147 files changed, 2860 insertions, 1428 deletions
diff --git a/MAINTAINERS b/MAINTAINERS
index e443eb76ce5e..14cffbfbd041 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1674,10 +1674,9 @@ F:	drivers/net/ethernet/broadcom/tg3.*
 BROADCOM BRCM80211 IEEE802.11n WIRELESS DRIVER
 M:      Brett Rudley <brudley@broadcom.com>
-M:      Roland Vossen <rvossen@broadcom.com>
 M:      Arend van Spriel <arend@broadcom.com>
 M:      Franky (Zhenhui) Lin <frankyl@broadcom.com>
-M:      Kan Yan <kanyan@broadcom.com>
+M:      Hante Meuleman <meuleman@broadcom.com>
 L:      linux-wireless@vger.kernel.org
 L:      brcm80211-dev-list@broadcom.com
 S:      Supported
diff --git a/drivers/bcma/bcma_private.h b/drivers/bcma/bcma_private.h
index 169fc58427d3..bcb830ec4bb4 100644
--- a/drivers/bcma/bcma_private.h
+++ b/drivers/bcma/bcma_private.h
@@ -84,6 +84,8 @@ extern void __exit bcma_host_pci_exit(void);
 /* driver_pci.c */
 u32 bcma_pcie_read(struct bcma_drv_pci *pc, u32 address);
+extern int bcma_chipco_watchdog_register(struct bcma_drv_cc *cc);
 #ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
 bool __devinit bcma_core_pci_is_in_hostmode(struct bcma_drv_pci *pc);
 void __devinit bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
diff --git a/drivers/bcma/driver_chipcommon.c b/drivers/bcma/driver_chipcommon.c
index ffd74e51f02d..d017f2512275 100644
--- a/drivers/bcma/driver_chipcommon.c
+++ b/drivers/bcma/driver_chipcommon.c
@@ -4,12 +4,15 @@
 *
 * Copyright 2005, Broadcom Corporation
 * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
+ * Copyright 2012, Hauke Mehrtens <hauke@hauke-m.de>
 *
 * Licensed under the GNU/GPL. See COPYING for details.
 */
 #include "bcma_private.h"
+#include <linux/bcm47xx_wdt.h>
 #include <linux/export.h>
+#include <linux/platform_device.h>
 #include <linux/bcma/bcma.h>
 static inline u32 bcma_cc_write32_masked(struct bcma_drv_cc *cc, u16 offset,
@@ -22,6 +25,90 @@ static inline u32 bcma_cc_write32_masked(struct bcma_drv_cc *cc, u16 offset,
        return value;
 }
+static u32 bcma_chipco_alp_clock(struct bcma_drv_cc *cc)
+{
+        if (cc->capabilities & BCMA_CC_CAP_PMU)
+                return bcma_pmu_alp_clock(cc);
+        return 20000000;
+}
+static u32 bcma_chipco_watchdog_get_max_timer(struct bcma_drv_cc *cc)
+{
+        struct bcma_bus *bus = cc->core->bus;
+        u32 nb;
+        if (cc->capabilities & BCMA_CC_CAP_PMU) {
+                if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4706)
+                        nb = 32;
+                else if (cc->core->id.rev < 26)
+                        nb = 16;
+                else
+                        nb = (cc->core->id.rev >= 37) ? 32 : 24;
+        } else {
+                nb = 28;
+        }
+        if (nb == 32)
+                return 0xffffffff;
+        else
+                return (1 << nb) - 1;
+}
+static u32 bcma_chipco_watchdog_timer_set_wdt(struct bcm47xx_wdt *wdt,
+                                              u32 ticks)
+{
+        struct bcma_drv_cc *cc = bcm47xx_wdt_get_drvdata(wdt);
+        return bcma_chipco_watchdog_timer_set(cc, ticks);
+}
+static u32 bcma_chipco_watchdog_timer_set_ms_wdt(struct bcm47xx_wdt *wdt,
+                                                 u32 ms)
+{
+        struct bcma_drv_cc *cc = bcm47xx_wdt_get_drvdata(wdt);
+        u32 ticks;
+        ticks = bcma_chipco_watchdog_timer_set(cc, cc->ticks_per_ms * ms);
+        return ticks / cc->ticks_per_ms;
+}
+static int bcma_chipco_watchdog_ticks_per_ms(struct bcma_drv_cc *cc)
+{
+        struct bcma_bus *bus = cc->core->bus;
+        if (cc->capabilities & BCMA_CC_CAP_PMU) {
+                if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4706)
+                        /* 4706 CC and PMU watchdogs are clocked at 1/4 of ALP clock */
+                        return bcma_chipco_alp_clock(cc) / 4000;
+                else
+                        /* based on 32KHz ILP clock */
+                        return 32;
+        } else {
+                return bcma_chipco_alp_clock(cc) / 1000;
+        }
+}
+int bcma_chipco_watchdog_register(struct bcma_drv_cc *cc)
+{
+        struct bcm47xx_wdt wdt = {};
+        struct platform_device *pdev;
+        wdt.driver_data = cc;
+        wdt.timer_set = bcma_chipco_watchdog_timer_set_wdt;
+        wdt.timer_set_ms = bcma_chipco_watchdog_timer_set_ms_wdt;
+        wdt.max_timer_ms = bcma_chipco_watchdog_get_max_timer(cc) / cc->ticks_per_ms;
+        pdev = platform_device_register_data(NULL, "bcm47xx-wdt",
+                                             cc->core->bus->num, &wdt,
+                                             sizeof(wdt));
+        if (IS_ERR(pdev))
+                return PTR_ERR(pdev);
+        cc->watchdog = pdev;
+        return 0;
+}
 void bcma_core_chipcommon_early_init(struct bcma_drv_cc *cc)
 {
        if (cc->early_setup_done)
@@ -69,15 +156,33 @@ void bcma_core_chipcommon_init(struct bcma_drv_cc *cc)
                        ((leddc_on << BCMA_CC_GPIOTIMER_ONTIME_SHIFT) |
                         (leddc_off << BCMA_CC_GPIOTIMER_OFFTIME_SHIFT)));
        }
+        cc->ticks_per_ms = bcma_chipco_watchdog_ticks_per_ms(cc);
        cc->setup_done = true;
 }
 /* Set chip watchdog reset timer to fire in 'ticks' backplane cycles */
-void bcma_chipco_watchdog_timer_set(struct bcma_drv_cc *cc, u32 ticks)
+u32 bcma_chipco_watchdog_timer_set(struct bcma_drv_cc *cc, u32 ticks)
 {
-        /* instant NMI */
+        u32 maxt;
-        bcma_cc_write32(cc, BCMA_CC_WATCHDOG, ticks);
+        enum bcma_clkmode clkmode;
+        maxt = bcma_chipco_watchdog_get_max_timer(cc);
+        if (cc->capabilities & BCMA_CC_CAP_PMU) {
+                if (ticks == 1)
+                        ticks = 2;
+                else if (ticks > maxt)
+                        ticks = maxt;
+                bcma_cc_write32(cc, BCMA_CC_PMU_WATCHDOG, ticks);
+        } else {
+                clkmode = ticks ? BCMA_CLKMODE_FAST : BCMA_CLKMODE_DYNAMIC;
+                bcma_core_set_clockmode(cc->core, clkmode);
+                if (ticks > maxt)
+                        ticks = maxt;
+                /* instant NMI */
+                bcma_cc_write32(cc, BCMA_CC_WATCHDOG, ticks);
+        }
+        return ticks;
 }
 void bcma_chipco_irq_mask(struct bcma_drv_cc *cc, u32 mask, u32 value)
@@ -131,8 +236,7 @@ void bcma_chipco_serial_init(struct bcma_drv_cc *cc)
        struct bcma_serial_port *ports = cc->serial_ports;
        if (ccrev >= 11 && ccrev != 15) {
-                /* Fixed ALP clock */
+                baud_base = bcma_chipco_alp_clock(cc);
-                baud_base = bcma_pmu_alp_clock(cc);
                if (ccrev >= 21) {
                        /* Turn off UART clock before switching clocksource. */
                        bcma_cc_write32(cc, BCMA_CC_CORECTL,
diff --git a/drivers/bcma/driver_pci_host.c b/drivers/bcma/driver_pci_host.c
index e56449506695..e6b5c89469dc 100644
--- a/drivers/bcma/driver_pci_host.c
+++ b/drivers/bcma/driver_pci_host.c
@@ -538,7 +538,7 @@ DECLARE_PCI_FIXUP_EARLY(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_pcibridge);
 static void bcma_core_pci_fixup_addresses(struct pci_dev *dev)
 {
        struct resource *res;
-        int pos;
+        int pos, err;
        if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
                /* This is not a device on the PCI-core bridge. */
@@ -551,8 +551,12 @@ static void bcma_core_pci_fixup_addresses(struct pci_dev *dev)
        for (pos = 0; pos < 6; pos++) {
                res = &dev->resource[pos];
-                if (res->flags & (IORESOURCE_IO | IORESOURCE_MEM))
+                if (res->flags & (IORESOURCE_IO | IORESOURCE_MEM)) {
-                        pci_assign_resource(dev, pos);
+                        err = pci_assign_resource(dev, pos);
+                        if (err)
+                                pr_err("PCI: Problem fixing up the addresses on %s\n",
+                                       pci_name(dev));
+                }
        }
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_addresses);
diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
index a9718893000b..debd4f142f93 100644
--- a/drivers/bcma/main.c
+++ b/drivers/bcma/main.c
@@ -165,6 +165,12 @@ static int bcma_register_cores(struct bcma_bus *bus)
        }
 #endif
+        if (bus->hosttype == BCMA_HOSTTYPE_SOC) {
+                err = bcma_chipco_watchdog_register(&bus->drv_cc);
+                if (err)
+                        bcma_err(bus, "Error registering watchdog driver\n");
+        }
        return 0;
 }
@@ -177,6 +183,8 @@ static void bcma_unregister_cores(struct bcma_bus *bus)
                if (core->dev_registered)
                        device_unregister(&core->dev);
        }
+        if (bus->hosttype == BCMA_HOSTTYPE_SOC)
+                platform_device_unregister(bus->drv_cc.watchdog);
 }
 int __devinit bcma_bus_register(struct bcma_bus *bus)
diff --git a/drivers/net/wireless/adm8211.c b/drivers/net/wireless/adm8211.c
index 154a4965be4f..3d339e04efb7 100644
--- a/drivers/net/wireless/adm8211.c
+++ b/drivers/net/wireless/adm8211.c
@@ -1761,7 +1761,7 @@ static const struct ieee80211_ops adm8211_ops = {
        .get_tsf                = adm8211_get_tsft
 };
-static int __devinit adm8211_probe(struct pci_dev *pdev,
+static int adm8211_probe(struct pci_dev *pdev,
                                   const struct pci_device_id *id)
 {
        struct ieee80211_hw *dev;
@@ -1935,7 +1935,7 @@ static int __devinit adm8211_probe(struct pci_dev *pdev,
 }
-static void __devexit adm8211_remove(struct pci_dev *pdev)
+static void adm8211_remove(struct pci_dev *pdev)
 {
        struct ieee80211_hw *dev = pci_get_drvdata(pdev);
        struct adm8211_priv *priv;
@@ -1985,7 +1985,7 @@ static struct pci_driver adm8211_driver = {
        .name           = "adm8211",
        .id_table       = adm8211_pci_id_table,
        .probe          = adm8211_probe,
-        .remove         = __devexit_p(adm8211_remove),
+        .remove         = adm8211_remove,
 #ifdef CONFIG_PM
        .suspend        = adm8211_suspend,
        .resume         = adm8211_resume,
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 57f7db1ac31b..53295418f576 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -78,7 +78,7 @@ static struct pci_driver airo_driver = {
        .name     = DRV_NAME,
        .id_table = card_ids,
        .probe    = airo_pci_probe,
-        .remove   = __devexit_p(airo_pci_remove),
+        .remove   = airo_pci_remove,
        .suspend  = airo_pci_suspend,
        .resume   = airo_pci_resume,
 };
@@ -5584,7 +5584,7 @@ static void timer_func( struct net_device *dev ) {
 }
 #ifdef CONFIG_PCI
-static int __devinit airo_pci_probe(struct pci_dev *pdev,
+static int airo_pci_probe(struct pci_dev *pdev,
                                    const struct pci_device_id *pent)
 {
        struct net_device *dev;
@@ -5606,7 +5606,7 @@ static int __devinit airo_pci_probe(struct pci_dev *pdev,
        return 0;
 }
-static void __devexit airo_pci_remove(struct pci_dev *pdev)
+static void airo_pci_remove(struct pci_dev *pdev)
 {
        struct net_device *dev = pci_get_drvdata(pdev);
diff --git a/drivers/net/wireless/ath/Kconfig b/drivers/net/wireless/ath/Kconfig
index c25dcf192fec..1a67a4f829fe 100644
--- a/drivers/net/wireless/ath/Kconfig
+++ b/drivers/net/wireless/ath/Kconfig
@@ -1,4 +1,7 @@
-menuconfig ATH_COMMON
+config ATH_COMMON
+        tristate
+menuconfig ATH_CARDS
        tristate "Atheros Wireless Cards"
        depends on CFG80211 && (!UML || BROKEN)
        ---help---
@@ -14,7 +17,7 @@ menuconfig ATH_COMMON
          http://wireless.kernel.org/en/users/Drivers/Atheros
-if ATH_COMMON
+if ATH_CARDS
 config ATH_DEBUG
        bool "Atheros wireless debugging"
diff --git a/drivers/net/wireless/ath/ar5523/Kconfig b/drivers/net/wireless/ath/ar5523/Kconfig
index 11d99ee8de51..0d320cc7769b 100644
--- a/drivers/net/wireless/ath/ar5523/Kconfig
+++ b/drivers/net/wireless/ath/ar5523/Kconfig
@@ -1,6 +1,7 @@
 config AR5523
       tristate "Atheros AR5523 wireless driver support"
       depends on MAC80211 && USB
+       select ATH_COMMON
       select FW_LOADER
       ---help---
         This module add support for AR5523 based USB dongles such as D-Link
diff --git a/drivers/net/wireless/ath/ath5k/Kconfig b/drivers/net/wireless/ath/ath5k/Kconfig
index 338c5c42357d..c9f81a388f15 100644
--- a/drivers/net/wireless/ath/ath5k/Kconfig
+++ b/drivers/net/wireless/ath/ath5k/Kconfig
@@ -1,6 +1,7 @@
 config ATH5K
        tristate "Atheros 5xxx wireless cards support"
        depends on (PCI || ATHEROS_AR231X) && MAC80211
+        select ATH_COMMON
        select MAC80211_LEDS
        select LEDS_CLASS
        select NEW_LEDS
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 2fd5bab2e22a..3a5a61e03922 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -2435,7 +2435,7 @@ static const struct ieee80211_iface_combination if_comb = {
        .num_different_channels = 1,
 };
-int __devinit
+int
 ath5k_init_ah(struct ath5k_hw *ah, const struct ath_bus_ops *bus_ops)
 {
        struct ieee80211_hw *hw = ah->hw;
@@ -2861,7 +2861,7 @@ static void ath5k_reset_work(struct work_struct *work)
        mutex_unlock(&ah->lock);
 }
-static int __devinit
+static int
 ath5k_init(struct ieee80211_hw *hw)
 {
diff --git a/drivers/net/wireless/ath/ath5k/led.c b/drivers/net/wireless/ath/ath5k/led.c
index b9f708a45f4e..f77ef36acf87 100644
--- a/drivers/net/wireless/ath/ath5k/led.c
+++ b/drivers/net/wireless/ath/ath5k/led.c
@@ -158,7 +158,7 @@ void ath5k_unregister_leds(struct ath5k_hw *ah)
        ath5k_unregister_led(&ah->tx_led);
 }
-int __devinit ath5k_init_leds(struct ath5k_hw *ah)
+int ath5k_init_leds(struct ath5k_hw *ah)
 {
        int ret = 0;
        struct ieee80211_hw *hw = ah->hw;
diff --git a/drivers/net/wireless/ath/ath5k/pci.c b/drivers/net/wireless/ath/ath5k/pci.c
index dff48fbc63bf..859db7c34f87 100644
--- a/drivers/net/wireless/ath/ath5k/pci.c
+++ b/drivers/net/wireless/ath/ath5k/pci.c
@@ -155,7 +155,7 @@ static const struct ath_bus_ops ath_pci_bus_ops = {
 * PCI Initialization *
 \********************/
-static int __devinit
+static int
 ath5k_pci_probe(struct pci_dev *pdev,
                const struct pci_device_id *id)
 {
@@ -285,7 +285,7 @@ err:
        return ret;
 }
-static void __devexit
+static void
 ath5k_pci_remove(struct pci_dev *pdev)
 {
        struct ieee80211_hw *hw = pci_get_drvdata(pdev);
@@ -336,7 +336,7 @@ static struct pci_driver ath5k_pci_driver = {
        .name           = KBUILD_MODNAME,
        .id_table       = ath5k_pci_id_table,
        .probe          = ath5k_pci_probe,
-        .remove         = __devexit_p(ath5k_pci_remove),
+        .remove         = ath5k_pci_remove,
        .driver.pm      = ATH5K_PM_OPS,
 };
diff --git a/drivers/net/wireless/ath/ath9k/Kconfig b/drivers/net/wireless/ath/ath9k/Kconfig
index c7aa6646123e..5fc15bf8be09 100644
--- a/drivers/net/wireless/ath/ath9k/Kconfig
+++ b/drivers/net/wireless/ath/ath9k/Kconfig
@@ -17,6 +17,7 @@ config ATH9K_BTCOEX_SUPPORT
 config ATH9K
        tristate "Atheros 802.11n wireless cards support"
        depends on MAC80211
+        select ATH_COMMON
        select ATH9K_HW
        select MAC80211_LEDS
        select LEDS_CLASS
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 80bab1b8447a..86e26a19efda 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -259,9 +259,10 @@ struct ath_atx_tid {
 };
 struct ath_node {
+        struct ath_softc *sc;
        struct ieee80211_sta *sta; /* station struct we're part of */
        struct ieee80211_vif *vif; /* interface with which we're associated */
-        struct ath_atx_tid tid[WME_NUM_TID];
+        struct ath_atx_tid tid[IEEE80211_NUM_TIDS];
        struct ath_atx_ac ac[IEEE80211_NUM_ACS];
        int ps_key;
@@ -269,6 +270,10 @@ struct ath_node {
        u8 mpdudensity;
        bool sleeping;
+#if defined(CONFIG_MAC80211_DEBUGFS) && defined(CONFIG_ATH9K_DEBUGFS)
+        struct dentry *node_stat;
+#endif
 };
 #define AGGR_CLEANUP         BIT(1)
diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
index 76b543900314..5f845beeb18b 100644
--- a/drivers/net/wireless/ath/ath9k/common.h
+++ b/drivers/net/wireless/ath/ath9k/common.h
@@ -23,7 +23,6 @@
 /* Common header for Atheros 802.11n base driver cores */
-#define WME_NUM_TID             16
 #define WME_BA_BMP_SIZE         64
 #define WME_MAX_BA              WME_BA_BMP_SIZE
 #define ATH_TID_MAX_BUFS        (2 * WME_MAX_BA)
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 939308c25712..13ff9edc2401 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -1509,6 +1509,215 @@ static const struct file_operations fops_btcoex = {
 };
 #endif
+static ssize_t read_file_node_stat(struct file *file, char __user *user_buf,
+                                   size_t count, loff_t *ppos)
+{
+        struct ath_node *an = file->private_data;
+        struct ath_softc *sc = an->sc;
+        struct ath_atx_tid *tid;
+        struct ath_atx_ac *ac;
+        struct ath_txq *txq;
+        u32 len = 0, size = 4096;
+        char *buf;
+        size_t retval;
+        int tidno, acno;
+        buf = kzalloc(size, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
+        if (!an->sta->ht_cap.ht_supported) {
+                len = snprintf(buf, size, "%s\n",
+                               "HT not supported");
+                goto exit;
+        }
+        len = snprintf(buf, size, "Max-AMPDU: %d\n",
+                       an->maxampdu);
+        len += snprintf(buf + len, size - len, "MPDU Density: %d\n\n",
+                        an->mpdudensity);
+        len += snprintf(buf + len, size - len,
+                        "%2s%7s\n", "AC", "SCHED");
+        for (acno = 0, ac = &an->ac[acno];
+             acno < IEEE80211_NUM_ACS; acno++, ac++) {
+                txq = ac->txq;
+                ath_txq_lock(sc, txq);
+                len += snprintf(buf + len, size - len,
+                                "%2d%7d\n",
+                                acno, ac->sched);
+                ath_txq_unlock(sc, txq);
+        }
+        len += snprintf(buf + len, size - len,
+                        "\n%3s%11s%10s%10s%10s%10s%9s%6s%8s\n",
+                        "TID", "SEQ_START", "SEQ_NEXT", "BAW_SIZE",
+                        "BAW_HEAD", "BAW_TAIL", "BAR_IDX", "SCHED", "PAUSED");
+        for (tidno = 0, tid = &an->tid[tidno];
+             tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
+                txq = tid->ac->txq;
+                ath_txq_lock(sc, txq);
+                len += snprintf(buf + len, size - len,
+                                "%3d%11d%10d%10d%10d%10d%9d%6d%8d\n",
+                                tid->tidno, tid->seq_start, tid->seq_next,
+                                tid->baw_size, tid->baw_head, tid->baw_tail,
+                                tid->bar_index, tid->sched, tid->paused);
+                ath_txq_unlock(sc, txq);
+        }
+exit:
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+        return retval;
+}
+static const struct file_operations fops_node_stat = {
+        .read = read_file_node_stat,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+void ath9k_sta_add_debugfs(struct ieee80211_hw *hw,
+                           struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta,
+                           struct dentry *dir)
+{
+        struct ath_node *an = (struct ath_node *)sta->drv_priv;
+        an->node_stat = debugfs_create_file("node_stat", S_IRUGO,
+                                            dir, an, &fops_node_stat);
+}
+void ath9k_sta_remove_debugfs(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif,
+                              struct ieee80211_sta *sta,
+                              struct dentry *dir)
+{
+        struct ath_node *an = (struct ath_node *)sta->drv_priv;
+        debugfs_remove(an->node_stat);
+}
+/* Ethtool support for get-stats */
+#define AMKSTR(nm) #nm "_BE", #nm "_BK", #nm "_VI", #nm "_VO"
+static const char ath9k_gstrings_stats[][ETH_GSTRING_LEN] = {
+        "tx_pkts_nic",
+        "tx_bytes_nic",
+        "rx_pkts_nic",
+        "rx_bytes_nic",
+        AMKSTR(d_tx_pkts),
+        AMKSTR(d_tx_bytes),
+        AMKSTR(d_tx_mpdus_queued),
+        AMKSTR(d_tx_mpdus_completed),
+        AMKSTR(d_tx_mpdu_xretries),
+        AMKSTR(d_tx_aggregates),
+        AMKSTR(d_tx_ampdus_queued_hw),
+        AMKSTR(d_tx_ampdus_queued_sw),
+        AMKSTR(d_tx_ampdus_completed),
+        AMKSTR(d_tx_ampdu_retries),
+        AMKSTR(d_tx_ampdu_xretries),
+        AMKSTR(d_tx_fifo_underrun),
+        AMKSTR(d_tx_op_exceeded),
+        AMKSTR(d_tx_timer_expiry),
+        AMKSTR(d_tx_desc_cfg_err),
+        AMKSTR(d_tx_data_underrun),
+        AMKSTR(d_tx_delim_underrun),
+        "d_rx_decrypt_crc_err",
+        "d_rx_phy_err",
+        "d_rx_mic_err",
+        "d_rx_pre_delim_crc_err",
+        "d_rx_post_delim_crc_err",
+        "d_rx_decrypt_busy_err",
+        "d_rx_phyerr_radar",
+        "d_rx_phyerr_ofdm_timing",
+        "d_rx_phyerr_cck_timing",
+};
+#define ATH9K_SSTATS_LEN ARRAY_SIZE(ath9k_gstrings_stats)
+void ath9k_get_et_strings(struct ieee80211_hw *hw,
+                          struct ieee80211_vif *vif,
+                          u32 sset, u8 *data)
+{
+        if (sset == ETH_SS_STATS)
+                memcpy(data, *ath9k_gstrings_stats,
+                       sizeof(ath9k_gstrings_stats));
+}
+int ath9k_get_et_sset_count(struct ieee80211_hw *hw,
+                            struct ieee80211_vif *vif, int sset)
+{
+        if (sset == ETH_SS_STATS)
+                return ATH9K_SSTATS_LEN;
+        return 0;
+}
+#define AWDATA(elem)                                                    \
+        do {                                                            \
+                data[i++] = sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_BE)].elem; \
+                data[i++] = sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_BK)].elem; \
