SIZE(priv->region_channel); j++) {
-                        region_chan = &priv->region_channel[j];
-
-                        lbs_deb_11d("%d region_chan->band %d\n", j,
-                               region_chan->band);
-
-                        if (!region_chan || !region_chan->valid
-                            || !region_chan->CFP)
-                                continue;
-                        if (region_chan->band != priv->curbssparams.band)
-                                continue;
-                        break;
-                }
-
-                if (j >= ARRAY_SIZE(priv->region_channel)) {
-                        lbs_deb_11d("region_chan not found, band %d\n",
-                               priv->curbssparams.band);
-                        ret = -1;
-                        goto done;
-                }
-
-                memset(&priv->parsed_region_chan, 0,
-                       sizeof(struct parsed_region_chan_11d));
-                lbs_generate_parsed_region_chan_11d(region_chan,
-                                                     &priv->
-                                                     parsed_region_chan);
-
-                memset(&priv->domainreg, 0,
-                       sizeof(struct lbs_802_11d_domain_reg));
-                generate_domain_info_11d(&priv->parsed_region_chan,
-                                         &priv->domainreg);
-
-                ret = set_domain_info_11d(priv);
-
-                if (ret) {
-                        lbs_deb_11d("error setting domain info\n");
-                        goto done;
-                }
-
-        }
-        ret = 0;
-
-done:
-        lbs_deb_leave_args(LBS_DEB_11D, "ret %d", ret);
-        return ret;
-}
diff --git a/drivers/net/wireless/libertas/11d.h b/drivers/net/wireless/libertas/11d.h
deleted file mode 100644
index fb75d3e321a0..000000000000
--- a/drivers/net/wireless/libertas/11d.h
+++ /dev/null
@@ -1,105 +0,0 @@
-/**
-  * This header file contains data structures and
-  * function declarations of 802.11d
-  */
-#ifndef _LBS_11D_
-#define _LBS_11D_
-
-#include "types.h"
-#include "defs.h"
-
-#define UNIVERSAL_REGION_CODE                   0xff
-
-/** (Beaconsize(256)-5(IEId,len,contrystr(3))/3(FirstChan,NoOfChan,MaxPwr)
- */
-#define MRVDRV_MAX_SUBBAND_802_11D              83
-
-#define COUNTRY_CODE_LEN                        3
-#define MAX_NO_OF_CHAN                          40
-
-struct cmd_ds_command;
-
-/** Data structure for Country IE*/
-struct ieee_subbandset {
-        u8 firstchan;
-        u8 nrchan;
-        u8 maxtxpwr;
-} __attribute__ ((packed));
-
-struct ieee_ie_country_info_set {
-        struct ieee_ie_header header;
-
-        u8 countrycode[COUNTRY_CODE_LEN];
-        struct ieee_subbandset subband[1];
-};
-
-struct ieee_ie_country_info_full_set {
-        struct ieee_ie_header header;
-
-        u8 countrycode[COUNTRY_CODE_LEN];
-        struct ieee_subbandset subband[MRVDRV_MAX_SUBBAND_802_11D];
-} __attribute__ ((packed));
-
-struct mrvl_ie_domain_param_set {
-        struct mrvl_ie_header header;
-
-        u8 countrycode[COUNTRY_CODE_LEN];
-        struct ieee_subbandset subband[1];
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11d_domain_info {
-        __le16 action;
-        struct mrvl_ie_domain_param_set domain;
-} __attribute__ ((packed));
-
-/** domain regulatory information */
-struct lbs_802_11d_domain_reg {
-        /** country Code*/
-        u8 countrycode[COUNTRY_CODE_LEN];
-        /** No. of subband*/
-        u8 nr_subband;
-        struct ieee_subbandset subband[MRVDRV_MAX_SUBBAND_802_11D];
-};
-
-struct chan_power_11d {
-        u8 chan;
-        u8 pwr;
-} __attribute__ ((packed));
-
-struct parsed_region_chan_11d {
-        u8 band;
-        u8 region;
-        s8 countrycode[COUNTRY_CODE_LEN];
-        struct chan_power_11d chanpwr[MAX_NO_OF_CHAN];
-        u8 nr_chan;
-} __attribute__ ((packed));
-
-struct region_code_mapping {
-        u8 region[COUNTRY_CODE_LEN];
-        u8 code;
-};
-
-struct lbs_private;
-
-u8 lbs_get_scan_type_11d(u8 chan,
-                          struct parsed_region_chan_11d *parsed_region_chan);
-
-u32 lbs_chan_2_freq(u8 chan);
-
-void lbs_init_11d(struct lbs_private *priv);
-
-int lbs_set_universaltable(struct lbs_private *priv, u8 band);
-
-int lbs_cmd_802_11d_domain_info(struct lbs_private *priv,
-                                 struct cmd_ds_command *cmd, u16 cmdno,
-                                 u16 cmdOption);
-
-int lbs_ret_802_11d_domain_info(struct cmd_ds_command *resp);
-
-struct bss_descriptor;
-int lbs_parse_dnld_countryinfo_11d(struct lbs_private *priv,
-                                        struct bss_descriptor * bss);
-
-int lbs_create_dnld_countryinfo_11d(struct lbs_private *priv);
-
-#endif
diff --git a/drivers/net/wireless/libertas/Makefile b/drivers/net/wireless/libertas/Makefile
index e5584dd1c79a..fa37039e0eae 100644
--- a/drivers/net/wireless/libertas/Makefile
+++ b/drivers/net/wireless/libertas/Makefile
@@ -1,4 +1,3 @@
-libertas-y += 11d.o
 libertas-y += assoc.o
 libertas-y += cfg.o
 libertas-y += cmd.o
diff --git a/drivers/net/wireless/libertas/assoc.c b/drivers/net/wireless/libertas/assoc.c
index dd8732611ba9..751067369ba8 100644
--- a/drivers/net/wireless/libertas/assoc.c
+++ b/drivers/net/wireless/libertas/assoc.c
@@ -23,6 +23,13 @@ static const u8 bssid_off[ETH_ALEN]  __attribute__ ((aligned (2))) =
  */
 #define CAPINFO_MASK    (~(0xda00))
 
+/**
+ * 802.11b/g supported bitrates (in 500Kb/s units)
+ */
+u8 lbs_bg_rates[MAX_RATES] =
+    { 0x02, 0x04, 0x0b, 0x16, 0x0c, 0x12, 0x18, 0x24, 0x30, 0x48, 0x60, 0x6c,
+0x00, 0x00 };
+
 
 /**
  *  @brief This function finds common rates between rates and card rates.
@@ -147,6 +154,397 @@ static int lbs_set_authentication(struct lbs_private *priv, u8 bssid[6], u8 auth
 }
 
 
+int lbs_cmd_802_11_set_wep(struct lbs_private *priv, uint16_t cmd_action,
+                           struct assoc_request *assoc)
+{
+        struct cmd_ds_802_11_set_wep cmd;
+        int ret = 0;
+
+        lbs_deb_enter(LBS_DEB_CMD);
+
+        memset(&cmd, 0, sizeof(cmd));
+        cmd.hdr.command = cpu_to_le16(CMD_802_11_SET_WEP);
+        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
+
+        cmd.action = cpu_to_le16(cmd_action);
+
+        if (cmd_action == CMD_ACT_ADD) {
+                int i;
+
+                /* default tx key index */
+                cmd.keyindex = cpu_to_le16(assoc->wep_tx_keyidx &
+                                           CMD_WEP_KEY_INDEX_MASK);
+
+                /* Copy key types and material to host command structure */
+                for (i = 0; i < 4; i++) {
+                        struct enc_key *pkey = &assoc->wep_keys[i];
+
+                        switch (pkey->len) {
+                        case KEY_LEN_WEP_40:
+                                cmd.keytype[i] = CMD_TYPE_WEP_40_BIT;
+                                memmove(cmd.keymaterial[i], pkey->key, pkey->len);
+                                lbs_deb_cmd("SET_WEP: add key %d (40 bit)\n", i);
+                                break;
+                        case KEY_LEN_WEP_104:
+                                cmd.keytype[i] = CMD_TYPE_WEP_104_BIT;
+                                memmove(cmd.keymaterial[i], pkey->key, pkey->len);
+                                lbs_deb_cmd("SET_WEP: add key %d (104 bit)\n", i);
+                                break;
+                        case 0:
+                                break;
+                        default:
+                                lbs_deb_cmd("SET_WEP: invalid key %d, length %d\n",
+                                            i, pkey->len);
+                                ret = -1;
+                                goto done;
+                                break;
+                        }
+                }
+        } else if (cmd_action == CMD_ACT_REMOVE) {
+                /* ACT_REMOVE clears _all_ WEP keys */
+
+                /* default tx key index */
+                cmd.keyindex = cpu_to_le16(priv->wep_tx_keyidx &
+                                           CMD_WEP_KEY_INDEX_MASK);
+                lbs_deb_cmd("SET_WEP: remove key %d\n", priv->wep_tx_keyidx);
+        }
+
+        ret = lbs_cmd_with_response(priv, CMD_802_11_SET_WEP, &cmd);
+done:
+        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
+        return ret;
+}
+
+int lbs_cmd_802_11_enable_rsn(struct lbs_private *priv, uint16_t cmd_action,
+                              uint16_t *enable)
+{
+        struct cmd_ds_802_11_enable_rsn cmd;
+        int ret;
+
+        lbs_deb_enter(LBS_DEB_CMD);
+
+        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
+        cmd.action = cpu_to_le16(cmd_action);
+
+        if (cmd_action == CMD_ACT_GET)
+                cmd.enable = 0;
+        else {
+                if (*enable)
+                        cmd.enable = cpu_to_le16(CMD_ENABLE_RSN);
+                else
+                        cmd.enable = cpu_to_le16(CMD_DISABLE_RSN);
+                lbs_deb_cmd("ENABLE_RSN: %d\n", *enable);
+        }
+
+        ret = lbs_cmd_with_response(priv, CMD_802_11_ENABLE_RSN, &cmd);
+        if (!ret && cmd_action == CMD_ACT_GET)
+                *enable = le16_to_cpu(cmd.enable);
+
+        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
+        return ret;
+}
+
+static void set_one_wpa_key(struct MrvlIEtype_keyParamSet *keyparam,
+                struct enc_key *key)
+{
+        lbs_deb_enter(LBS_DEB_CMD);
+
+        if (key->flags & KEY_INFO_WPA_ENABLED)
+                keyparam->keyinfo |= cpu_to_le16(KEY_INFO_WPA_ENABLED);
+        if (key->flags & KEY_INFO_WPA_UNICAST)
+                keyparam->keyinfo |= cpu_to_le16(KEY_INFO_WPA_UNICAST);
+        if (key->flags & KEY_INFO_WPA_MCAST)
+                keyparam->keyinfo |= cpu_to_le16(KEY_INFO_WPA_MCAST);
+
+        keyparam->type = cpu_to_le16(TLV_TYPE_KEY_MATERIAL);
+        keyparam->keytypeid = cpu_to_le16(key->type);
+        keyparam->keylen = cpu_to_le16(key->len);
+        memcpy(keyparam->key, key->key, key->len);
+
+        /* Length field doesn't include the {type,length} header */
+        keyparam->length = cpu_to_le16(sizeof(*keyparam) - 4);
+        lbs_deb_leave(LBS_DEB_CMD);
+}
+
+int lbs_cmd_802_11_key_material(struct lbs_private *priv, uint16_t cmd_action,
+                                struct assoc_request *assoc)
+{
+        struct cmd_ds_802_11_key_material cmd;
+        int ret = 0;
+        int index = 0;
+
+        lbs_deb_enter(LBS_DEB_CMD);
+
+        cmd.action = cpu_to_le16(cmd_action);
+        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
+
+        if (cmd_action == CMD_ACT_GET) {
+                cmd.hdr.size = cpu_to_le16(sizeof(struct cmd_header) + 2);
+        } else {
+                memset(cmd.keyParamSet, 0, sizeof(cmd.keyParamSet));
+
+                if (test_bit(ASSOC_FLAG_WPA_UCAST_KEY, &assoc->flags)) {
+                        set_one_wpa_key(&cmd.keyParamSet[index],
+                                        &assoc->wpa_unicast_key);
+                        index++;
+                }
+
+                if (test_bit(ASSOC_FLAG_WPA_MCAST_KEY, &assoc->flags)) {
+                        set_one_wpa_key(&cmd.keyParamSet[index],
+                                        &assoc->wpa_mcast_key);
+                        index++;
+                }
+
+                /* The common header and as many keys as we included */
+                cmd.hdr.size = cpu_to_le16(offsetof(typeof(cmd),
+                                                    keyParamSet[index]));
+        }
+        ret = lbs_cmd_with_response(priv, CMD_802_11_KEY_MATERIAL, &cmd);
+        /* Copy the returned key to driver private data */
+        if (!ret && cmd_action == CMD_ACT_GET) {
+                void *buf_ptr = cmd.keyParamSet;
+                void *resp_end = &(&cmd)[1];
+
+                while (buf_ptr < resp_end) {
+                        struct MrvlIEtype_keyParamSet *keyparam = buf_ptr;
+                        struct enc_key *key;
+                        uint16_t param_set_len = le16_to_cpu(keyparam->length);
+                        uint16_t key_len = le16_to_cpu(keyparam->keylen);
+                        uint16_t key_flags = le16_to_cpu(keyparam->keyinfo);
+                        uint16_t key_type = le16_to_cpu(keyparam->keytypeid);
+                        void *end;
+
+                        end = (void *)keyparam + sizeof(keyparam->type)
+                                + sizeof(keyparam->length) + param_set_len;
+
+                        /* Make sure we don't access past the end of the IEs */
+                        if (end > resp_end)
+                                break;
+
+                        if (key_flags & KEY_INFO_WPA_UNICAST)
+                                key = &priv->wpa_unicast_key;
+                        else if (key_flags & KEY_INFO_WPA_MCAST)
+                                key = &priv->wpa_mcast_key;
+                        else
+                                break;
+
+                        /* Copy returned key into driver */
+                        memset(key, 0, sizeof(struct enc_key));
+                        if (key_len > sizeof(key->key))
+                                break;
+                        key->type = key_type;
+                        key->flags = key_flags;
+                        key->len = key_len;
+                        memcpy(key->key, keyparam->key, key->len);
+
+                        buf_ptr = end + 1;
+                }
+        }
+
+        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
+        return ret;
+}
+
+static __le16 lbs_rate_to_fw_bitmap(int rate, int lower_rates_ok)
+{
+/*              Bit     Rate
+*               15:13 Reserved
+*               12    54 Mbps
+*               11    48 Mbps
+*               10    36 Mbps
+*               9     24 Mbps
+*               8     18 Mbps
+*               7     12 Mbps
+*               6     9 Mbps
+*               5     6 Mbps
+*               4     Reserved
+*               3     11 Mbps
+*               2     5.5 Mbps
+*               1     2 Mbps
+*               0     1 Mbps
+**/
+
+        uint16_t ratemask;
+        int i = lbs_data_rate_to_fw_index(rate);
+        if (lower_rates_ok)
+                ratemask = (0x1fef >> (12 - i));
+        else
+                ratemask = (1 << i);
+        return cpu_to_le16(ratemask);
+}
+
+int lbs_cmd_802_11_rate_adapt_rateset(struct lbs_private *priv,
+                                      uint16_t cmd_action)
+{
+        struct cmd_ds_802_11_rate_adapt_rateset cmd;
+        int ret;
+
+        lbs_deb_enter(LBS_DEB_CMD);
+
+        if (!priv->cur_rate && !priv->enablehwauto)
+                return -EINVAL;
+
+        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
+
+        cmd.action = cpu_to_le16(cmd_action);
+        cmd.enablehwauto = cpu_to_le16(priv->enablehwauto);
+        cmd.bitmap = lbs_rate_to_fw_bitmap(priv->cur_rate, priv->enablehwauto);
+        ret = lbs_cmd_with_response(priv, CMD_802_11_RATE_ADAPT_RATESET, &cmd);
+        if (!ret && cmd_action == CMD_ACT_GET) {
+                priv->ratebitmap = le16_to_cpu(cmd.bitmap);
+                priv->enablehwauto = le16_to_cpu(cmd.enablehwauto);
+        }
+
+        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
+        return ret;
+}
+
+/**
+ *  @brief Set the data rate
+ *
+ *  @param priv         A pointer to struct lbs_private structure
+ *  @param rate         The desired data rate, or 0 to clear a locked rate
+ *
+ *  @return             0 on success, error on failure
+ */
+int lbs_set_data_rate(struct lbs_private *priv, u8 rate)
+{
+        struct cmd_ds_802_11_data_rate cmd;
+        int ret = 0;
+
+        lbs_deb_enter(LBS_DEB_CMD);
+
+        memset(&cmd, 0, sizeof(cmd));
+        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
+
+        if (rate > 0) {
+                cmd.action = cpu_to_le16(CMD_ACT_SET_TX_FIX_RATE);
+                cmd.rates[0] = lbs_data_rate_to_fw_index(rate);
+                if (cmd.rates[0] == 0) {
+                        lbs_deb_cmd("DATA_RATE: invalid requested rate of"
+                                " 0x%02X\n", rate);
+                        ret = 0;
+                        goto out;
+                }
+                lbs_deb_cmd("DATA_RATE: set fixed 0x%02X\n", cmd.rates[0]);
+        } else {
+                cmd.action = cpu_to_le16(CMD_ACT_SET_TX_AUTO);
+                lbs_deb_cmd("DATA_RATE: setting auto\n");
+        }
+
+        ret = lbs_cmd_with_response(priv, CMD_802_11_DATA_RATE, &cmd);
+        if (ret)
+                goto out;
+
+        lbs_deb_hex(LBS_DEB_CMD, "DATA_RATE_RESP", (u8 *) &cmd, sizeof(cmd));
+
+        /* FIXME: get actual rates FW can do if this command actually returns
+         * all data rates supported.
+         */
+        priv->cur_rate = lbs_fw_index_to_data_rate(cmd.rates[0]);
+        lbs_deb_cmd("DATA_RATE: current rate is 0x%02x\n", priv->cur_rate);
+
+out:
+        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
+        return ret;
+}
+
+
+int lbs_cmd_802_11_rssi(struct lbs_private *priv,
+                                struct cmd_ds_command *cmd)
+{
+
+        lbs_deb_enter(LBS_DEB_CMD);
+        cmd->command = cpu_to_le16(CMD_802_11_RSSI);
+        cmd->size = cpu_to_le16(sizeof(struct cmd_ds_802_11_rssi) +
+                sizeof(struct cmd_header));
+        cmd->params.rssi.N = cpu_to_le16(DEFAULT_BCN_AVG_FACTOR);
+
+        /* reset Beacon SNR/NF/RSSI values */
+        priv->SNR[TYPE_BEACON][TYPE_NOAVG] = 0;
+        priv->SNR[TYPE_BEACON][TYPE_AVG] = 0;
+        priv->NF[TYPE_BEACON][TYPE_NOAVG] = 0;
+        priv->NF[TYPE_BEACON][TYPE_AVG] = 0;
+        priv->RSSI[TYPE_BEACON][TYPE_NOAVG] = 0;
+        priv->RSSI[TYPE_BEACON][TYPE_AVG] = 0;
+
+        lbs_deb_leave(LBS_DEB_CMD);
+        return 0;
+}
+
+int lbs_ret_802_11_rssi(struct lbs_private *priv,
+                                struct cmd_ds_command *resp)
+{
+        struct cmd_ds_802_11_rssi_rsp *rssirsp = &resp->params.rssirsp;
+
+        lbs_deb_enter(LBS_DEB_CMD);
+
+        /* store the non average value */
+        priv->SNR[TYPE_BEACON][TYPE_NOAVG] = get_unaligned_le16(&rssirsp->SNR);
+        priv->NF[TYPE_BEACON][TYPE_NOAVG] =
+                get_unaligned_le16(&rssirsp->noisefloor);
+
+        priv->SNR[TYPE_BEACON][TYPE_AVG] = get_unaligned_le16(&rssirsp->avgSNR);
+        priv->NF[TYPE_BEACON][TYPE_AVG] =
+                get_unaligned_le16(&rssirsp->avgnoisefloor);
+
+        priv->RSSI[TYPE_BEACON][TYPE_NOAVG] =
+            CAL_RSSI(priv->SNR[TYPE_BEACON][TYPE_NOAVG],
+                     priv->NF[TYPE_BEACON][TYPE_NOAVG]);
+
+        priv->RSSI[TYPE_BEACON][TYPE_AVG] =
+            CAL_RSSI(priv->SNR[TYPE_BEACON][TYPE_AVG] / AVG_SCALE,
+                     priv->NF[TYPE_BEACON][TYPE_AVG] / AVG_SCALE);
+
+        lbs_deb_cmd("RSSI: beacon %d, avg %d\n",
+               priv->RSSI[TYPE_BEACON][TYPE_NOAVG],
+               priv->RSSI[TYPE_BEACON][TYPE_AVG]);
+
+        lbs_deb_leave(LBS_DEB_CMD);
+        return 0;
+}
+
+
+int lbs_cmd_bcn_ctrl(struct lbs_private *priv,
+                                struct cmd_ds_command *cmd,
+                                u16 cmd_action)
+{
+        struct cmd_ds_802_11_beacon_control
+                *bcn_ctrl = &cmd->params.bcn_ctrl;
+
+        lbs_deb_enter(LBS_DEB_CMD);
+        cmd->size =
+            cpu_to_le16(sizeof(struct cmd_ds_802_11_beacon_control)
+                             + sizeof(struct cmd_header));
+        cmd->command = cpu_to_le16(CMD_802_11_BEACON_CTRL);
+
+        bcn_ctrl->action = cpu_to_le16(cmd_action);
+        bcn_ctrl->beacon_enable = cpu_to_le16(priv->beacon_enable);
+        bcn_ctrl->beacon_period = cpu_to_le16(priv->beacon_period);
+
+        lbs_deb_leave(LBS_DEB_CMD);
+        return 0;
+}
+
+int lbs_ret_802_11_bcn_ctrl(struct lbs_private *priv,
+                                        struct cmd_ds_command *resp)
+{
+        struct cmd_ds_802_11_beacon_control *bcn_ctrl =
+            &resp->params.bcn_ctrl;
+
+        lbs_deb_enter(LBS_DEB_CMD);
+
+        if (bcn_ctrl->action == CMD_ACT_GET) {
+                priv->beacon_enable = (u8) le16_to_cpu(bcn_ctrl->beacon_enable);
+                priv->beacon_period = le16_to_cpu(bcn_ctrl->beacon_period);
+        }
+
+        lbs_deb_enter(LBS_DEB_CMD);
+        return 0;
+}
+
+
+
 static int lbs_assoc_post(struct lbs_private *priv,
                           struct cmd_ds_802_11_associate_response *resp)
 {
@@ -226,7 +624,7 @@ static int lbs_assoc_post(struct lbs_private *priv,
         priv->connect_status = LBS_CONNECTED;
 
         /* Update current SSID and BSSID */
-        memcpy(&priv->curbssparams.ssid, &bss->ssid, IW_ESSID_MAX_SIZE);
+        memcpy(&priv->curbssparams.ssid, &bss->ssid, IEEE80211_MAX_SSID_LEN);
         priv->curbssparams.ssid_len = bss->ssid_len;
         memcpy(priv->curbssparams.bssid, bss->bssid, ETH_ALEN);
 
@@ -369,12 +767,7 @@ static int lbs_associate(struct lbs_private *priv,
                                    (u16)(pos - (u8 *) &cmd.iebuf));
 
         /* update curbssparams */
-        priv->curbssparams.channel = bss->phy.ds.channel;
-
-        if (lbs_parse_dnld_countryinfo_11d(priv, bss)) {
-                ret = -1;
-                goto done;
-        }
+        priv->channel = bss->phy.ds.channel;
 
         ret = lbs_cmd_with_response(priv, command, &cmd);
         if (ret == 0) {
@@ -472,7 +865,7 @@ static int lbs_adhoc_post(struct lbs_private *priv,
         memcpy(&priv->curbssparams.bssid, bss->bssid, ETH_ALEN);
 
         /* Set the new SSID to current SSID */
-        memcpy(&priv->curbssparams.ssid, &bss->ssid, IW_ESSID_MAX_SIZE);
+        memcpy(&priv->curbssparams.ssid, &bss->ssid, IEEE80211_MAX_SSID_LEN);
         priv->curbssparams.ssid_len = bss->ssid_len;
 
         netif_carrier_on(priv->dev);
@@ -487,7 +880,7 @@ static int lbs_adhoc_post(struct lbs_private *priv,
         lbs_deb_join("ADHOC_RESP: Joined/started '%s', BSSID %pM, channel %d\n",
                      print_ssid(ssid, bss->ssid, bss->ssid_len),
                      priv->curbssparams.bssid,
-                     priv->curbssparams.channel);
+                     priv->channel);
 
 done:
         lbs_deb_leave_args(LBS_DEB_JOIN, "ret %d", ret);
@@ -560,7 +953,7 @@ static int lbs_adhoc_join(struct lbs_private *priv,
         lbs_deb_join("AdhocJoin: band = %c\n", assoc_req->band);
 
         priv->adhoccreate = 0;
-        priv->curbssparams.channel = bss->channel;
+        priv->channel = bss->channel;
 
         /* Build the join command */
         memset(&cmd, 0, sizeof(cmd));
@@ -633,11 +1026,6 @@ static int lbs_adhoc_join(struct lbs_private *priv,
                 }
         }
 
-        if (lbs_parse_dnld_countryinfo_11d(priv, bss)) {
-                ret = -1;
-                goto out;
-        }
-
         ret = lbs_cmd_with_response(priv, CMD_802_11_AD_HOC_JOIN, &cmd);
         if (ret == 0) {
                 ret = lbs_adhoc_post(priv,
@@ -737,12 +1125,6 @@ static int lbs_adhoc_start(struct lbs_private *priv,
         lbs_deb_join("ADHOC_START: rates=%02x %02x %02x %02x\n",
                cmd.rates[0], cmd.rates[1], cmd.rates[2], cmd.rates[3]);
 
-        if (lbs_create_dnld_countryinfo_11d(priv)) {
-                lbs_deb_join("ADHOC_START: dnld_countryinfo_11d failed\n");
-                ret = -1;
-                goto out;
-        }
-
         lbs_deb_join("ADHOC_START: Starting Ad-Hoc BSS on channel %d, band %d\n",
                      assoc_req->channel, assoc_req->band);
 
@@ -1099,7 +1481,7 @@ static int assoc_helper_essid(struct lbs_private *priv,
                         /* else send START command */
                         lbs_deb_assoc("SSID not found, creating adhoc network\n");
                         memcpy(&assoc_req->bss.ssid, &assoc_req->ssid,
-                                IW_ESSID_MAX_SIZE);
+                                IEEE80211_MAX_SSID_LEN);
                         assoc_req->bss.ssid_len = assoc_req->ssid_len;
                         lbs_adhoc_start(priv, assoc_req);
                 }
@@ -1185,7 +1567,8 @@ static int assoc_helper_mode(struct lbs_private *priv,
         }
 
         priv->mode = assoc_req->mode;
-        ret = lbs_set_snmp_mib(priv, SNMP_MIB_OID_BSS_TYPE, assoc_req->mode);
+        ret = lbs_set_snmp_mib(priv, SNMP_MIB_OID_BSS_TYPE,
+                assoc_req->mode == IW_MODE_ADHOC ? 2 : 1);
 
 done:
         lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
@@ -1205,7 +1588,7 @@ static int assoc_helper_channel(struct lbs_private *priv,
                 goto done;
         }
 
-        if (assoc_req->channel == priv->curbssparams.channel)
+        if (assoc_req->channel == priv->channel)
                 goto done;
 
         if (priv->mesh_dev) {
@@ -1217,7 +1600,7 @@ static int assoc_helper_channel(struct lbs_private *priv,
         }
 
         lbs_deb_assoc("ASSOC: channel: %d -> %d\n",
-                      priv->curbssparams.channel, assoc_req->channel);
+                      priv->channel, assoc_req->channel);
 
         ret = lbs_set_channel(priv, assoc_req->channel);
         if (ret < 0)
@@ -1232,7 +1615,7 @@ static int assoc_helper_channel(struct lbs_private *priv,
                 goto done;
         }
 
-        if (assoc_req->channel != priv->curbssparams.channel) {
+        if (assoc_req->channel != priv->channel) {
                 lbs_deb_assoc("ASSOC: channel: failed to update channel to %d\n",
                               assoc_req->channel);
                 goto restore_mesh;
@@ -1253,7 +1636,7 @@ static int assoc_helper_channel(struct lbs_private *priv,
  restore_mesh:
         if (priv->mesh_dev)
                 lbs_mesh_config(priv, CMD_ACT_MESH_CONFIG_START,
-                                priv->curbssparams.channel);
+                                priv->channel);
 
  done:
         lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
@@ -1475,7 +1858,7 @@ static int should_stop_adhoc(struct lbs_private *priv,
         }
 
         if (test_bit(ASSOC_FLAG_CHANNEL, &assoc_req->flags)) {
-                if (assoc_req->channel != priv->curbssparams.channel)
+                if (assoc_req->channel != priv->channel)
                         return 1;
         }
 
@@ -1557,7 +1940,7 @@ static int lbs_find_best_network_ssid(struct lbs_private *priv,
 
         found = lbs_find_best_ssid_in_list(priv, preferred_mode);
         if (found && (found->ssid_len > 0)) {
-                memcpy(out_ssid, &found->ssid, IW_ESSID_MAX_SIZE);
+                memcpy(out_ssid, &found->ssid, IEEE80211_MAX_SSID_LEN);
                 *out_ssid_len = found->ssid_len;
                 *out_mode = found->mode;
                 ret = 0;
@@ -1775,12 +2158,12 @@ struct assoc_request *lbs_get_association_request(struct lbs_private *priv)
         assoc_req = priv->pending_assoc_req;
         if (!test_bit(ASSOC_FLAG_SSID, &assoc_req->flags)) {
                 memcpy(&assoc_req->ssid, &priv->curbssparams.ssid,
-                       IW_ESSID_MAX_SIZE);
+                       IEEE80211_MAX_SSID_LEN);
                 assoc_req->ssid_len = priv->curbssparams.ssid_len;
         }
 
         if (!test_bit(ASSOC_FLAG_CHANNEL, &assoc_req->flags))
-                assoc_req->channel = priv->curbssparams.channel;
+                assoc_req->channel = priv->channel;
 
         if (!test_bit(ASSOC_FLAG_BAND, &assoc_req->flags))
                 assoc_req->band = priv->curbssparams.band;
diff --git a/drivers/net/wireless/libertas/assoc.h b/drivers/net/wireless/libertas/assoc.h
index 6e765e9f91a3..40621b789fc5 100644
--- a/drivers/net/wireless/libertas/assoc.h
+++ b/drivers/net/wireless/libertas/assoc.h
@@ -3,7 +3,126 @@
 #ifndef _LBS_ASSOC_H_
 #define _LBS_ASSOC_H_
 
-#include "dev.h"
+
+#include "defs.h"
+#include "host.h"
+
+
+struct lbs_private;
+
+/*
+ * In theory, the IE is limited to the IE length, 255,
+ * but in practice 64 bytes are enough.
+ */
+#define MAX_WPA_IE_LEN 64
+
+
+
+struct lbs_802_11_security {
+        u8 WPAenabled;
+        u8 WPA2enabled;
+        u8 wep_enabled;
+        u8 auth_mode;
+        u32 key_mgmt;
+};
+
+/** Current Basic Service Set State Structure */
+struct current_bss_params {
+        /** bssid */
+        u8 bssid[ETH_ALEN];
+        /** ssid */
+        u8 ssid[IEEE80211_MAX_SSID_LEN + 1];
+        u8 ssid_len;
+
+        /** band */
+        u8 band;
+        /** channel is directly in priv->channel */
+        /** zero-terminated array of supported data rates */
+        u8 rates[MAX_RATES + 1];
+};
+
+/**
+ *  @brief Structure used to store information for each beacon/probe response
+ */
+struct bss_descriptor {
+        u8 bssid[ETH_ALEN];
+
+        u8 ssid[IEEE80211_MAX_SSID_LEN + 1];
+        u8 ssid_len;
+
+        u16 capability;
+        u32 rssi;
+        u32 channel;
+        u16 beaconperiod;
+        __le16 atimwindow;
+
+        /* IW_MODE_AUTO, IW_MODE_ADHOC, IW_MODE_INFRA */
+        u8 mode;
+
+        /* zero-terminated array of supported data rates */
+        u8 rates[MAX_RATES + 1];
+
+        unsigned long last_scanned;
+
+        union ieee_phy_param_set phy;
+        union ieee_ss_param_set ss;
+
+        u8 wpa_ie[MAX_WPA_IE_LEN];
+        size_t wpa_ie_len;
+        u8 rsn_ie[MAX_WPA_IE_LEN];
+        size_t rsn_ie_len;
+
+        u8 mesh;
+
+        struct list_head list;
+};
+
+/** Association request
+ *
+ * Encapsulates all the options that describe a specific assocation request
+ * or configuration of the wireless card's radio, mode, and security settings.
+ */
+struct assoc_request {
+#define ASSOC_FLAG_SSID                 1
+#define ASSOC_FLAG_CHANNEL              2
+#define ASSOC_FLAG_BAND                 3
+#define ASSOC_FLAG_MODE                 4
+#define ASSOC_FLAG_BSSID                5
+#define ASSOC_FLAG_WEP_KEYS             6
+#define ASSOC_FLAG_WEP_TX_KEYIDX        7
+#define ASSOC_FLAG_WPA_MCAST_KEY        8
+#define ASSOC_FLAG_WPA_UCAST_KEY        9
+#define ASSOC_FLAG_SECINFO              10
+#define ASSOC_FLAG_WPA_IE               11
+        unsigned long flags;
+
+        u8 ssid[IEEE80211_MAX_SSID_LEN + 1];
+        u8 ssid_len;
+        u8 channel;
+        u8 band;
+        u8 mode;
+        u8 bssid[ETH_ALEN] __attribute__ ((aligned (2)));
+
+        /** WEP keys */
+        struct enc_key wep_keys[4];
+        u16 wep_tx_keyidx;
+
+        /** WPA keys */
+        struct enc_key wpa_mcast_key;
+        struct enc_key wpa_unicast_key;
+
+        struct lbs_802_11_security secinfo;
+
+        /** WPA Information Elements*/
+        u8 wpa_ie[MAX_WPA_IE_LEN];
+        u8 wpa_ie_len;
+
+        /* BSS to associate with for infrastructure of Ad-Hoc join */
+        struct bss_descriptor bss;
+};
+
+
+extern u8 lbs_bg_rates[MAX_RATES];
 
 void lbs_association_worker(struct work_struct *work);
 struct assoc_request *lbs_get_association_request(struct lbs_private *priv);
@@ -13,4 +132,24 @@ int lbs_adhoc_stop(struct lbs_private *priv);
 int lbs_cmd_80211_deauthenticate(struct lbs_private *priv,
                                  u8 bssid[ETH_ALEN], u16 reason);
 
+int lbs_cmd_802_11_rssi(struct lbs_private *priv,
+                                struct cmd_ds_command *cmd);
+int lbs_ret_802_11_rssi(struct lbs_private *priv,
+                                struct cmd_ds_command *resp);
+
+int lbs_cmd_bcn_ctrl(struct lbs_private *priv,
+                                struct cmd_ds_command *cmd,
+                                u16 cmd_action);
+int lbs_ret_802_11_bcn_ctrl(struct lbs_private *priv,
+                                        struct cmd_ds_command *resp);
+
+int lbs_cmd_802_11_set_wep(struct lbs_private *priv, uint16_t cmd_action,
+                           struct assoc_request *assoc);
+
+int lbs_cmd_802_11_enable_rsn(struct lbs_private *priv, uint16_t cmd_action,
+                              uint16_t *enable);
+
+int lbs_cmd_802_11_key_material(struct lbs_private *priv, uint16_t cmd_action,
+                                struct assoc_request *assoc);
+
 #endif /* _LBS_ASSOC_H */
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index 0fb312576b8d..1065ce29cd08 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -3,18 +3,20 @@
   * It prepares command and sends it to firmware when it is ready.
   */
 
-#include <net/iw_handler.h>
 #include <net/lib80211.h>
 #include <linux/kfifo.h>
+#include <linux/sched.h>
+
 #include "host.h"
-#include "hostcmd.h"
 #include "decl.h"
 #include "defs.h"
 #include "dev.h"
 #include "assoc.h"
 #include "wext.h"
+#include "scan.h"
 #include "cmd.h"
 
+
 static struct cmd_ctrl_node *lbs_get_cmd_ctrl_node(struct lbs_private *priv);
 
 /**
@@ -191,11 +193,6 @@ int lbs_update_hw_spec(struct lbs_private *priv)
                 goto out;
         }
 
-        if (lbs_set_universaltable(priv, 0)) {
-                ret = -1;
-                goto out;
-        }
-
 out:
         lbs_deb_leave(LBS_DEB_CMD);
         return ret;
@@ -244,7 +241,7 @@ static int lbs_cmd_802_11_ps_mode(struct cmd_ds_command *cmd,
 
         cmd->command = cpu_to_le16(CMD_802_11_PS_MODE);
         cmd->size = cpu_to_le16(sizeof(struct cmd_ds_802_11_ps_mode) +
-                                S_DS_GEN);
+                                sizeof(struct cmd_header));
         psm->action = cpu_to_le16(cmd_action);
         psm->multipledtim = 0;
         switch (cmd_action) {
@@ -273,33 +270,6 @@ static int lbs_cmd_802_11_ps_mode(struct cmd_ds_command *cmd,
         return 0;
 }
 
-int lbs_cmd_802_11_inactivity_timeout(struct lbs_private *priv,
-                                      uint16_t cmd_action, uint16_t *timeout)
-{
-        struct cmd_ds_802_11_inactivity_timeout cmd;
-        int ret;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        cmd.hdr.command = cpu_to_le16(CMD_802_11_INACTIVITY_TIMEOUT);
-        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
-
-        cmd.action = cpu_to_le16(cmd_action);
-
-        if (cmd_action == CMD_ACT_SET)
-                cmd.timeout = cpu_to_le16(*timeout);
-        else
-                cmd.timeout = 0;
-
-        ret = lbs_cmd_with_response(priv, CMD_802_11_INACTIVITY_TIMEOUT, &cmd);
-
-        if (!ret)
-                *timeout = le16_to_cpu(cmd.timeout);
-
-        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
-        return 0;
-}
-
 int lbs_cmd_802_11_sleep_params(struct lbs_private *priv, uint16_t cmd_action,
                                 struct sleep_params *sp)
 {
@@ -396,197 +366,6 @@ int lbs_set_deep_sleep(struct lbs_private *priv, int deep_sleep)
         return ret;
 }
 
-int lbs_cmd_802_11_set_wep(struct lbs_private *priv, uint16_t cmd_action,
-                           struct assoc_request *assoc)
-{
-        struct cmd_ds_802_11_set_wep cmd;
-        int ret = 0;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        memset(&cmd, 0, sizeof(cmd));
-        cmd.hdr.command = cpu_to_le16(CMD_802_11_SET_WEP);
-        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
-
-        cmd.action = cpu_to_le16(cmd_action);
-
-        if (cmd_action == CMD_ACT_ADD) {
-                int i;
-
-                /* default tx key index */
-                cmd.keyindex = cpu_to_le16(assoc->wep_tx_keyidx &
-                                           CMD_WEP_KEY_INDEX_MASK);
-
-                /* Copy key types and material to host command structure */
-                for (i = 0; i < 4; i++) {
-                        struct enc_key *pkey = &assoc->wep_keys[i];
-
-                        switch (pkey->len) {
-                        case KEY_LEN_WEP_40:
-                                cmd.keytype[i] = CMD_TYPE_WEP_40_BIT;
-                                memmove(cmd.keymaterial[i], pkey->key, pkey->len);
-                                lbs_deb_cmd("SET_WEP: add key %d (40 bit)\n", i);
-                                break;
-                        case KEY_LEN_WEP_104:
-                                cmd.keytype[i] = CMD_TYPE_WEP_104_BIT;
-                                memmove(cmd.keymaterial[i], pkey->key, pkey->len);
-                                lbs_deb_cmd("SET_WEP: add key %d (104 bit)\n", i);
-                                break;
-                        case 0:
-                                break;
-                        default:
-                                lbs_deb_cmd("SET_WEP: invalid key %d, length %d\n",
-                                            i, pkey->len);
-                                ret = -1;
-                                goto done;
-                                break;
-                        }
-                }
-        } else if (cmd_action == CMD_ACT_REMOVE) {
-                /* ACT_REMOVE clears _all_ WEP keys */
-
-                /* default tx key index */
-                cmd.keyindex = cpu_to_le16(priv->wep_tx_keyidx &
-                                           CMD_WEP_KEY_INDEX_MASK);
-                lbs_deb_cmd("SET_WEP: remove key %d\n", priv->wep_tx_keyidx);
-        }
-
-        ret = lbs_cmd_with_response(priv, CMD_802_11_SET_WEP, &cmd);
-done:
-        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
-        return ret;
-}
-
-int lbs_cmd_802_11_enable_rsn(struct lbs_private *priv, uint16_t cmd_action,
-                              uint16_t *enable)
-{
-        struct cmd_ds_802_11_enable_rsn cmd;
-        int ret;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
-        cmd.action = cpu_to_le16(cmd_action);
-
-        if (cmd_action == CMD_ACT_GET)
-                cmd.enable = 0;
-        else {
-                if (*enable)
-                        cmd.enable = cpu_to_le16(CMD_ENABLE_RSN);
-                else
-                        cmd.enable = cpu_to_le16(CMD_DISABLE_RSN);
-                lbs_deb_cmd("ENABLE_RSN: %d\n", *enable);
-        }
-
-        ret = lbs_cmd_with_response(priv, CMD_802_11_ENABLE_RSN, &cmd);
-        if (!ret && cmd_action == CMD_ACT_GET)
-                *enable = le16_to_cpu(cmd.enable);
-
-        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
-        return ret;
-}
-
-static void set_one_wpa_key(struct MrvlIEtype_keyParamSet *keyparam,
-                            struct enc_key *key)
-{
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        if (key->flags & KEY_INFO_WPA_ENABLED)
-                keyparam->keyinfo |= cpu_to_le16(KEY_INFO_WPA_ENABLED);
-        if (key->flags & KEY_INFO_WPA_UNICAST)
-                keyparam->keyinfo |= cpu_to_le16(KEY_INFO_WPA_UNICAST);
-        if (key->flags & KEY_INFO_WPA_MCAST)
-                keyparam->keyinfo |= cpu_to_le16(KEY_INFO_WPA_MCAST);
-
-        keyparam->type = cpu_to_le16(TLV_TYPE_KEY_MATERIAL);
-        keyparam->keytypeid = cpu_to_le16(key->type);
-        keyparam->keylen = cpu_to_le16(key->len);
-        memcpy(keyparam->key, key->key, key->len);
-
-        /* Length field doesn't include the {type,length} header */
-        keyparam->length = cpu_to_le16(sizeof(*keyparam) - 4);
-        lbs_deb_leave(LBS_DEB_CMD);
-}
-
-int lbs_cmd_802_11_key_material(struct lbs_private *priv, uint16_t cmd_action,
-                                struct assoc_request *assoc)
-{
-        struct cmd_ds_802_11_key_material cmd;
-        int ret = 0;
-        int index = 0;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        cmd.action = cpu_to_le16(cmd_action);
-        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
-
-        if (cmd_action == CMD_ACT_GET) {
-                cmd.hdr.size = cpu_to_le16(S_DS_GEN + 2);
-        } else {
-                memset(cmd.keyParamSet, 0, sizeof(cmd.keyParamSet));
-
-                if (test_bit(ASSOC_FLAG_WPA_UCAST_KEY, &assoc->flags)) {
-                        set_one_wpa_key(&cmd.keyParamSet[index],
-                                        &assoc->wpa_unicast_key);
-                        index++;
-                }
-
-                if (test_bit(ASSOC_FLAG_WPA_MCAST_KEY, &assoc->flags)) {
-                        set_one_wpa_key(&cmd.keyParamSet[index],
-                                        &assoc->wpa_mcast_key);
-                        index++;
-                }
-
-                /* The common header and as many keys as we included */
-                cmd.hdr.size = cpu_to_le16(offsetof(typeof(cmd),
-                                                    keyParamSet[index]));
-        }
-        ret = lbs_cmd_with_response(priv, CMD_802_11_KEY_MATERIAL, &cmd);
-        /* Copy the returned key to driver private data */
-        if (!ret && cmd_action == CMD_ACT_GET) {
-                void *buf_ptr = cmd.keyParamSet;
-                void *resp_end = &(&cmd)[1];
-
-                while (buf_ptr < resp_end) {
-                        struct MrvlIEtype_keyParamSet *keyparam = buf_ptr;
-                        struct enc_key *key;
-                        uint16_t param_set_len = le16_to_cpu(keyparam->length);
-                        uint16_t key_len = le16_to_cpu(keyparam->keylen);
-                        uint16_t key_flags = le16_to_cpu(keyparam->keyinfo);
-                        uint16_t key_type = le16_to_cpu(keyparam->keytypeid);
-                        void *end;
-
-                        end = (void *)keyparam + sizeof(keyparam->type)
-                                + sizeof(keyparam->length) + param_set_len;
-
-                        /* Make sure we don't access past the end of the IEs */
-                        if (end > resp_end)
-                                break;
-
-                        if (key_flags & KEY_INFO_WPA_UNICAST)
-                                key = &priv->wpa_unicast_key;
-                        else if (key_flags & KEY_INFO_WPA_MCAST)
-                                key = &priv->wpa_mcast_key;
-                        else
-                                break;
-
-                        /* Copy returned key into driver */
-                        memset(key, 0, sizeof(struct enc_key));
-                        if (key_len > sizeof(key->key))
-                                break;
-                        key->type = key_type;
-                        key->flags = key_flags;
-                        key->len = key_len;
-                        memcpy(key->key, keyparam->key, key->len);
-
-                        buf_ptr = end + 1;
-                }
-        }
-
-        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
-        return ret;
-}
-
 /**
  *  @brief Set an SNMP MIB value
  *
@@ -611,7 +390,7 @@ int lbs_set_snmp_mib(struct lbs_private *priv, u32 oid, u16 val)
         switch (oid) {
         case SNMP_MIB_OID_BSS_TYPE:
                 cmd.bufsize = cpu_to_le16(sizeof(u8));
-                cmd.value[0] = (val == IW_MODE_ADHOC) ? 2 : 1;
+                cmd.value[0] = val;
                 break;
         case SNMP_MIB_OID_11D_ENABLE:
         case SNMP_MIB_OID_FRAG_THRESHOLD:
@@ -664,13 +443,7 @@ int lbs_get_snmp_mib(struct lbs_private *priv, u32 oid, u16 *out_val)
 
         switch (le16_to_cpu(cmd.bufsize)) {
         case sizeof(u8):
-                if (oid == SNMP_MIB_OID_BSS_TYPE) {
-                        if (cmd.value[0] == 2)
-                                *out_val = IW_MODE_ADHOC;
-                        else
-                                *out_val = IW_MODE_INFRA;
-                } else
-                        *out_val = cmd.value[0];
+                *out_val = cmd.value[0];
                 break;
         case sizeof(u16):
                 *out_val = le16_to_cpu(*((__le16 *)(&cmd.value)));
@@ -757,7 +530,7 @@ static int lbs_cmd_802_11_monitor_mode(struct cmd_ds_command *cmd,
         cmd->command = cpu_to_le16(CMD_802_11_MONITOR_MODE);
         cmd->size =
             cpu_to_le16(sizeof(struct cmd_ds_802_11_monitor_mode) +
-                             S_DS_GEN);
+                             sizeof(struct cmd_header));
 
         monitor->action = cpu_to_le16(cmd_action);
         if (cmd_action == CMD_ACT_SET) {
@@ -768,111 +541,6 @@ static int lbs_cmd_802_11_monitor_mode(struct cmd_ds_command *cmd,
         return 0;
 }
 
-static __le16 lbs_rate_to_fw_bitmap(int rate, int lower_rates_ok)
-{
-/*              Bit     Rate
-*               15:13 Reserved
-*               12    54 Mbps
-*               11    48 Mbps
-*               10    36 Mbps
-*               9     24 Mbps
-*               8     18 Mbps
-*               7     12 Mbps
-*               6     9 Mbps
-*               5     6 Mbps
-*               4     Reserved
-*               3     11 Mbps
-*               2     5.5 Mbps
-*               1     2 Mbps
-*               0     1 Mbps
-**/
-
-        uint16_t ratemask;
-        int i = lbs_data_rate_to_fw_index(rate);
-        if (lower_rates_ok)
-                ratemask = (0x1fef >> (12 - i));
-        else
-                ratemask = (1 << i);
-        return cpu_to_le16(ratemask);
-}
-
-int lbs_cmd_802_11_rate_adapt_rateset(struct lbs_private *priv,
-                                      uint16_t cmd_action)
-{
-        struct cmd_ds_802_11_rate_adapt_rateset cmd;
-        int ret;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        if (!priv->cur_rate && !priv->enablehwauto)
-                return -EINVAL;
-
-        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
-
-        cmd.action = cpu_to_le16(cmd_action);
-        cmd.enablehwauto = cpu_to_le16(priv->enablehwauto);
-        cmd.bitmap = lbs_rate_to_fw_bitmap(priv->cur_rate, priv->enablehwauto);
-        ret = lbs_cmd_with_response(priv, CMD_802_11_RATE_ADAPT_RATESET, &cmd);
-        if (!ret && cmd_action == CMD_ACT_GET) {
-                priv->ratebitmap = le16_to_cpu(cmd.bitmap);
-                priv->enablehwauto = le16_to_cpu(cmd.enablehwauto);
-        }
-
-        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
-        return ret;
-}
-EXPORT_SYMBOL_GPL(lbs_cmd_802_11_rate_adapt_rateset);
-
-/**
- *  @brief Set the data rate
- *
- *  @param priv         A pointer to struct lbs_private structure
- *  @param rate         The desired data rate, or 0 to clear a locked rate
- *
- *  @return             0 on success, error on failure
- */
-int lbs_set_data_rate(struct lbs_private *priv, u8 rate)
-{
-        struct cmd_ds_802_11_data_rate cmd;
-        int ret = 0;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        memset(&cmd, 0, sizeof(cmd));
-        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
-
-        if (rate > 0) {
-                cmd.action = cpu_to_le16(CMD_ACT_SET_TX_FIX_RATE);
-                cmd.rates[0] = lbs_data_rate_to_fw_index(rate);
-                if (cmd.rates[0] == 0) {
-                        lbs_deb_cmd("DATA_RATE: invalid requested rate of"
-                                    " 0x%02X\n", rate);
-                        ret = 0;
-                        goto out;
-                }
-                lbs_deb_cmd("DATA_RATE: set fixed 0x%02X\n", cmd.rates[0]);
-        } else {
-                cmd.action = cpu_to_le16(CMD_ACT_SET_TX_AUTO);
-                lbs_deb_cmd("DATA_RATE: setting auto\n");
-        }
-
-        ret = lbs_cmd_with_response(priv, CMD_802_11_DATA_RATE, &cmd);
-        if (ret)
-                goto out;
-
-        lbs_deb_hex(LBS_DEB_CMD, "DATA_RATE_RESP", (u8 *) &cmd, sizeof (cmd));
-
-        /* FIXME: get actual rates FW can do if this command actually returns
-         * all data rates supported.
-         */
-        priv->cur_rate = lbs_fw_index_to_data_rate(cmd.rates[0]);
-        lbs_deb_cmd("DATA_RATE: current rate is 0x%02x\n", priv->cur_rate);
-
-out:
-        lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
-        return ret;
-}
-
 /**
  *  @brief Get the radio channel
  *
@@ -880,7 +548,7 @@ out:
  *
  *  @return             The channel on success, error on failure
  */
-int lbs_get_channel(struct lbs_private *priv)
+static int lbs_get_channel(struct lbs_private *priv)
 {
         struct cmd_ds_802_11_rf_channel cmd;
         int ret = 0;
@@ -912,7 +580,7 @@ int lbs_update_channel(struct lbs_private *priv)
 
         ret = lbs_get_channel(priv);
         if (ret > 0) {
-                priv->curbssparams.channel = ret;
+                priv->channel = ret;
                 ret = 0;
         }
         lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
@@ -931,7 +599,7 @@ int lbs_set_channel(struct lbs_private *priv, u8 channel)
 {
         struct cmd_ds_802_11_rf_channel cmd;
 #ifdef DEBUG
-        u8 old_channel = priv->curbssparams.channel;
+        u8 old_channel = priv->channel;
 #endif
         int ret = 0;
 
@@ -946,36 +614,15 @@ int lbs_set_channel(struct lbs_private *priv, u8 channel)
         if (ret)
                 goto out;
 
-        priv->curbssparams.channel = (uint8_t) le16_to_cpu(cmd.channel);
+        priv->channel = (uint8_t) le16_to_cpu(cmd.channel);
         lbs_deb_cmd("channel switch from %d to %d\n", old_channel,
-                priv->curbssparams.channel);
+                priv->channel);
 
 out:
         lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
         return ret;
 }
 
-static int lbs_cmd_802_11_rssi(struct lbs_private *priv,
-                                struct cmd_ds_command *cmd)
-{
-
-        lbs_deb_enter(LBS_DEB_CMD);
-        cmd->command = cpu_to_le16(CMD_802_11_RSSI);
-        cmd->size = cpu_to_le16(sizeof(struct cmd_ds_802_11_rssi) + S_DS_GEN);
-        cmd->params.rssi.N = cpu_to_le16(DEFAULT_BCN_AVG_FACTOR);
-
-        /* reset Beacon SNR/NF/RSSI values */
-        priv->SNR[TYPE_BEACON][TYPE_NOAVG] = 0;
-        priv->SNR[TYPE_BEACON][TYPE_AVG] = 0;
-        priv->NF[TYPE_BEACON][TYPE_NOAVG] = 0;
-        priv->NF[TYPE_BEACON][TYPE_AVG] = 0;
-        priv->RSSI[TYPE_BEACON][TYPE_NOAVG] = 0;
-        priv->RSSI[TYPE_BEACON][TYPE_AVG] = 0;
-
-        lbs_deb_leave(LBS_DEB_CMD);
-        return 0;
-}
-
 static int lbs_cmd_reg_access(struct cmd_ds_command *cmdptr,
                                u8 cmd_action, void *pdata_buf)
 {
@@ -992,7 +639,7 @@ static int lbs_cmd_reg_access(struct cmd_ds_command *cmdptr,
 
                         cmdptr->size =
                             cpu_to_le16(sizeof (struct cmd_ds_mac_reg_access)
-                                        + S_DS_GEN);
+                                        + sizeof(struct cmd_header));
                         macreg =
                             (struct cmd_ds_mac_reg_access *)&cmdptr->params.
                             macreg;
@@ -1011,7 +658,7 @@ static int lbs_cmd_reg_access(struct cmd_ds_command *cmdptr,
                         cmdptr->size =
                             cpu_to_le16(sizeof
                                              (struct cmd_ds_bbp_reg_access)
-                                             + S_DS_GEN);
+                                             + sizeof(struct cmd_header));
                         bbpreg =
                             (struct cmd_ds_bbp_reg_access *)&cmdptr->params.
                             bbpreg;
@@ -1030,7 +677,7 @@ static int lbs_cmd_reg_access(struct cmd_ds_command *cmdptr,
                         cmdptr->size =
                             cpu_to_le16(sizeof
                                              (struct cmd_ds_rf_reg_access) +
-                                             S_DS_GEN);
+                                             sizeof(struct cmd_header));
                         rfreg =
                             (struct cmd_ds_rf_reg_access *)&cmdptr->params.
                             rfreg;
@@ -1057,7 +704,8 @@ static int lbs_cmd_bt_access(struct cmd_ds_command *cmd,
         lbs_deb_enter_args(LBS_DEB_CMD, "action %d", cmd_action);
 
         cmd->command = cpu_to_le16(CMD_BT_ACCESS);
-        cmd->size = cpu_to_le16(sizeof(struct cmd_ds_bt_access) + S_DS_GEN);
+        cmd->size = cpu_to_le16(sizeof(struct cmd_ds_bt_access) +
+                sizeof(struct cmd_header));
         cmd->result = 0;
         bt_access->action = cpu_to_le16(cmd_action);
 
@@ -1094,7 +742,8 @@ static int lbs_cmd_fwt_access(struct cmd_ds_command *cmd,
         lbs_deb_enter_args(LBS_DEB_CMD, "action %d", cmd_action);
 
         cmd->command = cpu_to_le16(CMD_FWT_ACCESS);
-        cmd->size = cpu_to_le16(sizeof(struct cmd_ds_fwt_access) + S_DS_GEN);
+        cmd->size = cpu_to_le16(sizeof(struct cmd_ds_fwt_access) +
+                sizeof(struct cmd_header));
         cmd->result = 0;
 
         if (pdata_buf)
@@ -1200,7 +849,7 @@ int lbs_mesh_config(struct lbs_private *priv, uint16_t action, uint16_t chan)
                 ie->val.mesh_id_len = priv->mesh_ssid_len;
                 memcpy(ie->val.mesh_id, priv->mesh_ssid, priv->mesh_ssid_len);
                 ie->len = sizeof(struct mrvl_meshie_val) -
-                        IW_ESSID_MAX_SIZE + priv->mesh_ssid_len;
+                        IEEE80211_MAX_SSID_LEN + priv->mesh_ssid_len;
                 cmd.length = cpu_to_le16(sizeof(struct mrvl_meshie_val));
                 break;
         case CMD_ACT_MESH_CONFIG_STOP:
@@ -1215,27 +864,6 @@ int lbs_mesh_config(struct lbs_private *priv, uint16_t action, uint16_t chan)
         return __lbs_mesh_config_send(priv, &cmd, action, priv->mesh_tlv);
 }
 
-static int lbs_cmd_bcn_ctrl(struct lbs_private * priv,
-                                struct cmd_ds_command *cmd,
-                                u16 cmd_action)
-{
-        struct cmd_ds_802_11_beacon_control
-                *bcn_ctrl = &cmd->params.bcn_ctrl;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-        cmd->size =
-            cpu_to_le16(sizeof(struct cmd_ds_802_11_beacon_control)
-                             + S_DS_GEN);
-        cmd->command = cpu_to_le16(CMD_802_11_BEACON_CTRL);
-
-        bcn_ctrl->action = cpu_to_le16(cmd_action);
-        bcn_ctrl->beacon_enable = cpu_to_le16(priv->beacon_enable);
-        bcn_ctrl->beacon_period = cpu_to_le16(priv->beacon_period);
-
-        lbs_deb_leave(LBS_DEB_CMD);
-        return 0;
-}
-
 static void lbs_queue_cmd(struct lbs_private *priv,
                           struct cmd_ctrl_node *cmdnode)
 {
@@ -1531,7 +1159,7 @@ int lbs_prepare_and_send_command(struct lbs_private *priv,
 
                 cmdptr->command = cpu_to_le16(cmd_no);
                 cmdptr->size = cpu_to_le16(sizeof(struct cmd_ds_802_11_afc) +
-                                           S_DS_GEN);
+                                           sizeof(struct cmd_header));
 
                 memmove(&cmdptr->params.afc,
                         pdata_buf, sizeof(struct cmd_ds_802_11_afc));
@@ -1539,45 +1167,17 @@ int lbs_prepare_and_send_command(struct lbs_private *priv,
                 ret = 0;
                 goto done;
 
-        case CMD_802_11D_DOMAIN_INFO:
-                ret = lbs_cmd_802_11d_domain_info(priv, cmdptr,
-                                                   cmd_no, cmd_action);
-                break;
-
         case CMD_802_11_TPC_CFG:
                 cmdptr->command = cpu_to_le16(CMD_802_11_TPC_CFG);
                 cmdptr->size =
                     cpu_to_le16(sizeof(struct cmd_ds_802_11_tpc_cfg) +
-                                     S_DS_GEN);
+                                     sizeof(struct cmd_header));
 
                 memmove(&cmdptr->params.tpccfg,
                         pdata_buf, sizeof(struct cmd_ds_802_11_tpc_cfg));
 
                 ret = 0;
                 break;
-        case CMD_802_11_LED_GPIO_CTRL:
-                {
-                        struct mrvl_ie_ledgpio *gpio =
-                            (struct mrvl_ie_ledgpio*)
-                            cmdptr->params.ledgpio.data;
-
-                        memmove(&cmdptr->params.ledgpio,
-                                pdata_buf,
-                                sizeof(struct cmd_ds_802_11_led_ctrl));
-
-                        cmdptr->command =
-                            cpu_to_le16(CMD_802_11_LED_GPIO_CTRL);
-
-#define ACTION_NUMLED_TLVTYPE_LEN_FIELDS_LEN 8
-                        cmdptr->size =
-                            cpu_to_le16(le16_to_cpu(gpio->header.len)
-                                + S_DS_GEN
-                                + ACTION_NUMLED_TLVTYPE_LEN_FIELDS_LEN);
-                        gpio->header.len = gpio->header.len;
-
-                        ret = 0;
-                        break;
-                }
 
         case CMD_BT_ACCESS:
                 ret = lbs_cmd_bt_access(cmdptr, cmd_action, pdata_buf);
@@ -1587,18 +1187,12 @@ int lbs_prepare_and_send_command(struct lbs_private *priv,
                 ret = lbs_cmd_fwt_access(cmdptr, cmd_action, pdata_buf);
                 break;
 
-        case CMD_GET_TSF:
-                cmdptr->command = cpu_to_le16(CMD_GET_TSF);
-                cmdptr->size = cpu_to_le16(sizeof(struct cmd_ds_get_tsf) +
-                                           S_DS_GEN);
-                ret = 0;
-                break;
         case CMD_802_11_BEACON_CTRL:
                 ret = lbs_cmd_bcn_ctrl(priv, cmdptr, cmd_action);
                 break;
         case CMD_802_11_DEEP_SLEEP:
                 cmdptr->command = cpu_to_le16(CMD_802_11_DEEP_SLEEP);
-                cmdptr->size = cpu_to_le16(S_DS_GEN);
+                cmdptr->size = cpu_to_le16(sizeof(struct cmd_header));
                 break;
         default:
                 lbs_pr_err("PREP_CMD: unknown command 0x%04x\n", cmd_no);
@@ -1917,30 +1511,6 @@ done:
         return ret;
 }
 
-void lbs_send_iwevcustom_event(struct lbs_private *priv, s8 *str)
-{
-        union iwreq_data iwrq;
-        u8 buf[50];
-
-        lbs_deb_enter(LBS_DEB_WEXT);
-
-        memset(&iwrq, 0, sizeof(union iwreq_data));
-        memset(buf, 0, sizeof(buf));
-
-        snprintf(buf, sizeof(buf) - 1, "%s", str);
-
-        iwrq.data.length = strlen(buf) + 1 + IW_EV_LCP_LEN;
-
-        /* Send Event to upper layer */
-        lbs_deb_wext("event indication string %s\n", (char *)buf);
-        lbs_deb_wext("event indication length %d\n", iwrq.data.length);
-        lbs_deb_wext("sending wireless event IWEVCUSTOM for %s\n", str);
-
-        wireless_send_event(priv->dev, IWEVCUSTOM, &iwrq, buf);
-
-        lbs_deb_leave(LBS_DEB_WEXT);
-}
-
 static void lbs_send_confirmsleep(struct lbs_private *priv)
 {
         unsigned long flags;
@@ -2118,7 +1688,7 @@ int lbs_set_power_adapt_cfg(struct lbs_private *priv, int enable, int8_t p0,
 }
 
 
-static struct cmd_ctrl_node *__lbs_cmd_async(struct lbs_private *priv,
+struct cmd_ctrl_node *__lbs_cmd_async(struct lbs_private *priv,
         uint16_t command, struct cmd_header *in_cmd, int in_cmd_size,
         int (*callback)(struct lbs_private *, unsigned long, struct cmd_header *),
         unsigned long callback_arg)
@@ -2216,5 +1786,3 @@ done:
         return ret;
 }
 EXPORT_SYMBOL_GPL(__lbs_cmd);
-
-
diff --git a/drivers/net/wireless/libertas/cmd.h b/drivers/net/wireless/libertas/cmd.h
index 392e578ca095..2862748aef70 100644
--- a/drivers/net/wireless/libertas/cmd.h
+++ b/drivers/net/wireless/libertas/cmd.h
@@ -3,11 +3,30 @@
 #ifndef _LBS_CMD_H_
 #define _LBS_CMD_H_
 
-#include "hostcmd.h"
+#include "host.h"
 #include "dev.h"
 
+
+/* Command & response transfer between host and card */
+
+struct cmd_ctrl_node {
+        struct list_head list;
+        int result;
+        /* command response */
+        int (*callback)(struct lbs_private *,
+                        unsigned long,
+                        struct cmd_header *);
+        unsigned long callback_arg;
+        /* command data */
+        struct cmd_header *cmdbuf;
+        /* wait queue */
+        u16 cmdwaitqwoken;
+        wait_queue_head_t cmdwait_q;
+};
+
+
 /* lbs_cmd() infers the size of the buffer to copy data back into, from
-   the size of the target of the pointer. Since the command to be sent 
+   the size of the target of the pointer. Since the command to be sent
    may often be smaller, that size is set in cmd->size by the caller.*/
 #define lbs_cmd(priv, cmdnr, cmd, cb, cb_arg)   ({              \
         uint16_t __sz = le16_to_cpu((cmd)->hdr.size);           \
@@ -18,6 +37,11 @@
 #define lbs_cmd_with_response(priv, cmdnr, cmd) \
         lbs_cmd(priv, cmdnr, cmd, lbs_cmd_copyback, (unsigned long) (cmd))
 
+int lbs_prepare_and_send_command(struct lbs_private *priv,
+        u16 cmd_no,
+        u16 cmd_action,
+        u16 wait_option, u32 cmd_oid, void *pdata_buf);
+
 void lbs_cmd_async(struct lbs_private *priv, uint16_t command,
         struct cmd_header *in_cmd, int in_cmd_size);
 
@@ -26,62 +50,93 @@ int __lbs_cmd(struct lbs_private *priv, uint16_t command,
               int (*callback)(struct lbs_private *, unsigned long, struct cmd_header *),
               unsigned long callback_arg);
 
-int lbs_set_power_adapt_cfg(struct lbs_private *priv, int enable, int8_t p0,
-                int8_t p1, int8_t p2);
+struct cmd_ctrl_node *__lbs_cmd_async(struct lbs_private *priv,
+        uint16_t command, struct cmd_header *in_cmd, int in_cmd_size,
+        int (*callback)(struct lbs_private *, unsigned long, struct cmd_header *),
+        unsigned long callback_arg);
 
-int lbs_set_tpc_cfg(struct lbs_private *priv, int enable, int8_t p0, int8_t p1,
-                int8_t p2, int usesnr);
+int lbs_cmd_copyback(struct lbs_private *priv, unsigned long extra,
+                     struct cmd_header *resp);
 
-int lbs_set_power_adapt_cfg(struct lbs_private *priv, int enable, int8_t p0,
-                int8_t p1, int8_t p2);
+int lbs_allocate_cmd_buffer(struct lbs_private *priv);
+int lbs_free_cmd_buffer(struct lbs_private *priv);
 
-int lbs_set_tpc_cfg(struct lbs_private *priv, int enable, int8_t p0, int8_t p1,
-                int8_t p2, int usesnr);
+int lbs_execute_next_command(struct lbs_private *priv);
+void lbs_complete_command(struct lbs_private *priv, struct cmd_ctrl_node *cmd,
+                          int result);
+int lbs_process_command_response(struct lbs_private *priv, u8 *data, u32 len);
 
-int lbs_cmd_copyback(struct lbs_private *priv, unsigned long extra,
-                     struct cmd_header *resp);
 
-int lbs_update_hw_spec(struct lbs_private *priv);
+/* From cmdresp.c */
 
-int lbs_mesh_access(struct lbs_private *priv, uint16_t cmd_action,
-                    struct cmd_ds_mesh_access *cmd);
+void lbs_mac_event_disconnected(struct lbs_private *priv);
 
-int lbs_set_data_rate(struct lbs_private *priv, u8 rate);
 
-int lbs_get_channel(struct lbs_private *priv);
+
+/* Events */
+
+int lbs_process_event(struct lbs_private *priv, u32 event);
+
+
+/* Actual commands */
+
+int lbs_update_hw_spec(struct lbs_private *priv);
+
 int lbs_set_channel(struct lbs_private *priv, u8 channel);
 
-int lbs_mesh_config_send(struct lbs_private *priv,
-                         struct cmd_ds_mesh_config *cmd,
-                         uint16_t action, uint16_t type);
-int lbs_mesh_config(struct lbs_private *priv, uint16_t enable, uint16_t chan);
+int lbs_update_channel(struct lbs_private *priv);
 
 int lbs_host_sleep_cfg(struct lbs_private *priv, uint32_t criteria,
                 struct wol_config *p_wol_config);
-int lbs_suspend(struct lbs_private *priv);
-void lbs_resume(struct lbs_private *priv);
 
-int lbs_cmd_802_11_rate_adapt_rateset(struct lbs_private *priv,
-                                      uint16_t cmd_action);
-int lbs_cmd_802_11_inactivity_timeout(struct lbs_private *priv,
-                                      uint16_t cmd_action, uint16_t *timeout);
 int lbs_cmd_802_11_sleep_params(struct lbs_private *priv, uint16_t cmd_action,
                                 struct sleep_params *sp);
-int lbs_cmd_802_11_set_wep(struct lbs_private *priv, uint16_t cmd_action,
-                           struct assoc_request *assoc);
-int lbs_cmd_802_11_enable_rsn(struct lbs_private *priv, uint16_t cmd_action,
-                              uint16_t *enable);
-int lbs_cmd_802_11_key_material(struct lbs_private *priv, uint16_t cmd_action,
-                                struct assoc_request *assoc);
 
-int lbs_get_tx_power(struct lbs_private *priv, s16 *curlevel, s16 *minlevel,
-                     s16 *maxlevel);
-int lbs_set_tx_power(struct lbs_private *priv, s16 dbm);
+void lbs_ps_sleep(struct lbs_private *priv, int wait_option);
+
+void lbs_ps_wakeup(struct lbs_private *priv, int wait_option);
+
+void lbs_ps_confirm_sleep(struct lbs_private *priv);
 
 int lbs_set_radio(struct lbs_private *priv, u8 preamble, u8 radio_on);
 
+void lbs_set_mac_control(struct lbs_private *priv);
+
+int lbs_get_tx_power(struct lbs_private *priv, s16 *curlevel, s16 *minlevel,
+                     s16 *maxlevel);
+
 int lbs_set_snmp_mib(struct lbs_private *priv, u32 oid, u16 val);
 
 int lbs_get_snmp_mib(struct lbs_private *priv, u32 oid, u16 *out_val);
 
+
+/* Mesh related */
+
+int lbs_mesh_access(struct lbs_private *priv, uint16_t cmd_action,
+                    struct cmd_ds_mesh_access *cmd);
+
+int lbs_mesh_config_send(struct lbs_private *priv,
+                         struct cmd_ds_mesh_config *cmd,
+                         uint16_t action, uint16_t type);
+
+int lbs_mesh_config(struct lbs_private *priv, uint16_t enable, uint16_t chan);
+
+
+/* Commands only used in wext.c, assoc. and scan.c */
+
+int lbs_set_power_adapt_cfg(struct lbs_private *priv, int enable, int8_t p0,
+                int8_t p1, int8_t p2);
+
+int lbs_set_tpc_cfg(struct lbs_private *priv, int enable, int8_t p0, int8_t p1,
+                int8_t p2, int usesnr);
+
+int lbs_set_data_rate(struct lbs_private *priv, u8 rate);
+
+int lbs_cmd_802_11_rate_adapt_rateset(struct lbs_private *priv,
+                                      uint16_t cmd_action);
+
+int lbs_set_tx_power(struct lbs_private *priv, s16 dbm);
+
+int lbs_set_deep_sleep(struct lbs_private *priv, int deep_sleep);
+
 #endif /* _LBS_CMD_H */
diff --git a/drivers/net/wireless/libertas/cmdresp.c b/drivers/net/wireless/libertas/cmdresp.c
index 9ee8bd11bda9..21d57690c20a 100644
--- a/drivers/net/wireless/libertas/cmdresp.c
+++ b/drivers/net/wireless/libertas/cmdresp.c
@@ -11,6 +11,7 @@
 
 #include "host.h"
 #include "decl.h"
+#include "cmd.h"
 #include "defs.h"
 #include "dev.h"
 #include "assoc.h"
@@ -26,23 +27,17 @@
  */
 void lbs_mac_event_disconnected(struct lbs_private *priv)
 {
-        union iwreq_data wrqu;
-
         if (priv->connect_status != LBS_CONNECTED)
                 return;
 
         lbs_deb_enter(LBS_DEB_ASSOC);
 
-        memset(wrqu.ap_addr.sa_data, 0x00, ETH_ALEN);
-        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
-
         /*
          * Cisco AP sends EAP failure and de-auth in less than 0.5 ms.
          * It causes problem in the Supplicant
          */
-
         msleep_interruptible(1000);
-        wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
+        lbs_send_disconnect_notification(priv);
 
         /* report disconnect to upper layer */
         netif_stop_queue(priv->dev);
@@ -67,7 +62,7 @@ void lbs_mac_event_disconnected(struct lbs_private *priv)
          * no longer valid.
          */
         memset(&priv->curbssparams.bssid, 0, ETH_ALEN);
-        memset(&priv->curbssparams.ssid, 0, IW_ESSID_MAX_SIZE);
+        memset(&priv->curbssparams.ssid, 0, IEEE80211_MAX_SSID_LEN);
         priv->curbssparams.ssid_len = 0;
 
         if (priv->psstate != PS_STATE_FULL_POWER) {
@@ -78,32 +73,6 @@ void lbs_mac_event_disconnected(struct lbs_private *priv)
         lbs_deb_leave(LBS_DEB_ASSOC);
 }
 
-/**
- *  @brief This function handles MIC failure event.
- *
- *  @param priv    A pointer to struct lbs_private structure
- *  @para  event   the event id
- *  @return        n/a
- */
-static void handle_mic_failureevent(struct lbs_private *priv, u32 event)
-{
-        char buf[50];
-
-        lbs_deb_enter(LBS_DEB_CMD);
-        memset(buf, 0, sizeof(buf));
-
-        sprintf(buf, "%s", "MLME-MICHAELMICFAILURE.indication ");
-
-        if (event == MACREG_INT_CODE_MIC_ERR_UNICAST) {
-                strcat(buf, "unicast ");
-        } else {
-                strcat(buf, "multicast ");
-        }
-
-        lbs_send_iwevcustom_event(priv, buf);
-        lbs_deb_leave(LBS_DEB_CMD);
-}
-
 static int lbs_ret_reg_access(struct lbs_private *priv,
                                u16 type, struct cmd_ds_command *resp)
 {
@@ -147,53 +116,6 @@ static int lbs_ret_reg_access(struct lbs_private *priv,
         return ret;
 }
 
-static int lbs_ret_802_11_rssi(struct lbs_private *priv,
-                                struct cmd_ds_command *resp)
-{
-        struct cmd_ds_802_11_rssi_rsp *rssirsp = &resp->params.rssirsp;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        /* store the non average value */
-        priv->SNR[TYPE_BEACON][TYPE_NOAVG] = get_unaligned_le16(&rssirsp->SNR);
-        priv->NF[TYPE_BEACON][TYPE_NOAVG] = get_unaligned_le16(&rssirsp->noisefloor);
-
-        priv->SNR[TYPE_BEACON][TYPE_AVG] = get_unaligned_le16(&rssirsp->avgSNR);
-        priv->NF[TYPE_BEACON][TYPE_AVG] = get_unaligned_le16(&rssirsp->avgnoisefloor);
-
-        priv->RSSI[TYPE_BEACON][TYPE_NOAVG] =
-            CAL_RSSI(priv->SNR[TYPE_BEACON][TYPE_NOAVG],
-                     priv->NF[TYPE_BEACON][TYPE_NOAVG]);
-
-        priv->RSSI[TYPE_BEACON][TYPE_AVG] =
-            CAL_RSSI(priv->SNR[TYPE_BEACON][TYPE_AVG] / AVG_SCALE,
-                     priv->NF[TYPE_BEACON][TYPE_AVG] / AVG_SCALE);
-
-        lbs_deb_cmd("RSSI: beacon %d, avg %d\n",
-               priv->RSSI[TYPE_BEACON][TYPE_NOAVG],
-               priv->RSSI[TYPE_BEACON][TYPE_AVG]);
-
-        lbs_deb_leave(LBS_DEB_CMD);
-        return 0;
-}
-
-static int lbs_ret_802_11_bcn_ctrl(struct lbs_private * priv,
-                                        struct cmd_ds_command *resp)
-{
-        struct cmd_ds_802_11_beacon_control *bcn_ctrl =
-            &resp->params.bcn_ctrl;
-
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        if (bcn_ctrl->action == CMD_ACT_GET) {
-                priv->beacon_enable = (u8) le16_to_cpu(bcn_ctrl->beacon_enable);
-                priv->beacon_period = le16_to_cpu(bcn_ctrl->beacon_period);
-        }
-
-        lbs_deb_enter(LBS_DEB_CMD);
-        return 0;
-}
-
 static inline int handle_cmd_response(struct lbs_private *priv,
                                       struct cmd_header *cmd_response)
 {
@@ -227,29 +149,13 @@ static inline int handle_cmd_response(struct lbs_private *priv,
                 ret = lbs_ret_802_11_rssi(priv, resp);
                 break;
 
-        case CMD_RET(CMD_802_11D_DOMAIN_INFO):
-                ret = lbs_ret_802_11d_domain_info(resp);
-                break;
-
         case CMD_RET(CMD_802_11_TPC_CFG):
                 spin_lock_irqsave(&priv->driver_lock, flags);
                 memmove((void *)priv->cur_cmd->callback_arg, &resp->params.tpccfg,
                         sizeof(struct cmd_ds_802_11_tpc_cfg));
                 spin_unlock_irqrestore(&priv->driver_lock, flags);
                 break;
-        case CMD_RET(CMD_802_11_LED_GPIO_CTRL):
-                spin_lock_irqsave(&priv->driver_lock, flags);
-                memmove((void *)priv->cur_cmd->callback_arg, &resp->params.ledgpio,
-                        sizeof(struct cmd_ds_802_11_led_ctrl));
-                spin_unlock_irqrestore(&priv->driver_lock, flags);
-                break;
 
-        case CMD_RET(CMD_GET_TSF):
-                spin_lock_irqsave(&priv->driver_lock, flags);
-                memcpy((void *)priv->cur_cmd->callback_arg,
-                       &resp->params.gettsf.tsfvalue, sizeof(u64));
-                spin_unlock_irqrestore(&priv->driver_lock, flags);
-                break;
         case CMD_RET(CMD_BT_ACCESS):
                 spin_lock_irqsave(&priv->driver_lock, flags);
                 if (priv->cur_cmd->callback_arg)
@@ -545,12 +451,12 @@ int lbs_process_event(struct lbs_private *priv, u32 event)
 
         case MACREG_INT_CODE_MIC_ERR_UNICAST:
                 lbs_deb_cmd("EVENT: UNICAST MIC ERROR\n");
-                handle_mic_failureevent(priv, MACREG_INT_CODE_MIC_ERR_UNICAST);
+                lbs_send_mic_failureevent(priv, event);
                 break;
 
         case MACREG_INT_CODE_MIC_ERR_MULTICAST:
                 lbs_deb_cmd("EVENT: MULTICAST MIC ERROR\n");
-                handle_mic_failureevent(priv, MACREG_INT_CODE_MIC_ERR_MULTICAST);
+                lbs_send_mic_failureevent(priv, event);
                 break;
 
         case MACREG_INT_CODE_MIB_CHANGED:
diff --git a/drivers/net/wireless/libertas/debugfs.c b/drivers/net/wireless/libertas/debugfs.c
index 893a55ca344a..587b0cb0088d 100644
--- a/drivers/net/wireless/libertas/debugfs.c
+++ b/drivers/net/wireless/libertas/debugfs.c
@@ -451,10 +451,12 @@ static ssize_t lbs_rdmac_read(struct file *file, char __user *userbuf,
                                 CMD_MAC_REG_ACCESS, 0,
                                 CMD_OPTION_WAITFORRSP, 0, &offval);
         mdelay(10);
-        pos += snprintf(buf+pos, len-pos, "MAC[0x%x] = 0x%08x\n",
+        if (!ret) {
+                pos += snprintf(buf+pos, len-pos, "MAC[0x%x] = 0x%08x\n",
                                 priv->mac_offset, priv->offsetvalue.value);
 
-        ret = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
+                ret = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
+        }
         free_page(addr);
         return ret;
 }
@@ -514,7 +516,8 @@ static ssize_t lbs_wrmac_write(struct file *file,
                                 CMD_OPTION_WAITFORRSP, 0, &offval);
         mdelay(10);
 
-        res = count;
+        if (!res)
+                res = count;
 out_unlock:
         free_page(addr);
         return res;
@@ -539,10 +542,12 @@ static ssize_t lbs_rdbbp_read(struct file *file, char __user *userbuf,
                                 CMD_BBP_REG_ACCESS, 0,
                                 CMD_OPTION_WAITFORRSP, 0, &offval);
         mdelay(10);
-        pos += snprintf(buf+pos, len-pos, "BBP[0x%x] = 0x%08x\n",
+        if (!ret) {
+                pos += snprintf(buf+pos, len-pos, "BBP[0x%x] = 0x%08x\n",
                                 priv->bbp_offset, priv->offsetvalue.value);
 
-        ret = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
+                ret = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
+        }
         free_page(addr);
 
         return ret;
@@ -603,7 +608,8 @@ static ssize_t lbs_wrbbp_write(struct file *file,
                                 CMD_OPTION_WAITFORRSP, 0, &offval);
         mdelay(10);
 
-        res = count;
+        if (!res)
+                res = count;
 out_unlock:
         free_page(addr);
         return res;
@@ -628,10 +634,12 @@ static ssize_t lbs_rdrf_read(struct file *file, char __user *userbuf,
                                 CMD_RF_REG_ACCESS, 0,
                                 CMD_OPTION_WAITFORRSP, 0, &offval);
         mdelay(10);
-        pos += snprintf(buf+pos, len-pos, "RF[0x%x] = 0x%08x\n",
+        if (!ret) {
+                pos += snprintf(buf+pos, len-pos, "RF[0x%x] = 0x%08x\n",
                                 priv->rf_offset, priv->offsetvalue.value);
 
-        ret = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
+                ret = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
+        }
         free_page(addr);
 
         return ret;
@@ -692,7 +700,8 @@ static ssize_t lbs_wrrf_write(struct file *file,
                                 CMD_OPTION_WAITFORRSP, 0, &offval);
         mdelay(10);
 
-        res = count;
+        if (!res)
+                res = count;
 out_unlock:
         free_page(addr);
         return res;
diff --git a/drivers/net/wireless/libertas/decl.h b/drivers/net/wireless/libertas/decl.h
index fb91c3639fc1..678f7c9f7503 100644
--- a/drivers/net/wireless/libertas/decl.h
+++ b/drivers/net/wireless/libertas/decl.h
@@ -8,74 +8,48 @@
 
 #include <linux/netdevice.h>
 
-#include "defs.h"
 
-/** Function Prototype Declaration */
 struct lbs_private;
 struct sk_buff;
 struct net_device;
-struct cmd_ctrl_node;
-struct cmd_ds_command;
 
-void lbs_set_mac_control(struct lbs_private *priv);
 
-void lbs_send_tx_feedback(struct lbs_private *priv, u32 try_count);
-
-int lbs_free_cmd_buffer(struct lbs_private *priv);
+/* ethtool.c */
+extern const struct ethtool_ops lbs_ethtool_ops;
 
-int lbs_prepare_and_send_command(struct lbs_private *priv,
-        u16 cmd_no,
-        u16 cmd_action,
-        u16 wait_option, u32 cmd_oid, void *pdata_buf);
-
-int lbs_allocate_cmd_buffer(struct lbs_private *priv);
-int lbs_execute_next_command(struct lbs_private *priv);
-int lbs_process_event(struct lbs_private *priv, u32 event);
-void lbs_queue_event(struct lbs_private *priv, u32 event);
-void lbs_notify_command_response(struct lbs_private *priv, u8 resp_idx);
-int lbs_set_deep_sleep(struct lbs_private *priv, int deep_sleep);
-int lbs_enter_auto_deep_sleep(struct lbs_private *priv);
-int lbs_exit_auto_deep_sleep(struct lbs_private *priv);
 
-u32 lbs_fw_index_to_data_rate(u8 index);
-u8 lbs_data_rate_to_fw_index(u32 rate);
-
-/** The proc fs interface */
-int lbs_process_command_response(struct lbs_private *priv, u8 *data, u32 len);
-void lbs_complete_command(struct lbs_private *priv, struct cmd_ctrl_node *cmd,
-                          int result);
+/* tx.c */
+void lbs_send_tx_feedback(struct lbs_private *priv, u32 try_count);
 netdev_tx_t lbs_hard_start_xmit(struct sk_buff *skb,
                                 struct net_device *dev);
-int lbs_set_regiontable(struct lbs_private *priv, u8 region, u8 band);
 
+/* rx.c */
 int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *);
 
-void lbs_ps_sleep(struct lbs_private *priv, int wait_option);
-void lbs_ps_confirm_sleep(struct lbs_private *priv);
-void lbs_ps_wakeup(struct lbs_private *priv, int wait_option);
-
-struct chan_freq_power *lbs_find_cfp_by_band_and_channel(
-        struct lbs_private *priv,
-        u8 band,
-        u16 channel);
-
-void lbs_mac_event_disconnected(struct lbs_private *priv);
-
-void lbs_send_iwevcustom_event(struct lbs_private *priv, s8 *str);
 
 /* persistcfg.c */
 void lbs_persist_config_init(struct net_device *net);
 void lbs_persist_config_remove(struct net_device *net);
 
+
 /* main.c */
-struct chan_freq_power *lbs_get_region_cfp_table(u8 region,
-        int *cfp_no);
 struct lbs_private *lbs_add_card(void *card, struct device *dmdev);
 void lbs_remove_card(struct lbs_private *priv);
 int lbs_start_card(struct lbs_private *priv);
 void lbs_stop_card(struct lbs_private *priv);
 void lbs_host_to_card_done(struct lbs_private *priv);
 
-int lbs_update_channel(struct lbs_private *priv);
+int lbs_suspend(struct lbs_private *priv);
+void lbs_resume(struct lbs_private *priv);
+
+void lbs_queue_event(struct lbs_private *priv, u32 event);
+void lbs_notify_command_response(struct lbs_private *priv, u8 resp_idx);
+
+int lbs_enter_auto_deep_sleep(struct lbs_private *priv);
+int lbs_exit_auto_deep_sleep(struct lbs_private *priv);
+
+u32 lbs_fw_index_to_data_rate(u8 index);
+u8 lbs_data_rate_to_fw_index(u32 rate);
+
 
 #endif
diff --git a/drivers/net/wireless/libertas/defs.h b/drivers/net/wireless/libertas/defs.h
index 1cf5d5985dac..6b6ea9f7bf5b 100644
--- a/drivers/net/wireless/libertas/defs.h
+++ b/drivers/net/wireless/libertas/defs.h
@@ -322,7 +322,6 @@ static inline void lbs_deb_hex(unsigned int grp, const char *prompt, u8 *buf, in
 extern const char lbs_driver_version[];
 extern u16 lbs_region_code_to_index[MRVDRV_MAX_REGION_CODE];
 
-extern u8 lbs_bg_rates[MAX_RATES];
 
 /** ENUM definition*/
 /** SNRNF_TYPE */
diff --git a/drivers/net/wireless/libertas/dev.h b/drivers/net/wireless/libertas/dev.h
index 8abb28af5afa..1a675111300d 100644
--- a/drivers/net/wireless/libertas/dev.h
+++ b/drivers/net/wireless/libertas/dev.h
@@ -6,75 +6,10 @@
 #ifndef _LBS_DEV_H_
 #define _LBS_DEV_H_
 
-#include <linux/netdevice.h>
-#include <linux/wireless.h>
-#include <linux/ethtool.h>
-#include <linux/debugfs.h>
+#include "scan.h"
+#include "assoc.h"
 
-#include "defs.h"
-#include "hostcmd.h"
 
-extern const struct ethtool_ops lbs_ethtool_ops;
-
-#define MAX_BSSID_PER_CHANNEL           16
-
-#define NR_TX_QUEUE                     3
-
-/* For the extended Scan */
-#define MAX_EXTENDED_SCAN_BSSID_LIST    MAX_BSSID_PER_CHANNEL * \
-                                                MRVDRV_MAX_CHANNEL_SIZE + 1
-
-#define MAX_REGION_CHANNEL_NUM  2
-
-/** Chan-freq-TxPower mapping table*/
-struct chan_freq_power {
-        /** channel Number              */
-        u16 channel;
-        /** frequency of this channel   */
-        u32 freq;
-        /** Max allowed Tx power level  */
-        u16 maxtxpower;
-        /** TRUE:channel unsupported;  FLASE:supported*/
-        u8 unsupported;
-};
-
-/** region-band mapping table*/
-struct region_channel {
-        /** TRUE if this entry is valid              */
-        u8 valid;
-        /** region code for US, Japan ...            */
-        u8 region;
-        /** band B/G/A, used for BAND_CONFIG cmd             */
-        u8 band;
-        /** Actual No. of elements in the array below */
-        u8 nrcfp;
-        /** chan-freq-txpower mapping table*/
-        struct chan_freq_power *CFP;
-};
-
-struct lbs_802_11_security {
-        u8 WPAenabled;
-        u8 WPA2enabled;
-        u8 wep_enabled;
-        u8 auth_mode;
-        u32 key_mgmt;
-};
-
-/** Current Basic Service Set State Structure */
-struct current_bss_params {
-        /** bssid */
-        u8 bssid[ETH_ALEN];
-        /** ssid */
-        u8 ssid[IW_ESSID_MAX_SIZE + 1];
-        u8 ssid_len;
-
-        /** band */
-        u8 band;
-        /** channel */
-        u8 channel;
-        /** zero-terminated array of supported data rates */
-        u8 rates[MAX_RATES + 1];
-};
 
 /** sleep_params */
 struct sleep_params {
@@ -100,113 +35,96 @@ struct lbs_mesh_stats {
 
 /** Private structure for the MV device */
 struct lbs_private {
+
+        /* Basic networking */
+        struct net_device *dev;
+        u32 connect_status;
+        int infra_open;
+        struct work_struct mcast_work;
+        u32 nr_of_multicastmacaddr;
+        u8 multicastlist[MRVDRV_MAX_MULTICAST_LIST_SIZE][ETH_ALEN];
+
+        /* CFG80211 */
         struct wireless_dev *wdev;
+
+        /* Mesh */
+        struct net_device *mesh_dev; /* Virtual device */
+        u32 mesh_connect_status;
+        struct lbs_mesh_stats mstats;
         int mesh_open;
         int mesh_fw_ver;
-        int infra_open;
         int mesh_autostart_enabled;
+        uint16_t mesh_tlv;
+        u8 mesh_ssid[IEEE80211_MAX_SSID_LEN + 1];
+        u8 mesh_ssid_len;
+        struct work_struct sync_channel;
 
-        char name[DEV_NAME_LEN];
-
-        void *card;
-        struct net_device *dev;
-
-        struct net_device *mesh_dev; /* Virtual device */
+        /* Monitor mode */
         struct net_device *rtap_net_dev;
+        u32 monitormode;
 
-        struct iw_statistics wstats;
-        struct lbs_mesh_stats mstats;
+        /* Debugfs */
         struct dentry *debugfs_dir;
         struct dentry *debugfs_debug;
         struct dentry *debugfs_files[6];
-
         struct dentry *events_dir;
         struct dentry *debugfs_events_files[6];
-
         struct dentry *regs_dir;
         struct dentry *debugfs_regs_files[6];
 
+        /* Hardware debugging */
         u32 mac_offset;
         u32 bbp_offset;
         u32 rf_offset;
+        struct lbs_offset_value offsetvalue;
+
+        /* Power management */
+        u16 psmode;
+        u32 psstate;
+        u8 needtowakeup;
 
-        /** Deep sleep flag */
+        /* Deep sleep */
         int is_deep_sleep;
-        /** Auto deep sleep enabled flag */
         int is_auto_deep_sleep_enabled;
-        /** Device wakeup required flag */
         int wakeup_dev_required;
-        /** Auto deep sleep flag*/
         int is_activity_detected;
-        /** Auto deep sleep timeout (in miliseconds) */
-        int auto_deep_sleep_timeout;
-
-        /** Deep sleep wait queue */
-        wait_queue_head_t       ds_awake_q;
-
-        /* Download sent:
-           bit0 1/0=data_sent/data_tx_done,
-           bit1 1/0=cmd_sent/cmd_tx_done,
-           all other bits reserved 0 */
-        u8 dnld_sent;
-
-        /** thread to service interrupts */
-        struct task_struct *main_thread;
-        wait_queue_head_t waitq;
-        struct workqueue_struct *work_thread;
-
-        struct work_struct mcast_work;
-
-        /** Scanning */
-        struct delayed_work scan_work;
-        struct delayed_work assoc_work;
-        struct work_struct sync_channel;
-        /* remember which channel was scanned last, != 0 if currently scanning */
-        int scan_channel;
-        u8 scan_ssid[IW_ESSID_MAX_SIZE + 1];
-        u8 scan_ssid_len;
+        int auto_deep_sleep_timeout; /* in ms */
+        wait_queue_head_t ds_awake_q;
+        struct timer_list auto_deepsleep_timer;
 
-        /** Hardware access */
+        /* Hardware access */
+        void *card;
+        u8 fw_ready;
+        u8 surpriseremoved;
         int (*hw_host_to_card) (struct lbs_private *priv, u8 type, u8 *payload, u16 nb);
         void (*reset_card) (struct lbs_private *priv);
         int (*enter_deep_sleep) (struct lbs_private *priv);
         int (*exit_deep_sleep) (struct lbs_private *priv);
         int (*reset_deep_sleep_wakeup) (struct lbs_private *priv);
 
-        /* Wake On LAN */
-        uint32_t wol_criteria;
-        uint8_t wol_gpio;
-        uint8_t wol_gap;
-
-        /** Wlan adapter data structure*/
-        /** STATUS variables */
+        /* Adapter info (from EEPROM) */
         u32 fwrelease;
         u32 fwcapinfo;
+        u16 regioncode;
+        u8 current_addr[ETH_ALEN];
 
-        struct mutex lock;
-
-        /* TX packet ready to be sent... */
-        int tx_pending_len;             /* -1 while building packet */
-
-        u8 tx_pending_buf[LBS_UPLD_SIZE];
-        /* protected by hard_start_xmit serialization */
-
-        /** command-related variables */
+        /* Command download */
+        u8 dnld_sent;
+        /* bit0 1/0=data_sent/data_tx_done,
+           bit1 1/0=cmd_sent/cmd_tx_done,
+           all other bits reserved 0 */
         u16 seqnum;
-
         struct cmd_ctrl_node *cmd_array;
-        /** Current command */
         struct cmd_ctrl_node *cur_cmd;
-        int cur_cmd_retcode;
-        /** command Queues */
-        /** Free command buffers */
-        struct list_head cmdfreeq;
-        /** Pending command buffers */
-        struct list_head cmdpendingq;
-
+        struct list_head cmdfreeq;    /* free command buffers */
+        struct list_head cmdpendingq; /* pending command buffers */
         wait_queue_head_t cmd_pending;
+        struct timer_list command_timer;
+        int nr_retries;
+        int cmd_timed_out;
 
         /* Command responses sent from the hardware to the driver */
+        int cur_cmd_retcode;
         u8 resp_idx;
         u8 resp_buf[2][LBS_UPLD_SIZE];
         u32 resp_len[2];
@@ -214,96 +132,76 @@ struct lbs_private {
         /* Events sent from hardware to driver */
         struct kfifo *event_fifo;
 
-        /* nickname */
-        u8 nodename[16];
-
-        /** spin locks */
-        spinlock_t driver_lock;
-
-        /** Timers */
-        struct timer_list command_timer;
-        struct timer_list auto_deepsleep_timer;
-        int nr_retries;
-        int cmd_timed_out;
-
-        /** current ssid/bssid related parameters*/
-        struct current_bss_params curbssparams;
-
-        uint16_t mesh_tlv;
-        u8 mesh_ssid[IW_ESSID_MAX_SIZE + 1];
-        u8 mesh_ssid_len;
-
-        /* IW_MODE_* */
-        u8 mode;
-
-        /* Scan results list */
-        struct list_head network_list;
-        struct list_head network_free_list;
-        struct bss_descriptor *networks;
-
-        u16 beacon_period;
-        u8 beacon_enable;
-        u8 adhoccreate;
-
-        /** capability Info used in Association, start, join */
-        u16 capability;
-
-        /** MAC address information */
-        u8 current_addr[ETH_ALEN];
-        u8 multicastlist[MRVDRV_MAX_MULTICAST_LIST_SIZE][ETH_ALEN];
-        u32 nr_of_multicastmacaddr;
+        /** thread to service interrupts */
+        struct task_struct *main_thread;
+        wait_queue_head_t waitq;
+        struct workqueue_struct *work_thread;
 
-        /** 802.11 statistics */
-//      struct cmd_DS_802_11_GET_STAT wlan802_11Stat;
+        /** Encryption stuff */
+        struct lbs_802_11_security secinfo;
+        struct enc_key wpa_mcast_key;
+        struct enc_key wpa_unicast_key;
+        u8 wpa_ie[MAX_WPA_IE_LEN];
+        u8 wpa_ie_len;
+        u16 wep_tx_keyidx;
+        struct enc_key wep_keys[4];
 
-        uint16_t enablehwauto;
-        uint16_t ratebitmap;
+        /* Wake On LAN */
+        uint32_t wol_criteria;
+        uint8_t wol_gpio;
+        uint8_t wol_gap;
 