+                data[i++] = sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_VI)].elem; \
+                data[i++] = sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_VO)].elem; \
+        } while (0)
+#define AWDATA_RX(elem)                                         \
+        do {                                                    \
+                data[i++] = sc->debug.stats.rxstats.elem;       \
+        } while (0)
+void ath9k_get_et_stats(struct ieee80211_hw *hw,
+                        struct ieee80211_vif *vif,
+                        struct ethtool_stats *stats, u64 *data)
+{
+        struct ath_softc *sc = hw->priv;
+        int i = 0;
+        data[i++] = (sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_BE)].tx_pkts_all +
+                     sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_BK)].tx_pkts_all +
+                     sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_VI)].tx_pkts_all +
+                     sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_VO)].tx_pkts_all);
+        data[i++] = (sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_BE)].tx_bytes_all +
+                     sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_BK)].tx_bytes_all +
+                     sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_VI)].tx_bytes_all +
+                     sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_VO)].tx_bytes_all);
+        AWDATA_RX(rx_pkts_all);
+        AWDATA_RX(rx_bytes_all);
+        AWDATA(tx_pkts_all);
+        AWDATA(tx_bytes_all);
+        AWDATA(queued);
+        AWDATA(completed);
+        AWDATA(xretries);
+        AWDATA(a_aggr);
+        AWDATA(a_queued_hw);
+        AWDATA(a_queued_sw);
+        AWDATA(a_completed);
+        AWDATA(a_retries);
+        AWDATA(a_xretries);
+        AWDATA(fifo_underrun);
+        AWDATA(xtxop);
+        AWDATA(timer_exp);
+        AWDATA(desc_cfg_err);
+        AWDATA(data_underrun);
+        AWDATA(delim_underrun);
+        AWDATA_RX(decrypt_crc_err);
+        AWDATA_RX(phy_err);
+        AWDATA_RX(mic_err);
+        AWDATA_RX(pre_delim_crc_err);
+        AWDATA_RX(post_delim_crc_err);
+        AWDATA_RX(decrypt_busy_err);
+        AWDATA_RX(phy_err_stats[ATH9K_PHYERR_RADAR]);
+        AWDATA_RX(phy_err_stats[ATH9K_PHYERR_OFDM_TIMING]);
+        AWDATA_RX(phy_err_stats[ATH9K_PHYERR_CCK_TIMING]);
+        WARN_ON(i != ATH9K_SSTATS_LEN);
+}
 int ath9k_init_debug(struct ath_hw *ah)
 {
        struct ath_common *common = ath9k_hw_common(ah);
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index f9bee18de5a0..72d4893311b1 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -307,7 +307,22 @@ void ath_debug_stat_tx(struct ath_softc *sc, struct ath_buf *bf,
                       struct ath_tx_status *ts, struct ath_txq *txq,
                       unsigned int flags);
 void ath_debug_stat_rx(struct ath_softc *sc, struct ath_rx_status *rs);
+int ath9k_get_et_sset_count(struct ieee80211_hw *hw,
+                            struct ieee80211_vif *vif, int sset);
+void ath9k_get_et_stats(struct ieee80211_hw *hw,
+                        struct ieee80211_vif *vif,
+                        struct ethtool_stats *stats, u64 *data);
+void ath9k_get_et_strings(struct ieee80211_hw *hw,
+                          struct ieee80211_vif *vif,
+                          u32 sset, u8 *data);
+void ath9k_sta_add_debugfs(struct ieee80211_hw *hw,
+                           struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta,
+                           struct dentry *dir);
+void ath9k_sta_remove_debugfs(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif,
+                              struct ieee80211_sta *sta,
+                              struct dentry *dir);
 #else
 #define RX_STAT_INC(c) /* NOP */
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 0653dbc99e31..be30a9af1528 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -331,6 +331,7 @@ static void ath_node_attach(struct ath_softc *sc, struct ieee80211_sta *sta,
        u8 density;
        an = (struct ath_node *)sta->drv_priv;
+        an->sc = sc;
        an->sta = sta;
        an->vif = vif;
@@ -1882,133 +1883,6 @@ static int ath9k_get_antenna(struct ieee80211_hw *hw, u32 *tx_ant, u32 *rx_ant)
        return 0;
 }
-#ifdef CONFIG_ATH9K_DEBUGFS
-/* Ethtool support for get-stats */
-#define AMKSTR(nm) #nm "_BE", #nm "_BK", #nm "_VI", #nm "_VO"
-static const char ath9k_gstrings_stats[][ETH_GSTRING_LEN] = {
-        "tx_pkts_nic",
-        "tx_bytes_nic",
-        "rx_pkts_nic",
-        "rx_bytes_nic",
-        AMKSTR(d_tx_pkts),
-        AMKSTR(d_tx_bytes),
-        AMKSTR(d_tx_mpdus_queued),
-        AMKSTR(d_tx_mpdus_completed),
-        AMKSTR(d_tx_mpdu_xretries),
-        AMKSTR(d_tx_aggregates),
-        AMKSTR(d_tx_ampdus_queued_hw),
-        AMKSTR(d_tx_ampdus_queued_sw),
-        AMKSTR(d_tx_ampdus_completed),
-        AMKSTR(d_tx_ampdu_retries),
-        AMKSTR(d_tx_ampdu_xretries),
-        AMKSTR(d_tx_fifo_underrun),
-        AMKSTR(d_tx_op_exceeded),
-        AMKSTR(d_tx_timer_expiry),
-        AMKSTR(d_tx_desc_cfg_err),
-        AMKSTR(d_tx_data_underrun),
-        AMKSTR(d_tx_delim_underrun),
-        "d_rx_decrypt_crc_err",
-        "d_rx_phy_err",
-        "d_rx_mic_err",
-        "d_rx_pre_delim_crc_err",
-        "d_rx_post_delim_crc_err",
-        "d_rx_decrypt_busy_err",
-        "d_rx_phyerr_radar",
-        "d_rx_phyerr_ofdm_timing",
-        "d_rx_phyerr_cck_timing",
-};
-#define ATH9K_SSTATS_LEN ARRAY_SIZE(ath9k_gstrings_stats)
-static void ath9k_get_et_strings(struct ieee80211_hw *hw,
-                                 struct ieee80211_vif *vif,
-                                 u32 sset, u8 *data)
-{
-        if (sset == ETH_SS_STATS)
-                memcpy(data, *ath9k_gstrings_stats,
-                       sizeof(ath9k_gstrings_stats));
-}
-static int ath9k_get_et_sset_count(struct ieee80211_hw *hw,
-                                   struct ieee80211_vif *vif, int sset)
-{
-        if (sset == ETH_SS_STATS)
-                return ATH9K_SSTATS_LEN;
-        return 0;
-}
-#define AWDATA(elem)                                                    \
-        do {                                                            \
-                data[i++] = sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_BE)].elem; \
-                data[i++] = sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_BK)].elem; \
-                data[i++] = sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_VI)].elem; \
-                data[i++] = sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_VO)].elem; \
-        } while (0)
-#define AWDATA_RX(elem)                                         \
-        do {                                                    \
-                data[i++] = sc->debug.stats.rxstats.elem;       \
-        } while (0)
-static void ath9k_get_et_stats(struct ieee80211_hw *hw,
-                               struct ieee80211_vif *vif,
-                               struct ethtool_stats *stats, u64 *data)
-{
-        struct ath_softc *sc = hw->priv;
-        int i = 0;
-        data[i++] = (sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_BE)].tx_pkts_all +
-                     sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_BK)].tx_pkts_all +
-                     sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_VI)].tx_pkts_all +
-                     sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_VO)].tx_pkts_all);
-        data[i++] = (sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_BE)].tx_bytes_all +
-                     sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_BK)].tx_bytes_all +
-                     sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_VI)].tx_bytes_all +
-                     sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_VO)].tx_bytes_all);
-        AWDATA_RX(rx_pkts_all);
-        AWDATA_RX(rx_bytes_all);
-        AWDATA(tx_pkts_all);
-        AWDATA(tx_bytes_all);
-        AWDATA(queued);
-        AWDATA(completed);
-        AWDATA(xretries);
-        AWDATA(a_aggr);
-        AWDATA(a_queued_hw);
-        AWDATA(a_queued_sw);
-        AWDATA(a_completed);
-        AWDATA(a_retries);
-        AWDATA(a_xretries);
-        AWDATA(fifo_underrun);
-        AWDATA(xtxop);
-        AWDATA(timer_exp);
-        AWDATA(desc_cfg_err);
-        AWDATA(data_underrun);
-        AWDATA(delim_underrun);
-        AWDATA_RX(decrypt_crc_err);
-        AWDATA_RX(phy_err);
-        AWDATA_RX(mic_err);
-        AWDATA_RX(pre_delim_crc_err);
-        AWDATA_RX(post_delim_crc_err);
-        AWDATA_RX(decrypt_busy_err);
-        AWDATA_RX(phy_err_stats[ATH9K_PHYERR_RADAR]);
-        AWDATA_RX(phy_err_stats[ATH9K_PHYERR_OFDM_TIMING]);
-        AWDATA_RX(phy_err_stats[ATH9K_PHYERR_CCK_TIMING]);
-        WARN_ON(i != ATH9K_SSTATS_LEN);
-}
-/* End of ethtool get-stats functions */
-#endif
 #ifdef CONFIG_PM_SLEEP
 static void ath9k_wow_map_triggers(struct ath_softc *sc,
@@ -2402,7 +2276,12 @@ struct ieee80211_ops ath9k_ops = {
 #ifdef CONFIG_ATH9K_DEBUGFS
        .get_et_sset_count  = ath9k_get_et_sset_count,
-        .get_et_stats  = ath9k_get_et_stats,
+        .get_et_stats       = ath9k_get_et_stats,
-        .get_et_strings  = ath9k_get_et_strings,
+        .get_et_strings     = ath9k_get_et_strings,
+#endif
+#if defined(CONFIG_MAC80211_DEBUGFS) && defined(CONFIG_ATH9K_DEBUGFS)
+        .sta_add_debugfs    = ath9k_sta_add_debugfs,
+        .sta_remove_debugfs = ath9k_sta_remove_debugfs,
 #endif
 };
diff --git a/drivers/net/wireless/ath/ath9k/mci.c b/drivers/net/wireless/ath/ath9k/mci.c
index 706378ea3ba2..5c02702f21e7 100644
--- a/drivers/net/wireless/ath/ath9k/mci.c
+++ b/drivers/net/wireless/ath/ath9k/mci.c
@@ -257,8 +257,9 @@ static void ath_mci_set_concur_txprio(struct ath_softc *sc)
 {
        struct ath_btcoex *btcoex = &sc->btcoex;
        struct ath_mci_profile *mci = &btcoex->mci;
-        u8 stomp_txprio[] = { 0, 0, 0, 0 }; /* all, low, none, low_ftp */
+        u8 stomp_txprio[ATH_BTCOEX_STOMP_MAX];
+        memset(stomp_txprio, 0, sizeof(stomp_txprio));
        if (mci->num_mgmt) {
                stomp_txprio[ATH_BTCOEX_STOMP_ALL] = ATH_MCI_INQUIRY_PRIO;
                if (!mci->num_pan && !mci->num_other_acl)
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 9553203ee624..8e9b826f878b 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -287,7 +287,7 @@ static void ath_pci_remove(struct pci_dev *pdev)
        pci_release_region(pdev, 0);
 }
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static int ath_pci_suspend(struct device *device)
 {
@@ -333,22 +333,15 @@ static int ath_pci_resume(struct device *device)
        return 0;
 }
-static const struct dev_pm_ops ath9k_pm_ops = {
+static SIMPLE_DEV_PM_OPS(ath9k_pm_ops, ath_pci_suspend, ath_pci_resume);
-        .suspend = ath_pci_suspend,
-        .resume = ath_pci_resume,
-        .freeze = ath_pci_suspend,
-        .thaw = ath_pci_resume,
-        .poweroff = ath_pci_suspend,
-        .restore = ath_pci_resume,
-};
 #define ATH9K_PM_OPS    (&ath9k_pm_ops)
-#else /* !CONFIG_PM */
+#else /* !CONFIG_PM_SLEEP */
 #define ATH9K_PM_OPS    NULL
-#endif /* !CONFIG_PM */
+#endif /* !CONFIG_PM_SLEEP */
 MODULE_DEVICE_TABLE(pci, ath_pci_id_table);
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 34130943f9de..90e48a0fafe5 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -312,7 +312,6 @@ static struct ath_buf *ath_tx_get_buffer(struct ath_softc *sc)
        }
        bf = list_first_entry(&sc->tx.txbuf, struct ath_buf, list);
-        bf->bf_next = NULL;
        list_del(&bf->list);
        spin_unlock_bh(&sc->tx.txbuflock);
@@ -1263,7 +1262,7 @@ void ath_tx_aggr_sleep(struct ieee80211_sta *sta, struct ath_softc *sc,
        int tidno;
        for (tidno = 0, tid = &an->tid[tidno];
-             tidno < WME_NUM_TID; tidno++, tid++) {
+             tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
                if (!tid->sched)
                        continue;
@@ -1297,7 +1296,7 @@ void ath_tx_aggr_wakeup(struct ath_softc *sc, struct ath_node *an)
        int tidno;
        for (tidno = 0, tid = &an->tid[tidno];
-             tidno < WME_NUM_TID; tidno++, tid++) {
+             tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
                ac = tid->ac;
                txq = ac->txq;
@@ -2448,7 +2447,7 @@ void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an)
        int tidno, acno;
        for (tidno = 0, tid = &an->tid[tidno];
-             tidno < WME_NUM_TID;
+             tidno < IEEE80211_NUM_TIDS;
             tidno++, tid++) {
                tid->an        = an;
                tid->tidno     = tidno;
@@ -2481,7 +2480,7 @@ void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an)
        int tidno;
        for (tidno = 0, tid = &an->tid[tidno];
-             tidno < WME_NUM_TID; tidno++, tid++) {
+             tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
                ac = tid->ac;
                txq = ac->txq;
diff --git a/drivers/net/wireless/ath/carl9170/Kconfig b/drivers/net/wireless/ath/carl9170/Kconfig
index 267d5dcf82dc..13a204598766 100644
--- a/drivers/net/wireless/ath/carl9170/Kconfig
+++ b/drivers/net/wireless/ath/carl9170/Kconfig
@@ -1,6 +1,7 @@
 config CARL9170
        tristate "Linux Community AR9170 802.11n USB support"
        depends on USB && MAC80211 && EXPERIMENTAL
+        select ATH_COMMON
        select FW_LOADER
        select CRC32
        help
diff --git a/drivers/net/wireless/ath/carl9170/rx.c b/drivers/net/wireless/ath/carl9170/rx.c
index 6d22382875bc..876a773fd0b4 100644
--- a/drivers/net/wireless/ath/carl9170/rx.c
+++ b/drivers/net/wireless/ath/carl9170/rx.c
@@ -814,6 +814,8 @@ static void carl9170_rx_untie_data(struct ar9170 *ar, u8 *buf, int len)
        if (phy)
                carl9170_rx_phy_status(ar, phy, &status);
+        else
+                status.flag |= RX_FLAG_NO_SIGNAL_VAL;
        if (carl9170_handle_mpdu(ar, buf, mpdu_len, &status))
                goto drop;
diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
index 84377cf580e0..ef4ec0da6e49 100644
--- a/drivers/net/wireless/ath/carl9170/tx.c
+++ b/drivers/net/wireless/ath/carl9170/tx.c
@@ -1485,6 +1485,13 @@ void carl9170_op_tx(struct ieee80211_hw *hw,
        }
        if (info->flags & IEEE80211_TX_CTL_AMPDU) {
+                /* to static code analyzers and reviewers:
+                 * mac80211 guarantees that a valid "sta"
+                 * reference is present, if a frame is to
+                 * be part of an ampdu. Hence any extra
+                 * sta == NULL checks are redundant in this
+                 * special case.
+                 */
                run = carl9170_tx_ampdu_queue(ar, sta, skb);
                if (run)
                        carl9170_tx_ampdu(ar);
diff --git a/drivers/net/wireless/atmel_pci.c b/drivers/net/wireless/atmel_pci.c
index 51e33b53386e..c1b159ebcffe 100644
--- a/drivers/net/wireless/atmel_pci.c
+++ b/drivers/net/wireless/atmel_pci.c
@@ -45,11 +45,11 @@ static struct pci_driver atmel_driver = {
        .name     = "atmel",
        .id_table = card_ids,
        .probe    = atmel_pci_probe,
-        .remove   = __devexit_p(atmel_pci_remove),
+        .remove   = atmel_pci_remove,
 };
-static int __devinit atmel_pci_probe(struct pci_dev *pdev,
+static int atmel_pci_probe(struct pci_dev *pdev,
                                     const struct pci_device_id *pent)
 {
        struct net_device *dev;
@@ -69,7 +69,7 @@ static int __devinit atmel_pci_probe(struct pci_dev *pdev,
        return 0;
 }
-static void __devexit atmel_pci_remove(struct pci_dev *pdev)
+static void atmel_pci_remove(struct pci_dev *pdev)
 {
        stop_atmel_card(pci_get_drvdata(pdev));
 }
diff --git a/drivers/net/wireless/b43/pcmcia.c b/drivers/net/wireless/b43/pcmcia.c
index 714cad649c45..f2ea2ceec8a9 100644
--- a/drivers/net/wireless/b43/pcmcia.c
+++ b/drivers/net/wireless/b43/pcmcia.c
@@ -60,7 +60,7 @@ static int b43_pcmcia_resume(struct pcmcia_device *dev)
 # define b43_pcmcia_resume              NULL
 #endif /* CONFIG_PM */
-static int __devinit b43_pcmcia_probe(struct pcmcia_device *dev)
+static int b43_pcmcia_probe(struct pcmcia_device *dev)
 {
        struct ssb_bus *ssb;
        int err = -ENOMEM;
@@ -110,7 +110,7 @@ out_error:
        return err;
 }
-static void __devexit b43_pcmcia_remove(struct pcmcia_device *dev)
+static void b43_pcmcia_remove(struct pcmcia_device *dev)
 {
        struct ssb_bus *ssb = dev->priv;
@@ -125,7 +125,7 @@ static struct pcmcia_driver b43_pcmcia_driver = {
        .name           = "b43-pcmcia",
        .id_table       = b43_pcmcia_tbl,
        .probe          = b43_pcmcia_probe,
-        .remove         = __devexit_p(b43_pcmcia_remove),
+        .remove         = b43_pcmcia_remove,
        .suspend        = b43_pcmcia_suspend,
        .resume         = b43_pcmcia_resume,
 };
diff --git a/drivers/net/wireless/b43/sdio.c b/drivers/net/wireless/b43/sdio.c
index a54fb2d29089..59a521800694 100644
--- a/drivers/net/wireless/b43/sdio.c
+++ b/drivers/net/wireless/b43/sdio.c
@@ -93,7 +93,7 @@ void b43_sdio_free_irq(struct b43_wldev *dev)
        sdio->irq_handler = NULL;
 }
-static int __devinit b43_sdio_probe(struct sdio_func *func,
+static int b43_sdio_probe(struct sdio_func *func,
                                    const struct sdio_device_id *id)
 {
        struct b43_sdio *sdio;
@@ -171,7 +171,7 @@ out:
        return error;
 }
-static void __devexit b43_sdio_remove(struct sdio_func *func)
+static void b43_sdio_remove(struct sdio_func *func)
 {
        struct b43_sdio *sdio = sdio_get_drvdata(func);
@@ -193,7 +193,7 @@ static struct sdio_driver b43_sdio_driver = {
        .name           = "b43-sdio",
        .id_table       = b43_sdio_ids,
        .probe          = b43_sdio_probe,
-        .remove         = __devexit_p(b43_sdio_remove),
+        .remove         = b43_sdio_remove,
 };
 int b43_sdio_init(void)
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
index fa8fc4433417..7a00c4614baf 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
@@ -314,7 +314,7 @@ static void brcmf_fweh_event_worker(struct work_struct *work)
        while ((event = brcmf_fweh_dequeue_event(fweh))) {
                ifp = drvr->iflist[event->ifidx];
-                brcmf_dbg(EVENT, "event %s (%u) ifidx %u bsscfg %u addr %pM:\n",
+                brcmf_dbg(EVENT, "event %s (%u) ifidx %u bsscfg %u addr %pM\n",
                          brcmf_fweh_event_name(event->code), event->code,
                          event->emsg.ifidx, event->emsg.bsscfgidx,
                          event->emsg.addr);
@@ -337,7 +337,7 @@ static void brcmf_fweh_event_worker(struct work_struct *work)
                          emsg.version, emsg.flags, emsg.status, emsg.reason);
                brcmf_dbg_hex_dump(BRCMF_EVENT_ON(), event->data,
                                   min_t(u32, emsg.datalen, 64),
-                                   "appended:");
+                                   "event payload, len=%d\n", emsg.datalen);
                /* special handling of interface event */
                if (event->code == BRCMF_E_IF) {
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fweh.h b/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
index b39246a630df..240a2eafead5 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
@@ -158,7 +158,7 @@ typedef int (*brcmf_fweh_handler_t)(struct brcmf_if *ifp,
 */
 struct brcmf_fweh_info {
        struct work_struct event_work;
-        struct spinlock evt_q_lock;
+        spinlock_t evt_q_lock;
        struct list_head event_q;
        int (*evt_handler[BRCMF_E_LAST])(struct brcmf_if *ifp,
                                         const struct brcmf_event_msg *evtmsg,
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index 2044fdb55558..96bc349d7f6c 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -447,7 +447,7 @@ brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
                         struct vif_params *params)
 {
        struct brcmf_if *ifp = netdev_priv(ndev);
-        struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+        struct brcmf_cfg80211_vif *vif = ifp->vif;
        s32 infra = 0;
        s32 ap = 0;
        s32 err = 0;
@@ -461,15 +461,15 @@ brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
                       type);
                return -EOPNOTSUPP;
        case NL80211_IFTYPE_ADHOC:
-                cfg->conf->mode = WL_MODE_IBSS;
+                vif->mode = WL_MODE_IBSS;
                infra = 0;
                break;
        case NL80211_IFTYPE_STATION:
-                cfg->conf->mode = WL_MODE_BSS;
+                vif->mode = WL_MODE_BSS;
                infra = 1;
                break;
        case NL80211_IFTYPE_AP:
-                cfg->conf->mode = WL_MODE_AP;
+                vif->mode = WL_MODE_AP;
                ap = 1;
                break;
        default:
@@ -478,18 +478,16 @@ brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
        }
        if (ap) {
-                set_bit(BRCMF_VIF_STATUS_AP_CREATING, &ifp->vif->sme_state);
+                set_bit(BRCMF_VIF_STATUS_AP_CREATING, &vif->sme_state);
                WL_INFO("IF Type = AP\n");
        } else {
-                err = brcmf_fil_cmd_int_set(netdev_priv(ndev),
+                err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, infra);
-                                            BRCMF_C_SET_INFRA, infra);
                if (err) {
                        WL_ERR("WLC_SET_INFRA error (%d)\n", err);
                        err = -EAGAIN;
                        goto done;
                }
-                WL_INFO("IF Type = %s\n",
+                WL_INFO("IF Type = %s\n", (vif->mode == WL_MODE_IBSS) ?
-                        (cfg->conf->mode == WL_MODE_IBSS) ?