+        /* Transmitting */
+        int tx_pending_len;             /* -1 while building packet */
+        u8 tx_pending_buf[LBS_UPLD_SIZE];
+        /* protected by hard_start_xmit serialization */
         u8 txretrycount;
-
-        /** Tx-related variables (for single packet tx) */
         struct sk_buff *currenttxskb;
 
-        /** NIC Operation characteristics */
+        /* Locks */
+        struct mutex lock;
+        spinlock_t driver_lock;
+
+        /* NIC/link operation characteristics */
         u16 mac_control;
-        u32 connect_status;
-        u32 mesh_connect_status;
-        u16 regioncode;
+        u8 radio_on;
+        u8 channel;
         s16 txpower_cur;
         s16 txpower_min;
         s16 txpower_max;
 
-        /** POWER MANAGEMENT AND PnP SUPPORT */
-        u8 surpriseremoved;
-
-        u16 psmode;             /* Wlan802_11PowermodeCAM=disable
-                                   Wlan802_11PowermodeMAX_PSP=enable */
-        u32 psstate;
-        u8 needtowakeup;
+        /** Scanning */
+        struct delayed_work scan_work;
+        int scan_channel;
+        /* remember which channel was scanned last, != 0 if currently scanning */
+        u8 scan_ssid[IEEE80211_MAX_SSID_LEN + 1];
+        u8 scan_ssid_len;
 
+        /* Associating */
+        struct delayed_work assoc_work;
+        struct current_bss_params curbssparams;
+        u8 mode;
+        struct list_head network_list;
+        struct list_head network_free_list;
+        struct bss_descriptor *networks;
         struct assoc_request * pending_assoc_req;
         struct assoc_request * in_progress_assoc_req;
+        u16 capability;
+        uint16_t enablehwauto;
+        uint16_t ratebitmap;
 
-        /** Encryption parameter */
-        struct lbs_802_11_security secinfo;
-
-        /** WEP keys */
-        struct enc_key wep_keys[4];
-        u16 wep_tx_keyidx;
-
-        /** WPA keys */
-        struct enc_key wpa_mcast_key;
-        struct enc_key wpa_unicast_key;
-
-/*
- * In theory, the IE is limited to the IE length, 255,
- * but in practice 64 bytes are enough.
- */
-#define MAX_WPA_IE_LEN 64
+        /* ADHOC */
+        u16 beacon_period;
+        u8 beacon_enable;
+        u8 adhoccreate;
 
-        /** WPA Information Elements*/
-        u8 wpa_ie[MAX_WPA_IE_LEN];
-        u8 wpa_ie_len;
+        /* WEXT */
+        char name[DEV_NAME_LEN];
+        u8 nodename[16];
+        struct iw_statistics wstats;
+        u8 cur_rate;
+#define MAX_REGION_CHANNEL_NUM  2
+        struct region_channel region_channel[MAX_REGION_CHANNEL_NUM];
 
         /** Requested Signal Strength*/
         u16 SNR[MAX_TYPE_B][MAX_TYPE_AVG];
@@ -313,116 +211,8 @@ struct lbs_private {
         u8 rawNF[DEFAULT_DATA_AVG_FACTOR];
         u16 nextSNRNF;
         u16 numSNRNF;
-
-        u8 radio_on;
-
-        /** data rate stuff */
-        u8 cur_rate;
-
-        /** RF calibration data */
-
-#define MAX_REGION_CHANNEL_NUM  2
-        /** region channel data */
-        struct region_channel region_channel[MAX_REGION_CHANNEL_NUM];
-
-        struct region_channel universal_channel[MAX_REGION_CHANNEL_NUM];
-
-        /** 11D and Domain Regulatory Data */
-        struct lbs_802_11d_domain_reg domainreg;
-        struct parsed_region_chan_11d parsed_region_chan;
-
-        /** FSM variable for 11d support */
-        u32 enable11d;
-
-        /**     MISCELLANEOUS */
-        struct lbs_offset_value offsetvalue;
-
-        u32 monitormode;
-        u8 fw_ready;
 };
 
 extern struct cmd_confirm_sleep confirm_sleep;
 
-/**
- *  @brief Structure used to store information for each beacon/probe response
- */
-struct bss_descriptor {
-        u8 bssid[ETH_ALEN];
-
-        u8 ssid[IW_ESSID_MAX_SIZE + 1];
-        u8 ssid_len;
-
-        u16 capability;
-        u32 rssi;
-        u32 channel;
-        u16 beaconperiod;
-        __le16 atimwindow;
-
-        /* IW_MODE_AUTO, IW_MODE_ADHOC, IW_MODE_INFRA */
-        u8 mode;
-
-        /* zero-terminated array of supported data rates */
-        u8 rates[MAX_RATES + 1];
-
-        unsigned long last_scanned;
-
-        union ieee_phy_param_set phy;
-        union ieee_ss_param_set ss;
-
-        struct ieee_ie_country_info_full_set countryinfo;
-
-        u8 wpa_ie[MAX_WPA_IE_LEN];
-        size_t wpa_ie_len;
-        u8 rsn_ie[MAX_WPA_IE_LEN];
-        size_t rsn_ie_len;
-
-        u8 mesh;
-
-        struct list_head list;
-};
-
-/** Association request
- *
- * Encapsulates all the options that describe a specific assocation request
- * or configuration of the wireless card's radio, mode, and security settings.
- */
-struct assoc_request {
-#define ASSOC_FLAG_SSID                 1
-#define ASSOC_FLAG_CHANNEL              2
-#define ASSOC_FLAG_BAND                 3
-#define ASSOC_FLAG_MODE                 4
-#define ASSOC_FLAG_BSSID                5
-#define ASSOC_FLAG_WEP_KEYS             6
-#define ASSOC_FLAG_WEP_TX_KEYIDX        7
-#define ASSOC_FLAG_WPA_MCAST_KEY        8
-#define ASSOC_FLAG_WPA_UCAST_KEY        9
-#define ASSOC_FLAG_SECINFO              10
-#define ASSOC_FLAG_WPA_IE               11
-        unsigned long flags;
-
-        u8 ssid[IW_ESSID_MAX_SIZE + 1];
-        u8 ssid_len;
-        u8 channel;
-        u8 band;
-        u8 mode;
-        u8 bssid[ETH_ALEN] __attribute__ ((aligned (2)));
-
-        /** WEP keys */
-        struct enc_key wep_keys[4];
-        u16 wep_tx_keyidx;
-
-        /** WPA keys */
-        struct enc_key wpa_mcast_key;
-        struct enc_key wpa_unicast_key;
-
-        struct lbs_802_11_security secinfo;
-
-        /** WPA Information Elements*/
-        u8 wpa_ie[MAX_WPA_IE_LEN];
-        u8 wpa_ie_len;
-
-        /* BSS to associate with for infrastructure of Ad-Hoc join */
-        struct bss_descriptor bss;
-};
-
 #endif
diff --git a/drivers/net/wireless/libertas/host.h b/drivers/net/wireless/libertas/host.h
index c055daabea13..3809c0b49464 100644
--- a/drivers/net/wireless/libertas/host.h
+++ b/drivers/net/wireless/libertas/host.h
@@ -1,202 +1,190 @@
 /**
-  * This file contains definitions of WLAN commands.
+  * This file function prototypes, data structure
+  * and  definitions for all the host/station commands
   */
 
 #ifndef _LBS_HOST_H_
 #define _LBS_HOST_H_
 
-/** PUBLIC DEFINITIONS */
-#define DEFAULT_AD_HOC_CHANNEL                  6
-#define DEFAULT_AD_HOC_CHANNEL_A                36
+#include "types.h"
+#include "defs.h"
 
-#define CMD_OPTION_WAITFORRSP                   0x0002
+#define DEFAULT_AD_HOC_CHANNEL                  6
+
+#define CMD_OPTION_WAITFORRSP                   0x0002
 
 /** Host command IDs */
 
 /* Return command are almost always the same as the host command, but with
  * bit 15 set high.  There are a few exceptions, though...
  */
-#define CMD_RET(cmd)                    (0x8000 | cmd)
+#define CMD_RET(cmd)                            (0x8000 | cmd)
 
 /* Return command convention exceptions: */
-#define CMD_RET_802_11_ASSOCIATE                0x8012
+#define CMD_RET_802_11_ASSOCIATE                0x8012
 
 /* Command codes */
-#define CMD_GET_HW_SPEC                         0x0003
-#define CMD_EEPROM_UPDATE                       0x0004
-#define CMD_802_11_RESET                        0x0005
-#define CMD_802_11_SCAN                         0x0006
-#define CMD_802_11_GET_LOG                      0x000b
-#define CMD_MAC_MULTICAST_ADR                   0x0010
-#define CMD_802_11_AUTHENTICATE                 0x0011
-#define CMD_802_11_EEPROM_ACCESS                0x0059
-#define CMD_802_11_ASSOCIATE                    0x0050
-#define CMD_802_11_SET_WEP                      0x0013
-#define CMD_802_11_GET_STAT                     0x0014
-#define CMD_802_3_GET_STAT                      0x0015
-#define CMD_802_11_SNMP_MIB                     0x0016
-#define CMD_MAC_REG_MAP                         0x0017
-#define CMD_BBP_REG_MAP                         0x0018
-#define CMD_MAC_REG_ACCESS                      0x0019
-#define CMD_BBP_REG_ACCESS                      0x001a
-#define CMD_RF_REG_ACCESS                       0x001b
-#define CMD_802_11_RADIO_CONTROL                0x001c
-#define CMD_802_11_RF_CHANNEL                   0x001d
-#define CMD_802_11_RF_TX_POWER                  0x001e
-#define CMD_802_11_RSSI                         0x001f
-#define CMD_802_11_RF_ANTENNA                   0x0020
-#define CMD_802_11_PS_MODE                      0x0021
-#define CMD_802_11_DATA_RATE                    0x0022
-#define CMD_RF_REG_MAP                          0x0023
-#define CMD_802_11_DEAUTHENTICATE               0x0024
-#define CMD_802_11_REASSOCIATE                  0x0025
-#define CMD_MAC_CONTROL                         0x0028
-#define CMD_802_11_AD_HOC_START                 0x002b
-#define CMD_802_11_AD_HOC_JOIN                  0x002c
-#define CMD_802_11_QUERY_TKIP_REPLY_CNTRS       0x002e
-#define CMD_802_11_ENABLE_RSN                   0x002f
-#define CMD_802_11_SET_AFC                      0x003c
-#define CMD_802_11_GET_AFC                      0x003d
-#define CMD_802_11_DEEP_SLEEP                  0x003e
-#define CMD_802_11_AD_HOC_STOP                  0x0040
-#define CMD_802_11_HOST_SLEEP_CFG               0x0043
-#define CMD_802_11_WAKEUP_CONFIRM               0x0044
-#define CMD_802_11_HOST_SLEEP_ACTIVATE          0x0045
-#define CMD_802_11_BEACON_STOP                  0x0049
-#define CMD_802_11_MAC_ADDRESS                  0x004d
-#define CMD_802_11_LED_GPIO_CTRL                0x004e
-#define CMD_802_11_EEPROM_ACCESS                0x0059
-#define CMD_802_11_BAND_CONFIG                  0x0058
-#define CMD_GSPI_BUS_CONFIG                     0x005a
-#define CMD_802_11D_DOMAIN_INFO                 0x005b
-#define CMD_802_11_KEY_MATERIAL                 0x005e
-#define CMD_802_11_SLEEP_PARAMS                 0x0066
-#define CMD_802_11_INACTIVITY_TIMEOUT           0x0067
-#define CMD_802_11_SLEEP_PERIOD                 0x0068
-#define CMD_802_11_TPC_CFG                      0x0072
-#define CMD_802_11_PA_CFG                       0x0073
-#define CMD_802_11_FW_WAKE_METHOD               0x0074
-#define CMD_802_11_SUBSCRIBE_EVENT              0x0075
-#define CMD_802_11_RATE_ADAPT_RATESET           0x0076
-#define CMD_802_11_TX_RATE_QUERY                0x007f
-#define CMD_GET_TSF                             0x0080
-#define CMD_BT_ACCESS                           0x0087
-#define CMD_FWT_ACCESS                          0x0095
-#define CMD_802_11_MONITOR_MODE                 0x0098
-#define CMD_MESH_ACCESS                         0x009b
-#define CMD_MESH_CONFIG_OLD                     0x00a3
-#define CMD_MESH_CONFIG                         0x00ac
-#define CMD_SET_BOOT2_VER                       0x00a5
-#define CMD_FUNC_INIT                           0x00a9
-#define CMD_FUNC_SHUTDOWN                       0x00aa
-#define CMD_802_11_BEACON_CTRL                  0x00b0
+#define CMD_GET_HW_SPEC                         0x0003
+#define CMD_EEPROM_UPDATE                       0x0004
+#define CMD_802_11_RESET                        0x0005
+#define CMD_802_11_SCAN                         0x0006
+#define CMD_802_11_GET_LOG                      0x000b
+#define CMD_MAC_MULTICAST_ADR                   0x0010
+#define CMD_802_11_AUTHENTICATE                 0x0011
+#define CMD_802_11_EEPROM_ACCESS                0x0059
+#define CMD_802_11_ASSOCIATE                    0x0050
+#define CMD_802_11_SET_WEP                      0x0013
+#define CMD_802_11_GET_STAT                     0x0014
+#define CMD_802_3_GET_STAT                      0x0015
+#define CMD_802_11_SNMP_MIB                     0x0016
+#define CMD_MAC_REG_MAP                         0x0017
+#define CMD_BBP_REG_MAP                         0x0018
+#define CMD_MAC_REG_ACCESS                      0x0019
+#define CMD_BBP_REG_ACCESS                      0x001a
+#define CMD_RF_REG_ACCESS                       0x001b
+#define CMD_802_11_RADIO_CONTROL                0x001c
+#define CMD_802_11_RF_CHANNEL                   0x001d
+#define CMD_802_11_RF_TX_POWER                  0x001e
+#define CMD_802_11_RSSI                         0x001f
+#define CMD_802_11_RF_ANTENNA                   0x0020
+#define CMD_802_11_PS_MODE                      0x0021
+#define CMD_802_11_DATA_RATE                    0x0022
+#define CMD_RF_REG_MAP                          0x0023
+#define CMD_802_11_DEAUTHENTICATE               0x0024
+#define CMD_802_11_REASSOCIATE                  0x0025
+#define CMD_MAC_CONTROL                         0x0028
+#define CMD_802_11_AD_HOC_START                 0x002b
+#define CMD_802_11_AD_HOC_JOIN                  0x002c
+#define CMD_802_11_QUERY_TKIP_REPLY_CNTRS       0x002e
+#define CMD_802_11_ENABLE_RSN                   0x002f
+#define CMD_802_11_SET_AFC                      0x003c
+#define CMD_802_11_GET_AFC                      0x003d
+#define CMD_802_11_DEEP_SLEEP                   0x003e
+#define CMD_802_11_AD_HOC_STOP                  0x0040
+#define CMD_802_11_HOST_SLEEP_CFG               0x0043
+#define CMD_802_11_WAKEUP_CONFIRM               0x0044
+#define CMD_802_11_HOST_SLEEP_ACTIVATE          0x0045
+#define CMD_802_11_BEACON_STOP                  0x0049
+#define CMD_802_11_MAC_ADDRESS                  0x004d
+#define CMD_802_11_LED_GPIO_CTRL                0x004e
+#define CMD_802_11_EEPROM_ACCESS                0x0059
+#define CMD_802_11_BAND_CONFIG                  0x0058
+#define CMD_GSPI_BUS_CONFIG                     0x005a
+#define CMD_802_11D_DOMAIN_INFO                 0x005b
+#define CMD_802_11_KEY_MATERIAL                 0x005e
+#define CMD_802_11_SLEEP_PARAMS                 0x0066
+#define CMD_802_11_INACTIVITY_TIMEOUT           0x0067
+#define CMD_802_11_SLEEP_PERIOD                 0x0068
+#define CMD_802_11_TPC_CFG                      0x0072
+#define CMD_802_11_PA_CFG                       0x0073
+#define CMD_802_11_FW_WAKE_METHOD               0x0074
+#define CMD_802_11_SUBSCRIBE_EVENT              0x0075
+#define CMD_802_11_RATE_ADAPT_RATESET           0x0076
+#define CMD_802_11_TX_RATE_QUERY                0x007f
+#define CMD_GET_TSF                             0x0080
+#define CMD_BT_ACCESS                           0x0087
+#define CMD_FWT_ACCESS                          0x0095
+#define CMD_802_11_MONITOR_MODE                 0x0098
+#define CMD_MESH_ACCESS                         0x009b
+#define CMD_MESH_CONFIG_OLD                     0x00a3
+#define CMD_MESH_CONFIG                         0x00ac
+#define CMD_SET_BOOT2_VER                       0x00a5
+#define CMD_FUNC_INIT                           0x00a9
+#define CMD_FUNC_SHUTDOWN                       0x00aa
+#define CMD_802_11_BEACON_CTRL                  0x00b0
 
 /* For the IEEE Power Save */
-#define CMD_SUBCMD_ENTER_PS             0x0030
-#define CMD_SUBCMD_EXIT_PS              0x0031
-#define CMD_SUBCMD_SLEEP_CONFIRMED      0x0034
-#define CMD_SUBCMD_FULL_POWERDOWN       0x0035
-#define CMD_SUBCMD_FULL_POWERUP         0x0036
+#define CMD_SUBCMD_ENTER_PS                     0x0030
+#define CMD_SUBCMD_EXIT_PS                      0x0031
+#define CMD_SUBCMD_SLEEP_CONFIRMED              0x0034
+#define CMD_SUBCMD_FULL_POWERDOWN               0x0035
+#define CMD_SUBCMD_FULL_POWERUP                 0x0036
 
-#define CMD_ENABLE_RSN                  0x0001
-#define CMD_DISABLE_RSN                 0x0000
+#define CMD_ENABLE_RSN                          0x0001
+#define CMD_DISABLE_RSN                         0x0000
 
-#define CMD_ACT_GET                     0x0000
-#define CMD_ACT_SET                     0x0001
-#define CMD_ACT_GET_AES                 0x0002
-#define CMD_ACT_SET_AES                 0x0003
-#define CMD_ACT_REMOVE_AES              0x0004
+#define CMD_ACT_GET                             0x0000
+#define CMD_ACT_SET                             0x0001
 
 /* Define action or option for CMD_802_11_SET_WEP */
-#define CMD_ACT_ADD                     0x0002
-#define CMD_ACT_REMOVE                  0x0004
-#define CMD_ACT_USE_DEFAULT             0x0008
-
-#define CMD_TYPE_WEP_40_BIT             0x01
-#define CMD_TYPE_WEP_104_BIT            0x02
+#define CMD_ACT_ADD                             0x0002
+#define CMD_ACT_REMOVE                          0x0004
 
-#define CMD_NUM_OF_WEP_KEYS             4
+#define CMD_TYPE_WEP_40_BIT                     0x01
+#define CMD_TYPE_WEP_104_BIT                    0x02
 
-#define CMD_WEP_KEY_INDEX_MASK          0x3fff
+#define CMD_NUM_OF_WEP_KEYS                     4
 
-/* Define action or option for CMD_802_11_RESET */
-#define CMD_ACT_HALT                    0x0003
+#define CMD_WEP_KEY_INDEX_MASK                  0x3fff
 
 /* Define action or option for CMD_802_11_SCAN */
-#define CMD_BSS_TYPE_BSS                0x0001
-#define CMD_BSS_TYPE_IBSS               0x0002
-#define CMD_BSS_TYPE_ANY                0x0003
+#define CMD_BSS_TYPE_BSS                        0x0001
+#define CMD_BSS_TYPE_IBSS                       0x0002
+#define CMD_BSS_TYPE_ANY                        0x0003
 
 /* Define action or option for CMD_802_11_SCAN */
-#define CMD_SCAN_TYPE_ACTIVE            0x0000
-#define CMD_SCAN_TYPE_PASSIVE           0x0001
+#define CMD_SCAN_TYPE_ACTIVE                    0x0000
+#define CMD_SCAN_TYPE_PASSIVE                   0x0001
 
-#define CMD_SCAN_RADIO_TYPE_BG          0
+#define CMD_SCAN_RADIO_TYPE_BG                  0
 
-#define CMD_SCAN_PROBE_DELAY_TIME       0
+#define CMD_SCAN_PROBE_DELAY_TIME               0
 
 /* Define action or option for CMD_MAC_CONTROL */
-#define CMD_ACT_MAC_RX_ON                       0x0001
-#define CMD_ACT_MAC_TX_ON                       0x0002
-#define CMD_ACT_MAC_LOOPBACK_ON                 0x0004
-#define CMD_ACT_MAC_WEP_ENABLE                  0x0008
-#define CMD_ACT_MAC_INT_ENABLE                  0x0010
-#define CMD_ACT_MAC_MULTICAST_ENABLE            0x0020
-#define CMD_ACT_MAC_BROADCAST_ENABLE            0x0040
-#define CMD_ACT_MAC_PROMISCUOUS_ENABLE          0x0080
-#define CMD_ACT_MAC_ALL_MULTICAST_ENABLE        0x0100
-#define CMD_ACT_MAC_STRICT_PROTECTION_ENABLE    0x0400
+#define CMD_ACT_MAC_RX_ON                       0x0001
+#define CMD_ACT_MAC_TX_ON                       0x0002
+#define CMD_ACT_MAC_LOOPBACK_ON                 0x0004
+#define CMD_ACT_MAC_WEP_ENABLE                  0x0008
+#define CMD_ACT_MAC_INT_ENABLE                  0x0010
+#define CMD_ACT_MAC_MULTICAST_ENABLE            0x0020
+#define CMD_ACT_MAC_BROADCAST_ENABLE            0x0040
+#define CMD_ACT_MAC_PROMISCUOUS_ENABLE          0x0080
+#define CMD_ACT_MAC_ALL_MULTICAST_ENABLE        0x0100
+#define CMD_ACT_MAC_STRICT_PROTECTION_ENABLE    0x0400
 
 /* Event flags for CMD_802_11_SUBSCRIBE_EVENT */
-#define CMD_SUBSCRIBE_RSSI_LOW          0x0001
-#define CMD_SUBSCRIBE_SNR_LOW           0x0002
-#define CMD_SUBSCRIBE_FAILCOUNT         0x0004
-#define CMD_SUBSCRIBE_BCNMISS           0x0008
-#define CMD_SUBSCRIBE_RSSI_HIGH         0x0010
-#define CMD_SUBSCRIBE_SNR_HIGH          0x0020
+#define CMD_SUBSCRIBE_RSSI_LOW                  0x0001
+#define CMD_SUBSCRIBE_SNR_LOW                   0x0002
+#define CMD_SUBSCRIBE_FAILCOUNT                 0x0004
+#define CMD_SUBSCRIBE_BCNMISS                   0x0008
+#define CMD_SUBSCRIBE_RSSI_HIGH                 0x0010
+#define CMD_SUBSCRIBE_SNR_HIGH                  0x0020
 
-#define RADIO_PREAMBLE_LONG     0x00
-#define RADIO_PREAMBLE_SHORT    0x02
-#define RADIO_PREAMBLE_AUTO     0x04
+#define RADIO_PREAMBLE_LONG                     0x00
+#define RADIO_PREAMBLE_SHORT                    0x02
+#define RADIO_PREAMBLE_AUTO                     0x04
 
 /* Define action or option for CMD_802_11_RF_CHANNEL */
-#define CMD_OPT_802_11_RF_CHANNEL_GET   0x00
-#define CMD_OPT_802_11_RF_CHANNEL_SET   0x01
+#define CMD_OPT_802_11_RF_CHANNEL_GET           0x00
+#define CMD_OPT_802_11_RF_CHANNEL_SET           0x01
 
 /* Define action or option for CMD_802_11_DATA_RATE */
-#define CMD_ACT_SET_TX_AUTO             0x0000
-#define CMD_ACT_SET_TX_FIX_RATE         0x0001
-#define CMD_ACT_GET_TX_RATE             0x0002
-
-#define CMD_ACT_SET_RX                  0x0001
-#define CMD_ACT_SET_TX                  0x0002
-#define CMD_ACT_SET_BOTH                0x0003
-#define CMD_ACT_GET_RX                  0x0004
-#define CMD_ACT_GET_TX                  0x0008
-#define CMD_ACT_GET_BOTH                0x000c
+#define CMD_ACT_SET_TX_AUTO                     0x0000
+#define CMD_ACT_SET_TX_FIX_RATE                 0x0001
+#define CMD_ACT_GET_TX_RATE                     0x0002
 
 /* Define action or option for CMD_802_11_PS_MODE */
-#define CMD_TYPE_CAM                    0x0000
-#define CMD_TYPE_MAX_PSP                0x0001
-#define CMD_TYPE_FAST_PSP               0x0002
+#define CMD_TYPE_CAM                            0x0000
+#define CMD_TYPE_MAX_PSP                        0x0001
+#define CMD_TYPE_FAST_PSP                       0x0002
 
 /* Options for CMD_802_11_FW_WAKE_METHOD */
-#define CMD_WAKE_METHOD_UNCHANGED       0x0000
-#define CMD_WAKE_METHOD_COMMAND_INT     0x0001
-#define CMD_WAKE_METHOD_GPIO            0x0002
+#define CMD_WAKE_METHOD_UNCHANGED               0x0000
+#define CMD_WAKE_METHOD_COMMAND_INT             0x0001
+#define CMD_WAKE_METHOD_GPIO                    0x0002
 
 /* Object IDs for CMD_802_11_SNMP_MIB */
-#define SNMP_MIB_OID_BSS_TYPE           0x0000
-#define SNMP_MIB_OID_OP_RATE_SET        0x0001
-#define SNMP_MIB_OID_BEACON_PERIOD      0x0002  /* Reserved on v9+ */
-#define SNMP_MIB_OID_DTIM_PERIOD        0x0003  /* Reserved on v9+ */
-#define SNMP_MIB_OID_ASSOC_TIMEOUT      0x0004  /* Reserved on v9+ */
-#define SNMP_MIB_OID_RTS_THRESHOLD      0x0005
-#define SNMP_MIB_OID_SHORT_RETRY_LIMIT  0x0006
-#define SNMP_MIB_OID_LONG_RETRY_LIMIT   0x0007
-#define SNMP_MIB_OID_FRAG_THRESHOLD     0x0008
-#define SNMP_MIB_OID_11D_ENABLE         0x0009
-#define SNMP_MIB_OID_11H_ENABLE         0x000A
+#define SNMP_MIB_OID_BSS_TYPE                   0x0000
+#define SNMP_MIB_OID_OP_RATE_SET                0x0001
+#define SNMP_MIB_OID_BEACON_PERIOD              0x0002  /* Reserved on v9+ */
+#define SNMP_MIB_OID_DTIM_PERIOD                0x0003  /* Reserved on v9+ */
+#define SNMP_MIB_OID_ASSOC_TIMEOUT              0x0004  /* Reserved on v9+ */
+#define SNMP_MIB_OID_RTS_THRESHOLD              0x0005
+#define SNMP_MIB_OID_SHORT_RETRY_LIMIT          0x0006
+#define SNMP_MIB_OID_LONG_RETRY_LIMIT           0x0007
+#define SNMP_MIB_OID_FRAG_THRESHOLD             0x0008
+#define SNMP_MIB_OID_11D_ENABLE                 0x0009
+#define SNMP_MIB_OID_11H_ENABLE                 0x000A
 
 /* Define action or option for CMD_BT_ACCESS */
 enum cmd_bt_access_opts {
@@ -303,4 +291,672 @@ enum cmd_mesh_config_types {
 #define MACREG_INT_CODE_MESH_AUTO_STARTED       35
 #define MACREG_INT_CODE_FIRMWARE_READY          48
 
+
+/* 802.11-related definitions */
+
+/* TxPD descriptor */
+struct txpd {
+        /* union to cope up with later FW revisions */
+        union {
+                /* Current Tx packet status */
+                __le32 tx_status;
+                struct {
+                        /* BSS type: client, AP, etc. */
+                        u8 bss_type;
+                        /* BSS number */
+                        u8 bss_num;
+                        /* Reserved */
+                        __le16 reserved;
+                } bss;
+        } u;
+        /* Tx control */
+        __le32 tx_control;
+        __le32 tx_packet_location;
+        /* Tx packet length */
+        __le16 tx_packet_length;
+        /* First 2 byte of destination MAC address */
+        u8 tx_dest_addr_high[2];
+        /* Last 4 byte of destination MAC address */
+        u8 tx_dest_addr_low[4];
+        /* Pkt Priority */
+        u8 priority;
+        /* Pkt Trasnit Power control */
+        u8 powermgmt;
+        /* Amount of time the packet has been queued (units = 2ms) */
+        u8 pktdelay_2ms;
+        /* reserved */
+        u8 reserved1;
+} __attribute__ ((packed));
+
+/* RxPD Descriptor */
+struct rxpd {
+        /* union to cope up with later FW revisions */
+        union {
+                /* Current Rx packet status */
+                __le16 status;
+                struct {
+                        /* BSS type: client, AP, etc. */
+                        u8 bss_type;
+                        /* BSS number */
+                        u8 bss_num;
+                } __attribute__ ((packed)) bss;
+        } __attribute__ ((packed)) u;
+
+        /* SNR */
+        u8 snr;
+
+        /* Tx control */
+        u8 rx_control;
+
+        /* Pkt length */
+        __le16 pkt_len;
+
+        /* Noise Floor */
+        u8 nf;
+
+        /* Rx Packet Rate */
+        u8 rx_rate;
+
+        /* Pkt addr */
+        __le32 pkt_ptr;
+
+        /* Next Rx RxPD addr */
+        __le32 next_rxpd_ptr;
+
+        /* Pkt Priority */
+        u8 priority;
+        u8 reserved[3];
+} __attribute__ ((packed));
+
+struct cmd_header {
+        __le16 command;
+        __le16 size;
+        __le16 seqnum;
+        __le16 result;
+} __attribute__ ((packed));
+
+/* Generic structure to hold all key types. */
+struct enc_key {
+        u16 len;
+        u16 flags;  /* KEY_INFO_* from defs.h */
+        u16 type; /* KEY_TYPE_* from defs.h */
+        u8 key[32];
+};
+
+/* lbs_offset_value */
+struct lbs_offset_value {
+        u32 offset;
+        u32 value;
+} __attribute__ ((packed));
+
+/*
+ * Define data structure for CMD_GET_HW_SPEC
+ * This structure defines the response for the GET_HW_SPEC command
+ */
+struct cmd_ds_get_hw_spec {
+        struct cmd_header hdr;
+
+        /* HW Interface version number */
+        __le16 hwifversion;
+        /* HW version number */
+        __le16 version;
+        /* Max number of TxPD FW can handle */
+        __le16 nr_txpd;
+        /* Max no of Multicast address */
+        __le16 nr_mcast_adr;
+        /* MAC address */
+        u8 permanentaddr[6];
+
+        /* region Code */
+        __le16 regioncode;
+
+        /* Number of antenna used */
+        __le16 nr_antenna;
+
+        /* FW release number, example 0x01030304 = 2.3.4p1 */
+        __le32 fwrelease;
+
+        /* Base Address of TxPD queue */
+        __le32 wcb_base;
+        /* Read Pointer of RxPd queue */
+        __le32 rxpd_rdptr;
+
+        /* Write Pointer of RxPd queue */
+        __le32 rxpd_wrptr;
+
+        /*FW/HW capability */
+        __le32 fwcapinfo;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_subscribe_event {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le16 events;
+
+        /* A TLV to the CMD_802_11_SUBSCRIBE_EVENT command can contain a
+         * number of TLVs. From the v5.1 manual, those TLVs would add up to
+         * 40 bytes. However, future firmware might add additional TLVs, so I
+         * bump this up a bit.
+         */
+        uint8_t tlv[128];
+} __attribute__ ((packed));
+
+/*
+ * This scan handle Country Information IE(802.11d compliant)
+ * Define data structure for CMD_802_11_SCAN
+ */
+struct cmd_ds_802_11_scan {
+        struct cmd_header hdr;
+
+        uint8_t bsstype;
+        uint8_t bssid[ETH_ALEN];
+        uint8_t tlvbuffer[0];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_scan_rsp {
+        struct cmd_header hdr;
+
+        __le16 bssdescriptsize;
+        uint8_t nr_sets;
+        uint8_t bssdesc_and_tlvbuffer[0];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_get_log {
+        struct cmd_header hdr;
+
+        __le32 mcasttxframe;
+        __le32 failed;
+        __le32 retry;
+        __le32 multiretry;
+        __le32 framedup;
+        __le32 rtssuccess;
+        __le32 rtsfailure;
+        __le32 ackfailure;
+        __le32 rxfrag;
+        __le32 mcastrxframe;
+        __le32 fcserror;
+        __le32 txframe;
+        __le32 wepundecryptable;
+} __attribute__ ((packed));
+
+struct cmd_ds_mac_control {
+        struct cmd_header hdr;
+        __le16 action;
+        u16 reserved;
+} __attribute__ ((packed));
+
+struct cmd_ds_mac_multicast_adr {
+        struct cmd_header hdr;
+        __le16 action;
+        __le16 nr_of_adrs;
+        u8 maclist[ETH_ALEN * MRVDRV_MAX_MULTICAST_LIST_SIZE];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_authenticate {
+        struct cmd_header hdr;
+
+        u8 bssid[ETH_ALEN];
+        u8 authtype;
+        u8 reserved[10];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_deauthenticate {
+        struct cmd_header hdr;
+
+        u8 macaddr[ETH_ALEN];
+        __le16 reasoncode;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_associate {
+        struct cmd_header hdr;
+
+        u8 bssid[6];
+        __le16 capability;
+        __le16 listeninterval;
+        __le16 bcnperiod;
+        u8 dtimperiod;
+        u8 iebuf[512];    /* Enough for required and most optional IEs */
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_associate_response {
+        struct cmd_header hdr;
+
+        __le16 capability;
+        __le16 statuscode;
+        __le16 aid;
+        u8 iebuf[512];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_set_wep {
+        struct cmd_header hdr;
+
+        /* ACT_ADD, ACT_REMOVE or ACT_ENABLE */
+        __le16 action;
+
+        /* key Index selected for Tx */
+        __le16 keyindex;
+
+        /* 40, 128bit or TXWEP */
+        uint8_t keytype[4];
+        uint8_t keymaterial[4][16];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_snmp_mib {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le16 oid;
+        __le16 bufsize;
+        u8 value[128];
+} __attribute__ ((packed));
+
+struct cmd_ds_mac_reg_access {
+        __le16 action;
+        __le16 offset;
+        __le32 value;
+} __attribute__ ((packed));
+
+struct cmd_ds_bbp_reg_access {
+        __le16 action;
+        __le16 offset;
+        u8 value;
+        u8 reserved[3];
+} __attribute__ ((packed));
+
+struct cmd_ds_rf_reg_access {
+        __le16 action;
+        __le16 offset;
+        u8 value;
+        u8 reserved[3];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_radio_control {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le16 control;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_beacon_control {
+        __le16 action;
+        __le16 beacon_enable;
+        __le16 beacon_period;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_sleep_params {
+        struct cmd_header hdr;
+
+        /* ACT_GET/ACT_SET */
+        __le16 action;
+
+        /* Sleep clock error in ppm */
+        __le16 error;
+
+        /* Wakeup offset in usec */
+        __le16 offset;
+
+        /* Clock stabilization time in usec */
+        __le16 stabletime;
+
+        /* control periodic calibration */
+        uint8_t calcontrol;
+
+        /* control the use of external sleep clock */
+        uint8_t externalsleepclk;
+
+        /* reserved field, should be set to zero */
+        __le16 reserved;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_rf_channel {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le16 channel;
+        __le16 rftype;      /* unused */
+        __le16 reserved;    /* unused */
+        u8 channellist[32]; /* unused */
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_rssi {
+        /* weighting factor */
+        __le16 N;
+
+        __le16 reserved_0;
+        __le16 reserved_1;
+        __le16 reserved_2;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_rssi_rsp {
+        __le16 SNR;
+        __le16 noisefloor;
+        __le16 avgSNR;
+        __le16 avgnoisefloor;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_mac_address {
+        struct cmd_header hdr;
+
+        __le16 action;
+        u8 macadd[ETH_ALEN];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_rf_tx_power {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le16 curlevel;
+        s8 maxlevel;
+        s8 minlevel;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_monitor_mode {
+        __le16 action;
+        __le16 mode;
+} __attribute__ ((packed));
+
+struct cmd_ds_set_boot2_ver {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le16 version;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_fw_wake_method {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le16 method;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_ps_mode {
+        __le16 action;
+        __le16 nullpktinterval;
+        __le16 multipledtim;
+        __le16 reserved;
+        __le16 locallisteninterval;
+} __attribute__ ((packed));
+
+struct cmd_confirm_sleep {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le16 nullpktinterval;
+        __le16 multipledtim;
+        __le16 reserved;
+        __le16 locallisteninterval;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_data_rate {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le16 reserved;
+        u8 rates[MAX_RATES];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_rate_adapt_rateset {
+        struct cmd_header hdr;
+        __le16 action;
+        __le16 enablehwauto;
+        __le16 bitmap;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_ad_hoc_start {
+        struct cmd_header hdr;
+
+        u8 ssid[IEEE80211_MAX_SSID_LEN];
+        u8 bsstype;
+        __le16 beaconperiod;
+        u8 dtimperiod;   /* Reserved on v9 and later */
+        struct ieee_ie_ibss_param_set ibss;
+        u8 reserved1[4];
+        struct ieee_ie_ds_param_set ds;
+        u8 reserved2[4];
+        __le16 probedelay;  /* Reserved on v9 and later */
+        __le16 capability;
+        u8 rates[MAX_RATES];
+        u8 tlv_memory_size_pad[100];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_ad_hoc_result {
+        struct cmd_header hdr;
+
+        u8 pad[3];
+        u8 bssid[ETH_ALEN];
+} __attribute__ ((packed));
+
+struct adhoc_bssdesc {
+        u8 bssid[ETH_ALEN];
+        u8 ssid[IEEE80211_MAX_SSID_LEN];
+        u8 type;
+        __le16 beaconperiod;
+        u8 dtimperiod;
+        __le64 timestamp;
+        __le64 localtime;
+        struct ieee_ie_ds_param_set ds;
+        u8 reserved1[4];
+        struct ieee_ie_ibss_param_set ibss;
+        u8 reserved2[4];
+        __le16 capability;
+        u8 rates[MAX_RATES];
+
+        /* DO NOT ADD ANY FIELDS TO THIS STRUCTURE. It is used below in the
+         * Adhoc join command and will cause a binary layout mismatch with
+         * the firmware
+         */
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_ad_hoc_join {
+        struct cmd_header hdr;
+
+        struct adhoc_bssdesc bss;
+        __le16 failtimeout;   /* Reserved on v9 and later */
+        __le16 probedelay;    /* Reserved on v9 and later */
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_ad_hoc_stop {
+        struct cmd_header hdr;
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_enable_rsn {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le16 enable;
+} __attribute__ ((packed));
+
+struct MrvlIEtype_keyParamSet {
+        /* type ID */
+        __le16 type;
+
+        /* length of Payload */
+        __le16 length;
+
+        /* type of key: WEP=0, TKIP=1, AES=2 */
+        __le16 keytypeid;
+
+        /* key control Info specific to a keytypeid */
+        __le16 keyinfo;
+
+        /* length of key */
+        __le16 keylen;
+
+        /* key material of size keylen */
+        u8 key[32];
+} __attribute__ ((packed));
+
+#define MAX_WOL_RULES           16
+
+struct host_wol_rule {
+        uint8_t rule_no;
+        uint8_t rule_ops;
+        __le16 sig_offset;
+        __le16 sig_length;
+        __le16 reserve;
+        __be32 sig_mask;
+        __be32 signature;
+} __attribute__ ((packed));
+
+struct wol_config {
+        uint8_t action;
+        uint8_t pattern;
+        uint8_t no_rules_in_cmd;
+        uint8_t result;
+        struct host_wol_rule rule[MAX_WOL_RULES];
+} __attribute__ ((packed));
+
+struct cmd_ds_host_sleep {
+        struct cmd_header hdr;
+        __le32 criteria;
+        uint8_t gpio;
+        uint16_t gap;
+        struct wol_config wol_conf;
+} __attribute__ ((packed));
+
+
+
+struct cmd_ds_802_11_key_material {
+        struct cmd_header hdr;
+
+        __le16 action;
+        struct MrvlIEtype_keyParamSet keyParamSet[2];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_eeprom_access {
+        struct cmd_header hdr;
+        __le16 action;
+        __le16 offset;
+        __le16 len;
+        /* firmware says it returns a maximum of 20 bytes */
+#define LBS_EEPROM_READ_LEN 20
+        u8 value[LBS_EEPROM_READ_LEN];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_tpc_cfg {
+        struct cmd_header hdr;
+
+        __le16 action;
+        uint8_t enable;
+        int8_t P0;
+        int8_t P1;
+        int8_t P2;
+        uint8_t usesnr;
+} __attribute__ ((packed));
+
+
+struct cmd_ds_802_11_pa_cfg {
+        struct cmd_header hdr;
+
+        __le16 action;
+        uint8_t enable;
+        int8_t P0;
+        int8_t P1;
+        int8_t P2;
+} __attribute__ ((packed));
+
+
+struct cmd_ds_802_11_led_ctrl {
+        __le16 action;
+        __le16 numled;
+        u8 data[256];
+} __attribute__ ((packed));
+
+struct cmd_ds_802_11_afc {
+        __le16 afc_auto;
+        union {
+                struct {
+                        __le16 threshold;
+                        __le16 period;
+                };
+                struct {
+                        __le16 timing_offset; /* signed */
+                        __le16 carrier_offset; /* signed */
+                };
+        };
+} __attribute__ ((packed));
+
+struct cmd_tx_rate_query {
+        __le16 txrate;
+} __attribute__ ((packed));
+
+struct cmd_ds_get_tsf {
+        __le64 tsfvalue;
+} __attribute__ ((packed));
+
+struct cmd_ds_bt_access {
+        __le16 action;
+        __le32 id;
+        u8 addr1[ETH_ALEN];
+        u8 addr2[ETH_ALEN];
+} __attribute__ ((packed));
+
+struct cmd_ds_fwt_access {
+        __le16 action;
+        __le32 id;
+        u8 valid;
+        u8 da[ETH_ALEN];
+        u8 dir;
+        u8 ra[ETH_ALEN];
+        __le32 ssn;
+        __le32 dsn;
+        __le32 metric;
+        u8 rate;
+        u8 hopcount;
+        u8 ttl;
+        __le32 expiration;
+        u8 sleepmode;
+        __le32 snr;
+        __le32 references;
+        u8 prec[ETH_ALEN];
+} __attribute__ ((packed));
+
+struct cmd_ds_mesh_config {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le16 channel;
+        __le16 type;
+        __le16 length;
+        u8 data[128];   /* last position reserved */
+} __attribute__ ((packed));
+
+struct cmd_ds_mesh_access {
+        struct cmd_header hdr;
+
+        __le16 action;
+        __le32 data[32];        /* last position reserved */
+} __attribute__ ((packed));
+
+/* Number of stats counters returned by the firmware */
+#define MESH_STATS_NUM 8
+
+struct cmd_ds_command {
+        /* command header */
+        __le16 command;
+        __le16 size;
+        __le16 seqnum;
+        __le16 result;
+
+        /* command Body */
+        union {
+                struct cmd_ds_802_11_ps_mode psmode;
+                struct cmd_ds_802_11_monitor_mode monitor;
+                struct cmd_ds_802_11_rssi rssi;
+                struct cmd_ds_802_11_rssi_rsp rssirsp;
+                struct cmd_ds_mac_reg_access macreg;
+                struct cmd_ds_bbp_reg_access bbpreg;
+                struct cmd_ds_rf_reg_access rfreg;
+
+                struct cmd_ds_802_11_tpc_cfg tpccfg;
+                struct cmd_ds_802_11_afc afc;
+                struct cmd_ds_802_11_led_ctrl ledgpio;
+
+                struct cmd_ds_bt_access bt;
+                struct cmd_ds_fwt_access fwt;
+                struct cmd_ds_802_11_beacon_control bcn_ctrl;
+        } params;
+} __attribute__ ((packed));
+
 #endif
diff --git a/drivers/net/wireless/libertas/hostcmd.h b/drivers/net/wireless/libertas/hostcmd.h
deleted file mode 100644
index c8a1998d4744..000000000000
--- a/drivers/net/wireless/libertas/hostcmd.h
+++ /dev/null
@@ -1,800 +0,0 @@
-/*
- * This file contains the function prototypes, data structure
- * and defines for all the host/station commands
- */
-#ifndef _LBS_HOSTCMD_H
-#define _LBS_HOSTCMD_H
-
-#include <linux/wireless.h>
-#include "11d.h"
-#include "types.h"
-
-/* 802.11-related definitions */
-
-/* TxPD descriptor */
-struct txpd {
-        /* union to cope up with later FW revisions */
-        union {
-                /* Current Tx packet status */
-                __le32 tx_status;
-                struct {
-                        /* BSS type: client, AP, etc. */
-                        u8 bss_type;
-                        /* BSS number */
-                        u8 bss_num;
-                        /* Reserved */
-                        __le16 reserved;
-                } bss;
-        } u;
-        /* Tx control */
-        __le32 tx_control;
-        __le32 tx_packet_location;
-        /* Tx packet length */
-        __le16 tx_packet_length;
-        /* First 2 byte of destination MAC address */
-        u8 tx_dest_addr_high[2];
-        /* Last 4 byte of destination MAC address */
-        u8 tx_dest_addr_low[4];
-        /* Pkt Priority */
-        u8 priority;
-        /* Pkt Trasnit Power control */
-        u8 powermgmt;
-        /* Amount of time the packet has been queued in the driver (units = 2ms) */
-        u8 pktdelay_2ms;
-        /* reserved */
-        u8 reserved1;
-} __attribute__ ((packed));
-
-/* RxPD Descriptor */
-struct rxpd {
-        /* union to cope up with later FW revisions */
-        union {
-                /* Current Rx packet status */
-                __le16 status;
-                struct {
-                        /* BSS type: client, AP, etc. */
-                        u8 bss_type;
-                        /* BSS number */
-                        u8 bss_num;
-                } __attribute__ ((packed)) bss;
-        } __attribute__ ((packed)) u;
-
-        /* SNR */
-        u8 snr;
-
-        /* Tx control */
-        u8 rx_control;
-
-        /* Pkt length */
-        __le16 pkt_len;
-
-        /* Noise Floor */
-        u8 nf;
-
-        /* Rx Packet Rate */
-        u8 rx_rate;
-
-        /* Pkt addr */
-        __le32 pkt_ptr;
-
-        /* Next Rx RxPD addr */
-        __le32 next_rxpd_ptr;
-
-        /* Pkt Priority */
-        u8 priority;
-        u8 reserved[3];
-} __attribute__ ((packed));
-
-struct cmd_header {
-        __le16 command;
-        __le16 size;
-        __le16 seqnum;
-        __le16 result;
-} __attribute__ ((packed));
-
-struct cmd_ctrl_node {
-        struct list_head list;
-        int result;
-        /* command response */
-        int (*callback)(struct lbs_private *, unsigned long, struct cmd_header *);
-        unsigned long callback_arg;
-        /* command data */
-        struct cmd_header *cmdbuf;
-        /* wait queue */
-        u16 cmdwaitqwoken;
-        wait_queue_head_t cmdwait_q;
-};
-
-/* Generic structure to hold all key types. */
-struct enc_key {
-        u16 len;
-        u16 flags;  /* KEY_INFO_* from defs.h */
-        u16 type; /* KEY_TYPE_* from defs.h */
-        u8 key[32];
-};
-
-/* lbs_offset_value */
-struct lbs_offset_value {
-        u32 offset;
-        u32 value;
-} __attribute__ ((packed));
-
-/* Define general data structure */
-/* cmd_DS_GEN */
-struct cmd_ds_gen {
-        __le16 command;
-        __le16 size;
-        __le16 seqnum;
-        __le16 result;
-        void *cmdresp[0];
-} __attribute__ ((packed));
-
-#define S_DS_GEN sizeof(struct cmd_ds_gen)
-
-
-/*
- * Define data structure for CMD_GET_HW_SPEC
- * This structure defines the response for the GET_HW_SPEC command
- */
-struct cmd_ds_get_hw_spec {
-        struct cmd_header hdr;
-
-        /* HW Interface version number */
-        __le16 hwifversion;
-        /* HW version number */
-        __le16 version;
-        /* Max number of TxPD FW can handle */
-        __le16 nr_txpd;
-        /* Max no of Multicast address */
-        __le16 nr_mcast_adr;
-        /* MAC address */
-        u8 permanentaddr[6];
-
-        /* region Code */
-        __le16 regioncode;
-
-        /* Number of antenna used */
-        __le16 nr_antenna;
-
-        /* FW release number, example 0x01030304 = 2.3.4p1 */
-        __le32 fwrelease;
-
-        /* Base Address of TxPD queue */
-        __le32 wcb_base;
-        /* Read Pointer of RxPd queue */
-        __le32 rxpd_rdptr;
-
-        /* Write Pointer of RxPd queue */
-        __le32 rxpd_wrptr;
-
-        /*FW/HW capability */
-        __le32 fwcapinfo;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_subscribe_event {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le16 events;
-
-        /* A TLV to the CMD_802_11_SUBSCRIBE_EVENT command can contain a
-         * number of TLVs. From the v5.1 manual, those TLVs would add up to
-         * 40 bytes. However, future firmware might add additional TLVs, so I
-         * bump this up a bit.
-         */
-        uint8_t tlv[128];
-} __attribute__ ((packed));
-
-/*
- * This scan handle Country Information IE(802.11d compliant)
- * Define data structure for CMD_802_11_SCAN
- */
-struct cmd_ds_802_11_scan {
-        struct cmd_header hdr;
-
-        uint8_t bsstype;
-        uint8_t bssid[ETH_ALEN];
-        uint8_t tlvbuffer[0];
-#if 0
-        mrvlietypes_ssidparamset_t ssidParamSet;
-        mrvlietypes_chanlistparamset_t ChanListParamSet;
-        mrvlietypes_ratesparamset_t OpRateSet;
-#endif
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_scan_rsp {
-        struct cmd_header hdr;
-
-        __le16 bssdescriptsize;
-        uint8_t nr_sets;
-        uint8_t bssdesc_and_tlvbuffer[0];
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_get_log {
-        struct cmd_header hdr;
-
-        __le32 mcasttxframe;
-        __le32 failed;
-        __le32 retry;
-        __le32 multiretry;
-        __le32 framedup;
-        __le32 rtssuccess;
-        __le32 rtsfailure;
-        __le32 ackfailure;
-        __le32 rxfrag;
-        __le32 mcastrxframe;
-        __le32 fcserror;
-        __le32 txframe;
-        __le32 wepundecryptable;
-} __attribute__ ((packed));
-
-struct cmd_ds_mac_control {
-        struct cmd_header hdr;
-        __le16 action;
-        u16 reserved;
-} __attribute__ ((packed));
-
-struct cmd_ds_mac_multicast_adr {
-        struct cmd_header hdr;
-        __le16 action;
-        __le16 nr_of_adrs;
-        u8 maclist[ETH_ALEN * MRVDRV_MAX_MULTICAST_LIST_SIZE];
-} __attribute__ ((packed));
-
-struct cmd_ds_gspi_bus_config {
-        struct cmd_header hdr;
-        __le16 action;
-        __le16 bus_delay_mode;
-        __le16 host_time_delay_to_read_port;
-        __le16 host_time_delay_to_read_register;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_authenticate {
-        struct cmd_header hdr;
-
-        u8 bssid[ETH_ALEN];
-        u8 authtype;
-        u8 reserved[10];
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_deauthenticate {
-        struct cmd_header hdr;
-
-        u8 macaddr[ETH_ALEN];
-        __le16 reasoncode;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_associate {
-        struct cmd_header hdr;
-
-        u8 bssid[6];
-        __le16 capability;
-        __le16 listeninterval;
-        __le16 bcnperiod;
-        u8 dtimperiod;
-        u8 iebuf[512];    /* Enough for required and most optional IEs */
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_associate_response {
-        struct cmd_header hdr;
-
-        __le16 capability;
-        __le16 statuscode;
-        __le16 aid;
-        u8 iebuf[512];
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_set_wep {
-        struct cmd_header hdr;
-
-        /* ACT_ADD, ACT_REMOVE or ACT_ENABLE */
-        __le16 action;
-
-        /* key Index selected for Tx */
-        __le16 keyindex;
-
-        /* 40, 128bit or TXWEP */
-        uint8_t keytype[4];
-        uint8_t keymaterial[4][16];
-} __attribute__ ((packed));
-
-struct cmd_ds_802_3_get_stat {
-        __le32 xmitok;
-        __le32 rcvok;
-        __le32 xmiterror;
-        __le32 rcverror;
-        __le32 rcvnobuffer;
-        __le32 rcvcrcerror;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_get_stat {
-        __le32 txfragmentcnt;
-        __le32 mcasttxframecnt;
-        __le32 failedcnt;
-        __le32 retrycnt;
-        __le32 Multipleretrycnt;
-        __le32 rtssuccesscnt;
-        __le32 rtsfailurecnt;
-        __le32 ackfailurecnt;
-        __le32 frameduplicatecnt;
-        __le32 rxfragmentcnt;
-        __le32 mcastrxframecnt;
-        __le32 fcserrorcnt;
-        __le32 bcasttxframecnt;
-        __le32 bcastrxframecnt;
-        __le32 txbeacon;
-        __le32 rxbeacon;
-        __le32 wepundecryptable;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_snmp_mib {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le16 oid;
-        __le16 bufsize;
-        u8 value[128];
-} __attribute__ ((packed));
-
-struct cmd_ds_mac_reg_map {
-        __le16 buffersize;
-        u8 regmap[128];
-        __le16 reserved;
-} __attribute__ ((packed));
-
-struct cmd_ds_bbp_reg_map {
-        __le16 buffersize;
-        u8 regmap[128];
-        __le16 reserved;
-} __attribute__ ((packed));
-
-struct cmd_ds_rf_reg_map {
-        __le16 buffersize;
-        u8 regmap[64];
-        __le16 reserved;
-} __attribute__ ((packed));
-
-struct cmd_ds_mac_reg_access {
-        __le16 action;
-        __le16 offset;
-        __le32 value;
-} __attribute__ ((packed));
-
-struct cmd_ds_bbp_reg_access {
-        __le16 action;
-        __le16 offset;
-        u8 value;
-        u8 reserved[3];
-} __attribute__ ((packed));
-
-struct cmd_ds_rf_reg_access {
-        __le16 action;
-        __le16 offset;
-        u8 value;
-        u8 reserved[3];
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_radio_control {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le16 control;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_beacon_control {
-        __le16 action;
-        __le16 beacon_enable;
-        __le16 beacon_period;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_sleep_params {
-        struct cmd_header hdr;
-
-        /* ACT_GET/ACT_SET */
-        __le16 action;
-
-        /* Sleep clock error in ppm */
-        __le16 error;
-
-        /* Wakeup offset in usec */
-        __le16 offset;
-
-        /* Clock stabilization time in usec */
-        __le16 stabletime;
-
-        /* control periodic calibration */
-        uint8_t calcontrol;
-
-        /* control the use of external sleep clock */
-        uint8_t externalsleepclk;
-
-        /* reserved field, should be set to zero */
-        __le16 reserved;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_inactivity_timeout {
-        struct cmd_header hdr;
-
-        /* ACT_GET/ACT_SET */
-        __le16 action;
-
-        /* Inactivity timeout in msec */
-        __le16 timeout;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_rf_channel {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le16 channel;
-        __le16 rftype;      /* unused */
-        __le16 reserved;    /* unused */
-        u8 channellist[32]; /* unused */
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_rssi {
-        /* weighting factor */
-        __le16 N;
-
-        __le16 reserved_0;
-        __le16 reserved_1;
-        __le16 reserved_2;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_rssi_rsp {
-        __le16 SNR;
-        __le16 noisefloor;
-        __le16 avgSNR;
-        __le16 avgnoisefloor;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_mac_address {
-        struct cmd_header hdr;
-
-        __le16 action;
-        u8 macadd[ETH_ALEN];
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_rf_tx_power {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le16 curlevel;
-        s8 maxlevel;
-        s8 minlevel;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_rf_antenna {
-        __le16 action;
-
-        /* Number of antennas or 0xffff(diversity) */
-        __le16 antennamode;
-
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_monitor_mode {
-        __le16 action;
-        __le16 mode;
-} __attribute__ ((packed));
-
-struct cmd_ds_set_boot2_ver {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le16 version;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_fw_wake_method {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le16 method;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_sleep_period {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le16 period;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_ps_mode {
-        __le16 action;
-        __le16 nullpktinterval;
-        __le16 multipledtim;
-        __le16 reserved;
-        __le16 locallisteninterval;
-} __attribute__ ((packed));
-
-struct cmd_confirm_sleep {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le16 nullpktinterval;
-        __le16 multipledtim;
-        __le16 reserved;
-        __le16 locallisteninterval;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_data_rate {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le16 reserved;
-        u8 rates[MAX_RATES];
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_rate_adapt_rateset {
-        struct cmd_header hdr;
-        __le16 action;
-        __le16 enablehwauto;
-        __le16 bitmap;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_ad_hoc_start {
-        struct cmd_header hdr;
-
-        u8 ssid[IW_ESSID_MAX_SIZE];
-        u8 bsstype;
-        __le16 beaconperiod;
-        u8 dtimperiod;   /* Reserved on v9 and later */
-        struct ieee_ie_ibss_param_set ibss;
-        u8 reserved1[4];
-        struct ieee_ie_ds_param_set ds;
-        u8 reserved2[4];
-        __le16 probedelay;  /* Reserved on v9 and later */
-        __le16 capability;
-        u8 rates[MAX_RATES];
-        u8 tlv_memory_size_pad[100];
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_ad_hoc_result {
-        struct cmd_header hdr;
-
-        u8 pad[3];
-        u8 bssid[ETH_ALEN];
-} __attribute__ ((packed));
-
-struct adhoc_bssdesc {
-        u8 bssid[ETH_ALEN];
-        u8 ssid[IW_ESSID_MAX_SIZE];
-        u8 type;
-        __le16 beaconperiod;
-        u8 dtimperiod;
-        __le64 timestamp;
-        __le64 localtime;
-        struct ieee_ie_ds_param_set ds;
-        u8 reserved1[4];
-        struct ieee_ie_ibss_param_set ibss;
-        u8 reserved2[4];
-        __le16 capability;
-        u8 rates[MAX_RATES];
-
-        /* DO NOT ADD ANY FIELDS TO THIS STRUCTURE. It is used below in the
-         * Adhoc join command and will cause a binary layout mismatch with
-         * the firmware
-         */
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_ad_hoc_join {
-        struct cmd_header hdr;
-
-        struct adhoc_bssdesc bss;
-        __le16 failtimeout;   /* Reserved on v9 and later */
-        __le16 probedelay;    /* Reserved on v9 and later */
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_ad_hoc_stop {
-        struct cmd_header hdr;
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_enable_rsn {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le16 enable;
-} __attribute__ ((packed));
-
-struct MrvlIEtype_keyParamSet {
-        /* type ID */
-        __le16 type;
-
-        /* length of Payload */
-        __le16 length;
-
-        /* type of key: WEP=0, TKIP=1, AES=2 */
-        __le16 keytypeid;
-
-        /* key control Info specific to a keytypeid */
-        __le16 keyinfo;
-
-        /* length of key */
-        __le16 keylen;
-
-        /* key material of size keylen */
-        u8 key[32];
-} __attribute__ ((packed));
-
-#define MAX_WOL_RULES           16
-
-struct host_wol_rule {
-        uint8_t rule_no;
-        uint8_t rule_ops;
-        __le16 sig_offset;
-        __le16 sig_length;
-        __le16 reserve;
-        __be32 sig_mask;
-        __be32 signature;
-} __attribute__ ((packed));
-
-struct wol_config {
-        uint8_t action;
-        uint8_t pattern;
-        uint8_t no_rules_in_cmd;
-        uint8_t result;
-        struct host_wol_rule rule[MAX_WOL_RULES];
-} __attribute__ ((packed));
-
-struct cmd_ds_host_sleep {
-        struct cmd_header hdr;
-        __le32 criteria;
-        uint8_t gpio;
-        uint16_t gap;
-        struct wol_config wol_conf;
-} __attribute__ ((packed));
-
-
-
-struct cmd_ds_802_11_key_material {
-        struct cmd_header hdr;
-
-        __le16 action;
-        struct MrvlIEtype_keyParamSet keyParamSet[2];
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_eeprom_access {
-        struct cmd_header hdr;
-        __le16 action;
-        __le16 offset;
-        __le16 len;
-        /* firmware says it returns a maximum of 20 bytes */
-#define LBS_EEPROM_READ_LEN 20
-        u8 value[LBS_EEPROM_READ_LEN];
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_tpc_cfg {
-        struct cmd_header hdr;
-
-        __le16 action;
-        uint8_t enable;
-        int8_t P0;
-        int8_t P1;
-        int8_t P2;
-        uint8_t usesnr;
-} __attribute__ ((packed));
-
-
-struct cmd_ds_802_11_pa_cfg {
-        struct cmd_header hdr;
-
-        __le16 action;
-        uint8_t enable;
-        int8_t P0;
-        int8_t P1;
-        int8_t P2;
-} __attribute__ ((packed));
-
-
-struct cmd_ds_802_11_led_ctrl {
-        __le16 action;
-        __le16 numled;
-        u8 data[256];
-} __attribute__ ((packed));
-
-struct cmd_ds_802_11_afc {
-        __le16 afc_auto;
-        union {
-                struct {
-                        __le16 threshold;
-                        __le16 period;
-                };
-                struct {
-                        __le16 timing_offset; /* signed */
-                        __le16 carrier_offset; /* signed */
-                };
-        };
-} __attribute__ ((packed));
-
-struct cmd_tx_rate_query {
-        __le16 txrate;
-} __attribute__ ((packed));
-
-struct cmd_ds_get_tsf {
-        __le64 tsfvalue;
-} __attribute__ ((packed));
-
-struct cmd_ds_bt_access {
-        __le16 action;
-        __le32 id;
-        u8 addr1[ETH_ALEN];
-        u8 addr2[ETH_ALEN];
-} __attribute__ ((packed));
-
-struct cmd_ds_fwt_access {
-        __le16 action;
-        __le32 id;
-        u8 valid;
-        u8 da[ETH_ALEN];
-        u8 dir;
-        u8 ra[ETH_ALEN];
-        __le32 ssn;
-        __le32 dsn;
-        __le32 metric;
-        u8 rate;
-        u8 hopcount;
-        u8 ttl;
-        __le32 expiration;
-        u8 sleepmode;
-        __le32 snr;
-        __le32 references;
-        u8 prec[ETH_ALEN];
-} __attribute__ ((packed));
-
-
-struct cmd_ds_mesh_config {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le16 channel;
-        __le16 type;
-        __le16 length;
-        u8 data[128];   /* last position reserved */
-} __attribute__ ((packed));
-
-
-struct cmd_ds_mesh_access {
-        struct cmd_header hdr;
-
-        __le16 action;
-        __le32 data[32];        /* last position reserved */
-} __attribute__ ((packed));
-
-/* Number of stats counters returned by the firmware */
-#define MESH_STATS_NUM 8
-
-struct cmd_ds_command {
-        /* command header */
-        __le16 command;
-        __le16 size;
-        __le16 seqnum;
-        __le16 result;
-
-        /* command Body */
-        union {
-                struct cmd_ds_802_11_ps_mode psmode;
-                struct cmd_ds_802_11_get_stat gstat;
-                struct cmd_ds_802_3_get_stat gstat_8023;
-                struct cmd_ds_802_11_rf_antenna rant;
-                struct cmd_ds_802_11_monitor_mode monitor;
-                struct cmd_ds_802_11_rssi rssi;
-                struct cmd_ds_802_11_rssi_rsp rssirsp;
-                struct cmd_ds_mac_reg_access macreg;
-                struct cmd_ds_bbp_reg_access bbpreg;
-                struct cmd_ds_rf_reg_access rfreg;
-
-                struct cmd_ds_802_11d_domain_info domaininfo;
-                struct cmd_ds_802_11d_domain_info domaininforesp;
-
-                struct cmd_ds_802_11_tpc_cfg tpccfg;
-                struct cmd_ds_802_11_afc afc;
-                struct cmd_ds_802_11_led_ctrl ledgpio;
-
-                struct cmd_tx_rate_query txrate;
-                struct cmd_ds_bt_access bt;
-                struct cmd_ds_fwt_access fwt;
-                struct cmd_ds_get_tsf gettsf;
-                struct cmd_ds_802_11_beacon_control bcn_ctrl;
-        } params;
-} __attribute__ ((packed));
-
-#endif
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index 87bfd17b9c8c..01f46cf288d7 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -45,119 +45,6 @@ module_param_named(libertas_debug, lbs_debug, int, 0644);
 struct cmd_confirm_sleep confirm_sleep;
 
 
-#define LBS_TX_PWR_DEFAULT              20      /*100mW */
-#define LBS_TX_PWR_US_DEFAULT           20      /*100mW */
-#define LBS_TX_PWR_JP_DEFAULT           16      /*50mW */
-#define LBS_TX_PWR_FR_DEFAULT           20      /*100mW */
-#define LBS_TX_PWR_EMEA_DEFAULT 20      /*100mW */
-
-/* Format { channel, frequency (MHz), maxtxpower } */
-/* band: 'B/G', region: USA FCC/Canada IC */
-static struct chan_freq_power channel_freq_power_US_BG[] = {
-        {1, 2412, LBS_TX_PWR_US_DEFAULT},
-        {2, 2417, LBS_TX_PWR_US_DEFAULT},
-        {3, 2422, LBS_TX_PWR_US_DEFAULT},
-        {4, 2427, LBS_TX_PWR_US_DEFAULT},
-        {5, 2432, LBS_TX_PWR_US_DEFAULT},
-        {6, 2437, LBS_TX_PWR_US_DEFAULT},
-        {7, 2442, LBS_TX_PWR_US_DEFAULT},
-        {8, 2447, LBS_TX_PWR_US_DEFAULT},
-        {9, 2452, LBS_TX_PWR_US_DEFAULT},
-        {10, 2457, LBS_TX_PWR_US_DEFAULT},
-        {11, 2462, LBS_TX_PWR_US_DEFAULT}
-};
-
-/* band: 'B/G', region: Europe ETSI */
-static struct chan_freq_power channel_freq_power_EU_BG[] = {
-        {1, 2412, LBS_TX_PWR_EMEA_DEFAULT},
-        {2, 2417, LBS_TX_PWR_EMEA_DEFAULT},
-        {3, 2422, LBS_TX_PWR_EMEA_DEFAULT},
-        {4, 2427, LBS_TX_PWR_EMEA_DEFAULT},
-        {5, 2432, LBS_TX_PWR_EMEA_DEFAULT},
-        {6, 2437, LBS_TX_PWR_EMEA_DEFAULT},
-        {7, 2442, LBS_TX_PWR_EMEA_DEFAULT},
-        {8, 2447, LBS_TX_PWR_EMEA_DEFAULT},
-        {9, 2452, LBS_TX_PWR_EMEA_DEFAULT},
-        {10, 2457, LBS_TX_PWR_EMEA_DEFAULT},
-        {11, 2462, LBS_TX_PWR_EMEA_DEFAULT},
-        {12, 2467, LBS_TX_PWR_EMEA_DEFAULT},
-        {13, 2472, LBS_TX_PWR_EMEA_DEFAULT}
-};
-
-/* band: 'B/G', region: Spain */
-static struct chan_freq_power channel_freq_power_SPN_BG[] = {
-        {10, 2457, LBS_TX_PWR_DEFAULT},
-        {11, 2462, LBS_TX_PWR_DEFAULT}
-};
-
-/* band: 'B/G', region: France */
-static struct chan_freq_power channel_freq_power_FR_BG[] = {
-        {10, 2457, LBS_TX_PWR_FR_DEFAULT},
-        {11, 2462, LBS_TX_PWR_FR_DEFAULT},
-        {12, 2467, LBS_TX_PWR_FR_DEFAULT},
-        {13, 2472, LBS_TX_PWR_FR_DEFAULT}
-};
-
-/* band: 'B/G', region: Japan */
-static struct chan_freq_power channel_freq_power_JPN_BG[] = {
-        {1, 2412, LBS_TX_PWR_JP_DEFAULT},
-        {2, 2417, LBS_TX_PWR_JP_DEFAULT},
-        {3, 2422, LBS_TX_PWR_JP_DEFAULT},
-        {4, 2427, LBS_TX_PWR_JP_DEFAULT},
-        {5, 2432, LBS_TX_PWR_JP_DEFAULT},
-        {6, 2437, LBS_TX_PWR_JP_DEFAULT},
-        {7, 2442, LBS_TX_PWR_JP_DEFAULT},
-        {8, 2447, LBS_TX_PWR_JP_DEFAULT},
-        {9, 2452, LBS_TX_PWR_JP_DEFAULT},
-        {10, 2457, LBS_TX_PWR_JP_DEFAULT},
-        {11, 2462, LBS_TX_PWR_JP_DEFAULT},
-        {12, 2467, LBS_TX_PWR_JP_DEFAULT},
-        {13, 2472, LBS_TX_PWR_JP_DEFAULT},
-        {14, 2484, LBS_TX_PWR_JP_DEFAULT}
-};
-
-/**
- * the structure for channel, frequency and power
- */
-struct region_cfp_table {
-        u8 region;
-        struct chan_freq_power *cfp_BG;
-        int cfp_no_BG;
-};
-
-/**
- * the structure for the mapping between region and CFP
- */
-static struct region_cfp_table region_cfp_table[] = {
-        {0x10,                  /*US FCC */
-         channel_freq_power_US_BG,
-         ARRAY_SIZE(channel_freq_power_US_BG),
-         }
-        ,
-        {0x20,                  /*CANADA IC */
-         channel_freq_power_US_BG,
-         ARRAY_SIZE(channel_freq_power_US_BG),
-         }
-        ,
-        {0x30, /*EU*/ channel_freq_power_EU_BG,
-         ARRAY_SIZE(channel_freq_power_EU_BG),
-         }
-        ,
-        {0x31, /*SPAIN*/ channel_freq_power_SPN_BG,
-         ARRAY_SIZE(channel_freq_power_SPN_BG),
-         }
-        ,
-        {0x32, /*FRANCE*/ channel_freq_power_FR_BG,
-         ARRAY_SIZE(channel_freq_power_FR_BG),
-         }
-        ,
-        {0x40, /*JAPAN*/ channel_freq_power_JPN_BG,
-         ARRAY_SIZE(channel_freq_power_JPN_BG),
-         }
-        ,
-/*Add new region here */
-};
-
 /**
  * the table to keep region code
  */
@@ -165,13 +52,6 @@ u16 lbs_region_code_to_index[MRVDRV_MAX_REGION_CODE] =
     { 0x10, 0x20, 0x30, 0x31, 0x32, 0x40 };
 
 /**
- * 802.11b/g supported bitrates (in 500Kb/s units)
- */
-u8 lbs_bg_rates[MAX_RATES] =
-    { 0x02, 0x04, 0x0b, 0x16, 0x0c, 0x12, 0x18, 0x24, 0x30, 0x48, 0x60, 0x6c,
-0x00, 0x00 };
-
-/**
  * FW rate table.  FW refers to rates by their index in this table, not by the
  * rate value itself.  Values of 0x00 are
  * reserved positions.
@@ -405,7 +285,7 @@ static ssize_t lbs_mesh_set(struct device *dev,
                 return count;
         if (enable)
                 action = CMD_ACT_MESH_CONFIG_START;
-        ret = lbs_mesh_config(priv, action, priv->curbssparams.channel);
+        ret = lbs_mesh_config(priv, action, priv->channel);
         if (ret)
                 return ret;
 
@@ -1089,6 +969,8 @@ static void auto_deepsleep_timer_fn(unsigned long data)
                         ret = lbs_prepare_and_send_command(priv,
                                         CMD_802_11_DEEP_SLEEP, 0,
                                         0, 0, NULL);
+                        if (ret)
+                                lbs_pr_err("Enter Deep Sleep command failed\n");
                 }
         }
         mod_timer(&priv->auto_deepsleep_timer , jiffies +
@@ -1164,7 +1046,7 @@ static int lbs_init_adapter(struct lbs_private *priv)
         priv->mesh_connect_status = LBS_DISCONNECTED;
         priv->secinfo.auth_mode = IW_AUTH_ALG_OPEN_SYSTEM;
         priv->mode = IW_MODE_INFRA;
-        priv->curbssparams.channel = DEFAULT_AD_HOC_CHANNEL;
+        priv->channel = DEFAULT_AD_HOC_CHANNEL;
         priv->mac_control = CMD_ACT_MAC_RX_ON | CMD_ACT_MAC_TX_ON;
         priv->radio_on = 1;
         priv->enablehwauto = 1;
@@ -1345,7 +1227,6 @@ EXPORT_SYMBOL_GPL(lbs_add_card);
 void lbs_remove_card(struct lbs_private *priv)
 {
         struct net_device *dev = priv->dev;
-        union iwreq_data wrqu;
 
         lbs_deb_enter(LBS_DEB_MAIN);
 
@@ -1370,9 +1251,7 @@ void lbs_remove_card(struct lbs_private *priv)
                 lbs_ps_wakeup(priv, CMD_OPTION_WAITFORRSP);
         }
 
-        memset(wrqu.ap_addr.sa_data, 0xaa, ETH_ALEN);
-        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
-        wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
+        lbs_send_disconnect_notification(priv);
 
         if (priv->is_deep_sleep) {
                 priv->is_deep_sleep = 0;
@@ -1406,9 +1285,6 @@ int lbs_start_card(struct lbs_private *priv)
         if (ret)
                 goto done;
 
-        /* init 802.11d */
-        lbs_init_11d(priv);
-
         if (lbs_cfg_register(priv)) {
                 lbs_pr_err("cannot register device\n");
                 goto done;
@@ -1435,10 +1311,10 @@ int lbs_start_card(struct lbs_private *priv)
 
                 priv->mesh_tlv = TLV_TYPE_OLD_MESH_ID;
                 if (lbs_mesh_config(priv, CMD_ACT_MESH_CONFIG_START,
-                                    priv->curbssparams.channel)) {
+                                    priv->channel)) {
                         priv->mesh_tlv = TLV_TYPE_MESH_ID;
                         if (lbs_mesh_config(priv, CMD_ACT_MESH_CONFIG_START,
-                                            priv->curbssparams.channel))
+                                            priv->channel))
                                 priv->mesh_tlv = 0;
                 }
         } else if (priv->mesh_fw_ver == MESH_FW_NEW) {
@@ -1447,7 +1323,7 @@ int lbs_start_card(struct lbs_private *priv)
                  */
                 priv->mesh_tlv = TLV_TYPE_MESH_ID;
                 if (lbs_mesh_config(priv, CMD_ACT_MESH_CONFIG_START,
-                                    priv->curbssparams.channel))
+                                    priv->channel))
                         priv->mesh_tlv = 0;
         }
         if (priv->mesh_tlv) {
@@ -1618,68 +1494,6 @@ static void lbs_remove_mesh(struct lbs_private *priv)
         lbs_deb_leave(LBS_DEB_MESH);
 }
 
-/**
- *  @brief This function finds the CFP in
- *  region_cfp_table based on region and band parameter.
- *
- *  @param region  The region code
- *  @param band    The band
- *  @param cfp_no  A pointer to CFP number
- *  @return        A pointer to CFP
- */
-struct chan_freq_power *lbs_get_region_cfp_table(u8 region, int *cfp_no)
-{
-        int i, end;
-
-        lbs_deb_enter(LBS_DEB_MAIN);
-
-        end = ARRAY_SIZE(region_cfp_table);
-
-        for (i = 0; i < end ; i++) {
-                lbs_deb_main("region_cfp_table[i].region=%d\n",
-                        region_cfp_table[i].region);
-                if (region_cfp_table[i].region == region) {
-                        *cfp_no = region_cfp_table[i].cfp_no_BG;
-                        lbs_deb_leave(LBS_DEB_MAIN);
-                        return region_cfp_table[i].cfp_BG;
-                }
-        }
-
-        lbs_deb_leave_args(LBS_DEB_MAIN, "ret NULL");
-        return NULL;
-}
-
-int lbs_set_regiontable(struct lbs_private *priv, u8 region, u8 band)
-{
-        int ret = 0;
-        int i = 0;
-
-        struct chan_freq_power *cfp;
-        int cfp_no;
-
-        lbs_deb_enter(LBS_DEB_MAIN);
-
-        memset(priv->region_channel, 0, sizeof(priv->region_channel));
-
-        cfp = lbs_get_region_cfp_table(region, &cfp_no);
-        if (cfp != NULL) {
-                priv->region_channel[i].nrcfp = cfp_no;
-                priv->region_channel[i].CFP = cfp;
-        } else {
-                lbs_deb_main("wrong region code %#x in band B/G\n",
-                       region);
-                ret = -1;
-                goto out;
-        }
-        priv->region_channel[i].valid = 1;
-        priv->region_channel[i].region = region;
-        priv->region_channel[i].band = band;
-        i++;
-out:
-        lbs_deb_leave_args(LBS_DEB_MAIN, "ret %d", ret);
-        return ret;
-}
-
 void lbs_queue_event(struct lbs_private *priv, u32 event)
 {
         unsigned long flags;
diff --git a/drivers/net/wireless/libertas/persistcfg.c b/drivers/net/wireless/libertas/persistcfg.c
index 18fe29faf99b..871f914a75fc 100644
--- a/drivers/net/wireless/libertas/persistcfg.c
+++ b/drivers/net/wireless/libertas/persistcfg.c
@@ -187,9 +187,9 @@ static ssize_t mesh_id_get(struct device *dev, struct device_attribute *attr,
         if (ret)
                 return ret;
 
-        if (defs.meshie.val.mesh_id_len > IW_ESSID_MAX_SIZE) {
+        if (defs.meshie.val.mesh_id_len > IEEE80211_MAX_SSID_LEN) {
                 lbs_pr_err("inconsistent mesh ID length");
-                defs.meshie.val.mesh_id_len = IW_ESSID_MAX_SIZE;
+                defs.meshie.val.mesh_id_len = IEEE80211_MAX_SSID_LEN;
         }
 
         /* SSID not null terminated: reserve room for \0 + \n */
@@ -214,7 +214,7 @@ static ssize_t mesh_id_set(struct device *dev, struct device_attribute *attr,
         int len;
         int ret;
 
-        if (count < 2 || count > IW_ESSID_MAX_SIZE + 1)
+        if (count < 2 || count > IEEE80211_MAX_SSID_LEN + 1)
                 return -EINVAL;
 
         memset(&cmd, 0, sizeof(struct cmd_ds_mesh_config));
@@ -233,7 +233,7 @@ static ssize_t mesh_id_set(struct device *dev, struct device_attribute *attr,
         /* SSID len */
         ie->val.mesh_id_len = len;
         /* IE len */
-        ie->len = sizeof(struct mrvl_meshie_val) - IW_ESSID_MAX_SIZE + len;
+        ie->len = sizeof(struct mrvl_meshie_val) - IEEE80211_MAX_SSID_LEN + len;
 
         ret = lbs_mesh_config_send(priv, &cmd, CMD_ACT_MESH_CONFIG_SET,
                                    CMD_TYPE_MESH_SET_MESH_IE);
diff --git a/drivers/net/wireless/libertas/rx.c b/drivers/net/wireless/libertas/rx.c
index 65f02cc6752f..9f18a19cc49d 100644
--- a/drivers/net/wireless/libertas/rx.c
+++ b/drivers/net/wireless/libertas/rx.c
@@ -4,7 +4,7 @@
 #include <linux/etherdevice.h>
 #include <linux/types.h>
 
-#include "hostcmd.h"
+#include "host.h"
 #include "radiotap.h"
 #include "decl.h"
 #include "dev.h"
diff --git a/drivers/net/wireless/libertas/scan.c b/drivers/net/wireless/libertas/scan.c
index 6c95af3023cc..c6a6c042b82f 100644
--- a/drivers/net/wireless/libertas/scan.c
+++ b/drivers/net/wireless/libertas/scan.c
@@ -12,18 +12,19 @@
 #include <net/lib80211.h>
 
 #include "host.h"
-#include "decl.h"
 #include "dev.h"
 #include "scan.h"
+#include "assoc.h"
+#include "wext.h"
 #include "cmd.h"
 
 //! Approximate amount of data needed to pass a scan result back to iwlist
 #define MAX_SCAN_CELL_SIZE  (IW_EV_ADDR_LEN             \
-                             + IW_ESSID_MAX_SIZE        \
+                             + IEEE80211_MAX_SSID_LEN   \
                              + IW_EV_UINT_LEN           \
                              + IW_EV_FREQ_LEN           \
                              + IW_EV_QUAL_LEN           \
-                             + IW_ESSID_MAX_SIZE        \
+                             + IEEE80211_MAX_SSID_LEN   \
                              + IW_EV_PARAM_LEN          \
                              + 40)      /* 40 for WPAIE */
 
@@ -121,6 +122,189 @@ static inline int is_same_network(struct bss_descriptor *src,
 
 
 
+/*********************************************************************/
+/*                                                                   */
+/* Region channel support                                            */
+/*                                                                   */
+/*********************************************************************/
+
+#define LBS_TX_PWR_DEFAULT              20      /*100mW */
+#define LBS_TX_PWR_US_DEFAULT           20      /*100mW */
+#define LBS_TX_PWR_JP_DEFAULT           16      /*50mW */
+#define LBS_TX_PWR_FR_DEFAULT           20      /*100mW */
+#define LBS_TX_PWR_EMEA_DEFAULT 20      /*100mW */
+
+/* Format { channel, frequency (MHz), maxtxpower } */
+/* band: 'B/G', region: USA FCC/Canada IC */
+static struct chan_freq_power channel_freq_power_US_BG[] = {
+        {1, 2412, LBS_TX_PWR_US_DEFAULT},
+        {2, 2417, LBS_TX_PWR_US_DEFAULT},
+        {3, 2422, LBS_TX_PWR_US_DEFAULT},
+        {4, 2427, LBS_TX_PWR_US_DEFAULT},
+        {5, 2432, LBS_TX_PWR_US_DEFAULT},
+        {6, 2437, LBS_TX_PWR_US_DEFAULT},
+        {7, 2442, LBS_TX_PWR_US_DEFAULT},
+        {8, 2447, LBS_TX_PWR_US_DEFAULT},
+        {9, 2452, LBS_TX_PWR_US_DEFAULT},
+        {10, 2457, LBS_TX_PWR_US_DEFAULT},
+        {11, 2462, LBS_TX_PWR_US_DEFAULT}
+};
+
+/* band: 'B/G', region: Europe ETSI */
+static struct chan_freq_power channel_freq_power_EU_BG[] = {
+        {1, 2412, LBS_TX_PWR_EMEA_DEFAULT},
+        {2, 2417, LBS_TX_PWR_EMEA_DEFAULT},
+        {3, 2422, LBS_TX_PWR_EMEA_DEFAULT},
+        {4, 2427, LBS_TX_PWR_EMEA_DEFAULT},
+        {5, 2432, LBS_TX_PWR_EMEA_DEFAULT},
+        {6, 2437, LBS_TX_PWR_EMEA_DEFAULT},
+        {7, 2442, LBS_TX_PWR_EMEA_DEFAULT},
+        {8, 2447, LBS_TX_PWR_EMEA_DEFAULT},
+        {9, 2452, LBS_TX_PWR_EMEA_DEFAULT},
+        {10, 2457, LBS_TX_PWR_EMEA_DEFAULT},
+        {11, 2462, LBS_TX_PWR_EMEA_DEFAULT},
+        {12, 2467, LBS_TX_PWR_EMEA_DEFAULT},
+        {13, 2472, LBS_TX_PWR_EMEA_DEFAULT}
+};
+
+/* band: 'B/G', region: Spain */
+static struct chan_freq_power channel_freq_power_SPN_BG[] = {
+        {10, 2457, LBS_TX_PWR_DEFAULT},
+        {11, 2462, LBS_TX_PWR_DEFAULT}
+};
+
+/* band: 'B/G', region: France */
+static struct chan_freq_power channel_freq_power_FR_BG[] = {
+        {10, 2457, LBS_TX_PWR_FR_DEFAULT},
+        {11, 2462, LBS_TX_PWR_FR_DEFAULT},
+        {12, 2467, LBS_TX_PWR_FR_DEFAULT},
+        {13, 2472, LBS_TX_PWR_FR_DEFAULT}
+};
+
+/* band: 'B/G', region: Japan */
+static struct chan_freq_power channel_freq_power_JPN_BG[] = {
+        {1, 2412, LBS_TX_PWR_JP_DEFAULT},
+        {2, 2417, LBS_TX_PWR_JP_DEFAULT},
+        {3, 2422, LBS_TX_PWR_JP_DEFAULT},
+        {4, 2427, LBS_TX_PWR_JP_DEFAULT},
+        {5, 2432, LBS_TX_PWR_JP_DEFAULT},
+        {6, 2437, LBS_TX_PWR_JP_DEFAULT},
+        {7, 2442, LBS_TX_PWR_JP_DEFAULT},
+        {8, 2447, LBS_TX_PWR_JP_DEFAULT},
+        {9, 2452, LBS_TX_PWR_JP_DEFAULT},
+        {10, 2457, LBS_TX_PWR_JP_DEFAULT},
+        {11, 2462, LBS_TX_PWR_JP_DEFAULT},
+        {12, 2467, LBS_TX_PWR_JP_DEFAULT},
+        {13, 2472, LBS_TX_PWR_JP_DEFAULT},
+        {14, 2484, LBS_TX_PWR_JP_DEFAULT}
+};
+
+/**
+ * the structure for channel, frequency and power
+ */
+struct region_cfp_table {
+        u8 region;
+        struct chan_freq_power *cfp_BG;
+        int cfp_no_BG;
+};
+
+/**
+ * the structure for the mapping between region and CFP
+ */
+static struct region_cfp_table region_cfp_table[] = {
+        {0x10,                  /*US FCC */
+         channel_freq_power_US_BG,
+         ARRAY_SIZE(channel_freq_power_US_BG),
+         }
+        ,
+        {0x20,                  /*CANADA IC */
+         channel_freq_power_US_BG,
+         ARRAY_SIZE(channel_freq_power_US_BG),
+         }
+        ,
+        {0x30, /*EU*/ channel_freq_power_EU_BG,
+         ARRAY_SIZE(channel_freq_power_EU_BG),
+         }
+        ,
+        {0x31, /*SPAIN*/ channel_freq_power_SPN_BG,
+         ARRAY_SIZE(channel_freq_power_SPN_BG),
+         }
+        ,
+        {0x32, /*FRANCE*/ channel_freq_power_FR_BG,
+         ARRAY_SIZE(channel_freq_power_FR_BG),
+         }
+        ,
+        {0x40, /*JAPAN*/ channel_freq_power_JPN_BG,
+         ARRAY_SIZE(channel_freq_power_JPN_BG),
+         }
+        ,
+/*Add new region here */
+};
+
+/**
+ *  @brief This function finds the CFP in
+ *  region_cfp_table based on region and band parameter.
+ *
+ *  @param region  The region code
+ *  @param band    The band
+ *  @param cfp_no  A pointer to CFP number
+ *  @return        A pointer to CFP
+ */
+static struct chan_freq_power *lbs_get_region_cfp_table(u8 region, int *cfp_no)
+{
+        int i, end;
+
+        lbs_deb_enter(LBS_DEB_MAIN);
+
+        end = ARRAY_SIZE(region_cfp_table);
+
+        for (i = 0; i < end ; i++) {
+                lbs_deb_main("region_cfp_table[i].region=%d\n",
+                        region_cfp_table[i].region);
+                if (region_cfp_table[i].region == region) {
+                        *cfp_no = region_cfp_table[i].cfp_no_BG;
+                        lbs_deb_leave(LBS_DEB_MAIN);
+                        return region_cfp_table[i].cfp_BG;
+                }
+        }
+
+        lbs_deb_leave_args(LBS_DEB_MAIN, "ret NULL");
+        return NULL;
+}
+
+int lbs_set_regiontable(struct lbs_private *priv, u8 region, u8 band)
+{
+        int ret = 0;
+        int i = 0;
+
+        struct chan_freq_power *cfp;
+        int cfp_no;
+
+        lbs_deb_enter(LBS_DEB_MAIN);
+
+        memset(priv->region_channel, 0, sizeof(priv->region_channel));
+
+        cfp = lbs_get_region_cfp_table(region, &cfp_no);
+        if (cfp != NULL) {
+                priv->region_channel[i].nrcfp = cfp_no;
+                priv->region_channel[i].CFP = cfp;
+        } else {
+                lbs_deb_main("wrong region code %#x in band B/G\n",
+                       region);
+                ret = -1;
+                goto out;
+        }
+        priv->region_channel[i].valid = 1;
+        priv->region_channel[i].region = region;
+        priv->region_channel[i].band = band;
+        i++;
+out:
+        lbs_deb_leave_args(LBS_DEB_MAIN, "ret %d", ret);
+        return ret;
+}
+
+
+
 
 /*********************************************************************/
 /*                                                                   */
@@ -161,31 +345,15 @@ static int lbs_scan_create_channel_list(struct lbs_private *priv,
         scantype = CMD_SCAN_TYPE_ACTIVE;
 
         for (rgnidx = 0; rgnidx < ARRAY_SIZE(priv->region_channel); rgnidx++) {
-                if (priv->enable11d && (priv->connect_status != LBS_CONNECTED)
-                    && (priv->mesh_connect_status != LBS_CONNECTED)) {
-                        /* Scan all the supported chan for the first scan */
-                        if (!priv->universal_channel[rgnidx].valid)
-                                continue;
-                        scanregion = &priv->universal_channel[rgnidx];
-
-                        /* clear the parsed_region_chan for the first scan */
-                        memset(&priv->parsed_region_chan, 0x00,
-                               sizeof(priv->parsed_region_chan));
-                } else {
-                        if (!priv->region_channel[rgnidx].valid)
-                                continue;
-                        scanregion = &priv->region_channel[rgnidx];
-                }
+                if (!priv->region_channel[rgnidx].valid)
+                        continue;
+                scanregion = &priv->region_channel[rgnidx];
 
                 for (nextchan = 0; nextchan < scanregion->nrcfp; nextchan++, chanidx++) {
                         struct chanscanparamset *chan = &scanchanlist[chanidx];
 
                         cfp = scanregion->CFP + nextchan;
 
-                        if (priv->enable11d)
-                                scantype = lbs_get_scan_type_11d(cfp->channel,
-                                                                 &priv->parsed_region_chan);
-
                         if (scanregion->band == BAND_B || scanregion->band == BAND_G)
                                 chan->radiotype = CMD_SCAN_RADIO_TYPE_BG;
 
@@ -519,7 +687,6 @@ static int lbs_process_bss(struct bss_descriptor *bss,
         struct ieee_ie_cf_param_set *cf;
         struct ieee_ie_ibss_param_set *ibss;
         DECLARE_SSID_BUF(ssid);
-        struct ieee_ie_country_info_set *pcountryinfo;
         uint8_t *pos, *end, *p;
         uint8_t n_ex_rates = 0, got_basic_rates = 0, n_basic_rates = 0;
         uint16_t beaconsize = 0;
@@ -642,26 +809,6 @@ static int lbs_process_bss(struct bss_descriptor *bss,
                         lbs_deb_scan("got IBSS IE\n");
                         break;
 
-                case WLAN_EID_COUNTRY:
-                        pcountryinfo = (struct ieee_ie_country_info_set *) pos;
-                        lbs_deb_scan("got COUNTRY IE\n");
-                        if (pcountryinfo->header.len < sizeof(pcountryinfo->countrycode)
-                            || pcountryinfo->header.len > 254) {
-                                lbs_deb_scan("%s: 11D- Err CountryInfo len %d, min %zd, max 254\n",
-                                             __func__,
-                                             pcountryinfo->header.len,
-                                             sizeof(pcountryinfo->countrycode));
-                                ret = -1;
-                                goto done;
-                        }
-
-                        memcpy(&bss->countryinfo, pcountryinfo,
-                                pcountryinfo->header.len + 2);
-                        lbs_deb_hex(LBS_DEB_SCAN, "process_bss: 11d countryinfo",
-                                    (uint8_t *) pcountryinfo,
-                                    (int) (pcountryinfo->header.len + 2));
-                        break;
-
                 case WLAN_EID_EXT_SUPP_RATES:
                         /* only process extended supported rate if data rate is
                          * already found. Data rate IE should come before
@@ -812,7 +959,7 @@ static inline char *lbs_translate_scan(struct lbs_private *priv,
         /* SSID */
         iwe.cmd = SIOCGIWESSID;
         iwe.u.data.flags = 1;
-        iwe.u.data.length = min((uint32_t) bss->ssid_len, (uint32_t) IW_ESSID_MAX_SIZE);
+        iwe.u.data.length = min((uint32_t) bss->ssid_len, (uint32_t) IEEE80211_MAX_SSID_LEN);
         start = iwe_stream_add_point(info, start, stop, &iwe, bss->ssid);
 
         /* Mode */
@@ -1022,9 +1169,12 @@ int lbs_get_scan(struct net_device *dev, struct iw_request_info *info,
                 return -EAGAIN;
 
         /* Update RSSI if current BSS is a locally created ad-hoc BSS */
-        if ((priv->mode == IW_MODE_ADHOC) && priv->adhoccreate)
-                lbs_prepare_and_send_command(priv, CMD_802_11_RSSI, 0,
-                                             CMD_OPTION_WAITFORRSP, 0, NULL);
+        if ((priv->mode == IW_MODE_ADHOC) && priv->adhoccreate) {
+                err = lbs_prepare_and_send_command(priv, CMD_802_11_RSSI, 0,
+                                CMD_OPTION_WAITFORRSP, 0, NULL);
+                if (err)
+                        goto out;
+        }
 
         mutex_lock(&priv->lock);
         list_for_each_entry_safe (iter_bss, safe, &priv->network_list, list) {
@@ -1058,7 +1208,7 @@ int lbs_get_scan(struct net_device *dev, struct iw_request_info *info,
 
         dwrq->length = (ev - extra);
         dwrq->flags = 0;
-
+out:
         lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", err);
         return err;
 }
@@ -1141,11 +1291,11 @@ static int lbs_ret_80211_scan(struct lbs_private *priv, unsigned long dummy,
         /* The size of the TLV buffer is equal to the entire command response
          *   size (scanrespsize) minus the fixed fields (sizeof()'s), the
          *   BSS Descriptions (bssdescriptsize as bytesLef) and the command
-         *   response header (S_DS_GEN)
+         *   response header (sizeof(struct cmd_header))
          */
         tlvbufsize = scanrespsize - (bytesleft + sizeof(scanresp->bssdescriptsize)
                                      + sizeof(scanresp->nr_sets)
-                                     + S_DS_GEN);
+                                     + sizeof(struct cmd_header));
 
         /*
          *  Process each scan response returned (scanresp->nr_sets). Save
diff --git a/drivers/net/wireless/libertas/scan.h b/drivers/net/wireless/libertas/scan.h
index fab7d5d097fc..8fb1706d7526 100644
--- a/drivers/net/wireless/libertas/scan.h
+++ b/drivers/net/wireless/libertas/scan.h
@@ -9,8 +9,36 @@
 
 #include <net/iw_handler.h>
 
+struct lbs_private;
+
 #define MAX_NETWORK_COUNT 128
 
+/** Chan-freq-TxPower mapping table*/
+struct chan_freq_power {
+        /** channel Number              */
+        u16 channel;
+        /** frequency of this channel   */
+        u32 freq;
+        /** Max allowed Tx power level  */
+        u16 maxtxpower;
+        /** TRUE:channel unsupported;  FLASE:supported*/
+        u8 unsupported;
+};
+
+/** region-band mapping table*/
+struct region_channel {
+        /** TRUE if this entry is valid              */
+        u8 valid;
+        /** region code for US, Japan ...            */
+        u8 region;
+        /** band B/G/A, used for BAND_CONFIG cmd             */
+        u8 band;
+        /** Actual No. of elements in the array below */
+        u8 nrcfp;
+        /** chan-freq-txpower mapping table*/
+        struct chan_freq_power *CFP;
+};
+
 /**
  *  @brief Maximum number of channels that can be sent in a setuserscan ioctl
  */
@@ -18,6 +46,8 @@
 
 int lbs_ssid_cmp(u8 *ssid1, u8 ssid1_len, u8 *ssid2, u8 ssid2_len);
 
+int lbs_set_regiontable(struct lbs_private *priv, u8 region, u8 band);
+
 int lbs_send_specific_ssid_scan(struct lbs_private *priv, u8 *ssid,
                                 u8 ssid_len);
 
diff --git a/drivers/net/wireless/libertas/tx.c b/drivers/net/wireless/libertas/tx.c
index 4c018f7a0a8d..5d7c011fe296 100644
--- a/drivers/net/wireless/libertas/tx.c
+++ b/drivers/net/wireless/libertas/tx.c
@@ -4,7 +4,7 @@
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 
-#include "hostcmd.h"
+#include "host.h"
 #include "radiotap.h"
 #include "decl.h"
 #include "defs.h"
diff --git a/drivers/net/wireless/libertas/types.h b/drivers/net/wireless/libertas/types.h
index 99905df65b25..3e72c86ceca8 100644
--- a/drivers/net/wireless/libertas/types.h
+++ b/drivers/net/wireless/libertas/types.h
@@ -5,8 +5,8 @@
 #define _LBS_TYPES_H_
 
 #include <linux/if_ether.h>
+#include <linux/ieee80211.h>
 #include <asm/byteorder.h>
-#include <linux/wireless.h>
 
 struct ieee_ie_header {
         u8 id;
@@ -247,7 +247,7 @@ struct mrvl_meshie_val {
         uint8_t active_metric_id;
         uint8_t mesh_capability;
         uint8_t mesh_id_len;
-        uint8_t mesh_id[IW_ESSID_MAX_SIZE];
+        uint8_t mesh_id[IEEE80211_MAX_SSID_LEN];
 } __attribute__ ((packed));
 
 struct mrvl_meshie {
diff --git a/drivers/net/wireless/libertas/wext.c b/drivers/net/wireless/libertas/wext.c
index 69dd19bf9558..a8eb9e1fcf36 100644
--- a/drivers/net/wireless/libertas/wext.c
+++ b/drivers/net/wireless/libertas/wext.c
@@ -45,6 +45,64 @@ static inline void lbs_cancel_association_work(struct lbs_private *priv)
         priv->pending_assoc_req = NULL;
 }
 
+void lbs_send_disconnect_notification(struct lbs_private *priv)
+{
+        union iwreq_data wrqu;
+
+        memset(wrqu.ap_addr.sa_data, 0x00, ETH_ALEN);
+        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+        wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
+}
+
+static void lbs_send_iwevcustom_event(struct lbs_private *priv, s8 *str)
+{
+        union iwreq_data iwrq;
+        u8 buf[50];
+
+        lbs_deb_enter(LBS_DEB_WEXT);
+
+        memset(&iwrq, 0, sizeof(union iwreq_data));
+        memset(buf, 0, sizeof(buf));
+
+        snprintf(buf, sizeof(buf) - 1, "%s", str);
+
+        iwrq.data.length = strlen(buf) + 1 + IW_EV_LCP_LEN;
+
+        /* Send Event to upper layer */
+        lbs_deb_wext("event indication string %s\n", (char *)buf);
+        lbs_deb_wext("event indication length %d\n", iwrq.data.length);
+        lbs_deb_wext("sending wireless event IWEVCUSTOM for %s\n", str);
+
+        wireless_send_event(priv->dev, IWEVCUSTOM, &iwrq, buf);
+
+        lbs_deb_leave(LBS_DEB_WEXT);
+}
+
+/**
+ *  @brief This function handles MIC failure event.
+ *
+ *  @param priv    A pointer to struct lbs_private structure
+ *  @para  event   the event id
+ *  @return        n/a
+ */
+void lbs_send_mic_failureevent(struct lbs_private *priv, u32 event)
+{
+        char buf[50];
+
+        lbs_deb_enter(LBS_DEB_CMD);
+        memset(buf, 0, sizeof(buf));
+
+        sprintf(buf, "%s", "MLME-MICHAELMICFAILURE.indication ");
+
+        if (event == MACREG_INT_CODE_MIC_ERR_UNICAST)
+                strcat(buf, "unicast ");
+        else
+                strcat(buf, "multicast ");
+
+        lbs_send_iwevcustom_event(priv, buf);
+        lbs_deb_leave(LBS_DEB_CMD);
+}
+
 /**
  *  @brief Find the channel frequency power info with specific channel
  *
@@ -65,8 +123,6 @@ struct chan_freq_power *lbs_find_cfp_by_band_and_channel(
         for (j = 0; !cfp && (j < ARRAY_SIZE(priv->region_channel)); j++) {
                 rc = &priv->region_channel[j];
 
-                if (priv->enable11d)
-                        rc = &priv->universal_channel[j];
                 if (!rc->valid || !rc->CFP)
                         continue;
                 if (rc->band != band)
@@ -106,8 +162,6 @@ static struct chan_freq_power *find_cfp_by_band_and_freq(
         for (j = 0; !cfp && (j < ARRAY_SIZE(priv->region_channel)); j++) {
                 rc = &priv->region_channel[j];
 
-                if (priv->enable11d)
-                        rc = &priv->universal_channel[j];
                 if (!rc->valid || !rc->CFP)
                         continue;
                 if (rc->band != band)
@@ -168,12 +222,12 @@ static int lbs_get_freq(struct net_device *dev, struct iw_request_info *info,
         lbs_deb_enter(LBS_DEB_WEXT);
 
         cfp = lbs_find_cfp_by_band_and_channel(priv, 0,
-                                           priv->curbssparams.channel);
+                                           priv->channel);
 
         if (!cfp) {
-                if (priv->curbssparams.channel)
+                if (priv->channel)
                         lbs_deb_wext("invalid channel %d\n",
-                               priv->curbssparams.channel);
+                               priv->channel);
                 return -EINVAL;
         }
 
@@ -546,8 +600,6 @@ static int lbs_get_range(struct net_device *dev, struct iw_request_info *info,
         struct chan_freq_power *cfp;
         u8 rates[MAX_RATES + 1];
 
-        u8 flag = 0;
-
         lbs_deb_enter(LBS_DEB_WEXT);
 
         dwrq->length = sizeof(struct iw_range);
@@ -569,52 +621,21 @@ static int lbs_get_range(struct net_device *dev, struct iw_request_info *info,
 
         range->scan_capa = IW_SCAN_CAPA_ESSID;
 
-        if (priv->enable11d &&
-            (priv->connect_status == LBS_CONNECTED ||
-            priv->mesh_connect_status == LBS_CONNECTED)) {
-                u8 chan_no;
-                u8 band;
-
-                struct parsed_region_chan_11d *parsed_region_chan =
-                    &priv->parsed_region_chan;
-
-                if (parsed_region_chan == NULL) {
-                        lbs_deb_wext("11d: parsed_region_chan is NULL\n");
-                        goto out;
-                }
-                band = parsed_region_chan->band;
-                lbs_deb_wext("band %d, nr_char %d\n", band,
-                       parsed_region_chan->nr_chan);
-
+        for (j = 0; (range->num_frequency < IW_MAX_FREQUENCIES)
+             && (j < ARRAY_SIZE(priv->region_channel)); j++) {
+                cfp = priv->region_channel[j].CFP;
                 for (i = 0; (range->num_frequency < IW_MAX_FREQUENCIES)
-                     && (i < parsed_region_chan->nr_chan); i++) {
-                        chan_no = parsed_region_chan->chanpwr[i].chan;
-                        lbs_deb_wext("chan_no %d\n", chan_no);
-                        range->freq[range->num_frequency].i = (long)chan_no;
+                     && priv->region_channel[j].valid
+                     && cfp
+                     && (i < priv->region_channel[j].nrcfp); i++) {
+                        range->freq[range->num_frequency].i =
+                            (long)cfp->channel;
                         range->freq[range->num_frequency].m =
-                            (long)lbs_chan_2_freq(chan_no) * 100000;
+                            (long)cfp->freq * 100000;
                         range->freq[range->num_frequency].e = 1;
+                        cfp++;
                         range->num_frequency++;
                 }
-                flag = 1;
-        }
-        if (!flag) {
-                for (j = 0; (range->num_frequency < IW_MAX_FREQUENCIES)
-                     && (j < ARRAY_SIZE(priv->region_channel)); j++) {
-                        cfp = priv->region_channel[j].CFP;
-                        for (i = 0; (range->num_frequency < IW_MAX_FREQUENCIES)
-                             && priv->region_channel[j].valid
-                             && cfp
-                             && (i < priv->region_channel[j].nrcfp); i++) {
-                                range->freq[range->num_frequency].i =
-                                    (long)cfp->channel;
-                                range->freq[range->num_frequency].m =
-                                    (long)cfp->freq * 100000;
-                                range->freq[range->num_frequency].e = 1;
-                                cfp++;
-                                range->num_frequency++;
-                        }
-                }
         }
 
         lbs_deb_wext("IW_MAX_FREQUENCIES %d, num_frequency %d\n",
@@ -699,7 +720,6 @@ static int lbs_get_range(struct net_device *dev, struct iw_request_info *info,
                                   | IW_ENC_CAPA_CIPHER_CCMP;
         }
 
-out:
         lbs_deb_leave(LBS_DEB_WEXT);
         return 0;
 }
@@ -832,7 +852,7 @@ static struct iw_statistics *lbs_get_wireless_stats(struct net_device *dev)
         u32 rssi_qual;
         u32 tx_qual;
         u32 quality = 0;
-        int stats_valid = 0;
+        int ret, stats_valid = 0;
         u8 rssi;
         u32 tx_retries;
         struct cmd_ds_802_11_get_log log;
@@ -881,7 +901,9 @@ static struct iw_statistics *lbs_get_wireless_stats(struct net_device *dev)
 
         memset(&log, 0, sizeof(log));
         log.hdr.size = cpu_to_le16(sizeof(log));
-        lbs_cmd_with_response(priv, CMD_802_11_GET_LOG, &log);
+        ret = lbs_cmd_with_response(priv, CMD_802_11_GET_LOG, &log);
+        if (ret)
+                goto out;
 
         tx_retries = le32_to_cpu(log.retry);
 
@@ -909,8 +931,10 @@ static struct iw_statistics *lbs_get_wireless_stats(struct net_device *dev)
         stats_valid = 1;
 
         /* update stats asynchronously for future calls */
-        lbs_prepare_and_send_command(priv, CMD_802_11_RSSI, 0,
+        ret = lbs_prepare_and_send_command(priv, CMD_802_11_RSSI, 0,
                                         0, 0, NULL);
+        if (ret)
+                lbs_pr_err("RSSI command failed\n");
 out:
         if (!stats_valid) {
                 priv->wstats.miss.beacon = 0;
@@ -1020,7 +1044,7 @@ static int lbs_mesh_set_freq(struct net_device *dev,
                 goto out;
         }
 
-        if (fwrq->m != priv->curbssparams.channel) {
+        if (fwrq->m != priv->channel) {
                 lbs_deb_wext("mesh channel change forces eth disconnect\n");
                 if (priv->mode == IW_MODE_INFRA)
                         lbs_cmd_80211_deauthenticate(priv,
@@ -2023,7 +2047,7 @@ static int lbs_set_essid(struct net_device *dev, struct iw_request_info *info,
 {
         struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
-        u8 ssid[IW_ESSID_MAX_SIZE];
+        u8 ssid[IEEE80211_MAX_SSID_LEN];
         u8 ssid_len = 0;
         struct assoc_request * assoc_req;
         int in_ssid_len = dwrq->length;
@@ -2037,7 +2061,7 @@ static int lbs_set_essid(struct net_device *dev, struct iw_request_info *info,
         }
 
         /* Check the size of the string */
-        if (in_ssid_len > IW_ESSID_MAX_SIZE) {
+        if (in_ssid_len > IEEE80211_MAX_SSID_LEN) {
                 ret = -E2BIG;
                 goto out;
         }
@@ -2068,7 +2092,7 @@ out:
                         ret = -ENOMEM;
                 } else {
                         /* Copy the SSID to the association request */
-                        memcpy(&assoc_req->ssid, &ssid, IW_ESSID_MAX_SIZE);
+                        memcpy(&assoc_req->ssid, &ssid, IEEE80211_MAX_SSID_LEN);
                         assoc_req->ssid_len = ssid_len;
                         set_bit(ASSOC_FLAG_SSID, &assoc_req->flags);
                         lbs_postpone_association_work(priv);
@@ -2119,7 +2143,7 @@ static int lbs_mesh_set_essid(struct net_device *dev,
         }
 
         /* Check the size of the string */
-        if (dwrq->length > IW_ESSID_MAX_SIZE) {
+        if (dwrq->length > IEEE80211_MAX_SSID_LEN) {
                 ret = -E2BIG;
                 goto out;
         }
@@ -2134,7 +2158,7 @@ static int lbs_mesh_set_essid(struct net_device *dev,
         }
 
         lbs_mesh_config(priv, CMD_ACT_MESH_CONFIG_START,
-                        priv->curbssparams.channel);
+                        priv->channel);
  out:
         lbs_deb_leave_args(LBS_DEB_WEXT, "ret %d", ret);
         return ret;
diff --git a/drivers/net/wireless/libertas/wext.h b/drivers/net/wireless/libertas/wext.h
index 4c08db497606..7863baf7d234 100644
--- a/drivers/net/wireless/libertas/wext.h
+++ b/drivers/net/wireless/libertas/wext.h
@@ -4,7 +4,15 @@
 #ifndef _LBS_WEXT_H_
 #define _LBS_WEXT_H_
 
+void lbs_send_disconnect_notification(struct lbs_private *priv);
+void lbs_send_mic_failureevent(struct lbs_private *priv, u32 event);
+
 extern struct iw_handler_def lbs_handler_def;
 extern struct iw_handler_def mesh_handler_def;
 
+struct chan_freq_power *lbs_find_cfp_by_band_and_channel(
+        struct lbs_private *priv,
+        u8 band,
+        u16 channel);
+
 #endif
diff --git a/drivers/net/wireless/orinoco/hw.c b/drivers/net/wireless/orinoco/hw.c
index 359652d35e63..404830f47ab2 100644
--- a/drivers/net/wireless/orinoco/hw.c
+++ b/drivers/net/wireless/orinoco/hw.c
@@ -60,8 +60,15 @@ static inline fwtype_t determine_firmware_type(struct comp_id *nic_id)
 /* Set priv->firmware type, determine firmware properties
  * This function can be called before we have registerred with netdev,
  * so all errors go out with dev_* rather than printk
+ *
+ * If non-NULL stores a firmware description in fw_name.
+ * If non-NULL stores a HW version in hw_ver
+ *
+ * These are output via generic cfg80211 ethtool support.
  */
-int determine_fw_capabilities(struct orinoco_private *priv)
+int determine_fw_capabilities(struct orinoco_private *priv,
+                              char *fw_name, size_t fw_name_len,
+                              u32 *hw_ver)
 {
         struct device *dev = priv->dev;
         hermes_t *hw = &priv->hw;
@@ -85,6 +92,12 @@ int determine_fw_capabilities(struct orinoco_private *priv)
         dev_info(dev, "Hardware identity %04x:%04x:%04x:%04x\n",
                  nic_id.id, nic_id.variant, nic_id.major, nic_id.minor);
 
+        if (hw_ver)
+                *hw_ver = (((nic_id.id & 0xff) << 24) |
+                           ((nic_id.variant & 0xff) << 16) |
+                           ((nic_id.major & 0xff) << 8) |
+                           (nic_id.minor & 0xff));
+
         priv->firmware_type = determine_firmware_type(&nic_id);
 
         /* Get the firmware version */
@@ -135,8 +148,9 @@ int determine_fw_capabilities(struct orinoco_private *priv)
         case FIRMWARE_TYPE_AGERE:
                 /* Lucent Wavelan IEEE, Lucent Orinoco, Cabletron RoamAbout,
                    ELSA, Melco, HP, IBM, Dell 1150, Compaq 110/210 */
-                snprintf(priv->fw_name, sizeof(priv->fw_name) - 1,
-                         "Lucent/Agere %d.%02d", sta_id.major, sta_id.minor);
+                if (fw_name)
+                        snprintf(fw_name, fw_name_len, "Lucent/Agere %d.%02d",
+                                 sta_id.major, sta_id.minor);
 
                 firmver = ((unsigned long)sta_id.major << 16) | sta_id.minor;
 
@@ -185,8 +199,8 @@ int determine_fw_capabilities(struct orinoco_private *priv)
                         tmp[SYMBOL_MAX_VER_LEN] = '\0';
                 }
 
-                snprintf(priv->fw_name, sizeof(priv->fw_name) - 1,
-                         "Symbol %s", tmp);
+                if (fw_name)
+                        snprintf(fw_name, fw_name_len, "Symbol %s", tmp);
 
                 priv->has_ibss = (firmver >= 0x20000);
                 priv->has_wep = (firmver >= 0x15012);
@@ -224,9 +238,9 @@ int determine_fw_capabilities(struct orinoco_private *priv)
                  * different and less well tested */
                 /* D-Link MAC : 00:40:05:* */
                 /* Addtron MAC : 00:90:D1:* */
-                snprintf(priv->fw_name, sizeof(priv->fw_name) - 1,
-                         "Intersil %d.%d.%d", sta_id.major, sta_id.minor,
-                         sta_id.variant);
+                if (fw_name)
+                        snprintf(fw_name, fw_name_len, "Intersil %d.%d.%d",
+                                 sta_id.major, sta_id.minor, sta_id.variant);
 
                 firmver = ((unsigned long)sta_id.major << 16) |
                         ((unsigned long)sta_id.minor << 8) | sta_id.variant;
@@ -245,7 +259,8 @@ int determine_fw_capabilities(struct orinoco_private *priv)
                 }
                 break;
         }
-        dev_info(dev, "Firmware determined as %s\n", priv->fw_name);
+        if (fw_name)
+                dev_info(dev, "Firmware determined as %s\n", fw_name);
 
         return 0;
 }
diff --git a/drivers/net/wireless/orinoco/hw.h b/drivers/net/wireless/orinoco/hw.h
index 8df6e8752be6..e2f7fdc4d45a 100644
--- a/drivers/net/wireless/orinoco/hw.h
+++ b/drivers/net/wireless/orinoco/hw.h
@@ -24,7 +24,8 @@
 struct orinoco_private;
 struct dev_addr_list;
 
-int determine_fw_capabilities(struct orinoco_private *priv);
+int determine_fw_capabilities(struct orinoco_private *priv, char *fw_name,
+                              size_t fw_name_len, u32 *hw_ver);
 int orinoco_hw_read_card_settings(struct orinoco_private *priv, u8 *dev_addr);
 int orinoco_hw_allocate_fid(struct orinoco_private *priv);
 int orinoco_get_bitratemode(int bitrate, int automatic);
diff --git a/drivers/net/wireless/orinoco/main.c b/drivers/net/wireless/orinoco/main.c
index 5fdc59c594f2..753a1804eee7 100644
--- a/drivers/net/wireless/orinoco/main.c
+++ b/drivers/net/wireless/orinoco/main.c
@@ -83,7 +83,6 @@
 #include <linux/device.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
-#include <linux/ethtool.h>
 #include <linux/suspend.h>
 #include <linux/if_arp.h>
 #include <linux/wireless.h>
@@ -162,8 +161,6 @@ static const u8 encaps_hdr[] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
                                  | HERMES_EV_WTERR | HERMES_EV_INFO \
                                  | HERMES_EV_INFDROP)
 
-static const struct ethtool_ops orinoco_ethtool_ops;
-
 /********************************************************************/
 /* Data types                                                       */
 /********************************************************************/
@@ -1994,7 +1991,9 @@ int orinoco_init(struct orinoco_private *priv)
                 goto out;
         }
 
-        err = determine_fw_capabilities(priv);
+        err = determine_fw_capabilities(priv, wiphy->fw_version,
+                                        sizeof(wiphy->fw_version),
+                                        &wiphy->hw_version);
         if (err != 0) {
                 dev_err(dev, "Incompatible firmware, aborting\n");
                 goto out;
@@ -2010,7 +2009,9 @@ int orinoco_init(struct orinoco_private *priv)
                         priv->do_fw_download = 0;
 
                 /* Check firmware version again */
-                err = determine_fw_capabilities(priv);
+                err = determine_fw_capabilities(priv, wiphy->fw_version,
+                                                sizeof(wiphy->fw_version),
+                                                &wiphy->hw_version);
                 if (err != 0) {
                         dev_err(dev, "Incompatible firmware, aborting\n");
                         goto out;
@@ -2212,7 +2213,6 @@ int orinoco_if_add(struct orinoco_private *priv,
         dev->ieee80211_ptr = wdev;
         dev->netdev_ops = &orinoco_netdev_ops;
         dev->watchdog_timeo = HZ; /* 1 second timeout */
-        dev->ethtool_ops = &orinoco_ethtool_ops;
         dev->wireless_handlers = &orinoco_handler_def;
 #ifdef WIRELESS_SPY
         dev->wireless_data = &priv->wireless_data;
@@ -2349,27 +2349,6 @@ void orinoco_down(struct orinoco_private *priv)
 }
 EXPORT_SYMBOL(orinoco_down);
 
-static void orinoco_get_drvinfo(struct net_device *dev,
-                                struct ethtool_drvinfo *info)
-{
-        struct orinoco_private *priv = ndev_priv(dev);
-
-        strncpy(info->driver, DRIVER_NAME, sizeof(info->driver) - 1);
-        strncpy(info->version, DRIVER_VERSION, sizeof(info->version) - 1);
-        strncpy(info->fw_version, priv->fw_name, sizeof(info->fw_version) - 1);
-        if (dev->dev.parent)
-                strncpy(info->bus_info, dev_name(dev->dev.parent),
-                        sizeof(info->bus_info) - 1);
-        else
-                snprintf(info->bus_info, sizeof(info->bus_info) - 1,
-                         "PCMCIA %p", priv->hw.iobase);
-}
-
-static const struct ethtool_ops orinoco_ethtool_ops = {
-        .get_drvinfo = orinoco_get_drvinfo,
-        .get_link = ethtool_op_get_link,
-};
-
 /********************************************************************/
 /* Module initialization                                            */
 /********************************************************************/
diff --git a/drivers/net/wireless/orinoco/orinoco.h b/drivers/net/wireless/orinoco/orinoco.h
index 9ac6f1dda4b0..665ef56f8382 100644
--- a/drivers/net/wireless/orinoco/orinoco.h
+++ b/drivers/net/wireless/orinoco/orinoco.h
@@ -93,7 +93,6 @@ struct orinoco_private {
 
         /* Capabilities of the hardware/firmware */
         fwtype_t firmware_type;
-        char fw_name[32];
         int ibss_port;
         int nicbuf_size;
         u16 channel_mask;
diff --git a/drivers/net/wireless/rt2x00/Kconfig b/drivers/net/wireless/rt2x00/Kconfig
index ed1f997e3521..390c0c7b3ac2 100644
--- a/drivers/net/wireless/rt2x00/Kconfig
+++ b/drivers/net/wireless/rt2x00/Kconfig
@@ -53,6 +53,32 @@ config RT61PCI
 
           When compiled as a module, this driver will be called rt61pci.
 
+config RT2800PCI_PCI
+        tristate
+        depends on PCI
+        default y
+
+config RT2800PCI_SOC
+        tristate
+        depends on RALINK_RT288X || RALINK_RT305X
+        default y
+
+config RT2800PCI
+        tristate "Ralink rt2800 (PCI/PCMCIA) support"
+        depends on (RT2800PCI_PCI || RT2800PCI_SOC) && EXPERIMENTAL
+        select RT2X00_LIB_PCI if RT2800PCI_PCI
+        select RT2X00_LIB_SOC if RT2800PCI_SOC
+        select RT2X00_LIB_HT
+        select RT2X00_LIB_FIRMWARE
+        select RT2X00_LIB_CRYPTO
+        select CRC_CCITT
+        select EEPROM_93CX6
+        ---help---
+          This adds support for rt2800 wireless chipset family.
+          Supported chips: RT2760, RT2790, RT2860, RT2880, RT2890 & RT3052
+
+          When compiled as a module, this driver will be called "rt2800pci.ko".
+
 config RT2500USB
         tristate "Ralink rt2500 (USB) support"
         depends on USB
@@ -95,6 +121,10 @@ config RT2X00_LIB_PCI
         tristate
         select RT2X00_LIB
 
+config RT2X00_LIB_SOC
+        tristate
+        select RT2X00_LIB
+
 config RT2X00_LIB_USB
         tristate
         select RT2X00_LIB
diff --git a/drivers/net/wireless/rt2x00/Makefile b/drivers/net/wireless/rt2x00/Makefile
index 13043ea97667..912f5f67e159 100644
--- a/drivers/net/wireless/rt2x00/Makefile
+++ b/drivers/net/wireless/rt2x00/Makefile
@@ -11,10 +11,12 @@ rt2x00lib-$(CONFIG_RT2X00_LIB_HT)	+= rt2x00ht.o
 