                        "Adhoc" : "Infra");
        }
        ndev->ieee80211_ptr->iftype = type;
@@ -963,22 +961,21 @@ static void brcmf_ch_to_chanspec(int ch, struct brcmf_join_params *join_params,
        }
 }
-static void brcmf_link_down(struct brcmf_cfg80211_info *cfg)
+static void brcmf_link_down(struct brcmf_cfg80211_vif *vif)
 {
-        struct net_device *ndev = NULL;
        s32 err = 0;
        WL_TRACE("Enter\n");
-        if (cfg->link_up) {
+        if (test_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state)) {
-                ndev = cfg_to_ndev(cfg);
                WL_INFO("Call WLC_DISASSOC to stop excess roaming\n ");
-                err = brcmf_fil_cmd_data_set(netdev_priv(ndev),
+                err = brcmf_fil_cmd_data_set(vif->ifp,
                                             BRCMF_C_DISASSOC, NULL, 0);
                if (err)
                        WL_ERR("WLC_DISASSOC failed (%d)\n", err);
-                cfg->link_up = false;
+                clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state);
        }
+        clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
        WL_TRACE("Exit\n");
 }
@@ -1130,7 +1127,6 @@ done:
 static s32
 brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
 {
-        struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
        struct brcmf_if *ifp = netdev_priv(ndev);
        s32 err = 0;
@@ -1138,7 +1134,7 @@ brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
        if (!check_vif_up(ifp->vif))
                return -EIO;
-        brcmf_link_down(cfg);
+        brcmf_link_down(ifp->vif);
        WL_TRACE("Exit\n");
@@ -1496,7 +1492,6 @@ static s32
 brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
                       u16 reason_code)
 {
-        struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
        struct brcmf_if *ifp = netdev_priv(ndev);
        struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
        struct brcmf_scb_val_le scbval;
@@ -1515,8 +1510,6 @@ brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
        if (err)
                WL_ERR("error (%d)\n", err);
-        cfg->link_up = false;
        WL_TRACE("Exit\n");
        return err;
 }
@@ -1716,7 +1709,6 @@ brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
                    u8 key_idx, bool pairwise, const u8 *mac_addr,
                    struct key_params *params)
 {
-        struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
        struct brcmf_if *ifp = netdev_priv(ndev);
        struct brcmf_wsec_key key;
        s32 val;
@@ -1758,7 +1750,7 @@ brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
                WL_CONN("WLAN_CIPHER_SUITE_WEP104\n");
                break;
        case WLAN_CIPHER_SUITE_TKIP:
-                if (cfg->conf->mode != WL_MODE_AP) {
+                if (ifp->vif->mode != WL_MODE_AP) {
                        WL_CONN("Swapping key\n");
                        memcpy(keybuf, &key.data[24], sizeof(keybuf));
                        memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
@@ -1908,7 +1900,6 @@ static s32
 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
                           u8 *mac, struct station_info *sinfo)
 {
-        struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
        struct brcmf_if *ifp = netdev_priv(ndev);
        struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
        struct brcmf_scb_val_le scb_val;
@@ -1922,7 +1913,7 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
        if (!check_vif_up(ifp->vif))
                return -EIO;
-        if (cfg->conf->mode == WL_MODE_AP) {
+        if (ifp->vif->mode == WL_MODE_AP) {
                memcpy(&sta_info_le, mac, ETH_ALEN);
                err = brcmf_fil_iovar_data_get(ifp, "sta_info",
                                               &sta_info_le,
@@ -1939,7 +1930,7 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
                }
                WL_TRACE("STA idle time : %d ms, connected time :%d sec\n",
                         sinfo->inactive_time, sinfo->connected_time);
-        } else if (cfg->conf->mode == WL_MODE_BSS) {
+        } else if (ifp->vif->mode == WL_MODE_BSS) {
                if (memcmp(mac, bssid, ETH_ALEN)) {
                        WL_ERR("Wrong Mac address cfg_mac-%pM wl_bssid-%pM\n",
                               mac, bssid);
@@ -2249,9 +2240,9 @@ CleanUp:
        return err;
 }
-static bool brcmf_is_ibssmode(struct brcmf_cfg80211_info *cfg)
+static bool brcmf_is_ibssmode(struct brcmf_cfg80211_vif *vif)
 {
-        return cfg->conf->mode == WL_MODE_IBSS;
+        return vif->mode == WL_MODE_IBSS;
 }
 /*
@@ -2336,7 +2327,7 @@ static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg)
        s32 err = 0;
        WL_TRACE("Enter\n");
-        if (brcmf_is_ibssmode(cfg))
+        if (brcmf_is_ibssmode(ifp->vif))
                return err;
        ssid = &profile->ssid;
@@ -2596,17 +2587,13 @@ static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
                 * While going to suspend if associated with AP disassociate
                 * from AP to save power while system is in suspended state
                 */
-                if (test_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state) ||
+                brcmf_link_down(vif);
-                    test_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state)) {
-                        WL_INFO("Disassociating from AP before suspend\n");
+                /* Make sure WPA_Supplicant receives all the event
-                        brcmf_link_down(cfg);
+                 * generated due to DISASSOC call to the fw to keep
+                 * the state fw and WPA_Supplicant state consistent
-                        /* Make sure WPA_Supplicant receives all the event
+                 */
-                         * generated due to DISASSOC call to the fw to keep
+                brcmf_delay(500);
-                         * the state fw and WPA_Supplicant state consistent
-                         */
-                        brcmf_delay(500);
-                }
        }
        /* end any scanning */
@@ -3306,11 +3293,12 @@ brcmf_parse_vndr_ies(const u8 *vndr_ie_buf, u32 vndr_ie_len,
                if (vndr_ies->count >= MAX_VNDR_IE_NUMBER)
                        break;
 next:
-                remaining_len -= ie->len;
+                remaining_len -= (ie->len + TLV_HDR_LEN);
-                if (remaining_len <= 2)
+                if (remaining_len <= TLV_HDR_LEN)
                        ie = NULL;
                else
-                        ie = (struct brcmf_tlv *)(((u8 *)ie) + ie->len);
+                        ie = (struct brcmf_tlv *)(((u8 *)ie) + ie->len +
+                                TLV_HDR_LEN);
        }
        return err;
 }
@@ -3409,11 +3397,11 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
                }
        }
-        if (mgmt_ie_buf != NULL) {
+        if (mgmt_ie_buf && *mgmt_ie_len) {
                if (parsed_ie_buf_len && (parsed_ie_buf_len == *mgmt_ie_len) &&
                    (memcmp(mgmt_ie_buf, curr_ie_buf,
                            parsed_ie_buf_len) == 0)) {
-                        WL_TRACE("Previous mgmt IE is equals to current IE");
+                        WL_TRACE("Previous mgmt IE equals to current IE\n");
                        goto exit;
                }
@@ -3451,6 +3439,16 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
                for (i = 0; i < new_vndr_ies.count; i++) {
                        vndrie_info = &new_vndr_ies.ie_info[i];
+                        /* verify remained buf size before copy data */
+                        if (remained_buf_len < (vndrie_info->vndrie.len +
+                                                        VNDR_IE_VSIE_OFFSET)) {
+                                WL_ERR("no space in mgmt_ie_buf: len left %d",
+                                       remained_buf_len);
+                                break;
+                        }
+                        remained_buf_len -= (vndrie_info->ie_len +
+                                             VNDR_IE_VSIE_OFFSET);
                        WL_TRACE("ADDED ID : %d, Len: %d, OUI:%02x:%02x:%02x\n",
                                 vndrie_info->vndrie.id,
                                 vndrie_info->vndrie.len,
@@ -3462,13 +3460,6 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
                                                           vndrie_info->ie_ptr,
                                                           vndrie_info->ie_len,
                                                           "add");
-                        /* verify remained buf size before copy data */
-                        remained_buf_len -= vndrie_info->ie_len;
-                        if (remained_buf_len < 0) {
-                                WL_ERR("no space in mgmt_ie_buf: len left %d",
-                                        remained_buf_len);
-                                break;
-                        }
                        /* save the parsed IE in wl struct */
                        memcpy(ptr + (*mgmt_ie_len), vndrie_info->ie_ptr,
@@ -3643,22 +3634,20 @@ exit:
 static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
 {
        struct brcmf_if *ifp = netdev_priv(ndev);
-        struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
        s32 err = -EPERM;
        WL_TRACE("Enter\n");
-        if (cfg->conf->mode == WL_MODE_AP) {
+        if (ifp->vif->mode == WL_MODE_AP) {
                /* Due to most likely deauths outstanding we sleep */
                /* first to make sure they get processed by fw. */
                msleep(400);
-                err = brcmf_fil_cmd_int_set(netdev_priv(ndev),
+                err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
-                                            BRCMF_C_SET_AP, 0);
                if (err < 0) {
                        WL_ERR("setting AP mode failed %d\n", err);
                        goto exit;
                }
-                err = brcmf_fil_cmd_int_set(netdev_priv(ndev), BRCMF_C_UP, 0);
+                err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 0);
                if (err < 0) {
                        WL_ERR("BRCMF_C_UP error %d\n", err);
                        goto exit;
@@ -3849,23 +3838,20 @@ static void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
        }
 }
-static bool brcmf_is_linkup(struct brcmf_cfg80211_info *cfg,
+static bool brcmf_is_linkup(const struct brcmf_event_msg *e)
-                            const struct brcmf_event_msg *e)
 {
        u32 event = e->event_code;
        u32 status = e->status;
        if (event == BRCMF_E_SET_SSID && status == BRCMF_E_STATUS_SUCCESS) {
                WL_CONN("Processing set ssid\n");
-                cfg->link_up = true;
                return true;
        }
        return false;
 }
-static bool brcmf_is_linkdown(struct brcmf_cfg80211_info *cfg,
+static bool brcmf_is_linkdown(const struct brcmf_event_msg *e)
-                              const struct brcmf_event_msg *e)
 {
        u32 event = e->event_code;
        u16 flags = e->flags;
@@ -4115,11 +4101,11 @@ brcmf_notify_connect_status(struct brcmf_if *ifp,
        struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
        s32 err = 0;
-        if (cfg->conf->mode == WL_MODE_AP) {
+        if (ifp->vif->mode == WL_MODE_AP) {
                err = brcmf_notify_connect_status_ap(cfg, ndev, e, data);
-        } else if (brcmf_is_linkup(cfg, e)) {
+        } else if (brcmf_is_linkup(e)) {
                WL_CONN("Linkup\n");
-                if (brcmf_is_ibssmode(cfg)) {
+                if (brcmf_is_ibssmode(ifp->vif)) {
                        memcpy(profile->bssid, e->addr, ETH_ALEN);
                        wl_inform_ibss(cfg, ndev, e->addr);
                        cfg80211_ibss_joined(ndev, e->addr, GFP_KERNEL);
@@ -4129,26 +4115,19 @@ brcmf_notify_connect_status(struct brcmf_if *ifp,
                                &ifp->vif->sme_state);
                } else
                        brcmf_bss_connect_done(cfg, ndev, e, true);
-        } else if (brcmf_is_linkdown(cfg, e)) {
+        } else if (brcmf_is_linkdown(e)) {
                WL_CONN("Linkdown\n");
-                if (brcmf_is_ibssmode(cfg)) {
+                if (!brcmf_is_ibssmode(ifp->vif)) {
-                        clear_bit(BRCMF_VIF_STATUS_CONNECTING,
-                                  &ifp->vif->sme_state);
-                        if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED,
-                                               &ifp->vif->sme_state))
-                                brcmf_link_down(cfg);
-                } else {
                        brcmf_bss_connect_done(cfg, ndev, e, false);
                        if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED,
-                                               &ifp->vif->sme_state)) {
+                                               &ifp->vif->sme_state))
                                cfg80211_disconnected(ndev, 0, NULL, 0,
                                                      GFP_KERNEL);
-                                brcmf_link_down(cfg);
-                        }
                }
+                brcmf_link_down(ifp->vif);
                brcmf_init_prof(ndev_to_prof(ndev));
        } else if (brcmf_is_nonetwork(cfg, e)) {
-                if (brcmf_is_ibssmode(cfg))
+                if (brcmf_is_ibssmode(ifp->vif))
                        clear_bit(BRCMF_VIF_STATUS_CONNECTING,
                                  &ifp->vif->sme_state);
                else
@@ -4197,7 +4176,6 @@ brcmf_notify_mic_status(struct brcmf_if *ifp,
 static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf)
 {
-        conf->mode = (u32)-1;
        conf->frag_threshold = (u32)-1;
        conf->rts_threshold = (u32)-1;
        conf->retry_short = (u32)-1;
@@ -4282,7 +4260,6 @@ static s32 wl_init_priv(struct brcmf_cfg80211_info *cfg)
        mutex_init(&cfg->usr_sync);
        brcmf_init_escan(cfg);
        brcmf_init_conf(cfg->conf);
-        brcmf_link_down(cfg);
        return err;
 }
@@ -4290,7 +4267,6 @@ static s32 wl_init_priv(struct brcmf_cfg80211_info *cfg)
 static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
 {
        cfg->dongle_up = false; /* dongle down */
-        brcmf_link_down(cfg);
        brcmf_abort_scanning(cfg);
        brcmf_deinit_priv_mem(cfg);
 }
@@ -4537,11 +4513,8 @@ static s32 __brcmf_cfg80211_down(struct brcmf_if *ifp)
         * While going down, if associated with AP disassociate
         * from AP to save power
         */
-        if ((test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state) ||
+        if (check_vif_up(ifp->vif)) {
-             test_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state)) &&
+                brcmf_link_down(ifp->vif);
-             check_vif_up(ifp->vif)) {
-                WL_INFO("Disassociating from AP");
-                brcmf_link_down(cfg);
                /* Make sure WPA_Supplicant receives all the event
                   generated due to DISASSOC call to the fw to keep
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
index e2ef8519ea84..d60de187e7d9 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
@@ -128,7 +128,6 @@ enum wl_mode {
 /* dongle configuration */
 struct brcmf_cfg80211_conf {
-        u32 mode;               /* adhoc , infrastructure or ap */
        u32 frag_threshold;
        u32 rts_threshold;
        u32 retry_short;
@@ -359,7 +358,6 @@ struct brcmf_pno_scanresults_le {
 * @active_scan: current scan mode.
 * @sched_escan: e-scan for scheduled scan support running.
 * @ibss_starter: indicates this sta is ibss starter.
- * @link_up: link/connection up flag.
 * @pwr_save: indicate whether dongle to support power save mode.
 * @dongle_up: indicate whether dongle up or not.
 * @roam_on: on/off switch for dongle self-roaming.
@@ -391,7 +389,6 @@ struct brcmf_cfg80211_info {
        bool active_scan;
        bool sched_escan;
        bool ibss_starter;
-        bool link_up;
        bool pwr_save;
        bool dongle_up;
        bool roam_on;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/debug.c b/drivers/net/wireless/brcm80211/brcmsmac/debug.c
index 6ba4136c7cf6..9761deb46204 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/debug.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/debug.c
@@ -1,8 +1,120 @@
+/*
+ * Copyright (c) 2012 Broadcom Corporation
+ * Copyright (c) 2012 Canonical Ltd.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#include <linux/debugfs.h>
+#include <linux/if_ether.h>
+#include <linux/if.h>
 #include <linux/net.h>
+#include <linux/netdevice.h>
+#include <linux/ieee80211.h>
+#include <linux/module.h>
+#include <net/mac80211.h>
+#include <defs.h>
+#include <brcmu_wifi.h>
+#include <brcmu_utils.h>
 #include "types.h"
+#include "main.h"
 #include "debug.h"
 #include "brcms_trace_events.h"
+static struct dentry *root_folder;
+void brcms_debugfs_init(void)
+{
+        root_folder = debugfs_create_dir(KBUILD_MODNAME, NULL);
+        if (IS_ERR(root_folder))
+                root_folder = NULL;
+}
+void brcms_debugfs_exit(void)
+{
+        if (!root_folder)
+                return;
+        debugfs_remove_recursive(root_folder);
+        root_folder = NULL;
+}
+int brcms_debugfs_attach(struct brcms_pub *drvr)
+{
+        if (!root_folder)
+                return -ENODEV;
+        drvr->dbgfs_dir = debugfs_create_dir(
+                 dev_name(&drvr->wlc->hw->d11core->dev), root_folder);
+        return PTR_RET(drvr->dbgfs_dir);
+}
+void brcms_debugfs_detach(struct brcms_pub *drvr)
+{
+        if (!IS_ERR_OR_NULL(drvr->dbgfs_dir))
+                debugfs_remove_recursive(drvr->dbgfs_dir);
+}
+struct dentry *brcms_debugfs_get_devdir(struct brcms_pub *drvr)
+{
+        return drvr->dbgfs_dir;
+}
+static
+ssize_t brcms_debugfs_hardware_read(struct file *f, char __user *data,
+                                        size_t count, loff_t *ppos)
+{
+        char buf[128];
+        int res;
+        struct brcms_pub *drvr = f->private_data;
+        /* only allow read from start */
+        if (*ppos > 0)
+                return 0;
+        res = scnprintf(buf, sizeof(buf),
+                "board vendor: %x\n"
+                "board type: %x\n"
+                "board revision: %x\n"
+                "board flags: %x\n"
+                "board flags2: %x\n"
+                "firmware revision: %x\n",
+                drvr->wlc->hw->d11core->bus->boardinfo.vendor,
+                drvr->wlc->hw->d11core->bus->boardinfo.type,
+                drvr->wlc->hw->boardrev,
+                drvr->wlc->hw->boardflags,
+                drvr->wlc->hw->boardflags2,
+                drvr->wlc->ucode_rev
+                );
+        return simple_read_from_buffer(data, count, ppos, buf, res);
+}
+static const struct file_operations brcms_debugfs_hardware_ops = {
+        .owner = THIS_MODULE,
+        .open = simple_open,
+        .read = brcms_debugfs_hardware_read
+};
+void brcms_debugfs_create_files(struct brcms_pub *drvr)
+{
+        struct dentry *dentry = drvr->dbgfs_dir;
+        if (!IS_ERR_OR_NULL(dentry))
+                debugfs_create_file("hardware", S_IRUGO, dentry,
+                                    drvr, &brcms_debugfs_hardware_ops);
+}
 #define __brcms_fn(fn)                                          \
 void __brcms_ ##fn(struct device *dev, const char *fmt, ...)    \
 {                                                               \
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/debug.h b/drivers/net/wireless/brcm80211/brcmsmac/debug.h
index f77066bda9d2..796836b0f469 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/debug.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/debug.h
@@ -1,3 +1,18 @@
+/*
+ * Copyright (c) 2012 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
 #ifndef _BRCMS_DEBUG_H_
 #define _BRCMS_DEBUG_H_
@@ -49,4 +64,12 @@ void __brcms_dbg(struct device *dev, u32 level, const char *func,
 #define brcms_dbg_dma(core, f, a...)            brcms_dbg(core, BRCM_DL_DMA, f, ##a)
 #define brcms_dbg_ht(core, f, a...)             brcms_dbg(core, BRCM_DL_HT, f, ##a)
+struct brcms_pub;
+void brcms_debugfs_init(void);
+void brcms_debugfs_exit(void);
+int brcms_debugfs_attach(struct brcms_pub *drvr);
+void brcms_debugfs_detach(struct brcms_pub *drvr);
+struct dentry *brcms_debugfs_get_devdir(struct brcms_pub *drvr);
+void brcms_debugfs_create_files(struct brcms_pub *drvr);
 #endif /* _BRCMS_DEBUG_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/dma.c b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
index 511e45775c33..1860c572b3c4 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/dma.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
@@ -349,10 +349,8 @@ static uint _dma_ctrlflags(struct dma_info *di, uint mask, uint flags)
 {
        uint dmactrlflags;
-        if (di == NULL) {
+        if (di == NULL)
-                brcms_dbg_dma(di->core, "NULL dma handle\n");
                return 0;
-        }
        dmactrlflags = di->dma.dmactrlflags;
        dmactrlflags &= ~mask;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index 1710ccba8bac..02d27eacc0e2 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -285,8 +285,8 @@ static void brcms_ops_tx(struct ieee80211_hw *hw,
                kfree_skb(skb);
                goto done;
        }
-        brcms_c_sendpkt_mac80211(wl->wlc, skb, hw);
+        if (brcms_c_sendpkt_mac80211(wl->wlc, skb, hw))
-        tx_info->rate_driver_data[0] = control->sta;
+                tx_info->rate_driver_data[0] = control->sta;
 done:
        spin_unlock_bh(&wl->lock);
 }
@@ -846,8 +846,10 @@ static void brcms_free(struct brcms_info *wl)
        /* kill dpc */
        tasklet_kill(&wl->tasklet);
-        if (wl->pub)
+        if (wl->pub) {
+                brcms_debugfs_detach(wl->pub);
                brcms_c_module_unregister(wl->pub, "linux", wl);
+        }
        /* free common resources */
        if (wl->wlc) {
@@ -896,27 +898,22 @@ static void brcms_remove(struct bcma_device *pdev)
 static irqreturn_t brcms_isr(int irq, void *dev_id)
 {
        struct brcms_info *wl;
-        bool ours, wantdpc;
+        irqreturn_t ret = IRQ_NONE;
        wl = (struct brcms_info *) dev_id;
        spin_lock(&wl->isr_lock);
        /* call common first level interrupt handler */
-        ours = brcms_c_isr(wl->wlc, &wantdpc);
+        if (brcms_c_isr(wl->wlc)) {
-        if (ours) {
+                /* schedule second level handler */
-                /* if more to do... */
+                tasklet_schedule(&wl->tasklet);
-                if (wantdpc) {
+                ret = IRQ_HANDLED;
-                        /* ...and call the second level interrupt handler */
-                        /* schedule dpc */
-                        tasklet_schedule(&wl->tasklet);
-                }
        }
        spin_unlock(&wl->isr_lock);
-        return IRQ_RETVAL(ours);
+        return ret;
 }
 /*
@@ -1082,6 +1079,8 @@ static struct brcms_info *brcms_attach(struct bcma_device *pdev)
            regulatory_hint(wl->wiphy, wl->pub->srom_ccode))
                wiphy_err(wl->wiphy, "%s: regulatory hint failed\n", __func__);
+        brcms_debugfs_attach(wl->pub);
+        brcms_debugfs_create_files(wl->pub);
        n_adapters_found++;
        return wl;
@@ -1100,7 +1099,7 @@ fail:
 *
 * Perimeter lock is initialized in the course of this function.
 */
-static int __devinit brcms_bcma_probe(struct bcma_device *pdev)
+static int brcms_bcma_probe(struct bcma_device *pdev)
 {
        struct brcms_info *wl;
        struct ieee80211_hw *hw;
@@ -1166,7 +1165,7 @@ static struct bcma_driver brcms_bcma_driver = {
        .probe    = brcms_bcma_probe,
        .suspend  = brcms_suspend,
        .resume   = brcms_resume,
-        .remove   = __devexit_p(brcms_remove),
+        .remove   = brcms_remove,
        .id_table = brcms_coreid_table,
 };
@@ -1190,6 +1189,7 @@ static DECLARE_WORK(brcms_driver_work, brcms_driver_init);
 static int __init brcms_module_init(void)
 {
+        brcms_debugfs_init();
        if (!schedule_work(&brcms_driver_work))
                return -EBUSY;
@@ -1207,6 +1207,7 @@ static void __exit brcms_module_exit(void)
 {
        cancel_work_sync(&brcms_driver_work);
        bcma_driver_unregister(&brcms_bcma_driver);
+        brcms_debugfs_exit();
 }
 module_init(brcms_module_init);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 2a44593f1e37..8fce68751e47 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -1044,11 +1044,17 @@ brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
        s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
        while (!(*fatal)
               && (s1 & TXS_V)) {
+                /* !give others some time to run! */
+                if (n >= max_tx_num) {
+                        morepending = true;
+                        break;
+                }
                if (s1 == 0xffffffff) {
                        brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
                                  __func__);
-                        return morepending;
+                        *fatal = true;
+                        return false;
                }
                s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2));
@@ -1060,17 +1066,12 @@ brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
                *fatal = brcms_c_dotxstatus(wlc_hw->wlc, txs);
-                /* !give others some time to run! */
-                if (++n >= max_tx_num)
-                        break;
                s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
+                n++;
        }
        if (*fatal)
-                return 0;
+                return false;
-        if (n >= max_tx_num)
-                morepending = true;
        return morepending;
 }
@@ -2546,10 +2547,6 @@ static inline u32 wlc_intstatus(struct brcms_c_info *wlc, bool in_isr)
        if (macintstatus == 0)
                return 0;
-        /* interrupts are already turned off for CFE build
-         * Caution: For CFE Turning off the interrupts again has some undesired
-         * consequences
-         */
        /* turn off the interrupts */
        bcma_write32(core, D11REGOFFS(macintmask), 0);
        (void)bcma_read32(core, D11REGOFFS(macintmask));
@@ -2592,33 +2589,31 @@ bool brcms_c_intrsupd(struct brcms_c_info *wlc)
 /*
 * First-level interrupt processing.
- * Return true if this was our interrupt, false otherwise.