 obj-$(CONFIG_RT2X00_LIB)                += rt2x00lib.o
 obj-$(CONFIG_RT2X00_LIB_PCI)            += rt2x00pci.o
+obj-$(CONFIG_RT2X00_LIB_SOC)            += rt2x00soc.o
 obj-$(CONFIG_RT2X00_LIB_USB)            += rt2x00usb.o
 obj-$(CONFIG_RT2400PCI)                 += rt2400pci.o
 obj-$(CONFIG_RT2500PCI)                 += rt2500pci.o
 obj-$(CONFIG_RT61PCI)                   += rt61pci.o
+obj-$(CONFIG_RT2800PCI)                 += rt2800pci.o
 obj-$(CONFIG_RT2500USB)                 += rt2500usb.o
 obj-$(CONFIG_RT73USB)                   += rt73usb.o
 obj-$(CONFIG_RT2800USB)                 += rt2800usb.o
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
new file mode 100644
index 000000000000..be81788b80c7
--- /dev/null
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -0,0 +1,3323 @@
+/*
+        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        <http://rt2x00.serialmonkey.com>
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the
+        Free Software Foundation, Inc.,
+        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/*
+        Module: rt2800pci
+        Abstract: rt2800pci device specific routines.
+        Supported chipsets: RT2800E & RT2800ED.
+ */
+
+#include <linux/crc-ccitt.h>
+#include <linux/delay.h>
+#include <linux/etherdevice.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/platform_device.h>
+#include <linux/eeprom_93cx6.h>
+
+#include "rt2x00.h"
+#include "rt2x00pci.h"
+#include "rt2x00soc.h"
+#include "rt2800pci.h"
+
+#ifdef CONFIG_RT2800PCI_PCI_MODULE
+#define CONFIG_RT2800PCI_PCI
+#endif
+
+#ifdef CONFIG_RT2800PCI_WISOC_MODULE
+#define CONFIG_RT2800PCI_WISOC
+#endif
+
+/*
+ * Allow hardware encryption to be disabled.
+ */
+static int modparam_nohwcrypt = 1;
+module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
+MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
+
+/*
+ * Register access.
+ * BBP and RF register require indirect register access,
+ * and use the CSR registers PHY_CSR3 and PHY_CSR4 to achieve this.
+ * These indirect registers work with busy bits,
+ * and we will try maximal REGISTER_BUSY_COUNT times to access
+ * the register while taking a REGISTER_BUSY_DELAY us delay
+ * between each attampt. When the busy bit is still set at that time,
+ * the access attempt is considered to have failed,
+ * and we will print an error.
+ */
+#define WAIT_FOR_BBP(__dev, __reg) \
+        rt2x00pci_regbusy_read((__dev), BBP_CSR_CFG, BBP_CSR_CFG_BUSY, (__reg))
+#define WAIT_FOR_RFCSR(__dev, __reg) \
+        rt2x00pci_regbusy_read((__dev), RF_CSR_CFG, RF_CSR_CFG_BUSY, (__reg))
+#define WAIT_FOR_RF(__dev, __reg) \
+        rt2x00pci_regbusy_read((__dev), RF_CSR_CFG0, RF_CSR_CFG0_BUSY, (__reg))
+#define WAIT_FOR_MCU(__dev, __reg) \
+        rt2x00pci_regbusy_read((__dev), H2M_MAILBOX_CSR, \
+                               H2M_MAILBOX_CSR_OWNER, (__reg))
+
+static void rt2800pci_bbp_write(struct rt2x00_dev *rt2x00dev,
+                                const unsigned int word, const u8 value)
+{
+        u32 reg;
+
+        mutex_lock(&rt2x00dev->csr_mutex);
+
+        /*
+         * Wait until the BBP becomes available, afterwards we
+         * can safely write the new data into the register.
+         */
+        if (WAIT_FOR_BBP(rt2x00dev, &reg)) {
+                reg = 0;
+                rt2x00_set_field32(&reg, BBP_CSR_CFG_VALUE, value);
+                rt2x00_set_field32(&reg, BBP_CSR_CFG_REGNUM, word);
+                rt2x00_set_field32(&reg, BBP_CSR_CFG_BUSY, 1);
+                rt2x00_set_field32(&reg, BBP_CSR_CFG_READ_CONTROL, 0);
+                rt2x00_set_field32(&reg, BBP_CSR_CFG_BBP_RW_MODE, 1);
+
+                rt2x00pci_register_write(rt2x00dev, BBP_CSR_CFG, reg);
+        }
+
+        mutex_unlock(&rt2x00dev->csr_mutex);
+}
+
+static void rt2800pci_bbp_read(struct rt2x00_dev *rt2x00dev,
+                               const unsigned int word, u8 *value)
+{
+        u32 reg;
+
+        mutex_lock(&rt2x00dev->csr_mutex);
+
+        /*
+         * Wait until the BBP becomes available, afterwards we
+         * can safely write the read request into the register.
+         * After the data has been written, we wait until hardware
+         * returns the correct value, if at any time the register
+         * doesn't become available in time, reg will be 0xffffffff
+         * which means we return 0xff to the caller.
+         */
+        if (WAIT_FOR_BBP(rt2x00dev, &reg)) {
+                reg = 0;
+                rt2x00_set_field32(&reg, BBP_CSR_CFG_REGNUM, word);
+                rt2x00_set_field32(&reg, BBP_CSR_CFG_BUSY, 1);
+                rt2x00_set_field32(&reg, BBP_CSR_CFG_READ_CONTROL, 1);
+                rt2x00_set_field32(&reg, BBP_CSR_CFG_BBP_RW_MODE, 1);
+
+                rt2x00pci_register_write(rt2x00dev, BBP_CSR_CFG, reg);
+
+                WAIT_FOR_BBP(rt2x00dev, &reg);
+        }
+
+        *value = rt2x00_get_field32(reg, BBP_CSR_CFG_VALUE);
+
+        mutex_unlock(&rt2x00dev->csr_mutex);
+}
+
+static void rt2800pci_rfcsr_write(struct rt2x00_dev *rt2x00dev,
+                                  const unsigned int word, const u8 value)
+{
+        u32 reg;
+
+        mutex_lock(&rt2x00dev->csr_mutex);
+
+        /*
+         * Wait until the RFCSR becomes available, afterwards we
+         * can safely write the new data into the register.
+         */
+        if (WAIT_FOR_RFCSR(rt2x00dev, &reg)) {
+                reg = 0;
+                rt2x00_set_field32(&reg, RF_CSR_CFG_DATA, value);
+                rt2x00_set_field32(&reg, RF_CSR_CFG_REGNUM, word);
+                rt2x00_set_field32(&reg, RF_CSR_CFG_WRITE, 1);
+                rt2x00_set_field32(&reg, RF_CSR_CFG_BUSY, 1);
+
+                rt2x00pci_register_write(rt2x00dev, RF_CSR_CFG, reg);
+        }
+
+        mutex_unlock(&rt2x00dev->csr_mutex);
+}
+
+static void rt2800pci_rfcsr_read(struct rt2x00_dev *rt2x00dev,
+                                 const unsigned int word, u8 *value)
+{
+        u32 reg;
+
+        mutex_lock(&rt2x00dev->csr_mutex);
+
+        /*
+         * Wait until the RFCSR becomes available, afterwards we
+         * can safely write the read request into the register.
+         * After the data has been written, we wait until hardware
+         * returns the correct value, if at any time the register
+         * doesn't become available in time, reg will be 0xffffffff
+         * which means we return 0xff to the caller.
+         */
+        if (WAIT_FOR_RFCSR(rt2x00dev, &reg)) {
+                reg = 0;
+                rt2x00_set_field32(&reg, RF_CSR_CFG_REGNUM, word);
+                rt2x00_set_field32(&reg, RF_CSR_CFG_WRITE, 0);
+                rt2x00_set_field32(&reg, RF_CSR_CFG_BUSY, 1);
+
+                rt2x00pci_register_write(rt2x00dev, RF_CSR_CFG, reg);
+
+                WAIT_FOR_RFCSR(rt2x00dev, &reg);
+        }
+
+        *value = rt2x00_get_field32(reg, RF_CSR_CFG_DATA);
+
+        mutex_unlock(&rt2x00dev->csr_mutex);
+}
+
+static void rt2800pci_rf_write(struct rt2x00_dev *rt2x00dev,
+                               const unsigned int word, const u32 value)
+{
+        u32 reg;
+
+        mutex_lock(&rt2x00dev->csr_mutex);
+
+        /*
+         * Wait until the RF becomes available, afterwards we
+         * can safely write the new data into the register.
+         */
+        if (WAIT_FOR_RF(rt2x00dev, &reg)) {
+                reg = 0;
+                rt2x00_set_field32(&reg, RF_CSR_CFG0_REG_VALUE_BW, value);
+                rt2x00_set_field32(&reg, RF_CSR_CFG0_STANDBYMODE, 0);
+                rt2x00_set_field32(&reg, RF_CSR_CFG0_SEL, 0);
+                rt2x00_set_field32(&reg, RF_CSR_CFG0_BUSY, 1);
+
+                rt2x00pci_register_write(rt2x00dev, RF_CSR_CFG0, reg);
+                rt2x00_rf_write(rt2x00dev, word, value);
+        }
+
+        mutex_unlock(&rt2x00dev->csr_mutex);
+}
+
+static void rt2800pci_mcu_request(struct rt2x00_dev *rt2x00dev,
+                                  const u8 command, const u8 token,
+                                  const u8 arg0, const u8 arg1)
+{
+        u32 reg;
+
+        /*
+         * RT2880 and RT3052 don't support MCU requests.
+         */
+        if (rt2x00_rt(&rt2x00dev->chip, RT2880) ||
+            rt2x00_rt(&rt2x00dev->chip, RT3052))
+                return;
+
+        mutex_lock(&rt2x00dev->csr_mutex);
+
+        /*
+         * Wait until the MCU becomes available, afterwards we
+         * can safely write the new data into the register.
+         */
+        if (WAIT_FOR_MCU(rt2x00dev, &reg)) {
+                rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_OWNER, 1);
+                rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_CMD_TOKEN, token);
+                rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_ARG0, arg0);
+                rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_ARG1, arg1);
+                rt2x00pci_register_write(rt2x00dev, H2M_MAILBOX_CSR, reg);
+
+                reg = 0;
+                rt2x00_set_field32(&reg, HOST_CMD_CSR_HOST_COMMAND, command);
+                rt2x00pci_register_write(rt2x00dev, HOST_CMD_CSR, reg);
+        }
+
+        mutex_unlock(&rt2x00dev->csr_mutex);
+}
+
+static void rt2800pci_mcu_status(struct rt2x00_dev *rt2x00dev, const u8 token)
+{
+        unsigned int i;
+        u32 reg;
+
+        for (i = 0; i < 200; i++) {
+                rt2x00pci_register_read(rt2x00dev, H2M_MAILBOX_CID, &reg);
+
+                if ((rt2x00_get_field32(reg, H2M_MAILBOX_CID_CMD0) == token) ||
+                    (rt2x00_get_field32(reg, H2M_MAILBOX_CID_CMD1) == token) ||
+                    (rt2x00_get_field32(reg, H2M_MAILBOX_CID_CMD2) == token) ||
+                    (rt2x00_get_field32(reg, H2M_MAILBOX_CID_CMD3) == token))
+                        break;
+
+                udelay(REGISTER_BUSY_DELAY);
+        }
+
+        if (i == 200)
+                ERROR(rt2x00dev, "MCU request failed, no response from hardware\n");
+
+        rt2x00pci_register_write(rt2x00dev, H2M_MAILBOX_STATUS, ~0);
+        rt2x00pci_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
+}
+
+#ifdef CONFIG_RT2800PCI_WISOC
+static void rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
+{
+        u32 *base_addr = (u32 *) KSEG1ADDR(0x1F040000); /* XXX for RT3052 */
+
+        memcpy_fromio(rt2x00dev->eeprom, base_addr, EEPROM_SIZE);
+}
+#else
+static inline void rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
+{
+}
+#endif /* CONFIG_RT2800PCI_WISOC */
+
+#ifdef CONFIG_RT2800PCI_PCI
+static void rt2800pci_eepromregister_read(struct eeprom_93cx6 *eeprom)
+{
+        struct rt2x00_dev *rt2x00dev = eeprom->data;
+        u32 reg;
+
+        rt2x00pci_register_read(rt2x00dev, E2PROM_CSR, &reg);
+
+        eeprom->reg_data_in = !!rt2x00_get_field32(reg, E2PROM_CSR_DATA_IN);
+        eeprom->reg_data_out = !!rt2x00_get_field32(reg, E2PROM_CSR_DATA_OUT);
+        eeprom->reg_data_clock =
+            !!rt2x00_get_field32(reg, E2PROM_CSR_DATA_CLOCK);
+        eeprom->reg_chip_select =
+            !!rt2x00_get_field32(reg, E2PROM_CSR_CHIP_SELECT);
+}
+
+static void rt2800pci_eepromregister_write(struct eeprom_93cx6 *eeprom)
+{
+        struct rt2x00_dev *rt2x00dev = eeprom->data;
+        u32 reg = 0;
+
+        rt2x00_set_field32(&reg, E2PROM_CSR_DATA_IN, !!eeprom->reg_data_in);
+        rt2x00_set_field32(&reg, E2PROM_CSR_DATA_OUT, !!eeprom->reg_data_out);
+        rt2x00_set_field32(&reg, E2PROM_CSR_DATA_CLOCK,
+                           !!eeprom->reg_data_clock);
+        rt2x00_set_field32(&reg, E2PROM_CSR_CHIP_SELECT,
+                           !!eeprom->reg_chip_select);
+
+        rt2x00pci_register_write(rt2x00dev, E2PROM_CSR, reg);
+}
+
+static void rt2800pci_read_eeprom_pci(struct rt2x00_dev *rt2x00dev)
+{
+        struct eeprom_93cx6 eeprom;
+        u32 reg;
+
+        rt2x00pci_register_read(rt2x00dev, E2PROM_CSR, &reg);
+
+        eeprom.data = rt2x00dev;
+        eeprom.register_read = rt2800pci_eepromregister_read;
+        eeprom.register_write = rt2800pci_eepromregister_write;
+        eeprom.width = !rt2x00_get_field32(reg, E2PROM_CSR_TYPE) ?
+            PCI_EEPROM_WIDTH_93C46 : PCI_EEPROM_WIDTH_93C66;
+        eeprom.reg_data_in = 0;
+        eeprom.reg_data_out = 0;
+        eeprom.reg_data_clock = 0;
+        eeprom.reg_chip_select = 0;
+
+        eeprom_93cx6_multiread(&eeprom, EEPROM_BASE, rt2x00dev->eeprom,
+                               EEPROM_SIZE / sizeof(u16));
+}
+
+static void rt2800pci_efuse_read(struct rt2x00_dev *rt2x00dev,
+                                 unsigned int i)
+{
+        u32 reg;
+
+        rt2x00pci_register_read(rt2x00dev, EFUSE_CTRL, &reg);
+        rt2x00_set_field32(&reg, EFUSE_CTRL_ADDRESS_IN, i);
+        rt2x00_set_field32(&reg, EFUSE_CTRL_MODE, 0);
+        rt2x00_set_field32(&reg, EFUSE_CTRL_KICK, 1);
+        rt2x00pci_register_write(rt2x00dev, EFUSE_CTRL, reg);
+
+        /* Wait until the EEPROM has been loaded */
+        rt2x00pci_regbusy_read(rt2x00dev, EFUSE_CTRL, EFUSE_CTRL_KICK, &reg);
+
+        /* Apparently the data is read from end to start */
+        rt2x00pci_register_read(rt2x00dev, EFUSE_DATA3,
+                                (u32 *)&rt2x00dev->eeprom[i]);
+        rt2x00pci_register_read(rt2x00dev, EFUSE_DATA2,
+                                (u32 *)&rt2x00dev->eeprom[i + 2]);
+        rt2x00pci_register_read(rt2x00dev, EFUSE_DATA1,
+                                (u32 *)&rt2x00dev->eeprom[i + 4]);
+        rt2x00pci_register_read(rt2x00dev, EFUSE_DATA0,
+                                (u32 *)&rt2x00dev->eeprom[i + 6]);
+}
+
+static void rt2800pci_read_eeprom_efuse(struct rt2x00_dev *rt2x00dev)
+{
+        unsigned int i;
+
+        for (i = 0; i < EEPROM_SIZE / sizeof(u16); i += 8)
+                rt2800pci_efuse_read(rt2x00dev, i);
+}
+#else
+static inline void rt2800pci_read_eeprom_pci(struct rt2x00_dev *rt2x00dev)
+{
+}
+
+static inline void rt2800pci_read_eeprom_efuse(struct rt2x00_dev *rt2x00dev)
+{
+}
+#endif /* CONFIG_RT2800PCI_PCI */
+
+#ifdef CONFIG_RT2X00_LIB_DEBUGFS
+static const struct rt2x00debug rt2800pci_rt2x00debug = {
+        .owner  = THIS_MODULE,
+        .csr    = {
+                .read           = rt2x00pci_register_read,
+                .write          = rt2x00pci_register_write,
+                .flags          = RT2X00DEBUGFS_OFFSET,
+                .word_base      = CSR_REG_BASE,
+                .word_size      = sizeof(u32),
+                .word_count     = CSR_REG_SIZE / sizeof(u32),
+        },
+        .eeprom = {
+                .read           = rt2x00_eeprom_read,
+                .write          = rt2x00_eeprom_write,
+                .word_base      = EEPROM_BASE,
+                .word_size      = sizeof(u16),
+                .word_count     = EEPROM_SIZE / sizeof(u16),
+        },
+        .bbp    = {
+                .read           = rt2800pci_bbp_read,
+                .write          = rt2800pci_bbp_write,
+                .word_base      = BBP_BASE,
+                .word_size      = sizeof(u8),
+                .word_count     = BBP_SIZE / sizeof(u8),
+        },
+        .rf     = {
+                .read           = rt2x00_rf_read,
+                .write          = rt2800pci_rf_write,
+                .word_base      = RF_BASE,
+                .word_size      = sizeof(u32),
+                .word_count     = RF_SIZE / sizeof(u32),
+        },
+};
+#endif /* CONFIG_RT2X00_LIB_DEBUGFS */
+
+static int rt2800pci_rfkill_poll(struct rt2x00_dev *rt2x00dev)
+{
+        u32 reg;
+
+        rt2x00pci_register_read(rt2x00dev, GPIO_CTRL_CFG, &reg);
+        return rt2x00_get_field32(reg, GPIO_CTRL_CFG_BIT2);
+}
+
+#ifdef CONFIG_RT2X00_LIB_LEDS
+static void rt2800pci_brightness_set(struct led_classdev *led_cdev,
+                                     enum led_brightness brightness)
+{
+        struct rt2x00_led *led =
+            container_of(led_cdev, struct rt2x00_led, led_dev);
+        unsigned int enabled = brightness != LED_OFF;
+        unsigned int bg_mode =
+            (enabled && led->rt2x00dev->curr_band == IEEE80211_BAND_2GHZ);
+        unsigned int polarity =
+                rt2x00_get_field16(led->rt2x00dev->led_mcu_reg,
+                                   EEPROM_FREQ_LED_POLARITY);
+        unsigned int ledmode =
+                rt2x00_get_field16(led->rt2x00dev->led_mcu_reg,
+                                   EEPROM_FREQ_LED_MODE);
+
+        if (led->type == LED_TYPE_RADIO) {
+                rt2800pci_mcu_request(led->rt2x00dev, MCU_LED, 0xff, ledmode,
+                                      enabled ? 0x20 : 0);
+        } else if (led->type == LED_TYPE_ASSOC) {
+                rt2800pci_mcu_request(led->rt2x00dev, MCU_LED, 0xff, ledmode,
+                                      enabled ? (bg_mode ? 0x60 : 0xa0) : 0x20);
+        } else if (led->type == LED_TYPE_QUALITY) {
+                /*
+                 * The brightness is divided into 6 levels (0 - 5),
+                 * The specs tell us the following levels:
+                 *      0, 1 ,3, 7, 15, 31
+                 * to determine the level in a simple way we can simply
+                 * work with bitshifting:
+                 *      (1 << level) - 1
+                 */
+                rt2800pci_mcu_request(led->rt2x00dev, MCU_LED_STRENGTH, 0xff,
+                                      (1 << brightness / (LED_FULL / 6)) - 1,
+                                      polarity);
+        }
+}
+
+static int rt2800pci_blink_set(struct led_classdev *led_cdev,
+                               unsigned long *delay_on,
+                               unsigned long *delay_off)
+{
+        struct rt2x00_led *led =
+            container_of(led_cdev, struct rt2x00_led, led_dev);
+        u32 reg;
+
+        rt2x00pci_register_read(led->rt2x00dev, LED_CFG, &reg);
+        rt2x00_set_field32(&reg, LED_CFG_ON_PERIOD, *delay_on);
+        rt2x00_set_field32(&reg, LED_CFG_OFF_PERIOD, *delay_off);
+        rt2x00_set_field32(&reg, LED_CFG_SLOW_BLINK_PERIOD, 3);
+        rt2x00_set_field32(&reg, LED_CFG_R_LED_MODE, 3);
+        rt2x00_set_field32(&reg, LED_CFG_G_LED_MODE, 12);
+        rt2x00_set_field32(&reg, LED_CFG_Y_LED_MODE, 3);
+        rt2x00_set_field32(&reg, LED_CFG_LED_POLAR, 1);
+        rt2x00pci_register_write(led->rt2x00dev, LED_CFG, reg);
+
+        return 0;
+}
+
+static void rt2800pci_init_led(struct rt2x00_dev *rt2x00dev,
+                               struct rt2x00_led *led,
+                               enum led_type type)
+{
+        led->rt2x00dev = rt2x00dev;
+        led->type = type;
+        led->led_dev.brightness_set = rt2800pci_brightness_set;
+        led->led_dev.blink_set = rt2800pci_blink_set;
+        led->flags = LED_INITIALIZED;
+}
+#endif /* CONFIG_RT2X00_LIB_LEDS */
+
+/*
+ * Configuration handlers.
+ */
+static void rt2800pci_config_wcid_attr(struct rt2x00_dev *rt2x00dev,
+                                       struct rt2x00lib_crypto *crypto,
+                                       struct ieee80211_key_conf *key)
+{
+        struct mac_wcid_entry wcid_entry;
+        struct mac_iveiv_entry iveiv_entry;
+        u32 offset;
+        u32 reg;
+
+        offset = MAC_WCID_ATTR_ENTRY(key->hw_key_idx);
+
+        rt2x00pci_register_read(rt2x00dev, offset, &reg);
+        rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_KEYTAB,
+                           !!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE));
+        rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_CIPHER,
+                           (crypto->cmd == SET_KEY) * crypto->cipher);
+        rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_BSS_IDX,
+                           (crypto->cmd == SET_KEY) * crypto->bssidx);
+        rt2x00_set_field32(&reg, MAC_WCID_ATTRIBUTE_RX_WIUDF, crypto->cipher);
+        rt2x00pci_register_write(rt2x00dev, offset, reg);
+
+        offset = MAC_IVEIV_ENTRY(key->hw_key_idx);
+
+        memset(&iveiv_entry, 0, sizeof(iveiv_entry));
+        if ((crypto->cipher == CIPHER_TKIP) ||
+            (crypto->cipher == CIPHER_TKIP_NO_MIC) ||
+            (crypto->cipher == CIPHER_AES))
+                iveiv_entry.iv[3] |= 0x20;
+        iveiv_entry.iv[3] |= key->keyidx << 6;
+        rt2x00pci_register_multiwrite(rt2x00dev, offset,
+                                      &iveiv_entry, sizeof(iveiv_entry));
+
+        offset = MAC_WCID_ENTRY(key->hw_key_idx);
+
+        memset(&wcid_entry, 0, sizeof(wcid_entry));
+        if (crypto->cmd == SET_KEY)
+                memcpy(&wcid_entry, crypto->address, ETH_ALEN);
+        rt2x00pci_register_multiwrite(rt2x00dev, offset,
+                                      &wcid_entry, sizeof(wcid_entry));
+}
+
+static int rt2800pci_config_shared_key(struct rt2x00_dev *rt2x00dev,
+                                       struct rt2x00lib_crypto *crypto,
+                                       struct ieee80211_key_conf *key)
+{
+        struct hw_key_entry key_entry;
+        struct rt2x00_field32 field;
+        u32 offset;
+        u32 reg;
+
+        if (crypto->cmd == SET_KEY) {
+                key->hw_key_idx = (4 * crypto->bssidx) + key->keyidx;
+
+                memcpy(key_entry.key, crypto->key,
+                       sizeof(key_entry.key));
+                memcpy(key_entry.tx_mic, crypto->tx_mic,
+                       sizeof(key_entry.tx_mic));
+                memcpy(key_entry.rx_mic, crypto->rx_mic,
+                       sizeof(key_entry.rx_mic));
+
+                offset = SHARED_KEY_ENTRY(key->hw_key_idx);
+                rt2x00pci_register_multiwrite(rt2x00dev, offset,
+                                              &key_entry, sizeof(key_entry));
+        }
+
+        /*
+         * The cipher types are stored over multiple registers
+         * starting with SHARED_KEY_MODE_BASE each word will have
+         * 32 bits and contains the cipher types for 2 bssidx each.
+         * Using the correct defines correctly will cause overhead,
+         * so just calculate the correct offset.
+         */
+        field.bit_offset = 4 * (key->hw_key_idx % 8);
+        field.bit_mask = 0x7 << field.bit_offset;
+
+        offset = SHARED_KEY_MODE_ENTRY(key->hw_key_idx / 8);
+
+        rt2x00pci_register_read(rt2x00dev, offset, &reg);
+        rt2x00_set_field32(&reg, field,
+                           (crypto->cmd == SET_KEY) * crypto->cipher);
+        rt2x00pci_register_write(rt2x00dev, offset, reg);
+
+        /*
+         * Update WCID information
+         */
+        rt2800pci_config_wcid_attr(rt2x00dev, crypto, key);
+
+        return 0;
+}
+
+static int rt2800pci_config_pairwise_key(struct rt2x00_dev *rt2x00dev,
+                                         struct rt2x00lib_crypto *crypto,
+                                         struct ieee80211_key_conf *key)
+{
+        struct hw_key_entry key_entry;
+        u32 offset;
+
+        if (crypto->cmd == SET_KEY) {
+                /*
+                 * 1 pairwise key is possible per AID, this means that the AID
+                 * equals our hw_key_idx. Make sure the WCID starts _after_ the
+                 * last possible shared key entry.
+                 */
+                if (crypto->aid > (256 - 32))
+                        return -ENOSPC;
+
+                key->hw_key_idx = 32 + crypto->aid;
+
+
+                memcpy(key_entry.key, crypto->key,
+                       sizeof(key_entry.key));
+                memcpy(key_entry.tx_mic, crypto->tx_mic,
+                       sizeof(key_entry.tx_mic));
+                memcpy(key_entry.rx_mic, crypto->rx_mic,
+                       sizeof(key_entry.rx_mic));
+
+                offset = PAIRWISE_KEY_ENTRY(key->hw_key_idx);
+                rt2x00pci_register_multiwrite(rt2x00dev, offset,
+                                              &key_entry, sizeof(key_entry));
+        }
+
+        /*
+         * Update WCID information
+         */
+        rt2800pci_config_wcid_attr(rt2x00dev, crypto, key);
+
+        return 0;
+}
+
+static void rt2800pci_config_filter(struct rt2x00_dev *rt2x00dev,
+                                    const unsigned int filter_flags)
+{
+        u32 reg;
+
+        /*
+         * Start configuration steps.
+         * Note that the version error will always be dropped
+         * and broadcast frames will always be accepted since
+         * there is no filter for it at this time.
+         */
+        rt2x00pci_register_read(rt2x00dev, RX_FILTER_CFG, &reg);
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_CRC_ERROR,
+                           !(filter_flags & FIF_FCSFAIL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_PHY_ERROR,
+                           !(filter_flags & FIF_PLCPFAIL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_NOT_TO_ME,
+                           !(filter_flags & FIF_PROMISC_IN_BSS));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_NOT_MY_BSSD, 0);
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_VER_ERROR, 1);
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_MULTICAST,
+                           !(filter_flags & FIF_ALLMULTI));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_BROADCAST, 0);
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_DUPLICATE, 1);
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_CF_END_ACK,
+                           !(filter_flags & FIF_CONTROL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_CF_END,
+                           !(filter_flags & FIF_CONTROL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_ACK,
+                           !(filter_flags & FIF_CONTROL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_CTS,
+                           !(filter_flags & FIF_CONTROL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_RTS,
+                           !(filter_flags & FIF_CONTROL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_PSPOLL,
+                           !(filter_flags & FIF_PSPOLL));
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_BA, 1);
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_BAR, 0);
+        rt2x00_set_field32(&reg, RX_FILTER_CFG_DROP_CNTL,
+                           !(filter_flags & FIF_CONTROL));
+        rt2x00pci_register_write(rt2x00dev, RX_FILTER_CFG, reg);
+}
+
+static void rt2800pci_config_intf(struct rt2x00_dev *rt2x00dev,
+                                  struct rt2x00_intf *intf,
+                                  struct rt2x00intf_conf *conf,
+                                  const unsigned int flags)
+{
+        unsigned int beacon_base;
+        u32 reg;
+
+        if (flags & CONFIG_UPDATE_TYPE) {
+                /*
+                 * Clear current synchronisation setup.
+                 * For the Beacon base registers we only need to clear
+                 * the first byte since that byte contains the VALID and OWNER
+                 * bits which (when set to 0) will invalidate the entire beacon.
+                 */
+                beacon_base = HW_BEACON_OFFSET(intf->beacon->entry_idx);
+                rt2x00pci_register_write(rt2x00dev, beacon_base, 0);
+
+                /*
+                 * Enable synchronisation.
+                 */
+                rt2x00pci_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+                rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_TICKING, 1);
+                rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_SYNC, conf->sync);
+                rt2x00_set_field32(&reg, BCN_TIME_CFG_TBTT_ENABLE, 1);
+                rt2x00pci_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+        }
+
+        if (flags & CONFIG_UPDATE_MAC) {
+                reg = le32_to_cpu(conf->mac[1]);
+                rt2x00_set_field32(&reg, MAC_ADDR_DW1_UNICAST_TO_ME_MASK, 0xff);
+                conf->mac[1] = cpu_to_le32(reg);
+
+                rt2x00pci_register_multiwrite(rt2x00dev, MAC_ADDR_DW0,
+                                              conf->mac, sizeof(conf->mac));
+        }
+
+        if (flags & CONFIG_UPDATE_BSSID) {
+                reg = le32_to_cpu(conf->bssid[1]);
+                rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_ID_MASK, 0);
+                rt2x00_set_field32(&reg, MAC_BSSID_DW1_BSS_BCN_NUM, 0);
+                conf->bssid[1] = cpu_to_le32(reg);
+
+                rt2x00pci_register_multiwrite(rt2x00dev, MAC_BSSID_DW0,
+                                              conf->bssid, sizeof(conf->bssid));
+        }
+}
+
+static void rt2800pci_config_erp(struct rt2x00_dev *rt2x00dev,
+                                 struct rt2x00lib_erp *erp)
+{
+        u32 reg;
+
+        rt2x00pci_register_read(rt2x00dev, TX_TIMEOUT_CFG, &reg);
+        rt2x00_set_field32(&reg, TX_TIMEOUT_CFG_RX_ACK_TIMEOUT, 0x20);
+        rt2x00pci_register_write(rt2x00dev, TX_TIMEOUT_CFG, reg);
+
+        rt2x00pci_register_read(rt2x00dev, AUTO_RSP_CFG, &reg);
+        rt2x00_set_field32(&reg, AUTO_RSP_CFG_BAC_ACK_POLICY,
+                           !!erp->short_preamble);
+        rt2x00_set_field32(&reg, AUTO_RSP_CFG_AR_PREAMBLE,
+                           !!erp->short_preamble);
+        rt2x00pci_register_write(rt2x00dev, AUTO_RSP_CFG, reg);
+
+        rt2x00pci_register_read(rt2x00dev, OFDM_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_PROTECT_CTRL,
+                           erp->cts_protection ? 2 : 0);
+        rt2x00pci_register_write(rt2x00dev, OFDM_PROT_CFG, reg);
+
+        rt2x00pci_register_write(rt2x00dev, LEGACY_BASIC_RATE,
+                                 erp->basic_rates);
+        rt2x00pci_register_write(rt2x00dev, HT_BASIC_RATE, 0x00008003);
+
+        rt2x00pci_register_read(rt2x00dev, BKOFF_SLOT_CFG, &reg);
+        rt2x00_set_field32(&reg, BKOFF_SLOT_CFG_SLOT_TIME, erp->slot_time);
+        rt2x00_set_field32(&reg, BKOFF_SLOT_CFG_CC_DELAY_TIME, 2);
+        rt2x00pci_register_write(rt2x00dev, BKOFF_SLOT_CFG, reg);
+
+        rt2x00pci_register_read(rt2x00dev, XIFS_TIME_CFG, &reg);
+        rt2x00_set_field32(&reg, XIFS_TIME_CFG_CCKM_SIFS_TIME, erp->sifs);
+        rt2x00_set_field32(&reg, XIFS_TIME_CFG_OFDM_SIFS_TIME, erp->sifs);
+        rt2x00_set_field32(&reg, XIFS_TIME_CFG_OFDM_XIFS_TIME, 4);
+        rt2x00_set_field32(&reg, XIFS_TIME_CFG_EIFS, erp->eifs);
+        rt2x00_set_field32(&reg, XIFS_TIME_CFG_BB_RXEND_ENABLE, 1);
+        rt2x00pci_register_write(rt2x00dev, XIFS_TIME_CFG, reg);
+
+        rt2x00pci_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_INTERVAL,
+                           erp->beacon_int * 16);
+        rt2x00pci_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+}
+
+static void rt2800pci_config_ant(struct rt2x00_dev *rt2x00dev,
+                                 struct antenna_setup *ant)
+{
+        u8 r1;
+        u8 r3;
+
+        rt2800pci_bbp_read(rt2x00dev, 1, &r1);
+        rt2800pci_bbp_read(rt2x00dev, 3, &r3);
+
+        /*
+         * Configure the TX antenna.
+         */
+        switch ((int)ant->tx) {
+        case 1:
+                rt2x00_set_field8(&r1, BBP1_TX_ANTENNA, 0);
+                rt2x00_set_field8(&r3, BBP3_RX_ANTENNA, 0);
+                break;
+        case 2:
+                rt2x00_set_field8(&r1, BBP1_TX_ANTENNA, 2);
+                break;
+        case 3:
+                /* Do nothing */
+                break;
+        }
+
+        /*
+         * Configure the RX antenna.
+         */
+        switch ((int)ant->rx) {
+        case 1:
+                rt2x00_set_field8(&r3, BBP3_RX_ANTENNA, 0);
+                break;
+        case 2:
+                rt2x00_set_field8(&r3, BBP3_RX_ANTENNA, 1);
+                break;
+        case 3:
+                rt2x00_set_field8(&r3, BBP3_RX_ANTENNA, 2);
+                break;
+        }
+
+        rt2800pci_bbp_write(rt2x00dev, 3, r3);
+        rt2800pci_bbp_write(rt2x00dev, 1, r1);
+}
+
+static void rt2800pci_config_lna_gain(struct rt2x00_dev *rt2x00dev,
+                                      struct rt2x00lib_conf *libconf)
+{
+        u16 eeprom;
+        short lna_gain;
+
+        if (libconf->rf.channel <= 14) {
+                rt2x00_eeprom_read(rt2x00dev, EEPROM_LNA, &eeprom);
+                lna_gain = rt2x00_get_field16(eeprom, EEPROM_LNA_BG);
+        } else if (libconf->rf.channel <= 64) {
+                rt2x00_eeprom_read(rt2x00dev, EEPROM_LNA, &eeprom);
+                lna_gain = rt2x00_get_field16(eeprom, EEPROM_LNA_A0);
+        } else if (libconf->rf.channel <= 128) {
+                rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_BG2, &eeprom);
+                lna_gain = rt2x00_get_field16(eeprom, EEPROM_RSSI_BG2_LNA_A1);
+        } else {
+                rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_A2, &eeprom);
+                lna_gain = rt2x00_get_field16(eeprom, EEPROM_RSSI_A2_LNA_A2);
+        }
+
+        rt2x00dev->lna_gain = lna_gain;
+}
+
+static void rt2800pci_config_channel_rt2x(struct rt2x00_dev *rt2x00dev,
+                                          struct ieee80211_conf *conf,
+                                          struct rf_channel *rf,
+                                          struct channel_info *info)
+{
+        rt2x00_set_field32(&rf->rf4, RF4_FREQ_OFFSET, rt2x00dev->freq_offset);
+
+        if (rt2x00dev->default_ant.tx == 1)
+                rt2x00_set_field32(&rf->rf2, RF2_ANTENNA_TX1, 1);
+
+        if (rt2x00dev->default_ant.rx == 1) {
+                rt2x00_set_field32(&rf->rf2, RF2_ANTENNA_RX1, 1);
+                rt2x00_set_field32(&rf->rf2, RF2_ANTENNA_RX2, 1);
+        } else if (rt2x00dev->default_ant.rx == 2)
+                rt2x00_set_field32(&rf->rf2, RF2_ANTENNA_RX2, 1);
+
+        if (rf->channel > 14) {
+                /*
+                 * When TX power is below 0, we should increase it by 7 to
+                 * make it a positive value (Minumum value is -7).
+                 * However this means that values between 0 and 7 have
+                 * double meaning, and we should set a 7DBm boost flag.
+                 */
+                rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_A_7DBM_BOOST,
+                                   (info->tx_power1 >= 0));
+
+                if (info->tx_power1 < 0)
+                        info->tx_power1 += 7;
+
+                rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_A,
+                                   TXPOWER_A_TO_DEV(info->tx_power1));
+
+                rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_A_7DBM_BOOST,
+                                   (info->tx_power2 >= 0));
+
+                if (info->tx_power2 < 0)
+                        info->tx_power2 += 7;
+
+                rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_A,
+                                   TXPOWER_A_TO_DEV(info->tx_power2));
+        } else {
+                rt2x00_set_field32(&rf->rf3, RF3_TXPOWER_G,
+                                   TXPOWER_G_TO_DEV(info->tx_power1));
+                rt2x00_set_field32(&rf->rf4, RF4_TXPOWER_G,
+                                   TXPOWER_G_TO_DEV(info->tx_power2));
+        }
+
+        rt2x00_set_field32(&rf->rf4, RF4_HT40, conf_is_ht40(conf));
+
+        rt2800pci_rf_write(rt2x00dev, 1, rf->rf1);
+        rt2800pci_rf_write(rt2x00dev, 2, rf->rf2);
+        rt2800pci_rf_write(rt2x00dev, 3, rf->rf3 & ~0x00000004);
+        rt2800pci_rf_write(rt2x00dev, 4, rf->rf4);
+
+        udelay(200);
+
+        rt2800pci_rf_write(rt2x00dev, 1, rf->rf1);
+        rt2800pci_rf_write(rt2x00dev, 2, rf->rf2);
+        rt2800pci_rf_write(rt2x00dev, 3, rf->rf3 | 0x00000004);
+        rt2800pci_rf_write(rt2x00dev, 4, rf->rf4);
+
+        udelay(200);
+
+        rt2800pci_rf_write(rt2x00dev, 1, rf->rf1);
+        rt2800pci_rf_write(rt2x00dev, 2, rf->rf2);
+        rt2800pci_rf_write(rt2x00dev, 3, rf->rf3 & ~0x00000004);
+        rt2800pci_rf_write(rt2x00dev, 4, rf->rf4);
+}
+
+static void rt2800pci_config_channel_rt3x(struct rt2x00_dev *rt2x00dev,
+                                          struct ieee80211_conf *conf,
+                                          struct rf_channel *rf,
+                                          struct channel_info *info)
+{
+        u8 rfcsr;
+
+        rt2800pci_rfcsr_write(rt2x00dev, 2, rf->rf1);
+        rt2800pci_rfcsr_write(rt2x00dev, 2, rf->rf3);
+
+        rt2800pci_rfcsr_read(rt2x00dev, 6, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR6_R, rf->rf2);
+        rt2800pci_rfcsr_write(rt2x00dev, 6, rfcsr);
+
+        rt2800pci_rfcsr_read(rt2x00dev, 12, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR12_TX_POWER,
+                          TXPOWER_G_TO_DEV(info->tx_power1));
+        rt2800pci_rfcsr_write(rt2x00dev, 12, rfcsr);
+
+        rt2800pci_rfcsr_read(rt2x00dev, 23, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR23_FREQ_OFFSET, rt2x00dev->freq_offset);
+        rt2800pci_rfcsr_write(rt2x00dev, 23, rfcsr);
+
+        rt2800pci_rfcsr_write(rt2x00dev, 24,
+                              rt2x00dev->calibration[conf_is_ht40(conf)]);
+
+        rt2800pci_rfcsr_read(rt2x00dev, 23, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR7_RF_TUNING, 1);
+        rt2800pci_rfcsr_write(rt2x00dev, 23, rfcsr);
+}
+
+static void rt2800pci_config_channel(struct rt2x00_dev *rt2x00dev,
+                                     struct ieee80211_conf *conf,
+                                     struct rf_channel *rf,
+                                     struct channel_info *info)
+{
+        u32 reg;
+        unsigned int tx_pin;
+        u8 bbp;
+
+        if (rt2x00_rev(&rt2x00dev->chip) != RT3070_VERSION)
+                rt2800pci_config_channel_rt2x(rt2x00dev, conf, rf, info);
+        else
+                rt2800pci_config_channel_rt3x(rt2x00dev, conf, rf, info);
+
+        /*
+         * Change BBP settings
+         */
+        rt2800pci_bbp_write(rt2x00dev, 62, 0x37 - rt2x00dev->lna_gain);
+        rt2800pci_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
+        rt2800pci_bbp_write(rt2x00dev, 64, 0x37 - rt2x00dev->lna_gain);
+        rt2800pci_bbp_write(rt2x00dev, 86, 0);
+
+        if (rf->channel <= 14) {
+                if (test_bit(CONFIG_EXTERNAL_LNA_BG, &rt2x00dev->flags)) {
+                        rt2800pci_bbp_write(rt2x00dev, 82, 0x62);
+                        rt2800pci_bbp_write(rt2x00dev, 75, 0x46);
+                } else {
+                        rt2800pci_bbp_write(rt2x00dev, 82, 0x84);
+                        rt2800pci_bbp_write(rt2x00dev, 75, 0x50);
+                }
+        } else {
+                rt2800pci_bbp_write(rt2x00dev, 82, 0xf2);
+
+                if (test_bit(CONFIG_EXTERNAL_LNA_A, &rt2x00dev->flags))
+                        rt2800pci_bbp_write(rt2x00dev, 75, 0x46);
+                else
+                        rt2800pci_bbp_write(rt2x00dev, 75, 0x50);
+        }
+
+        rt2x00pci_register_read(rt2x00dev, TX_BAND_CFG, &reg);
+        rt2x00_set_field32(&reg, TX_BAND_CFG_HT40_PLUS, conf_is_ht40_plus(conf));
+        rt2x00_set_field32(&reg, TX_BAND_CFG_A, rf->channel > 14);
+        rt2x00_set_field32(&reg, TX_BAND_CFG_BG, rf->channel <= 14);
+        rt2x00pci_register_write(rt2x00dev, TX_BAND_CFG, reg);
+
+        tx_pin = 0;
+
+        /* Turn on unused PA or LNA when not using 1T or 1R */
+        if (rt2x00dev->default_ant.tx != 1) {
+                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_A1_EN, 1);
+                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_G1_EN, 1);
+        }
+
+        /* Turn on unused PA or LNA when not using 1T or 1R */
+        if (rt2x00dev->default_ant.rx != 1) {
+                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_A1_EN, 1);
+                rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_G1_EN, 1);
+        }
+
+        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_A0_EN, 1);
+        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_LNA_PE_G0_EN, 1);
+        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_RFTR_EN, 1);
+        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_TRSW_EN, 1);
+        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_G0_EN, rf->channel <= 14);
+        rt2x00_set_field32(&tx_pin, TX_PIN_CFG_PA_PE_A0_EN, rf->channel > 14);
+
+        rt2x00pci_register_write(rt2x00dev, TX_PIN_CFG, tx_pin);
+
+        rt2800pci_bbp_read(rt2x00dev, 4, &bbp);
+        rt2x00_set_field8(&bbp, BBP4_BANDWIDTH, 2 * conf_is_ht40(conf));
+        rt2800pci_bbp_write(rt2x00dev, 4, bbp);
+
+        rt2800pci_bbp_read(rt2x00dev, 3, &bbp);
+        rt2x00_set_field8(&bbp, BBP3_HT40_PLUS, conf_is_ht40_plus(conf));
+        rt2800pci_bbp_write(rt2x00dev, 3, bbp);
+
+        if (rt2x00_rev(&rt2x00dev->chip) == RT2860C_VERSION) {
+                if (conf_is_ht40(conf)) {
+                        rt2800pci_bbp_write(rt2x00dev, 69, 0x1a);
+                        rt2800pci_bbp_write(rt2x00dev, 70, 0x0a);
+                        rt2800pci_bbp_write(rt2x00dev, 73, 0x16);
+                } else {
+                        rt2800pci_bbp_write(rt2x00dev, 69, 0x16);
+                        rt2800pci_bbp_write(rt2x00dev, 70, 0x08);
+                        rt2800pci_bbp_write(rt2x00dev, 73, 0x11);
+                }
+        }
+
+        msleep(1);
+}
+
+static void rt2800pci_config_txpower(struct rt2x00_dev *rt2x00dev,
+                                     const int txpower)
+{
+        u32 reg;
+        u32 value = TXPOWER_G_TO_DEV(txpower);
+        u8 r1;
+
+        rt2800pci_bbp_read(rt2x00dev, 1, &r1);
+        rt2x00_set_field8(&reg, BBP1_TX_POWER, 0);
+        rt2800pci_bbp_write(rt2x00dev, 1, r1);
+
+        rt2x00pci_register_read(rt2x00dev, TX_PWR_CFG_0, &reg);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_0_1MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_0_2MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_0_55MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_0_11MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_0_6MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_0_9MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_0_12MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_0_18MBS, value);
+        rt2x00pci_register_write(rt2x00dev, TX_PWR_CFG_0, reg);
+
+        rt2x00pci_register_read(rt2x00dev, TX_PWR_CFG_1, &reg);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_1_24MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_1_36MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_1_48MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_1_54MBS, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_1_MCS0, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_1_MCS1, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_1_MCS2, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_1_MCS3, value);
+        rt2x00pci_register_write(rt2x00dev, TX_PWR_CFG_1, reg);
+
+        rt2x00pci_register_read(rt2x00dev, TX_PWR_CFG_2, &reg);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS4, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS5, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS6, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS7, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS8, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS9, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS10, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_2_MCS11, value);
+        rt2x00pci_register_write(rt2x00dev, TX_PWR_CFG_2, reg);
+
+        rt2x00pci_register_read(rt2x00dev, TX_PWR_CFG_3, &reg);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_3_MCS12, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_3_MCS13, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_3_MCS14, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_3_MCS15, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_3_UKNOWN1, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_3_UKNOWN2, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_3_UKNOWN3, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_3_UKNOWN4, value);
+        rt2x00pci_register_write(rt2x00dev, TX_PWR_CFG_3, reg);
+
+        rt2x00pci_register_read(rt2x00dev, TX_PWR_CFG_4, &reg);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_4_UKNOWN5, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_4_UKNOWN6, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_4_UKNOWN7, value);
+        rt2x00_set_field32(&reg, TX_PWR_CFG_4_UKNOWN8, value);
+        rt2x00pci_register_write(rt2x00dev, TX_PWR_CFG_4, reg);
+}
+
+static void rt2800pci_config_retry_limit(struct rt2x00_dev *rt2x00dev,
+                                         struct rt2x00lib_conf *libconf)
+{
+        u32 reg;
+
+        rt2x00pci_register_read(rt2x00dev, TX_RTY_CFG, &reg);
+        rt2x00_set_field32(&reg, TX_RTY_CFG_SHORT_RTY_LIMIT,
+                           libconf->conf->short_frame_max_tx_count);
+        rt2x00_set_field32(&reg, TX_RTY_CFG_LONG_RTY_LIMIT,
+                           libconf->conf->long_frame_max_tx_count);
+        rt2x00_set_field32(&reg, TX_RTY_CFG_LONG_RTY_THRE, 2000);
+        rt2x00_set_field32(&reg, TX_RTY_CFG_NON_AGG_RTY_MODE, 0);
+        rt2x00_set_field32(&reg, TX_RTY_CFG_AGG_RTY_MODE, 0);
+        rt2x00_set_field32(&reg, TX_RTY_CFG_TX_AUTO_FB_ENABLE, 1);
+        rt2x00pci_register_write(rt2x00dev, TX_RTY_CFG, reg);
+}
+
+static void rt2800pci_config_ps(struct rt2x00_dev *rt2x00dev,
+                                struct rt2x00lib_conf *libconf)
+{
+        enum dev_state state =
+            (libconf->conf->flags & IEEE80211_CONF_PS) ?
+                STATE_SLEEP : STATE_AWAKE;
+        u32 reg;
+
+        if (state == STATE_SLEEP) {
+                rt2x00pci_register_write(rt2x00dev, AUTOWAKEUP_CFG, 0);
+
+                rt2x00pci_register_read(rt2x00dev, AUTOWAKEUP_CFG, &reg);
+                rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_AUTO_LEAD_TIME, 5);
+                rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_TBCN_BEFORE_WAKE,
+                                   libconf->conf->listen_interval - 1);
+                rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_AUTOWAKE, 1);
+                rt2x00pci_register_write(rt2x00dev, AUTOWAKEUP_CFG, reg);
+
+                rt2x00dev->ops->lib->set_device_state(rt2x00dev, state);
+        } else {
+                rt2x00dev->ops->lib->set_device_state(rt2x00dev, state);
+
+                rt2x00pci_register_read(rt2x00dev, AUTOWAKEUP_CFG, &reg);
+                rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_AUTO_LEAD_TIME, 0);
+                rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_TBCN_BEFORE_WAKE, 0);
+                rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_AUTOWAKE, 0);
+                rt2x00pci_register_write(rt2x00dev, AUTOWAKEUP_CFG, reg);
+        }
+}
+
+static void rt2800pci_config(struct rt2x00_dev *rt2x00dev,
+                             struct rt2x00lib_conf *libconf,
+                             const unsigned int flags)
+{
+        /* Always recalculate LNA gain before changing configuration */
+        rt2800pci_config_lna_gain(rt2x00dev, libconf);
+
+        if (flags & IEEE80211_CONF_CHANGE_CHANNEL)
+                rt2800pci_config_channel(rt2x00dev, libconf->conf,
+                                         &libconf->rf, &libconf->channel);
+        if (flags & IEEE80211_CONF_CHANGE_POWER)
+                rt2800pci_config_txpower(rt2x00dev, libconf->conf->power_level);
+        if (flags & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
+                rt2800pci_config_retry_limit(rt2x00dev, libconf);
+        if (flags & IEEE80211_CONF_CHANGE_PS)
+                rt2800pci_config_ps(rt2x00dev, libconf);
+}
+
+/*
+ * Link tuning
+ */
+static void rt2800pci_link_stats(struct rt2x00_dev *rt2x00dev,
+                                 struct link_qual *qual)
+{
+        u32 reg;
+
+        /*
+         * Update FCS error count from register.
+         */
+        rt2x00pci_register_read(rt2x00dev, RX_STA_CNT0, &reg);
+        qual->rx_failed = rt2x00_get_field32(reg, RX_STA_CNT0_CRC_ERR);
+}
+
+static u8 rt2800pci_get_default_vgc(struct rt2x00_dev *rt2x00dev)
+{
+        if (rt2x00dev->curr_band == IEEE80211_BAND_2GHZ)
+                return 0x2e + rt2x00dev->lna_gain;
+
+        if (!test_bit(CONFIG_CHANNEL_HT40, &rt2x00dev->flags))
+                return 0x32 + (rt2x00dev->lna_gain * 5) / 3;
+        else
+                return 0x3a + (rt2x00dev->lna_gain * 5) / 3;
+}
+
+static inline void rt2800pci_set_vgc(struct rt2x00_dev *rt2x00dev,
+                                     struct link_qual *qual, u8 vgc_level)
+{
+        if (qual->vgc_level != vgc_level) {
+                rt2800pci_bbp_write(rt2x00dev, 66, vgc_level);
+                qual->vgc_level = vgc_level;
+                qual->vgc_level_reg = vgc_level;
+        }
+}
+
+static void rt2800pci_reset_tuner(struct rt2x00_dev *rt2x00dev,
+                                  struct link_qual *qual)
+{
+        rt2800pci_set_vgc(rt2x00dev, qual,
+                          rt2800pci_get_default_vgc(rt2x00dev));
+}
+
+static void rt2800pci_link_tuner(struct rt2x00_dev *rt2x00dev,
+                                 struct link_qual *qual, const u32 count)
+{
+        if (rt2x00_rev(&rt2x00dev->chip) == RT2860C_VERSION)
+                return;
+
+        /*
+         * When RSSI is better then -80 increase VGC level with 0x10
+         */
+        rt2800pci_set_vgc(rt2x00dev, qual,
+                          rt2800pci_get_default_vgc(rt2x00dev) +
+                          ((qual->rssi > -80) * 0x10));
+}
+
+/*
+ * Firmware functions
+ */
+static char *rt2800pci_get_firmware_name(struct rt2x00_dev *rt2x00dev)
+{
+        return FIRMWARE_RT2860;
+}
+
+static int rt2800pci_check_firmware(struct rt2x00_dev *rt2x00dev,
+                                    const u8 *data, const size_t len)
+{
+        u16 fw_crc;
+        u16 crc;
+
+        /*
+         * Only support 8kb firmware files.
+         */
+        if (len != 8192)
+                return FW_BAD_LENGTH;
+
+        /*
+         * The last 2 bytes in the firmware array are the crc checksum itself,
+         * this means that we should never pass those 2 bytes to the crc
+         * algorithm.
+         */
+        fw_crc = (data[len - 2] << 8 | data[len - 1]);
+
+        /*
+         * Use the crc ccitt algorithm.
+         * This will return the same value as the legacy driver which
+         * used bit ordering reversion on the both the firmware bytes
+         * before input input as well as on the final output.
+         * Obviously using crc ccitt directly is much more efficient.
+         */
+        crc = crc_ccitt(~0, data, len - 2);
+
+        /*
+         * There is a small difference between the crc-itu-t + bitrev and
+         * the crc-ccitt crc calculation. In the latter method the 2 bytes
+         * will be swapped, use swab16 to convert the crc to the correct
+         * value.
+         */
+        crc = swab16(crc);
+
+        return (fw_crc == crc) ? FW_OK : FW_BAD_CRC;
+}
+
+static int rt2800pci_load_firmware(struct rt2x00_dev *rt2x00dev,
+                                   const u8 *data, const size_t len)
+{
+        unsigned int i;
+        u32 reg;
+
+        /*
+         * Wait for stable hardware.
+         */
+        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+                rt2x00pci_register_read(rt2x00dev, MAC_CSR0, &reg);
+                if (reg && reg != ~0)
+                        break;
+                msleep(1);
+        }
+
+        if (i == REGISTER_BUSY_COUNT) {
+                ERROR(rt2x00dev, "Unstable hardware.\n");
+                return -EBUSY;
+        }
+
+        rt2x00pci_register_write(rt2x00dev, PWR_PIN_CFG, 0x00000002);
+        rt2x00pci_register_write(rt2x00dev, AUTOWAKEUP_CFG, 0x00000000);
+
+        /*
+         * Disable DMA, will be reenabled later when enabling
+         * the radio.
+         */
+        rt2x00pci_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_DMA_BUSY, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_RX_DMA_BUSY, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_WRITEBACK_DONE, 1);
+        rt2x00pci_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
+
+        /*
+         * enable Host program ram write selection
+         */
+        reg = 0;
+        rt2x00_set_field32(&reg, PBF_SYS_CTRL_HOST_RAM_WRITE, 1);
+        rt2x00pci_register_write(rt2x00dev, PBF_SYS_CTRL, reg);
+
+        /*
+         * Write firmware to device.
+         */
+        rt2x00pci_register_multiwrite(rt2x00dev, FIRMWARE_IMAGE_BASE,
+                                      data, len);
+
+        rt2x00pci_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000);
+        rt2x00pci_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00001);
+
+        /*
+         * Wait for device to stabilize.
+         */
+        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+                rt2x00pci_register_read(rt2x00dev, PBF_SYS_CTRL, &reg);
+                if (rt2x00_get_field32(reg, PBF_SYS_CTRL_READY))
+                        break;
+                msleep(1);
+        }
+
+        if (i == REGISTER_BUSY_COUNT) {
+                ERROR(rt2x00dev, "PBF system register not ready.\n");
+                return -EBUSY;
+        }
+
+        /*
+         * Disable interrupts
+         */
+        rt2x00dev->ops->lib->set_device_state(rt2x00dev, STATE_RADIO_IRQ_OFF);
+
+        /*
+         * Initialize BBP R/W access agent
+         */
+        rt2x00pci_register_write(rt2x00dev, H2M_BBP_AGENT, 0);
+        rt2x00pci_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
+
+        return 0;
+}
+
+/*
+ * Initialization functions.
+ */
+static bool rt2800pci_get_entry_state(struct queue_entry *entry)
+{
+        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
+        u32 word;
+
+        if (entry->queue->qid == QID_RX) {
+                rt2x00_desc_read(entry_priv->desc, 1, &word);
+
+                return (!rt2x00_get_field32(word, RXD_W1_DMA_DONE));
+        } else {
+                rt2x00_desc_read(entry_priv->desc, 1, &word);
+
+                return (!rt2x00_get_field32(word, TXD_W1_DMA_DONE));
+        }
+}
+
+static void rt2800pci_clear_entry(struct queue_entry *entry)
+{
+        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
+        u32 word;
+
+        if (entry->queue->qid == QID_RX) {
+                rt2x00_desc_read(entry_priv->desc, 0, &word);
+                rt2x00_set_field32(&word, RXD_W0_SDP0, skbdesc->skb_dma);
+                rt2x00_desc_write(entry_priv->desc, 0, word);
+
+                rt2x00_desc_read(entry_priv->desc, 1, &word);
+                rt2x00_set_field32(&word, RXD_W1_DMA_DONE, 0);
+                rt2x00_desc_write(entry_priv->desc, 1, word);
+        } else {
+                rt2x00_desc_read(entry_priv->desc, 1, &word);
+                rt2x00_set_field32(&word, TXD_W1_DMA_DONE, 1);
+                rt2x00_desc_write(entry_priv->desc, 1, word);
+        }
+}
+
+static int rt2800pci_init_queues(struct rt2x00_dev *rt2x00dev)
+{
+        struct queue_entry_priv_pci *entry_priv;
+        u32 reg;
+
+        rt2x00pci_register_read(rt2x00dev, WPDMA_RST_IDX, &reg);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX0, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX1, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX2, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX3, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX4, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX5, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DRX_IDX0, 1);
+        rt2x00pci_register_write(rt2x00dev, WPDMA_RST_IDX, reg);
+
+        rt2x00pci_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000e1f);
+        rt2x00pci_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000e00);
+
+        /*
+         * Initialize registers.
+         */
+        entry_priv = rt2x00dev->tx[0].entries[0].priv_data;
+        rt2x00pci_register_write(rt2x00dev, TX_BASE_PTR0, entry_priv->desc_dma);
+        rt2x00pci_register_write(rt2x00dev, TX_MAX_CNT0, rt2x00dev->tx[0].limit);
+        rt2x00pci_register_write(rt2x00dev, TX_CTX_IDX0, 0);
+        rt2x00pci_register_write(rt2x00dev, TX_DTX_IDX0, 0);
+
+        entry_priv = rt2x00dev->tx[1].entries[0].priv_data;
+        rt2x00pci_register_write(rt2x00dev, TX_BASE_PTR1, entry_priv->desc_dma);
+        rt2x00pci_register_write(rt2x00dev, TX_MAX_CNT1, rt2x00dev->tx[1].limit);
+        rt2x00pci_register_write(rt2x00dev, TX_CTX_IDX1, 0);
+        rt2x00pci_register_write(rt2x00dev, TX_DTX_IDX1, 0);
+
+        entry_priv = rt2x00dev->tx[2].entries[0].priv_data;
+        rt2x00pci_register_write(rt2x00dev, TX_BASE_PTR2, entry_priv->desc_dma);
+        rt2x00pci_register_write(rt2x00dev, TX_MAX_CNT2, rt2x00dev->tx[2].limit);
+        rt2x00pci_register_write(rt2x00dev, TX_CTX_IDX2, 0);
+        rt2x00pci_register_write(rt2x00dev, TX_DTX_IDX2, 0);
+
+        entry_priv = rt2x00dev->tx[3].entries[0].priv_data;
+        rt2x00pci_register_write(rt2x00dev, TX_BASE_PTR3, entry_priv->desc_dma);
+        rt2x00pci_register_write(rt2x00dev, TX_MAX_CNT3, rt2x00dev->tx[3].limit);
+        rt2x00pci_register_write(rt2x00dev, TX_CTX_IDX3, 0);
+        rt2x00pci_register_write(rt2x00dev, TX_DTX_IDX3, 0);
+
+        entry_priv = rt2x00dev->rx->entries[0].priv_data;
+        rt2x00pci_register_write(rt2x00dev, RX_BASE_PTR, entry_priv->desc_dma);
+        rt2x00pci_register_write(rt2x00dev, RX_MAX_CNT, rt2x00dev->rx[0].limit);
+        rt2x00pci_register_write(rt2x00dev, RX_CRX_IDX, rt2x00dev->rx[0].limit - 1);
+        rt2x00pci_register_write(rt2x00dev, RX_DRX_IDX, 0);
+
+        /*
+         * Enable global DMA configuration
+         */
+        rt2x00pci_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_WRITEBACK_DONE, 1);
+        rt2x00pci_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
+
+        rt2x00pci_register_write(rt2x00dev, DELAY_INT_CFG, 0);
+
+        return 0;
+}
+
+static int rt2800pci_init_registers(struct rt2x00_dev *rt2x00dev)
+{
+        u32 reg;
+        unsigned int i;
+
+        rt2x00pci_register_write(rt2x00dev, PWR_PIN_CFG, 0x00000003);
+
+        rt2x00pci_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_RESET_CSR, 1);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_RESET_BBP, 1);
+        rt2x00pci_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
+
+        rt2x00pci_register_write(rt2x00dev, MAC_SYS_CTRL, 0x00000000);
+
+        rt2x00pci_register_read(rt2x00dev, BCN_OFFSET0, &reg);
+        rt2x00_set_field32(&reg, BCN_OFFSET0_BCN0, 0xe0); /* 0x3800 */
+        rt2x00_set_field32(&reg, BCN_OFFSET0_BCN1, 0xe8); /* 0x3a00 */
+        rt2x00_set_field32(&reg, BCN_OFFSET0_BCN2, 0xf0); /* 0x3c00 */
+        rt2x00_set_field32(&reg, BCN_OFFSET0_BCN3, 0xf8); /* 0x3e00 */
+        rt2x00pci_register_write(rt2x00dev, BCN_OFFSET0, reg);
+
+        rt2x00pci_register_read(rt2x00dev, BCN_OFFSET1, &reg);
+        rt2x00_set_field32(&reg, BCN_OFFSET1_BCN4, 0xc8); /* 0x3200 */
+        rt2x00_set_field32(&reg, BCN_OFFSET1_BCN5, 0xd0); /* 0x3400 */
+        rt2x00_set_field32(&reg, BCN_OFFSET1_BCN6, 0x77); /* 0x1dc0 */
+        rt2x00_set_field32(&reg, BCN_OFFSET1_BCN7, 0x6f); /* 0x1bc0 */
+        rt2x00pci_register_write(rt2x00dev, BCN_OFFSET1, reg);
+
+        rt2x00pci_register_write(rt2x00dev, LEGACY_BASIC_RATE, 0x0000013f);
+        rt2x00pci_register_write(rt2x00dev, HT_BASIC_RATE, 0x00008003);
+
+        rt2x00pci_register_write(rt2x00dev, MAC_SYS_CTRL, 0x00000000);
+
+        rt2x00pci_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_INTERVAL, 0);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_TICKING, 0);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_SYNC, 0);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_TBTT_ENABLE, 0);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 0);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_TX_TIME_COMPENSATE, 0);
+        rt2x00pci_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+
+        rt2x00pci_register_write(rt2x00dev, TX_SW_CFG0, 0x00000000);
+        rt2x00pci_register_write(rt2x00dev, TX_SW_CFG1, 0x00080606);
+
+        rt2x00pci_register_read(rt2x00dev, TX_LINK_CFG, &reg);
+        rt2x00_set_field32(&reg, TX_LINK_CFG_REMOTE_MFB_LIFETIME, 32);
+        rt2x00_set_field32(&reg, TX_LINK_CFG_MFB_ENABLE, 0);
+        rt2x00_set_field32(&reg, TX_LINK_CFG_REMOTE_UMFS_ENABLE, 0);
+        rt2x00_set_field32(&reg, TX_LINK_CFG_TX_MRQ_EN, 0);
+        rt2x00_set_field32(&reg, TX_LINK_CFG_TX_RDG_EN, 0);
+        rt2x00_set_field32(&reg, TX_LINK_CFG_TX_CF_ACK_EN, 1);
+        rt2x00_set_field32(&reg, TX_LINK_CFG_REMOTE_MFB, 0);
+        rt2x00_set_field32(&reg, TX_LINK_CFG_REMOTE_MFS, 0);
+        rt2x00pci_register_write(rt2x00dev, TX_LINK_CFG, reg);
+
+        rt2x00pci_register_read(rt2x00dev, TX_TIMEOUT_CFG, &reg);
+        rt2x00_set_field32(&reg, TX_TIMEOUT_CFG_MPDU_LIFETIME, 9);
+        rt2x00_set_field32(&reg, TX_TIMEOUT_CFG_TX_OP_TIMEOUT, 10);
+        rt2x00pci_register_write(rt2x00dev, TX_TIMEOUT_CFG, reg);
+
+        rt2x00pci_register_read(rt2x00dev, MAX_LEN_CFG, &reg);
+        rt2x00_set_field32(&reg, MAX_LEN_CFG_MAX_MPDU, AGGREGATION_SIZE);
+        if (rt2x00_rev(&rt2x00dev->chip) >= RT2880E_VERSION &&
+            rt2x00_rev(&rt2x00dev->chip) < RT3070_VERSION)
+                rt2x00_set_field32(&reg, MAX_LEN_CFG_MAX_PSDU, 2);
+        else
+                rt2x00_set_field32(&reg, MAX_LEN_CFG_MAX_PSDU, 1);
+        rt2x00_set_field32(&reg, MAX_LEN_CFG_MIN_PSDU, 0);
+        rt2x00_set_field32(&reg, MAX_LEN_CFG_MIN_MPDU, 0);
+        rt2x00pci_register_write(rt2x00dev, MAX_LEN_CFG, reg);
+
+        rt2x00pci_register_write(rt2x00dev, PBF_MAX_PCNT, 0x1f3fbf9f);
+
+        rt2x00pci_register_read(rt2x00dev, AUTO_RSP_CFG, &reg);
+        rt2x00_set_field32(&reg, AUTO_RSP_CFG_AUTORESPONDER, 1);
+        rt2x00_set_field32(&reg, AUTO_RSP_CFG_CTS_40_MMODE, 0);
+        rt2x00_set_field32(&reg, AUTO_RSP_CFG_CTS_40_MREF, 0);
+        rt2x00_set_field32(&reg, AUTO_RSP_CFG_DUAL_CTS_EN, 0);
+        rt2x00_set_field32(&reg, AUTO_RSP_CFG_ACK_CTS_PSM_BIT, 0);
+        rt2x00pci_register_write(rt2x00dev, AUTO_RSP_CFG, reg);
+
+        rt2x00pci_register_read(rt2x00dev, CCK_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_PROTECT_RATE, 8);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_PROTECT_CTRL, 0);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_PROTECT_NAV, 1);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_CCK, 1);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_MM20, 1);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_MM40, 1);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_GF20, 1);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_GF40, 1);
+        rt2x00pci_register_write(rt2x00dev, CCK_PROT_CFG, reg);
+
+        rt2x00pci_register_read(rt2x00dev, OFDM_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_PROTECT_RATE, 8);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_PROTECT_CTRL, 0);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_PROTECT_NAV, 1);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_CCK, 1);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_MM20, 1);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_MM40, 1);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_GF20, 1);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_GF40, 1);
+        rt2x00pci_register_write(rt2x00dev, OFDM_PROT_CFG, reg);
+
+        rt2x00pci_register_read(rt2x00dev, MM20_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_PROTECT_RATE, 0x4004);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_PROTECT_CTRL, 0);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_PROTECT_NAV, 1);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_TX_OP_ALLOW_CCK, 1);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_TX_OP_ALLOW_MM20, 1);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_TX_OP_ALLOW_MM40, 0);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_TX_OP_ALLOW_GF20, 1);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_TX_OP_ALLOW_GF40, 0);
+        rt2x00pci_register_write(rt2x00dev, MM20_PROT_CFG, reg);
+
+        rt2x00pci_register_read(rt2x00dev, MM40_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_PROTECT_RATE, 0x4084);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_PROTECT_CTRL, 0);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_PROTECT_NAV, 1);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_CCK, 1);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_MM20, 1);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_MM40, 1);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_GF20, 1);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_TX_OP_ALLOW_GF40, 1);
+        rt2x00pci_register_write(rt2x00dev, MM40_PROT_CFG, reg);
+
+        rt2x00pci_register_read(rt2x00dev, GF20_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_PROTECT_RATE, 0x4004);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_PROTECT_CTRL, 0);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_PROTECT_NAV, 1);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_TX_OP_ALLOW_CCK, 1);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_TX_OP_ALLOW_MM20, 1);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_TX_OP_ALLOW_MM40, 0);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_TX_OP_ALLOW_GF20, 1);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_TX_OP_ALLOW_GF40, 0);
+        rt2x00pci_register_write(rt2x00dev, GF20_PROT_CFG, reg);
+
+        rt2x00pci_register_read(rt2x00dev, GF40_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_PROTECT_RATE, 0x4084);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_PROTECT_CTRL, 0);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_PROTECT_NAV, 1);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_TX_OP_ALLOW_CCK, 1);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_TX_OP_ALLOW_OFDM, 1);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_TX_OP_ALLOW_MM20, 1);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_TX_OP_ALLOW_MM40, 1);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_TX_OP_ALLOW_GF20, 1);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_TX_OP_ALLOW_GF40, 1);
+        rt2x00pci_register_write(rt2x00dev, GF40_PROT_CFG, reg);
+
+        rt2x00pci_register_write(rt2x00dev, TXOP_CTRL_CFG, 0x0000583f);
+        rt2x00pci_register_write(rt2x00dev, TXOP_HLDR_ET, 0x00000002);
+
+        rt2x00pci_register_read(rt2x00dev, TX_RTS_CFG, &reg);
+        rt2x00_set_field32(&reg, TX_RTS_CFG_AUTO_RTS_RETRY_LIMIT, 32);
+        rt2x00_set_field32(&reg, TX_RTS_CFG_RTS_THRES,
+                           IEEE80211_MAX_RTS_THRESHOLD);
+        rt2x00_set_field32(&reg, TX_RTS_CFG_RTS_FBK_EN, 0);
+        rt2x00pci_register_write(rt2x00dev, TX_RTS_CFG, reg);
+
+        rt2x00pci_register_write(rt2x00dev, EXP_ACK_TIME, 0x002400ca);
+        rt2x00pci_register_write(rt2x00dev, PWR_PIN_CFG, 0x00000003);
+
+        /*
+         * ASIC will keep garbage value after boot, clear encryption keys.
+         */
+        for (i = 0; i < 4; i++)
+                rt2x00pci_register_write(rt2x00dev,
+                                         SHARED_KEY_MODE_ENTRY(i), 0);
+
+        for (i = 0; i < 256; i++) {
+                u32 wcid[2] = { 0xffffffff, 0x00ffffff };
+                rt2x00pci_register_multiwrite(rt2x00dev, MAC_WCID_ENTRY(i),
+                                              wcid, sizeof(wcid));
+
+                rt2x00pci_register_write(rt2x00dev, MAC_WCID_ATTR_ENTRY(i), 1);
+                rt2x00pci_register_write(rt2x00dev, MAC_IVEIV_ENTRY(i), 0);
+        }
+
+        /*
+         * Clear all beacons
+         * For the Beacon base registers we only need to clear
+         * the first byte since that byte contains the VALID and OWNER
+         * bits which (when set to 0) will invalidate the entire beacon.
+         */
+        rt2x00pci_register_write(rt2x00dev, HW_BEACON_BASE0, 0);
+        rt2x00pci_register_write(rt2x00dev, HW_BEACON_BASE1, 0);
+        rt2x00pci_register_write(rt2x00dev, HW_BEACON_BASE2, 0);
+        rt2x00pci_register_write(rt2x00dev, HW_BEACON_BASE3, 0);
+        rt2x00pci_register_write(rt2x00dev, HW_BEACON_BASE4, 0);
+        rt2x00pci_register_write(rt2x00dev, HW_BEACON_BASE5, 0);
+        rt2x00pci_register_write(rt2x00dev, HW_BEACON_BASE6, 0);
+        rt2x00pci_register_write(rt2x00dev, HW_BEACON_BASE7, 0);
+
+        rt2x00pci_register_read(rt2x00dev, HT_FBK_CFG0, &reg);
+        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS0FBK, 0);
+        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS1FBK, 0);
+        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS2FBK, 1);
+        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS3FBK, 2);
+        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS4FBK, 3);
+        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS5FBK, 4);
+        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS6FBK, 5);
+        rt2x00_set_field32(&reg, HT_FBK_CFG0_HTMCS7FBK, 6);
+        rt2x00pci_register_write(rt2x00dev, HT_FBK_CFG0, reg);
+
+        rt2x00pci_register_read(rt2x00dev, HT_FBK_CFG1, &reg);
+        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS8FBK, 8);
+        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS9FBK, 8);
+        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS10FBK, 9);
+        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS11FBK, 10);
+        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS12FBK, 11);
+        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS13FBK, 12);
+        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS14FBK, 13);
+        rt2x00_set_field32(&reg, HT_FBK_CFG1_HTMCS15FBK, 14);
+        rt2x00pci_register_write(rt2x00dev, HT_FBK_CFG1, reg);
+
+        rt2x00pci_register_read(rt2x00dev, LG_FBK_CFG0, &reg);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS0FBK, 8);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS1FBK, 8);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS2FBK, 9);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS3FBK, 10);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS4FBK, 11);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS5FBK, 12);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS6FBK, 13);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_OFDMMCS7FBK, 14);
+        rt2x00pci_register_write(rt2x00dev, LG_FBK_CFG0, reg);
+
+        rt2x00pci_register_read(rt2x00dev, LG_FBK_CFG1, &reg);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_CCKMCS0FBK, 0);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_CCKMCS1FBK, 0);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_CCKMCS2FBK, 1);
+        rt2x00_set_field32(&reg, LG_FBK_CFG0_CCKMCS3FBK, 2);
+        rt2x00pci_register_write(rt2x00dev, LG_FBK_CFG1, reg);
+
+        /*
+         * We must clear the error counters.
+         * These registers are cleared on read,
+         * so we may pass a useless variable to store the value.
+         */
+        rt2x00pci_register_read(rt2x00dev, RX_STA_CNT0, &reg);
+        rt2x00pci_register_read(rt2x00dev, RX_STA_CNT1, &reg);
+        rt2x00pci_register_read(rt2x00dev, RX_STA_CNT2, &reg);
+        rt2x00pci_register_read(rt2x00dev, TX_STA_CNT0, &reg);
+        rt2x00pci_register_read(rt2x00dev, TX_STA_CNT1, &reg);
+        rt2x00pci_register_read(rt2x00dev, TX_STA_CNT2, &reg);
+
+        return 0;
+}
+
+static int rt2800pci_wait_bbp_rf_ready(struct rt2x00_dev *rt2x00dev)
+{
+        unsigned int i;
+        u32 reg;
+
+        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+                rt2x00pci_register_read(rt2x00dev, MAC_STATUS_CFG, &reg);
+                if (!rt2x00_get_field32(reg, MAC_STATUS_CFG_BBP_RF_BUSY))
+                        return 0;
+
+                udelay(REGISTER_BUSY_DELAY);
+        }
+
+        ERROR(rt2x00dev, "BBP/RF register access failed, aborting.\n");
+        return -EACCES;
+}
+
+static int rt2800pci_wait_bbp_ready(struct rt2x00_dev *rt2x00dev)
+{
+        unsigned int i;
+        u8 value;
+
+        /*
+         * BBP was enabled after firmware was loaded,
+         * but we need to reactivate it now.
+         */
+        rt2x00pci_register_write(rt2x00dev, H2M_BBP_AGENT, 0);
+        rt2x00pci_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
+        msleep(1);
+
+        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+                rt2800pci_bbp_read(rt2x00dev, 0, &value);
+                if ((value != 0xff) && (value != 0x00))
+                        return 0;
+                udelay(REGISTER_BUSY_DELAY);
+        }
+
+        ERROR(rt2x00dev, "BBP register access failed, aborting.\n");
+        return -EACCES;
+}
+
+static int rt2800pci_init_bbp(struct rt2x00_dev *rt2x00dev)
+{
+        unsigned int i;
+        u16 eeprom;
+        u8 reg_id;
+        u8 value;
+
+        if (unlikely(rt2800pci_wait_bbp_rf_ready(rt2x00dev) ||
+                     rt2800pci_wait_bbp_ready(rt2x00dev)))
+                return -EACCES;
+
+        rt2800pci_bbp_write(rt2x00dev, 65, 0x2c);
+        rt2800pci_bbp_write(rt2x00dev, 66, 0x38);
+        rt2800pci_bbp_write(rt2x00dev, 69, 0x12);
+        rt2800pci_bbp_write(rt2x00dev, 70, 0x0a);
+        rt2800pci_bbp_write(rt2x00dev, 73, 0x10);
+        rt2800pci_bbp_write(rt2x00dev, 81, 0x37);
+        rt2800pci_bbp_write(rt2x00dev, 82, 0x62);
+        rt2800pci_bbp_write(rt2x00dev, 83, 0x6a);
+        rt2800pci_bbp_write(rt2x00dev, 84, 0x99);
+        rt2800pci_bbp_write(rt2x00dev, 86, 0x00);
+        rt2800pci_bbp_write(rt2x00dev, 91, 0x04);
+        rt2800pci_bbp_write(rt2x00dev, 92, 0x00);
+        rt2800pci_bbp_write(rt2x00dev, 103, 0x00);
+        rt2800pci_bbp_write(rt2x00dev, 105, 0x05);
+
+        if (rt2x00_rev(&rt2x00dev->chip) == RT2860C_VERSION) {
+                rt2800pci_bbp_write(rt2x00dev, 69, 0x16);
+                rt2800pci_bbp_write(rt2x00dev, 73, 0x12);
+        }
+
+        if (rt2x00_rev(&rt2x00dev->chip) > RT2860D_VERSION)
+                rt2800pci_bbp_write(rt2x00dev, 84, 0x19);
+
+        if (rt2x00_rt(&rt2x00dev->chip, RT3052)) {
+                rt2800pci_bbp_write(rt2x00dev, 31, 0x08);
+                rt2800pci_bbp_write(rt2x00dev, 78, 0x0e);
+                rt2800pci_bbp_write(rt2x00dev, 80, 0x08);
+        }
+
+        for (i = 0; i < EEPROM_BBP_SIZE; i++) {
+                rt2x00_eeprom_read(rt2x00dev, EEPROM_BBP_START + i, &eeprom);
+
+                if (eeprom != 0xffff && eeprom != 0x0000) {
+                        reg_id = rt2x00_get_field16(eeprom, EEPROM_BBP_REG_ID);
+                        value = rt2x00_get_field16(eeprom, EEPROM_BBP_VALUE);
+                        rt2800pci_bbp_write(rt2x00dev, reg_id, value);
+                }
+        }
+
+        return 0;
+}
+
+static u8 rt2800pci_init_rx_filter(struct rt2x00_dev *rt2x00dev,
+                                   bool bw40, u8 rfcsr24, u8 filter_target)
+{
+        unsigned int i;
+        u8 bbp;
+        u8 rfcsr;
+        u8 passband;
+        u8 stopband;
+        u8 overtuned = 0;
+
+        rt2800pci_rfcsr_write(rt2x00dev, 24, rfcsr24);
+
+        rt2800pci_bbp_read(rt2x00dev, 4, &bbp);
+        rt2x00_set_field8(&bbp, BBP4_BANDWIDTH, 2 * bw40);
+        rt2800pci_bbp_write(rt2x00dev, 4, bbp);
+
+        rt2800pci_rfcsr_read(rt2x00dev, 22, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR22_BASEBAND_LOOPBACK, 1);
+        rt2800pci_rfcsr_write(rt2x00dev, 22, rfcsr);
+
+        /*
+         * Set power & frequency of passband test tone
+         */
+        rt2800pci_bbp_write(rt2x00dev, 24, 0);
+
+        for (i = 0; i < 100; i++) {
+                rt2800pci_bbp_write(rt2x00dev, 25, 0x90);
+                msleep(1);
+
+                rt2800pci_bbp_read(rt2x00dev, 55, &passband);
+                if (passband)
+                        break;
+        }
+
+        /*
+         * Set power & frequency of stopband test tone
+         */
+        rt2800pci_bbp_write(rt2x00dev, 24, 0x06);
+
+        for (i = 0; i < 100; i++) {
+                rt2800pci_bbp_write(rt2x00dev, 25, 0x90);
+                msleep(1);
+
+                rt2800pci_bbp_read(rt2x00dev, 55, &stopband);
+
+                if ((passband - stopband) <= filter_target) {
+                        rfcsr24++;
+                        overtuned += ((passband - stopband) == filter_target);
+                } else
+                        break;
+
+                rt2800pci_rfcsr_write(rt2x00dev, 24, rfcsr24);
+        }
+
+        rfcsr24 -= !!overtuned;
+
+        rt2800pci_rfcsr_write(rt2x00dev, 24, rfcsr24);
+        return rfcsr24;
+}
+
+static int rt2800pci_init_rfcsr(struct rt2x00_dev *rt2x00dev)
+{
+        u8 rfcsr;
+        u8 bbp;
+
+        if (!rt2x00_rf(&rt2x00dev->chip, RF3020) &&
+            !rt2x00_rf(&rt2x00dev->chip, RF3021) &&
+            !rt2x00_rf(&rt2x00dev->chip, RF3022))
+                return 0;
+
+        /*
+         * Init RF calibration.
+         */
+        rt2800pci_rfcsr_read(rt2x00dev, 30, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR30_RF_CALIBRATION, 1);
+        rt2800pci_rfcsr_write(rt2x00dev, 30, rfcsr);
+        msleep(1);
+        rt2x00_set_field8(&rfcsr, RFCSR30_RF_CALIBRATION, 0);
+        rt2800pci_rfcsr_write(rt2x00dev, 30, rfcsr);
+
+        rt2800pci_rfcsr_write(rt2x00dev, 0, 0x50);
+        rt2800pci_rfcsr_write(rt2x00dev, 1, 0x01);
+        rt2800pci_rfcsr_write(rt2x00dev, 2, 0xf7);
+        rt2800pci_rfcsr_write(rt2x00dev, 3, 0x75);
+        rt2800pci_rfcsr_write(rt2x00dev, 4, 0x40);
+        rt2800pci_rfcsr_write(rt2x00dev, 5, 0x03);
+        rt2800pci_rfcsr_write(rt2x00dev, 6, 0x02);
+        rt2800pci_rfcsr_write(rt2x00dev, 7, 0x50);
+        rt2800pci_rfcsr_write(rt2x00dev, 8, 0x39);
+        rt2800pci_rfcsr_write(rt2x00dev, 9, 0x0f);
+        rt2800pci_rfcsr_write(rt2x00dev, 10, 0x60);
+        rt2800pci_rfcsr_write(rt2x00dev, 11, 0x21);
+        rt2800pci_rfcsr_write(rt2x00dev, 12, 0x75);
+        rt2800pci_rfcsr_write(rt2x00dev, 13, 0x75);
+        rt2800pci_rfcsr_write(rt2x00dev, 14, 0x90);
+        rt2800pci_rfcsr_write(rt2x00dev, 15, 0x58);
+        rt2800pci_rfcsr_write(rt2x00dev, 16, 0xb3);
+        rt2800pci_rfcsr_write(rt2x00dev, 17, 0x92);
+        rt2800pci_rfcsr_write(rt2x00dev, 18, 0x2c);
+        rt2800pci_rfcsr_write(rt2x00dev, 19, 0x02);
+        rt2800pci_rfcsr_write(rt2x00dev, 20, 0xba);
+        rt2800pci_rfcsr_write(rt2x00dev, 21, 0xdb);
+        rt2800pci_rfcsr_write(rt2x00dev, 22, 0x00);
+        rt2800pci_rfcsr_write(rt2x00dev, 23, 0x31);
+        rt2800pci_rfcsr_write(rt2x00dev, 24, 0x08);
+        rt2800pci_rfcsr_write(rt2x00dev, 25, 0x01);
+        rt2800pci_rfcsr_write(rt2x00dev, 26, 0x25);
+        rt2800pci_rfcsr_write(rt2x00dev, 27, 0x23);
+        rt2800pci_rfcsr_write(rt2x00dev, 28, 0x13);
+        rt2800pci_rfcsr_write(rt2x00dev, 29, 0x83);
+
+        /*
+         * Set RX Filter calibration for 20MHz and 40MHz
+         */
+        rt2x00dev->calibration[0] =
+            rt2800pci_init_rx_filter(rt2x00dev, false, 0x07, 0x16);
+        rt2x00dev->calibration[1] =
+            rt2800pci_init_rx_filter(rt2x00dev, true, 0x27, 0x19);
+
+        /*
+         * Set back to initial state
+         */
+        rt2800pci_bbp_write(rt2x00dev, 24, 0);
+
+        rt2800pci_rfcsr_read(rt2x00dev, 22, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR22_BASEBAND_LOOPBACK, 0);
+        rt2800pci_rfcsr_write(rt2x00dev, 22, rfcsr);
+
+        /*
+         * set BBP back to BW20
+         */
+        rt2800pci_bbp_read(rt2x00dev, 4, &bbp);
+        rt2x00_set_field8(&bbp, BBP4_BANDWIDTH, 0);
+        rt2800pci_bbp_write(rt2x00dev, 4, bbp);
+
+        return 0;
+}
+
+/*
+ * Device state switch handlers.
+ */
+static void rt2800pci_toggle_rx(struct rt2x00_dev *rt2x00dev,
+                                enum dev_state state)
+{
+        u32 reg;
+
+        rt2x00pci_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_RX,
+                           (state == STATE_RADIO_RX_ON) ||
+                           (state == STATE_RADIO_RX_ON_LINK));
+        rt2x00pci_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
+}
+
+static void rt2800pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
+                                 enum dev_state state)
+{
+        int mask = (state == STATE_RADIO_IRQ_ON);
+        u32 reg;
+
+        /*
+         * When interrupts are being enabled, the interrupt registers
+         * should clear the register to assure a clean state.
+         */
+        if (state == STATE_RADIO_IRQ_ON) {
+                rt2x00pci_register_read(rt2x00dev, INT_SOURCE_CSR, &reg);
+                rt2x00pci_register_write(rt2x00dev, INT_SOURCE_CSR, reg);
+        }
+
+        rt2x00pci_register_read(rt2x00dev, INT_MASK_CSR, &reg);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_RXDELAYINT, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_TXDELAYINT, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_RX_DONE, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_AC0_DMA_DONE, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_AC1_DMA_DONE, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_AC2_DMA_DONE, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_AC3_DMA_DONE, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_HCCA_DMA_DONE, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_MGMT_DMA_DONE, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_MCU_COMMAND, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_RXTX_COHERENT, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_TBTT, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_PRE_TBTT, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_TX_FIFO_STATUS, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_AUTO_WAKEUP, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_GPTIMER, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_RX_COHERENT, mask);
+        rt2x00_set_field32(&reg, INT_MASK_CSR_TX_COHERENT, mask);
+        rt2x00pci_register_write(rt2x00dev, INT_MASK_CSR, reg);
+}
+
+static int rt2800pci_wait_wpdma_ready(struct rt2x00_dev *rt2x00dev)
+{
+        unsigned int i;
+        u32 reg;
+
+        for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+                rt2x00pci_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
+                if (!rt2x00_get_field32(reg, WPDMA_GLO_CFG_TX_DMA_BUSY) &&
+                    !rt2x00_get_field32(reg, WPDMA_GLO_CFG_RX_DMA_BUSY))
+                        return 0;
+
+                msleep(1);
+        }
+
+        ERROR(rt2x00dev, "WPDMA TX/RX busy, aborting.\n");
+        return -EACCES;
+}
+
+static int rt2800pci_enable_radio(struct rt2x00_dev *rt2x00dev)
+{
+        u32 reg;
+        u16 word;
+
+        /*
+         * Initialize all registers.
+         */
+        if (unlikely(rt2800pci_wait_wpdma_ready(rt2x00dev) ||
+                     rt2800pci_init_queues(rt2x00dev) ||
+                     rt2800pci_init_registers(rt2x00dev) ||
+                     rt2800pci_wait_wpdma_ready(rt2x00dev) ||
+                     rt2800pci_init_bbp(rt2x00dev) ||
+                     rt2800pci_init_rfcsr(rt2x00dev)))
+                return -EIO;
+
+        /*
+         * Send signal to firmware during boot time.
+         */
+        rt2800pci_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0xff, 0, 0);
+
+        /*
+         * Enable RX.
+         */
+        rt2x00pci_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_TX, 1);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_RX, 0);
+        rt2x00pci_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
+
+        rt2x00pci_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 1);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 1);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_WP_DMA_BURST_SIZE, 2);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_WRITEBACK_DONE, 1);
+        rt2x00pci_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
+
+        rt2x00pci_register_read(rt2x00dev, MAC_SYS_CTRL, &reg);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_TX, 1);
+        rt2x00_set_field32(&reg, MAC_SYS_CTRL_ENABLE_RX, 1);
+        rt2x00pci_register_write(rt2x00dev, MAC_SYS_CTRL, reg);
+
+        /*
+         * Initialize LED control
+         */
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_LED1, &word);
+        rt2800pci_mcu_request(rt2x00dev, MCU_LED_1, 0xff,
+                              word & 0xff, (word >> 8) & 0xff);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_LED2, &word);
+        rt2800pci_mcu_request(rt2x00dev, MCU_LED_2, 0xff,
+                              word & 0xff, (word >> 8) & 0xff);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_LED3, &word);
+        rt2800pci_mcu_request(rt2x00dev, MCU_LED_3, 0xff,
+                              word & 0xff, (word >> 8) & 0xff);
+
+        return 0;
+}
+
+static void rt2800pci_disable_radio(struct rt2x00_dev *rt2x00dev)
+{
+        u32 reg;
+
+        rt2x00pci_register_read(rt2x00dev, WPDMA_GLO_CFG, &reg);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_TX_DMA, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_DMA_BUSY, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_ENABLE_RX_DMA, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_RX_DMA_BUSY, 0);
+        rt2x00_set_field32(&reg, WPDMA_GLO_CFG_TX_WRITEBACK_DONE, 1);
+        rt2x00pci_register_write(rt2x00dev, WPDMA_GLO_CFG, reg);
+
+        rt2x00pci_register_write(rt2x00dev, MAC_SYS_CTRL, 0);
+        rt2x00pci_register_write(rt2x00dev, PWR_PIN_CFG, 0);
+        rt2x00pci_register_write(rt2x00dev, TX_PIN_CFG, 0);
+
+        rt2x00pci_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00001280);
+
+        rt2x00pci_register_read(rt2x00dev, WPDMA_RST_IDX, &reg);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX0, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX1, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX2, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX3, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX4, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX5, 1);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DRX_IDX0, 1);
+        rt2x00pci_register_write(rt2x00dev, WPDMA_RST_IDX, reg);
+
+        rt2x00pci_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000e1f);
+        rt2x00pci_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000e00);
+
+        /* Wait for DMA, ignore error */
+        rt2800pci_wait_wpdma_ready(rt2x00dev);
+}
+
+static int rt2800pci_set_state(struct rt2x00_dev *rt2x00dev,
+                               enum dev_state state)
+{
+        /*
+         * Always put the device to sleep (even when we intend to wakeup!)
+         * if the device is booting and wasn't asleep it will return
+         * failure when attempting to wakeup.
+         */
+        rt2800pci_mcu_request(rt2x00dev, MCU_SLEEP, 0xff, 0, 2);
+
+        if (state == STATE_AWAKE) {
+                rt2800pci_mcu_request(rt2x00dev, MCU_WAKEUP, TOKEN_WAKUP, 0, 0);
+                rt2800pci_mcu_status(rt2x00dev, TOKEN_WAKUP);
+        }
+
+        return 0;
+}
+
+static int rt2800pci_set_device_state(struct rt2x00_dev *rt2x00dev,
+                                      enum dev_state state)
+{
+        int retval = 0;
+
+        switch (state) {
+        case STATE_RADIO_ON:
+                /*
+                 * Before the radio can be enabled, the device first has
+                 * to be woken up. After that it needs a bit of time
+                 * to be fully awake and then the radio can be enabled.
+                 */
+                rt2800pci_set_state(rt2x00dev, STATE_AWAKE);
+                msleep(1);
+                retval = rt2800pci_enable_radio(rt2x00dev);
+                break;
+        case STATE_RADIO_OFF:
+                /*
+                 * After the radio has been disabled, the device should
+                 * be put to sleep for powersaving.
+                 */
+                rt2800pci_disable_radio(rt2x00dev);
+                rt2800pci_set_state(rt2x00dev, STATE_SLEEP);
+                break;
+        case STATE_RADIO_RX_ON:
+        case STATE_RADIO_RX_ON_LINK:
+        case STATE_RADIO_RX_OFF:
+        case STATE_RADIO_RX_OFF_LINK:
+                rt2800pci_toggle_rx(rt2x00dev, state);
+                break;
+        case STATE_RADIO_IRQ_ON:
+        case STATE_RADIO_IRQ_OFF:
+                rt2800pci_toggle_irq(rt2x00dev, state);
+                break;
+        case STATE_DEEP_SLEEP:
+        case STATE_SLEEP:
+        case STATE_STANDBY:
+        case STATE_AWAKE:
+                retval = rt2800pci_set_state(rt2x00dev, state);
+                break;
+        default:
+                retval = -ENOTSUPP;
+                break;
+        }
+
+        if (unlikely(retval))
+                ERROR(rt2x00dev, "Device failed to enter state %d (%d).\n",
+                      state, retval);
+
+        return retval;
+}
+
+/*
+ * TX descriptor initialization
+ */
+static void rt2800pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
+                                    struct sk_buff *skb,
+                                    struct txentry_desc *txdesc)
+{
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
+        __le32 *txd = skbdesc->desc;
+        __le32 *txwi = (__le32 *)(skb->data - rt2x00dev->hw->extra_tx_headroom);
+        u32 word;
+
+        /*
+         * Initialize TX Info descriptor
+         */
+        rt2x00_desc_read(txwi, 0, &word);
+        rt2x00_set_field32(&word, TXWI_W0_FRAG,
+                           test_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W0_MIMO_PS, 0);
+        rt2x00_set_field32(&word, TXWI_W0_CF_ACK, 0);
+        rt2x00_set_field32(&word, TXWI_W0_TS,
+                           test_bit(ENTRY_TXD_REQ_TIMESTAMP, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W0_AMPDU,
+                           test_bit(ENTRY_TXD_HT_AMPDU, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W0_MPDU_DENSITY, txdesc->mpdu_density);
+        rt2x00_set_field32(&word, TXWI_W0_TX_OP, txdesc->ifs);
+        rt2x00_set_field32(&word, TXWI_W0_MCS, txdesc->mcs);
+        rt2x00_set_field32(&word, TXWI_W0_BW,
+                           test_bit(ENTRY_TXD_HT_BW_40, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W0_SHORT_GI,
+                           test_bit(ENTRY_TXD_HT_SHORT_GI, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W0_STBC, txdesc->stbc);
+        rt2x00_set_field32(&word, TXWI_W0_PHYMODE, txdesc->rate_mode);
+        rt2x00_desc_write(txwi, 0, word);
+
+        rt2x00_desc_read(txwi, 1, &word);
+        rt2x00_set_field32(&word, TXWI_W1_ACK,
+                           test_bit(ENTRY_TXD_ACK, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W1_NSEQ,
+                           test_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags));
+        rt2x00_set_field32(&word, TXWI_W1_BW_WIN_SIZE, txdesc->ba_size);
+        rt2x00_set_field32(&word, TXWI_W1_WIRELESS_CLI_ID,
+                           test_bit(ENTRY_TXD_ENCRYPT, &txdesc->flags) ?
+                               (skbdesc->entry->entry_idx + 1) : 0xff);
+        rt2x00_set_field32(&word, TXWI_W1_MPDU_TOTAL_BYTE_COUNT,
+                           skb->len - txdesc->l2pad);
+        rt2x00_set_field32(&word, TXWI_W1_PACKETID,
+                           skbdesc->entry->queue->qid + 1);
+        rt2x00_desc_write(txwi, 1, word);
+
+        /*
+         * Always write 0 to IV/EIV fields, hardware will insert the IV
+         * from the IVEIV register when ENTRY_TXD_ENCRYPT_IV is set to 0.
+         * When ENTRY_TXD_ENCRYPT_IV is set to 1 it will use the IV data
+         * from the descriptor. The TXWI_W1_WIRELESS_CLI_ID indicates which
+         * crypto entry in the registers should be used to encrypt the frame.
+         */
+        _rt2x00_desc_write(txwi, 2, 0 /* skbdesc->iv[0] */);
+        _rt2x00_desc_write(txwi, 3, 0 /* skbdesc->iv[1] */);
+
+        /*
+         * The buffers pointed by SD_PTR0/SD_LEN0 and SD_PTR1/SD_LEN1
+         * must contains a TXWI structure + 802.11 header + padding + 802.11
+         * data. We choose to have SD_PTR0/SD_LEN0 only contains TXWI and
+         * SD_PTR1/SD_LEN1 contains 802.11 header + padding + 802.11
+         * data. It means that LAST_SEC0 is always 0.
+         */
+
+        /*
+         * Initialize TX descriptor
+         */
+        rt2x00_desc_read(txd, 0, &word);
+        rt2x00_set_field32(&word, TXD_W0_SD_PTR0, skbdesc->skb_dma);
+        rt2x00_desc_write(txd, 0, word);
+
+        rt2x00_desc_read(txd, 1, &word);
+        rt2x00_set_field32(&word, TXD_W1_SD_LEN1, skb->len);
+        rt2x00_set_field32(&word, TXD_W1_LAST_SEC1,
+                           !test_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags));
+        rt2x00_set_field32(&word, TXD_W1_BURST,
+                           test_bit(ENTRY_TXD_BURST, &txdesc->flags));
+        rt2x00_set_field32(&word, TXD_W1_SD_LEN0,
+                           rt2x00dev->hw->extra_tx_headroom);
+        rt2x00_set_field32(&word, TXD_W1_LAST_SEC0, 0);
+        rt2x00_set_field32(&word, TXD_W1_DMA_DONE, 0);
+        rt2x00_desc_write(txd, 1, word);
+
+        rt2x00_desc_read(txd, 2, &word);
+        rt2x00_set_field32(&word, TXD_W2_SD_PTR1,
+                           skbdesc->skb_dma + rt2x00dev->hw->extra_tx_headroom);
+        rt2x00_desc_write(txd, 2, word);
+
+        rt2x00_desc_read(txd, 3, &word);
+        rt2x00_set_field32(&word, TXD_W3_WIV,
+                           !test_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc->flags));
+        rt2x00_set_field32(&word, TXD_W3_QSEL, 2);
+        rt2x00_desc_write(txd, 3, word);
+}
+
+/*
+ * TX data initialization
+ */
+static void rt2800pci_write_beacon(struct queue_entry *entry)
+{
+        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
+        unsigned int beacon_base;
+        u32 reg;
+
+        /*
+         * Disable beaconing while we are reloading the beacon data,
+         * otherwise we might be sending out invalid data.
+         */
+        rt2x00pci_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 0);
+        rt2x00pci_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+
+        /*
+         * Write entire beacon with descriptor to register.
+         */
+        beacon_base = HW_BEACON_OFFSET(entry->entry_idx);
+        rt2x00pci_register_multiwrite(rt2x00dev,
+                                      beacon_base,
+                                      skbdesc->desc, skbdesc->desc_len);
+        rt2x00pci_register_multiwrite(rt2x00dev,
+                                      beacon_base + skbdesc->desc_len,
+                                      entry->skb->data, entry->skb->len);
+
+        /*
+         * Clean up beacon skb.
+         */
+        dev_kfree_skb_any(entry->skb);
+        entry->skb = NULL;
+}
+
+static void rt2800pci_kick_tx_queue(struct rt2x00_dev *rt2x00dev,
+                                    const enum data_queue_qid queue_idx)
+{
+        struct data_queue *queue;
+        unsigned int idx, qidx = 0;
+        u32 reg;
+
+        if (queue_idx == QID_BEACON) {
+                rt2x00pci_register_read(rt2x00dev, BCN_TIME_CFG, &reg);
+                if (!rt2x00_get_field32(reg, BCN_TIME_CFG_BEACON_GEN)) {
+                        rt2x00_set_field32(&reg, BCN_TIME_CFG_TSF_TICKING, 1);
+                        rt2x00_set_field32(&reg, BCN_TIME_CFG_TBTT_ENABLE, 1);
+                        rt2x00_set_field32(&reg, BCN_TIME_CFG_BEACON_GEN, 1);
+                        rt2x00pci_register_write(rt2x00dev, BCN_TIME_CFG, reg);
+                }
+                return;
+        }
+
+        if (queue_idx > QID_HCCA && queue_idx != QID_MGMT)
+                return;
+
+        queue = rt2x00queue_get_queue(rt2x00dev, queue_idx);
+        idx = queue->index[Q_INDEX];
+
+        if (queue_idx == QID_MGMT)
+                qidx = 5;
+        else
+                qidx = queue_idx;
+
+        rt2x00pci_register_write(rt2x00dev, TX_CTX_IDX(qidx), idx);
+}
+
+static void rt2800pci_kill_tx_queue(struct rt2x00_dev *rt2x00dev,
+                                    const enum data_queue_qid qid)
+{
+        u32 reg;
+
+        if (qid == QID_BEACON) {
+                rt2x00pci_register_write(rt2x00dev, BCN_TIME_CFG, 0);
+                return;
+        }
+
+        rt2x00pci_register_read(rt2x00dev, WPDMA_RST_IDX, &reg);
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX0, (qid == QID_AC_BE));
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX1, (qid == QID_AC_BK));
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX2, (qid == QID_AC_VI));
+        rt2x00_set_field32(&reg, WPDMA_RST_IDX_DTX_IDX3, (qid == QID_AC_VO));
+        rt2x00pci_register_write(rt2x00dev, WPDMA_RST_IDX, reg);
+}
+
+/*
+ * RX control handlers
+ */
+static void rt2800pci_fill_rxdone(struct queue_entry *entry,
+                                  struct rxdone_entry_desc *rxdesc)
+{
+        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
+        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
+        __le32 *rxd = entry_priv->desc;
+        __le32 *rxwi = (__le32 *)entry->skb->data;
+        u32 rxd3;
+        u32 rxwi0;
+        u32 rxwi1;
+        u32 rxwi2;
+        u32 rxwi3;
+
+        rt2x00_desc_read(rxd, 3, &rxd3);
+        rt2x00_desc_read(rxwi, 0, &rxwi0);
+        rt2x00_desc_read(rxwi, 1, &rxwi1);
+        rt2x00_desc_read(rxwi, 2, &rxwi2);
+        rt2x00_desc_read(rxwi, 3, &rxwi3);
+
+        if (rt2x00_get_field32(rxd3, RXD_W3_CRC_ERROR))
+                rxdesc->flags |= RX_FLAG_FAILED_FCS_CRC;
+
+        if (test_bit(CONFIG_SUPPORT_HW_CRYPTO, &rt2x00dev->flags)) {
+                /*
+                 * Unfortunately we don't know the cipher type used during
+                 * decryption. This prevents us from correct providing
+                 * correct statistics through debugfs.
+                 */
+                rxdesc->cipher = rt2x00_get_field32(rxwi0, RXWI_W0_UDF);
+                rxdesc->cipher_status =
+                    rt2x00_get_field32(rxd3, RXD_W3_CIPHER_ERROR);
+        }
+
+        if (rt2x00_get_field32(rxd3, RXD_W3_DECRYPTED)) {
+                /*
+                 * Hardware has stripped IV/EIV data from 802.11 frame during
+                 * decryption. Unfortunately the descriptor doesn't contain
+                 * any fields with the EIV/IV data either, so they can't
+                 * be restored by rt2x00lib.
+                 */
+                rxdesc->flags |= RX_FLAG_IV_STRIPPED;
+
+                if (rxdesc->cipher_status == RX_CRYPTO_SUCCESS)
+                        rxdesc->flags |= RX_FLAG_DECRYPTED;
+                else if (rxdesc->cipher_status == RX_CRYPTO_FAIL_MIC)
+                        rxdesc->flags |= RX_FLAG_MMIC_ERROR;
+        }
+
+        if (rt2x00_get_field32(rxd3, RXD_W3_MY_BSS))
+                rxdesc->dev_flags |= RXDONE_MY_BSS;
+
+        if (rt2x00_get_field32(rxd3, RXD_W3_L2PAD)) {
+                rxdesc->dev_flags |= RXDONE_L2PAD;
+                skbdesc->flags |= SKBDESC_L2_PADDED;
+        }
+
+        if (rt2x00_get_field32(rxwi1, RXWI_W1_SHORT_GI))
+                rxdesc->flags |= RX_FLAG_SHORT_GI;
+
+        if (rt2x00_get_field32(rxwi1, RXWI_W1_BW))
+                rxdesc->flags |= RX_FLAG_40MHZ;
+
+        /*
+         * Detect RX rate, always use MCS as signal type.
+         */
+        rxdesc->dev_flags |= RXDONE_SIGNAL_MCS;
+        rxdesc->rate_mode = rt2x00_get_field32(rxwi1, RXWI_W1_PHYMODE);
+        rxdesc->signal = rt2x00_get_field32(rxwi1, RXWI_W1_MCS);
+
+        /*
+         * Mask of 0x8 bit to remove the short preamble flag.
+         */
+        if (rxdesc->rate_mode == RATE_MODE_CCK)
+                rxdesc->signal &= ~0x8;
+
+        rxdesc->rssi =
+            (rt2x00_get_field32(rxwi2, RXWI_W2_RSSI0) +
+             rt2x00_get_field32(rxwi2, RXWI_W2_RSSI1)) / 2;
+
+        rxdesc->noise =
+            (rt2x00_get_field32(rxwi3, RXWI_W3_SNR0) +
+             rt2x00_get_field32(rxwi3, RXWI_W3_SNR1)) / 2;
+
+        rxdesc->size = rt2x00_get_field32(rxwi0, RXWI_W0_MPDU_TOTAL_BYTE_COUNT);
+
+        /*
+         * Set RX IDX in register to inform hardware that we have handled
+         * this entry and it is available for reuse again.
+         */
+        rt2x00pci_register_write(rt2x00dev, RX_CRX_IDX, entry->entry_idx);
+
+        /*
+         * Remove TXWI descriptor from start of buffer.
+         */
+        skb_pull(entry->skb, RXWI_DESC_SIZE);
+        skb_trim(entry->skb, rxdesc->size);
+}
+
+/*
+ * Interrupt functions.
+ */
+static void rt2800pci_txdone(struct rt2x00_dev *rt2x00dev)
+{
+        struct data_queue *queue;
+        struct queue_entry *entry;
+        struct queue_entry *entry_done;
+        struct queue_entry_priv_pci *entry_priv;
+        struct txdone_entry_desc txdesc;
+        u32 word;
+        u32 reg;
+        u32 old_reg;
+        unsigned int type;
+        unsigned int index;
+        u16 mcs, real_mcs;
+
+        /*
+         * During each loop we will compare the freshly read
+         * TX_STA_FIFO register value with the value read from
+         * the previous loop. If the 2 values are equal then
+         * we should stop processing because the chance it
+         * quite big that the device has been unplugged and
+         * we risk going into an endless loop.
+         */
+        old_reg = 0;
+
+        while (1) {
+                rt2x00pci_register_read(rt2x00dev, TX_STA_FIFO, &reg);
+                if (!rt2x00_get_field32(reg, TX_STA_FIFO_VALID))
+                        break;
+
+                if (old_reg == reg)
+                        break;
+                old_reg = reg;
+
+                /*
+                 * Skip this entry when it contains an invalid
+                 * queue identication number.
+                 */
+                type = rt2x00_get_field32(reg, TX_STA_FIFO_PID_TYPE) - 1;
+                if (type >= QID_RX)
+                        continue;
+
+                queue = rt2x00queue_get_queue(rt2x00dev, type);
+                if (unlikely(!queue))
+                        continue;
+
+                /*
+                 * Skip this entry when it contains an invalid
+                 * index number.
+                 */
+                index = rt2x00_get_field32(reg, TX_STA_FIFO_WCID) - 1;
+                if (unlikely(index >= queue->limit))
+                        continue;
+
+                entry = &queue->entries[index];
+                entry_priv = entry->priv_data;
+                rt2x00_desc_read((__le32 *)entry->skb->data, 0, &word);
+
+                entry_done = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
+                while (entry != entry_done) {
+                        /*
+                         * Catch up.
+                         * Just report any entries we missed as failed.
+                         */
+                        WARNING(rt2x00dev,
+                                "TX status report missed for entry %d\n",
+                                entry_done->entry_idx);
+
+                        txdesc.flags = 0;
+                        __set_bit(TXDONE_UNKNOWN, &txdesc.flags);
+                        txdesc.retry = 0;
+
+                        rt2x00lib_txdone(entry_done, &txdesc);
+                        entry_done = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
+                }
+
+                /*
+                 * Obtain the status about this packet.
+                 */
+                txdesc.flags = 0;
+                if (rt2x00_get_field32(reg, TX_STA_FIFO_TX_SUCCESS))
+                        __set_bit(TXDONE_SUCCESS, &txdesc.flags);
+                else
+                        __set_bit(TXDONE_FAILURE, &txdesc.flags);
+
+                /*
+                 * Ralink has a retry mechanism using a global fallback
+                 * table. We setup this fallback table to try immediate
+                 * lower rate for all rates. In the TX_STA_FIFO,
+                 * the MCS field contains the MCS used for the successfull
+                 * transmission. If the first transmission succeed,
+                 * we have mcs == tx_mcs. On the second transmission,
+                 * we have mcs = tx_mcs - 1. So the number of
+                 * retry is (tx_mcs - mcs).
+                 */
+                mcs = rt2x00_get_field32(word, TXWI_W0_MCS);
+                real_mcs = rt2x00_get_field32(reg, TX_STA_FIFO_MCS);
+                __set_bit(TXDONE_FALLBACK, &txdesc.flags);
+                txdesc.retry = mcs - min(mcs, real_mcs);
+
+                rt2x00lib_txdone(entry, &txdesc);
+        }
+}
+
+static irqreturn_t rt2800pci_interrupt(int irq, void *dev_instance)
+{
+        struct rt2x00_dev *rt2x00dev = dev_instance;
+        u32 reg;
+
+        /* Read status and ACK all interrupts */
+        rt2x00pci_register_read(rt2x00dev, INT_SOURCE_CSR, &reg);
+        rt2x00pci_register_write(rt2x00dev, INT_SOURCE_CSR, reg);
+
+        if (!reg)
+                return IRQ_NONE;
+
+        if (!test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
+                return IRQ_HANDLED;
+
+        /*
+         * 1 - Rx ring done interrupt.
+         */
+        if (rt2x00_get_field32(reg, INT_SOURCE_CSR_RX_DONE))
+                rt2x00pci_rxdone(rt2x00dev);
+
+        if (rt2x00_get_field32(reg, INT_SOURCE_CSR_TX_FIFO_STATUS))
+                rt2800pci_txdone(rt2x00dev);
+
+        return IRQ_HANDLED;
+}
+
+/*
+ * Device probe functions.
+ */
+static int rt2800pci_validate_eeprom(struct rt2x00_dev *rt2x00dev)
+{
+        u16 word;
+        u8 *mac;
+        u8 default_lna_gain;
+
+        /*
+         * Read EEPROM into buffer
+         */
+        switch(rt2x00dev->chip.rt) {
+        case RT2880:
+        case RT3052:
+                rt2800pci_read_eeprom_soc(rt2x00dev);
+                break;
+        case RT3090:
+                rt2800pci_read_eeprom_efuse(rt2x00dev);
+                break;
+        default:
+                rt2800pci_read_eeprom_pci(rt2x00dev);
+                break;
+        }
+
+        /*
+         * Start validation of the data that has been read.
+         */
+        mac = rt2x00_eeprom_addr(rt2x00dev, EEPROM_MAC_ADDR_0);
+        if (!is_valid_ether_addr(mac)) {
+                random_ether_addr(mac);
+                EEPROM(rt2x00dev, "MAC: %pM\n", mac);
+        }
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_ANTENNA, &word);
+        if (word == 0xffff) {
+                rt2x00_set_field16(&word, EEPROM_ANTENNA_RXPATH, 2);
+                rt2x00_set_field16(&word, EEPROM_ANTENNA_TXPATH, 1);
+                rt2x00_set_field16(&word, EEPROM_ANTENNA_RF_TYPE, RF2820);
+                rt2x00_eeprom_write(rt2x00dev, EEPROM_ANTENNA, word);
+                EEPROM(rt2x00dev, "Antenna: 0x%04x\n", word);
+        } else if (rt2x00_rev(&rt2x00dev->chip) < RT2883_VERSION) {
+                /*
+                 * There is a max of 2 RX streams for RT2860 series
+                 */
+                if (rt2x00_get_field16(word, EEPROM_ANTENNA_RXPATH) > 2)
+                        rt2x00_set_field16(&word, EEPROM_ANTENNA_RXPATH, 2);
+                rt2x00_eeprom_write(rt2x00dev, EEPROM_ANTENNA, word);
+        }
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC, &word);
+        if (word == 0xffff) {
+                rt2x00_set_field16(&word, EEPROM_NIC_HW_RADIO, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_DYNAMIC_TX_AGC, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_EXTERNAL_LNA_BG, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_EXTERNAL_LNA_A, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_CARDBUS_ACCEL, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_BW40M_SB_BG, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_BW40M_SB_A, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_WPS_PBC, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_BW40M_BG, 0);
+                rt2x00_set_field16(&word, EEPROM_NIC_BW40M_A, 0);
+                rt2x00_eeprom_write(rt2x00dev, EEPROM_NIC, word);
+                EEPROM(rt2x00dev, "NIC: 0x%04x\n", word);
+        }
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_FREQ, &word);
+        if ((word & 0x00ff) == 0x00ff) {
+                rt2x00_set_field16(&word, EEPROM_FREQ_OFFSET, 0);
+                rt2x00_set_field16(&word, EEPROM_FREQ_LED_MODE,
+                                   LED_MODE_TXRX_ACTIVITY);
+                rt2x00_set_field16(&word, EEPROM_FREQ_LED_POLARITY, 0);
+                rt2x00_eeprom_write(rt2x00dev, EEPROM_FREQ, word);
+                rt2x00_eeprom_write(rt2x00dev, EEPROM_LED1, 0x5555);
+                rt2x00_eeprom_write(rt2x00dev, EEPROM_LED2, 0x2221);
+                rt2x00_eeprom_write(rt2x00dev, EEPROM_LED3, 0xa9f8);
+                EEPROM(rt2x00dev, "Freq: 0x%04x\n", word);
+        }
+
+        /*
+         * During the LNA validation we are going to use
+         * lna0 as correct value. Note that EEPROM_LNA
+         * is never validated.
+         */
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_LNA, &word);
+        default_lna_gain = rt2x00_get_field16(word, EEPROM_LNA_A0);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_BG, &word);
+        if (abs(rt2x00_get_field16(word, EEPROM_RSSI_BG_OFFSET0)) > 10)
+                rt2x00_set_field16(&word, EEPROM_RSSI_BG_OFFSET0, 0);
+        if (abs(rt2x00_get_field16(word, EEPROM_RSSI_BG_OFFSET1)) > 10)
+                rt2x00_set_field16(&word, EEPROM_RSSI_BG_OFFSET1, 0);
+        rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_BG, word);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_BG2, &word);
+        if (abs(rt2x00_get_field16(word, EEPROM_RSSI_BG2_OFFSET2)) > 10)
+                rt2x00_set_field16(&word, EEPROM_RSSI_BG2_OFFSET2, 0);
+        if (rt2x00_get_field16(word, EEPROM_RSSI_BG2_LNA_A1) == 0x00 ||
+            rt2x00_get_field16(word, EEPROM_RSSI_BG2_LNA_A1) == 0xff)
+                rt2x00_set_field16(&word, EEPROM_RSSI_BG2_LNA_A1,
+                                   default_lna_gain);
+        rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_BG2, word);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_A, &word);
+        if (abs(rt2x00_get_field16(word, EEPROM_RSSI_A_OFFSET0)) > 10)
+                rt2x00_set_field16(&word, EEPROM_RSSI_A_OFFSET0, 0);
+        if (abs(rt2x00_get_field16(word, EEPROM_RSSI_A_OFFSET1)) > 10)
+                rt2x00_set_field16(&word, EEPROM_RSSI_A_OFFSET1, 0);
+        rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_A, word);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_A2, &word);
+        if (abs(rt2x00_get_field16(word, EEPROM_RSSI_A2_OFFSET2)) > 10)
+                rt2x00_set_field16(&word, EEPROM_RSSI_A2_OFFSET2, 0);
+        if (rt2x00_get_field16(word, EEPROM_RSSI_A2_LNA_A2) == 0x00 ||
+            rt2x00_get_field16(word, EEPROM_RSSI_A2_LNA_A2) == 0xff)
+                rt2x00_set_field16(&word, EEPROM_RSSI_A2_LNA_A2,
+                                   default_lna_gain);
+        rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_A2, word);
+
+        return 0;
+}
+
+static int rt2800pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
+{
+        u32 reg;
+        u16 value;
+        u16 eeprom;
+
+        /*
+         * Read EEPROM word for configuration.
+         */
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_ANTENNA, &eeprom);
+
+        /*
+         * Identify RF chipset.
+         */
+        value = rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RF_TYPE);
+        rt2x00pci_register_read(rt2x00dev, MAC_CSR0, &reg);
+        rt2x00_set_chip_rf(rt2x00dev, value, reg);
+
+        if (!rt2x00_rf(&rt2x00dev->chip, RF2820) &&
+            !rt2x00_rf(&rt2x00dev->chip, RF2850) &&
+            !rt2x00_rf(&rt2x00dev->chip, RF2720) &&
+            !rt2x00_rf(&rt2x00dev->chip, RF2750) &&
+            !rt2x00_rf(&rt2x00dev->chip, RF3020) &&
+            !rt2x00_rf(&rt2x00dev->chip, RF2020) &&
+            !rt2x00_rf(&rt2x00dev->chip, RF3021) &&
+            !rt2x00_rf(&rt2x00dev->chip, RF3022)) {
+                ERROR(rt2x00dev, "Invalid RF chipset detected.\n");
+                return -ENODEV;
+        }
+
+        /*
+         * Identify default antenna configuration.
+         */
+        rt2x00dev->default_ant.tx =
+            rt2x00_get_field16(eeprom, EEPROM_ANTENNA_TXPATH);
+        rt2x00dev->default_ant.rx =
+            rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RXPATH);
+
+        /*
+         * Read frequency offset and RF programming sequence.
+         */
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_FREQ, &eeprom);
+        rt2x00dev->freq_offset = rt2x00_get_field16(eeprom, EEPROM_FREQ_OFFSET);
+
+        /*
+         * Read external LNA informations.
+         */
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC, &eeprom);
+
+        if (rt2x00_get_field16(eeprom, EEPROM_NIC_EXTERNAL_LNA_A))
+                __set_bit(CONFIG_EXTERNAL_LNA_A, &rt2x00dev->flags);
+        if (rt2x00_get_field16(eeprom, EEPROM_NIC_EXTERNAL_LNA_BG))
+                __set_bit(CONFIG_EXTERNAL_LNA_BG, &rt2x00dev->flags);
+
+        /*
+         * Detect if this device has an hardware controlled radio.
+         */
+        if (rt2x00_get_field16(eeprom, EEPROM_NIC_HW_RADIO))
+                __set_bit(CONFIG_SUPPORT_HW_BUTTON, &rt2x00dev->flags);
+
+        /*
+         * Store led settings, for correct led behaviour.
+         */
+#ifdef CONFIG_RT2X00_LIB_LEDS
+        rt2800pci_init_led(rt2x00dev, &rt2x00dev->led_radio, LED_TYPE_RADIO);
+        rt2800pci_init_led(rt2x00dev, &rt2x00dev->led_assoc, LED_TYPE_ASSOC);
+        rt2800pci_init_led(rt2x00dev, &rt2x00dev->led_qual, LED_TYPE_QUALITY);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_FREQ, &rt2x00dev->led_mcu_reg);
+#endif /* CONFIG_RT2X00_LIB_LEDS */
+
+        return 0;
+}
+
+/*
+ * RF value list for rt2860
+ * Supports: 2.4 GHz (all) & 5.2 GHz (RF2850 & RF2750)
+ */
+static const struct rf_channel rf_vals[] = {
+        { 1,  0x18402ecc, 0x184c0786, 0x1816b455, 0x1800510b },
+        { 2,  0x18402ecc, 0x184c0786, 0x18168a55, 0x1800519f },
+        { 3,  0x18402ecc, 0x184c078a, 0x18168a55, 0x1800518b },
+        { 4,  0x18402ecc, 0x184c078a, 0x18168a55, 0x1800519f },
+        { 5,  0x18402ecc, 0x184c078e, 0x18168a55, 0x1800518b },
+        { 6,  0x18402ecc, 0x184c078e, 0x18168a55, 0x1800519f },
+        { 7,  0x18402ecc, 0x184c0792, 0x18168a55, 0x1800518b },
+        { 8,  0x18402ecc, 0x184c0792, 0x18168a55, 0x1800519f },
+        { 9,  0x18402ecc, 0x184c0796, 0x18168a55, 0x1800518b },
+        { 10, 0x18402ecc, 0x184c0796, 0x18168a55, 0x1800519f },
+        { 11, 0x18402ecc, 0x184c079a, 0x18168a55, 0x1800518b },
+        { 12, 0x18402ecc, 0x184c079a, 0x18168a55, 0x1800519f },
+        { 13, 0x18402ecc, 0x184c079e, 0x18168a55, 0x1800518b },
+        { 14, 0x18402ecc, 0x184c07a2, 0x18168a55, 0x18005193 },
+
+        /* 802.11 UNI / HyperLan 2 */
+        { 36, 0x18402ecc, 0x184c099a, 0x18158a55, 0x180ed1a3 },
+        { 38, 0x18402ecc, 0x184c099e, 0x18158a55, 0x180ed193 },
+        { 40, 0x18402ec8, 0x184c0682, 0x18158a55, 0x180ed183 },
+        { 44, 0x18402ec8, 0x184c0682, 0x18158a55, 0x180ed1a3 },
+        { 46, 0x18402ec8, 0x184c0686, 0x18158a55, 0x180ed18b },
+        { 48, 0x18402ec8, 0x184c0686, 0x18158a55, 0x180ed19b },
+        { 52, 0x18402ec8, 0x184c068a, 0x18158a55, 0x180ed193 },
+        { 54, 0x18402ec8, 0x184c068a, 0x18158a55, 0x180ed1a3 },
+        { 56, 0x18402ec8, 0x184c068e, 0x18158a55, 0x180ed18b },
+        { 60, 0x18402ec8, 0x184c0692, 0x18158a55, 0x180ed183 },
+        { 62, 0x18402ec8, 0x184c0692, 0x18158a55, 0x180ed193 },
+        { 64, 0x18402ec8, 0x184c0692, 0x18158a55, 0x180ed1a3 },
+
+        /* 802.11 HyperLan 2 */
+        { 100, 0x18402ec8, 0x184c06b2, 0x18178a55, 0x180ed783 },
+        { 102, 0x18402ec8, 0x184c06b2, 0x18578a55, 0x180ed793 },
+        { 104, 0x18402ec8, 0x185c06b2, 0x18578a55, 0x180ed1a3 },
+        { 108, 0x18402ecc, 0x185c0a32, 0x18578a55, 0x180ed193 },
+        { 110, 0x18402ecc, 0x184c0a36, 0x18178a55, 0x180ed183 },
+        { 112, 0x18402ecc, 0x184c0a36, 0x18178a55, 0x180ed19b },
+        { 116, 0x18402ecc, 0x184c0a3a, 0x18178a55, 0x180ed1a3 },
+        { 118, 0x18402ecc, 0x184c0a3e, 0x18178a55, 0x180ed193 },
+        { 120, 0x18402ec4, 0x184c0382, 0x18178a55, 0x180ed183 },
+        { 124, 0x18402ec4, 0x184c0382, 0x18178a55, 0x180ed193 },
+        { 126, 0x18402ec4, 0x184c0382, 0x18178a55, 0x180ed15b },
+        { 128, 0x18402ec4, 0x184c0382, 0x18178a55, 0x180ed1a3 },
+        { 132, 0x18402ec4, 0x184c0386, 0x18178a55, 0x180ed18b },
+        { 134, 0x18402ec4, 0x184c0386, 0x18178a55, 0x180ed193 },
+        { 136, 0x18402ec4, 0x184c0386, 0x18178a55, 0x180ed19b },
+        { 140, 0x18402ec4, 0x184c038a, 0x18178a55, 0x180ed183 },
+
+        /* 802.11 UNII */
+        { 149, 0x18402ec4, 0x184c038a, 0x18178a55, 0x180ed1a7 },
+        { 151, 0x18402ec4, 0x184c038e, 0x18178a55, 0x180ed187 },
+        { 153, 0x18402ec4, 0x184c038e, 0x18178a55, 0x180ed18f },
+        { 157, 0x18402ec4, 0x184c038e, 0x18178a55, 0x180ed19f },
+        { 159, 0x18402ec4, 0x184c038e, 0x18178a55, 0x180ed1a7 },
+        { 161, 0x18402ec4, 0x184c0392, 0x18178a55, 0x180ed187 },
+        { 165, 0x18402ec4, 0x184c0392, 0x18178a55, 0x180ed197 },
+
+        /* 802.11 Japan */
+        { 184, 0x15002ccc, 0x1500491e, 0x1509be55, 0x150c0a0b },
+        { 188, 0x15002ccc, 0x15004922, 0x1509be55, 0x150c0a13 },
+        { 192, 0x15002ccc, 0x15004926, 0x1509be55, 0x150c0a1b },
+        { 196, 0x15002ccc, 0x1500492a, 0x1509be55, 0x150c0a23 },
+        { 208, 0x15002ccc, 0x1500493a, 0x1509be55, 0x150c0a13 },
+        { 212, 0x15002ccc, 0x1500493e, 0x1509be55, 0x150c0a1b },
+        { 216, 0x15002ccc, 0x15004982, 0x1509be55, 0x150c0a23 },
+};
+
+static int rt2800pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
+{
+        struct hw_mode_spec *spec = &rt2x00dev->spec;
+        struct channel_info *info;
+        char *tx_power1;
+        char *tx_power2;
+        unsigned int i;
+        u16 eeprom;
+
+        /*
+         * Initialize all hw fields.
+         */
+        rt2x00dev->hw->flags =
+            IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
+            IEEE80211_HW_SIGNAL_DBM |
+            IEEE80211_HW_SUPPORTS_PS |
+            IEEE80211_HW_PS_NULLFUNC_STACK;
+        rt2x00dev->hw->extra_tx_headroom = TXWI_DESC_SIZE;
+
+        SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
+        SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
+                                rt2x00_eeprom_addr(rt2x00dev,
+                                                   EEPROM_MAC_ADDR_0));
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_ANTENNA, &eeprom);
+
+        /*
+         * Initialize hw_mode information.
+         */
+        spec->supported_bands = SUPPORT_BAND_2GHZ;
+        spec->supported_rates = SUPPORT_RATE_CCK | SUPPORT_RATE_OFDM;
+
+        if (rt2x00_rf(&rt2x00dev->chip, RF2820) ||
+            rt2x00_rf(&rt2x00dev->chip, RF2720) ||
+            rt2x00_rf(&rt2x00dev->chip, RF3020) ||
+            rt2x00_rf(&rt2x00dev->chip, RF3021) ||
+            rt2x00_rf(&rt2x00dev->chip, RF3022) ||
+            rt2x00_rf(&rt2x00dev->chip, RF2020) ||
+            rt2x00_rf(&rt2x00dev->chip, RF3052)) {
+                spec->num_channels = 14;
+                spec->channels = rf_vals;
+        } else if (rt2x00_rf(&rt2x00dev->chip, RF2850) ||
+                   rt2x00_rf(&rt2x00dev->chip, RF2750)) {
+                spec->supported_bands |= SUPPORT_BAND_5GHZ;
+                spec->num_channels = ARRAY_SIZE(rf_vals);
+                spec->channels = rf_vals;
+        }
+
+        /*
+         * Initialize HT information.
+         */
+        spec->ht.ht_supported = true;
+        spec->ht.cap =
+            IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
+            IEEE80211_HT_CAP_GRN_FLD |
+            IEEE80211_HT_CAP_SGI_20 |
+            IEEE80211_HT_CAP_SGI_40 |
+            IEEE80211_HT_CAP_TX_STBC |
+            IEEE80211_HT_CAP_RX_STBC |
+            IEEE80211_HT_CAP_PSMP_SUPPORT;
+        spec->ht.ampdu_factor = 3;
+        spec->ht.ampdu_density = 4;
+        spec->ht.mcs.tx_params =
+            IEEE80211_HT_MCS_TX_DEFINED |
+            IEEE80211_HT_MCS_TX_RX_DIFF |
+            ((rt2x00_get_field16(eeprom, EEPROM_ANTENNA_TXPATH) - 1) <<
+                IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT);
+
+        switch (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RXPATH)) {
+        case 3:
+                spec->ht.mcs.rx_mask[2] = 0xff;
+        case 2:
+                spec->ht.mcs.rx_mask[1] = 0xff;
+        case 1:
+                spec->ht.mcs.rx_mask[0] = 0xff;
+                spec->ht.mcs.rx_mask[4] = 0x1; /* MCS32 */
+                break;
+        }
+
+        /*
+         * Create channel information array
+         */
+        info = kzalloc(spec->num_channels * sizeof(*info), GFP_KERNEL);
+        if (!info)
+                return -ENOMEM;
+
+        spec->channels_info = info;
+
+        tx_power1 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG1);
+        tx_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG2);
+
+        for (i = 0; i < 14; i++) {
+                info[i].tx_power1 = TXPOWER_G_FROM_DEV(tx_power1[i]);
+                info[i].tx_power2 = TXPOWER_G_FROM_DEV(tx_power2[i]);
+        }
+
+        if (spec->num_channels > 14) {
+                tx_power1 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A1);
+                tx_power2 = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A2);
+
+                for (i = 14; i < spec->num_channels; i++) {
+                        info[i].tx_power1 = TXPOWER_A_FROM_DEV(tx_power1[i]);
+                        info[i].tx_power2 = TXPOWER_A_FROM_DEV(tx_power2[i]);
+                }
+        }
+
+        return 0;
+}
+
+static int rt2800pci_probe_hw(struct rt2x00_dev *rt2x00dev)
+{
+        int retval;
+
+        /*
+         * Allocate eeprom data.
+         */
+        retval = rt2800pci_validate_eeprom(rt2x00dev);
+        if (retval)
+                return retval;
+
+        retval = rt2800pci_init_eeprom(rt2x00dev);
+        if (retval)
+                return retval;
+
+        /*
+         * Initialize hw specifications.
+         */
+        retval = rt2800pci_probe_hw_mode(rt2x00dev);
+        if (retval)
+                return retval;
+
+        /*
+         * This device has multiple filters for control frames
+         * and has a separate filter for PS Poll frames.
+         */
+        __set_bit(DRIVER_SUPPORT_CONTROL_FILTERS, &rt2x00dev->flags);
+        __set_bit(DRIVER_SUPPORT_CONTROL_FILTER_PSPOLL, &rt2x00dev->flags);
+
+        /*
+         * This device requires firmware.
+         */
+        if (!rt2x00_rt(&rt2x00dev->chip, RT2880) &&
+            !rt2x00_rt(&rt2x00dev->chip, RT3052))
+                __set_bit(DRIVER_REQUIRE_FIRMWARE, &rt2x00dev->flags);
+        __set_bit(DRIVER_REQUIRE_DMA, &rt2x00dev->flags);
+        __set_bit(DRIVER_REQUIRE_L2PAD, &rt2x00dev->flags);
+        if (!modparam_nohwcrypt)
+                __set_bit(CONFIG_SUPPORT_HW_CRYPTO, &rt2x00dev->flags);
+
+        /*
+         * Set the rssi offset.
+         */
+        rt2x00dev->rssi_offset = DEFAULT_RSSI_OFFSET;
+
+        return 0;
+}
+
+/*
+ * IEEE80211 stack callback functions.
+ */
+static void rt2800pci_get_tkip_seq(struct ieee80211_hw *hw, u8 hw_key_idx,
+                                   u32 *iv32, u16 *iv16)
+{
+        struct rt2x00_dev *rt2x00dev = hw->priv;
+        struct mac_iveiv_entry iveiv_entry;
+        u32 offset;
+
+        offset = MAC_IVEIV_ENTRY(hw_key_idx);
+        rt2x00pci_register_multiread(rt2x00dev, offset,
+                                      &iveiv_entry, sizeof(iveiv_entry));
+
+        memcpy(&iveiv_entry.iv[0], iv16, sizeof(iv16));
+        memcpy(&iveiv_entry.iv[4], iv32, sizeof(iv32));
+}
+
+static int rt2800pci_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
+{
+        struct rt2x00_dev *rt2x00dev = hw->priv;
+        u32 reg;
+        bool enabled = (value < IEEE80211_MAX_RTS_THRESHOLD);
+
+        rt2x00pci_register_read(rt2x00dev, TX_RTS_CFG, &reg);
+        rt2x00_set_field32(&reg, TX_RTS_CFG_RTS_THRES, value);
+        rt2x00pci_register_write(rt2x00dev, TX_RTS_CFG, reg);
+
+        rt2x00pci_register_read(rt2x00dev, CCK_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, CCK_PROT_CFG_RTS_TH_EN, enabled);
+        rt2x00pci_register_write(rt2x00dev, CCK_PROT_CFG, reg);
+
+        rt2x00pci_register_read(rt2x00dev, OFDM_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, OFDM_PROT_CFG_RTS_TH_EN, enabled);
+        rt2x00pci_register_write(rt2x00dev, OFDM_PROT_CFG, reg);
+
+        rt2x00pci_register_read(rt2x00dev, MM20_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, MM20_PROT_CFG_RTS_TH_EN, enabled);
+        rt2x00pci_register_write(rt2x00dev, MM20_PROT_CFG, reg);
+
+        rt2x00pci_register_read(rt2x00dev, MM40_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, MM40_PROT_CFG_RTS_TH_EN, enabled);
+        rt2x00pci_register_write(rt2x00dev, MM40_PROT_CFG, reg);
+
+        rt2x00pci_register_read(rt2x00dev, GF20_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, GF20_PROT_CFG_RTS_TH_EN, enabled);
+        rt2x00pci_register_write(rt2x00dev, GF20_PROT_CFG, reg);
+
+        rt2x00pci_register_read(rt2x00dev, GF40_PROT_CFG, &reg);
+        rt2x00_set_field32(&reg, GF40_PROT_CFG_RTS_TH_EN, enabled);
+        rt2x00pci_register_write(rt2x00dev, GF40_PROT_CFG, reg);
+
+        return 0;
+}
+
+static int rt2800pci_conf_tx(struct ieee80211_hw *hw, u16 queue_idx,
+                             const struct ieee80211_tx_queue_params *params)
+{
+        struct rt2x00_dev *rt2x00dev = hw->priv;
+        struct data_queue *queue;
+        struct rt2x00_field32 field;
+        int retval;
+        u32 reg;
+        u32 offset;
+
+        /*
+         * First pass the configuration through rt2x00lib, that will
+         * update the queue settings and validate the input. After that
+         * we are free to update the registers based on the value
+         * in the queue parameter.
+         */
+        retval = rt2x00mac_conf_tx(hw, queue_idx, params);
+        if (retval)
+                return retval;
+
+        /*
+         * We only need to perform additional register initialization
+         * for WMM queues/
+         */
+        if (queue_idx >= 4)
+                return 0;
+
+        queue = rt2x00queue_get_queue(rt2x00dev, queue_idx);
+
+        /* Update WMM TXOP register */
+        offset = WMM_TXOP0_CFG + (sizeof(u32) * (!!(queue_idx & 2)));
+        field.bit_offset = (queue_idx & 1) * 16;
+        field.bit_mask = 0xffff << field.bit_offset;
+
+        rt2x00pci_register_read(rt2x00dev, offset, &reg);
+        rt2x00_set_field32(&reg, field, queue->txop);
+        rt2x00pci_register_write(rt2x00dev, offset, reg);
+
+        /* Update WMM registers */
+        field.bit_offset = queue_idx * 4;
+        field.bit_mask = 0xf << field.bit_offset;
+
+        rt2x00pci_register_read(rt2x00dev, WMM_AIFSN_CFG, &reg);
+        rt2x00_set_field32(&reg, field, queue->aifs);
+        rt2x00pci_register_write(rt2x00dev, WMM_AIFSN_CFG, reg);
+
+        rt2x00pci_register_read(rt2x00dev, WMM_CWMIN_CFG, &reg);
+        rt2x00_set_field32(&reg, field, queue->cw_min);
+        rt2x00pci_register_write(rt2x00dev, WMM_CWMIN_CFG, reg);
+
+        rt2x00pci_register_read(rt2x00dev, WMM_CWMAX_CFG, &reg);
+        rt2x00_set_field32(&reg, field, queue->cw_max);
+        rt2x00pci_register_write(rt2x00dev, WMM_CWMAX_CFG, reg);
+
+        /* Update EDCA registers */
+        offset = EDCA_AC0_CFG + (sizeof(u32) * queue_idx);
+
+        rt2x00pci_register_read(rt2x00dev, offset, &reg);
+        rt2x00_set_field32(&reg, EDCA_AC0_CFG_TX_OP, queue->txop);
+        rt2x00_set_field32(&reg, EDCA_AC0_CFG_AIFSN, queue->aifs);
+        rt2x00_set_field32(&reg, EDCA_AC0_CFG_CWMIN, queue->cw_min);
+        rt2x00_set_field32(&reg, EDCA_AC0_CFG_CWMAX, queue->cw_max);
+        rt2x00pci_register_write(rt2x00dev, offset, reg);
+
+        return 0;
+}
+
+static u64 rt2800pci_get_tsf(struct ieee80211_hw *hw)
+{
+        struct rt2x00_dev *rt2x00dev = hw->priv;
+        u64 tsf;
+        u32 reg;
+
+        rt2x00pci_register_read(rt2x00dev, TSF_TIMER_DW1, &reg);
+        tsf = (u64) rt2x00_get_field32(reg, TSF_TIMER_DW1_HIGH_WORD) << 32;
+        rt2x00pci_register_read(rt2x00dev, TSF_TIMER_DW0, &reg);
+        tsf |= rt2x00_get_field32(reg, TSF_TIMER_DW0_LOW_WORD);
+
+        return tsf;
+}
+
+static const struct ieee80211_ops rt2800pci_mac80211_ops = {
+        .tx                     = rt2x00mac_tx,
+        .start                  = rt2x00mac_start,
+        .stop                   = rt2x00mac_stop,
+        .add_interface          = rt2x00mac_add_interface,
+        .remove_interface       = rt2x00mac_remove_interface,
+        .config                 = rt2x00mac_config,
+        .configure_filter       = rt2x00mac_configure_filter,
+        .set_key                = rt2x00mac_set_key,
+        .get_stats              = rt2x00mac_get_stats,
+        .get_tkip_seq           = rt2800pci_get_tkip_seq,
+        .set_rts_threshold      = rt2800pci_set_rts_threshold,
+        .bss_info_changed       = rt2x00mac_bss_info_changed,
+        .conf_tx                = rt2800pci_conf_tx,
+        .get_tx_stats           = rt2x00mac_get_tx_stats,
+        .get_tsf                = rt2800pci_get_tsf,
+        .rfkill_poll            = rt2x00mac_rfkill_poll,
+};
+
+static const struct rt2x00lib_ops rt2800pci_rt2x00_ops = {
+        .irq_handler            = rt2800pci_interrupt,
+        .probe_hw               = rt2800pci_probe_hw,
+        .get_firmware_name      = rt2800pci_get_firmware_name,
+        .check_firmware         = rt2800pci_check_firmware,
+        .load_firmware          = rt2800pci_load_firmware,
+        .initialize             = rt2x00pci_initialize,
+        .uninitialize           = rt2x00pci_uninitialize,
+        .get_entry_state        = rt2800pci_get_entry_state,
+        .clear_entry            = rt2800pci_clear_entry,
+        .set_device_state       = rt2800pci_set_device_state,
+        .rfkill_poll            = rt2800pci_rfkill_poll,
+        .link_stats             = rt2800pci_link_stats,
+        .reset_tuner            = rt2800pci_reset_tuner,
+        .link_tuner             = rt2800pci_link_tuner,
+        .write_tx_desc          = rt2800pci_write_tx_desc,
+        .write_tx_data          = rt2x00pci_write_tx_data,
+        .write_beacon           = rt2800pci_write_beacon,
+        .kick_tx_queue          = rt2800pci_kick_tx_queue,
+        .kill_tx_queue          = rt2800pci_kill_tx_queue,
+        .fill_rxdone            = rt2800pci_fill_rxdone,
+        .config_shared_key      = rt2800pci_config_shared_key,
+        .config_pairwise_key    = rt2800pci_config_pairwise_key,
+        .config_filter          = rt2800pci_config_filter,
+        .config_intf            = rt2800pci_config_intf,
+        .config_erp             = rt2800pci_config_erp,
+        .config_ant             = rt2800pci_config_ant,
+        .config                 = rt2800pci_config,
+};
+
+static const struct data_queue_desc rt2800pci_queue_rx = {
+        .entry_num              = RX_ENTRIES,
+        .data_size              = AGGREGATION_SIZE,
+        .desc_size              = RXD_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_pci),
+};
+
+static const struct data_queue_desc rt2800pci_queue_tx = {
+        .entry_num              = TX_ENTRIES,
+        .data_size              = AGGREGATION_SIZE,
+        .desc_size              = TXD_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_pci),
+};
+
+static const struct data_queue_desc rt2800pci_queue_bcn = {
+        .entry_num              = 8 * BEACON_ENTRIES,
+        .data_size              = 0, /* No DMA required for beacons */
+        .desc_size              = TXWI_DESC_SIZE,
+        .priv_size              = sizeof(struct queue_entry_priv_pci),
+};
+
+static const struct rt2x00_ops rt2800pci_ops = {
+        .name           = KBUILD_MODNAME,
+        .max_sta_intf   = 1,
+        .max_ap_intf    = 8,
+        .eeprom_size    = EEPROM_SIZE,
+        .rf_size        = RF_SIZE,
+        .tx_queues      = NUM_TX_QUEUES,
+        .rx             = &rt2800pci_queue_rx,
+        .tx             = &rt2800pci_queue_tx,
+        .bcn            = &rt2800pci_queue_bcn,
+        .lib            = &rt2800pci_rt2x00_ops,
+        .hw             = &rt2800pci_mac80211_ops,
+#ifdef CONFIG_RT2X00_LIB_DEBUGFS
+        .debugfs        = &rt2800pci_rt2x00debug,
+#endif /* CONFIG_RT2X00_LIB_DEBUGFS */
+};
+
+/*
+ * RT2800pci module information.
+ */
+static struct pci_device_id rt2800pci_device_table[] = {
+        { PCI_DEVICE(0x1462, 0x891a), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1432, 0x7708), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1432, 0x7727), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1432, 0x7728), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1432, 0x7738), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1432, 0x7748), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1432, 0x7758), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1432, 0x7768), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1814, 0x0601), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1814, 0x0681), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1814, 0x0701), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1814, 0x0781), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1814, 0x3060), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1814, 0x3062), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1814, 0x3090), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1814, 0x3091), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1814, 0x3092), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1814, 0x3562), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1814, 0x3592), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1a3b, 0x1059), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { 0, }
+};
+
+MODULE_AUTHOR(DRV_PROJECT);
+MODULE_VERSION(DRV_VERSION);
+MODULE_DESCRIPTION("Ralink RT2800 PCI & PCMCIA Wireless LAN driver.");
+MODULE_SUPPORTED_DEVICE("Ralink RT2860 PCI & PCMCIA chipset based cards");
+#ifdef CONFIG_RT2800PCI_PCI
+MODULE_FIRMWARE(FIRMWARE_RT2860);
+MODULE_DEVICE_TABLE(pci, rt2800pci_device_table);
+#endif /* CONFIG_RT2800PCI_PCI */
+MODULE_LICENSE("GPL");
+
+#ifdef CONFIG_RT2800PCI_WISOC
+#if defined(CONFIG_RALINK_RT288X)
+__rt2x00soc_probe(RT2880, &rt2800pci_ops);
+#elif defined(CONFIG_RALINK_RT305X)
+__rt2x00soc_probe(RT3052, &rt2800pci_ops);
+#endif
+
+static struct platform_driver rt2800soc_driver = {
+        .driver         = {
+                .name           = "rt2800_wmac",
+                .owner          = THIS_MODULE,
+                .mod_name       = KBUILD_MODNAME,
+        },
+        .probe          = __rt2x00soc_probe,
+        .remove         = __devexit_p(rt2x00soc_remove),
+        .suspend        = rt2x00soc_suspend,
+        .resume         = rt2x00soc_resume,
+};
+#endif /* CONFIG_RT2800PCI_WISOC */
+
+#ifdef CONFIG_RT2800PCI_PCI
+static struct pci_driver rt2800pci_driver = {
+        .name           = KBUILD_MODNAME,
+        .id_table       = rt2800pci_device_table,
+        .probe          = rt2x00pci_probe,
+        .remove         = __devexit_p(rt2x00pci_remove),
+        .suspend        = rt2x00pci_suspend,
+        .resume         = rt2x00pci_resume,
+};
+#endif /* CONFIG_RT2800PCI_PCI */
+
+static int __init rt2800pci_init(void)
+{
+        int ret = 0;
+
+#ifdef CONFIG_RT2800PCI_WISOC
+        ret = platform_driver_register(&rt2800soc_driver);
+        if (ret)
+                return ret;
+#endif
+#ifdef CONFIG_RT2800PCI_PCI
+        ret = pci_register_driver(&rt2800pci_driver);
+        if (ret) {
+#ifdef CONFIG_RT2800PCI_WISOC
+                platform_driver_unregister(&rt2800soc_driver);
+#endif
+                return ret;
+        }
+#endif
+
+        return ret;
+}
+
+static void __exit rt2800pci_exit(void)
+{
+#ifdef CONFIG_RT2800PCI_PCI
+        pci_unregister_driver(&rt2800pci_driver);
+#endif
+#ifdef CONFIG_RT2800PCI_WISOC
+        platform_driver_unregister(&rt2800soc_driver);
+#endif
+}
+
+module_init(rt2800pci_init);
+module_exit(rt2800pci_exit);
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.h b/drivers/net/wireless/rt2x00/rt2800pci.h
new file mode 100644
index 000000000000..856908815221
--- /dev/null
+++ b/drivers/net/wireless/rt2x00/rt2800pci.h
@@ -0,0 +1,1960 @@
+/*
+        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        <http://rt2x00.serialmonkey.com>
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the
+        Free Software Foundation, Inc.,
+        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/*
+        Module: rt2800pci
+        Abstract: Data structures and registers for the rt2800pci module.
+        Supported chipsets: RT2800E & RT2800ED.
+ */
+
+#ifndef RT2800PCI_H
+#define RT2800PCI_H
+
+/*
+ * RF chip defines.
+ *
+ * RF2820 2.4G 2T3R
+ * RF2850 2.4G/5G 2T3R
+ * RF2720 2.4G 1T2R
+ * RF2750 2.4G/5G 1T2R
+ * RF3020 2.4G 1T1R
+ * RF2020 2.4G B/G
+ * RF3021 2.4G 1T2R
+ * RF3022 2.4G 2T2R
+ * RF3052 2.4G 2T2R
+ */
+#define RF2820                          0x0001
+#define RF2850                          0x0002
+#define RF2720                          0x0003
+#define RF2750                          0x0004
+#define RF3020                          0x0005
+#define RF2020                          0x0006
+#define RF3021                          0x0007
+#define RF3022                          0x0008
+#define RF3052                          0x0009
+
+/*
+ * RT2860 version
+ */
+#define RT2860C_VERSION                 0x28600100
+#define RT2860D_VERSION                 0x28600101
+#define RT2880E_VERSION                 0x28720200
+#define RT2883_VERSION                  0x28830300
+#define RT3070_VERSION                  0x30700200
+
+/*
+ * Signal information.
+ * Default offset is required for RSSI <-> dBm conversion.
+ */
+#define DEFAULT_RSSI_OFFSET             120 /* FIXME */
+
+/*
+ * Register layout information.
+ */
+#define CSR_REG_BASE                    0x1000
+#define CSR_REG_SIZE                    0x0800
+#define EEPROM_BASE                     0x0000
+#define EEPROM_SIZE                     0x0110
+#define BBP_BASE                        0x0000
+#define BBP_SIZE                        0x0080
+#define RF_BASE                         0x0004
+#define RF_SIZE                         0x0010
+
+/*
+ * Number of TX queues.
+ */
+#define NUM_TX_QUEUES                   4
+
+/*
+ * PCI registers.
+ */
+
+/*
+ * E2PROM_CSR: EEPROM control register.
+ * RELOAD: Write 1 to reload eeprom content.
+ * TYPE: 0: 93c46, 1:93c66.
+ * LOAD_STATUS: 1:loading, 0:done.
+ */
+#define E2PROM_CSR                      0x0004
+#define E2PROM_CSR_DATA_CLOCK           FIELD32(0x00000001)
+#define E2PROM_CSR_CHIP_SELECT          FIELD32(0x00000002)
+#define E2PROM_CSR_DATA_IN              FIELD32(0x00000004)
+#define E2PROM_CSR_DATA_OUT             FIELD32(0x00000008)
+#define E2PROM_CSR_TYPE                 FIELD32(0x00000030)
+#define E2PROM_CSR_LOAD_STATUS          FIELD32(0x00000040)
+#define E2PROM_CSR_RELOAD               FIELD32(0x00000080)
+
+/*
+ * INT_SOURCE_CSR: Interrupt source register.
+ * Write one to clear corresponding bit.
+ * TX_FIFO_STATUS: FIFO Statistics is full, sw should read 0x171c
+ */
+#define INT_SOURCE_CSR                  0x0200
+#define INT_SOURCE_CSR_RXDELAYINT       FIELD32(0x00000001)
+#define INT_SOURCE_CSR_TXDELAYINT       FIELD32(0x00000002)
+#define INT_SOURCE_CSR_RX_DONE          FIELD32(0x00000004)
+#define INT_SOURCE_CSR_AC0_DMA_DONE     FIELD32(0x00000008)
+#define INT_SOURCE_CSR_AC1_DMA_DONE     FIELD32(0x00000010)
+#define INT_SOURCE_CSR_AC2_DMA_DONE     FIELD32(0x00000020)
+#define INT_SOURCE_CSR_AC3_DMA_DONE     FIELD32(0x00000040)
+#define INT_SOURCE_CSR_HCCA_DMA_DONE    FIELD32(0x00000080)
+#define INT_SOURCE_CSR_MGMT_DMA_DONE    FIELD32(0x00000100)
+#define INT_SOURCE_CSR_MCU_COMMAND      FIELD32(0x00000200)
+#define INT_SOURCE_CSR_RXTX_COHERENT    FIELD32(0x00000400)
+#define INT_SOURCE_CSR_TBTT             FIELD32(0x00000800)
+#define INT_SOURCE_CSR_PRE_TBTT         FIELD32(0x00001000)
+#define INT_SOURCE_CSR_TX_FIFO_STATUS   FIELD32(0x00002000)
+#define INT_SOURCE_CSR_AUTO_WAKEUP      FIELD32(0x00004000)
+#define INT_SOURCE_CSR_GPTIMER          FIELD32(0x00008000)
+#define INT_SOURCE_CSR_RX_COHERENT      FIELD32(0x00010000)
+#define INT_SOURCE_CSR_TX_COHERENT      FIELD32(0x00020000)
+
+/*
+ * INT_MASK_CSR: Interrupt MASK register. 1: the interrupt is mask OFF.
+ */
+#define INT_MASK_CSR                    0x0204
+#define INT_MASK_CSR_RXDELAYINT         FIELD32(0x00000001)
+#define INT_MASK_CSR_TXDELAYINT         FIELD32(0x00000002)
+#define INT_MASK_CSR_RX_DONE            FIELD32(0x00000004)
+#define INT_MASK_CSR_AC0_DMA_DONE       FIELD32(0x00000008)
+#define INT_MASK_CSR_AC1_DMA_DONE       FIELD32(0x00000010)
+#define INT_MASK_CSR_AC2_DMA_DONE       FIELD32(0x00000020)
+#define INT_MASK_CSR_AC3_DMA_DONE       FIELD32(0x00000040)
+#define INT_MASK_CSR_HCCA_DMA_DONE      FIELD32(0x00000080)
+#define INT_MASK_CSR_MGMT_DMA_DONE      FIELD32(0x00000100)
+#define INT_MASK_CSR_MCU_COMMAND        FIELD32(0x00000200)
+#define INT_MASK_CSR_RXTX_COHERENT      FIELD32(0x00000400)
+#define INT_MASK_CSR_TBTT               FIELD32(0x00000800)
+#define INT_MASK_CSR_PRE_TBTT           FIELD32(0x00001000)
+#define INT_MASK_CSR_TX_FIFO_STATUS     FIELD32(0x00002000)
+#define INT_MASK_CSR_AUTO_WAKEUP        FIELD32(0x00004000)
+#define INT_MASK_CSR_GPTIMER            FIELD32(0x00008000)
+#define INT_MASK_CSR_RX_COHERENT        FIELD32(0x00010000)
+#define INT_MASK_CSR_TX_COHERENT        FIELD32(0x00020000)
+
+/*
+ * WPDMA_GLO_CFG
+ */
+#define WPDMA_GLO_CFG                   0x0208
+#define WPDMA_GLO_CFG_ENABLE_TX_DMA     FIELD32(0x00000001)
+#define WPDMA_GLO_CFG_TX_DMA_BUSY       FIELD32(0x00000002)
+#define WPDMA_GLO_CFG_ENABLE_RX_DMA     FIELD32(0x00000004)
+#define WPDMA_GLO_CFG_RX_DMA_BUSY       FIELD32(0x00000008)
+#define WPDMA_GLO_CFG_WP_DMA_BURST_SIZE FIELD32(0x00000030)
+#define WPDMA_GLO_CFG_TX_WRITEBACK_DONE FIELD32(0x00000040)
+#define WPDMA_GLO_CFG_BIG_ENDIAN        FIELD32(0x00000080)
+#define WPDMA_GLO_CFG_RX_HDR_SCATTER    FIELD32(0x0000ff00)
+#define WPDMA_GLO_CFG_HDR_SEG_LEN       FIELD32(0xffff0000)
+
+/*
+ * WPDMA_RST_IDX
+ */
+#define WPDMA_RST_IDX                   0x020c
+#define WPDMA_RST_IDX_DTX_IDX0          FIELD32(0x00000001)
+#define WPDMA_RST_IDX_DTX_IDX1          FIELD32(0x00000002)
+#define WPDMA_RST_IDX_DTX_IDX2          FIELD32(0x00000004)
+#define WPDMA_RST_IDX_DTX_IDX3          FIELD32(0x00000008)
+#define WPDMA_RST_IDX_DTX_IDX4          FIELD32(0x00000010)
+#define WPDMA_RST_IDX_DTX_IDX5          FIELD32(0x00000020)
+#define WPDMA_RST_IDX_DRX_IDX0          FIELD32(0x00010000)
+
+/*
+ * DELAY_INT_CFG
+ */
+#define DELAY_INT_CFG                   0x0210
+#define DELAY_INT_CFG_RXMAX_PTIME       FIELD32(0x000000ff)
+#define DELAY_INT_CFG_RXMAX_PINT        FIELD32(0x00007f00)
+#define DELAY_INT_CFG_RXDLY_INT_EN      FIELD32(0x00008000)
+#define DELAY_INT_CFG_TXMAX_PTIME       FIELD32(0x00ff0000)
+#define DELAY_INT_CFG_TXMAX_PINT        FIELD32(0x7f000000)
+#define DELAY_INT_CFG_TXDLY_INT_EN      FIELD32(0x80000000)
+
+/*
+ * WMM_AIFSN_CFG: Aifsn for each EDCA AC
+ * AIFSN0: AC_BE
+ * AIFSN1: AC_BK
+ * AIFSN1: AC_VI
+ * AIFSN1: AC_VO
+ */
+#define WMM_AIFSN_CFG                   0x0214
+#define WMM_AIFSN_CFG_AIFSN0            FIELD32(0x0000000f)
+#define WMM_AIFSN_CFG_AIFSN1            FIELD32(0x000000f0)
+#define WMM_AIFSN_CFG_AIFSN2            FIELD32(0x00000f00)
+#define WMM_AIFSN_CFG_AIFSN3            FIELD32(0x0000f000)
+
+/*
+ * WMM_CWMIN_CSR: CWmin for each EDCA AC
+ * CWMIN0: AC_BE
+ * CWMIN1: AC_BK
+ * CWMIN1: AC_VI
+ * CWMIN1: AC_VO
+ */
+#define WMM_CWMIN_CFG                   0x0218
+#define WMM_CWMIN_CFG_CWMIN0            FIELD32(0x0000000f)
+#define WMM_CWMIN_CFG_CWMIN1            FIELD32(0x000000f0)
+#define WMM_CWMIN_CFG_CWMIN2            FIELD32(0x00000f00)
+#define WMM_CWMIN_CFG_CWMIN3            FIELD32(0x0000f000)
+
+/*
+ * WMM_CWMAX_CSR: CWmax for each EDCA AC
+ * CWMAX0: AC_BE
+ * CWMAX1: AC_BK
+ * CWMAX1: AC_VI
+ * CWMAX1: AC_VO
+ */
+#define WMM_CWMAX_CFG                   0x021c
+#define WMM_CWMAX_CFG_CWMAX0            FIELD32(0x0000000f)
+#define WMM_CWMAX_CFG_CWMAX1            FIELD32(0x000000f0)
+#define WMM_CWMAX_CFG_CWMAX2            FIELD32(0x00000f00)
+#define WMM_CWMAX_CFG_CWMAX3            FIELD32(0x0000f000)
+
+/*
+ * AC_TXOP0: AC_BK/AC_BE TXOP register
+ * AC0TXOP: AC_BK in unit of 32us
+ * AC1TXOP: AC_BE in unit of 32us
+ */
+#define WMM_TXOP0_CFG                   0x0220
+#define WMM_TXOP0_CFG_AC0TXOP           FIELD32(0x0000ffff)
+#define WMM_TXOP0_CFG_AC1TXOP           FIELD32(0xffff0000)
+
+/*
+ * AC_TXOP1: AC_VO/AC_VI TXOP register
+ * AC2TXOP: AC_VI in unit of 32us
+ * AC3TXOP: AC_VO in unit of 32us
+ */
+#define WMM_TXOP1_CFG                   0x0224
+#define WMM_TXOP1_CFG_AC2TXOP           FIELD32(0x0000ffff)
+#define WMM_TXOP1_CFG_AC3TXOP           FIELD32(0xffff0000)
+
+/*
+ * GPIO_CTRL_CFG:
+ */
+#define GPIO_CTRL_CFG                   0x0228
+#define GPIO_CTRL_CFG_BIT0              FIELD32(0x00000001)
+#define GPIO_CTRL_CFG_BIT1              FIELD32(0x00000002)
+#define GPIO_CTRL_CFG_BIT2              FIELD32(0x00000004)
+#define GPIO_CTRL_CFG_BIT3              FIELD32(0x00000008)
+#define GPIO_CTRL_CFG_BIT4              FIELD32(0x00000010)
+#define GPIO_CTRL_CFG_BIT5              FIELD32(0x00000020)
+#define GPIO_CTRL_CFG_BIT6              FIELD32(0x00000040)
+#define GPIO_CTRL_CFG_BIT7              FIELD32(0x00000080)
+#define GPIO_CTRL_CFG_BIT8              FIELD32(0x00000100)
+
+/*
+ * MCU_CMD_CFG
+ */
+#define MCU_CMD_CFG                     0x022c
+
+/*
+ * AC_BK register offsets
+ */
+#define TX_BASE_PTR0                    0x0230
+#define TX_MAX_CNT0                     0x0234
+#define TX_CTX_IDX0                     0x0238
+#define TX_DTX_IDX0                     0x023c
+
+/*
+ * AC_BE register offsets
+ */
+#define TX_BASE_PTR1                    0x0240
+#define TX_MAX_CNT1                     0x0244
+#define TX_CTX_IDX1                     0x0248
+#define TX_DTX_IDX1                     0x024c
+
+/*
+ * AC_VI register offsets
+ */
+#define TX_BASE_PTR2                    0x0250
+#define TX_MAX_CNT2                     0x0254
+#define TX_CTX_IDX2                     0x0258
+#define TX_DTX_IDX2                     0x025c
+
+/*
+ * AC_VO register offsets
+ */
+#define TX_BASE_PTR3                    0x0260
+#define TX_MAX_CNT3                     0x0264
+#define TX_CTX_IDX3                     0x0268
+#define TX_DTX_IDX3                     0x026c
+
+/*
+ * HCCA register offsets
+ */
+#define TX_BASE_PTR4                    0x0270
+#define TX_MAX_CNT4                     0x0274
+#define TX_CTX_IDX4                     0x0278
+#define TX_DTX_IDX4                     0x027c
+
+/*
+ * MGMT register offsets
+ */
+#define TX_BASE_PTR5                    0x0280
+#define TX_MAX_CNT5                     0x0284
+#define TX_CTX_IDX5                     0x0288
+#define TX_DTX_IDX5                     0x028c
+
+/*
+ * Queue register offset macros
+ */
+#define TX_QUEUE_REG_OFFSET             0x10
+#define TX_BASE_PTR(__x)                TX_BASE_PTR0 + ((__x) * TX_QUEUE_REG_OFFSET)
+#define TX_MAX_CNT(__x)                 TX_MAX_CNT0 + ((__x) * TX_QUEUE_REG_OFFSET)
+#define TX_CTX_IDX(__x)                 TX_CTX_IDX0 + ((__x) * TX_QUEUE_REG_OFFSET)
+#define TX_DTX_IDX(__x)                 TX_DTX_IDX0 + ((__x) * TX_QUEUE_REG_OFFSET)
+
+/*
+ * RX register offsets
+ */
+#define RX_BASE_PTR                     0x0290
+#define RX_MAX_CNT                      0x0294
+#define RX_CRX_IDX                      0x0298
+#define RX_DRX_IDX                      0x029c
+
+/*
+ * PBF_SYS_CTRL
+ * HOST_RAM_WRITE: enable Host program ram write selection
+ */
+#define PBF_SYS_CTRL                    0x0400
+#define PBF_SYS_CTRL_READY              FIELD32(0x00000080)
+#define PBF_SYS_CTRL_HOST_RAM_WRITE     FIELD32(0x00010000)
+
+/*
+ * HOST-MCU shared memory
+ */
+#define HOST_CMD_CSR                    0x0404
+#define HOST_CMD_CSR_HOST_COMMAND       FIELD32(0x000000ff)
+
+/*
+ * PBF registers
+ * Most are for debug. Driver doesn't touch PBF register.
+ */
+#define PBF_CFG                         0x0408
+#define PBF_MAX_PCNT                    0x040c
+#define PBF_CTRL                        0x0410
+#define PBF_INT_STA                     0x0414
+#define PBF_INT_ENA                     0x0418
+
+/*
+ * BCN_OFFSET0:
+ */
+#define BCN_OFFSET0                     0x042c
+#define BCN_OFFSET0_BCN0                FIELD32(0x000000ff)
+#define BCN_OFFSET0_BCN1                FIELD32(0x0000ff00)
+#define BCN_OFFSET0_BCN2                FIELD32(0x00ff0000)
+#define BCN_OFFSET0_BCN3                FIELD32(0xff000000)
+
+/*
+ * BCN_OFFSET1:
+ */
+#define BCN_OFFSET1                     0x0430
+#define BCN_OFFSET1_BCN4                FIELD32(0x000000ff)
+#define BCN_OFFSET1_BCN5                FIELD32(0x0000ff00)
+#define BCN_OFFSET1_BCN6                FIELD32(0x00ff0000)
+#define BCN_OFFSET1_BCN7                FIELD32(0xff000000)
+
+/*
+ * PBF registers
+ * Most are for debug. Driver doesn't touch PBF register.
+ */
+#define TXRXQ_PCNT                      0x0438
+#define PBF_DBG                         0x043c
+
+/*
+ * RF registers
+ */
+#define RF_CSR_CFG                      0x0500
+#define RF_CSR_CFG_DATA                 FIELD32(0x000000ff)
+#define RF_CSR_CFG_REGNUM               FIELD32(0x00001f00)
+#define RF_CSR_CFG_WRITE                FIELD32(0x00010000)
+#define RF_CSR_CFG_BUSY                 FIELD32(0x00020000)
+
+/*
+ * EFUSE_CSR: RT3090 EEPROM
+ */
+#define EFUSE_CTRL                      0x0580
+#define EFUSE_CTRL_ADDRESS_IN           FIELD32(0x03fe0000)
+#define EFUSE_CTRL_MODE                 FIELD32(0x000000c0)
+#define EFUSE_CTRL_KICK                 FIELD32(0x40000000)
+
+/*
+ * EFUSE_DATA0
+ */
+#define EFUSE_DATA0                     0x0590
+
+/*
+ * EFUSE_DATA1
+ */
+#define EFUSE_DATA1                     0x0594
+
+/*
+ * EFUSE_DATA2
+ */
+#define EFUSE_DATA2                     0x0598
+
+/*
+ * EFUSE_DATA3
+ */
+#define EFUSE_DATA3                     0x059c
+
+/*
+ * MAC Control/Status Registers(CSR).
+ * Some values are set in TU, whereas 1 TU == 1024 us.
+ */
+
+/*
+ * MAC_CSR0: ASIC revision number.
+ * ASIC_REV: 0
+ * ASIC_VER: 2860
+ */
+#define MAC_CSR0                        0x1000
+#define MAC_CSR0_ASIC_REV               FIELD32(0x0000ffff)
+#define MAC_CSR0_ASIC_VER               FIELD32(0xffff0000)
+
+/*
+ * MAC_SYS_CTRL:
+ */
+#define MAC_SYS_CTRL                    0x1004
+#define MAC_SYS_CTRL_RESET_CSR          FIELD32(0x00000001)
+#define MAC_SYS_CTRL_RESET_BBP          FIELD32(0x00000002)
+#define MAC_SYS_CTRL_ENABLE_TX          FIELD32(0x00000004)
+#define MAC_SYS_CTRL_ENABLE_RX          FIELD32(0x00000008)
+#define MAC_SYS_CTRL_CONTINUOUS_TX      FIELD32(0x00000010)
+#define MAC_SYS_CTRL_LOOPBACK           FIELD32(0x00000020)
+#define MAC_SYS_CTRL_WLAN_HALT          FIELD32(0x00000040)
+#define MAC_SYS_CTRL_RX_TIMESTAMP       FIELD32(0x00000080)
+
+/*
+ * MAC_ADDR_DW0: STA MAC register 0
+ */
+#define MAC_ADDR_DW0                    0x1008
+#define MAC_ADDR_DW0_BYTE0              FIELD32(0x000000ff)
+#define MAC_ADDR_DW0_BYTE1              FIELD32(0x0000ff00)
+#define MAC_ADDR_DW0_BYTE2              FIELD32(0x00ff0000)
+#define MAC_ADDR_DW0_BYTE3              FIELD32(0xff000000)
+
+/*
+ * MAC_ADDR_DW1: STA MAC register 1
+ * UNICAST_TO_ME_MASK:
+ * Used to mask off bits from byte 5 of the MAC address
+ * to determine the UNICAST_TO_ME bit for RX frames.
+ * The full mask is complemented by BSS_ID_MASK:
+ *    MASK = BSS_ID_MASK & UNICAST_TO_ME_MASK
+ */
+#define MAC_ADDR_DW1                    0x100c
+#define MAC_ADDR_DW1_BYTE4              FIELD32(0x000000ff)
+#define MAC_ADDR_DW1_BYTE5              FIELD32(0x0000ff00)
+#define MAC_ADDR_DW1_UNICAST_TO_ME_MASK FIELD32(0x00ff0000)
+
+/*
+ * MAC_BSSID_DW0: BSSID register 0
+ */
+#define MAC_BSSID_DW0                   0x1010
+#define MAC_BSSID_DW0_BYTE0             FIELD32(0x000000ff)
+#define MAC_BSSID_DW0_BYTE1             FIELD32(0x0000ff00)
+#define MAC_BSSID_DW0_BYTE2             FIELD32(0x00ff0000)
+#define MAC_BSSID_DW0_BYTE3             FIELD32(0xff000000)
+
+/*
+ * MAC_BSSID_DW1: BSSID register 1
+ * BSS_ID_MASK:
+ *     0: 1-BSSID mode (BSS index = 0)
+ *     1: 2-BSSID mode (BSS index: Byte5, bit 0)
+ *     2: 4-BSSID mode (BSS index: byte5, bit 0 - 1)
+ *     3: 8-BSSID mode (BSS index: byte5, bit 0 - 2)
+ * This mask is used to mask off bits 0, 1 and 2 of byte 5 of the
+ * BSSID. This will make sure that those bits will be ignored
+ * when determining the MY_BSS of RX frames.
+ */
+#define MAC_BSSID_DW1                   0x1014
+#define MAC_BSSID_DW1_BYTE4             FIELD32(0x000000ff)
+#define MAC_BSSID_DW1_BYTE5             FIELD32(0x0000ff00)
+#define MAC_BSSID_DW1_BSS_ID_MASK       FIELD32(0x00030000)
+#define MAC_BSSID_DW1_BSS_BCN_NUM       FIELD32(0x001c0000)
+
+/*
+ * MAX_LEN_CFG: Maximum frame length register.
+ * MAX_MPDU: rt2860b max 16k bytes
+ * MAX_PSDU: Maximum PSDU length
+ *      (power factor) 0:2^13, 1:2^14, 2:2^15, 3:2^16
+ */
+#define MAX_LEN_CFG                     0x1018
+#define MAX_LEN_CFG_MAX_MPDU            FIELD32(0x00000fff)
+#define MAX_LEN_CFG_MAX_PSDU            FIELD32(0x00003000)
+#define MAX_LEN_CFG_MIN_PSDU            FIELD32(0x0000c000)
+#define MAX_LEN_CFG_MIN_MPDU            FIELD32(0x000f0000)
+
+/*
+ * BBP_CSR_CFG: BBP serial control register
+ * VALUE: Register value to program into BBP
+ * REG_NUM: Selected BBP register
+ * READ_CONTROL: 0 write BBP, 1 read BBP
+ * BUSY: ASIC is busy executing BBP commands
+ * BBP_PAR_DUR: 0 4 MAC clocks, 1 8 MAC clocks
+ * BBP_RW_MODE: 0 serial, 1 paralell
+ */
+#define BBP_CSR_CFG                     0x101c
+#define BBP_CSR_CFG_VALUE               FIELD32(0x000000ff)
+#define BBP_CSR_CFG_REGNUM              FIELD32(0x0000ff00)
+#define BBP_CSR_CFG_READ_CONTROL        FIELD32(0x00010000)
+#define BBP_CSR_CFG_BUSY                FIELD32(0x00020000)
+#define BBP_CSR_CFG_BBP_PAR_DUR         FIELD32(0x00040000)
+#define BBP_CSR_CFG_BBP_RW_MODE         FIELD32(0x00080000)
+
+/*
+ * RF_CSR_CFG0: RF control register
+ * REGID_AND_VALUE: Register value to program into RF
+ * BITWIDTH: Selected RF register
+ * STANDBYMODE: 0 high when standby, 1 low when standby
+ * SEL: 0 RF_LE0 activate, 1 RF_LE1 activate
+ * BUSY: ASIC is busy executing RF commands
+ */
+#define RF_CSR_CFG0                     0x1020
+#define RF_CSR_CFG0_REGID_AND_VALUE     FIELD32(0x00ffffff)
+#define RF_CSR_CFG0_BITWIDTH            FIELD32(0x1f000000)
+#define RF_CSR_CFG0_REG_VALUE_BW        FIELD32(0x1fffffff)
+#define RF_CSR_CFG0_STANDBYMODE         FIELD32(0x20000000)
+#define RF_CSR_CFG0_SEL                 FIELD32(0x40000000)
+#define RF_CSR_CFG0_BUSY                FIELD32(0x80000000)
+
+/*
+ * RF_CSR_CFG1: RF control register
+ * REGID_AND_VALUE: Register value to program into RF
+ * RFGAP: Gap between BB_CONTROL_RF and RF_LE
+ *        0: 3 system clock cycle (37.5usec)
+ *        1: 5 system clock cycle (62.5usec)
+ */
+#define RF_CSR_CFG1                     0x1024
+#define RF_CSR_CFG1_REGID_AND_VALUE     FIELD32(0x00ffffff)
+#define RF_CSR_CFG1_RFGAP               FIELD32(0x1f000000)
+
+/*
+ * RF_CSR_CFG2: RF control register
+ * VALUE: Register value to program into RF
+ * RFGAP: Gap between BB_CONTROL_RF and RF_LE
+ *        0: 3 system clock cycle (37.5usec)
+ *        1: 5 system clock cycle (62.5usec)
+ */
+#define RF_CSR_CFG2                     0x1028
+#define RF_CSR_CFG2_VALUE               FIELD32(0x00ffffff)
+
+/*
+ * LED_CFG: LED control
+ * color LED's:
+ *   0: off
+ *   1: blinking upon TX2
+ *   2: periodic slow blinking
+ *   3: always on
+ * LED polarity:
+ *   0: active low
+ *   1: active high
+ */
+#define LED_CFG                         0x102c
+#define LED_CFG_ON_PERIOD               FIELD32(0x000000ff)
+#define LED_CFG_OFF_PERIOD              FIELD32(0x0000ff00)
+#define LED_CFG_SLOW_BLINK_PERIOD       FIELD32(0x003f0000)
+#define LED_CFG_R_LED_MODE              FIELD32(0x03000000)
+#define LED_CFG_G_LED_MODE              FIELD32(0x0c000000)
+#define LED_CFG_Y_LED_MODE              FIELD32(0x30000000)
+#define LED_CFG_LED_POLAR               FIELD32(0x40000000)
+
+/*
+ * XIFS_TIME_CFG: MAC timing
+ * CCKM_SIFS_TIME: unit 1us. Applied after CCK RX/TX
+ * OFDM_SIFS_TIME: unit 1us. Applied after OFDM RX/TX
+ * OFDM_XIFS_TIME: unit 1us. Applied after OFDM RX
+ *      when MAC doesn't reference BBP signal BBRXEND
+ * EIFS: unit 1us
+ * BB_RXEND_ENABLE: reference RXEND signal to begin XIFS defer
+ *
+ */
+#define XIFS_TIME_CFG                   0x1100
+#define XIFS_TIME_CFG_CCKM_SIFS_TIME    FIELD32(0x000000ff)
+#define XIFS_TIME_CFG_OFDM_SIFS_TIME    FIELD32(0x0000ff00)
+#define XIFS_TIME_CFG_OFDM_XIFS_TIME    FIELD32(0x000f0000)
+#define XIFS_TIME_CFG_EIFS              FIELD32(0x1ff00000)
+#define XIFS_TIME_CFG_BB_RXEND_ENABLE   FIELD32(0x20000000)
+
+/*
+ * BKOFF_SLOT_CFG:
+ */
+#define BKOFF_SLOT_CFG                  0x1104
+#define BKOFF_SLOT_CFG_SLOT_TIME        FIELD32(0x000000ff)
+#define BKOFF_SLOT_CFG_CC_DELAY_TIME    FIELD32(0x0000ff00)
+
+/*
+ * NAV_TIME_CFG:
+ */
+#define NAV_TIME_CFG                    0x1108
+#define NAV_TIME_CFG_SIFS               FIELD32(0x000000ff)
+#define NAV_TIME_CFG_SLOT_TIME          FIELD32(0x0000ff00)
+#define NAV_TIME_CFG_EIFS               FIELD32(0x01ff0000)
+#define NAV_TIME_ZERO_SIFS              FIELD32(0x02000000)
+
+/*
+ * CH_TIME_CFG: count as channel busy
+ */
+#define CH_TIME_CFG                     0x110c
+
+/*
+ * PBF_LIFE_TIMER: TX/RX MPDU timestamp timer (free run) Unit: 1us
+ */
+#define PBF_LIFE_TIMER                  0x1110
+
+/*
+ * BCN_TIME_CFG:
+ * BEACON_INTERVAL: in unit of 1/16 TU
+ * TSF_TICKING: Enable TSF auto counting
+ * TSF_SYNC: Enable TSF sync, 00: disable, 01: infra mode, 10: ad-hoc mode
+ * BEACON_GEN: Enable beacon generator
+ */
+#define BCN_TIME_CFG                    0x1114
+#define BCN_TIME_CFG_BEACON_INTERVAL    FIELD32(0x0000ffff)
+#define BCN_TIME_CFG_TSF_TICKING        FIELD32(0x00010000)
+#define BCN_TIME_CFG_TSF_SYNC           FIELD32(0x00060000)
+#define BCN_TIME_CFG_TBTT_ENABLE        FIELD32(0x00080000)
+#define BCN_TIME_CFG_BEACON_GEN         FIELD32(0x00100000)
+#define BCN_TIME_CFG_TX_TIME_COMPENSATE FIELD32(0xf0000000)
+
+/*
+ * TBTT_SYNC_CFG:
+ */
+#define TBTT_SYNC_CFG                   0x1118
+
+/*
+ * TSF_TIMER_DW0: Local lsb TSF timer, read-only
+ */
+#define TSF_TIMER_DW0                   0x111c
+#define TSF_TIMER_DW0_LOW_WORD          FIELD32(0xffffffff)
+
+/*
+ * TSF_TIMER_DW1: Local msb TSF timer, read-only
+ */
+#define TSF_TIMER_DW1                   0x1120
+#define TSF_TIMER_DW1_HIGH_WORD         FIELD32(0xffffffff)
+
+/*
+ * TBTT_TIMER: TImer remains till next TBTT, read-only
+ */
+#define TBTT_TIMER                      0x1124
+
+/*
+ * INT_TIMER_CFG:
+ */
+#define INT_TIMER_CFG                   0x1128
+
+/*
+ * INT_TIMER_EN: GP-timer and pre-tbtt Int enable
+ */
+#define INT_TIMER_EN                    0x112c
+
+/*
+ * CH_IDLE_STA: channel idle time
+ */
+#define CH_IDLE_STA                     0x1130
+
+/*
+ * CH_BUSY_STA: channel busy time
+ */
+#define CH_BUSY_STA                     0x1134
+
+/*
+ * MAC_STATUS_CFG:
+ * BBP_RF_BUSY: When set to 0, BBP and RF are stable.
+ *      if 1 or higher one of the 2 registers is busy.
+ */
+#define MAC_STATUS_CFG                  0x1200
+#define MAC_STATUS_CFG_BBP_RF_BUSY      FIELD32(0x00000003)
+
+/*
+ * PWR_PIN_CFG:
+ */
+#define PWR_PIN_CFG                     0x1204
+
+/*
+ * AUTOWAKEUP_CFG: Manual power control / status register
+ * TBCN_BEFORE_WAKE: ForceWake has high privilege than PutToSleep when both set
+ * AUTOWAKE: 0:sleep, 1:awake
+ */
+#define AUTOWAKEUP_CFG                  0x1208
+#define AUTOWAKEUP_CFG_AUTO_LEAD_TIME   FIELD32(0x000000ff)
+#define AUTOWAKEUP_CFG_TBCN_BEFORE_WAKE FIELD32(0x00007f00)
+#define AUTOWAKEUP_CFG_AUTOWAKE         FIELD32(0x00008000)
+
+/*
+ * EDCA_AC0_CFG:
+ */
+#define EDCA_AC0_CFG                    0x1300
+#define EDCA_AC0_CFG_TX_OP              FIELD32(0x000000ff)
+#define EDCA_AC0_CFG_AIFSN              FIELD32(0x00000f00)
+#define EDCA_AC0_CFG_CWMIN              FIELD32(0x0000f000)
+#define EDCA_AC0_CFG_CWMAX              FIELD32(0x000f0000)
+
+/*
+ * EDCA_AC1_CFG:
+ */
+#define EDCA_AC1_CFG                    0x1304
+#define EDCA_AC1_CFG_TX_OP              FIELD32(0x000000ff)
+#define EDCA_AC1_CFG_AIFSN              FIELD32(0x00000f00)
+#define EDCA_AC1_CFG_CWMIN              FIELD32(0x0000f000)
+#define EDCA_AC1_CFG_CWMAX              FIELD32(0x000f0000)
+
+/*
+ * EDCA_AC2_CFG:
+ */
+#define EDCA_AC2_CFG                    0x1308
+#define EDCA_AC2_CFG_TX_OP              FIELD32(0x000000ff)
+#define EDCA_AC2_CFG_AIFSN              FIELD32(0x00000f00)
+#define EDCA_AC2_CFG_CWMIN              FIELD32(0x0000f000)
+#define EDCA_AC2_CFG_CWMAX              FIELD32(0x000f0000)
+
+/*
+ * EDCA_AC3_CFG:
+ */
+#define EDCA_AC3_CFG                    0x130c
+#define EDCA_AC3_CFG_TX_OP              FIELD32(0x000000ff)
+#define EDCA_AC3_CFG_AIFSN              FIELD32(0x00000f00)
+#define EDCA_AC3_CFG_CWMIN              FIELD32(0x0000f000)
+#define EDCA_AC3_CFG_CWMAX              FIELD32(0x000f0000)
+
+/*
+ * EDCA_TID_AC_MAP:
+ */
+#define EDCA_TID_AC_MAP                 0x1310
+
+/*
+ * TX_PWR_CFG_0:
+ */
+#define TX_PWR_CFG_0                    0x1314
+#define TX_PWR_CFG_0_1MBS               FIELD32(0x0000000f)
+#define TX_PWR_CFG_0_2MBS               FIELD32(0x000000f0)
+#define TX_PWR_CFG_0_55MBS              FIELD32(0x00000f00)
+#define TX_PWR_CFG_0_11MBS              FIELD32(0x0000f000)
+#define TX_PWR_CFG_0_6MBS               FIELD32(0x000f0000)
+#define TX_PWR_CFG_0_9MBS               FIELD32(0x00f00000)
+#define TX_PWR_CFG_0_12MBS              FIELD32(0x0f000000)
+#define TX_PWR_CFG_0_18MBS              FIELD32(0xf0000000)
+
+/*
+ * TX_PWR_CFG_1:
+ */
+#define TX_PWR_CFG_1                    0x1318
+#define TX_PWR_CFG_1_24MBS              FIELD32(0x0000000f)
+#define TX_PWR_CFG_1_36MBS              FIELD32(0x000000f0)
+#define TX_PWR_CFG_1_48MBS              FIELD32(0x00000f00)
+#define TX_PWR_CFG_1_54MBS              FIELD32(0x0000f000)
+#define TX_PWR_CFG_1_MCS0               FIELD32(0x000f0000)
+#define TX_PWR_CFG_1_MCS1               FIELD32(0x00f00000)
+#define TX_PWR_CFG_1_MCS2               FIELD32(0x0f000000)
+#define TX_PWR_CFG_1_MCS3               FIELD32(0xf0000000)
+
+/*
+ * TX_PWR_CFG_2:
+ */
+#define TX_PWR_CFG_2                    0x131c
+#define TX_PWR_CFG_2_MCS4               FIELD32(0x0000000f)
+#define TX_PWR_CFG_2_MCS5               FIELD32(0x000000f0)
+#define TX_PWR_CFG_2_MCS6               FIELD32(0x00000f00)
+#define TX_PWR_CFG_2_MCS7               FIELD32(0x0000f000)
+#define TX_PWR_CFG_2_MCS8               FIELD32(0x000f0000)
+#define TX_PWR_CFG_2_MCS9               FIELD32(0x00f00000)
+#define TX_PWR_CFG_2_MCS10              FIELD32(0x0f000000)
+#define TX_PWR_CFG_2_MCS11              FIELD32(0xf0000000)
+
+/*
+ * TX_PWR_CFG_3:
+ */
+#define TX_PWR_CFG_3                    0x1320
+#define TX_PWR_CFG_3_MCS12              FIELD32(0x0000000f)
+#define TX_PWR_CFG_3_MCS13              FIELD32(0x000000f0)
+#define TX_PWR_CFG_3_MCS14              FIELD32(0x00000f00)
+#define TX_PWR_CFG_3_MCS15              FIELD32(0x0000f000)
+#define TX_PWR_CFG_3_UKNOWN1            FIELD32(0x000f0000)
+#define TX_PWR_CFG_3_UKNOWN2            FIELD32(0x00f00000)
+#define TX_PWR_CFG_3_UKNOWN3            FIELD32(0x0f000000)
+#define TX_PWR_CFG_3_UKNOWN4            FIELD32(0xf0000000)
+
+/*
+ * TX_PWR_CFG_4:
+ */
+#define TX_PWR_CFG_4                    0x1324
+#define TX_PWR_CFG_4_UKNOWN5            FIELD32(0x0000000f)
+#define TX_PWR_CFG_4_UKNOWN6            FIELD32(0x000000f0)
+#define TX_PWR_CFG_4_UKNOWN7            FIELD32(0x00000f00)
+#define TX_PWR_CFG_4_UKNOWN8            FIELD32(0x0000f000)
+
+/*
+ * TX_PIN_CFG:
+ */
+#define TX_PIN_CFG                      0x1328
+#define TX_PIN_CFG_PA_PE_A0_EN          FIELD32(0x00000001)
+#define TX_PIN_CFG_PA_PE_G0_EN          FIELD32(0x00000002)
+#define TX_PIN_CFG_PA_PE_A1_EN          FIELD32(0x00000004)
+#define TX_PIN_CFG_PA_PE_G1_EN          FIELD32(0x00000008)
+#define TX_PIN_CFG_PA_PE_A0_POL         FIELD32(0x00000010)
+#define TX_PIN_CFG_PA_PE_G0_POL         FIELD32(0x00000020)
+#define TX_PIN_CFG_PA_PE_A1_POL         FIELD32(0x00000040)
+#define TX_PIN_CFG_PA_PE_G1_POL         FIELD32(0x00000080)
+#define TX_PIN_CFG_LNA_PE_A0_EN         FIELD32(0x00000100)
+#define TX_PIN_CFG_LNA_PE_G0_EN         FIELD32(0x00000200)
+#define TX_PIN_CFG_LNA_PE_A1_EN         FIELD32(0x00000400)
+#define TX_PIN_CFG_LNA_PE_G1_EN         FIELD32(0x00000800)
+#define TX_PIN_CFG_LNA_PE_A0_POL        FIELD32(0x00001000)
+#define TX_PIN_CFG_LNA_PE_G0_POL        FIELD32(0x00002000)
+#define TX_PIN_CFG_LNA_PE_A1_POL        FIELD32(0x00004000)
+#define TX_PIN_CFG_LNA_PE_G1_POL        FIELD32(0x00008000)
+#define TX_PIN_CFG_RFTR_EN              FIELD32(0x00010000)
+#define TX_PIN_CFG_RFTR_POL             FIELD32(0x00020000)
+#define TX_PIN_CFG_TRSW_EN              FIELD32(0x00040000)
+#define TX_PIN_CFG_TRSW_POL             FIELD32(0x00080000)
+
+/*
+ * TX_BAND_CFG: 0x1 use upper 20MHz, 0x0 use lower 20MHz
+ */
+#define TX_BAND_CFG                     0x132c
+#define TX_BAND_CFG_HT40_PLUS           FIELD32(0x00000001)
+#define TX_BAND_CFG_A                   FIELD32(0x00000002)
+#define TX_BAND_CFG_BG                  FIELD32(0x00000004)
+
+/*
+ * TX_SW_CFG0:
+ */
+#define TX_SW_CFG0                      0x1330
+
+/*
+ * TX_SW_CFG1:
+ */
+#define TX_SW_CFG1                      0x1334
+
+/*
+ * TX_SW_CFG2:
+ */
+#define TX_SW_CFG2                      0x1338
+
+/*
+ * TXOP_THRES_CFG:
+ */
+#define TXOP_THRES_CFG                  0x133c
+
+/*
+ * TXOP_CTRL_CFG:
+ */
+#define TXOP_CTRL_CFG                   0x1340
+
+/*
+ * TX_RTS_CFG:
+ * RTS_THRES: unit:byte
+ * RTS_FBK_EN: enable rts rate fallback
+ */
+#define TX_RTS_CFG                      0x1344
+#define TX_RTS_CFG_AUTO_RTS_RETRY_LIMIT FIELD32(0x000000ff)
+#define TX_RTS_CFG_RTS_THRES            FIELD32(0x00ffff00)
+#define TX_RTS_CFG_RTS_FBK_EN           FIELD32(0x01000000)
+
+/*
+ * TX_TIMEOUT_CFG:
+ * MPDU_LIFETIME: expiration time = 2^(9+MPDU LIFE TIME) us
+ * RX_ACK_TIMEOUT: unit:slot. Used for TX procedure
+ * TX_OP_TIMEOUT: TXOP timeout value for TXOP truncation.
+ *                it is recommended that:
+ *                (SLOT_TIME) > (TX_OP_TIMEOUT) > (RX_ACK_TIMEOUT)
+ */
+#define TX_TIMEOUT_CFG                  0x1348
+#define TX_TIMEOUT_CFG_MPDU_LIFETIME    FIELD32(0x000000f0)
+#define TX_TIMEOUT_CFG_RX_ACK_TIMEOUT   FIELD32(0x0000ff00)
+#define TX_TIMEOUT_CFG_TX_OP_TIMEOUT    FIELD32(0x00ff0000)
+
+/*
+ * TX_RTY_CFG:
+ * SHORT_RTY_LIMIT: short retry limit
+ * LONG_RTY_LIMIT: long retry limit
+ * LONG_RTY_THRE: Long retry threshoold
+ * NON_AGG_RTY_MODE: Non-Aggregate MPDU retry mode
+ *                   0:expired by retry limit, 1: expired by mpdu life timer
+ * AGG_RTY_MODE: Aggregate MPDU retry mode
+ *               0:expired by retry limit, 1: expired by mpdu life timer
+ * TX_AUTO_FB_ENABLE: Tx retry PHY rate auto fallback enable
+ */
+#define TX_RTY_CFG                      0x134c
+#define TX_RTY_CFG_SHORT_RTY_LIMIT      FIELD32(0x000000ff)
+#define TX_RTY_CFG_LONG_RTY_LIMIT       FIELD32(0x0000ff00)
+#define TX_RTY_CFG_LONG_RTY_THRE        FIELD32(0x0fff0000)
+#define TX_RTY_CFG_NON_AGG_RTY_MODE     FIELD32(0x10000000)
+#define TX_RTY_CFG_AGG_RTY_MODE         FIELD32(0x20000000)
+#define TX_RTY_CFG_TX_AUTO_FB_ENABLE    FIELD32(0x40000000)
+
+/*
+ * TX_LINK_CFG:
+ * REMOTE_MFB_LIFETIME: remote MFB life time. unit: 32us
+ * MFB_ENABLE: TX apply remote MFB 1:enable
+ * REMOTE_UMFS_ENABLE: remote unsolicit  MFB enable
+ *                     0: not apply remote remote unsolicit (MFS=7)
+ * TX_MRQ_EN: MCS request TX enable
+ * TX_RDG_EN: RDG TX enable
+ * TX_CF_ACK_EN: Piggyback CF-ACK enable
+ * REMOTE_MFB: remote MCS feedback
+ * REMOTE_MFS: remote MCS feedback sequence number
+ */
+#define TX_LINK_CFG                     0x1350
+#define TX_LINK_CFG_REMOTE_MFB_LIFETIME FIELD32(0x000000ff)
+#define TX_LINK_CFG_MFB_ENABLE          FIELD32(0x00000100)
+#define TX_LINK_CFG_REMOTE_UMFS_ENABLE  FIELD32(0x00000200)
+#define TX_LINK_CFG_TX_MRQ_EN           FIELD32(0x00000400)
+#define TX_LINK_CFG_TX_RDG_EN           FIELD32(0x00000800)
+#define TX_LINK_CFG_TX_CF_ACK_EN        FIELD32(0x00001000)
+#define TX_LINK_CFG_REMOTE_MFB          FIELD32(0x00ff0000)
+#define TX_LINK_CFG_REMOTE_MFS          FIELD32(0xff000000)
+
+/*
+ * HT_FBK_CFG0:
+ */
+#define HT_FBK_CFG0                     0x1354
+#define HT_FBK_CFG0_HTMCS0FBK           FIELD32(0x0000000f)
+#define HT_FBK_CFG0_HTMCS1FBK           FIELD32(0x000000f0)
+#define HT_FBK_CFG0_HTMCS2FBK           FIELD32(0x00000f00)
+#define HT_FBK_CFG0_HTMCS3FBK           FIELD32(0x0000f000)
+#define HT_FBK_CFG0_HTMCS4FBK           FIELD32(0x000f0000)
+#define HT_FBK_CFG0_HTMCS5FBK           FIELD32(0x00f00000)
+#define HT_FBK_CFG0_HTMCS6FBK           FIELD32(0x0f000000)
+#define HT_FBK_CFG0_HTMCS7FBK           FIELD32(0xf0000000)
+
+/*
+ * HT_FBK_CFG1:
+ */
+#define HT_FBK_CFG1                     0x1358
+#define HT_FBK_CFG1_HTMCS8FBK           FIELD32(0x0000000f)
+#define HT_FBK_CFG1_HTMCS9FBK           FIELD32(0x000000f0)
+#define HT_FBK_CFG1_HTMCS10FBK          FIELD32(0x00000f00)
+#define HT_FBK_CFG1_HTMCS11FBK          FIELD32(0x0000f000)
+#define HT_FBK_CFG1_HTMCS12FBK          FIELD32(0x000f0000)
+#define HT_FBK_CFG1_HTMCS13FBK          FIELD32(0x00f00000)
+#define HT_FBK_CFG1_HTMCS14FBK          FIELD32(0x0f000000)
+#define HT_FBK_CFG1_HTMCS15FBK          FIELD32(0xf0000000)
+
+/*
+ * LG_FBK_CFG0:
+ */
+#define LG_FBK_CFG0                     0x135c
+#define LG_FBK_CFG0_OFDMMCS0FBK         FIELD32(0x0000000f)
+#define LG_FBK_CFG0_OFDMMCS1FBK         FIELD32(0x000000f0)
+#define LG_FBK_CFG0_OFDMMCS2FBK         FIELD32(0x00000f00)
+#define LG_FBK_CFG0_OFDMMCS3FBK         FIELD32(0x0000f000)
+#define LG_FBK_CFG0_OFDMMCS4FBK         FIELD32(0x000f0000)
+#define LG_FBK_CFG0_OFDMMCS5FBK         FIELD32(0x00f00000)
+#define LG_FBK_CFG0_OFDMMCS6FBK         FIELD32(0x0f000000)
+#define LG_FBK_CFG0_OFDMMCS7FBK         FIELD32(0xf0000000)
+
+/*
+ * LG_FBK_CFG1:
+ */
+#define LG_FBK_CFG1                     0x1360
+#define LG_FBK_CFG0_CCKMCS0FBK          FIELD32(0x0000000f)
+#define LG_FBK_CFG0_CCKMCS1FBK          FIELD32(0x000000f0)
+#define LG_FBK_CFG0_CCKMCS2FBK          FIELD32(0x00000f00)
+#define LG_FBK_CFG0_CCKMCS3FBK          FIELD32(0x0000f000)
+
+/*
+ * CCK_PROT_CFG: CCK Protection
+ * PROTECT_RATE: Protection control frame rate for CCK TX(RTS/CTS/CFEnd)
+ * PROTECT_CTRL: Protection control frame type for CCK TX
+ *               0:none, 1:RTS/CTS, 2:CTS-to-self
+ * PROTECT_NAV: TXOP protection type for CCK TX
+ *              0:none, 1:ShortNAVprotect, 2:LongNAVProtect
+ * TX_OP_ALLOW_CCK: CCK TXOP allowance, 0:disallow
+ * TX_OP_ALLOW_OFDM: CCK TXOP allowance, 0:disallow
+ * TX_OP_ALLOW_MM20: CCK TXOP allowance, 0:disallow
+ * TX_OP_ALLOW_MM40: CCK TXOP allowance, 0:disallow
+ * TX_OP_ALLOW_GF20: CCK TXOP allowance, 0:disallow
+ * TX_OP_ALLOW_GF40: CCK TXOP allowance, 0:disallow
+ * RTS_TH_EN: RTS threshold enable on CCK TX
+ */
+#define CCK_PROT_CFG                    0x1364
+#define CCK_PROT_CFG_PROTECT_RATE       FIELD32(0x0000ffff)
+#define CCK_PROT_CFG_PROTECT_CTRL       FIELD32(0x00030000)
+#define CCK_PROT_CFG_PROTECT_NAV        FIELD32(0x000c0000)
+#define CCK_PROT_CFG_TX_OP_ALLOW_CCK    FIELD32(0x00100000)
+#define CCK_PROT_CFG_TX_OP_ALLOW_OFDM   FIELD32(0x00200000)
+#define CCK_PROT_CFG_TX_OP_ALLOW_MM20   FIELD32(0x00400000)
+#define CCK_PROT_CFG_TX_OP_ALLOW_MM40   FIELD32(0x00800000)
+#define CCK_PROT_CFG_TX_OP_ALLOW_GF20   FIELD32(0x01000000)
+#define CCK_PROT_CFG_TX_OP_ALLOW_GF40   FIELD32(0x02000000)
+#define CCK_PROT_CFG_RTS_TH_EN          FIELD32(0x04000000)
+
+/*
+ * OFDM_PROT_CFG: OFDM Protection
+ */
+#define OFDM_PROT_CFG                   0x1368
+#define OFDM_PROT_CFG_PROTECT_RATE      FIELD32(0x0000ffff)
+#define OFDM_PROT_CFG_PROTECT_CTRL      FIELD32(0x00030000)
+#define OFDM_PROT_CFG_PROTECT_NAV       FIELD32(0x000c0000)
+#define OFDM_PROT_CFG_TX_OP_ALLOW_CCK   FIELD32(0x00100000)
+#define OFDM_PROT_CFG_TX_OP_ALLOW_OFDM  FIELD32(0x00200000)
+#define OFDM_PROT_CFG_TX_OP_ALLOW_MM20  FIELD32(0x00400000)
+#define OFDM_PROT_CFG_TX_OP_ALLOW_MM40  FIELD32(0x00800000)
+#define OFDM_PROT_CFG_TX_OP_ALLOW_GF20  FIELD32(0x01000000)
+#define OFDM_PROT_CFG_TX_OP_ALLOW_GF40  FIELD32(0x02000000)
+#define OFDM_PROT_CFG_RTS_TH_EN         FIELD32(0x04000000)
+
+/*
+ * MM20_PROT_CFG: MM20 Protection
+ */
+#define MM20_PROT_CFG                   0x136c
+#define MM20_PROT_CFG_PROTECT_RATE      FIELD32(0x0000ffff)
+#define MM20_PROT_CFG_PROTECT_CTRL      FIELD32(0x00030000)
+#define MM20_PROT_CFG_PROTECT_NAV       FIELD32(0x000c0000)
+#define MM20_PROT_CFG_TX_OP_ALLOW_CCK   FIELD32(0x00100000)
+#define MM20_PROT_CFG_TX_OP_ALLOW_OFDM  FIELD32(0x00200000)
+#define MM20_PROT_CFG_TX_OP_ALLOW_MM20  FIELD32(0x00400000)
+#define MM20_PROT_CFG_TX_OP_ALLOW_MM40  FIELD32(0x00800000)
+#define MM20_PROT_CFG_TX_OP_ALLOW_GF20  FIELD32(0x01000000)
+#define MM20_PROT_CFG_TX_OP_ALLOW_GF40  FIELD32(0x02000000)
+#define MM20_PROT_CFG_RTS_TH_EN         FIELD32(0x04000000)
+
+/*
+ * MM40_PROT_CFG: MM40 Protection
+ */
+#define MM40_PROT_CFG                   0x1370
+#define MM40_PROT_CFG_PROTECT_RATE      FIELD32(0x0000ffff)
+#define MM40_PROT_CFG_PROTECT_CTRL      FIELD32(0x00030000)
+#define MM40_PROT_CFG_PROTECT_NAV       FIELD32(0x000c0000)
+#define MM40_PROT_CFG_TX_OP_ALLOW_CCK   FIELD32(0x00100000)
+#define MM40_PROT_CFG_TX_OP_ALLOW_OFDM  FIELD32(0x00200000)
+#define MM40_PROT_CFG_TX_OP_ALLOW_MM20  FIELD32(0x00400000)
+#define MM40_PROT_CFG_TX_OP_ALLOW_MM40  FIELD32(0x00800000)
+#define MM40_PROT_CFG_TX_OP_ALLOW_GF20  FIELD32(0x01000000)
+#define MM40_PROT_CFG_TX_OP_ALLOW_GF40  FIELD32(0x02000000)
+#define MM40_PROT_CFG_RTS_TH_EN         FIELD32(0x04000000)
+
+/*
+ * GF20_PROT_CFG: GF20 Protection
+ */
+#define GF20_PROT_CFG                   0x1374
+#define GF20_PROT_CFG_PROTECT_RATE      FIELD32(0x0000ffff)
+#define GF20_PROT_CFG_PROTECT_CTRL      FIELD32(0x00030000)
+#define GF20_PROT_CFG_PROTECT_NAV       FIELD32(0x000c0000)
+#define GF20_PROT_CFG_TX_OP_ALLOW_CCK   FIELD32(0x00100000)
+#define GF20_PROT_CFG_TX_OP_ALLOW_OFDM  FIELD32(0x00200000)
+#define GF20_PROT_CFG_TX_OP_ALLOW_MM20  FIELD32(0x00400000)
+#define GF20_PROT_CFG_TX_OP_ALLOW_MM40  FIELD32(0x00800000)
+#define GF20_PROT_CFG_TX_OP_ALLOW_GF20  FIELD32(0x01000000)
+#define GF20_PROT_CFG_TX_OP_ALLOW_GF40  FIELD32(0x02000000)
+#define GF20_PROT_CFG_RTS_TH_EN         FIELD32(0x04000000)
+
+/*
+ * GF40_PROT_CFG: GF40 Protection
+ */
+#define GF40_PROT_CFG                   0x1378
+#define GF40_PROT_CFG_PROTECT_RATE      FIELD32(0x0000ffff)
+#define GF40_PROT_CFG_PROTECT_CTRL      FIELD32(0x00030000)
+#define GF40_PROT_CFG_PROTECT_NAV       FIELD32(0x000c0000)
+#define GF40_PROT_CFG_TX_OP_ALLOW_CCK   FIELD32(0x00100000)
+#define GF40_PROT_CFG_TX_OP_ALLOW_OFDM  FIELD32(0x00200000)
+#define GF40_PROT_CFG_TX_OP_ALLOW_MM20  FIELD32(0x00400000)
+#define GF40_PROT_CFG_TX_OP_ALLOW_MM40  FIELD32(0x00800000)
+#define GF40_PROT_CFG_TX_OP_ALLOW_GF20  FIELD32(0x01000000)
+#define GF40_PROT_CFG_TX_OP_ALLOW_GF40  FIELD32(0x02000000)
+#define GF40_PROT_CFG_RTS_TH_EN         FIELD32(0x04000000)
+
+/*
+ * EXP_CTS_TIME:
+ */
+#define EXP_CTS_TIME                    0x137c
+
+/*
+ * EXP_ACK_TIME:
+ */
+#define EXP_ACK_TIME                    0x1380
+
+/*
+ * RX_FILTER_CFG: RX configuration register.
+ */
+#define RX_FILTER_CFG                   0x1400
+#define RX_FILTER_CFG_DROP_CRC_ERROR    FIELD32(0x00000001)
+#define RX_FILTER_CFG_DROP_PHY_ERROR    FIELD32(0x00000002)
+#define RX_FILTER_CFG_DROP_NOT_TO_ME    FIELD32(0x00000004)
+#define RX_FILTER_CFG_DROP_NOT_MY_BSSD  FIELD32(0x00000008)
+#define RX_FILTER_CFG_DROP_VER_ERROR    FIELD32(0x00000010)
+#define RX_FILTER_CFG_DROP_MULTICAST    FIELD32(0x00000020)
+#define RX_FILTER_CFG_DROP_BROADCAST    FIELD32(0x00000040)
+#define RX_FILTER_CFG_DROP_DUPLICATE    FIELD32(0x00000080)
+#define RX_FILTER_CFG_DROP_CF_END_ACK   FIELD32(0x00000100)
+#define RX_FILTER_CFG_DROP_CF_END       FIELD32(0x00000200)
+#define RX_FILTER_CFG_DROP_ACK          FIELD32(0x00000400)
+#define RX_FILTER_CFG_DROP_CTS          FIELD32(0x00000800)
+#define RX_FILTER_CFG_DROP_RTS          FIELD32(0x00001000)
+#define RX_FILTER_CFG_DROP_PSPOLL       FIELD32(0x00002000)
+#define RX_FILTER_CFG_DROP_BA           FIELD32(0x00004000)
+#define RX_FILTER_CFG_DROP_BAR          FIELD32(0x00008000)
+#define RX_FILTER_CFG_DROP_CNTL         FIELD32(0x00010000)
+
+/*
+ * AUTO_RSP_CFG:
+ * AUTORESPONDER: 0: disable, 1: enable
+ * BAC_ACK_POLICY: 0:long, 1:short preamble
+ * CTS_40_MMODE: Response CTS 40MHz duplicate mode
+ * CTS_40_MREF: Response CTS 40MHz duplicate mode
+ * AR_PREAMBLE: Auto responder preamble 0:long, 1:short preamble
+ * DUAL_CTS_EN: Power bit value in control frame
+ * ACK_CTS_PSM_BIT:Power bit value in control frame
+ */
+#define AUTO_RSP_CFG                    0x1404
+#define AUTO_RSP_CFG_AUTORESPONDER      FIELD32(0x00000001)
+#define AUTO_RSP_CFG_BAC_ACK_POLICY     FIELD32(0x00000002)
+#define AUTO_RSP_CFG_CTS_40_MMODE       FIELD32(0x00000004)
+#define AUTO_RSP_CFG_CTS_40_MREF        FIELD32(0x00000008)
+#define AUTO_RSP_CFG_AR_PREAMBLE        FIELD32(0x00000010)
+#define AUTO_RSP_CFG_DUAL_CTS_EN        FIELD32(0x00000040)
+#define AUTO_RSP_CFG_ACK_CTS_PSM_BIT    FIELD32(0x00000080)
+
+/*
+ * LEGACY_BASIC_RATE:
+ */
+#define LEGACY_BASIC_RATE               0x1408
+
+/*
+ * HT_BASIC_RATE:
+ */
+#define HT_BASIC_RATE                   0x140c
+
+/*
+ * HT_CTRL_CFG:
+ */
+#define HT_CTRL_CFG                     0x1410
+
+/*
+ * SIFS_COST_CFG:
+ */
+#define SIFS_COST_CFG                   0x1414
+
+/*
+ * RX_PARSER_CFG:
+ * Set NAV for all received frames
+ */
+#define RX_PARSER_CFG                   0x1418
+
+/*
+ * TX_SEC_CNT0:
+ */
+#define TX_SEC_CNT0                     0x1500
+
+/*
+ * RX_SEC_CNT0:
+ */
+#define RX_SEC_CNT0                     0x1504
+
+/*
+ * CCMP_FC_MUTE:
+ */
+#define CCMP_FC_MUTE                    0x1508
+
+/*
+ * TXOP_HLDR_ADDR0:
+ */
+#define TXOP_HLDR_ADDR0                 0x1600
+
+/*
+ * TXOP_HLDR_ADDR1:
+ */
+#define TXOP_HLDR_ADDR1                 0x1604
+
+/*
+ * TXOP_HLDR_ET:
+ */
+#define TXOP_HLDR_ET                    0x1608
+
+/*
+ * QOS_CFPOLL_RA_DW0:
+ */
+#define QOS_CFPOLL_RA_DW0               0x160c
+
+/*
+ * QOS_CFPOLL_RA_DW1:
+ */
+#define QOS_CFPOLL_RA_DW1               0x1610
+
+/*
+ * QOS_CFPOLL_QC:
+ */
+#define QOS_CFPOLL_QC                   0x1614
+
+/*
+ * RX_STA_CNT0: RX PLCP error count & RX CRC error count
+ */
+#define RX_STA_CNT0                     0x1700
+#define RX_STA_CNT0_CRC_ERR             FIELD32(0x0000ffff)
+#define RX_STA_CNT0_PHY_ERR             FIELD32(0xffff0000)
+
+/*
+ * RX_STA_CNT1: RX False CCA count & RX LONG frame count
+ */
+#define RX_STA_CNT1                     0x1704
+#define RX_STA_CNT1_FALSE_CCA           FIELD32(0x0000ffff)
+#define RX_STA_CNT1_PLCP_ERR            FIELD32(0xffff0000)
+
+/*
+ * RX_STA_CNT2:
+ */
+#define RX_STA_CNT2                     0x1708
+#define RX_STA_CNT2_RX_DUPLI_COUNT      FIELD32(0x0000ffff)
+#define RX_STA_CNT2_RX_FIFO_OVERFLOW    FIELD32(0xffff0000)
+
+/*
+ * TX_STA_CNT0: TX Beacon count
+ */
+#define TX_STA_CNT0                     0x170c
+#define TX_STA_CNT0_TX_FAIL_COUNT       FIELD32(0x0000ffff)
+#define TX_STA_CNT0_TX_BEACON_COUNT     FIELD32(0xffff0000)
+
+/*
+ * TX_STA_CNT1: TX tx count
+ */
+#define TX_STA_CNT1                     0x1710
+#define TX_STA_CNT1_TX_SUCCESS          FIELD32(0x0000ffff)
+#define TX_STA_CNT1_TX_RETRANSMIT       FIELD32(0xffff0000)
+
+/*
+ * TX_STA_CNT2: TX tx count
+ */
+#define TX_STA_CNT2                     0x1714
+#define TX_STA_CNT2_TX_ZERO_LEN_COUNT   FIELD32(0x0000ffff)
+#define TX_STA_CNT2_TX_UNDER_FLOW_COUNT FIELD32(0xffff0000)
+
+/*
+ * TX_STA_FIFO: TX Result for specific PID status fifo register
+ */
+#define TX_STA_FIFO                     0x1718
+#define TX_STA_FIFO_VALID               FIELD32(0x00000001)
+#define TX_STA_FIFO_PID_TYPE            FIELD32(0x0000001e)
+#define TX_STA_FIFO_TX_SUCCESS          FIELD32(0x00000020)
+#define TX_STA_FIFO_TX_AGGRE            FIELD32(0x00000040)
+#define TX_STA_FIFO_TX_ACK_REQUIRED     FIELD32(0x00000080)
+#define TX_STA_FIFO_WCID                FIELD32(0x0000ff00)
+#define TX_STA_FIFO_MCS                 FIELD32(0x007f0000)
+#define TX_STA_FIFO_PHYMODE             FIELD32(0xc0000000)
+
+/*
+ * TX_AGG_CNT: Debug counter
+ */
+#define TX_AGG_CNT                      0x171c
+#define TX_AGG_CNT_NON_AGG_TX_COUNT     FIELD32(0x0000ffff)
+#define TX_AGG_CNT_AGG_TX_COUNT         FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT0:
+ */
+#define TX_AGG_CNT0                     0x1720
+#define TX_AGG_CNT0_AGG_SIZE_1_COUNT    FIELD32(0x0000ffff)
+#define TX_AGG_CNT0_AGG_SIZE_2_COUNT    FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT1:
+ */
+#define TX_AGG_CNT1                     0x1724
+#define TX_AGG_CNT1_AGG_SIZE_3_COUNT    FIELD32(0x0000ffff)
+#define TX_AGG_CNT1_AGG_SIZE_4_COUNT    FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT2:
+ */
+#define TX_AGG_CNT2                     0x1728
+#define TX_AGG_CNT2_AGG_SIZE_5_COUNT    FIELD32(0x0000ffff)
+#define TX_AGG_CNT2_AGG_SIZE_6_COUNT    FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT3:
+ */
+#define TX_AGG_CNT3                     0x172c
+#define TX_AGG_CNT3_AGG_SIZE_7_COUNT    FIELD32(0x0000ffff)
+#define TX_AGG_CNT3_AGG_SIZE_8_COUNT    FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT4:
+ */
+#define TX_AGG_CNT4                     0x1730
+#define TX_AGG_CNT4_AGG_SIZE_9_COUNT    FIELD32(0x0000ffff)
+#define TX_AGG_CNT4_AGG_SIZE_10_COUNT   FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT5:
+ */
+#define TX_AGG_CNT5                     0x1734
+#define TX_AGG_CNT5_AGG_SIZE_11_COUNT   FIELD32(0x0000ffff)
+#define TX_AGG_CNT5_AGG_SIZE_12_COUNT   FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT6:
+ */
+#define TX_AGG_CNT6                     0x1738
+#define TX_AGG_CNT6_AGG_SIZE_13_COUNT   FIELD32(0x0000ffff)
+#define TX_AGG_CNT6_AGG_SIZE_14_COUNT   FIELD32(0xffff0000)
+
+/*
+ * TX_AGG_CNT7:
+ */
+#define TX_AGG_CNT7                     0x173c
+#define TX_AGG_CNT7_AGG_SIZE_15_COUNT   FIELD32(0x0000ffff)
+#define TX_AGG_CNT7_AGG_SIZE_16_COUNT   FIELD32(0xffff0000)
+
+/*
+ * MPDU_DENSITY_CNT:
+ * TX_ZERO_DEL: TX zero length delimiter count
+ * RX_ZERO_DEL: RX zero length delimiter count
+ */
+#define MPDU_DENSITY_CNT                0x1740
+#define MPDU_DENSITY_CNT_TX_ZERO_DEL    FIELD32(0x0000ffff)
+#define MPDU_DENSITY_CNT_RX_ZERO_DEL    FIELD32(0xffff0000)
+
+/*
+ * Security key table memory.
+ * MAC_WCID_BASE: 8-bytes (use only 6 bytes) * 256 entry
+ * PAIRWISE_KEY_TABLE_BASE: 32-byte * 256 entry
+ * MAC_IVEIV_TABLE_BASE: 8-byte * 256-entry
+ * MAC_WCID_ATTRIBUTE_BASE: 4-byte * 256-entry
+ * SHARED_KEY_TABLE_BASE: 32 bytes * 32-entry
+ * SHARED_KEY_MODE_BASE: 4 bits * 32-entry
+ */
+#define MAC_WCID_BASE                   0x1800
+#define PAIRWISE_KEY_TABLE_BASE         0x4000
+#define MAC_IVEIV_TABLE_BASE            0x6000
+#define MAC_WCID_ATTRIBUTE_BASE         0x6800
+#define SHARED_KEY_TABLE_BASE           0x6c00
+#define SHARED_KEY_MODE_BASE            0x7000
+
+#define MAC_WCID_ENTRY(__idx) \
+        ( MAC_WCID_BASE + ((__idx) * sizeof(struct mac_wcid_entry)) )
+#define PAIRWISE_KEY_ENTRY(__idx) \
+        ( PAIRWISE_KEY_TABLE_BASE + ((__idx) * sizeof(struct hw_key_entry)) )
+#define MAC_IVEIV_ENTRY(__idx) \
+        ( MAC_IVEIV_TABLE_BASE + ((__idx) & sizeof(struct mac_iveiv_entry)) )
+#define MAC_WCID_ATTR_ENTRY(__idx) \
+        ( MAC_WCID_ATTRIBUTE_BASE + ((__idx) * sizeof(u32)) )
+#define SHARED_KEY_ENTRY(__idx) \
+        ( SHARED_KEY_TABLE_BASE + ((__idx) * sizeof(struct hw_key_entry)) )
+#define SHARED_KEY_MODE_ENTRY(__idx) \
+        ( SHARED_KEY_MODE_BASE + ((__idx) * sizeof(u32)) )
+
+struct mac_wcid_entry {
+        u8 mac[6];
+        u8 reserved[2];
+} __attribute__ ((packed));
+
+struct hw_key_entry {
+        u8 key[16];
+        u8 tx_mic[8];
+        u8 rx_mic[8];
+} __attribute__ ((packed));
+
+struct mac_iveiv_entry {
+        u8 iv[8];
+} __attribute__ ((packed));
+
+/*
+ * MAC_WCID_ATTRIBUTE:
+ */
+#define MAC_WCID_ATTRIBUTE_KEYTAB       FIELD32(0x00000001)
+#define MAC_WCID_ATTRIBUTE_CIPHER       FIELD32(0x0000000e)
+#define MAC_WCID_ATTRIBUTE_BSS_IDX      FIELD32(0x00000070)
+#define MAC_WCID_ATTRIBUTE_RX_WIUDF     FIELD32(0x00000380)
+
+/*
+ * SHARED_KEY_MODE:
+ */
+#define SHARED_KEY_MODE_BSS0_KEY0       FIELD32(0x00000007)
+#define SHARED_KEY_MODE_BSS0_KEY1       FIELD32(0x00000070)
+#define SHARED_KEY_MODE_BSS0_KEY2       FIELD32(0x00000700)
+#define SHARED_KEY_MODE_BSS0_KEY3       FIELD32(0x00007000)
+#define SHARED_KEY_MODE_BSS1_KEY0       FIELD32(0x00070000)
+#define SHARED_KEY_MODE_BSS1_KEY1       FIELD32(0x00700000)
+#define SHARED_KEY_MODE_BSS1_KEY2       FIELD32(0x07000000)
+#define SHARED_KEY_MODE_BSS1_KEY3       FIELD32(0x70000000)
+
+/*
+ * HOST-MCU communication
+ */
+
+/*
+ * H2M_MAILBOX_CSR: Host-to-MCU Mailbox.
+ */
+#define H2M_MAILBOX_CSR                 0x7010
+#define H2M_MAILBOX_CSR_ARG0            FIELD32(0x000000ff)
+#define H2M_MAILBOX_CSR_ARG1            FIELD32(0x0000ff00)
+#define H2M_MAILBOX_CSR_CMD_TOKEN       FIELD32(0x00ff0000)
+#define H2M_MAILBOX_CSR_OWNER           FIELD32(0xff000000)
+
+/*
+ * H2M_MAILBOX_CID:
+ */
+#define H2M_MAILBOX_CID                 0x7014
+#define H2M_MAILBOX_CID_CMD0            FIELD32(0x000000ff)
+#define H2M_MAILBOX_CID_CMD1            FIELD32(0x0000ff00)
+#define H2M_MAILBOX_CID_CMD2            FIELD32(0x00ff0000)
+#define H2M_MAILBOX_CID_CMD3            FIELD32(0xff000000)
+
+/*
+ * H2M_MAILBOX_STATUS:
+ */
+#define H2M_MAILBOX_STATUS              0x701c
+
+/*
+ * H2M_INT_SRC:
+ */
+#define H2M_INT_SRC                     0x7024
+
+/*
+ * H2M_BBP_AGENT:
+ */
+#define H2M_BBP_AGENT                   0x7028
+
+/*
+ * MCU_LEDCS: LED control for MCU Mailbox.
+ */
+#define MCU_LEDCS_LED_MODE              FIELD8(0x1f)
+#define MCU_LEDCS_POLARITY              FIELD8(0x01)
+
+/*
+ * HW_CS_CTS_BASE:
+ * Carrier-sense CTS frame base address.
+ * It's where mac stores carrier-sense frame for carrier-sense function.
+ */
+#define HW_CS_CTS_BASE                  0x7700
+
+/*
+ * HW_DFS_CTS_BASE:
+ * FS CTS frame base address. It's where mac stores CTS frame for DFS.
+ */
+#define HW_DFS_CTS_BASE                 0x7780
+
+/*
+ * TXRX control registers - base address 0x3000
+ */
+
+/*
+ * TXRX_CSR1:
+ * rt2860b  UNKNOWN reg use R/O Reg Addr 0x77d0 first..
+ */
+#define TXRX_CSR1                       0x77d0
+
+/*
+ * HW_DEBUG_SETTING_BASE:
+ * since NULL frame won't be that long (256 byte)
+ * We steal 16 tail bytes to save debugging settings
+ */
+#define HW_DEBUG_SETTING_BASE           0x77f0
+#define HW_DEBUG_SETTING_BASE2          0x7770
+
+/*
+ * HW_BEACON_BASE
+ * In order to support maximum 8 MBSS and its maximum length
+ * is 512 bytes for each beacon
+ * Three section discontinue memory segments will be used.
+ * 1. The original region for BCN 0~3
+ * 2. Extract memory from FCE table for BCN 4~5
+ * 3. Extract memory from Pair-wise key table for BCN 6~7
+ *    It occupied those memory of wcid 238~253 for BCN 6
+ *    and wcid 222~237 for BCN 7
+ *
+ * IMPORTANT NOTE: Not sure why legacy driver does this,
+ * but HW_BEACON_BASE7 is 0x0200 bytes below HW_BEACON_BASE6.
+ */
+#define HW_BEACON_BASE0                 0x7800
+#define HW_BEACON_BASE1                 0x7a00
+#define HW_BEACON_BASE2                 0x7c00
+#define HW_BEACON_BASE3                 0x7e00
+#define HW_BEACON_BASE4                 0x7200
+#define HW_BEACON_BASE5                 0x7400
+#define HW_BEACON_BASE6                 0x5dc0
+#define HW_BEACON_BASE7                 0x5bc0
+
+#define HW_BEACON_OFFSET(__index) \
+        ( ((__index) < 4) ? ( HW_BEACON_BASE0 + (__index * 0x0200) ) : \
+          (((__index) < 6) ? ( HW_BEACON_BASE4 + ((__index - 4) * 0x0200) ) : \
+          (HW_BEACON_BASE6 - ((__index - 6) * 0x0200))) )
+
+/*
+ * 8051 firmware image.
+ */
+#define FIRMWARE_RT2860                 "rt2860.bin"
+#define FIRMWARE_IMAGE_BASE             0x2000
+
+/*
+ * BBP registers.
+ * The wordsize of the BBP is 8 bits.
+ */
+
+/*
+ * BBP 1: TX Antenna
+ */
+#define BBP1_TX_POWER                   FIELD8(0x07)
+#define BBP1_TX_ANTENNA                 FIELD8(0x18)
+
+/*
+ * BBP 3: RX Antenna
+ */
+#define BBP3_RX_ANTENNA                 FIELD8(0x18)
+#define BBP3_HT40_PLUS                  FIELD8(0x20)
+
+/*
+ * BBP 4: Bandwidth
+ */
+#define BBP4_TX_BF                      FIELD8(0x01)
+#define BBP4_BANDWIDTH                  FIELD8(0x18)
+
+/*
+ * RFCSR registers
+ * The wordsize of the RFCSR is 8 bits.
+ */
+
+/*
+ * RFCSR 6:
+ */
+#define RFCSR6_R                        FIELD8(0x03)
+
+/*
+ * RFCSR 7:
+ */
+#define RFCSR7_RF_TUNING                FIELD8(0x01)
+
+/*
+ * RFCSR 12:
+ */
+#define RFCSR12_TX_POWER                FIELD8(0x1f)
+
+/*
+ * RFCSR 22:
+ */
+#define RFCSR22_BASEBAND_LOOPBACK       FIELD8(0x01)
+
+/*
+ * RFCSR 23:
+ */
+#define RFCSR23_FREQ_OFFSET             FIELD8(0x7f)
+
+/*
+ * RFCSR 30:
+ */
+#define RFCSR30_RF_CALIBRATION          FIELD8(0x80)
+
+/*
+ * RF registers
+ */
+
+/*
+ * RF 2
+ */
+#define RF2_ANTENNA_RX2                 FIELD32(0x00000040)
+#define RF2_ANTENNA_TX1                 FIELD32(0x00004000)
+#define RF2_ANTENNA_RX1                 FIELD32(0x00020000)
+
+/*
+ * RF 3
+ */
+#define RF3_TXPOWER_G                   FIELD32(0x00003e00)
+#define RF3_TXPOWER_A_7DBM_BOOST        FIELD32(0x00000200)
+#define RF3_TXPOWER_A                   FIELD32(0x00003c00)
+
+/*
+ * RF 4
+ */
+#define RF4_TXPOWER_G                   FIELD32(0x000007c0)
+#define RF4_TXPOWER_A_7DBM_BOOST        FIELD32(0x00000040)
+#define RF4_TXPOWER_A                   FIELD32(0x00000780)
+#define RF4_FREQ_OFFSET                 FIELD32(0x001f8000)
+#define RF4_HT40                        FIELD32(0x00200000)
+
+/*
+ * EEPROM content.
+ * The wordsize of the EEPROM is 16 bits.
+ */
+
+/*
+ * EEPROM Version
+ */
+#define EEPROM_VERSION                  0x0001
+#define EEPROM_VERSION_FAE              FIELD16(0x00ff)
+#define EEPROM_VERSION_VERSION          FIELD16(0xff00)
+
+/*
+ * HW MAC address.
+ */
+#define EEPROM_MAC_ADDR_0               0x0002
+#define EEPROM_MAC_ADDR_BYTE0           FIELD16(0x00ff)
+#define EEPROM_MAC_ADDR_BYTE1           FIELD16(0xff00)
+#define EEPROM_MAC_ADDR_1               0x0003
+#define EEPROM_MAC_ADDR_BYTE2           FIELD16(0x00ff)
+#define EEPROM_MAC_ADDR_BYTE3           FIELD16(0xff00)
+#define EEPROM_MAC_ADDR_2               0x0004
+#define EEPROM_MAC_ADDR_BYTE4           FIELD16(0x00ff)
+#define EEPROM_MAC_ADDR_BYTE5           FIELD16(0xff00)
+
+/*
+ * EEPROM ANTENNA config
+ * RXPATH: 1: 1R, 2: 2R, 3: 3R
+ * TXPATH: 1: 1T, 2: 2T
+ */
+#define EEPROM_ANTENNA                  0x001a
+#define EEPROM_ANTENNA_RXPATH           FIELD16(0x000f)
+#define EEPROM_ANTENNA_TXPATH           FIELD16(0x00f0)
+#define EEPROM_ANTENNA_RF_TYPE          FIELD16(0x0f00)
+
+/*
+ * EEPROM NIC config
+ * CARDBUS_ACCEL: 0 - enable, 1 - disable
+ */
+#define EEPROM_NIC                      0x001b
+#define EEPROM_NIC_HW_RADIO             FIELD16(0x0001)
+#define EEPROM_NIC_DYNAMIC_TX_AGC       FIELD16(0x0002)
+#define EEPROM_NIC_EXTERNAL_LNA_BG      FIELD16(0x0004)
+#define EEPROM_NIC_EXTERNAL_LNA_A       FIELD16(0x0008)
+#define EEPROM_NIC_CARDBUS_ACCEL        FIELD16(0x0010)
+#define EEPROM_NIC_BW40M_SB_BG          FIELD16(0x0020)
+#define EEPROM_NIC_BW40M_SB_A           FIELD16(0x0040)
+#define EEPROM_NIC_WPS_PBC              FIELD16(0x0080)
+#define EEPROM_NIC_BW40M_BG             FIELD16(0x0100)
+#define EEPROM_NIC_BW40M_A              FIELD16(0x0200)
+
+/*
+ * EEPROM frequency
+ */
+#define EEPROM_FREQ                     0x001d
+#define EEPROM_FREQ_OFFSET              FIELD16(0x00ff)
+#define EEPROM_FREQ_LED_MODE            FIELD16(0x7f00)
+#define EEPROM_FREQ_LED_POLARITY        FIELD16(0x1000)
+
+/*
+ * EEPROM LED
+ * POLARITY_RDY_G: Polarity RDY_G setting.
+ * POLARITY_RDY_A: Polarity RDY_A setting.
+ * POLARITY_ACT: Polarity ACT setting.
+ * POLARITY_GPIO_0: Polarity GPIO0 setting.
+ * POLARITY_GPIO_1: Polarity GPIO1 setting.
+ * POLARITY_GPIO_2: Polarity GPIO2 setting.
+ * POLARITY_GPIO_3: Polarity GPIO3 setting.
+ * POLARITY_GPIO_4: Polarity GPIO4 setting.
+ * LED_MODE: Led mode.
+ */
+#define EEPROM_LED1                     0x001e
+#define EEPROM_LED2                     0x001f
+#define EEPROM_LED3                     0x0020
+#define EEPROM_LED_POLARITY_RDY_BG      FIELD16(0x0001)
+#define EEPROM_LED_POLARITY_RDY_A       FIELD16(0x0002)
+#define EEPROM_LED_POLARITY_ACT         FIELD16(0x0004)
+#define EEPROM_LED_POLARITY_GPIO_0      FIELD16(0x0008)
+#define EEPROM_LED_POLARITY_GPIO_1      FIELD16(0x0010)
+#define EEPROM_LED_POLARITY_GPIO_2      FIELD16(0x0020)
+#define EEPROM_LED_POLARITY_GPIO_3      FIELD16(0x0040)
+#define EEPROM_LED_POLARITY_GPIO_4      FIELD16(0x0080)
+#define EEPROM_LED_LED_MODE             FIELD16(0x1f00)
+
+/*
+ * EEPROM LNA
+ */
+#define EEPROM_LNA                      0x0022
+#define EEPROM_LNA_BG                   FIELD16(0x00ff)
+#define EEPROM_LNA_A0                   FIELD16(0xff00)
+
+/*
+ * EEPROM RSSI BG offset
+ */
+#define EEPROM_RSSI_BG                  0x0023
+#define EEPROM_RSSI_BG_OFFSET0          FIELD16(0x00ff)
+#define EEPROM_RSSI_BG_OFFSET1          FIELD16(0xff00)
+
+/*
+ * EEPROM RSSI BG2 offset
+ */
+#define EEPROM_RSSI_BG2                 0x0024
+#define EEPROM_RSSI_BG2_OFFSET2         FIELD16(0x00ff)
+#define EEPROM_RSSI_BG2_LNA_A1          FIELD16(0xff00)
+
+/*
+ * EEPROM RSSI A offset
+ */
+#define EEPROM_RSSI_A                   0x0025
+#define EEPROM_RSSI_A_OFFSET0           FIELD16(0x00ff)
+#define EEPROM_RSSI_A_OFFSET1           FIELD16(0xff00)
+
+/*
+ * EEPROM RSSI A2 offset
+ */
+#define EEPROM_RSSI_A2                  0x0026
+#define EEPROM_RSSI_A2_OFFSET2          FIELD16(0x00ff)
+#define EEPROM_RSSI_A2_LNA_A2           FIELD16(0xff00)
+
+/*
+ * EEPROM TXpower delta: 20MHZ AND 40 MHZ use different power.
+ *      This is delta in 40MHZ.
+ * VALUE: Tx Power dalta value (MAX=4)
+ * TYPE: 1: Plus the delta value, 0: minus the delta value
+ * TXPOWER: Enable:
+ */
+#define EEPROM_TXPOWER_DELTA            0x0028
+#define EEPROM_TXPOWER_DELTA_VALUE      FIELD16(0x003f)
+#define EEPROM_TXPOWER_DELTA_TYPE       FIELD16(0x0040)
+#define EEPROM_TXPOWER_DELTA_TXPOWER    FIELD16(0x0080)
+
+/*
+ * EEPROM TXPOWER 802.11BG
+ */
+#define EEPROM_TXPOWER_BG1              0x0029
+#define EEPROM_TXPOWER_BG2              0x0030
+#define EEPROM_TXPOWER_BG_SIZE          7
+#define EEPROM_TXPOWER_BG_1             FIELD16(0x00ff)
+#define EEPROM_TXPOWER_BG_2             FIELD16(0xff00)
+
+/*
+ * EEPROM TXPOWER 802.11A
+ */
+#define EEPROM_TXPOWER_A1               0x003c
+#define EEPROM_TXPOWER_A2               0x0053
+#define EEPROM_TXPOWER_A_SIZE           6
+#define EEPROM_TXPOWER_A_1              FIELD16(0x00ff)
+#define EEPROM_TXPOWER_A_2              FIELD16(0xff00)
+
+/*
+ * EEPROM TXpower byrate: 20MHZ power
+ */
+#define EEPROM_TXPOWER_BYRATE           0x006f
+
+/*
+ * EEPROM BBP.
+ */
+#define EEPROM_BBP_START                0x0078
+#define EEPROM_BBP_SIZE                 16
+#define EEPROM_BBP_VALUE                FIELD16(0x00ff)
+#define EEPROM_BBP_REG_ID               FIELD16(0xff00)
+
+/*
+ * MCU mailbox commands.
+ */
+#define MCU_SLEEP                       0x30
+#define MCU_WAKEUP                      0x31
+#define MCU_RADIO_OFF                   0x35
+#define MCU_CURRENT                     0x36
+#define MCU_LED                         0x50
+#define MCU_LED_STRENGTH                0x51
+#define MCU_LED_1                       0x52
+#define MCU_LED_2                       0x53
+#define MCU_LED_3                       0x54
+#define MCU_RADAR                       0x60
+#define MCU_BOOT_SIGNAL                 0x72
+#define MCU_BBP_SIGNAL                  0x80
+#define MCU_POWER_SAVE                  0x83
+
+/*
+ * MCU mailbox tokens
+ */
+#define TOKEN_WAKUP                     3
+
+/*
+ * DMA descriptor defines.
+ */
+#define TXD_DESC_SIZE                   ( 4 * sizeof(__le32) )
+#define TXWI_DESC_SIZE                  ( 4 * sizeof(__le32) )
+#define RXD_DESC_SIZE                   ( 4 * sizeof(__le32) )
+#define RXWI_DESC_SIZE                  ( 4 * sizeof(__le32) )
+
+/*
+ * TX descriptor format for TX, PRIO and Beacon Ring.
+ */
+
+/*
+ * Word0
+ */
+#define TXD_W0_SD_PTR0                  FIELD32(0xffffffff)
+
+/*
+ * Word1
+ */
+#define TXD_W1_SD_LEN1                  FIELD32(0x00003fff)
+#define TXD_W1_LAST_SEC1                FIELD32(0x00004000)
+#define TXD_W1_BURST                    FIELD32(0x00008000)
+#define TXD_W1_SD_LEN0                  FIELD32(0x3fff0000)
+#define TXD_W1_LAST_SEC0                FIELD32(0x40000000)
+#define TXD_W1_DMA_DONE                 FIELD32(0x80000000)
+
+/*
+ * Word2
+ */
+#define TXD_W2_SD_PTR1                  FIELD32(0xffffffff)
+
+/*
+ * Word3
+ * WIV: Wireless Info Valid. 1: Driver filled WI, 0: DMA needs to copy WI
+ * QSEL: Select on-chip FIFO ID for 2nd-stage output scheduler.
+ *       0:MGMT, 1:HCCA 2:EDCA
+ */
+#define TXD_W3_WIV                      FIELD32(0x01000000)
+#define TXD_W3_QSEL                     FIELD32(0x06000000)
+#define TXD_W3_TCO                      FIELD32(0x20000000)
+#define TXD_W3_UCO                      FIELD32(0x40000000)
+#define TXD_W3_ICO                      FIELD32(0x80000000)
+
+/*
+ * TX WI structure
+ */
+
+/*
+ * Word0
+ * FRAG: 1 To inform TKIP engine this is a fragment.
+ * MIMO_PS: The remote peer is in dynamic MIMO-PS mode
+ * TX_OP: 0:HT TXOP rule , 1:PIFS TX ,2:Backoff, 3:sifs
+ * BW: Channel bandwidth 20MHz or 40 MHz
+ * STBC: 1: STBC support MCS =0-7, 2,3 : RESERVED
+ */
+#define TXWI_W0_FRAG                    FIELD32(0x00000001)
+#define TXWI_W0_MIMO_PS                 FIELD32(0x00000002)
+#define TXWI_W0_CF_ACK                  FIELD32(0x00000004)
+#define TXWI_W0_TS                      FIELD32(0x00000008)
+#define TXWI_W0_AMPDU                   FIELD32(0x00000010)
+#define TXWI_W0_MPDU_DENSITY            FIELD32(0x000000e0)
+#define TXWI_W0_TX_OP                   FIELD32(0x00000300)
+#define TXWI_W0_MCS                     FIELD32(0x007f0000)
+#define TXWI_W0_BW                      FIELD32(0x00800000)
+#define TXWI_W0_SHORT_GI                FIELD32(0x01000000)
+#define TXWI_W0_STBC                    FIELD32(0x06000000)
+#define TXWI_W0_IFS                     FIELD32(0x08000000)
+#define TXWI_W0_PHYMODE                 FIELD32(0xc0000000)
+
+/*
+ * Word1
+ */
+#define TXWI_W1_ACK                     FIELD32(0x00000001)
+#define TXWI_W1_NSEQ                    FIELD32(0x00000002)
+#define TXWI_W1_BW_WIN_SIZE             FIELD32(0x000000fc)
+#define TXWI_W1_WIRELESS_CLI_ID         FIELD32(0x0000ff00)
+#define TXWI_W1_MPDU_TOTAL_BYTE_COUNT   FIELD32(0x0fff0000)
+#define TXWI_W1_PACKETID                FIELD32(0xf0000000)
+
+/*
+ * Word2
+ */
+#define TXWI_W2_IV                      FIELD32(0xffffffff)
+
+/*
+ * Word3
+ */
+#define TXWI_W3_EIV                     FIELD32(0xffffffff)
+
+/*
+ * RX descriptor format for RX Ring.
+ */
+
+/*
+ * Word0
+ */
+#define RXD_W0_SDP0                     FIELD32(0xffffffff)
+
+/*
+ * Word1
+ */
+#define RXD_W1_SDL1                     FIELD32(0x00003fff)
+#define RXD_W1_SDL0                     FIELD32(0x3fff0000)
+#define RXD_W1_LS0                      FIELD32(0x40000000)
+#define RXD_W1_DMA_DONE                 FIELD32(0x80000000)
+
+/*
+ * Word2
+ */
+#define RXD_W2_SDP1                     FIELD32(0xffffffff)
+
+/*
+ * Word3
+ * AMSDU: RX with 802.3 header, not 802.11 header.
+ * DECRYPTED: This frame is being decrypted.
+ */
+#define RXD_W3_BA                       FIELD32(0x00000001)
+#define RXD_W3_DATA                     FIELD32(0x00000002)
+#define RXD_W3_NULLDATA                 FIELD32(0x00000004)
+#define RXD_W3_FRAG                     FIELD32(0x00000008)
+#define RXD_W3_UNICAST_TO_ME            FIELD32(0x00000010)
+#define RXD_W3_MULTICAST                FIELD32(0x00000020)
+#define RXD_W3_BROADCAST                FIELD32(0x00000040)
+#define RXD_W3_MY_BSS                   FIELD32(0x00000080)
+#define RXD_W3_CRC_ERROR                FIELD32(0x00000100)
+#define RXD_W3_CIPHER_ERROR             FIELD32(0x00000600)
+#define RXD_W3_AMSDU                    FIELD32(0x00000800)
+#define RXD_W3_HTC                      FIELD32(0x00001000)
+#define RXD_W3_RSSI                     FIELD32(0x00002000)
+#define RXD_W3_L2PAD                    FIELD32(0x00004000)
+#define RXD_W3_AMPDU                    FIELD32(0x00008000)
+#define RXD_W3_DECRYPTED                FIELD32(0x00010000)
+#define RXD_W3_PLCP_SIGNAL              FIELD32(0x00020000)
+#define RXD_W3_PLCP_RSSI                FIELD32(0x00040000)
+
+/*
+ * RX WI structure
+ */
+
+/*
+ * Word0
+ */
+#define RXWI_W0_WIRELESS_CLI_ID         FIELD32(0x000000ff)
+#define RXWI_W0_KEY_INDEX               FIELD32(0x00000300)
+#define RXWI_W0_BSSID                   FIELD32(0x00001c00)
+#define RXWI_W0_UDF                     FIELD32(0x0000e000)
+#define RXWI_W0_MPDU_TOTAL_BYTE_COUNT   FIELD32(0x0fff0000)
+#define RXWI_W0_TID                     FIELD32(0xf0000000)
+
+/*
+ * Word1
+ */
+#define RXWI_W1_FRAG                    FIELD32(0x0000000f)
+#define RXWI_W1_SEQUENCE                FIELD32(0x0000fff0)
+#define RXWI_W1_MCS                     FIELD32(0x007f0000)
+#define RXWI_W1_BW                      FIELD32(0x00800000)
+#define RXWI_W1_SHORT_GI                FIELD32(0x01000000)
+#define RXWI_W1_STBC                    FIELD32(0x06000000)
+#define RXWI_W1_PHYMODE                 FIELD32(0xc0000000)
+
+/*
+ * Word2
+ */
+#define RXWI_W2_RSSI0                   FIELD32(0x000000ff)
+#define RXWI_W2_RSSI1                   FIELD32(0x0000ff00)
+#define RXWI_W2_RSSI2                   FIELD32(0x00ff0000)
+
+/*
+ * Word3
+ */
+#define RXWI_W3_SNR0                    FIELD32(0x000000ff)
+#define RXWI_W3_SNR1                    FIELD32(0x0000ff00)
+
+/*
+ * Macros for converting txpower from EEPROM to mac80211 value
+ * and from mac80211 value to register value.
+ */
+#define MIN_G_TXPOWER   0
+#define MIN_A_TXPOWER   -7
+#define MAX_G_TXPOWER   31
+#define MAX_A_TXPOWER   15
+#define DEFAULT_TXPOWER 5
+
+#define TXPOWER_G_FROM_DEV(__txpower) \
+        ((__txpower) > MAX_G_TXPOWER) ? DEFAULT_TXPOWER : (__txpower)
+
+#define TXPOWER_G_TO_DEV(__txpower) \
+        clamp_t(char, __txpower, MIN_G_TXPOWER, MAX_G_TXPOWER)
+
+#define TXPOWER_A_FROM_DEV(__txpower) \
+        ((__txpower) > MAX_A_TXPOWER) ? DEFAULT_TXPOWER : (__txpower)
+
+#define TXPOWER_A_TO_DEV(__txpower) \
+        clamp_t(char, __txpower, MIN_A_TXPOWER, MAX_A_TXPOWER)
+
+#endif /* RT2800PCI_H */
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 27bc6b7fbfde..196de8ab8153 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -158,6 +158,13 @@ struct rt2x00_chip {
 #define RT2561          0x0302
 #define RT2661          0x0401
 #define RT2571          0x1300
+#define RT2860          0x0601  /* 2.4GHz PCI/CB */
+#define RT2860D         0x0681  /* 2.4GHz, 5GHz PCI/CB */
+#define RT2890          0x0701  /* 2.4GHz PCIe */
+#define RT2890D         0x0781  /* 2.4GHz, 5GHz PCIe */
+#define RT2880          0x2880  /* WSOC */
+#define RT3052          0x3052  /* WSOC */
+#define RT3090          0x3090  /* 2.4GHz PCIe */
 #define RT2870          0x1600
 