+ * Return true if this was our interrupt
- * *wantdpc will be set to true if further brcms_c_dpc() processing is required,
+ * and if further brcms_c_dpc() processing is required,
 * false otherwise.
 */
-bool brcms_c_isr(struct brcms_c_info *wlc, bool *wantdpc)
+bool brcms_c_isr(struct brcms_c_info *wlc)
 {
        struct brcms_hardware *wlc_hw = wlc->hw;
        u32 macintstatus;
-        *wantdpc = false;
        if (!wlc_hw->up || !wlc->macintmask)
                return false;
        /* read and clear macintstatus and intstatus registers */
        macintstatus = wlc_intstatus(wlc, true);
-        if (macintstatus == 0xffffffff)
+        if (macintstatus == 0xffffffff) {
                brcms_err(wlc_hw->d11core,
                          "DEVICEREMOVED detected in the ISR code path\n");
+                return false;
+        }
        /* it is not for us */
        if (macintstatus == 0)
                return false;
-        *wantdpc = true;
        /* save interrupt status bits */
        wlc->macintstatus = macintstatus;
@@ -6928,17 +6923,20 @@ static int brcms_c_tx(struct brcms_c_info *wlc, struct sk_buff *skb)
        return ret;
 }
-void brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc, struct sk_buff *sdu,
+bool brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc, struct sk_buff *sdu,
                              struct ieee80211_hw *hw)
 {
        uint fifo;
        struct scb *scb = &wlc->pri_scb;
        fifo = brcms_ac_to_fifo(skb_get_queue_mapping(sdu));
-        if (brcms_c_d11hdrs_mac80211(wlc, hw, sdu, scb, 0, 1, fifo, 0))
+        brcms_c_d11hdrs_mac80211(wlc, hw, sdu, scb, 0, 1, fifo, 0);
-                return;
+        if (!brcms_c_tx(wlc, sdu))
-        if (brcms_c_tx(wlc, sdu))
+                return true;
-                dev_kfree_skb_any(sdu);
+        /* packet discarded */
+        dev_kfree_skb_any(sdu);
+        return false;
 }
 int
@@ -7634,16 +7632,19 @@ brcms_b_recv(struct brcms_hardware *wlc_hw, uint fifo, bool bound)
        uint n = 0;
        uint bound_limit = bound ? RXBND : -1;
+        bool morepending;
        skb_queue_head_init(&recv_frames);
        /* gather received frames */
-        while (dma_rx(wlc_hw->di[fifo], &recv_frames)) {
+        do {
                /* !give others some time to run! */
-                if (++n >= bound_limit)
+                if (n >= bound_limit)
                        break;
-        }
+                morepending = dma_rx(wlc_hw->di[fifo], &recv_frames);
+                n++;
+        } while (morepending);
        /* post more rbufs */
        dma_rxfill(wlc_hw->di[fifo]);
@@ -7673,7 +7674,7 @@ brcms_b_recv(struct brcms_hardware *wlc_hw, uint fifo, bool bound)
                brcms_c_recv(wlc_hw->wlc, p);
        }
-        return n >= bound_limit;
+        return morepending;
 }
 /* second-level interrupt processing
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
index abfd78822fb8..606b534347bc 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
@@ -1137,8 +1137,9 @@ wlc_lcnphy_set_rx_gain_by_distribution(struct brcms_phy *pi,
        gain0_15 = ((biq1 & 0xf) << 12) |
                   ((tia & 0xf) << 8) |
                   ((lna2 & 0x3) << 6) |
-                   ((lna2 &
+                   ((lna2 & 0x3) << 4) |
-                     0x3) << 4) | ((lna1 & 0x3) << 2) | ((lna1 & 0x3) << 0);
+                   ((lna1 & 0x3) << 2) |
+                   ((lna1 & 0x3) << 0);
        mod_phy_reg(pi, 0x4b6, (0xffff << 0), gain0_15 << 0);
        mod_phy_reg(pi, 0x4b7, (0xf << 0), gain16_19 << 0);
@@ -1156,6 +1157,8 @@ wlc_lcnphy_set_rx_gain_by_distribution(struct brcms_phy *pi,
        }
        mod_phy_reg(pi, 0x44d, (0x1 << 0), (!trsw) << 0);
+        mod_phy_reg(pi, 0x4b1, (0x3 << 11), lna1 << 11);
+        mod_phy_reg(pi, 0x4e6, (0x3 << 3), lna1 << 3);
 }
@@ -1328,6 +1331,43 @@ static u32 wlc_lcnphy_measure_digital_power(struct brcms_phy *pi, u16 nsamples)
        return (iq_est.i_pwr + iq_est.q_pwr) / nsamples;
 }
+static bool wlc_lcnphy_rx_iq_cal_gain(struct brcms_phy *pi, u16 biq1_gain,
+                                      u16 tia_gain, u16 lna2_gain)
+{
+        u32 i_thresh_l, q_thresh_l;
+        u32 i_thresh_h, q_thresh_h;
+        struct lcnphy_iq_est iq_est_h, iq_est_l;
+        wlc_lcnphy_set_rx_gain_by_distribution(pi, 0, 0, 0, biq1_gain, tia_gain,
+                                               lna2_gain, 0);
+        wlc_lcnphy_rx_gain_override_enable(pi, true);
+        wlc_lcnphy_start_tx_tone(pi, 2000, (40 >> 1), 0);
+        usleep_range(500, 500);
+        write_radio_reg(pi, RADIO_2064_REG112, 0);
+        if (!wlc_lcnphy_rx_iq_est(pi, 1024, 32, &iq_est_l))
+                return false;
+        wlc_lcnphy_start_tx_tone(pi, 2000, 40, 0);
+        usleep_range(500, 500);
+        write_radio_reg(pi, RADIO_2064_REG112, 0);
+        if (!wlc_lcnphy_rx_iq_est(pi, 1024, 32, &iq_est_h))
+                return false;
+        i_thresh_l = (iq_est_l.i_pwr << 1);
+        i_thresh_h = (iq_est_l.i_pwr << 2) + iq_est_l.i_pwr;
+        q_thresh_l = (iq_est_l.q_pwr << 1);
+        q_thresh_h = (iq_est_l.q_pwr << 2) + iq_est_l.q_pwr;
+        if ((iq_est_h.i_pwr > i_thresh_l) &&
+            (iq_est_h.i_pwr < i_thresh_h) &&
+            (iq_est_h.q_pwr > q_thresh_l) &&
+            (iq_est_h.q_pwr < q_thresh_h))
+                return true;
+        return false;
+}
 static bool
 wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
                     const struct lcnphy_rx_iqcomp *iqcomp,
@@ -1342,8 +1382,8 @@ wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
            RFOverrideVal0_old, rfoverride2_old, rfoverride2val_old,
            rfoverride3_old, rfoverride3val_old, rfoverride4_old,
            rfoverride4val_old, afectrlovr_old, afectrlovrval_old;
-        int tia_gain;
+        int tia_gain, lna2_gain, biq1_gain;
-        u32 received_power, rx_pwr_threshold;
+        bool set_gain;
        u16 old_sslpnCalibClkEnCtrl, old_sslpnRxFeClkEnCtrl;
        u16 values_to_save[11];
        s16 *ptr;
@@ -1368,126 +1408,134 @@ wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
                goto cal_done;
        }
-        if (module == 1) {
+        WARN_ON(module != 1);
+        tx_pwr_ctrl = wlc_lcnphy_get_tx_pwr_ctrl(pi);
+        wlc_lcnphy_set_tx_pwr_ctrl(pi, LCNPHY_TX_PWR_CTRL_OFF);
-                tx_pwr_ctrl = wlc_lcnphy_get_tx_pwr_ctrl(pi);
+        for (i = 0; i < 11; i++)
-                wlc_lcnphy_set_tx_pwr_ctrl(pi, LCNPHY_TX_PWR_CTRL_OFF);
+                values_to_save[i] =
+                        read_radio_reg(pi, rxiq_cal_rf_reg[i]);
+        Core1TxControl_old = read_phy_reg(pi, 0x631);
+        or_phy_reg(pi, 0x631, 0x0015);
+        RFOverride0_old = read_phy_reg(pi, 0x44c);
+        RFOverrideVal0_old = read_phy_reg(pi, 0x44d);
+        rfoverride2_old = read_phy_reg(pi, 0x4b0);
+        rfoverride2val_old = read_phy_reg(pi, 0x4b1);
+        rfoverride3_old = read_phy_reg(pi, 0x4f9);
+        rfoverride3val_old = read_phy_reg(pi, 0x4fa);
+        rfoverride4_old = read_phy_reg(pi, 0x938);
+        rfoverride4val_old = read_phy_reg(pi, 0x939);
+        afectrlovr_old = read_phy_reg(pi, 0x43b);
+        afectrlovrval_old = read_phy_reg(pi, 0x43c);
+        old_sslpnCalibClkEnCtrl = read_phy_reg(pi, 0x6da);
+        old_sslpnRxFeClkEnCtrl = read_phy_reg(pi, 0x6db);
-                for (i = 0; i < 11; i++)
+        tx_gain_override_old = wlc_lcnphy_tx_gain_override_enabled(pi);
-                        values_to_save[i] =
+        if (tx_gain_override_old) {
-                                read_radio_reg(pi, rxiq_cal_rf_reg[i]);
+                wlc_lcnphy_get_tx_gain(pi, &old_gains);
-                Core1TxControl_old = read_phy_reg(pi, 0x631);
+                tx_gain_index_old = pi_lcn->lcnphy_current_index;
+        }
-                or_phy_reg(pi, 0x631, 0x0015);
-                RFOverride0_old = read_phy_reg(pi, 0x44c);
-                RFOverrideVal0_old = read_phy_reg(pi, 0x44d);
-                rfoverride2_old = read_phy_reg(pi, 0x4b0);
-                rfoverride2val_old = read_phy_reg(pi, 0x4b1);
-                rfoverride3_old = read_phy_reg(pi, 0x4f9);
-                rfoverride3val_old = read_phy_reg(pi, 0x4fa);
-                rfoverride4_old = read_phy_reg(pi, 0x938);
-                rfoverride4val_old = read_phy_reg(pi, 0x939);
-                afectrlovr_old = read_phy_reg(pi, 0x43b);
-                afectrlovrval_old = read_phy_reg(pi, 0x43c);
-                old_sslpnCalibClkEnCtrl = read_phy_reg(pi, 0x6da);
-                old_sslpnRxFeClkEnCtrl = read_phy_reg(pi, 0x6db);
-                tx_gain_override_old = wlc_lcnphy_tx_gain_override_enabled(pi);
-                if (tx_gain_override_old) {
-                        wlc_lcnphy_get_tx_gain(pi, &old_gains);
-                        tx_gain_index_old = pi_lcn->lcnphy_current_index;
-                }
-                wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_idx);
+        wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_idx);
-                mod_phy_reg(pi, 0x4f9, (0x1 << 0), 1 << 0);
+        mod_phy_reg(pi, 0x4f9, (0x1 << 0), 1 << 0);
-                mod_phy_reg(pi, 0x4fa, (0x1 << 0), 0 << 0);
+        mod_phy_reg(pi, 0x4fa, (0x1 << 0), 0 << 0);
-                mod_phy_reg(pi, 0x43b, (0x1 << 1), 1 << 1);
+        mod_phy_reg(pi, 0x43b, (0x1 << 1), 1 << 1);
-                mod_phy_reg(pi, 0x43c, (0x1 << 1), 0 << 1);
+        mod_phy_reg(pi, 0x43c, (0x1 << 1), 0 << 1);
-                write_radio_reg(pi, RADIO_2064_REG116, 0x06);
+        write_radio_reg(pi, RADIO_2064_REG116, 0x06);
-                write_radio_reg(pi, RADIO_2064_REG12C, 0x07);
+        write_radio_reg(pi, RADIO_2064_REG12C, 0x07);
-                write_radio_reg(pi, RADIO_2064_REG06A, 0xd3);
+        write_radio_reg(pi, RADIO_2064_REG06A, 0xd3);
-                write_radio_reg(pi, RADIO_2064_REG098, 0x03);
+        write_radio_reg(pi, RADIO_2064_REG098, 0x03);
-                write_radio_reg(pi, RADIO_2064_REG00B, 0x7);
+        write_radio_reg(pi, RADIO_2064_REG00B, 0x7);
-                mod_radio_reg(pi, RADIO_2064_REG113, 1 << 4, 1 << 4);
+        mod_radio_reg(pi, RADIO_2064_REG113, 1 << 4, 1 << 4);
-                write_radio_reg(pi, RADIO_2064_REG01D, 0x01);
+        write_radio_reg(pi, RADIO_2064_REG01D, 0x01);
-                write_radio_reg(pi, RADIO_2064_REG114, 0x01);
+        write_radio_reg(pi, RADIO_2064_REG114, 0x01);
-                write_radio_reg(pi, RADIO_2064_REG02E, 0x10);
+        write_radio_reg(pi, RADIO_2064_REG02E, 0x10);
-                write_radio_reg(pi, RADIO_2064_REG12A, 0x08);
+        write_radio_reg(pi, RADIO_2064_REG12A, 0x08);
-                mod_phy_reg(pi, 0x938, (0x1 << 0), 1 << 0);
+        mod_phy_reg(pi, 0x938, (0x1 << 0), 1 << 0);
-                mod_phy_reg(pi, 0x939, (0x1 << 0), 0 << 0);
+        mod_phy_reg(pi, 0x939, (0x1 << 0), 0 << 0);
-                mod_phy_reg(pi, 0x938, (0x1 << 1), 1 << 1);
+        mod_phy_reg(pi, 0x938, (0x1 << 1), 1 << 1);
-                mod_phy_reg(pi, 0x939, (0x1 << 1), 1 << 1);
+        mod_phy_reg(pi, 0x939, (0x1 << 1), 1 << 1);
-                mod_phy_reg(pi, 0x938, (0x1 << 2), 1 << 2);
+        mod_phy_reg(pi, 0x938, (0x1 << 2), 1 << 2);
-                mod_phy_reg(pi, 0x939, (0x1 << 2), 1 << 2);
+        mod_phy_reg(pi, 0x939, (0x1 << 2), 1 << 2);
-                mod_phy_reg(pi, 0x938, (0x1 << 3), 1 << 3);
+        mod_phy_reg(pi, 0x938, (0x1 << 3), 1 << 3);
-                mod_phy_reg(pi, 0x939, (0x1 << 3), 1 << 3);
+        mod_phy_reg(pi, 0x939, (0x1 << 3), 1 << 3);
-                mod_phy_reg(pi, 0x938, (0x1 << 5), 1 << 5);
+        mod_phy_reg(pi, 0x938, (0x1 << 5), 1 << 5);
-                mod_phy_reg(pi, 0x939, (0x1 << 5), 0 << 5);
+        mod_phy_reg(pi, 0x939, (0x1 << 5), 0 << 5);
-                mod_phy_reg(pi, 0x43b, (0x1 << 0), 1 << 0);
-                mod_phy_reg(pi, 0x43c, (0x1 << 0), 0 << 0);
-                wlc_lcnphy_start_tx_tone(pi, 2000, 120, 0);
-                write_phy_reg(pi, 0x6da, 0xffff);
-                or_phy_reg(pi, 0x6db, 0x3);
-                wlc_lcnphy_set_trsw_override(pi, tx_switch, rx_switch);
-                wlc_lcnphy_rx_gain_override_enable(pi, true);
-                tia_gain = 8;
-                rx_pwr_threshold = 950;
-                while (tia_gain > 0) {
-                        tia_gain -= 1;
-                        wlc_lcnphy_set_rx_gain_by_distribution(pi,
-                                                               0, 0, 2, 2,
-                                                               (u16)
-                                                               tia_gain, 1, 0);
-                        udelay(500);
-                        received_power =
+        mod_phy_reg(pi, 0x43b, (0x1 << 0), 1 << 0);
-                                wlc_lcnphy_measure_digital_power(pi, 2000);
+        mod_phy_reg(pi, 0x43c, (0x1 << 0), 0 << 0);
-                        if (received_power < rx_pwr_threshold)
-                                break;
+        write_phy_reg(pi, 0x6da, 0xffff);
+        or_phy_reg(pi, 0x6db, 0x3);
+        wlc_lcnphy_set_trsw_override(pi, tx_switch, rx_switch);
+        set_gain = false;
+        lna2_gain = 3;
+        while ((lna2_gain >= 0) && !set_gain) {
+                tia_gain = 4;
+                while ((tia_gain >= 0) && !set_gain) {
+                        biq1_gain = 6;
+                        while ((biq1_gain >= 0) && !set_gain) {
+                                set_gain = wlc_lcnphy_rx_iq_cal_gain(pi,
+                                                                     (u16)
+                                                                     biq1_gain,
+                                                                     (u16)
+                                                                     tia_gain,
+                                                                     (u16)
+                                                                     lna2_gain);
+                                biq1_gain -= 1;
+                        }
+                        tia_gain -= 1;
                }
-                result = wlc_lcnphy_calc_rx_iq_comp(pi, 0xffff);
+                lna2_gain -= 1;
+        }
-                wlc_lcnphy_stop_tx_tone(pi);
+        if (set_gain)
+                result = wlc_lcnphy_calc_rx_iq_comp(pi, 1024);
+        else
+                result = false;
-                write_phy_reg(pi, 0x631, Core1TxControl_old);
+        wlc_lcnphy_stop_tx_tone(pi);
-                write_phy_reg(pi, 0x44c, RFOverrideVal0_old);
+        write_phy_reg(pi, 0x631, Core1TxControl_old);
-                write_phy_reg(pi, 0x44d, RFOverrideVal0_old);
-                write_phy_reg(pi, 0x4b0, rfoverride2_old);
+        write_phy_reg(pi, 0x44c, RFOverrideVal0_old);
-                write_phy_reg(pi, 0x4b1, rfoverride2val_old);
+        write_phy_reg(pi, 0x44d, RFOverrideVal0_old);
-                write_phy_reg(pi, 0x4f9, rfoverride3_old);
+        write_phy_reg(pi, 0x4b0, rfoverride2_old);
-                write_phy_reg(pi, 0x4fa, rfoverride3val_old);
+        write_phy_reg(pi, 0x4b1, rfoverride2val_old);
-                write_phy_reg(pi, 0x938, rfoverride4_old);
+        write_phy_reg(pi, 0x4f9, rfoverride3_old);
-                write_phy_reg(pi, 0x939, rfoverride4val_old);
+        write_phy_reg(pi, 0x4fa, rfoverride3val_old);
-                write_phy_reg(pi, 0x43b, afectrlovr_old);
+        write_phy_reg(pi, 0x938, rfoverride4_old);
-                write_phy_reg(pi, 0x43c, afectrlovrval_old);
+        write_phy_reg(pi, 0x939, rfoverride4val_old);
-                write_phy_reg(pi, 0x6da, old_sslpnCalibClkEnCtrl);
+        write_phy_reg(pi, 0x43b, afectrlovr_old);
-                write_phy_reg(pi, 0x6db, old_sslpnRxFeClkEnCtrl);
+        write_phy_reg(pi, 0x43c, afectrlovrval_old);
+        write_phy_reg(pi, 0x6da, old_sslpnCalibClkEnCtrl);
+        write_phy_reg(pi, 0x6db, old_sslpnRxFeClkEnCtrl);
-                wlc_lcnphy_clear_trsw_override(pi);
+        wlc_lcnphy_clear_trsw_override(pi);
-                mod_phy_reg(pi, 0x44c, (0x1 << 2), 0 << 2);
+        mod_phy_reg(pi, 0x44c, (0x1 << 2), 0 << 2);
-                for (i = 0; i < 11; i++)
+        for (i = 0; i < 11; i++)
-                        write_radio_reg(pi, rxiq_cal_rf_reg[i],
+                write_radio_reg(pi, rxiq_cal_rf_reg[i],
-                                        values_to_save[i]);
+                                values_to_save[i]);
-                if (tx_gain_override_old)
+        if (tx_gain_override_old)
-                        wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_index_old);
+                wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_index_old);
-                else
+        else
-                        wlc_lcnphy_disable_tx_gain_override(pi);
+                wlc_lcnphy_disable_tx_gain_override(pi);
-                wlc_lcnphy_set_tx_pwr_ctrl(pi, tx_pwr_ctrl);
+        wlc_lcnphy_set_tx_pwr_ctrl(pi, tx_pwr_ctrl);
-                wlc_lcnphy_rx_gain_override_enable(pi, false);
+        wlc_lcnphy_rx_gain_override_enable(pi, false);
-        }
 cal_done:
        kfree(ptr);
@@ -1781,6 +1829,17 @@ wlc_lcnphy_radio_2064_channel_tune_4313(struct brcms_phy *pi, u8 channel)
                write_radio_reg(pi, RADIO_2064_REG038, 3);
                write_radio_reg(pi, RADIO_2064_REG091, 7);
        }
+        if (!(pi->sh->boardflags & BFL_FEM)) {
+                u8 reg038[14] = {0xd, 0xe, 0xd, 0xd, 0xd, 0xc,
+                        0xa, 0xb, 0xb, 0x3, 0x3, 0x2, 0x0, 0x0};
+                write_radio_reg(pi, RADIO_2064_REG02A, 0xf);
+                write_radio_reg(pi, RADIO_2064_REG091, 0x3);
+                write_radio_reg(pi, RADIO_2064_REG038, 0x3);
+                write_radio_reg(pi, RADIO_2064_REG038, reg038[channel - 1]);
+        }
 }
 static int
@@ -1860,41 +1919,6 @@ wlc_lcnphy_load_tx_iir_filter(struct brcms_phy *pi, bool is_ofdm, s16 filt_type)
        return (filt_index != -1) ? 0 : -1;
 }
-void wlc_phy_chanspec_set_lcnphy(struct brcms_phy *pi, u16 chanspec)
-{
-        u8 channel = CHSPEC_CHANNEL(chanspec);
-        wlc_phy_chanspec_radio_set((struct brcms_phy_pub *) pi, chanspec);
-        wlc_lcnphy_set_chanspec_tweaks(pi, pi->radio_chanspec);
-        or_phy_reg(pi, 0x44a, 0x44);
-        write_phy_reg(pi, 0x44a, 0x80);
-        wlc_lcnphy_radio_2064_channel_tune_4313(pi, channel);
-        udelay(1000);
-        wlc_lcnphy_toggle_afe_pwdn(pi);
-        write_phy_reg(pi, 0x657, lcnphy_sfo_cfg[channel - 1].ptcentreTs20);
-        write_phy_reg(pi, 0x658, lcnphy_sfo_cfg[channel - 1].ptcentreFactor);
-        if (CHSPEC_CHANNEL(pi->radio_chanspec) == 14) {
-                mod_phy_reg(pi, 0x448, (0x3 << 8), (2) << 8);
-                wlc_lcnphy_load_tx_iir_filter(pi, false, 3);
-        } else {
-                mod_phy_reg(pi, 0x448, (0x3 << 8), (1) << 8);
-                wlc_lcnphy_load_tx_iir_filter(pi, false, 2);
-        }
-        wlc_lcnphy_load_tx_iir_filter(pi, true, 0);
-        mod_phy_reg(pi, 0x4eb, (0x7 << 3), (1) << 3);
-}
 static u16 wlc_lcnphy_get_pa_gain(struct brcms_phy *pi)
 {
        u16 pa_gain;
@@ -1936,6 +1960,21 @@ static void wlc_lcnphy_set_tx_gain(struct brcms_phy *pi,
        wlc_lcnphy_enable_tx_gain_override(pi);
 }