         u16 rf;
diff --git a/drivers/net/wireless/rt2x00/rt2x00soc.c b/drivers/net/wireless/rt2x00/rt2x00soc.c
new file mode 100644
index 000000000000..539568c48953
--- /dev/null
+++ b/drivers/net/wireless/rt2x00/rt2x00soc.c
@@ -0,0 +1,159 @@
+/*
+        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        <http://rt2x00.serialmonkey.com>
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the
+        Free Software Foundation, Inc.,
+        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/*
+        Module: rt2x00soc
+        Abstract: rt2x00 generic soc device routines.
+ */
+
+#include <linux/bug.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+
+#include "rt2x00.h"
+#include "rt2x00soc.h"
+
+static void rt2x00soc_free_reg(struct rt2x00_dev *rt2x00dev)
+{
+        kfree(rt2x00dev->rf);
+        rt2x00dev->rf = NULL;
+
+        kfree(rt2x00dev->eeprom);
+        rt2x00dev->eeprom = NULL;
+}
+
+static int rt2x00soc_alloc_reg(struct rt2x00_dev *rt2x00dev)
+{
+        struct platform_device *pdev = to_platform_device(rt2x00dev->dev);
+        struct resource *res;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res)
+                return -ENODEV;
+
+        rt2x00dev->csr.base = (void __iomem *)KSEG1ADDR(res->start);
+        if (!rt2x00dev->csr.base)
+                goto exit;
+
+        rt2x00dev->eeprom = kzalloc(rt2x00dev->ops->eeprom_size, GFP_KERNEL);
+        if (!rt2x00dev->eeprom)
+                goto exit;
+
+        rt2x00dev->rf = kzalloc(rt2x00dev->ops->rf_size, GFP_KERNEL);
+        if (!rt2x00dev->rf)
+                goto exit;
+
+        return 0;
+
+exit:
+        ERROR_PROBE("Failed to allocate registers.\n");
+        rt2x00soc_free_reg(rt2x00dev);
+
+        return -ENOMEM;
+}
+
+int rt2x00soc_probe(struct platform_device *pdev,
+                    const unsigned short chipset,
+                    const struct rt2x00_ops *ops)
+{
+        struct ieee80211_hw *hw;
+        struct rt2x00_dev *rt2x00dev;
+        int retval;
+
+        hw = ieee80211_alloc_hw(sizeof(struct rt2x00_dev), ops->hw);
+        if (!hw) {
+                ERROR_PROBE("Failed to allocate hardware.\n");
+                return -ENOMEM;
+        }
+
+        platform_set_drvdata(pdev, hw);
+
+        rt2x00dev = hw->priv;
+        rt2x00dev->dev = &pdev->dev;
+        rt2x00dev->ops = ops;
+        rt2x00dev->hw = hw;
+        rt2x00dev->irq = platform_get_irq(pdev, 0);
+        rt2x00dev->name = pdev->dev.driver->name;
+
+        rt2x00_set_chip_rt(rt2x00dev, chipset);
+
+        retval = rt2x00soc_alloc_reg(rt2x00dev);
+        if (retval)
+                goto exit_free_device;
+
+        retval = rt2x00lib_probe_dev(rt2x00dev);
+        if (retval)
+                goto exit_free_reg;
+
+        return 0;
+
+exit_free_reg:
+        rt2x00soc_free_reg(rt2x00dev);
+
+exit_free_device:
+        ieee80211_free_hw(hw);
+
+        return retval;
+}
+
+int rt2x00soc_remove(struct platform_device *pdev)
+{
+        struct ieee80211_hw *hw = platform_get_drvdata(pdev);
+        struct rt2x00_dev *rt2x00dev = hw->priv;
+
+        /*
+         * Free all allocated data.
+         */
+        rt2x00lib_remove_dev(rt2x00dev);
+        rt2x00soc_free_reg(rt2x00dev);
+        ieee80211_free_hw(hw);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(rt2x00soc_remove);
+
+#ifdef CONFIG_PM
+int rt2x00soc_suspend(struct platform_device *pdev, pm_message_t state)
+{
+        struct ieee80211_hw *hw = platform_get_drvdata(pdev);
+        struct rt2x00_dev *rt2x00dev = hw->priv;
+
+        return rt2x00lib_suspend(rt2x00dev, state);
+}
+EXPORT_SYMBOL_GPL(rt2x00soc_suspend);
+
+int rt2x00soc_resume(struct platform_device *pdev)
+{
+        struct ieee80211_hw *hw = platform_get_drvdata(pdev);
+        struct rt2x00_dev *rt2x00dev = hw->priv;
+
+        return rt2x00lib_resume(rt2x00dev);
+}
+EXPORT_SYMBOL_GPL(rt2x00soc_resume);
+#endif /* CONFIG_PM */
+
+/*
+ * rt2x00soc module information.
+ */
+MODULE_AUTHOR(DRV_PROJECT);
+MODULE_VERSION(DRV_VERSION);
+MODULE_DESCRIPTION("rt2x00 soc library");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/wireless/rt2x00/rt2x00soc.h b/drivers/net/wireless/rt2x00/rt2x00soc.h
new file mode 100644
index 000000000000..5cf114ac2b9c
--- /dev/null
+++ b/drivers/net/wireless/rt2x00/rt2x00soc.h
@@ -0,0 +1,52 @@
+/*
+        Copyright (C) 2004 - 2009 rt2x00 SourceForge Project
+        <http://rt2x00.serialmonkey.com>
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the
+        Free Software Foundation, Inc.,
+        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+/*
+        Module: rt2x00soc
+        Abstract: Data structures for the rt2x00soc module.
+ */
+
+#ifndef RT2X00SOC_H
+#define RT2X00SOC_H
+
+#define KSEG1ADDR(__ptr) __ptr
+
+#define __rt2x00soc_probe(__chipset, __ops) \
+static int __rt2x00soc_probe(struct platform_device *pdev) \
+{ \
+        return rt2x00soc_probe(pdev, (__chipset), (__ops)); \
+}
+
+/*
+ * SoC driver handlers.
+ */
+int rt2x00soc_probe(struct platform_device *pdev,
+                    const unsigned short chipset,
+                    const struct rt2x00_ops *ops);
+int rt2x00soc_remove(struct platform_device *pdev);
+#ifdef CONFIG_PM
+int rt2x00soc_suspend(struct platform_device *pdev, pm_message_t state);
+int rt2x00soc_resume(struct platform_device *pdev);
+#else
+#define rt2x00soc_suspend       NULL
+#define rt2x00soc_resume        NULL
+#endif /* CONFIG_PM */
+
+#endif /* RT2X00SOC_H */
diff --git a/drivers/net/wireless/wl12xx/wl1251_main.c b/drivers/net/wireless/wl12xx/wl1251_main.c
index 1103256ad989..48b0bfd6c55a 100644
--- a/drivers/net/wireless/wl12xx/wl1251_main.c
+++ b/drivers/net/wireless/wl12xx/wl1251_main.c
@@ -183,8 +183,11 @@ static int wl1251_chip_wakeup(struct wl1251 *wl)
                 wl1251_debug(DEBUG_BOOT, "chip id 0x%x (1251 PG12)",
                              wl->chip_id);
                 break;
-        case CHIP_ID_1251_PG10:
         case CHIP_ID_1251_PG11:
+                wl1251_debug(DEBUG_BOOT, "chip id 0x%x (1251 PG11)",
+                             wl->chip_id);
+                break;
+        case CHIP_ID_1251_PG10:
         default:
                 wl1251_error("unsupported chip id: 0x%x", wl->chip_id);
                 ret = -ENODEV;
@@ -1426,4 +1429,4 @@ EXPORT_SYMBOL_GPL(wl1251_free_hw);
 MODULE_DESCRIPTION("TI wl1251 Wireles LAN Driver Core");
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Kalle Valo <kalle.valo@nokia.com>");
-MODULE_ALIAS("spi:wl12xx");
+MODULE_ALIAS("spi:wl1251");
diff --git a/drivers/net/wireless/wl12xx/wl1251_rx.c b/drivers/net/wireless/wl12xx/wl1251_rx.c
index 17c54b59ef86..601fe0d67827 100644
--- a/drivers/net/wireless/wl12xx/wl1251_rx.c
+++ b/drivers/net/wireless/wl12xx/wl1251_rx.c
@@ -153,7 +153,7 @@ static void wl1251_rx_body(struct wl1251 *wl,
                      beacon ? "beacon" : "");
 
         memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
-        ieee80211_rx(wl->hw, skb);
+        ieee80211_rx_ni(wl->hw, skb);
 }
 
 static void wl1251_rx_ack(struct wl1251 *wl)
diff --git a/drivers/net/wireless/wl12xx/wl1251_spi.c b/drivers/net/wireless/wl12xx/wl1251_spi.c
index 14eff2b3d4c6..2cf8a2169d43 100644
--- a/drivers/net/wireless/wl12xx/wl1251_spi.c
+++ b/drivers/net/wireless/wl12xx/wl1251_spi.c
@@ -307,7 +307,7 @@ static int __devexit wl1251_spi_remove(struct spi_device *spi)
 
 static struct spi_driver wl1251_spi_driver = {
         .driver = {
-                .name           = "wl12xx",
+                .name           = "wl1251",
                 .bus            = &spi_bus_type,
                 .owner          = THIS_MODULE,
         },
diff --git a/drivers/net/wireless/wl12xx/wl1271.h b/drivers/net/wireless/wl12xx/wl1271.h
index 55818f94017b..566f1521ec22 100644
--- a/drivers/net/wireless/wl12xx/wl1271.h
+++ b/drivers/net/wireless/wl12xx/wl1271.h
@@ -32,6 +32,8 @@
 #include <linux/bitops.h>
 #include <net/mac80211.h>
 
+#include "wl1271_conf.h"
+
 #define DRIVER_NAME "wl1271"
 #define DRIVER_PREFIX DRIVER_NAME ": "
 
@@ -97,21 +99,42 @@ enum {
         } while (0)
 
 #define WL1271_DEFAULT_RX_CONFIG (CFG_UNI_FILTER_EN |   \
-                                  CFG_BSSID_FILTER_EN)
+                                  CFG_BSSID_FILTER_EN | \
+                                  CFG_MC_FILTER_EN)
 
 #define WL1271_DEFAULT_RX_FILTER (CFG_RX_RCTS_ACK | CFG_RX_PRSP_EN |  \
                                   CFG_RX_MGMT_EN | CFG_RX_DATA_EN |   \
                                   CFG_RX_CTL_EN | CFG_RX_BCN_EN |     \
                                   CFG_RX_AUTH_EN | CFG_RX_ASSOC_EN)
 
+#define WL1271_DEFAULT_BASIC_RATE_SET (CONF_TX_RATE_MASK_ALL)
+
 #define WL1271_FW_NAME "wl1271-fw.bin"
 #define WL1271_NVS_NAME "wl1271-nvs.bin"
 
-#define WL1271_BUSY_WORD_LEN 8
+/*
+ * Enable/disable 802.11a support for WL1273
+ */
+#undef WL1271_80211A_ENABLED
+
+/*
+ * FIXME: for the wl1271, a busy word count of 1 here will result in a more
+ * optimal SPI interface. There is some SPI bug however, causing RXS time outs
+ * with this mode occasionally on boot, so lets have three for now. A value of
+ * three should make sure, that the chipset will always be ready, though this
+ * will impact throughput and latencies slightly.
+ */
+#define WL1271_BUSY_WORD_CNT 3
+#define WL1271_BUSY_WORD_LEN (WL1271_BUSY_WORD_CNT * sizeof(u32))
 
 #define WL1271_ELP_HW_STATE_ASLEEP 0
 #define WL1271_ELP_HW_STATE_IRQ    1
 
+#define WL1271_DEFAULT_BEACON_INT  100
+#define WL1271_DEFAULT_DTIM_PERIOD 1
+
+#define ACX_TX_DESCRIPTORS         32
+
 enum wl1271_state {
         WL1271_STATE_OFF,
         WL1271_STATE_ON,
@@ -134,6 +157,8 @@ struct wl1271_partition {
 struct wl1271_partition_set {
         struct wl1271_partition mem;
         struct wl1271_partition reg;
+        struct wl1271_partition mem2;
+        struct wl1271_partition mem3;
 };
 
 struct wl1271;
@@ -258,15 +283,15 @@ struct wl1271_debugfs {
 
 /* FW status registers */
 struct wl1271_fw_status {
-        u32 intr;
+        __le32 intr;
         u8  fw_rx_counter;
         u8  drv_rx_counter;
         u8  reserved;
         u8  tx_results_counter;
-        u32 rx_pkt_descs[NUM_RX_PKT_DESC];
-        u32 tx_released_blks[NUM_TX_QUEUES];
-        u32 fw_localtime;
-        u32 padding[2];
+        __le32 rx_pkt_descs[NUM_RX_PKT_DESC];
+        __le32 tx_released_blks[NUM_TX_QUEUES];
+        __le32 fw_localtime;
+        __le32 padding[2];
 } __attribute__ ((packed));
 
 struct wl1271_rx_mem_pool_addr {
@@ -274,6 +299,15 @@ struct wl1271_rx_mem_pool_addr {
         u32 addr_extra;
 };
 
+struct wl1271_scan {
+        u8 state;
+        u8 ssid[IW_ESSID_MAX_SIZE+1];
+        size_t ssid_len;
+        u8 active;
+        u8 high_prio;
+        u8 probe_requests;
+};
+
 struct wl1271 {
         struct ieee80211_hw *hw;
         bool mac80211_registered;
@@ -288,10 +322,7 @@ struct wl1271 {
         enum wl1271_state state;
         struct mutex mutex;
 
-        int physical_mem_addr;
-        int physical_reg_addr;
-        int virtual_mem_addr;
-        int virtual_reg_addr;
+        struct wl1271_partition_set part;
 
         struct wl1271_chip chip;
 
@@ -308,7 +339,6 @@ struct wl1271 {
         u8 bss_type;
         u8 ssid[IW_ESSID_MAX_SIZE + 1];
         u8 ssid_len;
-        u8 listen_int;
         int channel;
 
         struct wl1271_acx_mem_map *target_mem_map;
@@ -332,10 +362,14 @@ struct wl1271 {
         bool tx_queue_stopped;
 
         struct work_struct tx_work;
-        struct work_struct filter_work;
 
         /* Pending TX frames */
-        struct sk_buff *tx_frames[16];
+        struct sk_buff *tx_frames[ACX_TX_DESCRIPTORS];
+
+        /* Security sequence number counters */
+        u8 tx_security_last_seq;
+        u16 tx_security_seq_16;
+        u32 tx_security_seq_32;
 
         /* FW Rx counter */
         u32 rx_counter;
@@ -354,10 +388,17 @@ struct wl1271 {
 
         /* Are we currently scanning */
         bool scanning;
+        struct wl1271_scan scan;
 
         /* Our association ID */
         u16 aid;
 
+        /* currently configured rate set */
+        u32 basic_rate_set;
+
+        /* The current band */
+        enum ieee80211_band band;
+
         /* Default key (for WEP) */
         u32 default_key;
 
@@ -368,6 +409,7 @@ struct wl1271 {
         bool elp;
 
         struct completion *elp_compl;
+        struct delayed_work elp_work;
 
         /* we can be in psm, but not in elp, we have to differentiate */
         bool psm;
@@ -383,11 +425,20 @@ struct wl1271 {
 
         u32 buffer_32;
         u32 buffer_cmd;
-        u8 buffer_busyword[WL1271_BUSY_WORD_LEN];
-        struct wl1271_rx_descriptor *rx_descriptor;
+        u32 buffer_busyword[WL1271_BUSY_WORD_CNT];
 
         struct wl1271_fw_status *fw_status;
         struct wl1271_tx_hw_res_if *tx_res_if;
+
+        struct ieee80211_vif *vif;
+
+        /* Used for a workaround to send disconnect before rejoining */
+        bool joined;
+
+        /* Current chipset configuration */
+        struct conf_drv_settings conf;
+
+        struct list_head list;
 };
 
 int wl1271_plt_start(struct wl1271 *wl);
@@ -404,4 +455,13 @@ int wl1271_plt_stop(struct wl1271 *wl);
 /* WL1271 needs a 200ms sleep after power on */
 #define WL1271_POWER_ON_SLEEP 200 /* in miliseconds */
 
+static inline bool wl1271_11a_enabled(void)
+{
+#ifdef WL1271_80211A_ENABLED
+        return true;
+#else
+        return false;
+#endif
+}
+
 #endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_acx.c b/drivers/net/wireless/wl12xx/wl1271_acx.c
index f622a4092615..bf5a8680a462 100644
--- a/drivers/net/wireless/wl12xx/wl1271_acx.c
+++ b/drivers/net/wireless/wl12xx/wl1271_acx.c
@@ -34,8 +34,7 @@
 #include "wl1271_spi.h"
 #include "wl1271_ps.h"
 
-int wl1271_acx_wake_up_conditions(struct wl1271 *wl, u8 wake_up_event,
-                                  u8 listen_interval)
+int wl1271_acx_wake_up_conditions(struct wl1271 *wl)
 {
         struct acx_wake_up_condition *wake_up;
         int ret;
@@ -48,8 +47,8 @@ int wl1271_acx_wake_up_conditions(struct wl1271 *wl, u8 wake_up_event,
                 goto out;
         }
 
-        wake_up->wake_up_event = wake_up_event;
-        wake_up->listen_interval = listen_interval;
+        wake_up->wake_up_event = wl->conf.conn.wake_up_event;
+        wake_up->listen_interval = wl->conf.conn.listen_interval;
 
         ret = wl1271_cmd_configure(wl, ACX_WAKE_UP_CONDITIONS,
                                    wake_up, sizeof(*wake_up));
@@ -137,7 +136,12 @@ int wl1271_acx_tx_power(struct wl1271 *wl, int power)
                 goto out;
         }
 
-        acx->current_tx_power = power * 10;
+        /*
+         * FIXME: This is a workaround needed while we don't the correct
+         * calibration, to avoid distortions
+         */
+        /* acx->current_tx_power = power * 10; */
+        acx->current_tx_power = 70;
 
         ret = wl1271_cmd_configure(wl, DOT11_CUR_TX_PWR, acx, sizeof(*acx));
         if (ret < 0) {
@@ -193,7 +197,7 @@ int wl1271_acx_mem_map(struct wl1271 *wl, struct acx_header *mem_map,
         return 0;
 }
 
-int wl1271_acx_rx_msdu_life_time(struct wl1271 *wl, u32 life_time)
+int wl1271_acx_rx_msdu_life_time(struct wl1271 *wl)
 {
         struct acx_rx_msdu_lifetime *acx;
         int ret;
@@ -206,7 +210,7 @@ int wl1271_acx_rx_msdu_life_time(struct wl1271 *wl, u32 life_time)
                 goto out;
         }
 
-        acx->lifetime = life_time;
+        acx->lifetime = cpu_to_le32(wl->conf.rx.rx_msdu_life_time);
         ret = wl1271_cmd_configure(wl, DOT11_RX_MSDU_LIFE_TIME,
                                    acx, sizeof(*acx));
         if (ret < 0) {
@@ -232,8 +236,8 @@ int wl1271_acx_rx_config(struct wl1271 *wl, u32 config, u32 filter)
                 goto out;
         }
 
-        rx_config->config_options = config;
-        rx_config->filter_options = filter;
+        rx_config->config_options = cpu_to_le32(config);
+        rx_config->filter_options = cpu_to_le32(filter);
 
         ret = wl1271_cmd_configure(wl, ACX_RX_CFG,
                                    rx_config, sizeof(*rx_config));
@@ -260,7 +264,7 @@ int wl1271_acx_pd_threshold(struct wl1271 *wl)
                 goto out;
         }
 
-        /* FIXME: threshold value not set */
+        pd->threshold = cpu_to_le32(wl->conf.rx.packet_detection_threshold);
 
         ret = wl1271_cmd_configure(wl, ACX_PD_THRESHOLD, pd, sizeof(*pd));
         if (ret < 0) {
@@ -300,7 +304,8 @@ out:
         return ret;
 }
 
-int wl1271_acx_group_address_tbl(struct wl1271 *wl)
+int wl1271_acx_group_address_tbl(struct wl1271 *wl, bool enable,
+                                 void *mc_list, u32 mc_list_len)
 {
         struct acx_dot11_grp_addr_tbl *acx;
         int ret;
@@ -314,9 +319,9 @@ int wl1271_acx_group_address_tbl(struct wl1271 *wl)
         }
 
         /* MAC filtering */
-        acx->enabled = 0;
-        acx->num_groups = 0;
-        memset(acx->mac_table, 0, ADDRESS_GROUP_MAX_LEN);
+        acx->enabled = enable;
+        acx->num_groups = mc_list_len;
+        memcpy(acx->mac_table, mc_list, mc_list_len * ETH_ALEN);
 
         ret = wl1271_cmd_configure(wl, DOT11_GROUP_ADDRESS_TBL,
                                    acx, sizeof(*acx));
@@ -343,8 +348,8 @@ int wl1271_acx_service_period_timeout(struct wl1271 *wl)
 
         wl1271_debug(DEBUG_ACX, "acx service period timeout");
 
-        rx_timeout->ps_poll_timeout = RX_TIMEOUT_PS_POLL_DEF;
-        rx_timeout->upsd_timeout = RX_TIMEOUT_UPSD_DEF;
+        rx_timeout->ps_poll_timeout = cpu_to_le16(wl->conf.rx.ps_poll_timeout);
+        rx_timeout->upsd_timeout = cpu_to_le16(wl->conf.rx.upsd_timeout);
 
         ret = wl1271_cmd_configure(wl, ACX_SERVICE_PERIOD_TIMEOUT,
                                    rx_timeout, sizeof(*rx_timeout));
@@ -372,7 +377,7 @@ int wl1271_acx_rts_threshold(struct wl1271 *wl, u16 rts_threshold)
                 goto out;
         }
 
-        rts->threshold = rts_threshold;
+        rts->threshold = cpu_to_le16(rts_threshold);
 
         ret = wl1271_cmd_configure(wl, DOT11_RTS_THRESHOLD, rts, sizeof(*rts));
         if (ret < 0) {
@@ -385,20 +390,29 @@ out:
         return ret;
 }
 
-int wl1271_acx_beacon_filter_opt(struct wl1271 *wl)
+int wl1271_acx_beacon_filter_opt(struct wl1271 *wl, bool enable_filter)
 {
-        struct acx_beacon_filter_option *beacon_filter;
-        int ret;
+        struct acx_beacon_filter_option *beacon_filter = NULL;
+        int ret = 0;
 
         wl1271_debug(DEBUG_ACX, "acx beacon filter opt");
 
+        if (enable_filter &&
+            wl->conf.conn.bcn_filt_mode == CONF_BCN_FILT_MODE_DISABLED)
+                goto out;
+
         beacon_filter = kzalloc(sizeof(*beacon_filter), GFP_KERNEL);
         if (!beacon_filter) {
                 ret = -ENOMEM;
                 goto out;
         }
 
-        beacon_filter->enable = 0;
+        beacon_filter->enable = enable_filter;
+
+        /*
+         * When set to zero, and the filter is enabled, beacons
+         * without the unicast TIM bit set are dropped.
+         */
         beacon_filter->max_num_beacons = 0;
 
         ret = wl1271_cmd_configure(wl, ACX_BEACON_FILTER_OPT,
@@ -416,7 +430,9 @@ out:
 int wl1271_acx_beacon_filter_table(struct wl1271 *wl)
 {
         struct acx_beacon_filter_ie_table *ie_table;
+        int i, idx = 0;
         int ret;
+        bool vendor_spec = false;
 
         wl1271_debug(DEBUG_ACX, "acx beacon filter table");
 
@@ -426,8 +442,32 @@ int wl1271_acx_beacon_filter_table(struct wl1271 *wl)
                 goto out;
         }
 
+        /* configure default beacon pass-through rules */
         ie_table->num_ie = 0;
-        memset(ie_table->table, 0, BEACON_FILTER_TABLE_MAX_SIZE);
+        for (i = 0; i < wl->conf.conn.bcn_filt_ie_count; i++) {
+                struct conf_bcn_filt_rule *r = &(wl->conf.conn.bcn_filt_ie[i]);
+                ie_table->table[idx++] = r->ie;
+                ie_table->table[idx++] = r->rule;
+
+                if (r->ie == WLAN_EID_VENDOR_SPECIFIC) {
+                        /* only one vendor specific ie allowed */
+                        if (vendor_spec)
+                                continue;
+
+                        /* for vendor specific rules configure the
+                           additional fields */
+                        memcpy(&(ie_table->table[idx]), r->oui,
+                               CONF_BCN_IE_OUI_LEN);
+                        idx += CONF_BCN_IE_OUI_LEN;
+                        ie_table->table[idx++] = r->type;
+                        memcpy(&(ie_table->table[idx]), r->version,
+                               CONF_BCN_IE_VER_LEN);
+                        idx += CONF_BCN_IE_VER_LEN;
+                        vendor_spec = true;
+                }
+
+                ie_table->num_ie++;
+        }
 
         ret = wl1271_cmd_configure(wl, ACX_BEACON_FILTER_TABLE,
                                    ie_table, sizeof(*ie_table));
@@ -441,6 +481,36 @@ out:
         return ret;
 }
 
+int wl1271_acx_conn_monit_params(struct wl1271 *wl)
+{
+        struct acx_conn_monit_params *acx;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx connection monitor parameters");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->synch_fail_thold = cpu_to_le32(wl->conf.conn.synch_fail_thold);
+        acx->bss_lose_timeout = cpu_to_le32(wl->conf.conn.bss_lose_timeout);
+
+        ret = wl1271_cmd_configure(wl, ACX_CONN_MONIT_PARAMS,
+                                   acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("failed to set connection monitor "
+                               "parameters: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+
 int wl1271_acx_sg_enable(struct wl1271 *wl)
 {
         struct acx_bt_wlan_coex *pta;
@@ -470,6 +540,7 @@ out:
 int wl1271_acx_sg_cfg(struct wl1271 *wl)
 {
         struct acx_bt_wlan_coex_param *param;
+        struct conf_sg_settings *c = &wl->conf.sg;
         int ret;
 
         wl1271_debug(DEBUG_ACX, "acx sg cfg");
@@ -481,34 +552,19 @@ int wl1271_acx_sg_cfg(struct wl1271 *wl)
         }
 