+static u8 wlc_lcnphy_get_bbmult(struct brcms_phy *pi)
+{
+        u16 m0m1;
+        struct phytbl_info tab;
+        tab.tbl_ptr = &m0m1;
+        tab.tbl_len = 1;
+        tab.tbl_id = LCNPHY_TBL_ID_IQLOCAL;
+        tab.tbl_offset = 87;
+        tab.tbl_width = 16;
+        wlc_lcnphy_read_table(pi, &tab);
+        return (u8) ((m0m1 & 0xff00) >> 8);
+}
 static void wlc_lcnphy_set_bbmult(struct brcms_phy *pi, u8 m0)
 {
        u16 m0m1 = (u16) m0 << 8;
@@ -1995,6 +2034,16 @@ wlc_lcnphy_set_tssi_mux(struct brcms_phy *pi, enum lcnphy_tssi_mode pos)
                } else {
                        mod_radio_reg(pi, RADIO_2064_REG03A, 1, 0x1);
                        mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 0x8);
+                        mod_radio_reg(pi, RADIO_2064_REG028, 0x1, 0x0);
+                        mod_radio_reg(pi, RADIO_2064_REG11A, 0x4, 1<<2);
+                        mod_radio_reg(pi, RADIO_2064_REG036, 0x10, 0x0);
+                        mod_radio_reg(pi, RADIO_2064_REG11A, 0x10, 1<<4);
+                        mod_radio_reg(pi, RADIO_2064_REG036, 0x3, 0x0);
+                        mod_radio_reg(pi, RADIO_2064_REG035, 0xff, 0x77);
+                        mod_radio_reg(pi, RADIO_2064_REG028, 0x1e, 0xe<<1);
+                        mod_radio_reg(pi, RADIO_2064_REG112, 0x80, 1<<7);
+                        mod_radio_reg(pi, RADIO_2064_REG005, 0x7, 1<<1);
+                        mod_radio_reg(pi, RADIO_2064_REG029, 0xf0, 0<<4);
                }
        } else {
                mod_phy_reg(pi, 0x4d9, (0x1 << 2), (0x1) << 2);
@@ -2081,12 +2130,14 @@ static void wlc_lcnphy_pwrctrl_rssiparams(struct brcms_phy *pi)
                    (auxpga_vmid_temp << 0) | (auxpga_gain_temp << 12));
        mod_radio_reg(pi, RADIO_2064_REG082, (1 << 5), (1 << 5));
+        mod_radio_reg(pi, RADIO_2064_REG07C, (1 << 0), (1 << 0));
 }
 static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
 {
        struct phytbl_info tab;
        u32 rfseq, ind;
+        u8 tssi_sel;
        tab.tbl_id = LCNPHY_TBL_ID_TXPWRCTL;
        tab.tbl_width = 32;
@@ -2108,7 +2159,13 @@ static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
        mod_phy_reg(pi, 0x503, (0x1 << 4), (1) << 4);
-        wlc_lcnphy_set_tssi_mux(pi, LCNPHY_TSSI_EXT);
+        if (pi->sh->boardflags & BFL_FEM) {
+                tssi_sel = 0x1;
+                wlc_lcnphy_set_tssi_mux(pi, LCNPHY_TSSI_EXT);
+        } else {
+                tssi_sel = 0xe;
+                wlc_lcnphy_set_tssi_mux(pi, LCNPHY_TSSI_POST_PA);
+        }
        mod_phy_reg(pi, 0x4a4, (0x1 << 14), (0) << 14);
        mod_phy_reg(pi, 0x4a4, (0x1 << 15), (1) << 15);
@@ -2144,9 +2201,10 @@ static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
        mod_phy_reg(pi, 0x49a, (0x1ff << 0), (0xff) << 0);
        if (LCNREV_IS(pi->pubpi.phy_rev, 2)) {
-                mod_radio_reg(pi, RADIO_2064_REG028, 0xf, 0xe);
+                mod_radio_reg(pi, RADIO_2064_REG028, 0xf, tssi_sel);
                mod_radio_reg(pi, RADIO_2064_REG086, 0x4, 0x4);
        } else {
+                mod_radio_reg(pi, RADIO_2064_REG028, 0x1e, tssi_sel << 1);
                mod_radio_reg(pi, RADIO_2064_REG03A, 0x1, 1);
                mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 1 << 3);
        }
@@ -2193,6 +2251,10 @@ static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
        mod_phy_reg(pi, 0x4d7, (0xf << 8), (0) << 8);
+        mod_radio_reg(pi, RADIO_2064_REG035, 0xff, 0x0);
+        mod_radio_reg(pi, RADIO_2064_REG036, 0x3, 0x0);
+        mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 0x8);
        wlc_lcnphy_pwrctrl_rssiparams(pi);
 }
@@ -2811,6 +2873,8 @@ static void wlc_lcnphy_idle_tssi_est(struct brcms_phy_pub *ppi)
                read_radio_reg(pi, RADIO_2064_REG007) & 1;
        u16 SAVE_jtag_auxpga = read_radio_reg(pi, RADIO_2064_REG0FF) & 0x10;
        u16 SAVE_iqadc_aux_en = read_radio_reg(pi, RADIO_2064_REG11F) & 4;
+        u8 SAVE_bbmult = wlc_lcnphy_get_bbmult(pi);
        idleTssi = read_phy_reg(pi, 0x4ab);
        suspend = (0 == (bcma_read32(pi->d11core, D11REGOFFS(maccontrol)) &
                         MCTL_EN_MAC));
@@ -2828,6 +2892,12 @@ static void wlc_lcnphy_idle_tssi_est(struct brcms_phy_pub *ppi)
        mod_radio_reg(pi, RADIO_2064_REG0FF, 0x10, 1 << 4);
        mod_radio_reg(pi, RADIO_2064_REG11F, 0x4, 1 << 2);
        wlc_lcnphy_tssi_setup(pi);
+        mod_phy_reg(pi, 0x4d7, (0x1 << 0), (1 << 0));
+        mod_phy_reg(pi, 0x4d7, (0x1 << 6), (1 << 6));
+        wlc_lcnphy_set_bbmult(pi, 0x0);
        wlc_phy_do_dummy_tx(pi, true, OFF);
        idleTssi = ((read_phy_reg(pi, 0x4ab) & (0x1ff << 0))
                    >> 0);
@@ -2849,6 +2919,7 @@ static void wlc_lcnphy_idle_tssi_est(struct brcms_phy_pub *ppi)
        mod_phy_reg(pi, 0x44c, (0x1 << 12), (0) << 12);
+        wlc_lcnphy_set_bbmult(pi, SAVE_bbmult);
        wlc_lcnphy_set_tx_gain_override(pi, tx_gain_override_old);
        wlc_lcnphy_set_tx_gain(pi, &old_gains);
        wlc_lcnphy_set_tx_pwr_ctrl(pi, SAVE_txpwrctrl);
@@ -3062,6 +3133,11 @@ static void wlc_lcnphy_tx_pwr_ctrl_init(struct brcms_phy_pub *ppi)
                        wlc_lcnphy_write_table(pi, &tab);
                        tab.tbl_offset++;
                }
+                mod_phy_reg(pi, 0x4d0, (0x1 << 0), (0) << 0);
+                mod_phy_reg(pi, 0x4d3, (0xff << 0), (0) << 0);
+                mod_phy_reg(pi, 0x4d3, (0xff << 8), (0) << 8);
+                mod_phy_reg(pi, 0x4d0, (0x1 << 4), (0) << 4);
+                mod_phy_reg(pi, 0x4d0, (0x1 << 2), (0) << 2);
                mod_phy_reg(pi, 0x410, (0x1 << 7), (0) << 7);
@@ -3075,21 +3151,6 @@ static void wlc_lcnphy_tx_pwr_ctrl_init(struct brcms_phy_pub *ppi)
                wlapi_enable_mac(pi->sh->physhim);
 }
-static u8 wlc_lcnphy_get_bbmult(struct brcms_phy *pi)
-{
-        u16 m0m1;
-        struct phytbl_info tab;
-        tab.tbl_ptr = &m0m1;
-        tab.tbl_len = 1;
-        tab.tbl_id = LCNPHY_TBL_ID_IQLOCAL;
-        tab.tbl_offset = 87;
-        tab.tbl_width = 16;
-        wlc_lcnphy_read_table(pi, &tab);
-        return (u8) ((m0m1 & 0xff00) >> 8);
-}
 static void wlc_lcnphy_set_pa_gain(struct brcms_phy *pi, u16 gain)
 {
        mod_phy_reg(pi, 0x4fb,
@@ -3878,7 +3939,6 @@ static void wlc_lcnphy_txpwrtbl_iqlo_cal(struct brcms_phy *pi)
        target_gains.pad_gain = 21;
        target_gains.dac_gain = 0;
        wlc_lcnphy_set_tx_gain(pi, &target_gains);
-        wlc_lcnphy_set_tx_pwr_by_index(pi, 16);
        if (LCNREV_IS(pi->pubpi.phy_rev, 1) || pi_lcn->lcnphy_hw_iqcal_en) {
@@ -3889,6 +3949,7 @@ static void wlc_lcnphy_txpwrtbl_iqlo_cal(struct brcms_phy *pi)
                                        lcnphy_recal ? LCNPHY_CAL_RECAL :
                                        LCNPHY_CAL_FULL), false);
        } else {
+                wlc_lcnphy_set_tx_pwr_by_index(pi, 16);
                wlc_lcnphy_tx_iqlo_soft_cal_full(pi);
        }
@@ -4313,17 +4374,22 @@ wlc_lcnphy_load_tx_gain_table(struct brcms_phy *pi,
        if (CHSPEC_IS5G(pi->radio_chanspec))
                pa_gain = 0x70;
        else
-                pa_gain = 0x70;
+                pa_gain = 0x60;
        if (pi->sh->boardflags & BFL_FEM)
                pa_gain = 0x10;
        tab.tbl_id = LCNPHY_TBL_ID_TXPWRCTL;
        tab.tbl_width = 32;
        tab.tbl_len = 1;
        tab.tbl_ptr = &val;
        for (j = 0; j < 128; j++) {
-                gm_gain = gain_table[j].gm;
+                if (pi->sh->boardflags & BFL_FEM)
+                        gm_gain = gain_table[j].gm;
+                else
+                        gm_gain = 15;
                val = (((u32) pa_gain << 24) |
                       (gain_table[j].pad << 16) |
                       (gain_table[j].pga << 8) | gm_gain);
@@ -4534,7 +4600,10 @@ static void wlc_radio_2064_init(struct brcms_phy *pi)
        write_phy_reg(pi, 0x4ea, 0x4688);
-        mod_phy_reg(pi, 0x4eb, (0x7 << 0), 2 << 0);
+        if (pi->sh->boardflags & BFL_FEM)
+                mod_phy_reg(pi, 0x4eb, (0x7 << 0), 2 << 0);
+        else
+                mod_phy_reg(pi, 0x4eb, (0x7 << 0), 3 << 0);
        mod_phy_reg(pi, 0x4eb, (0x7 << 6), 0 << 6);
@@ -4545,6 +4614,13 @@ static void wlc_radio_2064_init(struct brcms_phy *pi)
        wlc_lcnphy_rcal(pi);
        wlc_lcnphy_rc_cal(pi);
+        if (!(pi->sh->boardflags & BFL_FEM)) {
+                write_radio_reg(pi, RADIO_2064_REG032, 0x6f);
+                write_radio_reg(pi, RADIO_2064_REG033, 0x19);
+                write_radio_reg(pi, RADIO_2064_REG039, 0xe);
+        }
 }
 static void wlc_lcnphy_radio_init(struct brcms_phy *pi)
@@ -4574,22 +4650,20 @@ static void wlc_lcnphy_tbl_init(struct brcms_phy *pi)
                wlc_lcnphy_write_table(pi, &tab);
        }
-        tab.tbl_id = LCNPHY_TBL_ID_RFSEQ;
+        if (!(pi->sh->boardflags & BFL_FEM)) {
-        tab.tbl_width = 16;
+                tab.tbl_id = LCNPHY_TBL_ID_RFSEQ;
-        tab.tbl_ptr = &val;
+                tab.tbl_width = 16;
-        tab.tbl_len = 1;
+                tab.tbl_ptr = &val;
+                tab.tbl_len = 1;
-        val = 114;
-        tab.tbl_offset = 0;
-        wlc_lcnphy_write_table(pi, &tab);
-        val = 130;
+                val = 150;
-        tab.tbl_offset = 1;
+                tab.tbl_offset = 0;
-        wlc_lcnphy_write_table(pi, &tab);
+                wlc_lcnphy_write_table(pi, &tab);
-        val = 6;
+                val = 220;
-        tab.tbl_offset = 8;
+                tab.tbl_offset = 1;
-        wlc_lcnphy_write_table(pi, &tab);
+                wlc_lcnphy_write_table(pi, &tab);
+        }
        if (CHSPEC_IS2G(pi->radio_chanspec)) {
                if (pi->sh->boardflags & BFL_FEM)
@@ -4946,6 +5020,44 @@ void wlc_phy_txpower_recalc_target_lcnphy(struct brcms_phy *pi)
        }
 }
+void wlc_phy_chanspec_set_lcnphy(struct brcms_phy *pi, u16 chanspec)
+{
+        u8 channel = CHSPEC_CHANNEL(chanspec);
+        wlc_phy_chanspec_radio_set((struct brcms_phy_pub *)pi, chanspec);
+        wlc_lcnphy_set_chanspec_tweaks(pi, pi->radio_chanspec);
+        or_phy_reg(pi, 0x44a, 0x44);
+        write_phy_reg(pi, 0x44a, 0x80);
+        wlc_lcnphy_radio_2064_channel_tune_4313(pi, channel);
+        udelay(1000);
+        wlc_lcnphy_toggle_afe_pwdn(pi);
+        write_phy_reg(pi, 0x657, lcnphy_sfo_cfg[channel - 1].ptcentreTs20);
+        write_phy_reg(pi, 0x658, lcnphy_sfo_cfg[channel - 1].ptcentreFactor);
+        if (CHSPEC_CHANNEL(pi->radio_chanspec) == 14) {
+                mod_phy_reg(pi, 0x448, (0x3 << 8), (2) << 8);
+                wlc_lcnphy_load_tx_iir_filter(pi, false, 3);
+        } else {
+                mod_phy_reg(pi, 0x448, (0x3 << 8), (1) << 8);
+                wlc_lcnphy_load_tx_iir_filter(pi, false, 2);
+        }
+        if (pi->sh->boardflags & BFL_FEM)
+                wlc_lcnphy_load_tx_iir_filter(pi, true, 0);
+        else
+                wlc_lcnphy_load_tx_iir_filter(pi, true, 3);
+        mod_phy_reg(pi, 0x4eb, (0x7 << 3), (1) << 3);
+        wlc_lcnphy_tssi_setup(pi);
+}
 void wlc_phy_detach_lcnphy(struct brcms_phy *pi)
 {
        kfree(pi->u.pi_lcnphy);
@@ -4982,8 +5094,7 @@ bool wlc_phy_attach_lcnphy(struct brcms_phy *pi)
        if (!wlc_phy_txpwr_srom_read_lcnphy(pi))
                return false;
-        if ((pi->sh->boardflags & BFL_FEM) &&
+        if (LCNREV_IS(pi->pubpi.phy_rev, 1)) {
-            (LCNREV_IS(pi->pubpi.phy_rev, 1))) {
                if (pi_lcn->lcnphy_tempsense_option == 3) {
                        pi->hwpwrctrl = true;
                        pi->hwpwrctrl_capable = true;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
index 622c01ca72c5..b7e95acc2084 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
@@ -1992,70 +1992,70 @@ static const u16 dot11lcn_sw_ctrl_tbl_4313_epa_rev0[] = {
 };
 static const u16 dot11lcn_sw_ctrl_tbl_4313_rev0[] = {
-        0x000a,
        0x0009,
-        0x0006,
-        0x0005,
        0x000a,
-        0x0009,
-        0x0006,
        0x0005,
-        0x000a,
-        0x0009,
        0x0006,
-        0x0005,
-        0x000a,
        0x0009,
-        0x0006,
-        0x0005,
        0x000a,
-        0x0009,
-        0x0006,
        0x0005,
-        0x000a,
-        0x0009,
        0x0006,
-        0x0005,
-        0x000a,
        0x0009,
-        0x0006,
-        0x0005,
        0x000a,
-        0x0009,
-        0x0006,
        0x0005,
-        0x000a,
-        0x0009,
        0x0006,
-        0x0005,
-        0x000a,
        0x0009,
-        0x0006,
-        0x0005,
        0x000a,
-        0x0009,
-        0x0006,
        0x0005,
-        0x000a,
-        0x0009,
        0x0006,
-        0x0005,
+        0x0009,
        0x000a,
+        0x0005,
+        0x0006,
        0x0009,
+        0x000a,
+        0x0005,
        0x0006,
+        0x0009,
+        0x000a,
        0x0005,
+        0x0006,
+        0x0009,
        0x000a,
+        0x0005,
+        0x0006,
        0x0009,
+        0x000a,
+        0x0005,
        0x0006,
+        0x0009,
+        0x000a,
        0x0005,
+        0x0006,
+        0x0009,
        0x000a,
+        0x0005,
+        0x0006,
        0x0009,
+        0x000a,
+        0x0005,
        0x0006,
+        0x0009,
+        0x000a,
        0x0005,
+        0x0006,
+        0x0009,
        0x000a,
+        0x0005,
+        0x0006,
        0x0009,
+        0x000a,
+        0x0005,
        0x0006,
+        0x0009,
+        0x000a,
        0x0005,
+        0x0006,
 };
 static const u16 dot11lcn_sw_ctrl_tbl_rev0[] = {
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/pub.h b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
index 0148dec104f0..4fb2834f4e64 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/pub.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
@@ -176,6 +176,7 @@ struct brcms_pub {
        bool phy_11ncapable;    /* the PHY/HW is capable of 802.11N */
        struct wl_cnt *_cnt;    /* low-level counters in driver */
+        struct dentry *dbgfs_dir;
 };
 enum wlc_par_id {
@@ -282,9 +283,9 @@ extern void brcms_c_intrson(struct brcms_c_info *wlc);
 extern u32 brcms_c_intrsoff(struct brcms_c_info *wlc);
 extern void brcms_c_intrsrestore(struct brcms_c_info *wlc, u32 macintmask);
 extern bool brcms_c_intrsupd(struct brcms_c_info *wlc);
-extern bool brcms_c_isr(struct brcms_c_info *wlc, bool *wantdpc);
+extern bool brcms_c_isr(struct brcms_c_info *wlc);
 extern bool brcms_c_dpc(struct brcms_c_info *wlc, bool bounded);
-extern void brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc,
+extern bool brcms_c_sendpkt_mac80211(struct brcms_c_info *wlc,
                                     struct sk_buff *sdu,
                                     struct ieee80211_hw *hw);
 extern bool brcms_c_aggregatable(struct brcms_c_info *wlc, u8 tid);
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 46938bc9886d..d92b21a8e597 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -6410,7 +6410,7 @@ out:
        goto out;
 }
-static void __devexit ipw2100_pci_remove_one(struct pci_dev *pci_dev)
+static void ipw2100_pci_remove_one(struct pci_dev *pci_dev)
 {
        struct ipw2100_priv *priv = pci_get_drvdata(pci_dev);
        struct net_device *dev = priv->net_dev;
@@ -6606,7 +6606,7 @@ static struct pci_driver ipw2100_pci_driver = {
        .name = DRV_NAME,
        .id_table = ipw2100_pci_id_table,
        .probe = ipw2100_pci_init_one,
-        .remove = __devexit_p(ipw2100_pci_remove_one),
+        .remove = ipw2100_pci_remove_one,
 #ifdef CONFIG_PM
        .suspend = ipw2100_suspend,
        .resume = ipw2100_resume,
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 482f505f3f35..844f201b7b70 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -6812,7 +6812,6 @@ static int ipw_wx_get_auth(struct net_device *dev,
        struct libipw_device *ieee = priv->ieee;
        struct lib80211_crypt_data *crypt;
        struct iw_param *param = &wrqu->param;
-        int ret = 0;
        switch (param->flags & IW_AUTH_INDEX) {
        case IW_AUTH_WPA_VERSION:
@@ -6822,8 +6821,7 @@ static int ipw_wx_get_auth(struct net_device *dev,
                /*
                 * wpa_supplicant will control these internally
                 */
-                ret = -EOPNOTSUPP;
+                return -EOPNOTSUPP;
-                break;
        case IW_AUTH_TKIP_COUNTERMEASURES:
                crypt = priv->ieee->crypt_info.crypt[priv->ieee->crypt_info.tx_keyidx];
@@ -10774,7 +10772,7 @@ static void ipw_bg_link_down(struct work_struct *work)
        mutex_unlock(&priv->mutex);
 }
-static int __devinit ipw_setup_deferred_work(struct ipw_priv *priv)
+static int ipw_setup_deferred_work(struct ipw_priv *priv)
 {
        int ret = 0;
@@ -11728,7 +11726,7 @@ static const struct net_device_ops ipw_netdev_ops = {
        .ndo_validate_addr      = eth_validate_addr,
 };
-static int __devinit ipw_pci_probe(struct pci_dev *pdev,
+static int ipw_pci_probe(struct pci_dev *pdev,
                                   const struct pci_device_id *ent)
 {
        int err = 0;
@@ -11901,7 +11899,7 @@ static int __devinit ipw_pci_probe(struct pci_dev *pdev,
        return err;
 }
-static void __devexit ipw_pci_remove(struct pci_dev *pdev)
+static void ipw_pci_remove(struct pci_dev *pdev)
 {
        struct ipw_priv *priv = pci_get_drvdata(pdev);
        struct list_head *p, *q;
@@ -12063,7 +12061,7 @@ static struct pci_driver ipw_driver = {
        .name = DRV_NAME,
        .id_table = card_ids,
        .probe = ipw_pci_probe,
-        .remove = __devexit_p(ipw_pci_remove),
+        .remove = ipw_pci_remove,
 #ifdef CONFIG_PM
        .suspend = ipw_pci_suspend,
        .resume = ipw_pci_resume,
diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
index e252acb9c862..d604b4036a76 100644
--- a/drivers/net/wireless/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/iwlegacy/3945-mac.c
@@ -3794,7 +3794,7 @@ out:
        return err;
 }
-static void __devexit
+static void
 il3945_pci_remove(struct pci_dev *pdev)
 {
        struct il_priv *il = pci_get_drvdata(pdev);
@@ -3884,7 +3884,7 @@ static struct pci_driver il3945_driver = {
        .name = DRV_NAME,
        .id_table = il3945_hw_card_ids,
        .probe = il3945_pci_probe,
-        .remove = __devexit_p(il3945_pci_remove),
+        .remove = il3945_pci_remove,
        .driver.pm = IL_LEGACY_PM_OPS,
 };
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index 07ffa575e3ef..c3fbf6717564 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -6664,7 +6664,7 @@ out:
        return err;
 }
-static void __devexit
+static void
 il4965_pci_remove(struct pci_dev *pdev)
 {
        struct il_priv *il = pci_get_drvdata(pdev);
@@ -6772,7 +6772,7 @@ static struct pci_driver il4965_driver = {
        .name = DRV_NAME,
        .id_table = il4965_hw_card_ids,
        .probe = il4965_pci_probe,
-        .remove = __devexit_p(il4965_pci_remove),
+        .remove = il4965_pci_remove,
        .driver.pm = IL_LEGACY_PM_OPS,
 };
diff --git a/drivers/net/wireless/iwlwifi/dvm/rxon.c b/drivers/net/wireless/iwlwifi/dvm/rxon.c
index 10896393e5a0..2830ea290502 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rxon.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rxon.c
@@ -1012,12 +1012,12 @@ static void iwl_calc_basic_rates(struct iwl_priv *priv,
         * As a consequence, it's not as complicated as it sounds, just add
         * any lower rates to the ACK rate bitmap.
         */
-        if (IWL_RATE_11M_INDEX < lowest_present_ofdm)
+        if (IWL_RATE_11M_INDEX < lowest_present_cck)
-                ofdm |= IWL_RATE_11M_MASK >> IWL_FIRST_CCK_RATE;
+                cck |= IWL_RATE_11M_MASK >> IWL_FIRST_CCK_RATE;
-        if (IWL_RATE_5M_INDEX < lowest_present_ofdm)
+        if (IWL_RATE_5M_INDEX < lowest_present_cck)
-                ofdm |= IWL_RATE_5M_MASK >> IWL_FIRST_CCK_RATE;
+                cck |= IWL_RATE_5M_MASK >> IWL_FIRST_CCK_RATE;
-        if (IWL_RATE_2M_INDEX < lowest_present_ofdm)
+        if (IWL_RATE_2M_INDEX < lowest_present_cck)
-                ofdm |= IWL_RATE_2M_MASK >> IWL_FIRST_CCK_RATE;
+                cck |= IWL_RATE_2M_MASK >> IWL_FIRST_CCK_RATE;
        /* 1M already there or needed so always add */
        cck |= IWL_RATE_1M_MASK >> IWL_FIRST_CCK_RATE;
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 956fe6c370bc..2b7e8a0b1cd4 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -293,7 +293,7 @@ out_free_trans:
        return -EFAULT;
 }
-static void __devexit iwl_pci_remove(struct pci_dev *pdev)
+static void iwl_pci_remove(struct pci_dev *pdev)
 {
        struct iwl_trans *trans = pci_get_drvdata(pdev);
        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
@@ -352,7 +352,7 @@ static struct pci_driver iwl_pci_driver = {
        .name = DRV_NAME,
        .id_table = iwl_hw_card_ids,
        .probe = iwl_pci_probe,
-        .remove = __devexit_p(iwl_pci_remove),
+        .remove = iwl_pci_remove,
        .driver.pm = IWL_PM_OPS,
 };
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index ec36868f6fc5..ec6d5d6b452e 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -298,6 +298,7 @@ static int lbs_add_common_rates_tlv(u8 *tlv, struct cfg80211_bss *bss)
        const u8 *rates_eid, *ext_rates_eid;
        int n = 0;
+        rcu_read_lock();
        rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SUPP_RATES);
        ext_rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_EXT_SUPP_RATES);
@@ -325,6 +326,7 @@ static int lbs_add_common_rates_tlv(u8 *tlv, struct cfg80211_bss *bss)
                *tlv++ = 0x96;
                n = 4;
        }
+        rcu_read_unlock();
        rate_tlv->header.len = cpu_to_le16(n);
        return sizeof(rate_tlv->header) + n;
@@ -1140,11 +1142,13 @@ static int lbs_associate(struct lbs_private *priv,
        cmd->capability = cpu_to_le16(bss->capability);
        /* add SSID TLV */
+        rcu_read_lock();
        ssid_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SSID);
        if (ssid_eid)
                pos += lbs_add_ssid_tlv(pos, ssid_eid + 2, ssid_eid[1]);
        else
                lbs_deb_assoc("no SSID\n");
+        rcu_read_unlock();
        /* add DS param TLV */
        if (bss->channel)
@@ -1782,7 +1786,7 @@ static int lbs_ibss_join_existing(struct lbs_private *priv,
        struct cfg80211_ibss_params *params,
        struct cfg80211_bss *bss)
 {
-        const u8 *rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SUPP_RATES);
+        const u8 *rates_eid;
        struct cmd_ds_802_11_ad_hoc_join cmd;
        u8 preamble = RADIO_PREAMBLE_SHORT;
        int ret = 0;
@@ -1841,6 +1845,8 @@ static int lbs_ibss_join_existing(struct lbs_private *priv,
        /* set rates to the intersection of our rates and the rates in the
           bss */
+        rcu_read_lock();
+        rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SUPP_RATES);
        if (!rates_eid) {
                lbs_add_rates(cmd.bss.rates);
        } else {
@@ -1860,6 +1866,7 @@ static int lbs_ibss_join_existing(struct lbs_private *priv,
                        }
                }
        }
+        rcu_read_unlock();
        /* Only v8 and below support setting this */
        if (MRVL_FW_MAJOR_REV(priv->fwrelease) <= 8) {
diff --git a/drivers/net/wireless/libertas/if_spi.c b/drivers/net/wireless/libertas/if_spi.c
index 9604a1c4a74d..4bb6574f4073 100644
--- a/drivers/net/wireless/libertas/if_spi.c
+++ b/drivers/net/wireless/libertas/if_spi.c
@@ -1124,7 +1124,7 @@ static void if_spi_resume_worker(struct work_struct *work)
        }
 }
-static int __devinit if_spi_probe(struct spi_device *spi)
+static int if_spi_probe(struct spi_device *spi)
 {
        struct if_spi_card *card;
        struct lbs_private *priv = NULL;
@@ -1226,7 +1226,7 @@ out:
        return err;
 }
-static int __devexit libertas_spi_remove(struct spi_device *spi)
+static int libertas_spi_remove(struct spi_device *spi)
 {
        struct if_spi_card *card = spi_get_drvdata(spi);
        struct lbs_private *priv = card->priv;
@@ -1285,7 +1285,7 @@ static const struct dev_pm_ops if_spi_pm_ops = {
 static struct spi_driver libertas_spi_driver = {
        .probe  = if_spi_probe,
-        .remove = __devexit_p(libertas_spi_remove),
+        .remove = libertas_spi_remove,
        .driver = {
                .name   = "libertas_spi",
                .owner  = THIS_MODULE,
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 2aa8a1aa1184..8a61dbd320e6 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -1347,9 +1347,14 @@ static void hw_scan_work(struct work_struct *work)
                                                       hwsim->hw_scan_vif,
                                                       req->ssids[i].ssid,
                                                       req->ssids[i].ssid_len,
-                                                       req->ie, req->ie_len);
+                                                       req->ie_len);
                        if (!probe)
                                continue;
+                        if (req->ie_len)
+                                memcpy(skb_put(probe, req->ie_len), req->ie,
+                                       req->ie_len);
                        local_bh_disable();
                        mac80211_hwsim_tx_frame(hwsim->hw, probe,
                                                hwsim->tmp_chan);
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index 3b1c27712ad9..a875499f8945 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -1948,6 +1948,21 @@ mwifiex_setup_ht_caps(struct ieee80211_sta_ht_cap *ht_info,
        else
                ht_info->cap &= ~IEEE80211_HT_CAP_TX_STBC;
+        if (ISSUPP_GREENFIELD(adapter->hw_dot_11n_dev_cap))
+                ht_info->cap |= IEEE80211_HT_CAP_GRN_FLD;
+        else
+                ht_info->cap &= ~IEEE80211_HT_CAP_GRN_FLD;
+        if (ISENABLED_40MHZ_INTOLERANT(adapter->hw_dot_11n_dev_cap))
+                ht_info->cap |= IEEE80211_HT_CAP_40MHZ_INTOLERANT;
+        else
+                ht_info->cap &= ~IEEE80211_HT_CAP_40MHZ_INTOLERANT;
+        if (ISSUPP_RXLDPC(adapter->hw_dot_11n_dev_cap))
+                ht_info->cap |= IEEE80211_HT_CAP_LDPC_CODING;
+        else
+                ht_info->cap &= ~IEEE80211_HT_CAP_LDPC_CODING;
        ht_info->cap &= ~IEEE80211_HT_CAP_MAX_AMSDU;
        ht_info->cap |= IEEE80211_HT_CAP_SM_PS;
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index dda588b35570..4dc8e2e9a889 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -194,6 +194,8 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define ISSUPP_TXSTBC(Dot11nDevCap) (Dot11nDevCap & BIT(25))
 #define ISSUPP_RXSTBC(Dot11nDevCap) (Dot11nDevCap & BIT(26))
 #define ISSUPP_GREENFIELD(Dot11nDevCap) (Dot11nDevCap & BIT(29))
+#define ISENABLED_40MHZ_INTOLERANT(Dot11nDevCap) (Dot11nDevCap & BIT(8))
+#define ISSUPP_RXLDPC(Dot11nDevCap) (Dot11nDevCap & BIT(22))
 /* httxcfg bitmap
 * 0            reserved
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index 237c8d2ba9f2..cb682561c438 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -160,10 +160,21 @@ int mwifiex_fill_new_bss_desc(struct mwifiex_private *priv,
 {
        int ret;
        u8 *beacon_ie;
+        size_t beacon_ie_len;
        struct mwifiex_bss_priv *bss_priv = (void *)bss->priv;
+        const struct cfg80211_bss_ies *ies;
+        rcu_read_lock();
+        ies = rcu_dereference(bss->ies);
+        if (WARN_ON(!ies)) {
+                /* should never happen */
+                rcu_read_unlock();
+                return -EINVAL;
+        }
+        beacon_ie = kmemdup(ies->data, ies->len, GFP_ATOMIC);
+        beacon_ie_len = ies->len;
+        rcu_read_unlock();
-        beacon_ie = kmemdup(bss->information_elements, bss->len_beacon_ies,
-                            GFP_KERNEL);
        if (!beacon_ie) {
                dev_err(priv->adapter->dev, " failed to alloc beacon_ie\n");
                return -ENOMEM;
@@ -172,7 +183,7 @@ int mwifiex_fill_new_bss_desc(struct mwifiex_private *priv,
        memcpy(bss_desc->mac_address, bss->bssid, ETH_ALEN);
        bss_desc->rssi = bss->signal;
        bss_desc->beacon_buf = beacon_ie;
-        bss_desc->beacon_buf_size = bss->len_beacon_ies;
+        bss_desc->beacon_buf_size = beacon_ie_len;
        bss_desc->beacon_period = bss->beacon_interval;
        bss_desc->cap_info_bitmap = bss->capability;
        bss_desc->bss_band = bss_priv->band;
@@ -198,18 +209,23 @@ int mwifiex_fill_new_bss_desc(struct mwifiex_private *priv,
 static int mwifiex_process_country_ie(struct mwifiex_private *priv,
                                      struct cfg80211_bss *bss)
 {
-        u8 *country_ie, country_ie_len;
+        const u8 *country_ie;
+        u8 country_ie_len;
        struct mwifiex_802_11d_domain_reg *domain_info =
                                        &priv->adapter->domain_reg;
-        country_ie = (u8 *)ieee80211_bss_get_ie(bss, WLAN_EID_COUNTRY);
+        rcu_read_lock();
+        country_ie = ieee80211_bss_get_ie(bss, WLAN_EID_COUNTRY);
-        if (!country_ie)
+        if (!country_ie) {
+                rcu_read_unlock();
                return 0;
+        }
        country_ie_len = country_ie[1];
-        if (country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
+        if (country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN) {
+                rcu_read_unlock();
                return 0;
+        }
        domain_info->country_code[0] = country_ie[2];
        domain_info->country_code[1] = country_ie[3];
@@ -223,6 +239,8 @@ static int mwifiex_process_country_ie(struct mwifiex_private *priv,
        memcpy((u8 *)domain_info->triplet,
               &country_ie[2] + IEEE80211_COUNTRY_STRING_LEN, country_ie_len);
+        rcu_read_unlock();
        if (mwifiex_send_cmd_async(priv, HostCmd_CMD_802_11D_DOMAIN_INFO,
                                   HostCmd_ACT_GEN_SET, 0, NULL)) {
                wiphy_err(priv->adapter->wiphy,
@@ -461,7 +479,7 @@ int mwifiex_enable_hs(struct mwifiex_adapter *adapter)
        }
        if (adapter->hs_activated) {
-                dev_dbg(adapter->dev, "cmd: HS Already actived\n");
+                dev_dbg(adapter->dev, "cmd: HS Already activated\n");
                return true;
        }
diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
index bbe1f3518e4b..63ac9f2d11ae 100644
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -351,7 +351,7 @@ static int mwifiex_usb_probe(struct usb_interface *intf,
        card->udev = udev;
        card->intf = intf;
-        pr_debug("info: bcdUSB=%#x Device Class=%#x SubClass=%#x Protocl=%#x\n",
+        pr_debug("info: bcdUSB=%#x Device Class=%#x SubClass=%#x Protocol=%#x\n",
                 udev->descriptor.bcdUSB, udev->descriptor.bDeviceClass,
                 udev->descriptor.bDeviceSubClass,
                 udev->descriptor.bDeviceProtocol);
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 0cdae6632735..f221b95b90b3 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -5258,7 +5258,7 @@ enum {
 #define _MWL8K_8366_AP_FW(api) "mwl8k/fmimage_8366_ap-" #api ".fw"
 #define MWL8K_8366_AP_FW(api) _MWL8K_8366_AP_FW(api)
-static struct mwl8k_device_info mwl8k_info_tbl[] __devinitdata = {
+static struct mwl8k_device_info mwl8k_info_tbl[] = {
        [MWL8363] = {
                .part_name      = "88w8363",
                .helper_image   = "mwl8k/helper_8363.fw",
@@ -5756,7 +5756,7 @@ err_free_cookie:
        return rc;
 }
-static int __devinit mwl8k_probe(struct pci_dev *pdev,
+static int mwl8k_probe(struct pci_dev *pdev,
                                 const struct pci_device_id *id)
 {
        static int printed_version;
@@ -5873,12 +5873,7 @@ err_disable_device:
        return rc;
 }
-static void __devexit mwl8k_shutdown(struct pci_dev *pdev)
+static void mwl8k_remove(struct pci_dev *pdev)
-{
-        printk(KERN_ERR "===>%s(%u)\n", __func__, __LINE__);
-}
-static void __devexit mwl8k_remove(struct pci_dev *pdev)
 {
        struct ieee80211_hw *hw = pci_get_drvdata(pdev);
        struct mwl8k_priv *priv;
@@ -5930,8 +5925,7 @@ static struct pci_driver mwl8k_driver = {
        .name           = MWL8K_NAME,
        .id_table       = mwl8k_pci_id_table,
        .probe          = mwl8k_probe,
-        .remove         = __devexit_p(mwl8k_remove),
+        .remove         = mwl8k_remove,
-        .shutdown       = __devexit_p(mwl8k_shutdown),
 };
 module_pci_driver(mwl8k_driver);
diff --git a/drivers/net/wireless/orinoco/orinoco_nortel.c b/drivers/net/wireless/orinoco/orinoco_nortel.c
index 326396b313a6..d73fdf6185a2 100644
--- a/drivers/net/wireless/orinoco/orinoco_nortel.c
+++ b/drivers/net/wireless/orinoco/orinoco_nortel.c
@@ -255,7 +255,7 @@ static int orinoco_nortel_init_one(struct pci_dev *pdev,
        return err;
 }
-static void __devexit orinoco_nortel_remove_one(struct pci_dev *pdev)
+static void orinoco_nortel_remove_one(struct pci_dev *pdev)
 {
        struct orinoco_private *priv = pci_get_drvdata(pdev);
        struct orinoco_pci_card *card = priv->card;
@@ -288,7 +288,7 @@ static struct pci_driver orinoco_nortel_driver = {
        .name           = DRIVER_NAME,
        .id_table       = orinoco_nortel_id_table,
        .probe          = orinoco_nortel_init_one,
-        .remove         = __devexit_p(orinoco_nortel_remove_one),
+        .remove         = orinoco_nortel_remove_one,
        .suspend        = orinoco_pci_suspend,
        .resume         = orinoco_pci_resume,
 };
diff --git a/drivers/net/wireless/orinoco/orinoco_pci.c b/drivers/net/wireless/orinoco/orinoco_pci.c
index 6058c66b844e..677bf14eca84 100644
--- a/drivers/net/wireless/orinoco/orinoco_pci.c
+++ b/drivers/net/wireless/orinoco/orinoco_pci.c
@@ -199,7 +199,7 @@ static int orinoco_pci_init_one(struct pci_dev *pdev,
        return err;
 }
-static void __devexit orinoco_pci_remove_one(struct pci_dev *pdev)
+static void orinoco_pci_remove_one(struct pci_dev *pdev)
 {
        struct orinoco_private *priv = pci_get_drvdata(pdev);
@@ -228,7 +228,7 @@ static struct pci_driver orinoco_pci_driver = {
        .name           = DRIVER_NAME,
        .id_table       = orinoco_pci_id_table,
        .probe          = orinoco_pci_init_one,
-        .remove         = __devexit_p(orinoco_pci_remove_one),
+        .remove         = orinoco_pci_remove_one,
        .suspend        = orinoco_pci_suspend,
        .resume         = orinoco_pci_resume,
 };
diff --git a/drivers/net/wireless/orinoco/orinoco_plx.c b/drivers/net/wireless/orinoco/orinoco_plx.c
index 2bac8248a991..2559dbd6184b 100644
--- a/drivers/net/wireless/orinoco/orinoco_plx.c
+++ b/drivers/net/wireless/orinoco/orinoco_plx.c
@@ -294,7 +294,7 @@ static int orinoco_plx_init_one(struct pci_dev *pdev,
        return err;
 }
-static void __devexit orinoco_plx_remove_one(struct pci_dev *pdev)
+static void orinoco_plx_remove_one(struct pci_dev *pdev)
 {
        struct orinoco_private *priv = pci_get_drvdata(pdev);
        struct orinoco_pci_card *card = priv->card;
@@ -334,7 +334,7 @@ static struct pci_driver orinoco_plx_driver = {
        .name           = DRIVER_NAME,
        .id_table       = orinoco_plx_id_table,
        .probe          = orinoco_plx_init_one,
-        .remove         = __devexit_p(orinoco_plx_remove_one),
+        .remove         = orinoco_plx_remove_one,
        .suspend        = orinoco_pci_suspend,
        .resume         = orinoco_pci_resume,
 };
diff --git a/drivers/net/wireless/orinoco/orinoco_tmd.c b/drivers/net/wireless/orinoco/orinoco_tmd.c
index 93159d68ec93..42afeeea2c40 100644
--- a/drivers/net/wireless/orinoco/orinoco_tmd.c
+++ b/drivers/net/wireless/orinoco/orinoco_tmd.c
@@ -188,7 +188,7 @@ static int orinoco_tmd_init_one(struct pci_dev *pdev,
        return err;
 }
-static void __devexit orinoco_tmd_remove_one(struct pci_dev *pdev)
+static void orinoco_tmd_remove_one(struct pci_dev *pdev)
 {
        struct orinoco_private *priv = pci_get_drvdata(pdev);
        struct orinoco_pci_card *card = priv->card;
@@ -214,7 +214,7 @@ static struct pci_driver orinoco_tmd_driver = {
        .name           = DRIVER_NAME,
        .id_table       = orinoco_tmd_id_table,
        .probe          = orinoco_tmd_init_one,
-        .remove         = __devexit_p(orinoco_tmd_remove_one),
+        .remove         = orinoco_tmd_remove_one,
        .suspend        = orinoco_pci_suspend,
        .resume         = orinoco_pci_resume,
 };
diff --git a/drivers/net/wireless/p54/eeprom.c b/drivers/net/wireless/p54/eeprom.c
index 1ef1bfe6a9d7..d43e3740e45d 100644
--- a/drivers/net/wireless/p54/eeprom.c
+++ b/drivers/net/wireless/p54/eeprom.c
@@ -541,8 +541,9 @@ static int p54_parse_rssical(struct ieee80211_hw *dev,
                entries = (len - offset) /
                        sizeof(struct pda_rssi_cal_ext_entry);
-                if ((len - offset) % sizeof(struct pda_rssi_cal_ext_entry) ||
+                if (len < offset ||
-                    entries <= 0) {
+                    (len - offset) % sizeof(struct pda_rssi_cal_ext_entry) ||
+                    entries == 0) {
                        wiphy_err(dev->wiphy, "invalid rssi database.\n");
                        goto err_data;
                }
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index b4390797d78c..933e5d941937 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -540,7 +540,7 @@ out:
        pci_dev_put(pdev);
 }
-static int __devinit p54p_probe(struct pci_dev *pdev,
+static int p54p_probe(struct pci_dev *pdev,
                                const struct pci_device_id *id)
 {
        struct p54p_priv *priv;
@@ -639,7 +639,7 @@ static int __devinit p54p_probe(struct pci_dev *pdev,
        return err;
 }
-static void __devexit p54p_remove(struct pci_dev *pdev)
+static void p54p_remove(struct pci_dev *pdev)
 {
        struct ieee80211_hw *dev = pci_get_drvdata(pdev);
        struct p54p_priv *priv;
@@ -659,7 +659,7 @@ static void __devexit p54p_remove(struct pci_dev *pdev)
        p54_free_common(dev);
 }
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static int p54p_suspend(struct device *device)
 {
        struct pci_dev *pdev = to_pci_dev(device);
@@ -681,25 +681,18 @@ static int p54p_resume(struct device *device)
        return pci_set_power_state(pdev, PCI_D0);
 }
-static const struct dev_pm_ops p54pci_pm_ops = {
+static SIMPLE_DEV_PM_OPS(p54pci_pm_ops, p54p_suspend, p54p_resume);
-        .suspend = p54p_suspend,
-        .resume = p54p_resume,
-        .freeze = p54p_suspend,
-        .thaw = p54p_resume,
-        .poweroff = p54p_suspend,
-        .restore = p54p_resume,
-};
 #define P54P_PM_OPS (&p54pci_pm_ops)
 #else
 #define P54P_PM_OPS (NULL)
-#endif /* CONFIG_PM */
+#endif /* CONFIG_PM_SLEEP */
 static struct pci_driver p54p_driver = {
        .name           = "p54pci",
        .id_table       = p54p_table,
        .probe          = p54p_probe,
-        .remove         = __devexit_p(p54p_remove),
+        .remove         = p54p_remove,
        .driver.pm      = P54P_PM_OPS,
 };
diff --git a/drivers/net/wireless/p54/p54spi.c b/drivers/net/wireless/p54/p54spi.c
index f7929906d437..4fd49a007b51 100644
--- a/drivers/net/wireless/p54/p54spi.c
+++ b/drivers/net/wireless/p54/p54spi.c
@@ -595,7 +595,7 @@ static void p54spi_op_stop(struct ieee80211_hw *dev)
        cancel_work_sync(&priv->work);
 }
-static int __devinit p54spi_probe(struct spi_device *spi)
+static int p54spi_probe(struct spi_device *spi)
 {
        struct p54s_priv *priv = NULL;
        struct ieee80211_hw *hw;
@@ -683,7 +683,7 @@ err_free:
        return ret;
 }
-static int __devexit p54spi_remove(struct spi_device *spi)
+static int p54spi_remove(struct spi_device *spi)
 {
        struct p54s_priv *priv = dev_get_drvdata(&spi->dev);
@@ -710,7 +710,7 @@ static struct spi_driver p54spi_driver = {
        },
        .probe          = p54spi_probe,
-        .remove         = __devexit_p(p54spi_remove),
+        .remove         = p54spi_remove,
 };
 static int __init p54spi_init(void)
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index effb044a8a9d..e71c702e2eb1 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -986,7 +986,7 @@ static int p54u_load_firmware(struct ieee80211_hw *dev,
        return err;
 }
-static int __devinit p54u_probe(struct usb_interface *intf,
+static int p54u_probe(struct usb_interface *intf,
                                const struct usb_device_id *id)
 {
        struct usb_device *udev = interface_to_usbdev(intf);
@@ -1057,7 +1057,7 @@ static int __devinit p54u_probe(struct usb_interface *intf,
        return err;
 }
-static void __devexit p54u_disconnect(struct usb_interface *intf)
+static void p54u_disconnect(struct usb_interface *intf)
 {
        struct ieee80211_hw *dev = usb_get_intfdata(intf);
        struct p54u_priv *priv;
@@ -1131,7 +1131,7 @@ static struct usb_driver p54u_driver = {
        .name   = "p54usb",
        .id_table = p54u_table,
        .probe = p54u_probe,
-        .disconnect = __devexit_p(p54u_disconnect),
+        .disconnect = p54u_disconnect,
        .pre_reset = p54u_pre_reset,
        .post_reset = p54u_post_reset,
 #ifdef CONFIG_PM
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index e3a2d9070cf6..a2d2bc2c7b3d 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -1831,7 +1831,7 @@ static struct pci_driver rt2400pci_driver = {
        .name           = KBUILD_MODNAME,
        .id_table       = rt2400pci_device_table,
        .probe          = rt2400pci_probe,
-        .remove         = __devexit_p(rt2x00pci_remove),
+        .remove         = rt2x00pci_remove,
        .suspend        = rt2x00pci_suspend,
        .resume         = rt2x00pci_resume,
 };
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 479d756e275b..9bea10f53f0a 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -2122,7 +2122,7 @@ static struct pci_driver rt2500pci_driver = {
        .name           = KBUILD_MODNAME,
        .id_table       = rt2500pci_device_table,
        .probe          = rt2500pci_probe,
-        .remove         = __devexit_p(rt2x00pci_remove),
+        .remove         = rt2x00pci_remove,
        .suspend        = rt2x00pci_suspend,
        .resume         = rt2x00pci_resume,
 };
diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h
index 6d67c3ede651..4db1088a847f 100644
--- a/drivers/net/wireless/rt2x00/rt2800.h
+++ b/drivers/net/wireless/rt2x00/rt2800.h
@@ -1993,8 +1993,10 @@ struct mac_iveiv_entry {
 */
 #define RFCSR3_K                        FIELD8(0x0f)
 /* Bits [7-4] for RF3320 (RT3370/RT3390), on other chipsets reserved */
-#define RFCSR3_PA1_BIAS_CCK             FIELD8(0x70);
+#define RFCSR3_PA1_BIAS_CCK             FIELD8(0x70)
-#define RFCSR3_PA2_CASCODE_BIAS_CCKK    FIELD8(0x80);
+#define RFCSR3_PA2_CASCODE_BIAS_CCKK    FIELD8(0x80)
+/* Bits for RF3290/RF5360/RF5370/RF5372/RF5390/RF5392 */
+#define RFCSR3_VCOCAL_EN                FIELD8(0x80)
 /*
 * FRCSR 5:
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index c0441a715c96..d4d0c3664eb2 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -2173,7 +2173,7 @@ static void rt2800_config_channel_rf53xx(struct rt2x00_dev *rt2x00dev,
                                rt2800_rfcsr_write(rt2x00dev, 59,
                                                   r59_nonbt_rev[idx]);
                        } else if (rt2x00_rt(rt2x00dev, RT5390) ||
-                                           rt2x00_rt(rt2x00dev, RT5392)) {
+                                   rt2x00_rt(rt2x00dev, RT5392)) {
                                static const char r59_non_bt[] = {0x8f, 0x8f,
                                        0x8f, 0x8f, 0x8f, 0x8f, 0x8f, 0x8d,
                                        0x8a, 0x88, 0x88, 0x87, 0x87, 0x86};
@@ -2243,7 +2243,7 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
                rt2800_rfcsr_write(rt2x00dev, 30, rfcsr);
                rt2800_rfcsr_read(rt2x00dev, 3, &rfcsr);
-                rt2x00_set_field8(&rfcsr, RFCSR30_RF_CALIBRATION, 1);
+                rt2x00_set_field8(&rfcsr, RFCSR3_VCOCAL_EN, 1);
                rt2800_rfcsr_write(rt2x00dev, 3, rfcsr);
        }
@@ -2264,7 +2264,7 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