         /* BT-WLAN coext parameters */
-        param->min_rate = RATE_INDEX_24MBPS;
-        param->bt_hp_max_time = PTA_BT_HP_MAXTIME_DEF;
-        param->wlan_hp_max_time = PTA_WLAN_HP_MAX_TIME_DEF;
-        param->sense_disable_timer = PTA_SENSE_DISABLE_TIMER_DEF;
-        param->rx_time_bt_hp = PTA_PROTECTIVE_RX_TIME_DEF;
-        param->tx_time_bt_hp = PTA_PROTECTIVE_TX_TIME_DEF;
-        param->rx_time_bt_hp_fast = PTA_PROTECTIVE_RX_TIME_FAST_DEF;
-        param->tx_time_bt_hp_fast = PTA_PROTECTIVE_TX_TIME_FAST_DEF;
-        param->wlan_cycle_fast = PTA_CYCLE_TIME_FAST_DEF;
-        param->bt_anti_starvation_period = PTA_ANTI_STARVE_PERIOD_DEF;
-        param->next_bt_lp_packet = PTA_TIMEOUT_NEXT_BT_LP_PACKET_DEF;
-        param->wake_up_beacon = PTA_TIME_BEFORE_BEACON_DEF;
-        param->hp_dm_max_guard_time = PTA_HPDM_MAX_TIME_DEF;
-        param->next_wlan_packet = PTA_TIME_OUT_NEXT_WLAN_DEF;
-        param->antenna_type = PTA_ANTENNA_TYPE_DEF;
-        param->signal_type = PTA_SIGNALING_TYPE_DEF;
-        param->afh_leverage_on = PTA_AFH_LEVERAGE_ON_DEF;
-        param->quiet_cycle_num = PTA_NUMBER_QUIET_CYCLE_DEF;
-        param->max_cts = PTA_MAX_NUM_CTS_DEF;
-        param->wlan_packets_num = PTA_NUMBER_OF_WLAN_PACKETS_DEF;
-        param->bt_packets_num = PTA_NUMBER_OF_BT_PACKETS_DEF;
-        param->missed_rx_avalanche = PTA_RX_FOR_AVALANCHE_DEF;
-        param->wlan_elp_hp = PTA_ELP_HP_DEF;
-        param->bt_anti_starvation_cycles = PTA_ANTI_STARVE_NUM_CYCLE_DEF;
-        param->ack_mode_dual_ant = PTA_ACK_MODE_DEF;
-        param->pa_sd_enable = PTA_ALLOW_PA_SD_DEF;
-        param->pta_auto_mode_enable = PTA_AUTO_MODE_NO_CTS_DEF;
-        param->bt_hp_respected_num = PTA_BT_HP_RESPECTED_DEF;
+        param->per_threshold = cpu_to_le32(c->per_threshold);
+        param->max_scan_compensation_time =
+                cpu_to_le32(c->max_scan_compensation_time);
+        param->nfs_sample_interval = cpu_to_le16(c->nfs_sample_interval);
+        param->load_ratio = c->load_ratio;
+        param->auto_ps_mode = c->auto_ps_mode;
+        param->probe_req_compensation = c->probe_req_compensation;
+        param->scan_window_compensation = c->scan_window_compensation;
+        param->antenna_config = c->antenna_config;
+        param->beacon_miss_threshold = c->beacon_miss_threshold;
+        param->rate_adaptation_threshold =
+                cpu_to_le32(c->rate_adaptation_threshold);
+        param->rate_adaptation_snr = c->rate_adaptation_snr;
 
         ret = wl1271_cmd_configure(wl, ACX_SG_CFG, param, sizeof(*param));
         if (ret < 0) {
@@ -534,8 +590,8 @@ int wl1271_acx_cca_threshold(struct wl1271 *wl)
                 goto out;
         }
 
-        detection->rx_cca_threshold = CCA_THRSH_DISABLE_ENERGY_D;
-        detection->tx_energy_detection = 0;
+        detection->rx_cca_threshold = cpu_to_le16(wl->conf.rx.rx_cca_threshold);
+        detection->tx_energy_detection = wl->conf.tx.tx_energy_detection;
 
         ret = wl1271_cmd_configure(wl, ACX_CCA_THRESHOLD,
                                    detection, sizeof(*detection));
@@ -562,10 +618,10 @@ int wl1271_acx_bcn_dtim_options(struct wl1271 *wl)
                 goto out;
         }
 
-        bb->beacon_rx_timeout = BCN_RX_TIMEOUT_DEF_VALUE;
-        bb->broadcast_timeout = BROADCAST_RX_TIMEOUT_DEF_VALUE;
-        bb->rx_broadcast_in_ps = RX_BROADCAST_IN_PS_DEF_VALUE;
-        bb->ps_poll_threshold = CONSECUTIVE_PS_POLL_FAILURE_DEF;
+        bb->beacon_rx_timeout = cpu_to_le16(wl->conf.conn.beacon_rx_timeout);
+        bb->broadcast_timeout = cpu_to_le16(wl->conf.conn.broadcast_timeout);
+        bb->rx_broadcast_in_ps = wl->conf.conn.rx_broadcast_in_ps;
+        bb->ps_poll_threshold = wl->conf.conn.ps_poll_threshold;
 
         ret = wl1271_cmd_configure(wl, ACX_BCN_DTIM_OPTIONS, bb, sizeof(*bb));
         if (ret < 0) {
@@ -591,7 +647,7 @@ int wl1271_acx_aid(struct wl1271 *wl, u16 aid)
                 goto out;
         }
 
-        acx_aid->aid = aid;
+        acx_aid->aid = cpu_to_le16(aid);
 
         ret = wl1271_cmd_configure(wl, ACX_AID, acx_aid, sizeof(*acx_aid));
         if (ret < 0) {
@@ -618,9 +674,8 @@ int wl1271_acx_event_mbox_mask(struct wl1271 *wl, u32 event_mask)
         }
 
         /* high event mask is unused */
-        mask->high_event_mask = 0xffffffff;
-
-        mask->event_mask = event_mask;
+        mask->high_event_mask = cpu_to_le32(0xffffffff);
+        mask->event_mask = cpu_to_le32(event_mask);
 
         ret = wl1271_cmd_configure(wl, ACX_EVENT_MBOX_MASK,
                                    mask, sizeof(*mask));
@@ -703,9 +758,10 @@ int wl1271_acx_statistics(struct wl1271 *wl, struct acx_statistics *stats)
         return 0;
 }
 
-int wl1271_acx_rate_policies(struct wl1271 *wl)
+int wl1271_acx_rate_policies(struct wl1271 *wl, u32 enabled_rates)
 {
         struct acx_rate_policy *acx;
+        struct conf_tx_rate_class *c = &wl->conf.tx.rc_conf;
         int ret = 0;
 
         wl1271_debug(DEBUG_ACX, "acx rate policies");
@@ -718,11 +774,11 @@ int wl1271_acx_rate_policies(struct wl1271 *wl)
         }
 
         /* configure one default (one-size-fits-all) rate class */
-        acx->rate_class_cnt = 1;
-        acx->rate_class[0].enabled_rates = ACX_RATE_MASK_ALL;
-        acx->rate_class[0].short_retry_limit = ACX_RATE_RETRY_LIMIT;
-        acx->rate_class[0].long_retry_limit = ACX_RATE_RETRY_LIMIT;
-        acx->rate_class[0].aflags = 0;
+        acx->rate_class_cnt = cpu_to_le32(1);
+        acx->rate_class[0].enabled_rates = cpu_to_le32(enabled_rates);
+        acx->rate_class[0].short_retry_limit = c->short_retry_limit;
+        acx->rate_class[0].long_retry_limit = c->long_retry_limit;
+        acx->rate_class[0].aflags = c->aflags;
 
         ret = wl1271_cmd_configure(wl, ACX_RATE_POLICY, acx, sizeof(*acx));
         if (ret < 0) {
@@ -749,22 +805,14 @@ int wl1271_acx_ac_cfg(struct wl1271 *wl)
                 goto out;
         }
 
-        /*
-         * FIXME: Configure each AC with appropriate values (most suitable
-         * values will probably be different for each AC.
-         */
-        for (i = 0; i < WL1271_ACX_AC_COUNT; i++) {
-                acx->ac = i;
-
-                /*
-                 * FIXME: The following default values originate from
-                 * the TI reference driver. What do they mean?
-                 */
-                acx->cw_min = 15;
-                acx->cw_max = 63;
-                acx->aifsn = 3;
+        for (i = 0; i < wl->conf.tx.ac_conf_count; i++) {
+                struct conf_tx_ac_category *c = &(wl->conf.tx.ac_conf[i]);
+                acx->ac = c->ac;
+                acx->cw_min = c->cw_min;
+                acx->cw_max = cpu_to_le16(c->cw_max);
+                acx->aifsn = c->aifsn;
                 acx->reserved = 0;
-                acx->tx_op_limit = 0;
+                acx->tx_op_limit = cpu_to_le16(c->tx_op_limit);
 
                 ret = wl1271_cmd_configure(wl, ACX_AC_CFG, acx, sizeof(*acx));
                 if (ret < 0) {
@@ -793,12 +841,15 @@ int wl1271_acx_tid_cfg(struct wl1271 *wl)
                 goto out;
         }
 
-        /* FIXME: configure each TID with a different AC reference */
-        for (i = 0; i < WL1271_ACX_TID_COUNT; i++) {
-                acx->queue_id = i;
-                acx->tsid = WL1271_ACX_AC_BE;
-                acx->ps_scheme = WL1271_ACX_PS_SCHEME_LEGACY;
-                acx->ack_policy = WL1271_ACX_ACK_POLICY_LEGACY;
+        for (i = 0; i < wl->conf.tx.tid_conf_count; i++) {
+                struct conf_tx_tid *c = &(wl->conf.tx.tid_conf[i]);
+                acx->queue_id = c->queue_id;
+                acx->channel_type = c->channel_type;
+                acx->tsid = c->tsid;
+                acx->ps_scheme = c->ps_scheme;
+                acx->ack_policy = c->ack_policy;
+                acx->apsd_conf[0] = cpu_to_le32(c->apsd_conf[0]);
+                acx->apsd_conf[1] = cpu_to_le32(c->apsd_conf[1]);
 
                 ret = wl1271_cmd_configure(wl, ACX_TID_CFG, acx, sizeof(*acx));
                 if (ret < 0) {
@@ -826,7 +877,7 @@ int wl1271_acx_frag_threshold(struct wl1271 *wl)
                 goto out;
         }
 
-        acx->frag_threshold = IEEE80211_MAX_FRAG_THRESHOLD;
+        acx->frag_threshold = cpu_to_le16(wl->conf.tx.frag_threshold);
         ret = wl1271_cmd_configure(wl, ACX_FRAG_CFG, acx, sizeof(*acx));
         if (ret < 0) {
                 wl1271_warning("Setting of frag threshold failed: %d", ret);
@@ -852,8 +903,8 @@ int wl1271_acx_tx_config_options(struct wl1271 *wl)
                 goto out;
         }
 
-        acx->tx_compl_timeout = WL1271_ACX_TX_COMPL_TIMEOUT;
-        acx->tx_compl_threshold = WL1271_ACX_TX_COMPL_THRESHOLD;
+        acx->tx_compl_timeout = cpu_to_le16(wl->conf.tx.tx_compl_timeout);
+        acx->tx_compl_threshold = cpu_to_le16(wl->conf.tx.tx_compl_threshold);
         ret = wl1271_cmd_configure(wl, ACX_TX_CONFIG_OPT, acx, sizeof(*acx));
         if (ret < 0) {
                 wl1271_warning("Setting of tx options failed: %d", ret);
@@ -879,11 +930,11 @@ int wl1271_acx_mem_cfg(struct wl1271 *wl)
         }
 
         /* memory config */
-        mem_conf->num_stations = cpu_to_le16(DEFAULT_NUM_STATIONS);
+        mem_conf->num_stations = DEFAULT_NUM_STATIONS;
         mem_conf->rx_mem_block_num = ACX_RX_MEM_BLOCKS;
         mem_conf->tx_min_mem_block_num = ACX_TX_MIN_MEM_BLOCKS;
         mem_conf->num_ssid_profiles = ACX_NUM_SSID_PROFILES;
-        mem_conf->total_tx_descriptors = ACX_TX_DESCRIPTORS;
+        mem_conf->total_tx_descriptors = cpu_to_le32(ACX_TX_DESCRIPTORS);
 
         ret = wl1271_cmd_configure(wl, ACX_MEM_CFG, mem_conf,
                                    sizeof(*mem_conf));
@@ -906,7 +957,7 @@ int wl1271_acx_init_mem_config(struct wl1271 *wl)
                 return ret;
 
         wl->target_mem_map = kzalloc(sizeof(struct wl1271_acx_mem_map),
-                                          GFP_KERNEL);
+                                     GFP_KERNEL);
         if (!wl->target_mem_map) {
                 wl1271_error("couldn't allocate target memory map");
                 return -ENOMEM;
@@ -923,7 +974,8 @@ int wl1271_acx_init_mem_config(struct wl1271 *wl)
         }
 
         /* initialize TX block book keeping */
-        wl->tx_blocks_available = wl->target_mem_map->num_tx_mem_blocks;
+        wl->tx_blocks_available =
+                le32_to_cpu(wl->target_mem_map->num_tx_mem_blocks);
         wl1271_debug(DEBUG_TX, "available tx blocks: %d",
                      wl->tx_blocks_available);
 
@@ -943,10 +995,10 @@ int wl1271_acx_init_rx_interrupt(struct wl1271 *wl)
                 goto out;
         }
 
-        rx_conf->threshold = WL1271_RX_INTR_THRESHOLD_DEF;
-        rx_conf->timeout = WL1271_RX_INTR_TIMEOUT_DEF;
-        rx_conf->mblk_threshold = USHORT_MAX; /* Disabled */
-        rx_conf->queue_type = RX_QUEUE_TYPE_RX_LOW_PRIORITY;
+        rx_conf->threshold = cpu_to_le16(wl->conf.rx.irq_pkt_threshold);
+        rx_conf->timeout = cpu_to_le16(wl->conf.rx.irq_timeout);
+        rx_conf->mblk_threshold = cpu_to_le16(wl->conf.rx.irq_blk_threshold);
+        rx_conf->queue_type = wl->conf.rx.queue_type;
 
         ret = wl1271_cmd_configure(wl, ACX_RX_CONFIG_OPT, rx_conf,
                                    sizeof(*rx_conf));
@@ -959,3 +1011,124 @@ out:
         kfree(rx_conf);
         return ret;
 }
+
+int wl1271_acx_smart_reflex(struct wl1271 *wl)
+{
+        struct acx_smart_reflex_state *sr_state = NULL;
+        struct acx_smart_reflex_config_params *sr_param = NULL;
+        int i, ret;
+
+        wl1271_debug(DEBUG_ACX, "acx smart reflex");
+
+        sr_param = kzalloc(sizeof(*sr_param), GFP_KERNEL);
+        if (!sr_param) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        for (i = 0; i < CONF_SR_ERR_TBL_COUNT; i++) {
+                struct conf_mart_reflex_err_table *e =
+                        &(wl->conf.init.sr_err_tbl[i]);
+
+                sr_param->error_table[i].len = e->len;
+                sr_param->error_table[i].upper_limit = e->upper_limit;
+                memcpy(sr_param->error_table[i].values, e->values, e->len);
+        }
+
+        ret = wl1271_cmd_configure(wl, ACX_SET_SMART_REFLEX_PARAMS,
+                                   sr_param, sizeof(*sr_param));
+        if (ret < 0) {
+                wl1271_warning("failed to set smart reflex params: %d", ret);
+                goto out;
+        }
+
+        sr_state = kzalloc(sizeof(*sr_state), GFP_KERNEL);
+        if (!sr_state) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        /* enable smart reflex */
+        sr_state->enable = wl->conf.init.sr_enable;
+
+        ret = wl1271_cmd_configure(wl, ACX_SET_SMART_REFLEX_STATE,
+                                   sr_state, sizeof(*sr_state));
+        if (ret < 0) {
+                wl1271_warning("failed to set smart reflex params: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(sr_state);
+        kfree(sr_param);
+        return ret;
+
+}
+
+int wl1271_acx_bet_enable(struct wl1271 *wl, bool enable)
+{
+        struct wl1271_acx_bet_enable *acx = NULL;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_ACX, "acx bet enable");
+
+        if (enable && wl->conf.conn.bet_enable == CONF_BET_MODE_DISABLE)
+                goto out;
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->enable = enable ? CONF_BET_MODE_ENABLE : CONF_BET_MODE_DISABLE;
+        acx->max_consecutive = wl->conf.conn.bet_max_consecutive;
+
+        ret = wl1271_cmd_configure(wl, ACX_BET_ENABLE, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("acx bet enable failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+int wl1271_acx_arp_ip_filter(struct wl1271 *wl, bool enable, u8 *address,
+                             u8 version)
+{
+        struct wl1271_acx_arp_filter *acx;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx arp ip filter, enable: %d", enable);
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->version = version;
+        acx->enable = enable;
+
+        if (enable == true) {
+                if (version == ACX_IPV4_VERSION)
+                        memcpy(acx->address, address, ACX_IPV4_ADDR_SIZE);
+                else if (version == ACX_IPV6_VERSION)
+                        memcpy(acx->address, address, sizeof(acx->address));
+                else
+                        wl1271_error("Invalid IP version");
+        }
+
+        ret = wl1271_cmd_configure(wl, ACX_ARP_IP_FILTER,
+                                   acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("failed to set arp ip filter: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
diff --git a/drivers/net/wireless/wl12xx/wl1271_acx.h b/drivers/net/wireless/wl12xx/wl1271_acx.h
index 9068daaf0ddf..2ce0a8128542 100644
--- a/drivers/net/wireless/wl12xx/wl1271_acx.h
+++ b/drivers/net/wireless/wl12xx/wl1271_acx.h
@@ -61,8 +61,9 @@
                                             WL1271_ACX_INTR_HW_AVAILABLE  | \
                                             WL1271_ACX_INTR_DATA)
 
-#define WL1271_INTR_MASK                   (WL1271_ACX_INTR_EVENT_A |   \
-                                            WL1271_ACX_INTR_EVENT_B | \
+#define WL1271_INTR_MASK                   (WL1271_ACX_INTR_EVENT_A      | \
+                                            WL1271_ACX_INTR_EVENT_B      | \
+                                            WL1271_ACX_INTR_HW_AVAILABLE | \
                                             WL1271_ACX_INTR_DATA)
 
 /* Target's information element */
@@ -70,11 +71,11 @@ struct acx_header {
         struct wl1271_cmd_header cmd;
 
         /* acx (or information element) header */
-        u16 id;
+        __le16 id;
 
         /* payload length (not including headers */
-        u16 len;
-};
+        __le16 len;
+} __attribute__ ((packed));
 
 struct acx_error_counter {
         struct acx_header header;
@@ -82,21 +83,21 @@ struct acx_error_counter {
         /* The number of PLCP errors since the last time this */
         /* information element was interrogated. This field is */
         /* automatically cleared when it is interrogated.*/
-        u32 PLCP_error;
+        __le32 PLCP_error;
 
         /* The number of FCS errors since the last time this */
         /* information element was interrogated. This field is */
         /* automatically cleared when it is interrogated.*/
-        u32 FCS_error;
+        __le32 FCS_error;
 
         /* The number of MPDUs without PLCP header errors received*/
         /* since the last time this information element was interrogated. */
         /* This field is automatically cleared when it is interrogated.*/
-        u32 valid_frame;
+        __le32 valid_frame;
 
         /* the number of missed sequence numbers in the squentially */
         /* values of frames seq numbers */
-        u32 seq_num_miss;
+        __le32 seq_num_miss;
 } __attribute__ ((packed));
 
 struct acx_revision {
@@ -125,7 +126,7 @@ struct acx_revision {
          *              (1 = first spin, 2 = second spin, and so on).
          * bits 24 - 31: Chip ID - The WiLink chip ID.
          */
-        u32 hw_version;
+        __le32 hw_version;
 } __attribute__ ((packed));
 
 enum wl1271_psm_mode {
@@ -170,7 +171,6 @@ enum {
 #define  DP_RX_PACKET_RING_CHUNK_NUM 2
 #define  DP_TX_PACKET_RING_CHUNK_NUM 2
 #define  DP_TX_COMPLETE_TIME_OUT 20
-#define  FW_TX_CMPLT_BLOCK_SIZE 16
 
 #define TX_MSDU_LIFETIME_MIN       0
 #define TX_MSDU_LIFETIME_MAX       3000
@@ -186,7 +186,7 @@ struct acx_rx_msdu_lifetime {
          * The maximum amount of time, in TU, before the
          * firmware discards the MSDU.
          */
-        u32 lifetime;
+        __le32 lifetime;
 } __attribute__ ((packed));
 
 /*
@@ -273,14 +273,14 @@ struct acx_rx_msdu_lifetime {
 struct acx_rx_config {
         struct acx_header header;
 
-        u32 config_options;
-        u32 filter_options;
+        __le32 config_options;
+        __le32 filter_options;
 } __attribute__ ((packed));
 
 struct acx_packet_detection {
         struct acx_header header;
 
-        u32 threshold;
+        __le32 threshold;
 } __attribute__ ((packed));
 
 
@@ -302,8 +302,8 @@ struct acx_slot {
 } __attribute__ ((packed));
 
 
-#define ADDRESS_GROUP_MAX       (8)
-#define ADDRESS_GROUP_MAX_LEN   (ETH_ALEN * ADDRESS_GROUP_MAX)
+#define ACX_MC_ADDRESS_GROUP_MAX        (8)
+#define ADDRESS_GROUP_MAX_LEN           (ETH_ALEN * ACX_MC_ADDRESS_GROUP_MAX)
 
 struct acx_dot11_grp_addr_tbl {
         struct acx_header header;
@@ -314,40 +314,17 @@ struct acx_dot11_grp_addr_tbl {
         u8 mac_table[ADDRESS_GROUP_MAX_LEN];
 } __attribute__ ((packed));
 
-
-#define  RX_TIMEOUT_PS_POLL_MIN    0
-#define  RX_TIMEOUT_PS_POLL_MAX    (200000)
-#define  RX_TIMEOUT_PS_POLL_DEF    (15)
-#define  RX_TIMEOUT_UPSD_MIN       0
-#define  RX_TIMEOUT_UPSD_MAX       (200000)
-#define  RX_TIMEOUT_UPSD_DEF       (15)
-
 struct acx_rx_timeout {
         struct acx_header header;
 
-        /*
-         * The longest time the STA will wait to receive
-         * traffic from the AP after a PS-poll has been
-         * transmitted.
-         */
-        u16 ps_poll_timeout;
-
-        /*
-         * The longest time the STA will wait to receive
-         * traffic from the AP after a frame has been sent
-         * from an UPSD enabled queue.
-         */
-        u16 upsd_timeout;
+        __le16 ps_poll_timeout;
+        __le16 upsd_timeout;
 } __attribute__ ((packed));
 
-#define RTS_THRESHOLD_MIN              0
-#define RTS_THRESHOLD_MAX              4096
-#define RTS_THRESHOLD_DEF              2347
-
 struct acx_rts_threshold {
         struct acx_header header;
 
-        u16 threshold;
+        __le16 threshold;
         u8 pad[2];
 } __attribute__ ((packed));
 
@@ -408,6 +385,13 @@ struct acx_beacon_filter_ie_table {
         u8 pad[3];
 } __attribute__ ((packed));
 
+struct acx_conn_monit_params {
+       struct acx_header header;
+
+       __le32 synch_fail_thold; /* number of beacons missed */
+       __le32 bss_lose_timeout; /* number of TU's from synch fail */
+} __attribute__ ((packed));
+
 enum {
         SG_ENABLE = 0,
         SG_DISABLE,
@@ -431,6 +415,25 @@ struct acx_bt_wlan_coex {
         u8 pad[3];
 } __attribute__ ((packed));
 
+struct acx_smart_reflex_state {
+        struct acx_header header;
+
+        u8 enable;
+        u8 padding[3];
+} __attribute__ ((packed));
+
+struct smart_reflex_err_table {
+        u8 len;
+        s8 upper_limit;
+        s8 values[14];
+} __attribute__ ((packed));
+
+struct acx_smart_reflex_config_params {
+        struct acx_header header;
+
+        struct smart_reflex_err_table error_table[3];
+} __attribute__ ((packed));
+
 #define PTA_ANTENNA_TYPE_DEF              (0)
 #define PTA_BT_HP_MAXTIME_DEF             (2000)
 #define PTA_WLAN_HP_MAX_TIME_DEF          (5000)
@@ -463,150 +466,34 @@ struct acx_bt_wlan_coex {
 struct acx_bt_wlan_coex_param {
         struct acx_header header;
 
-        /*
-         * The minimum rate of a received WLAN packet in the STA,
-         * during protective mode, of which a new BT-HP request
-         * during this Rx will always be respected and gain the antenna.
-         */
-        u32 min_rate;
-
-        /* Max time the BT HP will be respected. */
-        u16 bt_hp_max_time;
-
-        /* Max time the WLAN HP will be respected. */
-        u16 wlan_hp_max_time;
-
-        /*
-         * The time between the last BT activity
-         * and the moment when the sense mode returns
-         * to SENSE_INACTIVE.
-         */
-        u16 sense_disable_timer;
-
-        /* Time before the next BT HP instance */
-        u16 rx_time_bt_hp;
-        u16 tx_time_bt_hp;
-
-        /* range: 10-20000    default: 1500 */
-        u16 rx_time_bt_hp_fast;
-        u16 tx_time_bt_hp_fast;
-
-        /* range: 2000-65535  default: 8700 */
-        u16 wlan_cycle_fast;
-
-        /* range: 0 - 15000 (Msec) default: 1000 */
-        u16 bt_anti_starvation_period;
-
-        /* range 400-10000(Usec) default: 3000 */
-        u16 next_bt_lp_packet;
-
-        /* Deafult: worst case for BT DH5 traffic */
-        u16 wake_up_beacon;
-
-        /* range: 0-50000(Usec) default: 1050 */
-        u16 hp_dm_max_guard_time;
-
-        /*
-         * This is to prevent both BT & WLAN antenna
-         * starvation.
-         * Range: 100-50000(Usec) default:2550
-         */
-        u16 next_wlan_packet;
-
-        /* 0 -> shared antenna */
-        u8 antenna_type;
-
-        /*
-         * 0 -> TI legacy
-         * 1 -> Palau
-         */
-        u8 signal_type;
-
-        /*
-         * BT AFH status
-         * 0 -> no AFH
-         * 1 -> from dedicated GPIO
-         * 2 -> AFH on (from host)
-         */
-        u8 afh_leverage_on;
-
-        /*
-         * The number of cycles during which no
-         * TX will be sent after 1 cycle of RX
-         * transaction in protective mode
-         */
-        u8 quiet_cycle_num;
-
-        /*
-         * The maximum number of CTSs that will
-         * be sent for receiving RX packet in
-         * protective mode
-         */
-        u8 max_cts;
-
-        /*
-         * The number of WLAN packets
-         * transferred in common mode before
-         * switching to BT.
-         */
-        u8 wlan_packets_num;
-
-        /*
-         * The number of BT packets
-         * transferred in common mode before
-         * switching to WLAN.
-         */
-        u8 bt_packets_num;
-
-        /* range: 1-255  default: 5 */
-        u8 missed_rx_avalanche;
-
-        /* range: 0-1    default: 1 */
-        u8 wlan_elp_hp;
-
-        /* range: 0 - 15  default: 4 */
-        u8 bt_anti_starvation_cycles;
-
-        u8 ack_mode_dual_ant;
-
-        /*
-         * Allow PA_SD assertion/de-assertion
-         * during enabled BT activity.
-         */
-        u8 pa_sd_enable;
-
-        /*
-         * Enable/Disable PTA in auto mode:
-         * Support Both Active & P.S modes
-         */
-        u8 pta_auto_mode_enable;
-
-        /* range: 0 - 20  default: 1 */
-        u8 bt_hp_respected_num;
+        __le32 per_threshold;
+        __le32 max_scan_compensation_time;
+        __le16 nfs_sample_interval;
+        u8 load_ratio;
+        u8 auto_ps_mode;
+        u8 probe_req_compensation;
+        u8 scan_window_compensation;
+        u8 antenna_config;
+        u8 beacon_miss_threshold;
+        __le32 rate_adaptation_threshold;
+        s8 rate_adaptation_snr;
+        u8 padding[3];
 } __attribute__ ((packed));
 
-#define CCA_THRSH_ENABLE_ENERGY_D       0x140A
-#define CCA_THRSH_DISABLE_ENERGY_D      0xFFEF
-
 struct acx_energy_detection {
         struct acx_header header;
 
         /* The RX Clear Channel Assessment threshold in the PHY */
-        u16 rx_cca_threshold;
+        __le16 rx_cca_threshold;
         u8 tx_energy_detection;
         u8 pad;
 } __attribute__ ((packed));
 
-#define BCN_RX_TIMEOUT_DEF_VALUE        10000
-#define BROADCAST_RX_TIMEOUT_DEF_VALUE  20000
-#define RX_BROADCAST_IN_PS_DEF_VALUE    1
-#define CONSECUTIVE_PS_POLL_FAILURE_DEF 4
-
 struct acx_beacon_broadcast {
         struct acx_header header;
 
-        u16 beacon_rx_timeout;
-        u16 broadcast_timeout;
+        __le16 beacon_rx_timeout;
+        __le16 broadcast_timeout;
 
         /* Enables receiving of broadcast packets in PS mode */
         u8 rx_broadcast_in_ps;
@@ -619,8 +506,8 @@ struct acx_beacon_broadcast {
 struct acx_event_mask {
         struct acx_header header;
 
-        u32 event_mask;
-        u32 high_event_mask; /* Unused */
+        __le32 event_mask;
+        __le32 high_event_mask; /* Unused */
 } __attribute__ ((packed));
 
 #define CFG_RX_FCS              BIT(2)
@@ -657,11 +544,15 @@ struct acx_event_mask {
 #define SCAN_TRIGGERED          BIT(2)
 #define SCAN_PRIORITY_HIGH      BIT(3)
 
+/* When set, disable HW encryption */
+#define DF_ENCRYPTION_DISABLE      0x01
+#define DF_SNIFF_MODE_ENABLE       0x80
+
 struct acx_feature_config {
         struct acx_header header;
 
-        u32 options;
-        u32 data_flow_options;
+        __le32 options;
+        __le32 data_flow_options;
 } __attribute__ ((packed));
 
 struct acx_current_tx_power {
@@ -671,14 +562,6 @@ struct acx_current_tx_power {
         u8  padding[3];
 } __attribute__ ((packed));
 
-enum acx_wake_up_event {
-        WAKE_UP_EVENT_BEACON_BITMAP     = 0x01, /* Wake on every Beacon*/
-        WAKE_UP_EVENT_DTIM_BITMAP       = 0x02, /* Wake on every DTIM*/
-        WAKE_UP_EVENT_N_DTIM_BITMAP     = 0x04, /* Wake on every Nth DTIM */
-        WAKE_UP_EVENT_N_BEACONS_BITMAP  = 0x08, /* Wake on every Nth Beacon */
-        WAKE_UP_EVENT_BITS_MASK         = 0x0F
-};
-
 struct acx_wake_up_condition {
         struct acx_header header;
 
@@ -693,7 +576,7 @@ struct acx_aid {
         /*
          * To be set when associated with an AP.
          */
-        u16 aid;
+        __le16 aid;
         u8 pad[2];
 } __attribute__ ((packed));
 
@@ -725,152 +608,152 @@ struct acx_ctsprotect {
 } __attribute__ ((packed));
 
 struct acx_tx_statistics {
-        u32 internal_desc_overflow;
+        __le32 internal_desc_overflow;
 }  __attribute__ ((packed));
 
 struct acx_rx_statistics {
-        u32 out_of_mem;
-        u32 hdr_overflow;
-        u32 hw_stuck;
-        u32 dropped;
-        u32 fcs_err;
-        u32 xfr_hint_trig;
-        u32 path_reset;
-        u32 reset_counter;
+        __le32 out_of_mem;
+        __le32 hdr_overflow;
+        __le32 hw_stuck;
+        __le32 dropped;
+        __le32 fcs_err;
+        __le32 xfr_hint_trig;
+        __le32 path_reset;
+        __le32 reset_counter;
 } __attribute__ ((packed));
 
 struct acx_dma_statistics {
-        u32 rx_requested;
-        u32 rx_errors;
-        u32 tx_requested;
-        u32 tx_errors;
+        __le32 rx_requested;
+        __le32 rx_errors;
+        __le32 tx_requested;
+        __le32 tx_errors;
 }  __attribute__ ((packed));
 
 struct acx_isr_statistics {
         /* host command complete */
-        u32 cmd_cmplt;
+        __le32 cmd_cmplt;
 
         /* fiqisr() */
-        u32 fiqs;
+        __le32 fiqs;
 
         /* (INT_STS_ND & INT_TRIG_RX_HEADER) */
-        u32 rx_headers;
+        __le32 rx_headers;
 
         /* (INT_STS_ND & INT_TRIG_RX_CMPLT) */
-        u32 rx_completes;
+        __le32 rx_completes;
 
         /* (INT_STS_ND & INT_TRIG_NO_RX_BUF) */
-        u32 rx_mem_overflow;
+        __le32 rx_mem_overflow;
 
         /* (INT_STS_ND & INT_TRIG_S_RX_RDY) */
-        u32 rx_rdys;
+        __le32 rx_rdys;
 
         /* irqisr() */
-        u32 irqs;
+        __le32 irqs;
 
         /* (INT_STS_ND & INT_TRIG_TX_PROC) */
-        u32 tx_procs;
+        __le32 tx_procs;
 
         /* (INT_STS_ND & INT_TRIG_DECRYPT_DONE) */
-        u32 decrypt_done;
+        __le32 decrypt_done;
 
         /* (INT_STS_ND & INT_TRIG_DMA0) */
-        u32 dma0_done;
+        __le32 dma0_done;
 
         /* (INT_STS_ND & INT_TRIG_DMA1) */
-        u32 dma1_done;
+        __le32 dma1_done;
 
         /* (INT_STS_ND & INT_TRIG_TX_EXC_CMPLT) */
-        u32 tx_exch_complete;
+        __le32 tx_exch_complete;
 
         /* (INT_STS_ND & INT_TRIG_COMMAND) */
-        u32 commands;
+        __le32 commands;
 
         /* (INT_STS_ND & INT_TRIG_RX_PROC) */
-        u32 rx_procs;
+        __le32 rx_procs;
 
         /* (INT_STS_ND & INT_TRIG_PM_802) */
-        u32 hw_pm_mode_changes;
+        __le32 hw_pm_mode_changes;
 
         /* (INT_STS_ND & INT_TRIG_ACKNOWLEDGE) */
-        u32 host_acknowledges;
+        __le32 host_acknowledges;
 
         /* (INT_STS_ND & INT_TRIG_PM_PCI) */
-        u32 pci_pm;
+        __le32 pci_pm;
 
         /* (INT_STS_ND & INT_TRIG_ACM_WAKEUP) */
-        u32 wakeups;
+        __le32 wakeups;
 
         /* (INT_STS_ND & INT_TRIG_LOW_RSSI) */
-        u32 low_rssi;
+        __le32 low_rssi;
 } __attribute__ ((packed));
 
 struct acx_wep_statistics {
         /* WEP address keys configured */
-        u32 addr_key_count;
+        __le32 addr_key_count;
 
         /* default keys configured */
-        u32 default_key_count;
+        __le32 default_key_count;
 
-        u32 reserved;
+        __le32 reserved;
 
         /* number of times that WEP key not found on lookup */
-        u32 key_not_found;
+        __le32 key_not_found;
 
         /* number of times that WEP key decryption failed */
-        u32 decrypt_fail;
+        __le32 decrypt_fail;
 
         /* WEP packets decrypted */
-        u32 packets;
+        __le32 packets;
 
         /* WEP decrypt interrupts */
-        u32 interrupt;
+        __le32 interrupt;
 } __attribute__ ((packed));
 
 #define ACX_MISSED_BEACONS_SPREAD 10
 
 struct acx_pwr_statistics {
         /* the amount of enters into power save mode (both PD & ELP) */
-        u32 ps_enter;
+        __le32 ps_enter;
 
         /* the amount of enters into ELP mode */
-        u32 elp_enter;
+        __le32 elp_enter;
 
         /* the amount of missing beacon interrupts to the host */
-        u32 missing_bcns;
+        __le32 missing_bcns;
 
         /* the amount of wake on host-access times */
-        u32 wake_on_host;
+        __le32 wake_on_host;
 
         /* the amount of wake on timer-expire */
-        u32 wake_on_timer_exp;
+        __le32 wake_on_timer_exp;
 
         /* the number of packets that were transmitted with PS bit set */
-        u32 tx_with_ps;
+        __le32 tx_with_ps;
 
         /* the number of packets that were transmitted with PS bit clear */
-        u32 tx_without_ps;
+        __le32 tx_without_ps;
 
         /* the number of received beacons */
-        u32 rcvd_beacons;
+        __le32 rcvd_beacons;
 
         /* the number of entering into PowerOn (power save off) */
-        u32 power_save_off;
+        __le32 power_save_off;
 
         /* the number of entries into power save mode */
-        u16 enable_ps;
+        __le16 enable_ps;
 
         /*
          * the number of exits from power save, not including failed PS
          * transitions
          */
-        u16 disable_ps;
+        __le16 disable_ps;
 
         /*
          * the number of times the TSF counter was adjusted because
          * of drift
          */
-        u32 fix_tsf_ps;
+        __le32 fix_tsf_ps;
 
         /* Gives statistics about the spread continuous missed beacons.
          * The 16 LSB are dedicated for the PS mode.
@@ -881,53 +764,53 @@ struct acx_pwr_statistics {
          * ...
          * cont_miss_bcns_spread[9] - ten and more continuous missed beacons.
         */
-        u32 cont_miss_bcns_spread[ACX_MISSED_BEACONS_SPREAD];
+        __le32 cont_miss_bcns_spread[ACX_MISSED_BEACONS_SPREAD];
 
         /* the number of beacons in awake mode */
-        u32 rcvd_awake_beacons;
+        __le32 rcvd_awake_beacons;
 } __attribute__ ((packed));
 
 struct acx_mic_statistics {
-        u32 rx_pkts;
-        u32 calc_failure;
+        __le32 rx_pkts;
+        __le32 calc_failure;
 } __attribute__ ((packed));
 
 struct acx_aes_statistics {
-        u32 encrypt_fail;
-        u32 decrypt_fail;
-        u32 encrypt_packets;
-        u32 decrypt_packets;
-        u32 encrypt_interrupt;
-        u32 decrypt_interrupt;
+        __le32 encrypt_fail;
+        __le32 decrypt_fail;
+        __le32 encrypt_packets;
+        __le32 decrypt_packets;
+        __le32 encrypt_interrupt;
+        __le32 decrypt_interrupt;
 } __attribute__ ((packed));
 
 struct acx_event_statistics {
-        u32 heart_beat;
-        u32 calibration;
-        u32 rx_mismatch;
-        u32 rx_mem_empty;
-        u32 rx_pool;
-        u32 oom_late;
-        u32 phy_transmit_error;
-        u32 tx_stuck;
+        __le32 heart_beat;
+        __le32 calibration;
+        __le32 rx_mismatch;
+        __le32 rx_mem_empty;
+        __le32 rx_pool;
+        __le32 oom_late;
+        __le32 phy_transmit_error;
+        __le32 tx_stuck;
 } __attribute__ ((packed));
 
 struct acx_ps_statistics {
-        u32 pspoll_timeouts;
-        u32 upsd_timeouts;
-        u32 upsd_max_sptime;
-        u32 upsd_max_apturn;
-        u32 pspoll_max_apturn;
-        u32 pspoll_utilization;
-        u32 upsd_utilization;
+        __le32 pspoll_timeouts;
+        __le32 upsd_timeouts;
+        __le32 upsd_max_sptime;
+        __le32 upsd_max_apturn;
+        __le32 pspoll_max_apturn;
+        __le32 pspoll_utilization;
+        __le32 upsd_utilization;
 } __attribute__ ((packed));
 
 struct acx_rxpipe_statistics {
-        u32 rx_prep_beacon_drop;
-        u32 descr_host_int_trig_rx_data;
-        u32 beacon_buffer_thres_host_int_trig_rx_data;
-        u32 missed_beacon_host_int_trig_rx_data;
-        u32 tx_xfr_host_int_trig_rx_data;
+        __le32 rx_prep_beacon_drop;
+        __le32 descr_host_int_trig_rx_data;
+        __le32 beacon_buffer_thres_host_int_trig_rx_data;
+        __le32 missed_beacon_host_int_trig_rx_data;
+        __le32 tx_xfr_host_int_trig_rx_data;
 } __attribute__ ((packed));
 
 struct acx_statistics {
@@ -946,13 +829,8 @@ struct acx_statistics {
         struct acx_rxpipe_statistics rxpipe;
 } __attribute__ ((packed));
 
-#define ACX_MAX_RATE_CLASSES       8
-#define ACX_RATE_MASK_UNSPECIFIED  0
-#define ACX_RATE_MASK_ALL          0x1eff
-#define ACX_RATE_RETRY_LIMIT       10
-
 struct acx_rate_class {
-        u32 enabled_rates;
+        __le32 enabled_rates;
         u8 short_retry_limit;
         u8 long_retry_limit;
         u8 aflags;
@@ -962,47 +840,20 @@ struct acx_rate_class {
 struct acx_rate_policy {
         struct acx_header header;
 
-        u32 rate_class_cnt;
-        struct acx_rate_class rate_class[ACX_MAX_RATE_CLASSES];
+        __le32 rate_class_cnt;
+        struct acx_rate_class rate_class[CONF_TX_MAX_RATE_CLASSES];
 } __attribute__ ((packed));
 
-#define WL1271_ACX_AC_COUNT 4
-
 struct acx_ac_cfg {
         struct acx_header header;
         u8 ac;
         u8 cw_min;
-        u16 cw_max;
+        __le16 cw_max;
         u8 aifsn;
         u8 reserved;
-        u16 tx_op_limit;
+        __le16 tx_op_limit;
 } __attribute__ ((packed));
 
-enum wl1271_acx_ac {
-        WL1271_ACX_AC_BE = 0,
-        WL1271_ACX_AC_BK = 1,
-        WL1271_ACX_AC_VI = 2,
-        WL1271_ACX_AC_VO = 3,
-        WL1271_ACX_AC_CTS2SELF = 4,
-        WL1271_ACX_AC_ANY_TID = 0x1F,
-        WL1271_ACX_AC_INVALID = 0xFF,
-};
-
-enum wl1271_acx_ps_scheme {
-        WL1271_ACX_PS_SCHEME_LEGACY = 0,
-        WL1271_ACX_PS_SCHEME_UPSD_TRIGGER = 1,
-        WL1271_ACX_PS_SCHEME_LEGACY_PSPOLL = 2,
-        WL1271_ACX_PS_SCHEME_SAPSD = 3,
-};
-
-enum wl1271_acx_ack_policy {
-        WL1271_ACX_ACK_POLICY_LEGACY = 0,
-        WL1271_ACX_ACK_POLICY_NO_ACK = 1,
-        WL1271_ACX_ACK_POLICY_BLOCK = 2,
-};
-
-#define WL1271_ACX_TID_COUNT 7
-
 struct acx_tid_config {
         struct acx_header header;
         u8 queue_id;
@@ -1011,22 +862,19 @@ struct acx_tid_config {
         u8 ps_scheme;
         u8 ack_policy;
         u8 padding[3];
-        u32 apsd_conf[2];
+        __le32 apsd_conf[2];
 } __attribute__ ((packed));
 
 struct acx_frag_threshold {
         struct acx_header header;
-        u16 frag_threshold;
+        __le16 frag_threshold;
         u8 padding[2];
 } __attribute__ ((packed));
 
-#define WL1271_ACX_TX_COMPL_TIMEOUT   5
-#define WL1271_ACX_TX_COMPL_THRESHOLD 5
-
 struct acx_tx_config_options {
         struct acx_header header;
-        u16 tx_compl_timeout;     /* msec */
-        u16 tx_compl_threshold;   /* number of packets */
+        __le16 tx_compl_timeout;     /* msec */
+        __le16 tx_compl_threshold;   /* number of packets */
 } __attribute__ ((packed));
 
 #define ACX_RX_MEM_BLOCKS     64
@@ -1041,79 +889,87 @@ struct wl1271_acx_config_memory {
         u8 tx_min_mem_block_num;
         u8 num_stations;
         u8 num_ssid_profiles;
-        u32 total_tx_descriptors;
+        __le32 total_tx_descriptors;
 } __attribute__ ((packed));
 
 struct wl1271_acx_mem_map {
         struct acx_header header;
 
-        void *code_start;
-        void *code_end;
+        __le32 code_start;
+        __le32 code_end;
 
-        void *wep_defkey_start;
-        void *wep_defkey_end;
+        __le32 wep_defkey_start;
+        __le32 wep_defkey_end;
 
-        void *sta_table_start;
-        void *sta_table_end;
+        __le32 sta_table_start;
+        __le32 sta_table_end;
 
-        void *packet_template_start;
-        void *packet_template_end;
+        __le32 packet_template_start;
+        __le32 packet_template_end;
 
         /* Address of the TX result interface (control block) */
-        u32 tx_result;
-        u32 tx_result_queue_start;
+        __le32 tx_result;
+        __le32 tx_result_queue_start;
 
-        void *queue_memory_start;
-        void *queue_memory_end;
+        __le32 queue_memory_start;
+        __le32 queue_memory_end;
 
-        u32 packet_memory_pool_start;
-        u32 packet_memory_pool_end;
+        __le32 packet_memory_pool_start;
+        __le32 packet_memory_pool_end;
 
-        void *debug_buffer1_start;
-        void *debug_buffer1_end;
+        __le32 debug_buffer1_start;
+        __le32 debug_buffer1_end;
 
-        void *debug_buffer2_start;
-        void *debug_buffer2_end;
+        __le32 debug_buffer2_start;
+        __le32 debug_buffer2_end;
 
         /* Number of blocks FW allocated for TX packets */
-        u32 num_tx_mem_blocks;
+        __le32 num_tx_mem_blocks;
 
         /* Number of blocks FW allocated for RX packets */
-        u32 num_rx_mem_blocks;
+        __le32 num_rx_mem_blocks;
 
         /* the following 4 fields are valid in SLAVE mode only */
         u8 *tx_cbuf;
         u8 *rx_cbuf;
-        void *rx_ctrl;
-        void *tx_ctrl;
+        __le32 rx_ctrl;
+        __le32 tx_ctrl;
 } __attribute__ ((packed));
 
-enum wl1271_acx_rx_queue_type {
-        RX_QUEUE_TYPE_RX_LOW_PRIORITY,    /* All except the high priority */
-        RX_QUEUE_TYPE_RX_HIGH_PRIORITY,   /* Management and voice packets */
-        RX_QUEUE_TYPE_NUM,
-        RX_QUEUE_TYPE_MAX = USHORT_MAX
-};
-
-#define WL1271_RX_INTR_THRESHOLD_DEF  0       /* no pacing, send interrupt on
-                                               * every event */
-#define WL1271_RX_INTR_THRESHOLD_MIN  0
-#define WL1271_RX_INTR_THRESHOLD_MAX  15
-
-#define WL1271_RX_INTR_TIMEOUT_DEF    5
-#define WL1271_RX_INTR_TIMEOUT_MIN    1
-#define WL1271_RX_INTR_TIMEOUT_MAX    100
-
 struct wl1271_acx_rx_config_opt {
         struct acx_header header;
 
-        u16 mblk_threshold;
-        u16 threshold;
-        u16 timeout;
+        __le16 mblk_threshold;
+        __le16 threshold;
+        __le16 timeout;
         u8 queue_type;
         u8 reserved;
 } __attribute__ ((packed));
 
+
+struct wl1271_acx_bet_enable {
+        struct acx_header header;
+
+        u8 enable;
+        u8 max_consecutive;
+        u8 padding[2];
+} __attribute__ ((packed));
+
+#define ACX_IPV4_VERSION 4
+#define ACX_IPV6_VERSION 6
+#define ACX_IPV4_ADDR_SIZE 4
+struct wl1271_acx_arp_filter {
+        struct acx_header header;
+        u8 version;         /* ACX_IPV4_VERSION, ACX_IPV6_VERSION */
+        u8 enable;          /* 1 to enable ARP filtering, 0 to disable */
+        u8 padding[2];
+        u8 address[16];     /* The configured device IP address - all ARP
+                               requests directed to this IP address will pass
+                               through. For IPv4, the first four bytes are
+                               used. */
+} __attribute__((packed));
+
+
 enum {
         ACX_WAKE_UP_CONDITIONS      = 0x0002,
         ACX_MEM_CFG                 = 0x0003,
@@ -1170,6 +1026,9 @@ enum {
         ACX_PEER_HT_CAP             = 0x0057,
         ACX_HT_BSS_OPERATION        = 0x0058,
         ACX_COEX_ACTIVITY           = 0x0059,
+        ACX_SET_SMART_REFLEX_DEBUG  = 0x005A,
+        ACX_SET_SMART_REFLEX_STATE  = 0x005B,
+        ACX_SET_SMART_REFLEX_PARAMS = 0x005F,
         DOT11_RX_MSDU_LIFE_TIME     = 0x1004,
         DOT11_CUR_TX_PWR            = 0x100D,
         DOT11_RX_DOT11_MODE         = 0x1012,
@@ -1182,23 +1041,24 @@ enum {
 };
 
 
-int wl1271_acx_wake_up_conditions(struct wl1271 *wl, u8 wake_up_event,
-                                  u8 listen_interval);
+int wl1271_acx_wake_up_conditions(struct wl1271 *wl);
 int wl1271_acx_sleep_auth(struct wl1271 *wl, u8 sleep_auth);
 int wl1271_acx_fw_version(struct wl1271 *wl, char *buf, size_t len);
 int wl1271_acx_tx_power(struct wl1271 *wl, int power);
 int wl1271_acx_feature_cfg(struct wl1271 *wl);
 int wl1271_acx_mem_map(struct wl1271 *wl,
                        struct acx_header *mem_map, size_t len);
-int wl1271_acx_rx_msdu_life_time(struct wl1271 *wl, u32 life_time);
+int wl1271_acx_rx_msdu_life_time(struct wl1271 *wl);
 int wl1271_acx_rx_config(struct wl1271 *wl, u32 config, u32 filter);
 int wl1271_acx_pd_threshold(struct wl1271 *wl);
 int wl1271_acx_slot(struct wl1271 *wl, enum acx_slot_type slot_time);
-int wl1271_acx_group_address_tbl(struct wl1271 *wl);
+int wl1271_acx_group_address_tbl(struct wl1271 *wl, bool enable,
+                                 void *mc_list, u32 mc_list_len);
 int wl1271_acx_service_period_timeout(struct wl1271 *wl);
 int wl1271_acx_rts_threshold(struct wl1271 *wl, u16 rts_threshold);
-int wl1271_acx_beacon_filter_opt(struct wl1271 *wl);
+int wl1271_acx_beacon_filter_opt(struct wl1271 *wl, bool enable_filter);
 int wl1271_acx_beacon_filter_table(struct wl1271 *wl);
+int wl1271_acx_conn_monit_params(struct wl1271 *wl);
 int wl1271_acx_sg_enable(struct wl1271 *wl);
 int wl1271_acx_sg_cfg(struct wl1271 *wl);
 int wl1271_acx_cca_threshold(struct wl1271 *wl);
@@ -1207,9 +1067,9 @@ int wl1271_acx_aid(struct wl1271 *wl, u16 aid);
 int wl1271_acx_event_mbox_mask(struct wl1271 *wl, u32 event_mask);
 int wl1271_acx_set_preamble(struct wl1271 *wl, enum acx_preamble_type preamble);
 int wl1271_acx_cts_protect(struct wl1271 *wl,
-                            enum acx_ctsprotect_type ctsprotect);
+                           enum acx_ctsprotect_type ctsprotect);
 int wl1271_acx_statistics(struct wl1271 *wl, struct acx_statistics *stats);
-int wl1271_acx_rate_policies(struct wl1271 *wl);
+int wl1271_acx_rate_policies(struct wl1271 *wl, u32 enabled_rates);
 int wl1271_acx_ac_cfg(struct wl1271 *wl);
 int wl1271_acx_tid_cfg(struct wl1271 *wl);
 int wl1271_acx_frag_threshold(struct wl1271 *wl);
@@ -1217,5 +1077,9 @@ int wl1271_acx_tx_config_options(struct wl1271 *wl);
 int wl1271_acx_mem_cfg(struct wl1271 *wl);
 int wl1271_acx_init_mem_config(struct wl1271 *wl);
 int wl1271_acx_init_rx_interrupt(struct wl1271 *wl);
+int wl1271_acx_smart_reflex(struct wl1271 *wl);
+int wl1271_acx_bet_enable(struct wl1271 *wl, bool enable);
+int wl1271_acx_arp_ip_filter(struct wl1271 *wl, bool enable, u8 *address,
+                             u8 version);
 
 #endif /* __WL1271_ACX_H__ */
diff --git a/drivers/net/wireless/wl12xx/wl1271_boot.c b/drivers/net/wireless/wl12xx/wl1271_boot.c
index 8228ef474a7e..ba4a2b4f0f56 100644
--- a/drivers/net/wireless/wl12xx/wl1271_boot.c
+++ b/drivers/net/wireless/wl12xx/wl1271_boot.c
@@ -39,6 +39,14 @@ static struct wl1271_partition_set part_table[PART_TABLE_LEN] = {
                         .start = REGISTERS_BASE,
                         .size  = 0x00008800
                 },
+                .mem2 = {
+                        .start = 0x00000000,
+                        .size  = 0x00000000
+                },
+                .mem3 = {
+                        .start = 0x00000000,
+                        .size  = 0x00000000
+                },
         },
 
         [PART_WORK] = {
@@ -48,7 +56,15 @@ static struct wl1271_partition_set part_table[PART_TABLE_LEN] = {
                 },
                 .reg = {
                         .start = REGISTERS_BASE,
-                        .size  = 0x0000b000
+                        .size  = 0x0000a000
+                },
+                .mem2 = {
+                        .start = 0x003004f8,
+                        .size  = 0x00000004
+                },
+                .mem3 = {
+                        .start = 0x00040404,
+                        .size  = 0x00000000
                 },
         },
 
@@ -60,6 +76,14 @@ static struct wl1271_partition_set part_table[PART_TABLE_LEN] = {
                 .reg = {
                         .start = DRPW_BASE,
                         .size  = 0x00006000
+                },
+                .mem2 = {
+                        .start = 0x00000000,
+                        .size  = 0x00000000
+                },
+                .mem3 = {
+                        .start = 0x00000000,
+                        .size  = 0x00000000
                 }
         }
 };
@@ -69,19 +93,19 @@ static void wl1271_boot_set_ecpu_ctrl(struct wl1271 *wl, u32 flag)
         u32 cpu_ctrl;
 
         /* 10.5.0 run the firmware (I) */
-        cpu_ctrl = wl1271_reg_read32(wl, ACX_REG_ECPU_CONTROL);
+        cpu_ctrl = wl1271_spi_read32(wl, ACX_REG_ECPU_CONTROL);
 
         /* 10.5.1 run the firmware (II) */
         cpu_ctrl |= flag;
-        wl1271_reg_write32(wl, ACX_REG_ECPU_CONTROL, cpu_ctrl);
+        wl1271_spi_write32(wl, ACX_REG_ECPU_CONTROL, cpu_ctrl);
 }
 
 static void wl1271_boot_fw_version(struct wl1271 *wl)
 {
         struct wl1271_static_data static_data;
 
-        wl1271_spi_mem_read(wl, wl->cmd_box_addr,
-                            &static_data, sizeof(static_data));
+        wl1271_spi_read(wl, wl->cmd_box_addr,
+                        &static_data, sizeof(static_data), false);
 
         strncpy(wl->chip.fw_ver, static_data.fw_version,
                 sizeof(wl->chip.fw_ver));
@@ -93,8 +117,9 @@ static void wl1271_boot_fw_version(struct wl1271 *wl)
 static int wl1271_boot_upload_firmware_chunk(struct wl1271 *wl, void *buf,
                                              size_t fw_data_len, u32 dest)
 {
+        struct wl1271_partition_set partition;
         int addr, chunk_num, partition_limit;
-        u8 *p;
+        u8 *p, *chunk;
 
         /* whal_FwCtrl_LoadFwImageSm() */
 
@@ -103,16 +128,20 @@ static int wl1271_boot_upload_firmware_chunk(struct wl1271 *wl, void *buf,
         wl1271_debug(DEBUG_BOOT, "fw_data_len %zd chunk_size %d",
                      fw_data_len, CHUNK_SIZE);
 
-
         if ((fw_data_len % 4) != 0) {
                 wl1271_error("firmware length not multiple of four");
                 return -EIO;
         }
 
-        wl1271_set_partition(wl, dest,
-                             part_table[PART_DOWN].mem.size,
-                             part_table[PART_DOWN].reg.start,
-                             part_table[PART_DOWN].reg.size);
+        chunk = kmalloc(CHUNK_SIZE, GFP_KERNEL);
+        if (!chunk) {
+                wl1271_error("allocation for firmware upload chunk failed");
+                return -ENOMEM;
+        }
+
+        memcpy(&partition, &part_table[PART_DOWN], sizeof(partition));
+        partition.mem.start = dest;
+        wl1271_set_partition(wl, &partition);
 
         /* 10.1 set partition limit and chunk num */
         chunk_num = 0;
@@ -125,21 +154,17 @@ static int wl1271_boot_upload_firmware_chunk(struct wl1271 *wl, void *buf,
                         addr = dest + chunk_num * CHUNK_SIZE;
                         partition_limit = chunk_num * CHUNK_SIZE +
                                 part_table[PART_DOWN].mem.size;
-
-                        /* FIXME: Over 80 chars! */
-                        wl1271_set_partition(wl,
-                                             addr,
-                                             part_table[PART_DOWN].mem.size,
-                                             part_table[PART_DOWN].reg.start,
-                                             part_table[PART_DOWN].reg.size);
+                        partition.mem.start = addr;
+                        wl1271_set_partition(wl, &partition);
                 }
 
                 /* 10.3 upload the chunk */
                 addr = dest + chunk_num * CHUNK_SIZE;
                 p = buf + chunk_num * CHUNK_SIZE;
+                memcpy(chunk, p, CHUNK_SIZE);
                 wl1271_debug(DEBUG_BOOT, "uploading fw chunk 0x%p to 0x%x",
                              p, addr);
-                wl1271_spi_mem_write(wl, addr, p, CHUNK_SIZE);
+                wl1271_spi_write(wl, addr, chunk, CHUNK_SIZE, false);
 
                 chunk_num++;
         }
@@ -147,28 +172,31 @@ static int wl1271_boot_upload_firmware_chunk(struct wl1271 *wl, void *buf,
         /* 10.4 upload the last chunk */
         addr = dest + chunk_num * CHUNK_SIZE;
         p = buf + chunk_num * CHUNK_SIZE;
+        memcpy(chunk, p, fw_data_len % CHUNK_SIZE);
         wl1271_debug(DEBUG_BOOT, "uploading fw last chunk (%zd B) 0x%p to 0x%x",
                      fw_data_len % CHUNK_SIZE, p, addr);
-        wl1271_spi_mem_write(wl, addr, p, fw_data_len % CHUNK_SIZE);
+        wl1271_spi_write(wl, addr, chunk, fw_data_len % CHUNK_SIZE, false);
 
+        kfree(chunk);
         return 0;
 }
 
 static int wl1271_boot_upload_firmware(struct wl1271 *wl)
 {
         u32 chunks, addr, len;
+        int ret = 0;
         u8 *fw;
 
         fw = wl->fw;
-        chunks = be32_to_cpup((u32 *) fw);
+        chunks = be32_to_cpup((__be32 *) fw);
         fw += sizeof(u32);
 
         wl1271_debug(DEBUG_BOOT, "firmware chunks to be uploaded: %u", chunks);
 
         while (chunks--) {
-                addr = be32_to_cpup((u32 *) fw);
+                addr = be32_to_cpup((__be32 *) fw);
                 fw += sizeof(u32);
-                len = be32_to_cpup((u32 *) fw);
+                len = be32_to_cpup((__be32 *) fw);
                 fw += sizeof(u32);
 
                 if (len > 300000) {
@@ -177,11 +205,13 @@ static int wl1271_boot_upload_firmware(struct wl1271 *wl)
                 }
                 wl1271_debug(DEBUG_BOOT, "chunk %d addr 0x%x len %u",
                              chunks, addr, len);
-                wl1271_boot_upload_firmware_chunk(wl, fw, len, addr);
+                ret = wl1271_boot_upload_firmware_chunk(wl, fw, len, addr);
+                if (ret != 0)
+                        break;
                 fw += len;
         }
 
-        return 0;
+        return ret;
 }
 
 static int wl1271_boot_upload_nvs(struct wl1271 *wl)
@@ -235,7 +265,7 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
                         wl1271_debug(DEBUG_BOOT,
                                      "nvs burst write 0x%x: 0x%x",
                                      dest_addr, val);
-                        wl1271_reg_write32(wl, dest_addr, val);
+                        wl1271_spi_write32(wl, dest_addr, val);
 
                         nvs_ptr += 4;
                         dest_addr += 4;
@@ -253,20 +283,18 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
         /* FIXME: The driver sets the partition here, but this is not needed,
            since it sets to the same one as currently in use */
         /* Now we must set the partition correctly */
-        wl1271_set_partition(wl,
-                             part_table[PART_WORK].mem.start,
-                             part_table[PART_WORK].mem.size,
-                             part_table[PART_WORK].reg.start,
-                             part_table[PART_WORK].reg.size);
+        wl1271_set_partition(wl, &part_table[PART_WORK]);
 
         /* Copy the NVS tables to a new block to ensure alignment */
         nvs_aligned = kmemdup(nvs_ptr, nvs_len, GFP_KERNEL);
+        if (!nvs_aligned)
+                return -ENOMEM;
 
         /* And finally we upload the NVS tables */
         /* FIXME: In wl1271, we upload everything at once.
            No endianness handling needed here?! The ref driver doesn't do
            anything about it at this point */
-        wl1271_spi_mem_write(wl, CMD_MBOX_ADDRESS, nvs_aligned, nvs_len);
+        wl1271_spi_write(wl, CMD_MBOX_ADDRESS, nvs_aligned, nvs_len, false);
 
         kfree(nvs_aligned);
         return 0;
@@ -275,9 +303,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
 static void wl1271_boot_enable_interrupts(struct wl1271 *wl)
 {
         enable_irq(wl->irq);
-        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_MASK,
+        wl1271_spi_write32(wl, ACX_REG_INTERRUPT_MASK,
                            WL1271_ACX_INTR_ALL & ~(WL1271_INTR_MASK));
-        wl1271_reg_write32(wl, HI_CFG, HI_CFG_DEF_VAL);
+        wl1271_spi_write32(wl, HI_CFG, HI_CFG_DEF_VAL);
 }
 
 static int wl1271_boot_soft_reset(struct wl1271 *wl)
@@ -286,12 +314,13 @@ static int wl1271_boot_soft_reset(struct wl1271 *wl)
         u32 boot_data;
 
         /* perform soft reset */
-        wl1271_reg_write32(wl, ACX_REG_SLV_SOFT_RESET, ACX_SLV_SOFT_RESET_BIT);
+        wl1271_spi_write32(wl, ACX_REG_SLV_SOFT_RESET,
+                           ACX_SLV_SOFT_RESET_BIT);
 
         /* SOFT_RESET is self clearing */
         timeout = jiffies + usecs_to_jiffies(SOFT_RESET_MAX_TIME);
         while (1) {
-                boot_data = wl1271_reg_read32(wl, ACX_REG_SLV_SOFT_RESET);
+                boot_data = wl1271_spi_read32(wl, ACX_REG_SLV_SOFT_RESET);
                 wl1271_debug(DEBUG_BOOT, "soft reset bootdata 0x%x", boot_data);
                 if ((boot_data & ACX_SLV_SOFT_RESET_BIT) == 0)
                         break;
@@ -307,10 +336,10 @@ static int wl1271_boot_soft_reset(struct wl1271 *wl)
         }
 
         /* disable Rx/Tx */
-        wl1271_reg_write32(wl, ENABLE, 0x0);
+        wl1271_spi_write32(wl, ENABLE, 0x0);
 
         /* disable auto calibration on start*/
-        wl1271_reg_write32(wl, SPARE_A2, 0xffff);
+        wl1271_spi_write32(wl, SPARE_A2, 0xffff);
 
         return 0;
 }
@@ -322,7 +351,7 @@ static int wl1271_boot_run_firmware(struct wl1271 *wl)
 
         wl1271_boot_set_ecpu_ctrl(wl, ECPU_CONTROL_HALT);
 
-        chip_id = wl1271_reg_read32(wl, CHIP_ID_B);
+        chip_id = wl1271_spi_read32(wl, CHIP_ID_B);
 
         wl1271_debug(DEBUG_BOOT, "chip id after firmware boot: 0x%x", chip_id);
 
@@ -335,7 +364,8 @@ static int wl1271_boot_run_firmware(struct wl1271 *wl)
         loop = 0;
         while (loop++ < INIT_LOOP) {
                 udelay(INIT_LOOP_DELAY);
-                interrupt = wl1271_reg_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
+                interrupt = wl1271_spi_read32(wl,
+                                              ACX_REG_INTERRUPT_NO_CLEAR);
 
                 if (interrupt == 0xffffffff) {
                         wl1271_error("error reading hardware complete "
@@ -344,7 +374,7 @@ static int wl1271_boot_run_firmware(struct wl1271 *wl)
                 }
                 /* check that ACX_INTR_INIT_COMPLETE is enabled */
                 else if (interrupt & WL1271_ACX_INTR_INIT_COMPLETE) {
-                        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_ACK,
+                        wl1271_spi_write32(wl, ACX_REG_INTERRUPT_ACK,
                                            WL1271_ACX_INTR_INIT_COMPLETE);
                         break;
                 }
@@ -357,17 +387,13 @@ static int wl1271_boot_run_firmware(struct wl1271 *wl)
         }
 
         /* get hardware config command mail box */
-        wl->cmd_box_addr = wl1271_reg_read32(wl, REG_COMMAND_MAILBOX_PTR);
+        wl->cmd_box_addr = wl1271_spi_read32(wl, REG_COMMAND_MAILBOX_PTR);
 
         /* get hardware config event mail box */
-        wl->event_box_addr = wl1271_reg_read32(wl, REG_EVENT_MAILBOX_PTR);
+        wl->event_box_addr = wl1271_spi_read32(wl, REG_EVENT_MAILBOX_PTR);
 
         /* set the working partition to its "running" mode offset */
-        wl1271_set_partition(wl,
-                             part_table[PART_WORK].mem.start,
-                             part_table[PART_WORK].mem.size,
-                             part_table[PART_WORK].reg.start,
-                             part_table[PART_WORK].reg.size);
+        wl1271_set_partition(wl, &part_table[PART_WORK]);
 
         wl1271_debug(DEBUG_MAILBOX, "cmd_box_addr 0x%x event_box_addr 0x%x",
                      wl->cmd_box_addr, wl->event_box_addr);
@@ -379,11 +405,9 @@ static int wl1271_boot_run_firmware(struct wl1271 *wl)
          * ready to receive event from the command mailbox
          */
 
-        /* enable gpio interrupts */
-        wl1271_boot_enable_interrupts(wl);
-
-        /* unmask all mbox events  */
-        wl->event_mask = 0xffffffff;
+        /* unmask required mbox events  */
+        wl->event_mask = BSS_LOSE_EVENT_ID |
+                SCAN_COMPLETE_EVENT_ID;
 
         ret = wl1271_event_unmask(wl);
         if (ret < 0) {
@@ -399,34 +423,13 @@ static int wl1271_boot_run_firmware(struct wl1271 *wl)
 
 static int wl1271_boot_write_irq_polarity(struct wl1271 *wl)
 {
-        u32 polarity, status, i;
-
-        wl1271_reg_write32(wl, OCP_POR_CTR, OCP_REG_POLARITY);
-        wl1271_reg_write32(wl, OCP_CMD, OCP_CMD_READ);
-
-        /* Wait until the command is complete (ie. bit 18 is set) */
-        for (i = 0; i < OCP_CMD_LOOP; i++) {
-                polarity = wl1271_reg_read32(wl, OCP_DATA_READ);
-                if (polarity & OCP_READY_MASK)
-                        break;
-        }
-        if (i == OCP_CMD_LOOP) {
-                wl1271_error("OCP command timeout!");
-                return -EIO;
-        }
+        u32 polarity;
 
-        status = polarity & OCP_STATUS_MASK;
-        if (status != OCP_STATUS_OK) {
-                wl1271_error("OCP command failed (%d)", status);
-                return -EIO;
-        }
+        polarity = wl1271_top_reg_read(wl, OCP_REG_POLARITY);
 
         /* We use HIGH polarity, so unset the LOW bit */
         polarity &= ~POLARITY_LOW;
-
-        wl1271_reg_write32(wl, OCP_POR_CTR, OCP_REG_POLARITY);
-        wl1271_reg_write32(wl, OCP_DATA_WRITE, polarity);
-        wl1271_reg_write32(wl, OCP_CMD, OCP_CMD_WRITE);
+        wl1271_top_reg_write(wl, OCP_REG_POLARITY, polarity);
 
         return 0;
 }
@@ -436,16 +439,32 @@ int wl1271_boot(struct wl1271 *wl)
         int ret = 0;
         u32 tmp, clk, pause;
 
-        if (REF_CLOCK == 0 || REF_CLOCK == 2)
-                /* ref clk: 19.2/38.4 */
+        if (REF_CLOCK == 0 || REF_CLOCK == 2 || REF_CLOCK == 4)
+                /* ref clk: 19.2/38.4/38.4-XTAL */
                 clk = 0x3;
         else if (REF_CLOCK == 1 || REF_CLOCK == 3)
                 /* ref clk: 26/52 */
                 clk = 0x5;
 
-        wl1271_reg_write32(wl, PLL_PARAMETERS, clk);
+        if (REF_CLOCK != 0) {
+                u16 val;
+                /* Set clock type */
+                val = wl1271_top_reg_read(wl, OCP_REG_CLK_TYPE);
+                val &= FREF_CLK_TYPE_BITS;
+                val |= CLK_REQ_PRCM;
+                wl1271_top_reg_write(wl, OCP_REG_CLK_TYPE, val);
+        } else {
+                u16 val;
+                /* Set clock polarity */
+                val = wl1271_top_reg_read(wl, OCP_REG_CLK_POLARITY);
+                val &= FREF_CLK_POLARITY_BITS;
+                val |= CLK_REQ_OUTN_SEL;
+                wl1271_top_reg_write(wl, OCP_REG_CLK_POLARITY, val);
+        }
+
+        wl1271_spi_write32(wl, PLL_PARAMETERS, clk);
 
-        pause = wl1271_reg_read32(wl, PLL_PARAMETERS);
+        pause = wl1271_spi_read32(wl, PLL_PARAMETERS);
 
         wl1271_debug(DEBUG_BOOT, "pause1 0x%x", pause);
 
@@ -454,39 +473,31 @@ int wl1271_boot(struct wl1271 *wl)
                                            * 0x3ff (magic number ).  How does
                                            * this work?! */
         pause |= WU_COUNTER_PAUSE_VAL;
-        wl1271_reg_write32(wl, WU_COUNTER_PAUSE, pause);
+        wl1271_spi_write32(wl, WU_COUNTER_PAUSE, pause);
 
         /* Continue the ELP wake up sequence */
-        wl1271_reg_write32(wl, WELP_ARM_COMMAND, WELP_ARM_COMMAND_VAL);
+        wl1271_spi_write32(wl, WELP_ARM_COMMAND, WELP_ARM_COMMAND_VAL);
         udelay(500);
 
-        wl1271_set_partition(wl,
-                             part_table[PART_DRPW].mem.start,
-                             part_table[PART_DRPW].mem.size,
-                             part_table[PART_DRPW].reg.start,
-                             part_table[PART_DRPW].reg.size);
+        wl1271_set_partition(wl, &part_table[PART_DRPW]);
 
         /* Read-modify-write DRPW_SCRATCH_START register (see next state)
            to be used by DRPw FW. The RTRIM value will be added by the FW
            before taking DRPw out of reset */
 
         wl1271_debug(DEBUG_BOOT, "DRPW_SCRATCH_START %08x", DRPW_SCRATCH_START);
-        clk = wl1271_reg_read32(wl, DRPW_SCRATCH_START);
+        clk = wl1271_spi_read32(wl, DRPW_SCRATCH_START);
 
         wl1271_debug(DEBUG_BOOT, "clk2 0x%x", clk);
 
         /* 2 */
         clk |= (REF_CLOCK << 1) << 4;
-        wl1271_reg_write32(wl, DRPW_SCRATCH_START, clk);
+        wl1271_spi_write32(wl, DRPW_SCRATCH_START, clk);
 
-        wl1271_set_partition(wl,
-                             part_table[PART_WORK].mem.start,
-                             part_table[PART_WORK].mem.size,
-                             part_table[PART_WORK].reg.start,
-                             part_table[PART_WORK].reg.size);
+        wl1271_set_partition(wl, &part_table[PART_WORK]);
 
         /* Disable interrupts */
-        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_MASK, WL1271_ACX_INTR_ALL);
+        wl1271_spi_write32(wl, ACX_REG_INTERRUPT_MASK, WL1271_ACX_INTR_ALL);
 
         ret = wl1271_boot_soft_reset(wl);
         if (ret < 0)
@@ -501,21 +512,22 @@ int wl1271_boot(struct wl1271 *wl)
          * ACX_EEPROMLESS_IND_REG */
         wl1271_debug(DEBUG_BOOT, "ACX_EEPROMLESS_IND_REG");
 
-        wl1271_reg_write32(wl, ACX_EEPROMLESS_IND_REG, ACX_EEPROMLESS_IND_REG);
+        wl1271_spi_write32(wl, ACX_EEPROMLESS_IND_REG,
+                           ACX_EEPROMLESS_IND_REG);
 
-        tmp = wl1271_reg_read32(wl, CHIP_ID_B);
+        tmp = wl1271_spi_read32(wl, CHIP_ID_B);
 
         wl1271_debug(DEBUG_BOOT, "chip id 0x%x", tmp);
 
         /* 6. read the EEPROM parameters */
-        tmp = wl1271_reg_read32(wl, SCR_PAD2);
+        tmp = wl1271_spi_read32(wl, SCR_PAD2);
 
         ret = wl1271_boot_write_irq_polarity(wl);
         if (ret < 0)
                 goto out;
 
         /* FIXME: Need to check whether this is really what we want */
-        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_MASK,
+        wl1271_spi_write32(wl, ACX_REG_INTERRUPT_MASK,
                            WL1271_ACX_ALL_EVENTS_VECTOR);
 
         /* WL1271: The reference driver skips steps 7 to 10 (jumps directly
@@ -530,6 +542,9 @@ int wl1271_boot(struct wl1271 *wl)
         if (ret < 0)
                 goto out;
 
+        /* Enable firmware interrupts now */
+        wl1271_boot_enable_interrupts(wl);
+
         /* set the wl1271 default filters */
         wl->rx_config = WL1271_DEFAULT_RX_CONFIG;
         wl->rx_filter = WL1271_DEFAULT_RX_FILTER;
diff --git a/drivers/net/wireless/wl12xx/wl1271_boot.h b/drivers/net/wireless/wl12xx/wl1271_boot.h
index b0d8fb46a439..412443ee655a 100644
--- a/drivers/net/wireless/wl12xx/wl1271_boot.h
+++ b/drivers/net/wireless/wl12xx/wl1271_boot.h
@@ -50,23 +50,17 @@ struct wl1271_static_data {
 #define WU_COUNTER_PAUSE_VAL 0x3FF
 #define WELP_ARM_COMMAND_VAL 0x4
 
-#define OCP_CMD_LOOP  32
-
-#define OCP_CMD_WRITE 0x1
-#define OCP_CMD_READ  0x2
-
-#define OCP_READY_MASK  BIT(18)
-#define OCP_STATUS_MASK (BIT(16) | BIT(17))
-
-#define OCP_STATUS_NO_RESP    0x00000
-#define OCP_STATUS_OK         0x10000
-#define OCP_STATUS_REQ_FAILED 0x20000
-#define OCP_STATUS_RESP_ERROR 0x30000
-
-#define OCP_REG_POLARITY 0x30032
+#define OCP_REG_POLARITY     0x0064
+#define OCP_REG_CLK_TYPE     0x0448
+#define OCP_REG_CLK_POLARITY 0x0cb2
 
 #define CMD_MBOX_ADDRESS 0x407B4
 
 #define POLARITY_LOW BIT(1)
 
+#define FREF_CLK_TYPE_BITS     0xfffffe7f
+#define CLK_REQ_PRCM           0x100
+#define FREF_CLK_POLARITY_BITS 0xfffff8ff
+#define CLK_REQ_OUTN_SEL       0x700
+
 #endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_cmd.c b/drivers/net/wireless/wl12xx/wl1271_cmd.c
index 2a4351ff54dc..0666328ce9ab 100644
--- a/drivers/net/wireless/wl12xx/wl1271_cmd.c
+++ b/drivers/net/wireless/wl12xx/wl1271_cmd.c
@@ -50,18 +50,18 @@ int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len)
         int ret = 0;
 
         cmd = buf;
-        cmd->id = id;
+        cmd->id = cpu_to_le16(id);
         cmd->status = 0;
 
         WARN_ON(len % 4 != 0);
 
-        wl1271_spi_mem_write(wl, wl->cmd_box_addr, buf, len);
+        wl1271_spi_write(wl, wl->cmd_box_addr, buf, len, false);
 
-        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_TRIG, INTR_TRIG_CMD);
+        wl1271_spi_write32(wl, ACX_REG_INTERRUPT_TRIG, INTR_TRIG_CMD);
 
         timeout = jiffies + msecs_to_jiffies(WL1271_COMMAND_TIMEOUT);
 
-        intr = wl1271_reg_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
+        intr = wl1271_spi_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
         while (!(intr & WL1271_ACX_INTR_CMD_COMPLETE)) {
                 if (time_after(jiffies, timeout)) {
                         wl1271_error("command complete timeout");
@@ -71,17 +71,17 @@ int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len)
 
                 msleep(1);
 
-                intr = wl1271_reg_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
+                intr = wl1271_spi_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
         }
 
-        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_ACK,
+        wl1271_spi_write32(wl, ACX_REG_INTERRUPT_ACK,
                            WL1271_ACX_INTR_CMD_COMPLETE);
 
 out:
         return ret;
 }
 
-int wl1271_cmd_cal_channel_tune(struct wl1271 *wl)
+static int wl1271_cmd_cal_channel_tune(struct wl1271 *wl)
 {
         struct wl1271_cmd_cal_channel_tune *cmd;
         int ret = 0;
@@ -104,7 +104,7 @@ int wl1271_cmd_cal_channel_tune(struct wl1271 *wl)
         return ret;
 }
 
-int wl1271_cmd_cal_update_ref_point(struct wl1271 *wl)
+static int wl1271_cmd_cal_update_ref_point(struct wl1271 *wl)
 {
         struct wl1271_cmd_cal_update_ref_point *cmd;
         int ret = 0;
@@ -129,7 +129,7 @@ int wl1271_cmd_cal_update_ref_point(struct wl1271 *wl)
         return ret;
 }
 
-int wl1271_cmd_cal_p2g(struct wl1271 *wl)
+static int wl1271_cmd_cal_p2g(struct wl1271 *wl)
 {
         struct wl1271_cmd_cal_p2g *cmd;
         int ret = 0;
@@ -150,7 +150,7 @@ int wl1271_cmd_cal_p2g(struct wl1271 *wl)
         return ret;
 }
 
-int wl1271_cmd_cal(struct wl1271 *wl)
+static int wl1271_cmd_cal(struct wl1271 *wl)
 {
         /*
          * FIXME: we must make sure that we're not sleeping when calibration
@@ -175,11 +175,9 @@ int wl1271_cmd_cal(struct wl1271 *wl)
         return ret;
 }
 
-int wl1271_cmd_join(struct wl1271 *wl, u8 bss_type, u8 dtim_interval,
-                    u16 beacon_interval, u8 wait)
+int wl1271_cmd_join(struct wl1271 *wl)
 {
         static bool do_cal = true;
-        unsigned long timeout;
         struct wl1271_cmd_join *join;
         int ret, i;
         u8 *bssid;
@@ -193,6 +191,18 @@ int wl1271_cmd_join(struct wl1271 *wl, u8 bss_type, u8 dtim_interval,
                         do_cal = false;
         }
 
+        /* FIXME: This is a workaround, because with the current stack, we
+         * cannot know when we have disassociated.  So, if we have already
+         * joined, we disconnect before joining again. */
+        if (wl->joined) {
+                ret = wl1271_cmd_disconnect(wl);
+                if (ret < 0) {
+                        wl1271_error("failed to disconnect before rejoining");
+                        goto out;
+                }
+
+                wl->joined = false;
+        }
 
         join = kzalloc(sizeof(*join), GFP_KERNEL);
         if (!join) {
@@ -207,15 +217,34 @@ int wl1271_cmd_join(struct wl1271 *wl, u8 bss_type, u8 dtim_interval,
         for (i = 0; i < ETH_ALEN; i++)
                 bssid[i] = wl->bssid[ETH_ALEN - i - 1];
 
-        join->rx_config_options = wl->rx_config;
-        join->rx_filter_options = wl->rx_filter;
+        join->rx_config_options = cpu_to_le32(wl->rx_config);
+        join->rx_filter_options = cpu_to_le32(wl->rx_filter);
+        join->bss_type = wl->bss_type;
 
-        join->basic_rate_set = RATE_MASK_1MBPS | RATE_MASK_2MBPS |
-                RATE_MASK_5_5MBPS | RATE_MASK_11MBPS;
+        /*
+         * FIXME: disable temporarily all filters because after commit
+         * 9cef8737 "mac80211: fix managed mode BSSID handling" broke
+         * association. The filter logic needs to be implemented properly
+         * and once that is done, this hack can be removed.
+         */
+        join->rx_config_options = cpu_to_le32(0);
+        join->rx_filter_options = cpu_to_le32(WL1271_DEFAULT_RX_FILTER);
+
+        if (wl->band == IEEE80211_BAND_2GHZ)
+                join->basic_rate_set = cpu_to_le32(CONF_HW_BIT_RATE_1MBPS   |
+                                                   CONF_HW_BIT_RATE_2MBPS   |
+                                                   CONF_HW_BIT_RATE_5_5MBPS |
+                                                   CONF_HW_BIT_RATE_11MBPS);
+        else {
+                join->bss_type |= WL1271_JOIN_CMD_BSS_TYPE_5GHZ;
+                join->basic_rate_set = cpu_to_le32(CONF_HW_BIT_RATE_6MBPS  |
+                                                   CONF_HW_BIT_RATE_12MBPS |
+                                                   CONF_HW_BIT_RATE_24MBPS);
+        }
+
+        join->beacon_interval = cpu_to_le16(WL1271_DEFAULT_BEACON_INT);
+        join->dtim_interval = WL1271_DEFAULT_DTIM_PERIOD;
 
-        join->beacon_interval = beacon_interval;
-        join->dtim_interval = dtim_interval;
-        join->bss_type = bss_type;
         join->channel = wl->channel;
         join->ssid_len = wl->ssid_len;
         memcpy(join->ssid, wl->ssid, wl->ssid_len);
@@ -228,6 +257,10 @@ int wl1271_cmd_join(struct wl1271 *wl, u8 bss_type, u8 dtim_interval,
 
         join->ctrl |= wl->session_counter << WL1271_JOIN_CMD_TX_SESSION_OFFSET;
 
+        /* reset TX security counters */
+        wl->tx_security_last_seq = 0;
+        wl->tx_security_seq_16 = 0;
+        wl->tx_security_seq_32 = 0;
 
         ret = wl1271_cmd_send(wl, CMD_START_JOIN, join, sizeof(*join));
         if (ret < 0) {
@@ -235,14 +268,13 @@ int wl1271_cmd_join(struct wl1271 *wl, u8 bss_type, u8 dtim_interval,
                 goto out_free;
         }
 
-        timeout = msecs_to_jiffies(JOIN_TIMEOUT);
+        wl->joined = true;
 
         /*
          * ugly hack: we should wait for JOIN_EVENT_COMPLETE_ID but to
          * simplify locking we just sleep instead, for now
          */
-        if (wait)
-                msleep(10);
+        msleep(10);
 
 out_free:
         kfree(join);
@@ -274,19 +306,20 @@ int wl1271_cmd_test(struct wl1271 *wl, void *buf, size_t buf_len, u8 answer)
 
         if (answer) {
                 struct wl1271_command *cmd_answer;
+                u16 status;
 
                 /*
                  * The test command got in, we can read the answer.
                  * The answer would be a wl1271_command, where the
                  * parameter array contains the actual answer.
                  */
-                wl1271_spi_mem_read(wl, wl->cmd_box_addr, buf, buf_len);
+                wl1271_spi_read(wl, wl->cmd_box_addr, buf, buf_len, false);
 
                 cmd_answer = buf;
+                status = le16_to_cpu(cmd_answer->header.status);
 
-                if (cmd_answer->header.status != CMD_STATUS_SUCCESS)
-                        wl1271_error("TEST command answer error: %d",
-                                     cmd_answer->header.status);
+                if (status != CMD_STATUS_SUCCESS)
+                        wl1271_error("TEST command answer error: %d", status);
         }
 
         return 0;
@@ -307,10 +340,10 @@ int wl1271_cmd_interrogate(struct wl1271 *wl, u16 id, void *buf, size_t len)
 
         wl1271_debug(DEBUG_CMD, "cmd interrogate");
 
-        acx->id = id;
+        acx->id = cpu_to_le16(id);
 
         /* payload length, does not include any headers */
-        acx->len = len - sizeof(*acx);
+        acx->len = cpu_to_le16(len - sizeof(*acx));
 
         ret = wl1271_cmd_send(wl, CMD_INTERROGATE, acx, sizeof(*acx));
         if (ret < 0) {
@@ -319,12 +352,12 @@ int wl1271_cmd_interrogate(struct wl1271 *wl, u16 id, void *buf, size_t len)
         }
 
         /* the interrogate command got in, we can read the answer */
-        wl1271_spi_mem_read(wl, wl->cmd_box_addr, buf, len);
+        wl1271_spi_read(wl, wl->cmd_box_addr, buf, len, false);
 
         acx = buf;
-        if (acx->cmd.status != CMD_STATUS_SUCCESS)
+        if (le16_to_cpu(acx->cmd.status) != CMD_STATUS_SUCCESS)
                 wl1271_error("INTERROGATE command error: %d",
-                             acx->cmd.status);
+                             le16_to_cpu(acx->cmd.status));
 
 out:
         return ret;
@@ -345,10 +378,10 @@ int wl1271_cmd_configure(struct wl1271 *wl, u16 id, void *buf, size_t len)
 
         wl1271_debug(DEBUG_CMD, "cmd configure");
 
-        acx->id = id;
+        acx->id = cpu_to_le16(id);
 
         /* payload length, does not include any headers */
-        acx->len = len - sizeof(*acx);
+        acx->len = cpu_to_le16(len - sizeof(*acx));
 
         ret = wl1271_cmd_send(wl, CMD_CONFIGURE, acx, len);
         if (ret < 0) {
@@ -414,8 +447,7 @@ int wl1271_cmd_ps_mode(struct wl1271 *wl, u8 ps_mode)
         int ret = 0;
 
         /* FIXME: this should be in ps.c */
-        ret = wl1271_acx_wake_up_conditions(wl, WAKE_UP_EVENT_DTIM_BITMAP,
-                                            wl->listen_int);
+        ret = wl1271_acx_wake_up_conditions(wl);
         if (ret < 0) {
                 wl1271_error("couldn't set wake up conditions");
                 goto out;
@@ -433,7 +465,7 @@ int wl1271_cmd_ps_mode(struct wl1271 *wl, u8 ps_mode)
         ps_params->send_null_data = 1;
         ps_params->retries = 5;
         ps_params->hang_over_period = 128;
-        ps_params->null_data_rate = 1; /* 1 Mbps */
+        ps_params->null_data_rate = cpu_to_le32(1); /* 1 Mbps */
 
         ret = wl1271_cmd_send(wl, CMD_SET_PS_MODE, ps_params,
                               sizeof(*ps_params));
@@ -464,8 +496,8 @@ int wl1271_cmd_read_memory(struct wl1271 *wl, u32 addr, void *answer,
         WARN_ON(len > MAX_READ_SIZE);
         len = min_t(size_t, len, MAX_READ_SIZE);
 
-        cmd->addr = addr;
-        cmd->size = len;
+        cmd->addr = cpu_to_le32(addr);
+        cmd->size = cpu_to_le32(len);
 
         ret = wl1271_cmd_send(wl, CMD_READ_MEMORY, cmd, sizeof(*cmd));
         if (ret < 0) {
@@ -474,11 +506,11 @@ int wl1271_cmd_read_memory(struct wl1271 *wl, u32 addr, void *answer,
         }
 
         /* the read command got in, we can now read the answer */
-        wl1271_spi_mem_read(wl, wl->cmd_box_addr, cmd, sizeof(*cmd));
+        wl1271_spi_read(wl, wl->cmd_box_addr, cmd, sizeof(*cmd), false);
 
-        if (cmd->header.status != CMD_STATUS_SUCCESS)
+        if (le16_to_cpu(cmd->header.status) != CMD_STATUS_SUCCESS)
                 wl1271_error("error in read command result: %d",
-                             cmd->header.status);
+                             le16_to_cpu(cmd->header.status));
 
         memcpy(answer, cmd->value, len);
 
@@ -488,14 +520,31 @@ out:
 }
 
 int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
-                    u8 active_scan, u8 high_prio, u8 num_channels,
+                    u8 active_scan, u8 high_prio, u8 band,
                     u8 probe_requests)
 {
 
         struct wl1271_cmd_trigger_scan_to *trigger = NULL;
         struct wl1271_cmd_scan *params = NULL;
-        int i, ret;
+        struct ieee80211_channel *channels;
+        int i, j, n_ch, ret;
         u16 scan_options = 0;
+        u8 ieee_band;
+
+        if (band == WL1271_SCAN_BAND_2_4_GHZ)
+                ieee_band = IEEE80211_BAND_2GHZ;
+        else if (band == WL1271_SCAN_BAND_DUAL && wl1271_11a_enabled())
+                ieee_band = IEEE80211_BAND_2GHZ;
+        else if (band == WL1271_SCAN_BAND_5_GHZ && wl1271_11a_enabled())
+                ieee_band = IEEE80211_BAND_5GHZ;
+        else
+                return -EINVAL;
+
+        if (wl->hw->wiphy->bands[ieee_band]->channels == NULL)
+                return -EINVAL;
+
+        channels = wl->hw->wiphy->bands[ieee_band]->channels;
+        n_ch = wl->hw->wiphy->bands[ieee_band]->n_channels;
 
         if (wl->scanning)
                 return -EINVAL;
@@ -512,32 +561,43 @@ int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
                 scan_options |= WL1271_SCAN_OPT_PASSIVE;
         if (high_prio)
                 scan_options |= WL1271_SCAN_OPT_PRIORITY_HIGH;
-        params->params.scan_options = scan_options;
+        params->params.scan_options = cpu_to_le16(scan_options);
 
-        params->params.num_channels = num_channels;
         params->params.num_probe_requests = probe_requests;
-        params->params.tx_rate = cpu_to_le32(RATE_MASK_2MBPS);
+        /* Let the fw autodetect suitable tx_rate for probes */
+        params->params.tx_rate = 0;
         params->params.tid_trigger = 0;
         params->params.scan_tag = WL1271_SCAN_DEFAULT_TAG;
 
-        for (i = 0; i < num_channels; i++) {
-                params->channels[i].min_duration =
-                        cpu_to_le32(WL1271_SCAN_CHAN_MIN_DURATION);
-                params->channels[i].max_duration =
-                        cpu_to_le32(WL1271_SCAN_CHAN_MAX_DURATION);
-                memset(&params->channels[i].bssid_lsb, 0xff, 4);
-                memset(&params->channels[i].bssid_msb, 0xff, 2);
-                params->channels[i].early_termination = 0;
-                params->channels[i].tx_power_att = WL1271_SCAN_CURRENT_TX_PWR;
-                params->channels[i].channel = i + 1;
+        if (band == WL1271_SCAN_BAND_DUAL)
+                params->params.band = WL1271_SCAN_BAND_2_4_GHZ;
+        else
+                params->params.band = band;
+
+        for (i = 0, j = 0; i < n_ch && i < WL1271_SCAN_MAX_CHANNELS; i++) {
+                if (!(channels[i].flags & IEEE80211_CHAN_DISABLED)) {
+                        params->channels[j].min_duration =
+                                cpu_to_le32(WL1271_SCAN_CHAN_MIN_DURATION);
+                        params->channels[j].max_duration =
+                                cpu_to_le32(WL1271_SCAN_CHAN_MAX_DURATION);
+                        memset(&params->channels[j].bssid_lsb, 0xff, 4);
+                        memset(&params->channels[j].bssid_msb, 0xff, 2);
+                        params->channels[j].early_termination = 0;
+                        params->channels[j].tx_power_att =
+                                WL1271_SCAN_CURRENT_TX_PWR;
+                        params->channels[j].channel = channels[i].hw_value;
+                        j++;
+                }
         }
 
+        params->params.num_channels = j;
+
         if (len && ssid) {
                 params->params.ssid_len = len;
                 memcpy(params->params.ssid, ssid, len);
         }
 
-        ret = wl1271_cmd_build_probe_req(wl, ssid, len);
+        ret = wl1271_cmd_build_probe_req(wl, ssid, len, ieee_band);
         if (ret < 0) {
                 wl1271_error("PROBE request template failed");
                 goto out;
@@ -562,6 +622,19 @@ int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
         wl1271_dump(DEBUG_SCAN, "SCAN: ", params, sizeof(*params));
 
         wl->scanning = true;
+        if (wl1271_11a_enabled()) {
+                wl->scan.state = band;
+                if (band == WL1271_SCAN_BAND_DUAL) {
+                        wl->scan.active = active_scan;
+                        wl->scan.high_prio = high_prio;
+                        wl->scan.probe_requests = probe_requests;
+                        if (len && ssid) {
+                                wl->scan.ssid_len = len;
+                                memcpy(wl->scan.ssid, ssid, len);
+                        } else
+                                wl->scan.ssid_len = 0;
+                }
+        }
 
         ret = wl1271_cmd_send(wl, CMD_SCAN, params, sizeof(*params));
         if (ret < 0) {
@@ -569,11 +642,12 @@ int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
                 goto out;
         }
 
-        wl1271_spi_mem_read(wl, wl->cmd_box_addr, params, sizeof(*params));
+        wl1271_spi_read(wl, wl->cmd_box_addr, params, sizeof(*params),
+                        false);
 
-        if (params->header.status != CMD_STATUS_SUCCESS) {
+        if (le16_to_cpu(params->header.status) != CMD_STATUS_SUCCESS) {
                 wl1271_error("Scan command error: %d",
-                             params->header.status);
+                             le16_to_cpu(params->header.status));
                 wl->scanning = false;
                 ret = -EIO;
                 goto out;
@@ -603,9 +677,9 @@ int wl1271_cmd_template_set(struct wl1271 *wl, u16 template_id,
 
         cmd->len = cpu_to_le16(buf_len);
         cmd->template_type = template_id;
-        cmd->enabled_rates = ACX_RATE_MASK_UNSPECIFIED;
-        cmd->short_retry_limit = ACX_RATE_RETRY_LIMIT;
-        cmd->long_retry_limit = ACX_RATE_RETRY_LIMIT;
+        cmd->enabled_rates = cpu_to_le32(wl->conf.tx.rc_conf.enabled_rates);
+        cmd->short_retry_limit = wl->conf.tx.rc_conf.short_retry_limit;
+        cmd->long_retry_limit = wl->conf.tx.rc_conf.long_retry_limit;
 
         if (buf)
                 memcpy(cmd->template_data, buf, buf_len);
@@ -623,30 +697,62 @@ out:
         return ret;
 }
 
-static int wl1271_build_basic_rates(char *rates)
+static int wl1271_build_basic_rates(char *rates, u8 band)
 {
         u8 index = 0;
 
-        rates[index++] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_1MB;
-        rates[index++] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_2MB;
-        rates[index++] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_5MB;
-        rates[index++] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_11MB;
+        if (band == IEEE80211_BAND_2GHZ) {
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_1MB;
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_2MB;
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_5MB;
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_11MB;
+        } else if (band == IEEE80211_BAND_5GHZ) {
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_6MB;
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_12MB;
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_24MB;
+        } else {
+                wl1271_error("build_basic_rates invalid band: %d", band);
+        }
 
         return index;
 }
 
-static int wl1271_build_extended_rates(char *rates)
+static int wl1271_build_extended_rates(char *rates, u8 band)
 {
         u8 index = 0;
 