        if (rf->channel <= 14) {
                if (!rt2x00_rt(rt2x00dev, RT5390) &&
-                        !rt2x00_rt(rt2x00dev, RT5392)) {
+                    !rt2x00_rt(rt2x00dev, RT5392)) {
                        if (test_bit(CAPABILITY_EXTERNAL_LNA_BG,
                                     &rt2x00dev->cap_flags)) {
                                rt2800_bbp_write(rt2x00dev, 82, 0x62);
@@ -2804,7 +2804,7 @@ void rt2800_vco_calibration(struct rt2x00_dev *rt2x00dev)
        case RF5390:
        case RF5392:
                rt2800_rfcsr_read(rt2x00dev, 3, &rfcsr);
-                rt2x00_set_field8(&rfcsr, RFCSR30_RF_CALIBRATION, 1);
+                rt2x00_set_field8(&rfcsr, RFCSR3_VCOCAL_EN, 1);
                rt2800_rfcsr_write(rt2x00dev, 3, rfcsr);
                break;
        default:
@@ -3592,8 +3592,8 @@ static int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
        if (rt2x00_rt_rev(rt2x00dev, RT2860, REV_RT2860D))
                rt2800_bbp_write(rt2x00dev, 84, 0x19);
        else if (rt2x00_rt(rt2x00dev, RT3290) ||
-                     rt2x00_rt(rt2x00dev, RT5390) ||
+                 rt2x00_rt(rt2x00dev, RT5390) ||
-                     rt2x00_rt(rt2x00dev, RT5392))
+                 rt2x00_rt(rt2x00dev, RT5392))
                rt2800_bbp_write(rt2x00dev, 84, 0x9a);
        else
                rt2800_bbp_write(rt2x00dev, 84, 0x99);
@@ -3652,7 +3652,7 @@ static int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
        else if (rt2x00_rt(rt2x00dev, RT3352))
                rt2800_bbp_write(rt2x00dev, 105, 0x34);
        else if (rt2x00_rt(rt2x00dev, RT5390) ||
-                         rt2x00_rt(rt2x00dev, RT5392))
+                 rt2x00_rt(rt2x00dev, RT5392))
                rt2800_bbp_write(rt2x00dev, 105, 0x3c);
        else
                rt2800_bbp_write(rt2x00dev, 105, 0x05);
@@ -3746,7 +3746,7 @@ static int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
        }
        if (rt2x00_rt(rt2x00dev, RT5390) ||
-                rt2x00_rt(rt2x00dev, RT5392)) {
+            rt2x00_rt(rt2x00dev, RT5392)) {
                int ant, div_mode;
                rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC_CONF1, &eeprom);
@@ -4220,66 +4220,66 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
                        rt2800_rfcsr_write(rt2x00dev, 61, 0xdd);
                rt2800_rfcsr_write(rt2x00dev, 62, 0x00);
                rt2800_rfcsr_write(rt2x00dev, 63, 0x00);
-        }       else if (rt2x00_rt(rt2x00dev, RT5392)) {
+        } else if (rt2x00_rt(rt2x00dev, RT5392)) {
-                        rt2800_rfcsr_write(rt2x00dev, 1, 0x17);
+                rt2800_rfcsr_write(rt2x00dev, 1, 0x17);
-                        rt2800_rfcsr_write(rt2x00dev, 2, 0x80);
+                rt2800_rfcsr_write(rt2x00dev, 2, 0x80);
-                        rt2800_rfcsr_write(rt2x00dev, 3, 0x88);
+                rt2800_rfcsr_write(rt2x00dev, 3, 0x88);
-                        rt2800_rfcsr_write(rt2x00dev, 5, 0x10);
+                rt2800_rfcsr_write(rt2x00dev, 5, 0x10);
-                        rt2800_rfcsr_write(rt2x00dev, 6, 0xe0);
+                rt2800_rfcsr_write(rt2x00dev, 6, 0xe0);
-                        rt2800_rfcsr_write(rt2x00dev, 7, 0x00);
+                rt2800_rfcsr_write(rt2x00dev, 7, 0x00);
-                        rt2800_rfcsr_write(rt2x00dev, 10, 0x53);
+                rt2800_rfcsr_write(rt2x00dev, 10, 0x53);
-                        rt2800_rfcsr_write(rt2x00dev, 11, 0x4a);
+                rt2800_rfcsr_write(rt2x00dev, 11, 0x4a);
-                        rt2800_rfcsr_write(rt2x00dev, 12, 0x46);
+                rt2800_rfcsr_write(rt2x00dev, 12, 0x46);
-                        rt2800_rfcsr_write(rt2x00dev, 13, 0x9f);
+                rt2800_rfcsr_write(rt2x00dev, 13, 0x9f);
-                        rt2800_rfcsr_write(rt2x00dev, 14, 0x00);
+                rt2800_rfcsr_write(rt2x00dev, 14, 0x00);
-                        rt2800_rfcsr_write(rt2x00dev, 15, 0x00);
+                rt2800_rfcsr_write(rt2x00dev, 15, 0x00);
-                        rt2800_rfcsr_write(rt2x00dev, 16, 0x00);
+                rt2800_rfcsr_write(rt2x00dev, 16, 0x00);
-                        rt2800_rfcsr_write(rt2x00dev, 18, 0x03);
+                rt2800_rfcsr_write(rt2x00dev, 18, 0x03);
-                        rt2800_rfcsr_write(rt2x00dev, 19, 0x4d);
+                rt2800_rfcsr_write(rt2x00dev, 19, 0x4d);
-                        rt2800_rfcsr_write(rt2x00dev, 20, 0x00);
+                rt2800_rfcsr_write(rt2x00dev, 20, 0x00);
-                        rt2800_rfcsr_write(rt2x00dev, 21, 0x8d);
+                rt2800_rfcsr_write(rt2x00dev, 21, 0x8d);
-                        rt2800_rfcsr_write(rt2x00dev, 22, 0x20);
+                rt2800_rfcsr_write(rt2x00dev, 22, 0x20);
-                        rt2800_rfcsr_write(rt2x00dev, 23, 0x0b);
+                rt2800_rfcsr_write(rt2x00dev, 23, 0x0b);
-                        rt2800_rfcsr_write(rt2x00dev, 24, 0x44);
+                rt2800_rfcsr_write(rt2x00dev, 24, 0x44);
-                        rt2800_rfcsr_write(rt2x00dev, 25, 0x80);
+                rt2800_rfcsr_write(rt2x00dev, 25, 0x80);
-                        rt2800_rfcsr_write(rt2x00dev, 26, 0x82);
+                rt2800_rfcsr_write(rt2x00dev, 26, 0x82);
-                        rt2800_rfcsr_write(rt2x00dev, 27, 0x09);
+                rt2800_rfcsr_write(rt2x00dev, 27, 0x09);
-                        rt2800_rfcsr_write(rt2x00dev, 28, 0x00);
+                rt2800_rfcsr_write(rt2x00dev, 28, 0x00);
-                        rt2800_rfcsr_write(rt2x00dev, 29, 0x10);
+                rt2800_rfcsr_write(rt2x00dev, 29, 0x10);
-                        rt2800_rfcsr_write(rt2x00dev, 30, 0x10);
+                rt2800_rfcsr_write(rt2x00dev, 30, 0x10);
-                        rt2800_rfcsr_write(rt2x00dev, 31, 0x80);
+                rt2800_rfcsr_write(rt2x00dev, 31, 0x80);
-                        rt2800_rfcsr_write(rt2x00dev, 32, 0x20);
+                rt2800_rfcsr_write(rt2x00dev, 32, 0x20);
-                        rt2800_rfcsr_write(rt2x00dev, 33, 0xC0);
+                rt2800_rfcsr_write(rt2x00dev, 33, 0xC0);
-                        rt2800_rfcsr_write(rt2x00dev, 34, 0x07);
+                rt2800_rfcsr_write(rt2x00dev, 34, 0x07);
-                        rt2800_rfcsr_write(rt2x00dev, 35, 0x12);
+                rt2800_rfcsr_write(rt2x00dev, 35, 0x12);
-                        rt2800_rfcsr_write(rt2x00dev, 36, 0x00);
+                rt2800_rfcsr_write(rt2x00dev, 36, 0x00);
-                        rt2800_rfcsr_write(rt2x00dev, 37, 0x08);
+                rt2800_rfcsr_write(rt2x00dev, 37, 0x08);
-                        rt2800_rfcsr_write(rt2x00dev, 38, 0x89);
+                rt2800_rfcsr_write(rt2x00dev, 38, 0x89);
-                        rt2800_rfcsr_write(rt2x00dev, 39, 0x1b);
+                rt2800_rfcsr_write(rt2x00dev, 39, 0x1b);
-                        rt2800_rfcsr_write(rt2x00dev, 40, 0x0f);
+                rt2800_rfcsr_write(rt2x00dev, 40, 0x0f);
-                        rt2800_rfcsr_write(rt2x00dev, 41, 0xbb);
+                rt2800_rfcsr_write(rt2x00dev, 41, 0xbb);
-                        rt2800_rfcsr_write(rt2x00dev, 42, 0xd5);
+                rt2800_rfcsr_write(rt2x00dev, 42, 0xd5);
-                        rt2800_rfcsr_write(rt2x00dev, 43, 0x9b);
+                rt2800_rfcsr_write(rt2x00dev, 43, 0x9b);
-                        rt2800_rfcsr_write(rt2x00dev, 44, 0x0e);
+                rt2800_rfcsr_write(rt2x00dev, 44, 0x0e);
-                        rt2800_rfcsr_write(rt2x00dev, 45, 0xa2);
+                rt2800_rfcsr_write(rt2x00dev, 45, 0xa2);
-                        rt2800_rfcsr_write(rt2x00dev, 46, 0x73);
+                rt2800_rfcsr_write(rt2x00dev, 46, 0x73);
-                        rt2800_rfcsr_write(rt2x00dev, 47, 0x0c);
+                rt2800_rfcsr_write(rt2x00dev, 47, 0x0c);
-                        rt2800_rfcsr_write(rt2x00dev, 48, 0x10);
+                rt2800_rfcsr_write(rt2x00dev, 48, 0x10);
-                        rt2800_rfcsr_write(rt2x00dev, 49, 0x94);
+                rt2800_rfcsr_write(rt2x00dev, 49, 0x94);
-                        rt2800_rfcsr_write(rt2x00dev, 50, 0x94);
+                rt2800_rfcsr_write(rt2x00dev, 50, 0x94);
-                        rt2800_rfcsr_write(rt2x00dev, 51, 0x3a);
+                rt2800_rfcsr_write(rt2x00dev, 51, 0x3a);
-                        rt2800_rfcsr_write(rt2x00dev, 52, 0x48);
+                rt2800_rfcsr_write(rt2x00dev, 52, 0x48);
-                        rt2800_rfcsr_write(rt2x00dev, 53, 0x44);
+                rt2800_rfcsr_write(rt2x00dev, 53, 0x44);
-                        rt2800_rfcsr_write(rt2x00dev, 54, 0x38);
+                rt2800_rfcsr_write(rt2x00dev, 54, 0x38);
-                        rt2800_rfcsr_write(rt2x00dev, 55, 0x43);
+                rt2800_rfcsr_write(rt2x00dev, 55, 0x43);
-                        rt2800_rfcsr_write(rt2x00dev, 56, 0xa1);
+                rt2800_rfcsr_write(rt2x00dev, 56, 0xa1);
-                        rt2800_rfcsr_write(rt2x00dev, 57, 0x00);
+                rt2800_rfcsr_write(rt2x00dev, 57, 0x00);
-                        rt2800_rfcsr_write(rt2x00dev, 58, 0x39);
+                rt2800_rfcsr_write(rt2x00dev, 58, 0x39);
-                        rt2800_rfcsr_write(rt2x00dev, 59, 0x07);
+                rt2800_rfcsr_write(rt2x00dev, 59, 0x07);
-                        rt2800_rfcsr_write(rt2x00dev, 60, 0x45);
+                rt2800_rfcsr_write(rt2x00dev, 60, 0x45);
-                        rt2800_rfcsr_write(rt2x00dev, 61, 0x91);
+                rt2800_rfcsr_write(rt2x00dev, 61, 0x91);
-                        rt2800_rfcsr_write(rt2x00dev, 62, 0x39);
+                rt2800_rfcsr_write(rt2x00dev, 62, 0x39);
-                        rt2800_rfcsr_write(rt2x00dev, 63, 0x07);
+                rt2800_rfcsr_write(rt2x00dev, 63, 0x07);
        }
        if (rt2x00_rt_rev_lt(rt2x00dev, RT3070, REV_RT3070F)) {
@@ -4356,7 +4356,7 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
        rt2800_bbp_read(rt2x00dev, 26, &drv_data->bbp26);
        if (!rt2x00_rt(rt2x00dev, RT5390) &&
-                !rt2x00_rt(rt2x00dev, RT5392)) {
+            !rt2x00_rt(rt2x00dev, RT5392)) {
                /*
                 * Set back to initial state
                 */
@@ -4385,7 +4385,7 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
        rt2800_register_write(rt2x00dev, OPT_14_CSR, reg);
        if (!rt2x00_rt(rt2x00dev, RT5390) &&
-                !rt2x00_rt(rt2x00dev, RT5392)) {
+            !rt2x00_rt(rt2x00dev, RT5392)) {
                rt2800_rfcsr_read(rt2x00dev, 17, &rfcsr);
                rt2x00_set_field8(&rfcsr, RFCSR17_TX_LO1_EN, 0);
                if (rt2x00_rt(rt2x00dev, RT3070) ||
@@ -4457,7 +4457,7 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
        }
        if (rt2x00_rt(rt2x00dev, RT5390) ||
-                rt2x00_rt(rt2x00dev, RT5392)) {
+            rt2x00_rt(rt2x00dev, RT5392)) {
                rt2800_rfcsr_read(rt2x00dev, 38, &rfcsr);
                rt2x00_set_field8(&rfcsr, RFCSR38_RX_LO1_EN, 0);
                rt2800_rfcsr_write(rt2x00dev, 38, rfcsr);
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index 27829e1e2e38..9224d874bf24 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -1176,7 +1176,7 @@ static struct platform_driver rt2800soc_driver = {
                .mod_name       = KBUILD_MODNAME,
        },
        .probe          = rt2800soc_probe,
-        .remove         = __devexit_p(rt2x00soc_remove),
+        .remove         = rt2x00soc_remove,
        .suspend        = rt2x00soc_suspend,
        .resume         = rt2x00soc_resume,
 };
@@ -1193,7 +1193,7 @@ static struct pci_driver rt2800pci_driver = {
        .name           = KBUILD_MODNAME,
        .id_table       = rt2800pci_device_table,
        .probe          = rt2800pci_probe,
-        .remove         = __devexit_p(rt2x00pci_remove),
+        .remove         = rt2x00pci_remove,
        .suspend        = rt2x00pci_suspend,
        .resume         = rt2x00pci_resume,
 };
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 67d167993d45..3248b4224c4e 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1124,6 +1124,9 @@ static inline void rt2x00lib_set_if_combinations(struct rt2x00_dev *rt2x00dev)
        struct ieee80211_iface_limit *if_limit;
        struct ieee80211_iface_combination *if_combination;
+        if (rt2x00dev->ops->max_ap_intf < 2)
+                return;
        /*
         * Build up AP interface limits structure.
         */
@@ -1183,6 +1186,13 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
        rt2x00dev->hw->vif_data_size = sizeof(struct rt2x00_intf);
        /*
+         * rt2x00 devices can only use the last n bits of the MAC address
+         * for virtual interfaces.
+         */
+        rt2x00dev->hw->wiphy->addr_mask[ETH_ALEN - 1] =
+                (rt2x00dev->ops->max_ap_intf - 1);
+        /*
         * Determine which operating modes are supported, all modes
         * which require beaconing, depend on the availability of
         * beacon entries.
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index d6582a2fa353..f95792cfcf89 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -3094,7 +3094,7 @@ static struct pci_driver rt61pci_driver = {
        .name           = KBUILD_MODNAME,
        .id_table       = rt61pci_device_table,
        .probe          = rt61pci_probe,
-        .remove         = __devexit_p(rt2x00pci_remove),
+        .remove         = rt2x00pci_remove,
        .suspend        = rt2x00pci_suspend,
        .resume         = rt2x00pci_resume,
 };
diff --git a/drivers/net/wireless/rtl818x/rtl8180/dev.c b/drivers/net/wireless/rtl818x/rtl8180/dev.c
index b4218a5f2066..1b3c2843221d 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/dev.c
@@ -901,7 +901,7 @@ static void rtl8180_eeprom_register_write(struct eeprom_93cx6 *eeprom)
        udelay(10);
 }
-static int __devinit rtl8180_probe(struct pci_dev *pdev,
+static int rtl8180_probe(struct pci_dev *pdev,
                                   const struct pci_device_id *id)
 {
        struct ieee80211_hw *dev;
@@ -1131,7 +1131,7 @@ static int __devinit rtl8180_probe(struct pci_dev *pdev,
        return err;
 }
-static void __devexit rtl8180_remove(struct pci_dev *pdev)
+static void rtl8180_remove(struct pci_dev *pdev)
 {
        struct ieee80211_hw *dev = pci_get_drvdata(pdev);
        struct rtl8180_priv *priv;
@@ -1170,7 +1170,7 @@ static struct pci_driver rtl8180_driver = {
        .name           = KBUILD_MODNAME,
        .id_table       = rtl8180_table,
        .probe          = rtl8180_probe,
-        .remove         = __devexit_p(rtl8180_remove),
+        .remove         = rtl8180_remove,
 #ifdef CONFIG_PM
        .suspend        = rtl8180_suspend,
        .resume         = rtl8180_resume,
diff --git a/drivers/net/wireless/rtl818x/rtl8187/dev.c b/drivers/net/wireless/rtl818x/rtl8187/dev.c
index 52e6bebcf089..4574bd213705 100644
--- a/drivers/net/wireless/rtl818x/rtl8187/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187/dev.c
@@ -1411,7 +1411,7 @@ static void rtl8187_eeprom_register_write(struct eeprom_93cx6 *eeprom)
        udelay(10);
 }
-static int __devinit rtl8187_probe(struct usb_interface *intf,
+static int rtl8187_probe(struct usb_interface *intf,
                                   const struct usb_device_id *id)
 {
        struct usb_device *udev = interface_to_usbdev(intf);
@@ -1639,7 +1639,7 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
        return err;
 }
-static void __devexit rtl8187_disconnect(struct usb_interface *intf)
+static void rtl8187_disconnect(struct usb_interface *intf)
 {
        struct ieee80211_hw *dev = usb_get_intfdata(intf);
        struct rtl8187_priv *priv;
@@ -1664,7 +1664,7 @@ static struct usb_driver rtl8187_driver = {
        .name           = KBUILD_MODNAME,
        .id_table       = rtl8187_table,
        .probe          = rtl8187_probe,
-        .disconnect     = __devexit_p(rtl8187_disconnect),
+        .disconnect     = rtl8187_disconnect,
        .disable_hub_initiated_lpm = 1,
 };
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index f38e30a947bc..3deacafdcd5e 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -1756,7 +1756,7 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev,
        return true;
 }
-int __devinit rtl_pci_probe(struct pci_dev *pdev,
+int rtl_pci_probe(struct pci_dev *pdev,
                            const struct pci_device_id *id)
 {
        struct ieee80211_hw *hw = NULL;
@@ -1982,6 +1982,7 @@ void rtl_pci_disconnect(struct pci_dev *pdev)
 }
 EXPORT_SYMBOL(rtl_pci_disconnect);
+#ifdef CONFIG_PM_SLEEP
 /***************************************
 kernel pci power state define:
 PCI_D0         ((pci_power_t __force) 0)
@@ -2021,6 +2022,7 @@ int rtl_pci_resume(struct device *dev)
        return 0;
 }
 EXPORT_SYMBOL(rtl_pci_resume);
+#endif /* CONFIG_PM_SLEEP */
 struct rtl_intf_ops rtl_pci_ops = {
        .read_efuse_byte = read_efuse_byte,
diff --git a/drivers/net/wireless/rtlwifi/pci.h b/drivers/net/wireless/rtlwifi/pci.h
index f71b12aa8cb4..65b08f50022e 100644
--- a/drivers/net/wireless/rtlwifi/pci.h
+++ b/drivers/net/wireless/rtlwifi/pci.h
@@ -236,11 +236,13 @@ int rtl_pci_reset_trx_ring(struct ieee80211_hw *hw);
 extern struct rtl_intf_ops rtl_pci_ops;
-int __devinit rtl_pci_probe(struct pci_dev *pdev,
+int rtl_pci_probe(struct pci_dev *pdev,
                            const struct pci_device_id *id);
 void rtl_pci_disconnect(struct pci_dev *pdev);
+#ifdef CONFIG_PM_SLEEP
 int rtl_pci_suspend(struct device *dev);
 int rtl_pci_resume(struct device *dev);
+#endif /* CONFIG_PM_SLEEP */
 static inline u8 pci_read8_sync(struct rtl_priv *rtlpriv, u32 addr)
 {
        return readb((u8 __iomem *) rtlpriv->io.pci_mem_start + addr);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
index 60451eea4d82..49f663bd93ff 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
@@ -372,14 +372,7 @@ MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n");
 MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 1)\n");
 MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
-static const struct dev_pm_ops rtlwifi_pm_ops = {
+static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
-        .suspend = rtl_pci_suspend,
-        .resume = rtl_pci_resume,
-        .freeze = rtl_pci_suspend,
-        .thaw = rtl_pci_resume,
-        .poweroff = rtl_pci_suspend,
-        .restore = rtl_pci_resume,
-};
 static struct pci_driver rtl92ce_driver = {
        .name = KBUILD_MODNAME,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
index 480862c07f92..03c6d18b2e07 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
@@ -352,7 +352,7 @@ static struct rtl_hal_cfg rtl92de_hal_cfg = {
        .maps[RTL_RC_HT_RATEMCS15] = DESC92_RATEMCS15,
 };
-static struct pci_device_id rtl92de_pci_ids[] __devinitdata = {
+static struct pci_device_id rtl92de_pci_ids[] = {
        {RTL_PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8193, rtl92de_hal_cfg)},
        {RTL_PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x002B, rtl92de_hal_cfg)},
        {},
@@ -378,14 +378,7 @@ MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n");
 MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 1)\n");
 MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
-static const struct dev_pm_ops rtlwifi_pm_ops = {
+static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
-        .suspend = rtl_pci_suspend,
-        .resume = rtl_pci_resume,
-        .freeze = rtl_pci_suspend,
-        .thaw = rtl_pci_resume,
-        .poweroff = rtl_pci_suspend,
-        .restore = rtl_pci_resume,
-};
 static struct pci_driver rtl92de_driver = {
        .name = KBUILD_MODNAME,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/def.h b/drivers/net/wireless/rtlwifi/rtl8192se/def.h
index 20afec62ce05..2d255e02d795 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/def.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/def.h
@@ -522,8 +522,7 @@ enum fwcmd_iotype {
        FW_CMD_IQK_ENABLE = 30,
 };
-/*
+/* Driver info contain PHY status
- * Driver info contain PHY status
 * and other variabel size info
 * PHY Status content as below
 */
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/dm.c b/drivers/net/wireless/rtlwifi/rtl8192se/dm.c
index bf79a52c8a52..e551fe5f9ccd 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/dm.c
@@ -465,8 +465,8 @@ static void _rtl92s_dm_initial_gain_sta_beforeconnect(struct ieee80211_hw *hw)
                                digtable->cur_igvalue =
                                                digtable->rx_gain_range_min;
                        else
-                                digtable->cur_igvalue = digtable->rssi_val + 10 -
+                                digtable->cur_igvalue = digtable->rssi_val + 10
-                                                digtable->back_val;
+                                        - digtable->back_val;
                        if (falsealm_cnt->cnt_all > 10000)
                                digtable->cur_igvalue =
@@ -518,7 +518,7 @@ static void _rtl92s_dm_initial_gain_sta_beforeconnect(struct ieee80211_hw *hw)
 static void _rtl92s_dm_ctrl_initgain_bytwoport(struct ieee80211_hw *hw)
 {
        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct dig_t *digtable = &rtlpriv->dm_digtable;
+        struct dig_t *dig = &rtlpriv->dm_digtable;
        if (rtlpriv->mac80211.act_scanning)
                return;
@@ -526,17 +526,17 @@ static void _rtl92s_dm_ctrl_initgain_bytwoport(struct ieee80211_hw *hw)
        /* Decide the current status and if modify initial gain or not */
        if (rtlpriv->mac80211.link_state >= MAC80211_LINKED ||
            rtlpriv->mac80211.opmode == NL80211_IFTYPE_ADHOC)
-                digtable->cur_sta_cstate = DIG_STA_CONNECT;
+                dig->cur_sta_cstate = DIG_STA_CONNECT;
        else
-                digtable->cur_sta_cstate = DIG_STA_DISCONNECT;
+                dig->cur_sta_cstate = DIG_STA_DISCONNECT;
-        digtable->rssi_val = rtlpriv->dm.undec_sm_pwdb;
+        dig->rssi_val = rtlpriv->dm.undec_sm_pwdb;
        /* Change dig mode to rssi */
-        if (digtable->cur_sta_cstate != DIG_STA_DISCONNECT) {
+        if (dig->cur_sta_cstate != DIG_STA_DISCONNECT) {
-                if (digtable->dig_twoport_algorithm ==
+                if (dig->dig_twoport_algorithm ==
                    DIG_TWO_PORT_ALGO_FALSE_ALARM) {
-                        digtable->dig_twoport_algorithm = DIG_TWO_PORT_ALGO_RSSI;
+                        dig->dig_twoport_algorithm = DIG_TWO_PORT_ALGO_RSSI;
                        rtl92s_phy_set_fw_cmd(hw, FW_CMD_DIG_MODE_SS);
                }
        }
@@ -544,7 +544,7 @@ static void _rtl92s_dm_ctrl_initgain_bytwoport(struct ieee80211_hw *hw)
        _rtl92s_dm_false_alarm_counter_statistics(hw);
        _rtl92s_dm_initial_gain_sta_beforeconnect(hw);
-        digtable->pre_sta_cstate = digtable->cur_sta_cstate;
+        dig->pre_sta_cstate = dig->cur_sta_cstate;
 }
 static void _rtl92s_dm_ctrl_initgain_byrssi(struct ieee80211_hw *hw)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
index 1d72779434ba..28526a7361f5 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
@@ -1089,8 +1089,9 @@ int rtl92se_hw_init(struct ieee80211_hw *hw)
        return err;
 }
-void rtl92se_set_mac_addr(struct rtl_io *io, const u8 * addr)
+void rtl92se_set_mac_addr(struct rtl_io *io, const u8 *addr)
 {
+        /* This is a stub. */
 }
 void rtl92se_set_check_bssid(struct ieee80211_hw *hw, bool check_bssid)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/hw.h b/drivers/net/wireless/rtlwifi/rtl8192se/hw.h
index 1886c2644a26..a8e068c76e47 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/hw.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/hw.h
@@ -54,7 +54,7 @@ void rtl92se_disable_interrupt(struct ieee80211_hw *hw);
 int rtl92se_set_network_type(struct ieee80211_hw *hw,
                             enum nl80211_iftype type);
 void rtl92se_set_check_bssid(struct ieee80211_hw *hw, bool check_bssid);
-void rtl92se_set_mac_addr(struct rtl_io *io, const u8 * addr);
+void rtl92se_set_mac_addr(struct rtl_io *io, const u8 *addr);
 void rtl92se_set_qos(struct ieee80211_hw *hw, int aci);
 void rtl92se_set_beacon_related_registers(struct ieee80211_hw *hw);
 void rtl92se_set_beacon_interval(struct ieee80211_hw *hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
index ad4b4803482d..cecc377e9e61 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
@@ -50,8 +50,7 @@ static void rtl92s_init_aspm_vars(struct ieee80211_hw *hw)
        /*close ASPM for AMD defaultly */
        rtlpci->const_amdpci_aspm = 0;
-        /*
+        /* ASPM PS mode.