-        rates[index++] = IEEE80211_OFDM_RATE_6MB;
-        rates[index++] = IEEE80211_OFDM_RATE_9MB;
-        rates[index++] = IEEE80211_OFDM_RATE_12MB;
-        rates[index++] = IEEE80211_OFDM_RATE_18MB;
-        rates[index++] = IEEE80211_OFDM_RATE_24MB;
-        rates[index++] = IEEE80211_OFDM_RATE_36MB;
-        rates[index++] = IEEE80211_OFDM_RATE_48MB;
-        rates[index++] = IEEE80211_OFDM_RATE_54MB;
+        if (band == IEEE80211_BAND_2GHZ) {
+                rates[index++] = IEEE80211_OFDM_RATE_6MB;
+                rates[index++] = IEEE80211_OFDM_RATE_9MB;
+                rates[index++] = IEEE80211_OFDM_RATE_12MB;
+                rates[index++] = IEEE80211_OFDM_RATE_18MB;
+                rates[index++] = IEEE80211_OFDM_RATE_24MB;
+                rates[index++] = IEEE80211_OFDM_RATE_36MB;
+                rates[index++] = IEEE80211_OFDM_RATE_48MB;
+                rates[index++] = IEEE80211_OFDM_RATE_54MB;
+        } else if (band == IEEE80211_BAND_5GHZ) {
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_9MB;
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_18MB;
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_24MB;
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_36MB;
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_48MB;
+                rates[index++] =
+                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_54MB;
+        } else {
+                wl1271_error("build_basic_rates invalid band: %d", band);
+        }
 
         return index;
 }
@@ -665,7 +771,8 @@ int wl1271_cmd_build_null_data(struct wl1271 *wl)
 
         memcpy(template.header.sa, wl->mac_addr, ETH_ALEN);
         template.header.frame_ctl = cpu_to_le16(IEEE80211_FTYPE_DATA |
-                                                IEEE80211_STYPE_NULLFUNC);
+                                                IEEE80211_STYPE_NULLFUNC |
+                                                IEEE80211_FCTL_TODS);
 
         return wl1271_cmd_template_set(wl, CMD_TEMPL_NULL_DATA, &template,
                                        sizeof(template));
@@ -678,7 +785,10 @@ int wl1271_cmd_build_ps_poll(struct wl1271 *wl, u16 aid)
 
         memcpy(template.bssid, wl->bssid, ETH_ALEN);
         memcpy(template.ta, wl->mac_addr, ETH_ALEN);
-        template.aid = aid;
+
+        /* aid in PS-Poll has its two MSBs each set to 1 */
+        template.aid = cpu_to_le16(1 << 15 | 1 << 14 | aid);
+
         template.fc = cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_PSPOLL);
 
         return wl1271_cmd_template_set(wl, CMD_TEMPL_PS_POLL, &template,
@@ -686,12 +796,14 @@ int wl1271_cmd_build_ps_poll(struct wl1271 *wl, u16 aid)
 
 }
 
-int wl1271_cmd_build_probe_req(struct wl1271 *wl, u8 *ssid, size_t ssid_len)
+int wl1271_cmd_build_probe_req(struct wl1271 *wl, u8 *ssid, size_t ssid_len,
+                               u8 band)
 {
         struct wl12xx_probe_req_template template;
         struct wl12xx_ie_rates *rates;
         char *ptr;
         u16 size;
+        int ret;
 
         ptr = (char *)&template;
         size = sizeof(struct ieee80211_header);
@@ -713,20 +825,25 @@ int wl1271_cmd_build_probe_req(struct wl1271 *wl, u8 *ssid, size_t ssid_len)
         /* Basic Rates */
         rates = (struct wl12xx_ie_rates *)ptr;
         rates->header.id = WLAN_EID_SUPP_RATES;
-        rates->header.len = wl1271_build_basic_rates(rates->rates);
+        rates->header.len = wl1271_build_basic_rates(rates->rates, band);
         size += sizeof(struct wl12xx_ie_header) + rates->header.len;
         ptr += sizeof(struct wl12xx_ie_header) + rates->header.len;
 
         /* Extended rates */
         rates = (struct wl12xx_ie_rates *)ptr;
         rates->header.id = WLAN_EID_EXT_SUPP_RATES;
-        rates->header.len = wl1271_build_extended_rates(rates->rates);
+        rates->header.len = wl1271_build_extended_rates(rates->rates, band);
         size += sizeof(struct wl12xx_ie_header) + rates->header.len;
 
         wl1271_dump(DEBUG_SCAN, "PROBE REQ: ", &template, size);
 
-        return wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_2_4,
-                                       &template, size);
+        if (band == IEEE80211_BAND_2GHZ)
+                ret = wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_2_4,
+                                              &template, size);
+        else
+                ret = wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_5,
+                                              &template, size);
+        return ret;
 }
 
 int wl1271_cmd_set_default_wep_key(struct wl1271 *wl, u8 id)
@@ -743,7 +860,7 @@ int wl1271_cmd_set_default_wep_key(struct wl1271 *wl, u8 id)
         }
 
         cmd->id = id;
-        cmd->key_action = KEY_SET_ID;
+        cmd->key_action = cpu_to_le16(KEY_SET_ID);
         cmd->key_type = KEY_WEP;
 
         ret = wl1271_cmd_send(wl, CMD_SET_KEYS, cmd, sizeof(*cmd));
@@ -759,7 +876,8 @@ out:
 }
 
 int wl1271_cmd_set_key(struct wl1271 *wl, u16 action, u8 id, u8 key_type,
-                       u8 key_size, const u8 *key, const u8 *addr)
+                       u8 key_size, const u8 *key, const u8 *addr,
+                       u32 tx_seq_32, u16 tx_seq_16)
 {
         struct wl1271_cmd_set_keys *cmd;
         int ret = 0;
@@ -773,16 +891,18 @@ int wl1271_cmd_set_key(struct wl1271 *wl, u16 action, u8 id, u8 key_type,
         if (key_type != KEY_WEP)
                 memcpy(cmd->addr, addr, ETH_ALEN);
 
-        cmd->key_action = action;
+        cmd->key_action = cpu_to_le16(action);
         cmd->key_size = key_size;
         cmd->key_type = key_type;
 
+        cmd->ac_seq_num16[0] = cpu_to_le16(tx_seq_16);
+        cmd->ac_seq_num32[0] = cpu_to_le32(tx_seq_32);
+
         /* we have only one SSID profile */
         cmd->ssid_profile = 0;
 
         cmd->id = id;
 
-        /* FIXME: this is from wl1251, needs to be checked */
         if (key_type == KEY_TKIP) {
                 /*
                  * We get the key in the following form:
@@ -811,3 +931,34 @@ out:
 
         return ret;
 }
+
+int wl1271_cmd_disconnect(struct wl1271 *wl)
+{
+        struct wl1271_cmd_disconnect *cmd;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_CMD, "cmd disconnect");
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        cmd->rx_config_options = cpu_to_le32(wl->rx_config);
+        cmd->rx_filter_options = cpu_to_le32(wl->rx_filter);
+        /* disconnect reason is not used in immediate disconnections */
+        cmd->type = DISCONNECT_IMMEDIATE;
+
+        ret = wl1271_cmd_send(wl, CMD_DISCONNECT, cmd, sizeof(*cmd));
+        if (ret < 0) {
+                wl1271_error("failed to send disconnect command");
+                goto out_free;
+        }
+
+out_free:
+        kfree(cmd);
+
+out:
+        return ret;
+}
diff --git a/drivers/net/wireless/wl12xx/wl1271_cmd.h b/drivers/net/wireless/wl12xx/wl1271_cmd.h
index 951a8447a516..174b8209dbf3 100644
--- a/drivers/net/wireless/wl12xx/wl1271_cmd.h
+++ b/drivers/net/wireless/wl12xx/wl1271_cmd.h
@@ -30,8 +30,7 @@
 struct acx_header;
 
 int wl1271_cmd_send(struct wl1271 *wl, u16 type, void *buf, size_t buf_len);
-int wl1271_cmd_join(struct wl1271 *wl, u8 bss_type, u8 dtim_interval,
-                    u16 beacon_interval, u8 wait);
+int wl1271_cmd_join(struct wl1271 *wl);
 int wl1271_cmd_test(struct wl1271 *wl, void *buf, size_t buf_len, u8 answer);
 int wl1271_cmd_interrogate(struct wl1271 *wl, u16 id, void *buf, size_t len);
 int wl1271_cmd_configure(struct wl1271 *wl, u16 id, void *buf, size_t len);
@@ -40,16 +39,19 @@ int wl1271_cmd_ps_mode(struct wl1271 *wl, u8 ps_mode);
 int wl1271_cmd_read_memory(struct wl1271 *wl, u32 addr, void *answer,
                            size_t len);
 int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
-                    u8 active_scan, u8 high_prio, u8 num_channels,
+                    u8 active_scan, u8 high_prio, u8 band,
                     u8 probe_requests);
 int wl1271_cmd_template_set(struct wl1271 *wl, u16 template_id,
                             void *buf, size_t buf_len);
 int wl1271_cmd_build_null_data(struct wl1271 *wl);
 int wl1271_cmd_build_ps_poll(struct wl1271 *wl, u16 aid);
-int wl1271_cmd_build_probe_req(struct wl1271 *wl, u8 *ssid, size_t ssid_len);
+int wl1271_cmd_build_probe_req(struct wl1271 *wl, u8 *ssid, size_t ssid_len,
+                               u8 band);
 int wl1271_cmd_set_default_wep_key(struct wl1271 *wl, u8 id);
 int wl1271_cmd_set_key(struct wl1271 *wl, u16 action, u8 id, u8 key_type,
-                       u8 key_size, const u8 *key, const u8 *addr);
+                       u8 key_size, const u8 *key, const u8 *addr,
+                       u32 tx_seq_32, u16 tx_seq_16);
+int wl1271_cmd_disconnect(struct wl1271 *wl);
 
 enum wl1271_commands {
         CMD_INTERROGATE     = 1,    /*use this to read information elements*/
@@ -118,8 +120,8 @@ enum cmd_templ {
 #define WL1271_CMD_TEMPL_MAX_SIZE  252
 
 struct wl1271_cmd_header {
-        u16 id;
-        u16 status;
+        __le16 id;
+        __le16 status;
         /* payload */
         u8 data[0];
 } __attribute__ ((packed));
@@ -172,17 +174,17 @@ struct cmd_read_write_memory {
         struct wl1271_cmd_header header;
 
         /* The address of the memory to read from or write to.*/
-        u32 addr;
+        __le32 addr;
 
         /* The amount of data in bytes to read from or write to the WiLink
          * device.*/
-        u32 size;
+        __le32 size;
 
         /* The actual value read from or written to the Wilink. The source
            of this field is the Host in WRITE command or the Wilink in READ
            command. */
         u8 value[MAX_READ_SIZE];
-};
+} __attribute__ ((packed));
 
 #define CMDMBOX_HEADER_LEN 4
 #define CMDMBOX_INFO_ELEM_HEADER_LEN 4
@@ -196,22 +198,23 @@ enum {
 
 #define WL1271_JOIN_CMD_CTRL_TX_FLUSH     0x80 /* Firmware flushes all Tx */
 #define WL1271_JOIN_CMD_TX_SESSION_OFFSET 1
+#define WL1271_JOIN_CMD_BSS_TYPE_5GHZ 0x10
 
 struct wl1271_cmd_join {
         struct wl1271_cmd_header header;
 
-        u32 bssid_lsb;
-        u16 bssid_msb;
-        u16 beacon_interval; /* in TBTTs */
-        u32 rx_config_options;
-        u32 rx_filter_options;
+        __le32 bssid_lsb;
+        __le16 bssid_msb;
+        __le16 beacon_interval; /* in TBTTs */
+        __le32 rx_config_options;
+        __le32 rx_filter_options;
 
         /*
          * The target uses this field to determine the rate at
          * which to transmit control frame responses (such as
          * ACK or CTS frames).
          */
-        u32 basic_rate_set;
+        __le32 basic_rate_set;
         u8 dtim_interval;
         /*
          * bits 0-2: This bitwise field specifies the type
@@ -240,10 +243,10 @@ struct cmd_enabledisable_path {
 struct wl1271_cmd_template_set {
         struct wl1271_cmd_header header;
 
-        u16 len;
+        __le16 len;
         u8 template_type;
         u8 index;  /* relevant only for KLV_TEMPLATE type */
-        u32 enabled_rates;
+        __le32 enabled_rates;
         u8 short_retry_limit;
         u8 long_retry_limit;
         u8 aflags;
@@ -280,18 +283,13 @@ struct wl1271_cmd_ps_params {
           * to power save mode.
           */
         u8 hang_over_period;
-        u32 null_data_rate;
+        __le32 null_data_rate;
 } __attribute__ ((packed));
 
 /* HW encryption keys */
 #define NUM_ACCESS_CATEGORIES_COPY 4
 #define MAX_KEY_SIZE 32
 
-/* When set, disable HW encryption */
-#define DF_ENCRYPTION_DISABLE      0x01
-/* When set, disable HW decryption */
-#define DF_SNIFF_MODE_ENABLE       0x80
-
 enum wl1271_cmd_key_action {
         KEY_ADD_OR_REPLACE = 1,
         KEY_REMOVE         = 2,
@@ -316,9 +314,9 @@ struct wl1271_cmd_set_keys {
         u8 addr[ETH_ALEN];
 
         /* key_action_e */
-        u16 key_action;
+        __le16 key_action;
 
-        u16 reserved_1;
+        __le16 reserved_1;
 
         /* key size in bytes */
         u8 key_size;
@@ -334,8 +332,8 @@ struct wl1271_cmd_set_keys {
         u8 id;
         u8 reserved_2[6];
         u8 key[MAX_KEY_SIZE];
-        u16 ac_seq_num16[NUM_ACCESS_CATEGORIES_COPY];
-        u32 ac_seq_num32[NUM_ACCESS_CATEGORIES_COPY];
+        __le16 ac_seq_num16[NUM_ACCESS_CATEGORIES_COPY];
+        __le32 ac_seq_num32[NUM_ACCESS_CATEGORIES_COPY];
 } __attribute__ ((packed));
 
 
@@ -347,19 +345,22 @@ struct wl1271_cmd_set_keys {
 #define WL1271_SCAN_OPT_PRIORITY_HIGH  4
 #define WL1271_SCAN_CHAN_MIN_DURATION  30000  /* TU */
 #define WL1271_SCAN_CHAN_MAX_DURATION  60000  /* TU */
+#define WL1271_SCAN_BAND_2_4_GHZ 0
+#define WL1271_SCAN_BAND_5_GHZ 1
+#define WL1271_SCAN_BAND_DUAL 2
 
 struct basic_scan_params {
-        u32 rx_config_options;
-        u32 rx_filter_options;
+        __le32 rx_config_options;
+        __le32 rx_filter_options;
         /* Scan option flags (WL1271_SCAN_OPT_*) */
-        u16 scan_options;
+        __le16 scan_options;
         /* Number of scan channels in the list (maximum 30) */
         u8 num_channels;
         /* This field indicates the number of probe requests to send
            per channel for an active scan */
         u8 num_probe_requests;
         /* Rate bit field for sending the probes */
-        u32 tx_rate;
+        __le32 tx_rate;
         u8 tid_trigger;
         u8 ssid_len;
         /* in order to align */
@@ -374,10 +375,10 @@ struct basic_scan_params {
 
 struct basic_scan_channel_params {
         /* Duration in TU to wait for frames on a channel for active scan */
-        u32 min_duration;
-        u32 max_duration;
-        u32 bssid_lsb;
-        u16 bssid_msb;
+        __le32 min_duration;
+        __le32 max_duration;
+        __le32 bssid_lsb;
+        __le16 bssid_msb;
         u8 early_termination;
         u8 tx_power_att;
         u8 channel;
@@ -397,13 +398,13 @@ struct wl1271_cmd_scan {
 struct wl1271_cmd_trigger_scan_to {
         struct wl1271_cmd_header header;
 
-        u32 timeout;
-};
+        __le32 timeout;
+} __attribute__ ((packed));
 
 struct wl1271_cmd_test_header {
         u8 id;
         u8 padding[3];
-};
+} __attribute__ ((packed));
 
 enum wl1271_channel_tune_bands {
         WL1271_CHANNEL_TUNE_BAND_2_4,
@@ -425,7 +426,7 @@ struct wl1271_cmd_cal_channel_tune {
         u8 band;
         u8 channel;
 
-        u16 radio_status;
+        __le16 radio_status;
 } __attribute__ ((packed));
 
 struct wl1271_cmd_cal_update_ref_point {
@@ -433,8 +434,8 @@ struct wl1271_cmd_cal_update_ref_point {
 
         struct wl1271_cmd_test_header test;
 
-        s32 ref_power;
-        s32 ref_detector;
+        __le32 ref_power;
+        __le32 ref_detector;
         u8  sub_band;
         u8  padding[3];
 } __attribute__ ((packed));
@@ -449,16 +450,42 @@ struct wl1271_cmd_cal_p2g {
 
         struct wl1271_cmd_test_header test;
 
-        u16 len;
+        __le16 len;
         u8  buf[MAX_TLV_LENGTH];
         u8  type;
         u8  padding;
 
-        s16 radio_status;
+        __le16 radio_status;
         u8  nvs_version[MAX_NVS_VERSION_LENGTH];
 
         u8  sub_band_mask;
         u8  padding2;
 } __attribute__ ((packed));
 
+
+/*
+ * There are three types of disconnections:
+ *
+ * DISCONNECT_IMMEDIATE: the fw doesn't send any frames
+ * DISCONNECT_DEAUTH:    the fw generates a DEAUTH request with the reason
+ *                       we have passed
+ * DISCONNECT_DISASSOC:  the fw generates a DESASSOC request with the reason
+ *                       we have passed
+ */
+enum wl1271_disconnect_type {
+        DISCONNECT_IMMEDIATE,
+        DISCONNECT_DEAUTH,
+        DISCONNECT_DISASSOC
+};
+
+struct wl1271_cmd_disconnect {
+        __le32 rx_config_options;
+        __le32 rx_filter_options;
+
+        __le16 reason;
+        u8  type;
+
+        u8  padding;
+} __attribute__ ((packed));
+
 #endif /* __WL1271_CMD_H__ */
diff --git a/drivers/net/wireless/wl12xx/wl1271_conf.h b/drivers/net/wireless/wl12xx/wl1271_conf.h
new file mode 100644
index 000000000000..061d47520a32
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_conf.h
@@ -0,0 +1,911 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL1271_CONF_H__
+#define __WL1271_CONF_H__
+
+enum {
+        CONF_HW_BIT_RATE_1MBPS   = BIT(0),
+        CONF_HW_BIT_RATE_2MBPS   = BIT(1),
+        CONF_HW_BIT_RATE_5_5MBPS = BIT(2),
+        CONF_HW_BIT_RATE_6MBPS   = BIT(3),
+        CONF_HW_BIT_RATE_9MBPS   = BIT(4),
+        CONF_HW_BIT_RATE_11MBPS  = BIT(5),
+        CONF_HW_BIT_RATE_12MBPS  = BIT(6),
+        CONF_HW_BIT_RATE_18MBPS  = BIT(7),
+        CONF_HW_BIT_RATE_22MBPS  = BIT(8),
+        CONF_HW_BIT_RATE_24MBPS  = BIT(9),
+        CONF_HW_BIT_RATE_36MBPS  = BIT(10),
+        CONF_HW_BIT_RATE_48MBPS  = BIT(11),
+        CONF_HW_BIT_RATE_54MBPS  = BIT(12),
+        CONF_HW_BIT_RATE_MCS_0   = BIT(13),
+        CONF_HW_BIT_RATE_MCS_1   = BIT(14),
+        CONF_HW_BIT_RATE_MCS_2   = BIT(15),
+        CONF_HW_BIT_RATE_MCS_3   = BIT(16),
+        CONF_HW_BIT_RATE_MCS_4   = BIT(17),
+        CONF_HW_BIT_RATE_MCS_5   = BIT(18),
+        CONF_HW_BIT_RATE_MCS_6   = BIT(19),
+        CONF_HW_BIT_RATE_MCS_7   = BIT(20)
+};
+
+enum {
+        CONF_HW_RATE_INDEX_1MBPS   = 0,
+        CONF_HW_RATE_INDEX_2MBPS   = 1,
+        CONF_HW_RATE_INDEX_5_5MBPS = 2,
+        CONF_HW_RATE_INDEX_6MBPS   = 3,
+        CONF_HW_RATE_INDEX_9MBPS   = 4,
+        CONF_HW_RATE_INDEX_11MBPS  = 5,
+        CONF_HW_RATE_INDEX_12MBPS  = 6,
+        CONF_HW_RATE_INDEX_18MBPS  = 7,
+        CONF_HW_RATE_INDEX_22MBPS  = 8,
+        CONF_HW_RATE_INDEX_24MBPS  = 9,
+        CONF_HW_RATE_INDEX_36MBPS  = 10,
+        CONF_HW_RATE_INDEX_48MBPS  = 11,
+        CONF_HW_RATE_INDEX_54MBPS  = 12,
+        CONF_HW_RATE_INDEX_MAX     = CONF_HW_RATE_INDEX_54MBPS,
+};
+
+struct conf_sg_settings {
+        /*
+         * Defines the PER threshold in PPM of the BT voice of which reaching
+         * this value will trigger raising the priority of the BT voice by
+         * the BT IP until next NFS sample interval time as defined in
+         * nfs_sample_interval.
+         *
+         * Unit: PER value in PPM (parts per million)
+         * #Error_packets / #Total_packets
+
+         * Range: u32
+         */
+        u32 per_threshold;
+
+        /*
+         * This value is an absolute time in micro-seconds to limit the
+         * maximum scan duration compensation while in SG
+         */
+        u32 max_scan_compensation_time;
+
+        /* Defines the PER threshold of the BT voice of which reaching this
+         * value will trigger raising the priority of the BT voice until next
+         * NFS sample interval time as defined in sample_interval.
+         *
+         * Unit: msec
+         * Range: 1-65000
+         */
+        u16 nfs_sample_interval;
+
+        /*
+         * Defines the load ratio for the BT.
+         * The WLAN ratio is: 100 - load_ratio
+         *
+         * Unit: Percent
+         * Range: 0-100
+         */
+        u8 load_ratio;
+
+        /*
+         * true - Co-ex is allowed to enter/exit P.S automatically and
+         *        transparently to the host
+         *
+         * false - Co-ex is disallowed to enter/exit P.S and will trigger an
+         *         event to the host to notify for the need to enter/exit P.S
+         *         due to BT change state
+         *
+         */
+        u8 auto_ps_mode;
+
+        /*
+         * This parameter defines the compensation percentage of num of probe
+         * requests in case scan is initiated during BT voice/BT ACL
+         * guaranteed link.
+         *
+         * Unit: Percent
+         * Range: 0-255 (0 - No compensation)
+         */
+        u8 probe_req_compensation;
+
+        /*
+         * This parameter defines the compensation percentage of scan window
+         * size in case scan is initiated during BT voice/BT ACL Guaranteed
+         * link.
+         *
+         * Unit: Percent
+         * Range: 0-255 (0 - No compensation)
+         */
+        u8 scan_window_compensation;
+
+        /*
+         * Defines the antenna configuration.
+         *
+         * Range: 0 - Single Antenna; 1 - Dual Antenna
+         */
+        u8 antenna_config;
+
+        /*
+         * The percent out of the Max consecutive beacon miss roaming trigger
+         * which is the threshold for raising the priority of beacon
+         * reception.
+         *
+         * Range: 1-100
+         * N = MaxConsecutiveBeaconMiss
+         * P = coexMaxConsecutiveBeaconMissPrecent
+         * Threshold = MIN( N-1, round(N * P / 100))
+         */
+        u8 beacon_miss_threshold;
+
+        /*
+         * The RX rate threshold below which rate adaptation is assumed to be
+         * occurring at the AP which will raise priority for ACTIVE_RX and RX
+         * SP.
+         *
+         * Range: HW_BIT_RATE_*
+         */
+        u32 rate_adaptation_threshold;
+
+        /*
+         * The SNR above which the RX rate threshold indicating AP rate
+         * adaptation is valid
+         *
+         * Range: -128 - 127
+         */
+        s8 rate_adaptation_snr;
+};
+
+enum conf_rx_queue_type {
+        CONF_RX_QUEUE_TYPE_LOW_PRIORITY,  /* All except the high priority */
+        CONF_RX_QUEUE_TYPE_HIGH_PRIORITY, /* Management and voice packets */
+};
+
+struct conf_rx_settings {
+        /*
+         * The maximum amount of time, in TU, before the
+         * firmware discards the MSDU.
+         *
+         * Range: 0 - 0xFFFFFFFF
+         */
+        u32 rx_msdu_life_time;
+
+        /*
+         * Packet detection threshold in the PHY.
+         *
+         * FIXME: details unknown.
+         */
+        u32 packet_detection_threshold;
+
+        /*
+         * The longest time the STA will wait to receive traffic from the AP
+         * after a PS-poll has been transmitted.
+         *
+         * Range: 0 - 200000
+         */
+        u16 ps_poll_timeout;
+        /*
+         * The longest time the STA will wait to receive traffic from the AP
+         * after a frame has been sent from an UPSD enabled queue.
+         *
+         * Range: 0 - 200000
+         */
+        u16 upsd_timeout;
+
+        /*
+         * The number of octets in an MPDU, below which an RTS/CTS
+         * handshake is not performed.
+         *
+         * Range: 0 - 4096
+         */
+        u16 rts_threshold;
+
+        /*
+         * The RX Clear Channel Assessment threshold in the PHY
+         * (the energy threshold).
+         *
+         * Range: ENABLE_ENERGY_D  == 0x140A
+         *        DISABLE_ENERGY_D == 0xFFEF
+         */
+        u16 rx_cca_threshold;
+
+        /*
+         * Occupied Rx mem-blocks number which requires interrupting the host
+         * (0 = no buffering, 0xffff = disabled).
+         *
+         * Range: u16
+         */
+        u16 irq_blk_threshold;
+
+        /*
+         * Rx packets number which requires interrupting the host
+         * (0 = no buffering).
+         *
+         * Range: u16
+         */
+        u16 irq_pkt_threshold;
+
+        /*
+         * Max time in msec the FW may delay RX-Complete interrupt.
+         *
+         * Range: 1 - 100
+         */
+        u16 irq_timeout;
+
+        /*
+         * The RX queue type.
+         *
+         * Range: RX_QUEUE_TYPE_RX_LOW_PRIORITY, RX_QUEUE_TYPE_RX_HIGH_PRIORITY,
+         */
+        u8 queue_type;
+};
+
+#define CONF_TX_MAX_RATE_CLASSES       8
+
+#define CONF_TX_RATE_MASK_UNSPECIFIED  0
+#define CONF_TX_RATE_MASK_ALL          0x1eff
+#define CONF_TX_RATE_RETRY_LIMIT       10
+
+struct conf_tx_rate_class {
+
+        /*
+         * The rates enabled for this rate class.
+         *
+         * Range: CONF_HW_BIT_RATE_* bit mask
+         */
+        u32 enabled_rates;
+
+        /*
+         * The dot11 short retry limit used for TX retries.
+         *
+         * Range: u8
+         */
+        u8 short_retry_limit;
+
+        /*
+         * The dot11 long retry limit used for TX retries.
+         *
+         * Range: u8
+         */
+        u8 long_retry_limit;
+
+        /*
+         * Flags controlling the attributes of TX transmission.
+         *
+         * Range: bit 0: Truncate - when set, FW attempts to send a frame stop
+         *               when the total valid per-rate attempts have
+         *               been exhausted; otherwise transmissions
+         *               will continue at the lowest available rate
+         *               until the appropriate one of the
+         *               short_retry_limit, long_retry_limit,
+         *               dot11_max_transmit_msdu_life_time, or
+         *               max_tx_life_time, is exhausted.
+         *            1: Preamble Override - indicates if the preamble type
+         *               should be used in TX.
+         *            2: Preamble Type - the type of the preamble to be used by
+         *               the policy (0 - long preamble, 1 - short preamble.
+         */
+        u8 aflags;
+};
+
+#define CONF_TX_MAX_AC_COUNT 4
+
+/* Slot number setting to start transmission at PIFS interval */
+#define CONF_TX_AIFS_PIFS 1
+/* Slot number setting to start transmission at DIFS interval normal
+ * DCF access */
+#define CONF_TX_AIFS_DIFS 2
+
+
+enum conf_tx_ac {
+        CONF_TX_AC_BE = 0,         /* best effort / legacy */
+        CONF_TX_AC_BK = 1,         /* background */
+        CONF_TX_AC_VI = 2,         /* video */
+        CONF_TX_AC_VO = 3,         /* voice */
+        CONF_TX_AC_CTS2SELF = 4,   /* fictious AC, follows AC_VO */
+        CONF_TX_AC_ANY_TID = 0x1f
+};
+
+struct conf_tx_ac_category {
+        /*
+         * The AC class identifier.
+         *
+         * Range: enum conf_tx_ac
+         */
+        u8 ac;
+
+        /*
+         * The contention window minimum size (in slots) for the access
+         * class.
+         *
+         * Range: u8
+         */
+        u8 cw_min;
+
+        /*
+         * The contention window maximum size (in slots) for the access
+         * class.
+         *
+         * Range: u8
+         */
+        u16 cw_max;
+
+        /*
+         * The AIF value (in slots) for the access class.
+         *
+         * Range: u8
+         */
+        u8 aifsn;
+
+        /*
+         * The TX Op Limit (in microseconds) for the access class.
+         *
+         * Range: u16
+         */
+        u16 tx_op_limit;
+};
+
+#define CONF_TX_MAX_TID_COUNT 7
+
+enum {
+        CONF_CHANNEL_TYPE_DCF = 0,   /* DC/LEGACY*/
+        CONF_CHANNEL_TYPE_EDCF = 1,  /* EDCA*/
+        CONF_CHANNEL_TYPE_HCCA = 2,  /* HCCA*/
+};
+
+enum {
+        CONF_PS_SCHEME_LEGACY = 0,
+        CONF_PS_SCHEME_UPSD_TRIGGER = 1,
+        CONF_PS_SCHEME_LEGACY_PSPOLL = 2,
+        CONF_PS_SCHEME_SAPSD = 3,
+};
+
+enum {
+        CONF_ACK_POLICY_LEGACY = 0,
+        CONF_ACK_POLICY_NO_ACK = 1,
+        CONF_ACK_POLICY_BLOCK = 2,
+};
+
+
+struct conf_tx_tid {
+        u8 queue_id;
+        u8 channel_type;
+        u8 tsid;
+        u8 ps_scheme;
+        u8 ack_policy;
+        u32 apsd_conf[2];
+};
+
+struct conf_tx_settings {
+        /*
+         * The TX ED value for TELEC Enable/Disable.
+         *
+         * Range: 0, 1
+         */
+        u8 tx_energy_detection;
+
+        /*
+         * Configuration for rate classes for TX (currently only one
+         * rate class supported.)
+         */
+        struct conf_tx_rate_class rc_conf;
+
+        /*
+         * Configuration for access categories for TX rate control.
+         */
+        u8 ac_conf_count;
+        struct conf_tx_ac_category ac_conf[CONF_TX_MAX_AC_COUNT];
+
+        /*
+         * Configuration for TID parameters.
+         */
+        u8 tid_conf_count;
+        struct conf_tx_tid tid_conf[CONF_TX_MAX_TID_COUNT];
+
+        /*
+         * The TX fragmentation threshold.
+         *
+         * Range: u16
+         */
+        u16 frag_threshold;
+
+        /*
+         * Max time in msec the FW may delay frame TX-Complete interrupt.
+         *
+         * Range: u16
+         */
+        u16 tx_compl_timeout;
+
+        /*
+         * Completed TX packet count which requires to issue the TX-Complete
+         * interrupt.
+         *
+         * Range: u16
+         */
+        u16 tx_compl_threshold;
+
+};
+
+enum {
+        CONF_WAKE_UP_EVENT_BEACON    = 0x01, /* Wake on every Beacon*/
+        CONF_WAKE_UP_EVENT_DTIM      = 0x02, /* Wake on every DTIM*/
+        CONF_WAKE_UP_EVENT_N_DTIM    = 0x04, /* Wake every Nth DTIM */
+        CONF_WAKE_UP_EVENT_N_BEACONS = 0x08, /* Wake every Nth beacon */
+        CONF_WAKE_UP_EVENT_BITS_MASK = 0x0F
+};
+
+#define CONF_MAX_BCN_FILT_IE_COUNT 32
+
+#define CONF_BCN_RULE_PASS_ON_CHANGE         BIT(0)
+#define CONF_BCN_RULE_PASS_ON_APPEARANCE     BIT(1)
+
+#define CONF_BCN_IE_OUI_LEN    3
+#define CONF_BCN_IE_VER_LEN    2
+
+struct conf_bcn_filt_rule {
+        /*
+         * IE number to which to associate a rule.
+         *
+         * Range: u8
+         */
+        u8 ie;
+
+        /*
+         * Rule to associate with the specific ie.
+         *
+         * Range: CONF_BCN_RULE_PASS_ON_*
+         */
+        u8 rule;
+
+        /*
+         * OUI for the vendor specifie IE (221)
+         */
+        u8 oui[CONF_BCN_IE_OUI_LEN];
+
+        /*
+         * Type for the vendor specifie IE (221)
+         */
+        u8 type;
+
+        /*
+         * Version for the vendor specifie IE (221)
+         */
+        u8 version[CONF_BCN_IE_VER_LEN];
+};
+
+#define CONF_MAX_RSSI_SNR_TRIGGERS 8
+
+enum {
+        CONF_TRIG_METRIC_RSSI_BEACON = 0,
+        CONF_TRIG_METRIC_RSSI_DATA,
+        CONF_TRIG_METRIC_SNR_BEACON,
+        CONF_TRIG_METRIC_SNR_DATA
+};
+
+enum {
+        CONF_TRIG_EVENT_TYPE_LEVEL = 0,
+        CONF_TRIG_EVENT_TYPE_EDGE
+};
+
+enum {
+        CONF_TRIG_EVENT_DIR_LOW = 0,
+        CONF_TRIG_EVENT_DIR_HIGH,
+        CONF_TRIG_EVENT_DIR_BIDIR
+};
+
+
+struct conf_sig_trigger {
+        /*
+         * The RSSI / SNR threshold value.
+         *
+         * FIXME: what is the range?
+         */
+        s16 threshold;
+
+        /*
+         * Minimum delay between two trigger events for this trigger in ms.
+         *
+         * Range: 0 - 60000
+         */
+        u16 pacing;
+
+        /*
+         * The measurement data source for this trigger.
+         *
+         * Range: CONF_TRIG_METRIC_*
+         */
+        u8 metric;
+
+        /*
+         * The trigger type of this trigger.
+         *
+         * Range: CONF_TRIG_EVENT_TYPE_*
+         */
+        u8 type;
+
+        /*
+         * The direction of the trigger.
+         *
+         * Range: CONF_TRIG_EVENT_DIR_*
+         */
+        u8 direction;
+
+        /*
+         * Hysteresis range of the trigger around the threshold (in dB)
+         *
+         * Range: u8
+         */
+        u8 hysteresis;
+
+        /*
+         * Index of the trigger rule.
+         *
+         * Range: 0 - CONF_MAX_RSSI_SNR_TRIGGERS-1
+         */
+        u8 index;
+
+        /*
+         * Enable / disable this rule (to use for clearing rules.)
+         *
+         * Range: 1 - Enabled, 2 - Not enabled
+         */
+        u8 enable;
+};
+
+struct conf_sig_weights {
+
+        /*
+         * RSSI from beacons average weight.
+         *
+         * Range: u8
+         */
+        u8 rssi_bcn_avg_weight;
+
+        /*
+         * RSSI from data average weight.
+         *
+         * Range: u8
+         */
+        u8 rssi_pkt_avg_weight;
+
+        /*
+         * SNR from beacons average weight.
+         *
+         * Range: u8
+         */
+        u8 snr_bcn_avg_weight;
+
+        /*
+         * SNR from data average weight.
+         *
+         * Range: u8
+         */
+        u8 snr_pkt_avg_weight;
+};
+
+enum conf_bcn_filt_mode {
+        CONF_BCN_FILT_MODE_DISABLED = 0,
+        CONF_BCN_FILT_MODE_ENABLED = 1
+};
+
+enum conf_bet_mode {
+        CONF_BET_MODE_DISABLE = 0,
+        CONF_BET_MODE_ENABLE = 1,
+};
+
+struct conf_conn_settings {
+        /*
+         * Firmware wakeup conditions configuration. The host may set only
+         * one bit.
+         *
+         * Range: CONF_WAKE_UP_EVENT_*
+         */
+        u8 wake_up_event;
+
+        /*
+         * Listen interval for beacons or Dtims.
+         *
+         * Range: 0 for beacon and Dtim wakeup
+         *        1-10 for x Dtims
+         *        1-255 for x beacons
+         */
+        u8 listen_interval;
+
+        /*
+         * Enable or disable the beacon filtering.
+         *
+         * Range: CONF_BCN_FILT_MODE_*
+         */
+        enum conf_bcn_filt_mode bcn_filt_mode;
+
+        /*
+         * Configure Beacon filter pass-thru rules.
+         */
+        u8 bcn_filt_ie_count;
+        struct conf_bcn_filt_rule bcn_filt_ie[CONF_MAX_BCN_FILT_IE_COUNT];
+
+        /*
+         * The number of consequtive beacons to lose, before the firmware
+         * becomes out of synch.
+         *
+         * Range: u32
+         */
+        u32 synch_fail_thold;
+
+        /*
+         * After out-of-synch, the number of TU's to wait without a further
+         * received beacon (or probe response) before issuing the BSS_EVENT_LOSE
+         * event.
+         *
+         * Range: u32
+         */
+        u32 bss_lose_timeout;
+
+        /*
+         * Beacon receive timeout.
+         *
+         * Range: u32
+         */
+        u32 beacon_rx_timeout;
+
+        /*
+         * Broadcast receive timeout.
+         *
+         * Range: u32
+         */
+        u32 broadcast_timeout;
+
+        /*
+         * Enable/disable reception of broadcast packets in power save mode
+         *
+         * Range: 1 - enable, 0 - disable
+         */
+        u8 rx_broadcast_in_ps;
+
+        /*
+         * Consequtive PS Poll failures before sending event to driver
+         *
+         * Range: u8
+         */
+        u8 ps_poll_threshold;
+
+        /*
+         * Configuration of signal (rssi/snr) triggers.
+         */
+        u8 sig_trigger_count;
+        struct conf_sig_trigger sig_trigger[CONF_MAX_RSSI_SNR_TRIGGERS];
+
+        /*
+         * Configuration of signal average weights.
+         */
+        struct conf_sig_weights sig_weights;
+
+        /*
+         * Specifies if beacon early termination procedure is enabled or
+         * disabled.
+         *
+         * Range: CONF_BET_MODE_*
+         */
+        u8 bet_enable;
+
+        /*
+         * Specifies the maximum number of consecutive beacons that may be
+         * early terminated. After this number is reached at least one full
+         * beacon must be correctly received in FW before beacon ET
+         * resumes.
+         *
+         * Range 0 - 255
+         */
+        u8 bet_max_consecutive;
+};
+
+#define CONF_SR_ERR_TBL_MAX_VALUES   14
+
+struct conf_mart_reflex_err_table {
+        /*
+         * Length of the error table values table.
+         *
+         * Range: 0 - CONF_SR_ERR_TBL_MAX_VALUES
+         */
+        u8 len;
+
+        /*
+         * Smart Reflex error table upper limit.
+         *
+         * Range: s8
+         */
+        s8 upper_limit;
+
+        /*
+         * Smart Reflex error table values.
+         *
+         * Range: s8
+         */
+        s8 values[CONF_SR_ERR_TBL_MAX_VALUES];
+};
+
+enum {
+        CONF_REF_CLK_19_2_E,
+        CONF_REF_CLK_26_E,
+        CONF_REF_CLK_38_4_E,
+        CONF_REF_CLK_52_E
+};
+
+enum single_dual_band_enum {
+        CONF_SINGLE_BAND,
+        CONF_DUAL_BAND
+};
+
+struct conf_general_parms {
+        /*
+         * RF Reference Clock type / speed
+         *
+         * Range: CONF_REF_CLK_*
+         */
+        u8 ref_clk;
+
+        /*
+         * Settling time of the reference clock after boot.
+         *
+         * Range: u8
+         */
+        u8 settling_time;
+
+        /*
+         * Flag defining whether clock is valid on wakeup.
+         *
+         * Range: 0 - not valid on wakeup, 1 - valid on wakeup
+         */
+        u8 clk_valid_on_wakeup;
+
+        /*
+         * DC-to-DC mode.
+         *
+         * Range: Unknown
+         */
+        u8 dc2dcmode;
+
+        /*
+         * Flag defining whether used as single or dual-band.
+         *
+         * Range: CONF_SINGLE_BAND, CONF_DUAL_BAND
+         */
+        u8 single_dual_band;
+
+        /*
+         * TX bip fem autodetect flag.
+         *
+         * Range: Unknown
+         */
+        u8 tx_bip_fem_autodetect;
+
+        /*
+         * TX bip gem manufacturer.
+         *
+         * Range: Unknown
+         */
+        u8 tx_bip_fem_manufacturer;
+
+        /*
+         * Settings flags.
+         *
+         * Range: Unknown
+         */
+        u8 settings;
+};
+
+#define CONF_RSSI_AND_PROCESS_COMPENSATION_SIZE 15
+#define CONF_NUMBER_OF_SUB_BANDS_5  7
+#define CONF_NUMBER_OF_RATE_GROUPS  6
+#define CONF_NUMBER_OF_CHANNELS_2_4 14
+#define CONF_NUMBER_OF_CHANNELS_5   35
+
+struct conf_radio_parms {
+        /*
+         * Static radio parameters for 2.4GHz
+         *
+         * Range: unknown
+         */
+        u8 rx_trace_loss;
+        u8 tx_trace_loss;
+        s8 rx_rssi_and_proc_compens[CONF_RSSI_AND_PROCESS_COMPENSATION_SIZE];
+
+        /*
+         * Static radio parameters for 5GHz
+         *
+         * Range: unknown
+         */
+        u8 rx_trace_loss_5[CONF_NUMBER_OF_SUB_BANDS_5];
+        u8 tx_trace_loss_5[CONF_NUMBER_OF_SUB_BANDS_5];
+        s8 rx_rssi_and_proc_compens_5[CONF_RSSI_AND_PROCESS_COMPENSATION_SIZE];
+
+        /*
+         * Dynamic radio parameters for 2.4GHz
+         *
+         * Range: unknown
+         */
+        s16 tx_ref_pd_voltage;
+        s8  tx_ref_power;
+        s8  tx_offset_db;
+
+        s8  tx_rate_limits_normal[CONF_NUMBER_OF_RATE_GROUPS];
+        s8  tx_rate_limits_degraded[CONF_NUMBER_OF_RATE_GROUPS];
+
+        s8  tx_channel_limits_11b[CONF_NUMBER_OF_CHANNELS_2_4];
+        s8  tx_channel_limits_ofdm[CONF_NUMBER_OF_CHANNELS_2_4];
+        s8  tx_pdv_rate_offsets[CONF_NUMBER_OF_RATE_GROUPS];
+
+        u8  tx_ibias[CONF_NUMBER_OF_RATE_GROUPS];
+        u8  rx_fem_insertion_loss;
+
+        /*
+         * Dynamic radio parameters for 5GHz
+         *
+         * Range: unknown
+         */
+        s16 tx_ref_pd_voltage_5[CONF_NUMBER_OF_SUB_BANDS_5];
+        s8  tx_ref_power_5[CONF_NUMBER_OF_SUB_BANDS_5];
+        s8  tx_offset_db_5[CONF_NUMBER_OF_SUB_BANDS_5];
+
+        s8  tx_rate_limits_normal_5[CONF_NUMBER_OF_RATE_GROUPS];
+        s8  tx_rate_limits_degraded_5[CONF_NUMBER_OF_RATE_GROUPS];
+
+        s8  tx_channel_limits_ofdm_5[CONF_NUMBER_OF_CHANNELS_5];
+        s8  tx_pdv_rate_offsets_5[CONF_NUMBER_OF_RATE_GROUPS];
+
+        /* FIXME: this is inconsistent with the types for 2.4GHz */
+        s8  tx_ibias_5[CONF_NUMBER_OF_RATE_GROUPS];
+        s8  rx_fem_insertion_loss_5[CONF_NUMBER_OF_SUB_BANDS_5];
+};
+
+#define CONF_SR_ERR_TBL_COUNT        3
+
+struct conf_init_settings {
+        /*
+         * Configure Smart Reflex error table values.
+         */
+        struct conf_mart_reflex_err_table sr_err_tbl[CONF_SR_ERR_TBL_COUNT];
+
+        /*
+         * Smart Reflex enable flag.
+         *
+         * Range: 1 - Smart Reflex enabled, 0 - Smart Reflex disabled
+         */
+        u8 sr_enable;
+
+        /*
+         * Configure general parameters.
+         */
+        struct conf_general_parms genparam;
+
+        /*
+         * Configure radio parameters.
+         */
+        struct conf_radio_parms radioparam;
+
+};
+
+struct conf_drv_settings {
+        struct conf_sg_settings sg;
+        struct conf_rx_settings rx;
+        struct conf_tx_settings tx;
+        struct conf_conn_settings conn;
+        struct conf_init_settings init;
+};
+
+#endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_event.c b/drivers/net/wireless/wl12xx/wl1271_event.c
index f3afd4a6ff33..31d396ba9188 100644
--- a/drivers/net/wireless/wl12xx/wl1271_event.c
+++ b/drivers/net/wireless/wl12xx/wl1271_event.c
@@ -26,20 +26,45 @@
 #include "wl1271_spi.h"
 #include "wl1271_event.h"
 #include "wl1271_ps.h"
+#include "wl12xx_80211.h"
 
 static int wl1271_event_scan_complete(struct wl1271 *wl,
                                       struct event_mailbox *mbox)
 {
+        int size = sizeof(struct wl12xx_probe_req_template);
         wl1271_debug(DEBUG_EVENT, "status: 0x%x",
                      mbox->scheduled_scan_status);
 
         if (wl->scanning) {
-                mutex_unlock(&wl->mutex);
-                ieee80211_scan_completed(wl->hw, false);
-                mutex_lock(&wl->mutex);
-                wl->scanning = false;
+                if (wl->scan.state == WL1271_SCAN_BAND_DUAL) {
+                        wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_2_4,
+                                                NULL, size);
+                        /* 2.4 GHz band scanned, scan 5 GHz band, pretend
+                         * to the wl1271_cmd_scan function that we are not
+                         * scanning as it checks that.
+                         */
+                        wl->scanning = false;
+                        wl1271_cmd_scan(wl, wl->scan.ssid, wl->scan.ssid_len,
+                                                wl->scan.active,
+                                                wl->scan.high_prio,
+                                                WL1271_SCAN_BAND_5_GHZ,
+                                                wl->scan.probe_requests);
+                } else {
+                        if (wl->scan.state == WL1271_SCAN_BAND_2_4_GHZ)
+                                wl1271_cmd_template_set(wl,
+                                                CMD_TEMPL_CFG_PROBE_REQ_2_4,
+                                                NULL, size);
+                        else
+                                wl1271_cmd_template_set(wl,
+                                                CMD_TEMPL_CFG_PROBE_REQ_5,
+                                                NULL, size);
+
+                        mutex_unlock(&wl->mutex);
+                        ieee80211_scan_completed(wl->hw, false);
+                        mutex_lock(&wl->mutex);
+                        wl->scanning = false;
+                }
         }
-
         return 0;
 }
 
@@ -57,7 +82,8 @@ static int wl1271_event_process(struct wl1271 *wl, struct event_mailbox *mbox)
 
         wl1271_event_mbox_dump(mbox);
 
-        vector = mbox->events_vector & ~(mbox->events_mask);
+        vector = le32_to_cpu(mbox->events_vector);
+        vector &= ~(le32_to_cpu(mbox->events_mask));
         wl1271_debug(DEBUG_EVENT, "vector: 0x%x", vector);
 
         if (vector & SCAN_COMPLETE_EVENT_ID) {
@@ -66,14 +92,16 @@ static int wl1271_event_process(struct wl1271 *wl, struct event_mailbox *mbox)
                         return ret;
         }
 
-        if (vector & BSS_LOSE_EVENT_ID) {
+        /*
+         * The BSS_LOSE_EVENT_ID is only needed while psm (and hence beacon
+         * filtering) is enabled. Without PSM, the stack will receive all
+         * beacons and can detect beacon loss by itself.
+         */
+        if (vector & BSS_LOSE_EVENT_ID && wl->psm) {
                 wl1271_debug(DEBUG_EVENT, "BSS_LOSE_EVENT");
 
-                if (wl->psm_requested && wl->psm) {
-                        ret = wl1271_ps_set_mode(wl, STATION_ACTIVE_MODE);
-                        if (ret < 0)
-                                return ret;
-                }
+                /* indicate to the stack, that beacons have been lost */
+                ieee80211_beacon_loss(wl->vif);
         }
 
         return 0;
@@ -92,14 +120,14 @@ int wl1271_event_unmask(struct wl1271 *wl)
 
 void wl1271_event_mbox_config(struct wl1271 *wl)
 {
-        wl->mbox_ptr[0] = wl1271_reg_read32(wl, REG_EVENT_MAILBOX_PTR);
+        wl->mbox_ptr[0] = wl1271_spi_read32(wl, REG_EVENT_MAILBOX_PTR);
         wl->mbox_ptr[1] = wl->mbox_ptr[0] + sizeof(struct event_mailbox);
 
         wl1271_debug(DEBUG_EVENT, "MBOX ptrs: 0x%x 0x%x",
                      wl->mbox_ptr[0], wl->mbox_ptr[1]);
 }
 
-int wl1271_event_handle(struct wl1271 *wl, u8 mbox_num)
+int wl1271_event_handle(struct wl1271 *wl, u8 mbox_num, bool do_ack)
 {
         struct event_mailbox mbox;
         int ret;
@@ -110,8 +138,8 @@ int wl1271_event_handle(struct wl1271 *wl, u8 mbox_num)
                 return -EINVAL;
 
         /* first we read the mbox descriptor */
-        wl1271_spi_mem_read(wl, wl->mbox_ptr[mbox_num], &mbox,
-                            sizeof(struct event_mailbox));
+        wl1271_spi_read(wl, wl->mbox_ptr[mbox_num], &mbox,
+                        sizeof(struct event_mailbox), false);
 
         /* process the descriptor */
         ret = wl1271_event_process(wl, &mbox);
@@ -119,7 +147,9 @@ int wl1271_event_handle(struct wl1271 *wl, u8 mbox_num)
                 return ret;
 
         /* then we let the firmware know it can go on...*/
-        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_TRIG, INTR_TRIG_EVENT_ACK);
+        if (do_ack)
+                wl1271_spi_write32(wl, ACX_REG_INTERRUPT_TRIG,
+                                   INTR_TRIG_EVENT_ACK);
 
         return 0;
 }
diff --git a/drivers/net/wireless/wl12xx/wl1271_event.h b/drivers/net/wireless/wl12xx/wl1271_event.h
index 2cdce7c34bf0..3ab53d331f15 100644
--- a/drivers/net/wireless/wl12xx/wl1271_event.h
+++ b/drivers/net/wireless/wl12xx/wl1271_event.h
@@ -66,33 +66,33 @@ enum {
 struct event_debug_report {
         u8 debug_event_id;
         u8 num_params;
-        u16 pad;
-        u32 report_1;
-        u32 report_2;
-        u32 report_3;
+        __le16 pad;
+        __le32 report_1;
+        __le32 report_2;
+        __le32 report_3;
 } __attribute__ ((packed));
 
 #define NUM_OF_RSSI_SNR_TRIGGERS 8
 
 struct event_mailbox {
-        u32 events_vector;
-        u32 events_mask;
-        u32 reserved_1;
-        u32 reserved_2;
+        __le32 events_vector;
+        __le32 events_mask;
+        __le32 reserved_1;
+        __le32 reserved_2;
 
         u8 dbg_event_id;
         u8 num_relevant_params;
-        u16 reserved_3;
-        u32 event_report_p1;
-        u32 event_report_p2;
-        u32 event_report_p3;
+        __le16 reserved_3;
+        __le32 event_report_p1;
+        __le32 event_report_p2;
+        __le32 event_report_p3;
 
         u8 number_of_scan_results;
         u8 scan_tag;
         u8 reserved_4[2];
-        u32 compl_scheduled_scan_status;
+        __le32 compl_scheduled_scan_status;
 
-        u16 scheduled_scan_attended_channels;
+        __le16 scheduled_scan_attended_channels;
         u8 soft_gemini_sense_info;
         u8 soft_gemini_protective_info;
         s8 rssi_snr_trigger_metric[NUM_OF_RSSI_SNR_TRIGGERS];
@@ -105,6 +105,6 @@ struct event_mailbox {
 
 int wl1271_event_unmask(struct wl1271 *wl);
 void wl1271_event_mbox_config(struct wl1271 *wl);
-int wl1271_event_handle(struct wl1271 *wl, u8 mbox);
+int wl1271_event_handle(struct wl1271 *wl, u8 mbox, bool do_ack);
 
 #endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_init.c b/drivers/net/wireless/wl12xx/wl1271_init.c
index 490df217605a..417b4152feb1 100644
--- a/drivers/net/wireless/wl12xx/wl1271_init.c
+++ b/drivers/net/wireless/wl12xx/wl1271_init.c
@@ -59,6 +59,14 @@ static int wl1271_init_templates_config(struct wl1271 *wl)
         if (ret < 0)
                 return ret;
 
+        if (wl1271_11a_enabled()) {
+                ret = wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_5,
+                                NULL,
+                                sizeof(struct wl12xx_probe_req_template));
+                if (ret < 0)
+                        return ret;
+        }
+
         ret = wl1271_cmd_template_set(wl, CMD_TEMPL_NULL_DATA, NULL,
                                       sizeof(struct wl12xx_null_data_template));
         if (ret < 0)
@@ -94,7 +102,7 @@ static int wl1271_init_rx_config(struct wl1271 *wl, u32 config, u32 filter)
 {
         int ret;
 
-        ret = wl1271_acx_rx_msdu_life_time(wl, RX_MSDU_LIFETIME_DEF);
+        ret = wl1271_acx_rx_msdu_life_time(wl);
         if (ret < 0)
                 return ret;
 
@@ -117,7 +125,7 @@ static int wl1271_init_phy_config(struct wl1271 *wl)
         if (ret < 0)
                 return ret;
 
-        ret = wl1271_acx_group_address_tbl(wl);
+        ret = wl1271_acx_group_address_tbl(wl, true, NULL, 0);
         if (ret < 0)
                 return ret;
 
@@ -125,7 +133,7 @@ static int wl1271_init_phy_config(struct wl1271 *wl)
         if (ret < 0)
                 return ret;
 
-        ret = wl1271_acx_rts_threshold(wl, RTS_THRESHOLD_DEF);
+        ret = wl1271_acx_rts_threshold(wl, wl->conf.rx.rts_threshold);
         if (ret < 0)
                 return ret;
 
@@ -136,7 +144,8 @@ static int wl1271_init_beacon_filter(struct wl1271 *wl)
 {
         int ret;
 
-        ret = wl1271_acx_beacon_filter_opt(wl);
+        /* disable beacon filtering at this stage */
+        ret = wl1271_acx_beacon_filter_opt(wl, false);
         if (ret < 0)
                 return ret;
 
@@ -187,6 +196,7 @@ static int wl1271_init_beacon_broadcast(struct wl1271 *wl)
 static int wl1271_init_general_parms(struct wl1271 *wl)
 {
         struct wl1271_general_parms *gen_parms;
+        struct conf_general_parms *g = &wl->conf.init.genparam;
         int ret;
 
         gen_parms = kzalloc(sizeof(*gen_parms), GFP_KERNEL);
@@ -195,15 +205,14 @@ static int wl1271_init_general_parms(struct wl1271 *wl)
 
         gen_parms->id = TEST_CMD_INI_FILE_GENERAL_PARAM;
 
-        gen_parms->ref_clk = REF_CLK_38_4_E;
-        /* FIXME: magic numbers */
-        gen_parms->settling_time = 5;
-        gen_parms->clk_valid_on_wakeup = 0;
-        gen_parms->dc2dcmode = 0;
-        gen_parms->single_dual_band = 0;
-        gen_parms->tx_bip_fem_autodetect = 1;
-        gen_parms->tx_bip_fem_manufacturer = 1;
-        gen_parms->settings = 1;
+        gen_parms->ref_clk = g->ref_clk;
+        gen_parms->settling_time = g->settling_time;
+        gen_parms->clk_valid_on_wakeup = g->clk_valid_on_wakeup;
+        gen_parms->dc2dcmode = g->dc2dcmode;
+        gen_parms->single_dual_band = g->single_dual_band;
+        gen_parms->tx_bip_fem_autodetect = g->tx_bip_fem_autodetect;
+        gen_parms->tx_bip_fem_manufacturer = g->tx_bip_fem_manufacturer;
+        gen_parms->settings = g->settings;
 
         ret = wl1271_cmd_test(wl, gen_parms, sizeof(*gen_parms), 0);
         if (ret < 0) {
@@ -217,32 +226,9 @@ static int wl1271_init_general_parms(struct wl1271 *wl)
 
 static int wl1271_init_radio_parms(struct wl1271 *wl)
 {
-        /*
-         * FIXME: All these magic numbers should be moved to some place where
-         * they can be configured (separate file?)
-         */
-
         struct wl1271_radio_parms *radio_parms;
-        int ret;
-        u8 compensation[] = { 0xec, 0xf6, 0x00, 0x0c, 0x18, 0xf8, 0xfc, 0x00,
-                              0x08, 0x10, 0xf0, 0xf8, 0x00, 0x0a, 0x14 };
-
-        u8 tx_rate_limits_normal[]   = { 0x1e, 0x1f, 0x22, 0x24, 0x28, 0x29 };
-        u8 tx_rate_limits_degraded[] = { 0x1b, 0x1c, 0x1e, 0x20, 0x24, 0x25 };
-
-        u8 tx_channel_limits_11b[] = { 0x22, 0x50, 0x50, 0x50,
-                                       0x50, 0x50, 0x50, 0x50,
-                                       0x50, 0x50, 0x22, 0x50,
-                                       0x22, 0x50 };
-
-        u8 tx_channel_limits_ofdm[] = { 0x20, 0x50, 0x50, 0x50,
-                                        0x50, 0x50, 0x50, 0x50,
-                                        0x50, 0x50, 0x20, 0x50,
-                                        0x20, 0x50 };
-
-        u8 tx_pdv_rate_offsets[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
-
-        u8 tx_ibias[] = { 0x1a, 0x1a, 0x1a, 0x1a, 0x1a, 0x27 };
+        struct conf_radio_parms *r = &wl->conf.init.radioparam;
+        int i, ret;
 
         radio_parms = kzalloc(sizeof(*radio_parms), GFP_KERNEL);
         if (!radio_parms)
@@ -251,33 +237,59 @@ static int wl1271_init_radio_parms(struct wl1271 *wl)
         radio_parms->id = TEST_CMD_INI_FILE_RADIO_PARAM;
 
         /* Static radio parameters */
-        radio_parms->rx_trace_loss = 10;
-        radio_parms->tx_trace_loss = 10;
-        memcpy(radio_parms->rx_rssi_and_proc_compens, compensation,
-               sizeof(compensation));
-
-        /* We don't set the 5GHz -- N/A */
+        radio_parms->rx_trace_loss = r->rx_trace_loss;
+        radio_parms->tx_trace_loss = r->tx_trace_loss;
+        memcpy(radio_parms->rx_rssi_and_proc_compens,
+               r->rx_rssi_and_proc_compens,
+               CONF_RSSI_AND_PROCESS_COMPENSATION_SIZE);
+
+        memcpy(radio_parms->rx_trace_loss_5, r->rx_trace_loss_5,
+               CONF_NUMBER_OF_SUB_BANDS_5);
+        memcpy(radio_parms->tx_trace_loss_5, r->tx_trace_loss_5,
+               CONF_NUMBER_OF_SUB_BANDS_5);
+        memcpy(radio_parms->rx_rssi_and_proc_compens_5,
+               r->rx_rssi_and_proc_compens_5,
+               CONF_RSSI_AND_PROCESS_COMPENSATION_SIZE);
 
         /* Dynamic radio parameters */
-        radio_parms->tx_ref_pd_voltage = cpu_to_le16(0x24e);
-        radio_parms->tx_ref_power = 0x78;
-        radio_parms->tx_offset_db = 0x0;
-
-        memcpy(radio_parms->tx_rate_limits_normal, tx_rate_limits_normal,
-               sizeof(tx_rate_limits_normal));
-        memcpy(radio_parms->tx_rate_limits_degraded, tx_rate_limits_degraded,
-               sizeof(tx_rate_limits_degraded));
-
-        memcpy(radio_parms->tx_channel_limits_11b, tx_channel_limits_11b,
-               sizeof(tx_channel_limits_11b));
-        memcpy(radio_parms->tx_channel_limits_ofdm, tx_channel_limits_ofdm,
-               sizeof(tx_channel_limits_ofdm));
-        memcpy(radio_parms->tx_pdv_rate_offsets, tx_pdv_rate_offsets,
-               sizeof(tx_pdv_rate_offsets));
-        memcpy(radio_parms->tx_ibias, tx_ibias,
-               sizeof(tx_ibias));
-
-        radio_parms->rx_fem_insertion_loss = 0x14;
+        radio_parms->tx_ref_pd_voltage = cpu_to_le16(r->tx_ref_pd_voltage);
+        radio_parms->tx_ref_power = r->tx_ref_power;
+        radio_parms->tx_offset_db = r->tx_offset_db;
+
+        memcpy(radio_parms->tx_rate_limits_normal, r->tx_rate_limits_normal,
+               CONF_NUMBER_OF_RATE_GROUPS);
+        memcpy(radio_parms->tx_rate_limits_degraded, r->tx_rate_limits_degraded,
+               CONF_NUMBER_OF_RATE_GROUPS);
+
+        memcpy(radio_parms->tx_channel_limits_11b, r->tx_channel_limits_11b,
+               CONF_NUMBER_OF_CHANNELS_2_4);
+        memcpy(radio_parms->tx_channel_limits_ofdm, r->tx_channel_limits_ofdm,
+               CONF_NUMBER_OF_CHANNELS_2_4);
+        memcpy(radio_parms->tx_pdv_rate_offsets, r->tx_pdv_rate_offsets,
+               CONF_NUMBER_OF_RATE_GROUPS);
+        memcpy(radio_parms->tx_ibias, r->tx_ibias, CONF_NUMBER_OF_RATE_GROUPS);
+
+        radio_parms->rx_fem_insertion_loss = r->rx_fem_insertion_loss;
+
+        for (i = 0; i < CONF_NUMBER_OF_SUB_BANDS_5; i++)
+                radio_parms->tx_ref_pd_voltage_5[i] =
+                        cpu_to_le16(r->tx_ref_pd_voltage_5[i]);
+        memcpy(radio_parms->tx_ref_power_5, r->tx_ref_power_5,
+               CONF_NUMBER_OF_SUB_BANDS_5);
+        memcpy(radio_parms->tx_offset_db_5, r->tx_offset_db_5,
+               CONF_NUMBER_OF_SUB_BANDS_5);
+        memcpy(radio_parms->tx_rate_limits_normal_5,
+               r->tx_rate_limits_normal_5, CONF_NUMBER_OF_RATE_GROUPS);
+        memcpy(radio_parms->tx_rate_limits_degraded_5,
+               r->tx_rate_limits_degraded_5, CONF_NUMBER_OF_RATE_GROUPS);
+        memcpy(radio_parms->tx_channel_limits_ofdm_5,
+               r->tx_channel_limits_ofdm_5, CONF_NUMBER_OF_CHANNELS_5);
+        memcpy(radio_parms->tx_pdv_rate_offsets_5, r->tx_pdv_rate_offsets_5,
+               CONF_NUMBER_OF_RATE_GROUPS);
+        memcpy(radio_parms->tx_ibias_5, r->tx_ibias_5,
+               CONF_NUMBER_OF_RATE_GROUPS);
+        memcpy(radio_parms->rx_fem_insertion_loss_5,
+               r->rx_fem_insertion_loss_5, CONF_NUMBER_OF_SUB_BANDS_5);
 
         ret = wl1271_cmd_test(wl, radio_parms, sizeof(*radio_parms), 0);
         if (ret < 0)
@@ -311,8 +323,8 @@ int wl1271_hw_init(struct wl1271 *wl)
 
         /* RX config */
         ret = wl1271_init_rx_config(wl,
-                                       RX_CFG_PROMISCUOUS | RX_CFG_TSF,
-                                       RX_FILTER_OPTION_DEF);
+                                    RX_CFG_PROMISCUOUS | RX_CFG_TSF,
+                                    RX_FILTER_OPTION_DEF);
         /* RX_CONFIG_OPTION_ANY_DST_ANY_BSS,
            RX_FILTER_OPTION_FILTER_ALL); */
         if (ret < 0)
@@ -323,6 +335,11 @@ int wl1271_hw_init(struct wl1271 *wl)
         if (ret < 0)
                 goto out_free_memmap;
 
+        /* Initialize connection monitoring thresholds */
+        ret = wl1271_acx_conn_monit_params(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
         /* Beacon filtering */
         ret = wl1271_init_beacon_filter(wl);
         if (ret < 0)
@@ -369,7 +386,7 @@ int wl1271_hw_init(struct wl1271 *wl)
                 goto out_free_memmap;
 
         /* Configure TX rate classes */
-        ret = wl1271_acx_rate_policies(wl);
+        ret = wl1271_acx_rate_policies(wl, CONF_TX_RATE_MASK_ALL);
         if (ret < 0)
                 goto out_free_memmap;
 
@@ -388,10 +405,16 @@ int wl1271_hw_init(struct wl1271 *wl)
         if (ret < 0)
                 goto out_free_memmap;
 
+        /* Configure smart reflex */
+        ret = wl1271_acx_smart_reflex(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
         return 0;
 
  out_free_memmap:
         kfree(wl->target_mem_map);
+        wl->target_mem_map = NULL;
 
         return ret;
 }
diff --git a/drivers/net/wireless/wl12xx/wl1271_init.h b/drivers/net/wireless/wl12xx/wl1271_init.h
index bd8ff0fa2272..6e21ceee76a6 100644
--- a/drivers/net/wireless/wl12xx/wl1271_init.h
+++ b/drivers/net/wireless/wl12xx/wl1271_init.h
@@ -48,19 +48,6 @@ struct wl1271_general_parms {
         u8 settings;
 } __attribute__ ((packed));
 
-enum ref_clk_enum {
-        REF_CLK_19_2_E,
-        REF_CLK_26_E,
-        REF_CLK_38_4_E,
-        REF_CLK_52_E
-};
-
-#define RSSI_AND_PROCESS_COMPENSATION_SIZE 15
-#define NUMBER_OF_SUB_BANDS_5  7
-#define NUMBER_OF_RATE_GROUPS  6
-#define NUMBER_OF_CHANNELS_2_4 14
-#define NUMBER_OF_CHANNELS_5   35
-
 struct wl1271_radio_parms {
         u8 id;
         u8 padding[3];
@@ -69,45 +56,45 @@ struct wl1271_radio_parms {
         /* 2.4GHz */
         u8 rx_trace_loss;
         u8 tx_trace_loss;
-        s8 rx_rssi_and_proc_compens[RSSI_AND_PROCESS_COMPENSATION_SIZE];
+        s8 rx_rssi_and_proc_compens[CONF_RSSI_AND_PROCESS_COMPENSATION_SIZE];
 
         /* 5GHz */
-        u8 rx_trace_loss_5[NUMBER_OF_SUB_BANDS_5];
-        u8 tx_trace_loss_5[NUMBER_OF_SUB_BANDS_5];
-        s8 rx_rssi_and_proc_compens_5[RSSI_AND_PROCESS_COMPENSATION_SIZE];
+        u8 rx_trace_loss_5[CONF_NUMBER_OF_SUB_BANDS_5];
+        u8 tx_trace_loss_5[CONF_NUMBER_OF_SUB_BANDS_5];
+        s8 rx_rssi_and_proc_compens_5[CONF_RSSI_AND_PROCESS_COMPENSATION_SIZE];
 
         /* Dynamic radio parameters */
         /* 2.4GHz */
-        s16 tx_ref_pd_voltage;
+        __le16 tx_ref_pd_voltage;
         s8  tx_ref_power;
         s8  tx_offset_db;
 
-        s8  tx_rate_limits_normal[NUMBER_OF_RATE_GROUPS];
-        s8  tx_rate_limits_degraded[NUMBER_OF_RATE_GROUPS];
+        s8  tx_rate_limits_normal[CONF_NUMBER_OF_RATE_GROUPS];
+        s8  tx_rate_limits_degraded[CONF_NUMBER_OF_RATE_GROUPS];
 
-        s8  tx_channel_limits_11b[NUMBER_OF_CHANNELS_2_4];
-        s8  tx_channel_limits_ofdm[NUMBER_OF_CHANNELS_2_4];
-        s8  tx_pdv_rate_offsets[NUMBER_OF_RATE_GROUPS];
+        s8  tx_channel_limits_11b[CONF_NUMBER_OF_CHANNELS_2_4];
+        s8  tx_channel_limits_ofdm[CONF_NUMBER_OF_CHANNELS_2_4];
+        s8  tx_pdv_rate_offsets[CONF_NUMBER_OF_RATE_GROUPS];
 
-        u8  tx_ibias[NUMBER_OF_RATE_GROUPS];
+        u8  tx_ibias[CONF_NUMBER_OF_RATE_GROUPS];
         u8  rx_fem_insertion_loss;
 
         u8 padding2;
 
         /* 5GHz */
-        s16 tx_ref_pd_voltage_5[NUMBER_OF_SUB_BANDS_5];
-        s8  tx_ref_power_5[NUMBER_OF_SUB_BANDS_5];
-        s8  tx_offset_db_5[NUMBER_OF_SUB_BANDS_5];
+        __le16 tx_ref_pd_voltage_5[CONF_NUMBER_OF_SUB_BANDS_5];
+        s8  tx_ref_power_5[CONF_NUMBER_OF_SUB_BANDS_5];
+        s8  tx_offset_db_5[CONF_NUMBER_OF_SUB_BANDS_5];
 
-        s8  tx_rate_limits_normal_5[NUMBER_OF_RATE_GROUPS];
-        s8  tx_rate_limits_degraded_5[NUMBER_OF_RATE_GROUPS];
+        s8  tx_rate_limits_normal_5[CONF_NUMBER_OF_RATE_GROUPS];
+        s8  tx_rate_limits_degraded_5[CONF_NUMBER_OF_RATE_GROUPS];
 
-        s8  tx_channel_limits_ofdm_5[NUMBER_OF_CHANNELS_5];
-        s8  tx_pdv_rate_offsets_5[NUMBER_OF_RATE_GROUPS];
+        s8  tx_channel_limits_ofdm_5[CONF_NUMBER_OF_CHANNELS_5];
+        s8  tx_pdv_rate_offsets_5[CONF_NUMBER_OF_RATE_GROUPS];
 
         /* FIXME: this is inconsistent with the types for 2.4GHz */
-        s8  tx_ibias_5[NUMBER_OF_RATE_GROUPS];
-        s8  rx_fem_insertion_loss_5[NUMBER_OF_SUB_BANDS_5];
+        s8  tx_ibias_5[CONF_NUMBER_OF_RATE_GROUPS];
+        s8  rx_fem_insertion_loss_5[CONF_NUMBER_OF_SUB_BANDS_5];
 
         u8 padding3[2];
 } __attribute__ ((packed));
diff --git a/drivers/net/wireless/wl12xx/wl1271_main.c b/drivers/net/wireless/wl12xx/wl1271_main.c
index 27298b19d5bd..86132bb00787 100644
--- a/drivers/net/wireless/wl12xx/wl1271_main.c
+++ b/drivers/net/wireless/wl12xx/wl1271_main.c
@@ -30,7 +30,9 @@
 #include <linux/spi/spi.h>
 #include <linux/crc32.h>
 #include <linux/etherdevice.h>
+#include <linux/vmalloc.h>
 #include <linux/spi/wl12xx.h>
+#include <linux/inetdevice.h>
 
 #include "wl1271.h"
 #include "wl12xx_80211.h"
@@ -45,6 +47,308 @@
 #include "wl1271_cmd.h"
 #include "wl1271_boot.h"
 
+static struct conf_drv_settings default_conf = {
+        .sg = {
+                .per_threshold               = 7500,
+                .max_scan_compensation_time  = 120000,
+                .nfs_sample_interval         = 400,
+                .load_ratio                  = 50,
+                .auto_ps_mode                = 0,
+                .probe_req_compensation      = 170,
+                .scan_window_compensation    = 50,
+                .antenna_config              = 0,
+                .beacon_miss_threshold       = 60,
+                .rate_adaptation_threshold   = CONF_HW_BIT_RATE_12MBPS,
+                .rate_adaptation_snr         = 0
+        },
+        .rx = {
+                .rx_msdu_life_time           = 512000,
+                .packet_detection_threshold  = 0,
+                .ps_poll_timeout             = 15,
+                .upsd_timeout                = 15,
+                .rts_threshold               = 2347,
+                .rx_cca_threshold            = 0xFFEF,
+                .irq_blk_threshold           = 0,
+                .irq_pkt_threshold           = USHORT_MAX,
+                .irq_timeout                 = 5,
+                .queue_type                  = CONF_RX_QUEUE_TYPE_LOW_PRIORITY,
+        },
+        .tx = {
+                .tx_energy_detection         = 0,
+                .rc_conf                     = {
+                        .enabled_rates       = CONF_TX_RATE_MASK_UNSPECIFIED,
+                        .short_retry_limit   = 10,
+                        .long_retry_limit    = 10,
+                        .aflags              = 0
+                },
+                .ac_conf_count               = 4,
+                .ac_conf                     = {
+                        [0] = {
+                                .ac          = CONF_TX_AC_BE,
+                                .cw_min      = 15,
+                                .cw_max      = 63,
+                                .aifsn       = 3,
+                                .tx_op_limit = 0,
+                        },
+                        [1] = {
+                                .ac          = CONF_TX_AC_BK,
+                                .cw_min      = 15,
+                                .cw_max      = 63,
+                                .aifsn       = 7,
+                                .tx_op_limit = 0,
+                        },
+                        [2] = {
+                                .ac          = CONF_TX_AC_VI,
+                                .cw_min      = 15,
+                                .cw_max      = 63,
+                                .aifsn       = CONF_TX_AIFS_PIFS,
+                                .tx_op_limit = 3008,
+                        },
+                        [3] = {
+                                .ac          = CONF_TX_AC_VO,
+                                .cw_min      = 15,
+                                .cw_max      = 63,
+                                .aifsn       = CONF_TX_AIFS_PIFS,
+                                .tx_op_limit = 1504,
+                        },
+                },
+                .tid_conf_count = 7,
+                .tid_conf = {
+                        [0] = {
+                                .queue_id    = 0,
+                                .channel_type = CONF_CHANNEL_TYPE_DCF,
+                                .tsid        = CONF_TX_AC_BE,
+                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
+                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
+                                .apsd_conf   = {0, 0},
+                        },
+                        [1] = {
+                                .queue_id    = 1,
+                                .channel_type = CONF_CHANNEL_TYPE_DCF,
+                                .tsid        = CONF_TX_AC_BE,
+                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
+                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
+                                .apsd_conf   = {0, 0},
+                        },
+                        [2] = {
+                                .queue_id    = 2,
+                                .channel_type = CONF_CHANNEL_TYPE_DCF,
+                                .tsid        = CONF_TX_AC_BE,
+                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
+                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
+                                .apsd_conf   = {0, 0},
+                        },
+                        [3] = {
+                                .queue_id    = 3,
+                                .channel_type = CONF_CHANNEL_TYPE_DCF,
+                                .tsid        = CONF_TX_AC_BE,
+                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
+                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
+                                .apsd_conf   = {0, 0},
+                        },
+                        [4] = {
+                                .queue_id    = 4,
+                                .channel_type = CONF_CHANNEL_TYPE_DCF,
+                                .tsid        = CONF_TX_AC_BE,
+                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
+                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
+                                .apsd_conf   = {0, 0},
+                        },
+                        [5] = {
+                                .queue_id    = 5,
+                                .channel_type = CONF_CHANNEL_TYPE_DCF,
+                                .tsid        = CONF_TX_AC_BE,
+                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
+                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
+                                .apsd_conf   = {0, 0},
+                        },
+                        [6] = {
+                                .queue_id    = 6,
+                                .channel_type = CONF_CHANNEL_TYPE_DCF,
+                                .tsid        = CONF_TX_AC_BE,
+                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
+                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
+                                .apsd_conf   = {0, 0},
+                        }
+                },
+                .frag_threshold              = IEEE80211_MAX_FRAG_THRESHOLD,
+                .tx_compl_timeout            = 5,
+                .tx_compl_threshold          = 5
+        },
+        .conn = {
+                .wake_up_event               = CONF_WAKE_UP_EVENT_DTIM,
+                .listen_interval             = 0,
+                .bcn_filt_mode               = CONF_BCN_FILT_MODE_ENABLED,
+                .bcn_filt_ie_count           = 1,
+                .bcn_filt_ie = {
+                        [0] = {
+                                .ie          = WLAN_EID_CHANNEL_SWITCH,
+                                .rule        = CONF_BCN_RULE_PASS_ON_APPEARANCE,
+                        }
+                },
+                .synch_fail_thold            = 5,
+                .bss_lose_timeout            = 100,
+                .beacon_rx_timeout           = 10000,
+                .broadcast_timeout           = 20000,
+                .rx_broadcast_in_ps          = 1,
+                .ps_poll_threshold           = 4,
+                .sig_trigger_count           = 2,
+                .sig_trigger = {
+                        [0] = {
+                                .threshold   = -75,
+                                .pacing      = 500,
+                                .metric      = CONF_TRIG_METRIC_RSSI_BEACON,
+                                .type        = CONF_TRIG_EVENT_TYPE_EDGE,
+                                .direction   = CONF_TRIG_EVENT_DIR_LOW,
+                                .hysteresis  = 2,
+                                .index       = 0,
+                                .enable      = 1
+                        },
+                        [1] = {
+                                .threshold   = -75,
+                                .pacing      = 500,
+                                .metric      = CONF_TRIG_METRIC_RSSI_BEACON,
+                                .type        = CONF_TRIG_EVENT_TYPE_EDGE,
+                                .direction   = CONF_TRIG_EVENT_DIR_HIGH,
+                                .hysteresis  = 2,
+                                .index       = 1,
+                                .enable      = 1
+                        }
+                },
+                .sig_weights = {
+                        .rssi_bcn_avg_weight = 10,
+                        .rssi_pkt_avg_weight = 10,
+                        .snr_bcn_avg_weight  = 10,
+                        .snr_pkt_avg_weight  = 10
+                },
+                .bet_enable                  = CONF_BET_MODE_ENABLE,
+                .bet_max_consecutive         = 100
+        },
+        .init = {
+                .sr_err_tbl = {
+                        [0] = {
+                                .len         = 7,
+                                .upper_limit = 0x03,
+                                .values      = {
+                                        0x18, 0x10, 0x05, 0xfb, 0xf0, 0xe8,
+                                        0x00 }
+                        },
+                        [1] = {
+                                .len         = 7,
+                                .upper_limit = 0x03,
+                                .values      = {
+                                        0x18, 0x10, 0x05, 0xf6, 0xf0, 0xe8,
+                                        0x00 }
+                        },
+                        [2] = {
+                                .len         = 7,
+                                .upper_limit = 0x03,
+                                .values      = {
+                                        0x18, 0x10, 0x05, 0xfb, 0xf0, 0xe8,
+                                        0x00 }
+                        }
+                },
+                .sr_enable                   = 1,
+                .genparam                    = {
+                        /*
+                         * FIXME: The correct value CONF_REF_CLK_38_4_E
+                         *        causes the firmware to crash on boot.
+                         *        The value 5 apparently is an
+                         *        unnoficial XTAL configuration of the
+                         *        same frequency, which appears to work.
+                         */
+                        .ref_clk             = 5,
+                        .settling_time       = 5,
+                        .clk_valid_on_wakeup = 0,
+                        .dc2dcmode           = 0,
+                        .single_dual_band    = CONF_SINGLE_BAND,
+                        .tx_bip_fem_autodetect = 0,
+                        .tx_bip_fem_manufacturer = 1,
+                        .settings = 1,
+                },
+                .radioparam = {
+                        .rx_trace_loss       = 10,
+                        .tx_trace_loss       = 10,
+                        .rx_rssi_and_proc_compens = {
+                                0xec, 0xf6, 0x00, 0x0c, 0x18, 0xf8,
+                                0xfc, 0x00, 0x08, 0x10, 0xf0, 0xf8,
+                                0x00, 0x0a, 0x14 },
+                        .rx_trace_loss_5     = { 0, 0, 0, 0, 0, 0, 0 },
+                        .tx_trace_loss_5     = { 0, 0, 0, 0, 0, 0, 0 },
+                        .rx_rssi_and_proc_compens_5 = {
+                                0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                                0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                                0x00, 0x00, 0x00 },
+                        .tx_ref_pd_voltage   = 0x24e,
+                        .tx_ref_power        = 0x78,
+                        .tx_offset_db        = 0x0,
+                        .tx_rate_limits_normal = {
+                                0x1e, 0x1f, 0x22, 0x24, 0x28, 0x29 },
+                        .tx_rate_limits_degraded = {
+                                0x1b, 0x1c, 0x1e, 0x20, 0x24, 0x25 },
+                        .tx_channel_limits_11b = {
+                                0x22, 0x50, 0x50, 0x50, 0x50, 0x50,
+                                0x50, 0x50, 0x50, 0x50, 0x22, 0x50,
+                                0x22, 0x50 },
+                        .tx_channel_limits_ofdm = {
+                                0x20, 0x50, 0x50, 0x50, 0x50, 0x50,
+                                0x50, 0x50, 0x50, 0x50, 0x20, 0x50,
+                                0x20, 0x50 },
+                        .tx_pdv_rate_offsets = {
+                                0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
+                        .tx_ibias            = {
+                                0x1a, 0x1a, 0x1a, 0x1a, 0x1a, 0x27 },
+                        .rx_fem_insertion_loss = 0x14,
+                        .tx_ref_pd_voltage_5 = {
+                                0x0190, 0x01a4, 0x01c3, 0x01d8,
+                                0x020a, 0x021c },
+                        .tx_ref_power_5      = {
+                                0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80 },
+                        .tx_offset_db_5      = {
+                                0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
+                        .tx_rate_limits_normal_5 = {
+                                0x1b, 0x1e, 0x21, 0x23, 0x27, 0x00 },
+                        .tx_rate_limits_degraded_5 = {
+                                0x1b, 0x1e, 0x21, 0x23, 0x27, 0x00 },
+                        .tx_channel_limits_ofdm_5 = {
+                                0x50, 0x50, 0x50, 0x50, 0x50, 0x50, 0x50, 0x50,
+                                0x50, 0x50, 0x50, 0x50, 0x50, 0x50, 0x50, 0x50,
+                                0x50, 0x50, 0x50, 0x50, 0x50, 0x50, 0x50, 0x50,
+                                0x50, 0x50, 0x50, 0x50, 0x50, 0x50, 0x50, 0x50,
+                                0x50, 0x50, 0x50 },
+                        .tx_pdv_rate_offsets_5 = {
+                                0x01, 0x02, 0x02, 0x02, 0x02, 0x00 },
+                        .tx_ibias_5          = {
+                                0x10, 0x10, 0x10, 0x10, 0x10, 0x10 },
+                        .rx_fem_insertion_loss_5 = {
+                                0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10 }
+                }
+        }
+};
+
+static LIST_HEAD(wl_list);
+
+static void wl1271_conf_init(struct wl1271 *wl)
+{
+
+        /*
+         * This function applies the default configuration to the driver. This
+         * function is invoked upon driver load (spi probe.)
+         *
+         * The configuration is stored in a run-time structure in order to
+         * facilitate for run-time adjustment of any of the parameters. Making
+         * changes to the configuration structure will apply the new values on
+         * the next interface up (wl1271_op_start.)
+         */
+
+        /* apply driver default configuration */
+        memcpy(&wl->conf, &default_conf, sizeof(default_conf));
+
+        if (wl1271_11a_enabled())
+                wl->conf.init.genparam.single_dual_band = CONF_DUAL_BAND;
+}
+
+
 static int wl1271_plt_init(struct wl1271 *wl)
 {
         int ret;
@@ -75,20 +379,14 @@ static void wl1271_power_on(struct wl1271 *wl)
         wl->set_power(true);
 }
 
-static void wl1271_fw_status(struct wl1271 *wl, struct wl1271_fw_status *status)
+static void wl1271_fw_status(struct wl1271 *wl,
+                             struct wl1271_fw_status *status)
 {
         u32 total = 0;
         int i;
 
-        /*
-         * FIXME: Reading the FW status directly from the registers seems to
-         * be the right thing to do, but it doesn't work.  And in the
-         * reference driver, there is a workaround called
-         * USE_SDIO_24M_WORKAROUND, which reads the status from memory
-         * instead, so we do the same here.
-         */
-
-        wl1271_spi_mem_read(wl, STATUS_MEM_ADDRESS, status, sizeof(*status));
+        wl1271_spi_read(wl, FW_STATUS_ADDR, status,
+                        sizeof(*status), false);
 
         wl1271_debug(DEBUG_IRQ, "intr: 0x%x (fw_rx_counter = %d, "
                      "drv_rx_counter = %d, tx_results_counter = %d)",
@@ -99,25 +397,28 @@ static void wl1271_fw_status(struct wl1271 *wl, struct wl1271_fw_status *status)
 
         /* update number of available TX blocks */
         for (i = 0; i < NUM_TX_QUEUES; i++) {
-                u32 cnt = status->tx_released_blks[i] - wl->tx_blocks_freed[i];
-                wl->tx_blocks_freed[i] = status->tx_released_blks[i];
+                u32 cnt = le32_to_cpu(status->tx_released_blks[i]) -
+                        wl->tx_blocks_freed[i];
+
+                wl->tx_blocks_freed[i] =
+                        le32_to_cpu(status->tx_released_blks[i]);
                 wl->tx_blocks_available += cnt;
                 total += cnt;
         }
 
         /* if more blocks are available now, schedule some tx work */
         if (total && !skb_queue_empty(&wl->tx_queue))
-                schedule_work(&wl->tx_work);
+                ieee80211_queue_work(wl->hw, &wl->tx_work);
 
         /* update the host-chipset time offset */
-        wl->time_offset = jiffies_to_usecs(jiffies) - status->fw_localtime;
+        wl->time_offset = jiffies_to_usecs(jiffies) -
+                le32_to_cpu(status->fw_localtime);
 }
 
-#define WL1271_IRQ_MAX_LOOPS 10
 static void wl1271_irq_work(struct work_struct *work)
 {
-        u32 intr, ctr = WL1271_IRQ_MAX_LOOPS;
         int ret;
+        u32 intr;
         struct wl1271 *wl =
                 container_of(work, struct wl1271, irq_work);
 
@@ -132,9 +433,10 @@ static void wl1271_irq_work(struct work_struct *work)
         if (ret < 0)
                 goto out;
 
-        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_MASK, WL1271_ACX_INTR_ALL);
+        wl1271_spi_write32(wl, ACX_REG_INTERRUPT_MASK, WL1271_ACX_INTR_ALL);
 
-        intr = wl1271_reg_read32(wl, ACX_REG_INTERRUPT_CLEAR);
+        wl1271_fw_status(wl, wl->fw_status);
+        intr = le32_to_cpu(wl->fw_status->intr);
         if (!intr) {
                 wl1271_debug(DEBUG_IRQ, "Zero interrupt received.");
                 goto out_sleep;
@@ -142,46 +444,39 @@ static void wl1271_irq_work(struct work_struct *work)
 
         intr &= WL1271_INTR_MASK;
 
-        do {
-                wl1271_fw_status(wl, wl->fw_status);
-
-
-                if (intr & (WL1271_ACX_INTR_EVENT_A |
-                            WL1271_ACX_INTR_EVENT_B)) {
-                        wl1271_debug(DEBUG_IRQ,
-                                     "WL1271_ACX_INTR_EVENT (0x%x)", intr);
-                        if (intr & WL1271_ACX_INTR_EVENT_A)
-                                wl1271_event_handle(wl, 0);
-                        else
-                                wl1271_event_handle(wl, 1);
-                }
+        if (intr & WL1271_ACX_INTR_EVENT_A) {
+                bool do_ack = (intr & WL1271_ACX_INTR_EVENT_B) ? false : true;
+                wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_EVENT_A");
+                wl1271_event_handle(wl, 0, do_ack);
+        }
 
-                if (intr & WL1271_ACX_INTR_INIT_COMPLETE)
-                        wl1271_debug(DEBUG_IRQ,
-                                     "WL1271_ACX_INTR_INIT_COMPLETE");
+        if (intr & WL1271_ACX_INTR_EVENT_B) {
+                wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_EVENT_B");
+                wl1271_event_handle(wl, 1, true);
+        }
 
-                if (intr & WL1271_ACX_INTR_HW_AVAILABLE)
-                        wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_HW_AVAILABLE");
+        if (intr & WL1271_ACX_INTR_INIT_COMPLETE)
+                wl1271_debug(DEBUG_IRQ,
+                             "WL1271_ACX_INTR_INIT_COMPLETE");
 
-                if (intr & WL1271_ACX_INTR_DATA) {
-                        u8 tx_res_cnt = wl->fw_status->tx_results_counter -
-                                wl->tx_results_count;
+        if (intr & WL1271_ACX_INTR_HW_AVAILABLE)
+                wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_HW_AVAILABLE");
 
-                        wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_DATA");
+        if (intr & WL1271_ACX_INTR_DATA) {
+                u8 tx_res_cnt = wl->fw_status->tx_results_counter -
+                        wl->tx_results_count;
 
-                        /* check for tx results */
-                        if (tx_res_cnt)
-                                wl1271_tx_complete(wl, tx_res_cnt);
+                wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_DATA");
 
-                        wl1271_rx(wl, wl->fw_status);
-                }
+                /* check for tx results */
+                if (tx_res_cnt)
+                        wl1271_tx_complete(wl, tx_res_cnt);
 
-                intr = wl1271_reg_read32(wl, ACX_REG_INTERRUPT_CLEAR);
-                intr &= WL1271_INTR_MASK;
-        } while (intr && --ctr);
+                wl1271_rx(wl, wl->fw_status);
+        }
 
 out_sleep:
-        wl1271_reg_write32(wl, ACX_REG_INTERRUPT_MASK,
+        wl1271_spi_write32(wl, ACX_REG_INTERRUPT_MASK,
                            WL1271_ACX_INTR_ALL & ~(WL1271_INTR_MASK));
         wl1271_ps_elp_sleep(wl);
 
@@ -205,7 +500,7 @@ static irqreturn_t wl1271_irq(int irq, void *cookie)
                 wl->elp_compl = NULL;
         }
 
-        schedule_work(&wl->irq_work);
+        ieee80211_queue_work(wl->hw, &wl->irq_work);
         spin_unlock_irqrestore(&wl->wl_lock, flags);
 
         return IRQ_HANDLED;
@@ -231,7 +526,7 @@ static int wl1271_fetch_firmware(struct wl1271 *wl)
         }
 
         wl->fw_len = fw->size;
-        wl->fw = kmalloc(wl->fw_len, GFP_KERNEL);
+        wl->fw = vmalloc(wl->fw_len);
 
         if (!wl->fw) {
                 wl1271_error("could not allocate memory for the firmware");
@@ -292,7 +587,7 @@ static void wl1271_fw_wakeup(struct wl1271 *wl)
         u32 elp_reg;
 
         elp_reg = ELPCTRL_WAKE_UP;
-        wl1271_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, elp_reg);
+        wl1271_raw_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, elp_reg);
 }
 
 static int wl1271_setup(struct wl1271 *wl)
@@ -314,6 +609,7 @@ static int wl1271_setup(struct wl1271 *wl)
 
 static int wl1271_chip_wakeup(struct wl1271 *wl)
 {
+        struct wl1271_partition_set partition;
         int ret = 0;
 
         wl1271_power_on(wl);
@@ -323,11 +619,10 @@ static int wl1271_chip_wakeup(struct wl1271 *wl)
 
         /* We don't need a real memory partition here, because we only want
          * to use the registers at this point. */
-        wl1271_set_partition(wl,
-                             0x00000000,
-                             0x00000000,
-                             REGISTERS_BASE,
-                             REGISTERS_DOWN_SIZE);
+        memset(&partition, 0, sizeof(partition));
+        partition.reg.start = REGISTERS_BASE;
+        partition.reg.size = REGISTERS_DOWN_SIZE;
+        wl1271_set_partition(wl, &partition);
 
         /* ELP module wake up */
         wl1271_fw_wakeup(wl);
@@ -335,7 +630,7 @@ static int wl1271_chip_wakeup(struct wl1271 *wl)
         /* whal_FwCtrl_BootSm() */
 
         /* 0. read chip id from CHIP_ID */
-        wl->chip.id = wl1271_reg_read32(wl, CHIP_ID_B);
+        wl->chip.id = wl1271_spi_read32(wl, CHIP_ID_B);
 
         /* 1. check if chip id is valid */
 
@@ -346,7 +641,7 @@ static int wl1271_chip_wakeup(struct wl1271 *wl)
 
                 ret = wl1271_setup(wl);
                 if (ret < 0)
-                        goto out;
+                        goto out_power_off;
                 break;
         case CHIP_ID_1271_PG20:
                 wl1271_debug(DEBUG_BOOT, "chip id 0x%x (1271 PG20)",
@@ -354,56 +649,34 @@ static int wl1271_chip_wakeup(struct wl1271 *wl)
 
                 ret = wl1271_setup(wl);
                 if (ret < 0)
-                        goto out;
+                        goto out_power_off;
                 break;
         default:
                 wl1271_error("unsupported chip id: 0x%x", wl->chip.id);
                 ret = -ENODEV;
-                goto out;
+                goto out_power_off;
         }
 
         if (wl->fw == NULL) {
                 ret = wl1271_fetch_firmware(wl);
                 if (ret < 0)
-                        goto out;
+                        goto out_power_off;
         }
 
         /* No NVS from netlink, try to get it from the filesystem */
         if (wl->nvs == NULL) {
                 ret = wl1271_fetch_nvs(wl);
                 if (ret < 0)
-                        goto out;
+                        goto out_power_off;
         }
 
-out:
-        return ret;
-}
-
-static void wl1271_filter_work(struct work_struct *work)
-{
-        struct wl1271 *wl =
-                container_of(work, struct wl1271, filter_work);
-        int ret;
-
-        mutex_lock(&wl->mutex);
-
-        if (wl->state == WL1271_STATE_OFF)
-                goto out;
-
-        ret = wl1271_ps_elp_wakeup(wl, false);
-        if (ret < 0)
-                goto out;
-
-        /* FIXME: replace the magic numbers with proper definitions */
-        ret = wl1271_cmd_join(wl, wl->bss_type, 1, 100, 0);
-        if (ret < 0)
-                goto out_sleep;
+        goto out;
 
-out_sleep:
-        wl1271_ps_elp_sleep(wl);
+out_power_off:
+        wl1271_power_off(wl);
 
 out:
-        mutex_unlock(&wl->mutex);
+        return ret;
 }
 
 int wl1271_plt_start(struct wl1271 *wl)
@@ -429,13 +702,26 @@ int wl1271_plt_start(struct wl1271 *wl)
 
         ret = wl1271_boot(wl);
         if (ret < 0)
-                goto out;
+                goto out_power_off;
 
         wl1271_notice("firmware booted in PLT mode (%s)", wl->chip.fw_ver);
 
         ret = wl1271_plt_init(wl);
         if (ret < 0)
-                goto out;
+                goto out_irq_disable;
+
+        /* Make sure power saving is disabled */
+        ret = wl1271_acx_sleep_auth(wl, WL1271_PSM_CAM);
+        if (ret < 0)
+                goto out_irq_disable;
+
+        goto out;
+
+out_irq_disable:
+        wl1271_disable_interrupts(wl);
+
+out_power_off:
+        wl1271_power_off(wl);
 
 out:
         mutex_unlock(&wl->mutex);
@@ -462,6 +748,7 @@ int wl1271_plt_stop(struct wl1271 *wl)
         wl1271_power_off(wl);
 
         wl->state = WL1271_STATE_OFF;
+        wl->rx_counter = 0;
 
 out:
         mutex_unlock(&wl->mutex);
@@ -481,7 +768,7 @@ static int wl1271_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
          * before that, the tx_work will not be initialized!
          */
 
-        schedule_work(&wl->tx_work);
+        ieee80211_queue_work(wl->hw, &wl->tx_work);
 
         /*
          * The workqueue is slow to process the tx_queue and we need stop
@@ -501,6 +788,93 @@ static int wl1271_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         return NETDEV_TX_OK;
 }
 
+static int wl1271_dev_notify(struct notifier_block *me, unsigned long what,
+                             void *arg)
+{
+        struct net_device *dev;
+        struct wireless_dev *wdev;
+        struct wiphy *wiphy;
+        struct ieee80211_hw *hw;
+        struct wl1271 *wl;
+        struct wl1271 *wl_temp;
+        struct in_device *idev;
+        struct in_ifaddr *ifa = arg;
+        int ret = 0;
+
+        /* FIXME: this ugly function should probably be implemented in the
+         * mac80211, and here should only be a simple callback handling actual
+         * setting of the filters. Now we need to dig up references to
+         * various structures to gain access to what we need.
+         * Also, because of this, there is no "initial" setting of the filter
+         * in "op_start", because we don't want to dig up struct net_device
+         * there - the filter will be set upon first change of the interface
+         * IP address. */
+
+        dev = ifa->ifa_dev->dev;
+
+        wdev = dev->ieee80211_ptr;
+        if (wdev == NULL)
+                return -ENODEV;
+
+        wiphy = wdev->wiphy;
+        if (wiphy == NULL)
+                return -ENODEV;
+
+        hw = wiphy_priv(wiphy);
+        if (hw == NULL)
+                return -ENODEV;
+
+        /* Check that the interface is one supported by this driver. */
+        wl_temp = hw->priv;
+        list_for_each_entry(wl, &wl_list, list) {
+                if (wl == wl_temp)
+                        break;
+        }
+        if (wl == NULL)
+                return -ENODEV;
+
+        /* Get the interface IP address for the device. "ifa" will become
+           NULL if:
+             - there is no IPV4 protocol address configured
+             - there are multiple (virtual) IPV4 addresses configured
+           When "ifa" is NULL, filtering will be disabled.
+        */
+        ifa = NULL;
+        idev = dev->ip_ptr;
+        if (idev)
+                ifa = idev->ifa_list;
+
+        if (ifa && ifa->ifa_next)
+                ifa = NULL;
+
+        mutex_lock(&wl->mutex);
+
+        if (wl->state == WL1271_STATE_OFF)
+                goto out;
+
+        ret = wl1271_ps_elp_wakeup(wl, false);
+        if (ret < 0)
+                goto out;
+        if (ifa)
+                ret = wl1271_acx_arp_ip_filter(wl, true,
+                                               (u8 *)&ifa->ifa_address,
+                                               ACX_IPV4_VERSION);
+        else
+                ret = wl1271_acx_arp_ip_filter(wl, false, NULL,
+                                               ACX_IPV4_VERSION);
+        wl1271_ps_elp_sleep(wl);
+
+out:
+        mutex_unlock(&wl->mutex);
+
+        return ret;
+}
+
+static struct notifier_block wl1271_dev_notifier = {
+        .notifier_call = wl1271_dev_notify,
+};
+
+
 static int wl1271_op_start(struct ieee80211_hw *hw)
 {
         struct wl1271 *wl = hw->priv;
@@ -523,22 +897,32 @@ static int wl1271_op_start(struct ieee80211_hw *hw)
 
         ret = wl1271_boot(wl);
         if (ret < 0)
-                goto out;
+                goto out_power_off;
 
         ret = wl1271_hw_init(wl);
         if (ret < 0)
-                goto out;
+                goto out_irq_disable;
 
         wl->state = WL1271_STATE_ON;
 
         wl1271_info("firmware booted (%s)", wl->chip.fw_ver);
 
-out:
-        if (ret < 0)
-                wl1271_power_off(wl);
+        goto out;
+
+out_irq_disable:
+        wl1271_disable_interrupts(wl);
 
+out_power_off:
+        wl1271_power_off(wl);
+
+out:
         mutex_unlock(&wl->mutex);
 
+        if (!ret) {
+                list_add(&wl->list, &wl_list);
+                register_inetaddr_notifier(&wl1271_dev_notifier);
+        }
+
         return ret;
 }
 
@@ -551,6 +935,9 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 stop");
 
+        unregister_inetaddr_notifier(&wl1271_dev_notifier);
+        list_del(&wl->list);
+
         mutex_lock(&wl->mutex);
 
         WARN_ON(wl->state != WL1271_STATE_ON);
@@ -570,7 +957,6 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
 
         cancel_work_sync(&wl->irq_work);
         cancel_work_sync(&wl->tx_work);
-        cancel_work_sync(&wl->filter_work);
 
         mutex_lock(&wl->mutex);
 
@@ -581,8 +967,8 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
         memset(wl->bssid, 0, ETH_ALEN);
         memset(wl->ssid, 0, IW_ESSID_MAX_SIZE + 1);
         wl->ssid_len = 0;
-        wl->listen_int = 1;
         wl->bss_type = MAX_BSS_TYPE;
+        wl->band = IEEE80211_BAND_2GHZ;
 
         wl->rx_counter = 0;
         wl->elp = false;
@@ -592,8 +978,13 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
         wl->tx_blocks_available = 0;
         wl->tx_results_count = 0;
         wl->tx_packets_count = 0;
+        wl->tx_security_last_seq = 0;
+        wl->tx_security_seq_16 = 0;
+        wl->tx_security_seq_32 = 0;
         wl->time_offset = 0;
         wl->session_counter = 0;
+        wl->joined = false;
+
         for (i = 0; i < NUM_TX_QUEUES; i++)
                 wl->tx_blocks_freed[i] = 0;
 
@@ -611,6 +1002,12 @@ static int wl1271_op_add_interface(struct ieee80211_hw *hw,
                      conf->type, conf->mac_addr);
 
         mutex_lock(&wl->mutex);
+        if (wl->vif) {
+                ret = -EBUSY;
+                goto out;
+        }
+
+        wl->vif = conf->vif;
 
         switch (conf->type) {
         case NL80211_IFTYPE_STATION:
@@ -634,7 +1031,12 @@ out:
 static void wl1271_op_remove_interface(struct ieee80211_hw *hw,
                                          struct ieee80211_if_init_conf *conf)
 {
+        struct wl1271 *wl = hw->priv;
+
+        mutex_lock(&wl->mutex);
         wl1271_debug(DEBUG_MAC80211, "mac80211 remove interface");
+        wl->vif = NULL;
+        mutex_unlock(&wl->mutex);
 }
 
 #if 0
@@ -657,7 +1059,15 @@ static int wl1271_op_config_interface(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out;
 
-        memcpy(wl->bssid, conf->bssid, ETH_ALEN);
+        if (memcmp(wl->bssid, conf->bssid, ETH_ALEN)) {
+                wl1271_debug(DEBUG_MAC80211, "bssid changed");
+
+                memcpy(wl->bssid, conf->bssid, ETH_ALEN);
+
+                ret = wl1271_cmd_join(wl);
+                if (ret < 0)
+                        goto out_sleep;
+        }
 
         ret = wl1271_cmd_build_null_data(wl);
         if (ret < 0)
@@ -667,13 +1077,6 @@ static int wl1271_op_config_interface(struct ieee80211_hw *hw,
         if (wl->ssid_len)
                 memcpy(wl->ssid, conf->ssid, wl->ssid_len);
 
-        if (wl->bss_type != BSS_TYPE_IBSS) {
-                /* FIXME: replace the magic numbers with proper definitions */
-                ret = wl1271_cmd_join(wl, wl->bss_type, 5, 100, 1);
-                if (ret < 0)
-                        goto out_sleep;
-        }
-
         if (conf->changed & IEEE80211_IFCC_BEACON) {
                 beacon = ieee80211_beacon_get(hw, vif);
                 ret = wl1271_cmd_template_set(wl, CMD_TEMPL_BEACON,
@@ -691,12 +1094,6 @@ static int wl1271_op_config_interface(struct ieee80211_hw *hw,
 
                 if (ret < 0)
                         goto out_sleep;
-
-                /* FIXME: replace the magic numbers with proper definitions */
-                ret = wl1271_cmd_join(wl, wl->bss_type, 1, 100, 0);
-
-                if (ret < 0)
-                        goto out_sleep;
         }
 
 out_sleep:
@@ -724,20 +1121,20 @@ static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
 
         mutex_lock(&wl->mutex);
 
+        wl->band = conf->channel->band;
+
         ret = wl1271_ps_elp_wakeup(wl, false);
         if (ret < 0)
                 goto out;
 
         if (channel != wl->channel) {
-                u8 old_channel = wl->channel;
+                /*
+                 * We assume that the stack will configure the right channel
+                 * before associating, so we don't need to send a join
+                 * command here.  We will join the right channel when the
+                 * BSSID changes
+                 */
                 wl->channel = channel;
-
-                /* FIXME: use beacon interval provided by mac80211 */
-                ret = wl1271_cmd_join(wl, wl->bss_type, 1, 100, 0);
-                if (ret < 0) {
-                        wl->channel = old_channel;
-                        goto out_sleep;
-                }
         }
 
         ret = wl1271_cmd_build_null_data(wl);
@@ -782,6 +1179,45 @@ out:
         return ret;
 }
 
+struct wl1271_filter_params {
+        bool enabled;
+        int mc_list_length;
+        u8 mc_list[ACX_MC_ADDRESS_GROUP_MAX][ETH_ALEN];
+};
+
+static u64 wl1271_op_prepare_multicast(struct ieee80211_hw *hw, int mc_count,
+                                       struct dev_addr_list *mc_list)
+{
+        struct wl1271_filter_params *fp;
+        int i;
+
+        fp = kzalloc(sizeof(*fp), GFP_ATOMIC);
+        if (!fp) {
+                wl1271_error("Out of memory setting filters.");
+                return 0;
+        }
+
+        /* update multicast filtering parameters */
+        fp->enabled = true;
+        if (mc_count > ACX_MC_ADDRESS_GROUP_MAX) {
+                mc_count = 0;
+                fp->enabled = false;
+        }
+
+        fp->mc_list_length = 0;
+        for (i = 0; i < mc_count; i++) {
+                if (mc_list->da_addrlen == ETH_ALEN) {
+                        memcpy(fp->mc_list[fp->mc_list_length],
+                               mc_list->da_addr, ETH_ALEN);
+                        fp->mc_list_length++;
+                } else
+                        wl1271_warning("Unknown mc address length.");
+                mc_list = mc_list->next;
+        }
+
+        return (u64)(unsigned long)fp;
+}
+
 #define WL1271_SUPPORTED_FILTERS (FIF_PROMISC_IN_BSS | \
                                   FIF_ALLMULTI | \
                                   FIF_FCSFAIL | \
@@ -791,28 +1227,53 @@ out:
 
 static void wl1271_op_configure_filter(struct ieee80211_hw *hw,
                                        unsigned int changed,
-                                       unsigned int *total,u64 multicast)
+                                       unsigned int *total, u64 multicast)
 {
+        struct wl1271_filter_params *fp = (void *)(unsigned long)multicast;
         struct wl1271 *wl = hw->priv;
+        int ret;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 configure filter");
 
+        mutex_lock(&wl->mutex);
+
+        if (wl->state == WL1271_STATE_OFF)
+                goto out;
+
+        ret = wl1271_ps_elp_wakeup(wl, false);
+        if (ret < 0)
+                goto out;
+
         *total &= WL1271_SUPPORTED_FILTERS;
         changed &= WL1271_SUPPORTED_FILTERS;
 
+        if (*total & FIF_ALLMULTI)
+                ret = wl1271_acx_group_address_tbl(wl, false, NULL, 0);
+        else if (fp)
+                ret = wl1271_acx_group_address_tbl(wl, fp->enabled,
+                                                   fp->mc_list,
+                                                   fp->mc_list_length);
+        if (ret < 0)
+                goto out_sleep;
+
+        kfree(fp);
+
+        /* FIXME: We still need to set our filters properly */
+
+        /* determine, whether supported filter values have changed */
         if (changed == 0)
-                return;
+                goto out_sleep;
 
-        /* FIXME: wl->rx_config and wl->rx_filter are not protected */
-        wl->rx_config = WL1271_DEFAULT_RX_CONFIG;
-        wl->rx_filter = WL1271_DEFAULT_RX_FILTER;
+        /* apply configured filters */
+        ret = wl1271_acx_rx_config(wl, wl->rx_config, wl->rx_filter);
+        if (ret < 0)
+                goto out_sleep;
 
-        /*
-         * FIXME: workqueues need to be properly cancelled on stop(), for
-         * now let's just disable changing the filter settings. They will
-         * be updated any on config().
-         */
-        /* schedule_work(&wl->filter_work); */
+out_sleep:
+        wl1271_ps_elp_sleep(wl);
+
+out:
+        mutex_unlock(&wl->mutex);
 }
 
 static int wl1271_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
@@ -823,6 +1284,8 @@ static int wl1271_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         struct wl1271 *wl = hw->priv;
         const u8 *addr;
         int ret;
+        u32 tx_seq_32 = 0;
+        u16 tx_seq_16 = 0;
         u8 key_type;
 
         static const u8 bcast_addr[ETH_ALEN] =
@@ -861,11 +1324,15 @@ static int wl1271_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 key_type = KEY_TKIP;
 
                 key_conf->hw_key_idx = key_conf->keyidx;
+                tx_seq_32 = wl->tx_security_seq_32;
+                tx_seq_16 = wl->tx_security_seq_16;
                 break;
         case ALG_CCMP:
                 key_type = KEY_AES;
 
                 key_conf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
+                tx_seq_32 = wl->tx_security_seq_32;
+                tx_seq_16 = wl->tx_security_seq_16;
                 break;
         default:
                 wl1271_error("Unknown key algo 0x%x", key_conf->alg);
@@ -879,7 +1346,7 @@ static int wl1271_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 ret = wl1271_cmd_set_key(wl, KEY_ADD_OR_REPLACE,
                                          key_conf->keyidx, key_type,
                                          key_conf->keylen, key_conf->key,
-                                         addr);
+                                         addr, tx_seq_32, tx_seq_16);
                 if (ret < 0) {
                         wl1271_error("Could not add or replace key");
                         goto out_sleep;
@@ -890,7 +1357,7 @@ static int wl1271_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 ret = wl1271_cmd_set_key(wl, KEY_REMOVE,
                                          key_conf->keyidx, key_type,
                                          key_conf->keylen, key_conf->key,
-                                         addr);
+                                         addr, 0, 0);
                 if (ret < 0) {
                         wl1271_error("Could not remove key");
                         goto out_sleep;
@@ -921,13 +1388,13 @@ static int wl1271_op_hw_scan(struct ieee80211_hw *hw,
         struct wl1271 *wl = hw->priv;
         int ret;
         u8 *ssid = NULL;
-        size_t ssid_len = 0;
+        size_t len = 0;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 hw scan");
 
         if (req->n_ssids) {
                 ssid = req->ssids[0].ssid;
-                ssid_len = req->ssids[0].ssid_len;
+                len = req->ssids[0].ssid_len;
         }
 
         mutex_lock(&wl->mutex);
@@ -936,7 +1403,12 @@ static int wl1271_op_hw_scan(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out;
 
-        ret = wl1271_cmd_scan(hw->priv, ssid, ssid_len, 1, 0, 13, 3);
+        if (wl1271_11a_enabled())
+                ret = wl1271_cmd_scan(hw->priv, ssid, len, 1, 0,
+                                      WL1271_SCAN_BAND_DUAL, 3);
+        else
+                ret = wl1271_cmd_scan(hw->priv, ssid, len, 1, 0,
+                                      WL1271_SCAN_BAND_2_4_GHZ, 3);
 
         wl1271_ps_elp_sleep(wl);
 
@@ -969,6 +1441,22 @@ out:
         return ret;
 }
 
+static u32 wl1271_enabled_rates_get(struct wl1271 *wl, u64 basic_rate_set)
+{
+        struct ieee80211_supported_band *band;
+        u32 enabled_rates = 0;
+        int bit;
+
+        band = wl->hw->wiphy->bands[wl->band];
+        for (bit = 0; bit < band->n_bitrates; bit++) {
+                if (basic_rate_set & 0x1)
+                        enabled_rates |= band->bitrates[bit].hw_value;
+                basic_rate_set >>= 1;
+        }
+
+        return enabled_rates;
+}
+
 static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                                        struct ieee80211_vif *vif,
                                        struct ieee80211_bss_conf *bss_conf,
@@ -990,6 +1478,12 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                 if (bss_conf->assoc) {
                         wl->aid = bss_conf->aid;
 
+                        /*
+                         * with wl1271, we don't need to update the
+                         * beacon_int and dtim_period, because the firmware
+                         * updates it by itself when the first beacon is
+                         * received after a join.
+                         */
                         ret = wl1271_cmd_build_ps_poll(wl, wl->aid);
                         if (ret < 0)
                                 goto out_sleep;
@@ -1005,8 +1499,14 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                                 if (ret < 0)
                                         goto out_sleep;
                         }
+                } else {
+                        /* use defaults when not associated */
+                        wl->basic_rate_set = WL1271_DEFAULT_BASIC_RATE_SET;
+                        wl->aid = 0;
                 }
+
         }
+
         if (changed & BSS_CHANGED_ERP_SLOT) {
                 if (bss_conf->use_short_slot)
                         ret = wl1271_acx_slot(wl, SLOT_TIME_SHORT);
@@ -1036,6 +1536,17 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                 }
         }
 
+        if (changed & BSS_CHANGED_BASIC_RATES) {
+                wl->basic_rate_set = wl1271_enabled_rates_get(
+                        wl, bss_conf->basic_rates);
+
+                ret = wl1271_acx_rate_policies(wl, wl->basic_rate_set);
+                if (ret < 0) {
+                        wl1271_warning("Set rate policies failed %d", ret);
+                        goto out_sleep;
+                }
+        }
+
 out_sleep:
         wl1271_ps_elp_sleep(wl);
 
@@ -1047,44 +1558,44 @@ out:
 /* can't be const, mac80211 writes to this */
 static struct ieee80211_rate wl1271_rates[] = {
         { .bitrate = 10,
-          .hw_value = 0x1,
-          .hw_value_short = 0x1, },
+          .hw_value = CONF_HW_BIT_RATE_1MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_1MBPS, },
         { .bitrate = 20,
-          .hw_value = 0x2,
-          .hw_value_short = 0x2,
+          .hw_value = CONF_HW_BIT_RATE_2MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_2MBPS,
           .flags = IEEE80211_RATE_SHORT_PREAMBLE },
         { .bitrate = 55,
-          .hw_value = 0x4,
-          .hw_value_short = 0x4,
+          .hw_value = CONF_HW_BIT_RATE_5_5MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_5_5MBPS,
           .flags = IEEE80211_RATE_SHORT_PREAMBLE },
         { .bitrate = 110,
-          .hw_value = 0x20,
-          .hw_value_short = 0x20,
+          .hw_value = CONF_HW_BIT_RATE_11MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_11MBPS,
           .flags = IEEE80211_RATE_SHORT_PREAMBLE },
         { .bitrate = 60,
-          .hw_value = 0x8,
-          .hw_value_short = 0x8, },
+          .hw_value = CONF_HW_BIT_RATE_6MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_6MBPS, },
         { .bitrate = 90,
-          .hw_value = 0x10,
-          .hw_value_short = 0x10, },
+          .hw_value = CONF_HW_BIT_RATE_9MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_9MBPS, },
         { .bitrate = 120,
-          .hw_value = 0x40,
-          .hw_value_short = 0x40, },
+          .hw_value = CONF_HW_BIT_RATE_12MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_12MBPS, },
         { .bitrate = 180,
-          .hw_value = 0x80,
-          .hw_value_short = 0x80, },
+          .hw_value = CONF_HW_BIT_RATE_18MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_18MBPS, },
         { .bitrate = 240,
-          .hw_value = 0x200,
-          .hw_value_short = 0x200, },
+          .hw_value = CONF_HW_BIT_RATE_24MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_24MBPS, },
         { .bitrate = 360,
-         .hw_value = 0x400,
-         .hw_value_short = 0x400, },
+         .hw_value = CONF_HW_BIT_RATE_36MBPS,
+         .hw_value_short = CONF_HW_BIT_RATE_36MBPS, },
         { .bitrate = 480,
-          .hw_value = 0x800,
-          .hw_value_short = 0x800, },
+          .hw_value = CONF_HW_BIT_RATE_48MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_48MBPS, },
         { .bitrate = 540,
-          .hw_value = 0x1000,
-          .hw_value_short = 0x1000, },
+          .hw_value = CONF_HW_BIT_RATE_54MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_54MBPS, },
 };
 
 /* can't be const, mac80211 writes to this */
@@ -1112,6 +1623,88 @@ static struct ieee80211_supported_band wl1271_band_2ghz = {
         .n_bitrates = ARRAY_SIZE(wl1271_rates),
 };
 
+/* 5 GHz data rates for WL1273 */
+static struct ieee80211_rate wl1271_rates_5ghz[] = {
+        { .bitrate = 60,
+          .hw_value = CONF_HW_BIT_RATE_6MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_6MBPS, },
+        { .bitrate = 90,
+          .hw_value = CONF_HW_BIT_RATE_9MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_9MBPS, },
+        { .bitrate = 120,
+          .hw_value = CONF_HW_BIT_RATE_12MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_12MBPS, },
+        { .bitrate = 180,
+          .hw_value = CONF_HW_BIT_RATE_18MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_18MBPS, },
+        { .bitrate = 240,
+          .hw_value = CONF_HW_BIT_RATE_24MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_24MBPS, },
+        { .bitrate = 360,
+         .hw_value = CONF_HW_BIT_RATE_36MBPS,
+         .hw_value_short = CONF_HW_BIT_RATE_36MBPS, },
+        { .bitrate = 480,
+          .hw_value = CONF_HW_BIT_RATE_48MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_48MBPS, },
+        { .bitrate = 540,
+          .hw_value = CONF_HW_BIT_RATE_54MBPS,
+          .hw_value_short = CONF_HW_BIT_RATE_54MBPS, },
+};
+
+/* 5 GHz band channels for WL1273 */
+static struct ieee80211_channel wl1271_channels_5ghz[] = {
+        { .hw_value = 183, .center_freq = 4915},
+        { .hw_value = 184, .center_freq = 4920},
+        { .hw_value = 185, .center_freq = 4925},
+        { .hw_value = 187, .center_freq = 4935},
+        { .hw_value = 188, .center_freq = 4940},
+        { .hw_value = 189, .center_freq = 4945},
+        { .hw_value = 192, .center_freq = 4960},
+        { .hw_value = 196, .center_freq = 4980},
+        { .hw_value = 7, .center_freq = 5035},
+        { .hw_value = 8, .center_freq = 5040},
+        { .hw_value = 9, .center_freq = 5045},
+        { .hw_value = 11, .center_freq = 5055},
+        { .hw_value = 12, .center_freq = 5060},
+        { .hw_value = 16, .center_freq = 5080},
+        { .hw_value = 34, .center_freq = 5170},
+        { .hw_value = 36, .center_freq = 5180},
+        { .hw_value = 38, .center_freq = 5190},
+        { .hw_value = 40, .center_freq = 5200},
+        { .hw_value = 42, .center_freq = 5210},
+        { .hw_value = 44, .center_freq = 5220},
+        { .hw_value = 46, .center_freq = 5230},
+        { .hw_value = 48, .center_freq = 5240},
+        { .hw_value = 52, .center_freq = 5260},
+        { .hw_value = 56, .center_freq = 5280},
+        { .hw_value = 60, .center_freq = 5300},
+        { .hw_value = 64, .center_freq = 5320},
+        { .hw_value = 100, .center_freq = 5500},
+        { .hw_value = 104, .center_freq = 5520},
+        { .hw_value = 108, .center_freq = 5540},
+        { .hw_value = 112, .center_freq = 5560},
+        { .hw_value = 116, .center_freq = 5580},
+        { .hw_value = 120, .center_freq = 5600},
+        { .hw_value = 124, .center_freq = 5620},
+        { .hw_value = 128, .center_freq = 5640},
+        { .hw_value = 132, .center_freq = 5660},
+        { .hw_value = 136, .center_freq = 5680},
+        { .hw_value = 140, .center_freq = 5700},
+        { .hw_value = 149, .center_freq = 5745},
+        { .hw_value = 153, .center_freq = 5765},
+        { .hw_value = 157, .center_freq = 5785},
+        { .hw_value = 161, .center_freq = 5805},
+        { .hw_value = 165, .center_freq = 5825},
+};
+
+
+static struct ieee80211_supported_band wl1271_band_5ghz = {
+        .channels = wl1271_channels_5ghz,
+        .n_channels = ARRAY_SIZE(wl1271_channels_5ghz),
+        .bitrates = wl1271_rates_5ghz,
+        .n_bitrates = ARRAY_SIZE(wl1271_rates_5ghz),
+};
+
 static const struct ieee80211_ops wl1271_ops = {
         .start = wl1271_op_start,
         .stop = wl1271_op_stop,
@@ -1119,6 +1712,7 @@ static const struct ieee80211_ops wl1271_ops = {
         .remove_interface = wl1271_op_remove_interface,
         .config = wl1271_op_config,
 /*      .config_interface = wl1271_op_config_interface, */
+        .prepare_multicast = wl1271_op_prepare_multicast,
         .configure_filter = wl1271_op_configure_filter,
         .tx = wl1271_op_tx,
         .set_key = wl1271_op_set_key,
@@ -1151,24 +1745,25 @@ static int wl1271_register_hw(struct wl1271 *wl)
 
 static int wl1271_init_ieee80211(struct wl1271 *wl)
 {
-        /*
-         * The tx descriptor buffer and the TKIP space.
-         *
-         * FIXME: add correct 1271 descriptor size
-         */
-        wl->hw->extra_tx_headroom = WL1271_TKIP_IV_SPACE;
+        /* The tx descriptor buffer and the TKIP space. */
+        wl->hw->extra_tx_headroom = WL1271_TKIP_IV_SPACE +
+                sizeof(struct wl1271_tx_hw_descr);
 
         /* unit us */
         /* FIXME: find a proper value */
         wl->hw->channel_change_time = 10000;
 
         wl->hw->flags = IEEE80211_HW_SIGNAL_DBM |
-                IEEE80211_HW_NOISE_DBM;
+                IEEE80211_HW_NOISE_DBM |
+                IEEE80211_HW_BEACON_FILTER;
 
         wl->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
         wl->hw->wiphy->max_scan_ssids = 1;
         wl->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &wl1271_band_2ghz;
 
+        if (wl1271_11a_enabled())
+                wl->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &wl1271_band_5ghz;
+
         SET_IEEE80211_DEV(wl->hw, &wl->spi->dev);
 
         return 0;
@@ -1213,17 +1808,18 @@ static int __devinit wl1271_probe(struct spi_device *spi)
         wl = hw->priv;
         memset(wl, 0, sizeof(*wl));
 
+        INIT_LIST_HEAD(&wl->list);
+
         wl->hw = hw;
         dev_set_drvdata(&spi->dev, wl);
         wl->spi = spi;
 
         skb_queue_head_init(&wl->tx_queue);
 
-        INIT_WORK(&wl->filter_work, wl1271_filter_work);
+        INIT_DELAYED_WORK(&wl->elp_work, wl1271_elp_work);
         wl->channel = WL1271_DEFAULT_CHANNEL;
         wl->scanning = false;
         wl->default_key = 0;
-        wl->listen_int = 1;
         wl->rx_counter = 0;
         wl->rx_config = WL1271_DEFAULT_RX_CONFIG;
         wl->rx_filter = WL1271_DEFAULT_RX_FILTER;
@@ -1232,10 +1828,12 @@ static int __devinit wl1271_probe(struct spi_device *spi)
         wl->psm_requested = false;
         wl->tx_queue_stopped = false;
         wl->power_level = WL1271_DEFAULT_POWER_LEVEL;
+        wl->basic_rate_set = WL1271_DEFAULT_BASIC_RATE_SET;
+        wl->band = IEEE80211_BAND_2GHZ;
+        wl->vif = NULL;
+        wl->joined = false;
 
-        /* We use the default power on sleep time until we know which chip
-         * we're using */
-        for (i = 0; i < FW_TX_CMPLT_BLOCK_SIZE; i++)
+        for (i = 0; i < ACX_TX_DESCRIPTORS; i++)
                 wl->tx_frames[i] = NULL;
 
         spin_lock_init(&wl->wl_lock);
@@ -1250,13 +1848,6 @@ static int __devinit wl1271_probe(struct spi_device *spi)
         wl->state = WL1271_STATE_OFF;
         mutex_init(&wl->mutex);
 
-        wl->rx_descriptor = kmalloc(sizeof(*wl->rx_descriptor), GFP_KERNEL);
-        if (!wl->rx_descriptor) {
-                wl1271_error("could not allocate memory for rx descriptor");
-                ret = -ENOMEM;
-                goto out_free;
-        }
-
         /* This is the only SPI value that we need to set here, the rest
          * comes from the board-peripherals file */
         spi->bits_per_word = 32;
@@ -1298,6 +1889,9 @@ static int __devinit wl1271_probe(struct spi_device *spi)
         }
         dev_set_drvdata(&wl1271_device.dev, wl);
 
+        /* Apply default driver configuration. */
+        wl1271_conf_init(wl);
+
         ret = wl1271_init_ieee80211(wl);
         if (ret)
                 goto out_platform;
@@ -1319,9 +1913,6 @@ static int __devinit wl1271_probe(struct spi_device *spi)
         free_irq(wl->irq, wl);
 
  out_free:
-        kfree(wl->rx_descriptor);
-        wl->rx_descriptor = NULL;
-
         ieee80211_free_hw(hw);
 
         return ret;
@@ -1337,14 +1928,11 @@ static int __devexit wl1271_remove(struct spi_device *spi)
         platform_device_unregister(&wl1271_device);
         free_irq(wl->irq, wl);
         kfree(wl->target_mem_map);
-        kfree(wl->fw);
+        vfree(wl->fw);
         wl->fw = NULL;
         kfree(wl->nvs);
         wl->nvs = NULL;
 
-        kfree(wl->rx_descriptor);
-        wl->rx_descriptor = NULL;
-
         kfree(wl->fw_status);
         kfree(wl->tx_res_if);
 
@@ -1391,3 +1979,4 @@ module_exit(wl1271_exit);
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Luciano Coelho <luciano.coelho@nokia.com>");
+MODULE_AUTHOR("Juuso Oikarinen <juuso.oikarinen@nokia.com>");
diff --git a/drivers/net/wireless/wl12xx/wl1271_ps.c b/drivers/net/wireless/wl12xx/wl1271_ps.c
index 1dc74b0c7736..507cd91d7eed 100644
--- a/drivers/net/wireless/wl12xx/wl1271_ps.c
+++ b/drivers/net/wireless/wl12xx/wl1271_ps.c
@@ -27,25 +27,38 @@
 
 #define WL1271_WAKEUP_TIMEOUT 500
 
+void wl1271_elp_work(struct work_struct *work)
+{
+        struct delayed_work *dwork;
+        struct wl1271 *wl;
+
+        dwork = container_of(work, struct delayed_work, work);
+        wl = container_of(dwork, struct wl1271, elp_work);
+
+        wl1271_debug(DEBUG_PSM, "elp work");
+
+        mutex_lock(&wl->mutex);
+
+        if (wl->elp || !wl->psm)
+                goto out;
+
+        wl1271_debug(DEBUG_PSM, "chip to elp");
+        wl1271_raw_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_SLEEP);
+        wl->elp = true;
+
+out:
+        mutex_unlock(&wl->mutex);
+}
+
+#define ELP_ENTRY_DELAY  5
+
 /* Routines to toggle sleep mode while in ELP */
 void wl1271_ps_elp_sleep(struct wl1271 *wl)
 {
-        /*
-         * FIXME: due to a problem in the firmware (causing a firmware
-         * crash), ELP entry is prevented below. Remove the "true" to
-         * re-enable ELP entry.
-         */
-        if (true || wl->elp || !wl->psm)
-                return;
-
-        /*
-         * Go to ELP unless there is work already pending - pending work
-         * will immediately wakeup the chipset anyway.
-         */
-        if (!work_pending(&wl->irq_work) && !work_pending(&wl->tx_work)) {
-                wl1271_debug(DEBUG_PSM, "chip to elp");
-                wl1271_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_SLEEP);
-                wl->elp = true;
+        if (wl->psm) {
+                cancel_delayed_work(&wl->elp_work);
+                ieee80211_queue_delayed_work(wl->hw, &wl->elp_work,
+                                        msecs_to_jiffies(ELP_ENTRY_DELAY));
         }
 }
 
@@ -73,7 +86,7 @@ int wl1271_ps_elp_wakeup(struct wl1271 *wl, bool chip_awake)
                 wl->elp_compl = &compl;
         spin_unlock_irqrestore(&wl->wl_lock, flags);
 
-        wl1271_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_WAKE_UP);
+        wl1271_raw_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_WAKE_UP);
 
         if (!pending) {
                 ret = wait_for_completion_timeout(
@@ -111,6 +124,17 @@ int wl1271_ps_set_mode(struct wl1271 *wl, enum wl1271_cmd_ps_mode mode)
         switch (mode) {
         case STATION_POWER_SAVE_MODE:
                 wl1271_debug(DEBUG_PSM, "entering psm");
+
+                /* enable beacon filtering */
+                ret = wl1271_acx_beacon_filter_opt(wl, true);
+                if (ret < 0)
+                        return ret;
+
+                /* enable beacon early termination */
+                ret = wl1271_acx_bet_enable(wl, true);
+                if (ret < 0)
+                        return ret;
+
                 ret = wl1271_cmd_ps_mode(wl, STATION_POWER_SAVE_MODE);
                 if (ret < 0)
                         return ret;
@@ -128,6 +152,16 @@ int wl1271_ps_set_mode(struct wl1271 *wl, enum wl1271_cmd_ps_mode mode)
                 if (ret < 0)
                         return ret;
 
+                /* disable beacon early termination */
+                ret = wl1271_acx_bet_enable(wl, false);
+                if (ret < 0)
+                        return ret;
+
+                /* disable beacon filtering */
+                ret = wl1271_acx_beacon_filter_opt(wl, false);
+                if (ret < 0)
+                        return ret;
+
                 ret = wl1271_cmd_ps_mode(wl, STATION_ACTIVE_MODE);
                 if (ret < 0)
                         return ret;
diff --git a/drivers/net/wireless/wl12xx/wl1271_ps.h b/drivers/net/wireless/wl12xx/wl1271_ps.h
index de2bd3c7dc9c..779653d0ae85 100644
--- a/drivers/net/wireless/wl12xx/wl1271_ps.h
+++ b/drivers/net/wireless/wl12xx/wl1271_ps.h
@@ -30,6 +30,6 @@
 int wl1271_ps_set_mode(struct wl1271 *wl, enum wl1271_cmd_ps_mode mode);
 void wl1271_ps_elp_sleep(struct wl1271 *wl);
 int wl1271_ps_elp_wakeup(struct wl1271 *wl, bool chip_awake);
-
+void wl1271_elp_work(struct work_struct *work);
 
 #endif /* __WL1271_PS_H__ */
diff --git a/drivers/net/wireless/wl12xx/wl1271_reg.h b/drivers/net/wireless/wl12xx/wl1271_reg.h
index f8ed4a4fc691..1f237389d1c7 100644
--- a/drivers/net/wireless/wl12xx/wl1271_reg.h
+++ b/drivers/net/wireless/wl12xx/wl1271_reg.h
@@ -34,7 +34,7 @@
 #define REGISTERS_WORK_SIZE 0x0000b000
 
 #define HW_ACCESS_ELP_CTRL_REG_ADDR         0x1FFFC
-#define STATUS_MEM_ADDRESS                  0x40400
+#define FW_STATUS_ADDR                      (0x14FC0 + 0xA000)
 
 /* ELP register commands */
 #define ELPCTRL_WAKE_UP             0x1
@@ -213,7 +213,6 @@
 ==============================================*/
 #define ACX_REG_INTERRUPT_ACK          (REGISTERS_BASE + 0x04F0)
 
-#define RX_DRIVER_DUMMY_WRITE_ADDRESS  (REGISTERS_BASE + 0x0534)
 #define RX_DRIVER_COUNTER_ADDRESS      (REGISTERS_BASE + 0x0538)
 
 /* Device Configuration registers*/
@@ -614,50 +613,6 @@ enum {
         MAX_RADIO_BANDS = 0xFF
 };
 
-enum {
-        NO_RATE      = 0,
-        RATE_1MBPS   = 0x0A,
-        RATE_2MBPS   = 0x14,
-        RATE_5_5MBPS = 0x37,
-        RATE_6MBPS   = 0x0B,
-        RATE_9MBPS   = 0x0F,
-        RATE_11MBPS  = 0x6E,
-        RATE_12MBPS  = 0x0A,
-        RATE_18MBPS  = 0x0E,
-        RATE_22MBPS  = 0xDC,
-        RATE_24MBPS  = 0x09,
-        RATE_36MBPS  = 0x0D,
-        RATE_48MBPS  = 0x08,
-        RATE_54MBPS  = 0x0C
-};
-
-enum {
-        RATE_INDEX_1MBPS   =  0,
-        RATE_INDEX_2MBPS   =  1,
-        RATE_INDEX_5_5MBPS =  2,
-        RATE_INDEX_6MBPS   =  3,
-        RATE_INDEX_9MBPS   =  4,
-        RATE_INDEX_11MBPS  =  5,
-        RATE_INDEX_12MBPS  =  6,
-        RATE_INDEX_18MBPS  =  7,
-        RATE_INDEX_22MBPS  =  8,
-        RATE_INDEX_24MBPS  =  9,
-        RATE_INDEX_36MBPS  =  10,
-        RATE_INDEX_48MBPS  =  11,
-        RATE_INDEX_54MBPS  =  12,
-        RATE_INDEX_MAX     =  RATE_INDEX_54MBPS,
-        MAX_RATE_INDEX,
-        INVALID_RATE_INDEX = MAX_RATE_INDEX,
-        RATE_INDEX_ENUM_MAX_SIZE = 0x7FFFFFFF
-};
-
-enum {
-        RATE_MASK_1MBPS = 0x1,
-        RATE_MASK_2MBPS = 0x2,
-        RATE_MASK_5_5MBPS = 0x4,
-        RATE_MASK_11MBPS = 0x20,
-};
-
 #define SHORT_PREAMBLE_BIT   BIT(0) /* CCK or Barker depending on the rate */
 #define OFDM_RATE_BIT        BIT(6)
 #define PBCC_RATE_BIT        BIT(7)
diff --git a/drivers/net/wireless/wl12xx/wl1271_rx.c b/drivers/net/wireless/wl12xx/wl1271_rx.c
index ad8b6904c5eb..37d81ab6acc0 100644
--- a/drivers/net/wireless/wl12xx/wl1271_rx.c
+++ b/drivers/net/wireless/wl12xx/wl1271_rx.c
@@ -30,14 +30,15 @@
 static u8 wl1271_rx_get_mem_block(struct wl1271_fw_status *status,
                                   u32 drv_rx_counter)
 {
-        return status->rx_pkt_descs[drv_rx_counter] & RX_MEM_BLOCK_MASK;
+        return le32_to_cpu(status->rx_pkt_descs[drv_rx_counter]) &
+                RX_MEM_BLOCK_MASK;
 }
 
 static u32 wl1271_rx_get_buf_size(struct wl1271_fw_status *status,
                                  u32 drv_rx_counter)
 {
-        return (status->rx_pkt_descs[drv_rx_counter] & RX_BUF_SIZE_MASK) >>
-                RX_BUF_SIZE_SHIFT_DIV;
+        return (le32_to_cpu(status->rx_pkt_descs[drv_rx_counter]) &
+                RX_BUF_SIZE_MASK) >> RX_BUF_SIZE_SHIFT_DIV;
 }
 
 /* The values of this table must match the wl1271_rates[] array */
@@ -70,6 +71,36 @@ static u8 wl1271_rx_rate_to_idx[] = {
         0                           /* WL1271_RATE_1    */
 };
 
+/* The values of this table must match the wl1271_rates[] array */
+static u8 wl1271_5_ghz_rx_rate_to_idx[] = {
+        /* MCS rates are used only with 11n */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS7 */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS6 */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS5 */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS4 */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS3 */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS2 */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS1 */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS0 */
+
+        7,                          /* WL1271_RATE_54   */
+        6,                          /* WL1271_RATE_48   */
+        5,                          /* WL1271_RATE_36   */
+        4,                          /* WL1271_RATE_24   */
+
+        /* TI-specific rate */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_22   */
+
+        3,                          /* WL1271_RATE_18   */
+        2,                          /* WL1271_RATE_12   */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_11   */
+        1,                          /* WL1271_RATE_9    */
+        0,                          /* WL1271_RATE_6    */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_5_5  */
+        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_2    */
+        WL1271_RX_RATE_UNSUPPORTED  /* WL1271_RATE_1    */
+};
+
 static void wl1271_rx_status(struct wl1271 *wl,
                              struct wl1271_rx_descriptor *desc,
                              struct ieee80211_rx_status *status,
@@ -77,12 +108,21 @@ static void wl1271_rx_status(struct wl1271 *wl,
 {
         memset(status, 0, sizeof(struct ieee80211_rx_status));
 
-        if ((desc->flags & WL1271_RX_DESC_BAND_MASK) == WL1271_RX_DESC_BAND_BG)
+        if ((desc->flags & WL1271_RX_DESC_BAND_MASK) ==
+            WL1271_RX_DESC_BAND_BG) {
                 status->band = IEEE80211_BAND_2GHZ;
-        else
+                status->rate_idx = wl1271_rx_rate_to_idx[desc->rate];
+        } else if ((desc->flags & WL1271_RX_DESC_BAND_MASK) ==
+                 WL1271_RX_DESC_BAND_A) {
+                status->band = IEEE80211_BAND_5GHZ;
+                status->rate_idx = wl1271_5_ghz_rx_rate_to_idx[desc->rate];
+        } else
                 wl1271_warning("unsupported band 0x%x",
                                desc->flags & WL1271_RX_DESC_BAND_MASK);
 
+        if (unlikely(status->rate_idx == WL1271_RX_RATE_UNSUPPORTED))
+                wl1271_warning("unsupported rate");
+
         /*
          * FIXME: Add mactime handling.  For IBSS (ad-hoc) we need to get the
          * timestamp from the beacon (acx_tsf_info).  In BSS mode (infra) we
@@ -91,12 +131,6 @@ static void wl1271_rx_status(struct wl1271 *wl,
          */
         status->signal = desc->rssi;
 
-        /* FIXME: Should this be optimized? */
-        status->qual = (desc->rssi - WL1271_RX_MIN_RSSI) * 100 /
-                (WL1271_RX_MAX_RSSI - WL1271_RX_MIN_RSSI);
-        status->qual = min(status->qual, 100);
-        status->qual = max(status->qual, 0);
-
         /*
          * FIXME: In wl1251, the SNR should be divided by two.  In wl1271 we
          * need to divide by two for now, but TI has been discussing about
@@ -109,17 +143,11 @@ static void wl1271_rx_status(struct wl1271 *wl,
         if (desc->flags & WL1271_RX_DESC_ENCRYPT_MASK) {
                 status->flag |= RX_FLAG_IV_STRIPPED | RX_FLAG_MMIC_STRIPPED;
 
-                if (likely(!(desc->flags & WL1271_RX_DESC_DECRYPT_FAIL)))
+                if (likely(!(desc->status & WL1271_RX_DESC_DECRYPT_FAIL)))
                         status->flag |= RX_FLAG_DECRYPTED;
-
-                if (unlikely(desc->flags & WL1271_RX_DESC_MIC_FAIL))
+                if (unlikely(desc->status & WL1271_RX_DESC_MIC_FAIL))
                         status->flag |= RX_FLAG_MMIC_ERROR;
         }
-
-        status->rate_idx = wl1271_rx_rate_to_idx[desc->rate];
-
-        if (status->rate_idx == WL1271_RX_RATE_UNSUPPORTED)
-                wl1271_warning("unsupported rate");
 }
 
 static void wl1271_rx_handle_data(struct wl1271 *wl, u32 length)
@@ -138,7 +166,7 @@ static void wl1271_rx_handle_data(struct wl1271 *wl, u32 length)
         }
 
         buf = skb_put(skb, length);
-        wl1271_spi_reg_read(wl, WL1271_SLV_MEM_DATA, buf, length, true);
+        wl1271_spi_read(wl, WL1271_SLV_MEM_DATA, buf, length, true);
 
         /* the data read starts with the descriptor */
         desc = (struct wl1271_rx_descriptor *) buf;
@@ -156,7 +184,7 @@ static void wl1271_rx_handle_data(struct wl1271 *wl, u32 length)
                      beacon ? "beacon" : "");
 
         memcpy(IEEE80211_SKB_RXCB(skb), &rx_status, sizeof(rx_status));
-        ieee80211_rx(wl->hw, skb);
+        ieee80211_rx_ni(wl->hw, skb);
 }
 
 void wl1271_rx(struct wl1271 *wl, struct wl1271_fw_status *status)
@@ -176,15 +204,15 @@ void wl1271_rx(struct wl1271 *wl, struct wl1271_fw_status *status)
                         break;
                 }
 
-                wl->rx_mem_pool_addr.addr =
-                        (mem_block << 8) + wl_mem_map->packet_memory_pool_start;
+                wl->rx_mem_pool_addr.addr = (mem_block << 8) +
+                        le32_to_cpu(wl_mem_map->packet_memory_pool_start);
                 wl->rx_mem_pool_addr.addr_extra =
                         wl->rx_mem_pool_addr.addr + 4;
 
                 /* Choose the block we want to read */
-                wl1271_spi_reg_write(wl, WL1271_SLV_REG_DATA,
-                                     &wl->rx_mem_pool_addr,
-                                     sizeof(wl->rx_mem_pool_addr), false);
+                wl1271_spi_write(wl, WL1271_SLV_REG_DATA,
+                                 &wl->rx_mem_pool_addr,
+                                 sizeof(wl->rx_mem_pool_addr), false);
 
                 wl1271_rx_handle_data(wl, buf_size);
 
@@ -192,9 +220,5 @@ void wl1271_rx(struct wl1271 *wl, struct wl1271_fw_status *status)
                 drv_rx_counter = wl->rx_counter & NUM_RX_PKT_DESC_MOD_MASK;
         }
 
-        wl1271_reg_write32(wl, RX_DRIVER_COUNTER_ADDRESS, wl->rx_counter);
-
-        /* This is a workaround for some problems in the chip */
-        wl1271_reg_write32(wl, RX_DRIVER_DUMMY_WRITE_ADDRESS, 0x1);
-
+        wl1271_spi_write32(wl, RX_DRIVER_COUNTER_ADDRESS, wl->rx_counter);
 }
diff --git a/drivers/net/wireless/wl12xx/wl1271_rx.h b/drivers/net/wireless/wl12xx/wl1271_rx.h
index d1ca60e43a25..1ae6d1783ed4 100644
--- a/drivers/net/wireless/wl12xx/wl1271_rx.h
+++ b/drivers/net/wireless/wl12xx/wl1271_rx.h
@@ -102,14 +102,14 @@
 #define RX_BUF_SIZE_SHIFT_DIV 6
 
 struct wl1271_rx_descriptor {
-        u16 length;
+        __le16 length;
         u8  status;
         u8  flags;
         u8  rate;
         u8  channel;
         s8  rssi;
         u8  snr;
-        u32 timestamp;
+        __le32 timestamp;
         u8  packet_class;
         u8  process_id;
         u8  pad_len;
diff --git a/drivers/net/wireless/wl12xx/wl1271_spi.c b/drivers/net/wireless/wl12xx/wl1271_spi.c
index 4a12880c16a8..02978a16e732 100644
--- a/drivers/net/wireless/wl12xx/wl1271_spi.c
+++ b/drivers/net/wireless/wl12xx/wl1271_spi.c
@@ -30,17 +30,29 @@
 #include "wl12xx_80211.h"
 #include "wl1271_spi.h"
 
-static int wl1271_translate_reg_addr(struct wl1271 *wl, int addr)
+static int wl1271_translate_addr(struct wl1271 *wl, int addr)
 {
-        return addr - wl->physical_reg_addr + wl->virtual_reg_addr;
-}
-
-static int wl1271_translate_mem_addr(struct wl1271 *wl, int addr)
-{
-        return addr - wl->physical_mem_addr + wl->virtual_mem_addr;
+        /*
+         * To translate, first check to which window of addresses the
+         * particular address belongs. Then subtract the starting address
+         * of that window from the address. Then, add offset of the
+         * translated region.
+         *
+         * The translated regions occur next to each other in physical device
+         * memory, so just add the sizes of the preceeding address regions to
+         * get the offset to the new region.
+         *
+         * Currently, only the two first regions are addressed, and the
+         * assumption is that all addresses will fall into either of those
+         * two.
+         */
+        if ((addr >= wl->part.reg.start) &&
+            (addr < wl->part.reg.start + wl->part.reg.size))
+                return addr - wl->part.reg.start + wl->part.mem.size;
+        else
+                return addr - wl->part.mem.start;
 }
 
-
 void wl1271_spi_reset(struct wl1271 *wl)
 {
         u8 *cmd;
@@ -123,133 +135,137 @@ void wl1271_spi_init(struct wl1271 *wl)
 
 /* Set the SPI partitions to access the chip addresses
  *
- * There are two VIRTUAL (SPI) partitions (the memory partition and the
- * registers partition), which are mapped to two different areas of the
- * PHYSICAL (hardware) memory.  This function also makes other checks to
- * ensure that the partitions are not overlapping.  In the diagram below, the
- * memory partition comes before the register partition, but the opposite is
- * also supported.
+ * To simplify driver code, a fixed (virtual) memory map is defined for
+ * register and memory addresses. Because in the chipset, in different stages
+ * of operation, those addresses will move around, an address translation
+ * mechanism is required.
  *
- *                               PHYSICAL address
+ * There are four partitions (three memory and one register partition),
+ * which are mapped to two different areas of the hardware memory.
+ *
+ *                                Virtual address
  *                                     space
  *
  *                                    |    |
- *                                 ...+----+--> mem_start
- *          VIRTUAL address     ...   |    |
+ *                                 ...+----+--> mem.start
+ *          Physical address    ...   |    |
  *               space       ...      |    | [PART_0]
  *                        ...         |    |
- * 0x00000000 <--+----+...         ...+----+--> mem_start + mem_size
+ *  00000000  <--+----+...         ...+----+--> mem.start + mem.size
  *               |    |         ...   |    |
  *               |MEM |      ...      |    |
  *               |    |   ...         |    |
- *  part_size <--+----+...            |    | {unused area)
+ *  mem.size  <--+----+...            |    | {unused area)
  *               |    |   ...         |    |
  *               |REG |      ...      |    |
- *  part_size    |    |         ...   |    |
- *      +     <--+----+...         ...+----+--> reg_start
- *  reg_size              ...         |    |
- *                           ...      |    | [PART_1]
- *                              ...   |    |
- *                                 ...+----+--> reg_start + reg_size
+ *  mem.size     |    |         ...   |    |
+ *      +     <--+----+...         ...+----+--> reg.start
+ *  reg.size     |    |   ...         |    |
+ *               |MEM2|      ...      |    | [PART_1]
+ *               |    |         ...   |    |
+ *                                 ...+----+--> reg.start + reg.size
  *                                    |    |
  *
  */
 int wl1271_set_partition(struct wl1271 *wl,
-                          u32 mem_start, u32 mem_size,
-                          u32 reg_start, u32 reg_size)
+                         struct wl1271_partition_set *p)
 {
-        struct wl1271_partition *partition;
-        struct spi_transfer t;
-        struct spi_message m;
-        size_t len, cmd_len;
-        u32 *cmd;
-        int addr;
-
-        cmd_len = sizeof(u32) + 2 * sizeof(struct wl1271_partition);
-        cmd = kzalloc(cmd_len, GFP_KERNEL);
-        if (!cmd)
-                return -ENOMEM;
-
-        spi_message_init(&m);
-        memset(&t, 0, sizeof(t));
-
-        partition = (struct wl1271_partition *) (cmd + 1);
-        addr = HW_ACCESS_PART0_SIZE_ADDR;
-        len = 2 * sizeof(struct wl1271_partition);
-
-        *cmd |= WSPI_CMD_WRITE;
-        *cmd |= (len << WSPI_CMD_BYTE_LENGTH_OFFSET) & WSPI_CMD_BYTE_LENGTH;
-        *cmd |= addr & WSPI_CMD_BYTE_ADDR;
+        /* copy partition info */
+        memcpy(&wl->part, p, sizeof(*p));
 
         wl1271_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
-                     mem_start, mem_size);
+                     p->mem.start, p->mem.size);
         wl1271_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
-                     reg_start, reg_size);
-
-        /* Make sure that the two partitions together don't exceed the
-         * address range */
-        if ((mem_size + reg_size) > HW_ACCESS_MEMORY_MAX_RANGE) {
-                wl1271_debug(DEBUG_SPI, "Total size exceeds maximum virtual"
-                             " address range.  Truncating partition[0].");
-                mem_size = HW_ACCESS_MEMORY_MAX_RANGE - reg_size;
-                wl1271_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
-                             mem_start, mem_size);
-                wl1271_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
-                             reg_start, reg_size);
-        }
+                     p->reg.start, p->reg.size);
+        wl1271_debug(DEBUG_SPI, "mem2_start %08X mem2_size %08X",
+                     p->mem2.start, p->mem2.size);
+        wl1271_debug(DEBUG_SPI, "mem3_start %08X mem3_size %08X",
+                     p->mem3.start, p->mem3.size);
+
+        /* write partition info to the chipset */
+        wl1271_raw_write32(wl, HW_PART0_START_ADDR, p->mem.start);
+        wl1271_raw_write32(wl, HW_PART0_SIZE_ADDR, p->mem.size);
+        wl1271_raw_write32(wl, HW_PART1_START_ADDR, p->reg.start);
+        wl1271_raw_write32(wl, HW_PART1_SIZE_ADDR, p->reg.size);
+        wl1271_raw_write32(wl, HW_PART2_START_ADDR, p->mem2.start);
+        wl1271_raw_write32(wl, HW_PART2_SIZE_ADDR, p->mem2.size);
+        wl1271_raw_write32(wl, HW_PART3_START_ADDR, p->mem3.start);
 
-        if ((mem_start < reg_start) &&
-            ((mem_start + mem_size) > reg_start)) {
-                /* Guarantee that the memory partition doesn't overlap the
-                 * registers partition */
-                wl1271_debug(DEBUG_SPI, "End of partition[0] is "
-                             "overlapping partition[1].  Adjusted.");
-                mem_size = reg_start - mem_start;
-                wl1271_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
-                             mem_start, mem_size);
-                wl1271_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
-                             reg_start, reg_size);
-        } else if ((reg_start < mem_start) &&
-                   ((reg_start + reg_size) > mem_start)) {
-                /* Guarantee that the register partition doesn't overlap the
-                 * memory partition */
-                wl1271_debug(DEBUG_SPI, "End of partition[1] is"
-                             " overlapping partition[0].  Adjusted.");
-                reg_size = mem_start - reg_start;
-                wl1271_debug(DEBUG_SPI, "mem_start %08X mem_size %08X",
-                             mem_start, mem_size);
-                wl1271_debug(DEBUG_SPI, "reg_start %08X reg_size %08X",
-                             reg_start, reg_size);
-        }
+        return 0;
+}
 
-        partition[0].start = mem_start;
-        partition[0].size  = mem_size;
-        partition[1].start = reg_start;
-        partition[1].size  = reg_size;
+#define WL1271_BUSY_WORD_TIMEOUT 1000
 
-        wl->physical_mem_addr = mem_start;
-        wl->physical_reg_addr = reg_start;
+/* FIXME: Check busy words, removed due to SPI bug */
+#if 0
+static void wl1271_spi_read_busy(struct wl1271 *wl, void *buf, size_t len)
+{
+        struct spi_transfer t[1];
+        struct spi_message m;
+        u32 *busy_buf;
+        int num_busy_bytes = 0;
 
-        wl->virtual_mem_addr = 0;
-        wl->virtual_reg_addr = mem_size;
+        wl1271_info("spi read BUSY!");
 
-        t.tx_buf = cmd;
-        t.len = cmd_len;
-        spi_message_add_tail(&t, &m);
+        /*
+         * Look for the non-busy word in the read buffer, and if found,
+         * read in the remaining data into the buffer.
+         */
+        busy_buf = (u32 *)buf;
+        for (; (u32)busy_buf < (u32)buf + len; busy_buf++) {
+                num_busy_bytes += sizeof(u32);
+                if (*busy_buf & 0x1) {
+                        spi_message_init(&m);
+                        memset(t, 0, sizeof(t));
+                        memmove(buf, busy_buf, len - num_busy_bytes);
+                        t[0].rx_buf = buf + (len - num_busy_bytes);
+                        t[0].len = num_busy_bytes;
+                        spi_message_add_tail(&t[0], &m);
+                        spi_sync(wl->spi, &m);
+                        return;
+                }
+        }
 
-        spi_sync(wl->spi, &m);
+        /*
+         * Read further busy words from SPI until a non-busy word is
+         * encountered, then read the data itself into the buffer.
+         */
+        wl1271_info("spi read BUSY-polling needed!");
 
-        kfree(cmd);
+        num_busy_bytes = WL1271_BUSY_WORD_TIMEOUT;
+        busy_buf = wl->buffer_busyword;
+        while (num_busy_bytes) {
+                num_busy_bytes--;
+                spi_message_init(&m);
+                memset(t, 0, sizeof(t));
+                t[0].rx_buf = busy_buf;
+                t[0].len = sizeof(u32);
+                spi_message_add_tail(&t[0], &m);
+                spi_sync(wl->spi, &m);
+
+                if (*busy_buf & 0x1) {
+                        spi_message_init(&m);
+                        memset(t, 0, sizeof(t));
+                        t[0].rx_buf = buf;
+                        t[0].len = len;
+                        spi_message_add_tail(&t[0], &m);
+                        spi_sync(wl->spi, &m);
+                        return;
+                }
+        }
 
-        return 0;
+        /* The SPI bus is unresponsive, the read failed. */
+        memset(buf, 0, len);
+        wl1271_error("SPI read busy-word timeout!\n");
 }
+#endif
 
-void wl1271_spi_read(struct wl1271 *wl, int addr, void *buf,
-                     size_t len, bool fixed)
+void wl1271_spi_raw_read(struct wl1271 *wl, int addr, void *buf,
+                         size_t len, bool fixed)
 {
         struct spi_transfer t[3];
         struct spi_message m;
-        u8 *busy_buf;
+        u32 *busy_buf;
         u32 *cmd;
 
         cmd = &wl->buffer_cmd;
@@ -281,14 +297,16 @@ void wl1271_spi_read(struct wl1271 *wl, int addr, void *buf,
 
         spi_sync(wl->spi, &m);
 
-        /* FIXME: check busy words */
+        /* FIXME: Check busy words, removed due to SPI bug */
+        /* if (!(busy_buf[WL1271_BUSY_WORD_CNT - 1] & 0x1))
+           wl1271_spi_read_busy(wl, buf, len); */
 
         wl1271_dump(DEBUG_SPI, "spi_read cmd -> ", cmd, sizeof(*cmd));
         wl1271_dump(DEBUG_SPI, "spi_read buf <- ", buf, len);
 }
 
-void wl1271_spi_write(struct wl1271 *wl, int addr, void *buf,
-                      size_t len, bool fixed)
+void wl1271_spi_raw_write(struct wl1271 *wl, int addr, void *buf,
+                          size_t len, bool fixed)
 {
         struct spi_transfer t[2];
         struct spi_message m;
@@ -321,62 +339,77 @@ void wl1271_spi_write(struct wl1271 *wl, int addr, void *buf,
         wl1271_dump(DEBUG_SPI, "spi_write buf -> ", buf, len);
 }
 
-void wl1271_spi_mem_read(struct wl1271 *wl, int addr, void *buf,
-                         size_t len)
+void wl1271_spi_read(struct wl1271 *wl, int addr, void *buf, size_t len,
+                     bool fixed)
 {
         int physical;
 
-        physical = wl1271_translate_mem_addr(wl, addr);
+        physical = wl1271_translate_addr(wl, addr);
 
-        wl1271_spi_read(wl, physical, buf, len, false);
+        wl1271_spi_raw_read(wl, physical, buf, len, fixed);
 }
 
-void wl1271_spi_mem_write(struct wl1271 *wl, int addr, void *buf,
-                          size_t len)
+void wl1271_spi_write(struct wl1271 *wl, int addr, void *buf, size_t len,
+                      bool fixed)
 {
         int physical;
 
-        physical = wl1271_translate_mem_addr(wl, addr);
+        physical = wl1271_translate_addr(wl, addr);
 
-        wl1271_spi_write(wl, physical, buf, len, false);
+        wl1271_spi_raw_write(wl, physical, buf, len, fixed);
 }
 
-void wl1271_spi_reg_read(struct wl1271 *wl, int addr, void *buf, size_t len,
-                         bool fixed)
+u32 wl1271_spi_read32(struct wl1271 *wl, int addr)
 {
-        int physical;
-
-        physical = wl1271_translate_reg_addr(wl, addr);
+        return wl1271_raw_read32(wl, wl1271_translate_addr(wl, addr));
+}
 
-        wl1271_spi_read(wl, physical, buf, len, fixed);
+void wl1271_spi_write32(struct wl1271 *wl, int addr, u32 val)
+{
+        wl1271_raw_write32(wl, wl1271_translate_addr(wl, addr), val);
 }
 
-void wl1271_spi_reg_write(struct wl1271 *wl, int addr, void *buf, size_t len,
-                          bool fixed)
+void wl1271_top_reg_write(struct wl1271 *wl, int addr, u16 val)
 {
-        int physical;
+        /* write address >> 1 + 0x30000 to OCP_POR_CTR */
+        addr = (addr >> 1) + 0x30000;
+        wl1271_spi_write32(wl, OCP_POR_CTR, addr);
 
-        physical = wl1271_translate_reg_addr(wl, addr);
+        /* write value to OCP_POR_WDATA */
+        wl1271_spi_write32(wl, OCP_DATA_WRITE, val);
 
-        wl1271_spi_write(wl, physical, buf, len, fixed);
+        /* write 1 to OCP_CMD */
+        wl1271_spi_write32(wl, OCP_CMD, OCP_CMD_WRITE);
 }
 
-u32 wl1271_mem_read32(struct wl1271 *wl, int addr)
+u16 wl1271_top_reg_read(struct wl1271 *wl, int addr)
 {
-        return wl1271_read32(wl, wl1271_translate_mem_addr(wl, addr));
-}
+        u32 val;
+        int timeout = OCP_CMD_LOOP;
 
-void wl1271_mem_write32(struct wl1271 *wl, int addr, u32 val)
-{
-        wl1271_write32(wl, wl1271_translate_mem_addr(wl, addr), val);
-}
+        /* write address >> 1 + 0x30000 to OCP_POR_CTR */
+        addr = (addr >> 1) + 0x30000;
+        wl1271_spi_write32(wl, OCP_POR_CTR, addr);
 
-u32 wl1271_reg_read32(struct wl1271 *wl, int addr)
-{
-        return wl1271_read32(wl, wl1271_translate_reg_addr(wl, addr));
-}
+        /* write 2 to OCP_CMD */
+        wl1271_spi_write32(wl, OCP_CMD, OCP_CMD_READ);
 
-void wl1271_reg_write32(struct wl1271 *wl, int addr, u32 val)
-{
-        wl1271_write32(wl, wl1271_translate_reg_addr(wl, addr), val);
+        /* poll for data ready */
+        do {
+                val = wl1271_spi_read32(wl, OCP_DATA_READ);
+                timeout--;
+        } while (!(val & OCP_READY_MASK) && timeout);
+
+        if (!timeout) {
+                wl1271_warning("Top register access timed out.");
+                return 0xffff;
+        }
+
+        /* check data status and return if OK */
+        if ((val & OCP_STATUS_MASK) == OCP_STATUS_OK)
+                return val & 0xffff;
+        else {
+                wl1271_warning("Top register access returned error.");
+                return 0xffff;
+        }
 }
diff --git a/drivers/net/wireless/wl12xx/wl1271_spi.h b/drivers/net/wireless/wl12xx/wl1271_spi.h
index 2c9968458646..cb7df1c56314 100644
--- a/drivers/net/wireless/wl12xx/wl1271_spi.h
+++ b/drivers/net/wireless/wl12xx/wl1271_spi.h
@@ -29,10 +29,14 @@
 
 #define HW_ACCESS_MEMORY_MAX_RANGE              0x1FFC0
 
-#define HW_ACCESS_PART0_SIZE_ADDR           0x1FFC0
-#define HW_ACCESS_PART0_START_ADDR          0x1FFC4
-#define HW_ACCESS_PART1_SIZE_ADDR           0x1FFC8
-#define HW_ACCESS_PART1_START_ADDR          0x1FFCC
+#define HW_PARTITION_REGISTERS_ADDR         0x1ffc0
+#define HW_PART0_SIZE_ADDR                  (HW_PARTITION_REGISTERS_ADDR)
+#define HW_PART0_START_ADDR                 (HW_PARTITION_REGISTERS_ADDR + 4)
+#define HW_PART1_SIZE_ADDR                  (HW_PARTITION_REGISTERS_ADDR + 8)
+#define HW_PART1_START_ADDR                 (HW_PARTITION_REGISTERS_ADDR + 12)
+#define HW_PART2_SIZE_ADDR                  (HW_PARTITION_REGISTERS_ADDR + 16)
+#define HW_PART2_START_ADDR                 (HW_PARTITION_REGISTERS_ADDR + 20)
+#define HW_PART3_START_ADDR                 (HW_PARTITION_REGISTERS_ADDR + 24)
 
 #define HW_ACCESS_REGISTER_SIZE             4
 
@@ -67,47 +71,56 @@
                 ((WL1271_BUSY_WORD_LEN - 4) / sizeof(u32))
 #define HW_ACCESS_WSPI_INIT_CMD_MASK  0
 
+#define OCP_CMD_LOOP  32
+
+#define OCP_CMD_WRITE 0x1
+#define OCP_CMD_READ  0x2
+
+#define OCP_READY_MASK  BIT(18)
+#define OCP_STATUS_MASK (BIT(16) | BIT(17))
+
+#define OCP_STATUS_NO_RESP    0x00000
+#define OCP_STATUS_OK         0x10000
+#define OCP_STATUS_REQ_FAILED 0x20000
+#define OCP_STATUS_RESP_ERROR 0x30000
 
 /* Raw target IO, address is not translated */
-void wl1271_spi_write(struct wl1271 *wl, int addr, void *buf,
+void wl1271_spi_raw_write(struct wl1271 *wl, int addr, void *buf,
                       size_t len, bool fixed);
-void wl1271_spi_read(struct wl1271 *wl, int addr, void *buf,
+void wl1271_spi_raw_read(struct wl1271 *wl, int addr, void *buf,
                      size_t len, bool fixed);
 
-/* Memory target IO, address is tranlated to partition 0 */
-void wl1271_spi_mem_read(struct wl1271 *wl, int addr, void *buf, size_t len);
-void wl1271_spi_mem_write(struct wl1271 *wl, int addr, void *buf, size_t len);
-u32 wl1271_mem_read32(struct wl1271 *wl, int addr);
-void wl1271_mem_write32(struct wl1271 *wl, int addr, u32 val);
+/* Translated target IO */
+void wl1271_spi_read(struct wl1271 *wl, int addr, void *buf, size_t len,
+                     bool fixed);
+void wl1271_spi_write(struct wl1271 *wl, int addr, void *buf, size_t len,
+                      bool fixed);
+u32 wl1271_spi_read32(struct wl1271 *wl, int addr);
+void wl1271_spi_write32(struct wl1271 *wl, int addr, u32 val);
 
-/* Registers IO */
-void wl1271_spi_reg_read(struct wl1271 *wl, int addr, void *buf, size_t len,
-                         bool fixed);
-void wl1271_spi_reg_write(struct wl1271 *wl, int addr, void *buf, size_t len,
-                          bool fixed);
-u32 wl1271_reg_read32(struct wl1271 *wl, int addr);
-void wl1271_reg_write32(struct wl1271 *wl, int addr, u32 val);
+/* Top Register IO */
+void wl1271_top_reg_write(struct wl1271 *wl, int addr, u16 val);
+u16 wl1271_top_reg_read(struct wl1271 *wl, int addr);
 
 /* INIT and RESET words */
 void wl1271_spi_reset(struct wl1271 *wl);
 void wl1271_spi_init(struct wl1271 *wl);
 int wl1271_set_partition(struct wl1271 *wl,
-                         u32 part_start, u32 part_size,
-                         u32 reg_start,  u32 reg_size);
+                         struct wl1271_partition_set *p);
 
-static inline u32 wl1271_read32(struct wl1271 *wl, int addr)
+static inline u32 wl1271_raw_read32(struct wl1271 *wl, int addr)
 {
-        wl1271_spi_read(wl, addr, &wl->buffer_32,
-                        sizeof(wl->buffer_32), false);
+        wl1271_spi_raw_read(wl, addr, &wl->buffer_32,
+                            sizeof(wl->buffer_32), false);
 
         return wl->buffer_32;
 }
 
-static inline void wl1271_write32(struct wl1271 *wl, int addr, u32 val)
+static inline void wl1271_raw_write32(struct wl1271 *wl, int addr, u32 val)
 {
         wl->buffer_32 = val;
-        wl1271_spi_write(wl, addr, &wl->buffer_32,
-                         sizeof(wl->buffer_32), false);
+        wl1271_spi_raw_write(wl, addr, &wl->buffer_32,
+                             sizeof(wl->buffer_32), false);
 }
 
 #endif /* __WL1271_SPI_H__ */
diff --git a/drivers/net/wireless/wl12xx/wl1271_tx.c b/drivers/net/wireless/wl12xx/wl1271_tx.c
index ff221258b941..00af065c77c2 100644
--- a/drivers/net/wireless/wl12xx/wl1271_tx.c
+++ b/drivers/net/wireless/wl12xx/wl1271_tx.c
@@ -33,8 +33,7 @@
 static int wl1271_tx_id(struct wl1271 *wl, struct sk_buff *skb)
 {
         int i;
-
-        for (i = 0; i < FW_TX_CMPLT_BLOCK_SIZE; i++)
+        for (i = 0; i < ACX_TX_DESCRIPTORS; i++)
                 if (wl->tx_frames[i] == NULL) {
                         wl->tx_frames[i] = skb;
                         return i;
@@ -58,8 +57,8 @@ static int wl1271_tx_allocate(struct wl1271 *wl, struct sk_buff *skb, u32 extra)
         /* approximate the number of blocks required for this packet
            in the firmware */
         /* FIXME: try to figure out what is done here and make it cleaner */
-        total_blocks = (skb->len) >> TX_HW_BLOCK_SHIFT_DIV;
-        excluded = (total_blocks << 2) + (skb->len & 0xff) + 34;
+        total_blocks = (total_len + 20) >> TX_HW_BLOCK_SHIFT_DIV;
+        excluded = (total_blocks << 2) + ((total_len + 20) & 0xff) + 34;
         total_blocks += (excluded > 252) ? 2 : 1;
         total_blocks += TX_HW_BLOCK_SPARE;
 
@@ -89,15 +88,25 @@ static int wl1271_tx_fill_hdr(struct wl1271 *wl, struct sk_buff *skb,
 {
         struct wl1271_tx_hw_descr *desc;
         int pad;
+        u16 tx_attr;
 
         desc = (struct wl1271_tx_hw_descr *) skb->data;
 
+        /* relocate space for security header */
+        if (extra) {
+                void *framestart = skb->data + sizeof(*desc);
+                u16 fc = *(u16 *)(framestart + extra);
+                int hdrlen = ieee80211_hdrlen(cpu_to_le16(fc));
+                memmove(framestart, framestart + extra, hdrlen);
+        }
+
         /* configure packet life time */
-        desc->start_time = jiffies_to_usecs(jiffies) - wl->time_offset;
-        desc->life_time = TX_HW_MGMT_PKT_LIFETIME_TU;
+        desc->start_time = cpu_to_le32(jiffies_to_usecs(jiffies) -
+                                       wl->time_offset);
+        desc->life_time = cpu_to_le16(TX_HW_MGMT_PKT_LIFETIME_TU);
 
         /* configure the tx attributes */
-        desc->tx_attr = wl->session_counter << TX_HW_ATTR_OFST_SESSION_COUNTER;
+        tx_attr = wl->session_counter << TX_HW_ATTR_OFST_SESSION_COUNTER;
         /* FIXME: do we know the packet priority? can we identify mgmt
            packets, and use max prio for them at least? */
         desc->tid = 0;
@@ -106,11 +115,13 @@ static int wl1271_tx_fill_hdr(struct wl1271 *wl, struct sk_buff *skb,
 
         /* align the length (and store in terms of words) */
         pad = WL1271_TX_ALIGN(skb->len);
-        desc->length = pad >> 2;
+        desc->length = cpu_to_le16(pad >> 2);
 
         /* calculate number of padding bytes */
         pad = pad - skb->len;
-        desc->tx_attr |= pad << TX_HW_ATTR_OFST_LAST_WORD_PAD;
+        tx_attr |= pad << TX_HW_ATTR_OFST_LAST_WORD_PAD;
+
+        desc->tx_attr = cpu_to_le16(tx_attr);
 
         wl1271_debug(DEBUG_TX, "tx_fill_hdr: pad: %d", pad);
         return 0;
@@ -147,11 +158,11 @@ static int wl1271_tx_send_packet(struct wl1271 *wl, struct sk_buff *skb,
         len = WL1271_TX_ALIGN(skb->len);
 
         /* perform a fixed address block write with the packet */
-        wl1271_spi_reg_write(wl, WL1271_SLV_MEM_DATA, skb->data, len, true);
+        wl1271_spi_write(wl, WL1271_SLV_MEM_DATA, skb->data, len, true);
 
         /* write packet new counter into the write access register */
         wl->tx_packets_count++;
-        wl1271_reg_write32(wl, WL1271_HOST_WR_ACCESS, wl->tx_packets_count);
+        wl1271_spi_write32(wl, WL1271_HOST_WR_ACCESS, wl->tx_packets_count);
 
         desc = (struct wl1271_tx_hw_descr *) skb->data;
         wl1271_debug(DEBUG_TX, "tx id %u skb 0x%p payload %u (%u words)",
@@ -254,14 +265,13 @@ out:
 static void wl1271_tx_complete_packet(struct wl1271 *wl,
                                       struct wl1271_tx_hw_res_descr *result)
 {
-
         struct ieee80211_tx_info *info;
         struct sk_buff *skb;
-        u32 header_len;
+        u16 seq;
         int id = result->id;
 
         /* check for id legality */
-        if (id >= TX_HW_RESULT_QUEUE_LEN || wl->tx_frames[id] == NULL) {
+        if (id >= ACX_TX_DESCRIPTORS || wl->tx_frames[id] == NULL) {
                 wl1271_warning("TX result illegal id: %d", id);
                 return;
         }
@@ -284,22 +294,32 @@ static void wl1271_tx_complete_packet(struct wl1271 *wl,
         /* info->status.retry_count = result->ack_failures; */
         wl->stats.retry_count += result->ack_failures;
 
-        /* get header len */
+        /* update security sequence number */
+        seq = wl->tx_security_seq_16 +
+                (result->lsb_security_sequence_number -
+                 wl->tx_security_last_seq);
+        wl->tx_security_last_seq = result->lsb_security_sequence_number;
+
+        if (seq < wl->tx_security_seq_16)
+                wl->tx_security_seq_32++;
+        wl->tx_security_seq_16 = seq;
+
+        /* remove private header from packet */
+        skb_pull(skb, sizeof(struct wl1271_tx_hw_descr));
+
+        /* remove TKIP header space if present */
         if (info->control.hw_key &&
-            info->control.hw_key->alg == ALG_TKIP)
-                header_len = WL1271_TKIP_IV_SPACE +
-                        sizeof(struct wl1271_tx_hw_descr);
-        else
-                header_len = sizeof(struct wl1271_tx_hw_descr);
+            info->control.hw_key->alg == ALG_TKIP) {
+                int hdrlen = ieee80211_get_hdrlen_from_skb(skb);
+                memmove(skb->data + WL1271_TKIP_IV_SPACE, skb->data, hdrlen);
+                skb_pull(skb, WL1271_TKIP_IV_SPACE);
+        }
 
         wl1271_debug(DEBUG_TX, "tx status id %u skb 0x%p failures %u rate 0x%x"
                      " status 0x%x",
                      result->id, skb, result->ack_failures,
                      result->rate_class_index, result->status);
 
-        /* remove private header from packet */
-        skb_pull(skb, header_len);
-
         /* return the packet to the stack */
         ieee80211_tx_status(wl->hw, skb);
         wl->tx_frames[result->id] = NULL;
@@ -315,8 +335,8 @@ void wl1271_tx_complete(struct wl1271 *wl, u32 count)
         wl1271_debug(DEBUG_TX, "tx_complete received, packets: %d", count);
 
         /* read the tx results from the chipset */
-        wl1271_spi_mem_read(wl, memmap->tx_result,
-                            wl->tx_res_if, sizeof(*wl->tx_res_if));
+        wl1271_spi_read(wl, le32_to_cpu(memmap->tx_result),
+                        wl->tx_res_if, sizeof(*wl->tx_res_if), false);
 
         /* verify that the result buffer is not getting overrun */
         if (count > TX_HW_RESULT_QUEUE_LEN) {
@@ -337,10 +357,10 @@ void wl1271_tx_complete(struct wl1271 *wl, u32 count)
         }
 
         /* write host counter to chipset (to ack) */
-        wl1271_mem_write32(wl, memmap->tx_result +
+        wl1271_spi_write32(wl, le32_to_cpu(memmap->tx_result) +
                            offsetof(struct wl1271_tx_hw_res_if,
                                     tx_result_host_counter),
-                           wl->tx_res_if->tx_result_fw_counter);
+                           le32_to_cpu(wl->tx_res_if->tx_result_fw_counter));
 }
 
 /* caller must hold wl->mutex */
@@ -364,7 +384,7 @@ void wl1271_tx_flush(struct wl1271 *wl)
                 ieee80211_tx_status(wl->hw, skb);
         }
 
-        for (i = 0; i < FW_TX_CMPLT_BLOCK_SIZE; i++)
+        for (i = 0; i < ACX_TX_DESCRIPTORS; i++)
                 if (wl->tx_frames[i] != NULL) {
                         skb = wl->tx_frames[i];
                         info = IEEE80211_SKB_CB(skb);
diff --git a/drivers/net/wireless/wl12xx/wl1271_tx.h b/drivers/net/wireless/wl12xx/wl1271_tx.h
index 4a614067ddba..416396caf0a0 100644
--- a/drivers/net/wireless/wl12xx/wl1271_tx.h
+++ b/drivers/net/wireless/wl12xx/wl1271_tx.h
@@ -58,7 +58,7 @@
 
 struct wl1271_tx_hw_descr {
         /* Length of packet in words, including descriptor+header+data */
-        u16 length;
+        __le16 length;
         /* Number of extra memory blocks to allocate for this packet in
            addition to the number of blocks derived from the packet length */
         u8 extra_mem_blocks;
@@ -67,12 +67,12 @@ struct wl1271_tx_hw_descr {
            HW!! */
         u8 total_mem_blocks;
         /* Device time (in us) when the packet arrived to the driver */
-        u32 start_time;
+        __le32 start_time;
         /* Max delay in TUs until transmission. The last device time the
            packet can be transmitted is: startTime+(1024*LifeTime) */
-        u16 life_time;
+        __le16 life_time;
         /* Bitwise fields - see TX_ATTR... definitions above. */
-        u16 tx_attr;
+        __le16 tx_attr;
         /* Packet identifier used also in the Tx-Result. */
         u8 id;
         /* The packet TID value (as User-Priority) */
@@ -100,12 +100,12 @@ struct wl1271_tx_hw_res_descr {
            several possible reasons for failure. */
         u8 status;
         /* Total air access duration including all retrys and overheads.*/
-        u16 medium_usage;
+        __le16 medium_usage;
         /* The time passed from host xfer to Tx-complete.*/
-        u32 fw_handling_time;
+        __le32 fw_handling_time;
         /* Total media delay
            (from 1st EDCA AIFS counter until TX Complete). */
-        u32 medium_delay;
+        __le32 medium_delay;
         /* LS-byte of last TKIP seq-num (saved per AC for recovery). */
         u8 lsb_security_sequence_number;
         /* Retry count - number of transmissions without successful ACK.*/
@@ -118,8 +118,8 @@ struct wl1271_tx_hw_res_descr {
 } __attribute__ ((packed));
 
 struct wl1271_tx_hw_res_if {
-        u32 tx_result_fw_counter;
-        u32 tx_result_host_counter;
+        __le32 tx_result_fw_counter;
+        __le32 tx_result_host_counter;
         struct wl1271_tx_hw_res_descr tx_results_queue[TX_HW_RESULT_QUEUE_LEN];
 } __attribute__ ((packed));
 
diff --git a/drivers/net/wireless/wl12xx/wl12xx_80211.h b/drivers/net/wireless/wl12xx/wl12xx_80211.h
index 657c2dbcb7d3..055d7bc6f592 100644
--- a/drivers/net/wireless/wl12xx/wl12xx_80211.h
+++ b/drivers/net/wireless/wl12xx/wl12xx_80211.h
@@ -122,8 +122,8 @@ struct wl12xx_null_data_template {
 } __attribute__ ((packed));
 
 struct wl12xx_ps_poll_template {
-        u16 fc;
-        u16 aid;
+        __le16 fc;
+        __le16 aid;
         u8 bssid[ETH_ALEN];
         u8 ta[ETH_ALEN];
 } __attribute__ ((packed));
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.c b/drivers/net/wireless/zd1211rw/zd_chip.c
index 4e79a9800134..dfa1b9bc22c8 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.c
+++ b/drivers/net/wireless/zd1211rw/zd_chip.c
@@ -755,7 +755,7 @@ static int hw_reset_phy(struct zd_chip *chip)
 static int zd1211_hw_init_hmac(struct zd_chip *chip)
 {
         static const struct zd_ioreq32 ioreqs[] = {
-                { CR_ZD1211_RETRY_MAX,          0x2 },
+                { CR_ZD1211_RETRY_MAX,          ZD1211_RETRY_COUNT },
                 { CR_RX_THRESHOLD,              0x000c0640 },
         };
 
@@ -767,7 +767,7 @@ static int zd1211_hw_init_hmac(struct zd_chip *chip)
 static int zd1211b_hw_init_hmac(struct zd_chip *chip)
 {
         static const struct zd_ioreq32 ioreqs[] = {
-                { CR_ZD1211B_RETRY_MAX,         0x02020202 },
+                { CR_ZD1211B_RETRY_MAX,         ZD1211B_RETRY_COUNT },
                 { CR_ZD1211B_CWIN_MAX_MIN_AC0,  0x007f003f },
                 { CR_ZD1211B_CWIN_MAX_MIN_AC1,  0x007f003f },
                 { CR_ZD1211B_CWIN_MAX_MIN_AC2,  0x003f001f },
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.h b/drivers/net/wireless/zd1211rw/zd_chip.h
index 678c139a840c..9fd8f3508d66 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.h
+++ b/drivers/net/wireless/zd1211rw/zd_chip.h
@@ -642,13 +642,29 @@ enum {
 #define CR_ZD1211B_TXOP                 CTL_REG(0x0b20)
 #define CR_ZD1211B_RETRY_MAX            CTL_REG(0x0b28)
 
+/* Value for CR_ZD1211_RETRY_MAX & CR_ZD1211B_RETRY_MAX. Vendor driver uses 2,
+ * we use 0. The first rate is tried (count+2), then all next rates are tried
+ * twice, until 1 Mbits is tried. */
+#define ZD1211_RETRY_COUNT              0
+#define ZD1211B_RETRY_COUNT     \
+        (ZD1211_RETRY_COUNT <<  0)|     \
+        (ZD1211_RETRY_COUNT <<  8)|     \
+        (ZD1211_RETRY_COUNT << 16)|     \
+        (ZD1211_RETRY_COUNT << 24)
+
 /* Used to detect PLL lock */
 #define UW2453_INTR_REG                 ((zd_addr_t)0x85c1)
 
 #define CWIN_SIZE                       0x007f043f
 
 
-#define HWINT_ENABLED                   0x004f0000
+#define HWINT_ENABLED                   \
+        (INT_TX_COMPLETE_EN|            \
+         INT_RX_COMPLETE_EN|            \
+         INT_RETRY_FAIL_EN|             \
+         INT_WAKEUP_EN|                 \
+         INT_CFG_NEXT_BCN_EN)
+
 #define HWINT_DISABLED                  0
 
 #define E2P_PWR_INT_GUARD               8
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index 6d666359a42f..8a243732c519 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -88,6 +88,34 @@ static const struct ieee80211_rate zd_rates[] = {
           .flags = 0 },
 };
 
+/*
+ * Zydas retry rates table. Each line is listed in the same order as
+ * in zd_rates[] and contains all the rate used when a packet is sent
+ * starting with a given rates. Let's consider an example :
+ *
+ * "11 Mbits : 4, 3, 2, 1, 0" means :
+ * - packet is sent using 4 different rates
+ * - 1st rate is index 3 (ie 11 Mbits)
+ * - 2nd rate is index 2 (ie 5.5 Mbits)
+ * - 3rd rate is index 1 (ie 2 Mbits)
+ * - 4th rate is index 0 (ie 1 Mbits)
+ */
+
+static const struct tx_retry_rate zd_retry_rates[] = {
+        { /*  1 Mbits */        1, { 0 }},
+        { /*  2 Mbits */        2, { 1,  0 }},
+        { /*  5.5 Mbits */      3, { 2,  1, 0 }},
+        { /* 11 Mbits */        4, { 3,  2, 1, 0 }},
+        { /*  6 Mbits */        5, { 4,  3, 2, 1, 0 }},
+        { /*  9 Mbits */        6, { 5,  4, 3, 2, 1, 0}},
+        { /* 12 Mbits */        5, { 6,  3, 2, 1, 0 }},
+        { /* 18 Mbits */        6, { 7,  6, 3, 2, 1, 0 }},
+        { /* 24 Mbits */        6, { 8,  6, 3, 2, 1, 0 }},
+        { /* 36 Mbits */        7, { 9,  8, 6, 3, 2, 1, 0 }},
+        { /* 48 Mbits */        8, {10,  9, 8, 6, 3, 2, 1, 0 }},
+        { /* 54 Mbits */        9, {11, 10, 9, 8, 6, 3, 2, 1, 0 }}
+};
+
 static const struct ieee80211_channel zd_channels[] = {
         { .center_freq = 2412, .hw_value = 1 },
         { .center_freq = 2417, .hw_value = 2 },
@@ -282,7 +310,7 @@ static void zd_op_stop(struct ieee80211_hw *hw)
 }
 
 /**
- * tx_status - reports tx status of a packet if required
+ * zd_mac_tx_status - reports tx status of a packet if required
  * @hw - a &struct ieee80211_hw pointer
  * @skb - a sk-buffer
  * @flags: extra flags to set in the TX status info
@@ -295,15 +323,49 @@ static void zd_op_stop(struct ieee80211_hw *hw)
  *
  * If no status information has been requested, the skb is freed.
  */
-static void tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
-                      int ackssi, bool success)
+static void zd_mac_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
+                      int ackssi, struct tx_status *tx_status)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        int i;
+        int success = 1, retry = 1;
+        int first_idx;
+        const struct tx_retry_rate *retries;
 
         ieee80211_tx_info_clear_status(info);
 
-        if (success)
+        if (tx_status) {
+                success = !tx_status->failure;
+                retry = tx_status->retry + success;
+        }
+
+        if (success) {
+                /* success */
                 info->flags |= IEEE80211_TX_STAT_ACK;
+        } else {
+                /* failure */
+                info->flags &= ~IEEE80211_TX_STAT_ACK;
+        }
+
+        first_idx = info->status.rates[0].idx;
+        ZD_ASSERT(0<=first_idx && first_idx<ARRAY_SIZE(zd_retry_rates));
+        retries = &zd_retry_rates[first_idx];
+        ZD_ASSERT(0<=retry && retry<=retries->count);
+
+        info->status.rates[0].idx = retries->rate[0];
+        info->status.rates[0].count = 1; // (retry > 1 ? 2 : 1);
+
+        for (i=1; i<IEEE80211_TX_MAX_RATES-1 && i<retry; i++) {
+                info->status.rates[i].idx = retries->rate[i];
+                info->status.rates[i].count = 1; // ((i==retry-1) && success ? 1:2);
+        }
+        for (; i<IEEE80211_TX_MAX_RATES && i<retry; i++) {
+                info->status.rates[i].idx = retries->rate[retry-1];
+                info->status.rates[i].count = 1; // (success ? 1:2);
+        }
+        if (i<IEEE80211_TX_MAX_RATES)
+                info->status.rates[i].idx = -1; /* terminate */
+
         info->status.ack_signal = ackssi;
         ieee80211_tx_status_irqsafe(hw, skb);
 }
@@ -316,16 +378,79 @@ static void tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
  * transferred. The first frame from the tx queue, will be selected and
  * reported as error to the upper layers.
  */
-void zd_mac_tx_failed(struct ieee80211_hw *hw)
+void zd_mac_tx_failed(struct urb *urb)
 {
-        struct sk_buff_head *q = &zd_hw_mac(hw)->ack_wait_queue;
+        struct ieee80211_hw * hw = zd_usb_to_hw(urb->context);
+        struct zd_mac *mac = zd_hw_mac(hw);
+        struct sk_buff_head *q = &mac->ack_wait_queue;
         struct sk_buff *skb;
+        struct tx_status *tx_status = (struct tx_status *)urb->transfer_buffer;
+        unsigned long flags;
+        int success = !tx_status->failure;
+        int retry = tx_status->retry + success;
+        int found = 0;
+        int i, position = 0;
 
-        skb = skb_dequeue(q);
-        if (skb == NULL)
-                return;
+        q = &mac->ack_wait_queue;
+        spin_lock_irqsave(&q->lock, flags);
+
+        skb_queue_walk(q, skb) {
+                struct ieee80211_hdr *tx_hdr;
+                struct ieee80211_tx_info *info;
+                int first_idx, final_idx;
+                const struct tx_retry_rate *retries;
+                u8 final_rate;
+
+                position ++;
+
+                /* if the hardware reports a failure and we had a 802.11 ACK
+                 * pending, then we skip the first skb when searching for a
+                 * matching frame */
+                if (tx_status->failure && mac->ack_pending &&
+                    skb_queue_is_first(q, skb)) {
+                        continue;
+                }
+
+                tx_hdr = (struct ieee80211_hdr *)skb->data;
+
+                /* we skip all frames not matching the reported destination */
+                if (unlikely(memcmp(tx_hdr->addr1, tx_status->mac, ETH_ALEN))) {
+                        continue;
+                }
+
+                /* we skip all frames not matching the reported final rate */
 
-        tx_status(hw, skb, 0, 0);
+                info = IEEE80211_SKB_CB(skb);
+                first_idx = info->status.rates[0].idx;
+                ZD_ASSERT(0<=first_idx && first_idx<ARRAY_SIZE(zd_retry_rates));
+                retries = &zd_retry_rates[first_idx];
+                if (retry < 0 || retry > retries->count) {
+                        continue;
+                }
+
+                ZD_ASSERT(0<=retry && retry<=retries->count);
+                final_idx = retries->rate[retry-1];
+                final_rate = zd_rates[final_idx].hw_value;
+
+                if (final_rate != tx_status->rate) {
+                        continue;
+                }
+
+                found = 1;
+                break;
+        }
+
+        if (found) {
+                for (i=1; i<=position; i++) {
+                        skb = __skb_dequeue(q);
+                        zd_mac_tx_status(hw, skb,
+                                         mac->ack_pending ? mac->ack_signal : 0,
+                                         i == position ? tx_status : NULL);
+                        mac->ack_pending = 0;
+                }
+        }
+
+        spin_unlock_irqrestore(&q->lock, flags);
 }
 
 /**
@@ -342,18 +467,27 @@ void zd_mac_tx_to_dev(struct sk_buff *skb, int error)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_hw *hw = info->rate_driver_data[0];
+        struct zd_mac *mac = zd_hw_mac(hw);
+
+        ieee80211_tx_info_clear_status(info);
 
         skb_pull(skb, sizeof(struct zd_ctrlset));
         if (unlikely(error ||
             (info->flags & IEEE80211_TX_CTL_NO_ACK))) {
-                tx_status(hw, skb, 0, !error);
+                /*
+                 * FIXME : do we need to fill in anything ?
+                 */
+                ieee80211_tx_status_irqsafe(hw, skb);
         } else {
-                struct sk_buff_head *q =
-                        &zd_hw_mac(hw)->ack_wait_queue;
+                struct sk_buff_head *q = &mac->ack_wait_queue;
 
                 skb_queue_tail(q, skb);
-                while (skb_queue_len(q) > ZD_MAC_MAX_ACK_WAITERS)
-                        zd_mac_tx_failed(hw);
+                while (skb_queue_len(q) > ZD_MAC_MAX_ACK_WAITERS) {
+                        zd_mac_tx_status(hw, skb_dequeue(q),
+                                         mac->ack_pending ? mac->ack_signal : 0,
+                                         NULL);
+                        mac->ack_pending = 0;
+                }
         }
 }
 
@@ -606,27 +740,47 @@ fail:
 static int filter_ack(struct ieee80211_hw *hw, struct ieee80211_hdr *rx_hdr,
                       struct ieee80211_rx_status *stats)
 {
+        struct zd_mac *mac = zd_hw_mac(hw);
         struct sk_buff *skb;
         struct sk_buff_head *q;
         unsigned long flags;
+        int found = 0;
+        int i, position = 0;
 
         if (!ieee80211_is_ack(rx_hdr->frame_control))
                 return 0;
 
-        q = &zd_hw_mac(hw)->ack_wait_queue;
+        q = &mac->ack_wait_queue;
         spin_lock_irqsave(&q->lock, flags);
         skb_queue_walk(q, skb) {
                 struct ieee80211_hdr *tx_hdr;
 
+                position ++;
+
+                if (mac->ack_pending && skb_queue_is_first(q, skb))
+                    continue;
+
                 tx_hdr = (struct ieee80211_hdr *)skb->data;
                 if (likely(!memcmp(tx_hdr->addr2, rx_hdr->addr1, ETH_ALEN)))
                 {
-                        __skb_unlink(skb, q);
-                        tx_status(hw, skb, stats->signal, 1);
-                        goto out;
+                        found = 1;
+                        break;
                 }
         }
-out:
+
+        if (found) {
+                for (i=1; i<position; i++) {
+                        skb = __skb_dequeue(q);
+                        zd_mac_tx_status(hw, skb,
+                                         mac->ack_pending ? mac->ack_signal : 0,
+                                         NULL);
+                        mac->ack_pending = 0;
+                }
+
+                mac->ack_pending = 1;
+                mac->ack_signal = stats->signal;
+        }
+
         spin_unlock_irqrestore(&q->lock, flags);
         return 1;
 }
@@ -709,6 +863,7 @@ int zd_mac_rx(struct ieee80211_hw *hw, const u8 *buffer, unsigned int length)
                 skb_reserve(skb, 2);
         }
 
+        /* FIXME : could we avoid this big memcpy ? */
         memcpy(skb_put(skb, length), buffer, length);
 
         memcpy(IEEE80211_SKB_RXCB(skb), &stats, sizeof(stats));
@@ -999,7 +1154,14 @@ struct ieee80211_hw *zd_mac_alloc_hw(struct usb_interface *intf)
         hw->queues = 1;
         hw->extra_tx_headroom = sizeof(struct zd_ctrlset);
 
+        /*
+         * Tell mac80211 that we support multi rate retries
+         */
+        hw->max_rates = IEEE80211_TX_MAX_RATES;
+        hw->max_rate_tries = 18;        /* 9 rates * 2 retries/rate */
+
         skb_queue_head_init(&mac->ack_wait_queue);
+        mac->ack_pending = 0;
 
         zd_chip_init(&mac->chip, hw, intf);
         housekeeping_init(mac);
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.h b/drivers/net/wireless/zd1211rw/zd_mac.h
index 7c2759118d13..630c298a730e 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.h
+++ b/drivers/net/wireless/zd1211rw/zd_mac.h
@@ -140,6 +140,21 @@ struct rx_status {
 #define ZD_RX_CRC16_ERROR               0x40
 #define ZD_RX_ERROR                     0x80
 
+struct tx_retry_rate {
+        int count;      /* number of valid element in rate[] array */
+        int rate[10];   /* retry rates, described by an index in zd_rates[] */
+};
+
+struct tx_status {
+        u8 type;        /* must always be 0x01 : USB_INT_TYPE */
+        u8 id;          /* must always be 0xa0 : USB_INT_ID_RETRY_FAILED */
+        u8 rate;
+        u8 pad;
+        u8 mac[ETH_ALEN];
+        u8 retry;
+        u8 failure;
+} __attribute__((packed));
+
 enum mac_flags {
         MAC_FIXED_CHANNEL = 0x01,
 };
@@ -150,7 +165,7 @@ struct housekeeping {
 
 #define ZD_MAC_STATS_BUFFER_SIZE 16
 
-#define ZD_MAC_MAX_ACK_WAITERS 10
+#define ZD_MAC_MAX_ACK_WAITERS 50
 
 struct zd_mac {
         struct zd_chip chip;
@@ -184,6 +199,12 @@ struct zd_mac {
 
         /* whether to pass control frames to stack */
         unsigned int pass_ctrl:1;
+
+        /* whether we have received a 802.11 ACK that is pending */
+        unsigned int ack_pending:1;
+
+        /* signal strength of the last 802.11 ACK received */
+        int ack_signal;
 };
 
 #define ZD_REGDOMAIN_FCC        0x10
@@ -279,7 +300,7 @@ int zd_mac_preinit_hw(struct ieee80211_hw *hw);
 int zd_mac_init_hw(struct ieee80211_hw *hw);
 
 int zd_mac_rx(struct ieee80211_hw *hw, const u8 *buffer, unsigned int length);
-void zd_mac_tx_failed(struct ieee80211_hw *hw);
+void zd_mac_tx_failed(struct urb *urb);
 void zd_mac_tx_to_dev(struct sk_buff *skb, int error);
 
 #ifdef DEBUG
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index 23a6a6d4863b..d46f20a57b7d 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -419,7 +419,7 @@ static void int_urb_complete(struct urb *urb)
                 handle_regs_int(urb);
                 break;
         case USB_INT_ID_RETRY_FAILED:
-                zd_mac_tx_failed(zd_usb_to_hw(urb->context));
+                zd_mac_tx_failed(urb);
                 break;
         default:
                 dev_dbg_f(urb_dev(urb), "error: urb %p unknown id %x\n", urb,
@@ -553,6 +553,8 @@ static void handle_rx_packet(struct zd_usb *usb, const u8 *buffer,
 
         if (length < sizeof(struct rx_length_info)) {
                 /* It's not a complete packet anyhow. */
+                printk("%s: invalid, small RX packet : %d\n",
+                       __func__, length);
                 return;
         }
         length_info = (struct rx_length_info *)
diff --git a/drivers/ssb/driver_pcicore.c b/drivers/ssb/driver_pcicore.c
index 538c570df337..f1dcd7969a5c 100644
--- a/drivers/ssb/driver_pcicore.c
+++ b/drivers/ssb/driver_pcicore.c
@@ -551,13 +551,13 @@ int ssb_pcicore_dev_irqvecs_enable(struct ssb_pcicore *pc,
         might_sleep_if(pdev->id.coreid != SSB_DEV_PCI);
 
         /* Enable interrupts for this device. */
-        if (bus->host_pci &&
-            ((pdev->id.revision >= 6) || (pdev->id.coreid == SSB_DEV_PCIE))) {
+        if ((pdev->id.revision >= 6) || (pdev->id.coreid == SSB_DEV_PCIE)) {
                 u32 coremask;
 
                 /* Calculate the "coremask" for the device. */
                 coremask = (1 << dev->core_index);
 
+                SSB_WARN_ON(bus->bustype != SSB_BUSTYPE_PCI);
                 err = pci_read_config_dword(bus->host_pci, SSB_PCI_IRQMASK, &tmp);
                 if (err)
                         goto out;