-         * ASPM PS mode.
         * 0 - Disable ASPM,
         * 1 - Enable ASPM without Clock Req,
         * 2 - Enable ASPM with Clock Req,
@@ -67,8 +66,7 @@ static void rtl92s_init_aspm_vars(struct ieee80211_hw *hw)
        /*Setting for PCI-E bridge */
        rtlpci->const_hostpci_aspm_setting = 0x02;
-        /*
+        /* In Hw/Sw Radio Off situation.
-         * In Hw/Sw Radio Off situation.
         * 0 - Default,
         * 1 - From ASPM setting without low Mac Pwr,
         * 2 - From ASPM setting with low Mac Pwr,
@@ -77,8 +75,7 @@ static void rtl92s_init_aspm_vars(struct ieee80211_hw *hw)
         */
        rtlpci->const_hwsw_rfoff_d3 = 2;
-        /*
+        /* This setting works for those device with
-         * This setting works for those device with
         * backdoor ASPM setting such as EPHY setting.
         * 0 - Not support ASPM,
         * 1 - Support ASPM,
@@ -403,7 +400,7 @@ static struct rtl_hal_cfg rtl92se_hal_cfg = {
        .maps[RTL_RC_HT_RATEMCS15] = DESC92_RATEMCS15,
 };
-static struct pci_device_id rtl92se_pci_ids[] __devinitdata = {
+static struct pci_device_id rtl92se_pci_ids[] = {
        {RTL_PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8192, rtl92se_hal_cfg)},
        {RTL_PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8171, rtl92se_hal_cfg)},
        {RTL_PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8172, rtl92se_hal_cfg)},
@@ -432,14 +429,7 @@ MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n");
 MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 1)\n");
 MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
-static const struct dev_pm_ops rtlwifi_pm_ops = {
+static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
-        .suspend = rtl_pci_suspend,
-        .resume = rtl_pci_resume,
-        .freeze = rtl_pci_suspend,
-        .thaw = rtl_pci_resume,
-        .poweroff = rtl_pci_suspend,
-        .restore = rtl_pci_resume,
-};
 static struct pci_driver rtl92se_driver = {
        .name = KBUILD_MODNAME,
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c b/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
index 0afdc240f2fd..18b0bc51766b 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/sw.c
@@ -367,14 +367,7 @@ MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n");
 MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 1)\n");
 MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
-static const struct dev_pm_ops rtlwifi_pm_ops = {
+static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
-        .suspend = rtl_pci_suspend,
-        .resume = rtl_pci_resume,
-        .freeze = rtl_pci_suspend,
-        .thaw = rtl_pci_resume,
-        .poweroff = rtl_pci_suspend,
-        .restore = rtl_pci_resume,
-};
 static struct pci_driver rtl8723ae_driver = {
        .name = KBUILD_MODNAME,
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index e3ea4b346889..29f0969e4ba0 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -940,7 +940,7 @@ static struct rtl_intf_ops rtl_usb_ops = {
        .waitq_insert = rtl_usb_tx_chk_waitq_insert,
 };
-int __devinit rtl_usb_probe(struct usb_interface *intf,
+int rtl_usb_probe(struct usb_interface *intf,
                        const struct usb_device_id *id)
 {
        int err;
diff --git a/drivers/net/wireless/rtlwifi/usb.h b/drivers/net/wireless/rtlwifi/usb.h
index 43846b329153..5235136f6dd2 100644
--- a/drivers/net/wireless/rtlwifi/usb.h
+++ b/drivers/net/wireless/rtlwifi/usb.h
@@ -156,7 +156,7 @@ struct rtl_usb_priv {
-int __devinit rtl_usb_probe(struct usb_interface *intf,
+int rtl_usb_probe(struct usb_interface *intf,
                            const struct usb_device_id *id);
 void rtl_usb_disconnect(struct usb_interface *intf);
 int rtl_usb_suspend(struct usb_interface *pusb_intf, pm_message_t message);
diff --git a/drivers/net/wireless/ti/wl1251/main.c b/drivers/net/wireless/ti/wl1251/main.c
index 441cbccbd381..f47e8b0482ad 100644
--- a/drivers/net/wireless/ti/wl1251/main.c
+++ b/drivers/net/wireless/ti/wl1251/main.c
@@ -896,11 +896,13 @@ static int wl1251_op_hw_scan(struct ieee80211_hw *hw,
                goto out;
        skb = ieee80211_probereq_get(wl->hw, wl->vif, ssid, ssid_len,
-                                     req->ie, req->ie_len);
+                                     req->ie_len);
        if (!skb) {
                ret = -ENOMEM;
                goto out;
        }
+        if (req->ie_len)
+                memcpy(skb_put(skb, req->ie_len), req->ie, req->ie_len);
        ret = wl1251_cmd_template_set(wl, CMD_PROBE_REQ, skb->data,
                                      skb->len);
diff --git a/drivers/net/wireless/ti/wl1251/sdio.c b/drivers/net/wireless/ti/wl1251/sdio.c
index e2750a12c6f1..e57ee48edff6 100644
--- a/drivers/net/wireless/ti/wl1251/sdio.c
+++ b/drivers/net/wireless/ti/wl1251/sdio.c
@@ -305,7 +305,7 @@ out_free_hw:
        return ret;
 }
-static void __devexit wl1251_sdio_remove(struct sdio_func *func)
+static void wl1251_sdio_remove(struct sdio_func *func)
 {
        struct wl1251 *wl = sdio_get_drvdata(func);
        struct wl1251_sdio *wl_sdio = wl->if_priv;
@@ -347,7 +347,7 @@ static struct sdio_driver wl1251_sdio_driver = {
        .name           = "wl1251_sdio",
        .id_table       = wl1251_devices,
        .probe          = wl1251_sdio_probe,
-        .remove         = __devexit_p(wl1251_sdio_remove),
+        .remove         = wl1251_sdio_remove,
        .drv.pm         = &wl1251_sdio_pm_ops,
 };
diff --git a/drivers/net/wireless/ti/wl1251/spi.c b/drivers/net/wireless/ti/wl1251/spi.c
index 567660cd2fcd..3b266d3231a3 100644
--- a/drivers/net/wireless/ti/wl1251/spi.c
+++ b/drivers/net/wireless/ti/wl1251/spi.c
@@ -237,7 +237,7 @@ static const struct wl1251_if_operations wl1251_spi_ops = {
        .power = wl1251_spi_set_power,
 };
-static int __devinit wl1251_spi_probe(struct spi_device *spi)
+static int wl1251_spi_probe(struct spi_device *spi)
 {
        struct wl12xx_platform_data *pdata;
        struct ieee80211_hw *hw;
@@ -309,7 +309,7 @@ static int __devinit wl1251_spi_probe(struct spi_device *spi)
        return ret;
 }
-static int __devexit wl1251_spi_remove(struct spi_device *spi)
+static int wl1251_spi_remove(struct spi_device *spi)
 {
        struct wl1251 *wl = dev_get_drvdata(&spi->dev);
@@ -326,7 +326,7 @@ static struct spi_driver wl1251_spi_driver = {
        },
        .probe          = wl1251_spi_probe,
-        .remove         = __devexit_p(wl1251_spi_remove),
+        .remove         = wl1251_spi_remove,
 };
 static int __init wl1251_spi_init(void)
diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c
index dadf1dbb002a..e5f5f8f39144 100644
--- a/drivers/net/wireless/ti/wl12xx/main.c
+++ b/drivers/net/wireless/ti/wl12xx/main.c
@@ -1696,7 +1696,7 @@ static int wl12xx_setup(struct wl1271 *wl)
        return 0;
 }
-static int __devinit wl12xx_probe(struct platform_device *pdev)
+static int wl12xx_probe(struct platform_device *pdev)
 {
        struct wl1271 *wl;
        struct ieee80211_hw *hw;
@@ -1725,7 +1725,7 @@ out:
        return ret;
 }
-static const struct platform_device_id wl12xx_id_table[] __devinitconst = {
+static const struct platform_device_id wl12xx_id_table[] = {
        { "wl12xx", 0 },
        {  } /* Terminating Entry */
 };
@@ -1733,7 +1733,7 @@ MODULE_DEVICE_TABLE(platform, wl12xx_id_table);
 static struct platform_driver wl12xx_driver = {
        .probe          = wl12xx_probe,
-        .remove         = __devexit_p(wlcore_remove),
+        .remove         = wlcore_remove,
        .id_table       = wl12xx_id_table,
        .driver = {
                .name   = "wl12xx_driver",
diff --git a/drivers/net/wireless/ti/wl18xx/main.c b/drivers/net/wireless/ti/wl18xx/main.c
index a39682a7c25f..8d8c1f8c63b7 100644
--- a/drivers/net/wireless/ti/wl18xx/main.c
+++ b/drivers/net/wireless/ti/wl18xx/main.c
@@ -1499,7 +1499,7 @@ static int wl18xx_setup(struct wl1271 *wl)
        return 0;
 }
-static int __devinit wl18xx_probe(struct platform_device *pdev)
+static int wl18xx_probe(struct platform_device *pdev)
 {
        struct wl1271 *wl;
        struct ieee80211_hw *hw;
@@ -1528,7 +1528,7 @@ out:
        return ret;
 }
-static const struct platform_device_id wl18xx_id_table[] __devinitconst = {
+static const struct platform_device_id wl18xx_id_table[] = {
        { "wl18xx", 0 },
        {  } /* Terminating Entry */
 };
@@ -1536,7 +1536,7 @@ MODULE_DEVICE_TABLE(platform, wl18xx_id_table);
 static struct platform_driver wl18xx_driver = {
        .probe          = wl18xx_probe,
-        .remove         = __devexit_p(wlcore_remove),
+        .remove         = wlcore_remove,
        .id_table       = wl18xx_id_table,
        .driver = {
                .name   = "wl18xx_driver",
diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c
index eaef3f41b252..27f83f72a93b 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.c
+++ b/drivers/net/wireless/ti/wlcore/cmd.c
@@ -1038,11 +1038,13 @@ int wl12xx_cmd_build_probe_req(struct wl1271 *wl, struct wl12xx_vif *wlvif,
        u16 template_id_5 = CMD_TEMPL_CFG_PROBE_REQ_5;
        skb = ieee80211_probereq_get(wl->hw, vif, ssid, ssid_len,
-                                     ie, ie_len);
+                                     ie_len);
        if (!skb) {
                ret = -ENOMEM;
                goto out;
        }
+        if (ie_len)
+                memcpy(skb_put(skb, ie_len), ie, ie_len);
        wl1271_dump(DEBUG_SCAN, "PROBE REQ: ", skb->data, skb->len);
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index 4f1a05b92d2d..ea9d8e011bc9 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -5660,7 +5660,7 @@ out:
        complete_all(&wl->nvs_loading_complete);
 }
-int __devinit wlcore_probe(struct wl1271 *wl, struct platform_device *pdev)
+int wlcore_probe(struct wl1271 *wl, struct platform_device *pdev)
 {
        int ret;
@@ -5683,7 +5683,7 @@ int __devinit wlcore_probe(struct wl1271 *wl, struct platform_device *pdev)
 }
 EXPORT_SYMBOL_GPL(wlcore_probe);
-int __devexit wlcore_remove(struct platform_device *pdev)
+int wlcore_remove(struct platform_device *pdev)
 {
        struct wl1271 *wl = platform_get_drvdata(pdev);
diff --git a/drivers/net/wireless/ti/wlcore/sdio.c b/drivers/net/wireless/ti/wlcore/sdio.c
index 73ace4b2604e..646f703ae739 100644
--- a/drivers/net/wireless/ti/wlcore/sdio.c
+++ b/drivers/net/wireless/ti/wlcore/sdio.c
@@ -54,7 +54,7 @@ struct wl12xx_sdio_glue {
        struct platform_device *core;
 };
-static const struct sdio_device_id wl1271_devices[] __devinitconst = {
+static const struct sdio_device_id wl1271_devices[] = {
        { SDIO_DEVICE(SDIO_VENDOR_ID_TI, SDIO_DEVICE_ID_TI_WL1271) },
        {}
 };
@@ -214,7 +214,7 @@ static struct wl1271_if_operations sdio_ops = {
        .set_block_size = wl1271_sdio_set_block_size,
 };
-static int __devinit wl1271_probe(struct sdio_func *func,
+static int wl1271_probe(struct sdio_func *func,
                                  const struct sdio_device_id *id)
 {
        struct wl12xx_platform_data *wlan_data;
@@ -319,7 +319,7 @@ out:
        return ret;
 }
-static void __devexit wl1271_remove(struct sdio_func *func)
+static void wl1271_remove(struct sdio_func *func)
 {
        struct wl12xx_sdio_glue *glue = sdio_get_drvdata(func);
@@ -384,7 +384,7 @@ static struct sdio_driver wl1271_sdio_driver = {
        .name           = "wl1271_sdio",
        .id_table       = wl1271_devices,
        .probe          = wl1271_probe,
-        .remove         = __devexit_p(wl1271_remove),
+        .remove         = wl1271_remove,
 #ifdef CONFIG_PM
        .drv = {
                .pm = &wl1271_sdio_pm_ops,
diff --git a/drivers/net/wireless/ti/wlcore/spi.c b/drivers/net/wireless/ti/wlcore/spi.c
index a519bc3adec1..f06f4770ce02 100644
--- a/drivers/net/wireless/ti/wlcore/spi.c
+++ b/drivers/net/wireless/ti/wlcore/spi.c
@@ -324,7 +324,7 @@ static struct wl1271_if_operations spi_ops = {
        .set_block_size = NULL,
 };
-static int __devinit wl1271_probe(struct spi_device *spi)
+static int wl1271_probe(struct spi_device *spi)
 {
        struct wl12xx_spi_glue *glue;
        struct wl12xx_platform_data *pdata;
@@ -403,7 +403,7 @@ out:
        return ret;
 }
-static int __devexit wl1271_remove(struct spi_device *spi)
+static int wl1271_remove(struct spi_device *spi)
 {
        struct wl12xx_spi_glue *glue = spi_get_drvdata(spi);
@@ -422,7 +422,7 @@ static struct spi_driver wl1271_spi_driver = {
        },
        .probe          = wl1271_probe,
-        .remove         = __devexit_p(wl1271_remove),
+        .remove         = wl1271_remove,
 };
 static int __init wl1271_init(void)
diff --git a/drivers/net/wireless/ti/wlcore/wlcore.h b/drivers/net/wireless/ti/wlcore/wlcore.h
index 68584aa0f2b0..c3884937c007 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore.h
@@ -414,8 +414,8 @@ struct wl1271 {
        struct completion nvs_loading_complete;
 };
-int __devinit wlcore_probe(struct wl1271 *wl, struct platform_device *pdev);
+int wlcore_probe(struct wl1271 *wl, struct platform_device *pdev);
-int __devexit wlcore_remove(struct platform_device *pdev);
+int wlcore_remove(struct platform_device *pdev);
 struct ieee80211_hw *wlcore_alloc_hw(size_t priv_size, u32 aggr_buf_size);
 int wlcore_free_hw(struct wl1271 *wl);
 int wlcore_set_key(struct wl1271 *wl, enum set_key_cmd cmd,
diff --git a/drivers/ssb/driver_chipcommon.c b/drivers/ssb/driver_chipcommon.c
index e9d2ca11283b..95c33a05f434 100644
--- a/drivers/ssb/driver_chipcommon.c
+++ b/drivers/ssb/driver_chipcommon.c
@@ -4,6 +4,7 @@
 *
 * Copyright 2005, Broadcom Corporation
 * Copyright 2006, 2007, Michael Buesch <m@bues.ch>
+ * Copyright 2012, Hauke Mehrtens <hauke@hauke-m.de>
 *
 * Licensed under the GNU/GPL. See COPYING for details.
 */
@@ -12,6 +13,7 @@
 #include <linux/ssb/ssb_regs.h>
 #include <linux/export.h>
 #include <linux/pci.h>
+#include <linux/bcm47xx_wdt.h>
 #include "ssb_private.h"
@@ -280,6 +282,69 @@ static void calc_fast_powerup_delay(struct ssb_chipcommon *cc)
        cc->fast_pwrup_delay = tmp;
 }
+static u32 ssb_chipco_alp_clock(struct ssb_chipcommon *cc)
+{
+        if (cc->capabilities & SSB_CHIPCO_CAP_PMU)
+                return ssb_pmu_get_alp_clock(cc);
+        return 20000000;
+}
+static u32 ssb_chipco_watchdog_get_max_timer(struct ssb_chipcommon *cc)
+{
+        u32 nb;
+        if (cc->capabilities & SSB_CHIPCO_CAP_PMU) {
+                if (cc->dev->id.revision < 26)
+                        nb = 16;
+                else
+                        nb = (cc->dev->id.revision >= 37) ? 32 : 24;
+        } else {
+                nb = 28;
+        }
+        if (nb == 32)
+                return 0xffffffff;
+        else
+                return (1 << nb) - 1;
+}
+u32 ssb_chipco_watchdog_timer_set_wdt(struct bcm47xx_wdt *wdt, u32 ticks)
+{
+        struct ssb_chipcommon *cc = bcm47xx_wdt_get_drvdata(wdt);
+        if (cc->dev->bus->bustype != SSB_BUSTYPE_SSB)
+                return 0;
+        return ssb_chipco_watchdog_timer_set(cc, ticks);
+}
+u32 ssb_chipco_watchdog_timer_set_ms(struct bcm47xx_wdt *wdt, u32 ms)
+{
+        struct ssb_chipcommon *cc = bcm47xx_wdt_get_drvdata(wdt);
+        u32 ticks;
+        if (cc->dev->bus->bustype != SSB_BUSTYPE_SSB)
+                return 0;
+        ticks = ssb_chipco_watchdog_timer_set(cc, cc->ticks_per_ms * ms);
+        return ticks / cc->ticks_per_ms;
+}
+static int ssb_chipco_watchdog_ticks_per_ms(struct ssb_chipcommon *cc)
+{
+        struct ssb_bus *bus = cc->dev->bus;
+        if (cc->capabilities & SSB_CHIPCO_CAP_PMU) {
+                        /* based on 32KHz ILP clock */
+                        return 32;
+        } else {
+                if (cc->dev->id.revision < 18)
+                        return ssb_clockspeed(bus) / 1000;
+                else
+                        return ssb_chipco_alp_clock(cc) / 1000;
+        }
+}
 void ssb_chipcommon_init(struct ssb_chipcommon *cc)
 {
        if (!cc->dev)
@@ -297,6 +362,11 @@ void ssb_chipcommon_init(struct ssb_chipcommon *cc)
        chipco_powercontrol_init(cc);
        ssb_chipco_set_clockmode(cc, SSB_CLKMODE_FAST);
        calc_fast_powerup_delay(cc);
+        if (cc->dev->bus->bustype == SSB_BUSTYPE_SSB) {
+                cc->ticks_per_ms = ssb_chipco_watchdog_ticks_per_ms(cc);
+                cc->max_timer_ms = ssb_chipco_watchdog_get_max_timer(cc) / cc->ticks_per_ms;
+        }
 }
 void ssb_chipco_suspend(struct ssb_chipcommon *cc)
@@ -395,10 +465,27 @@ void ssb_chipco_timing_init(struct ssb_chipcommon *cc,
 }
 /* Set chip watchdog reset timer to fire in 'ticks' backplane cycles */
-void ssb_chipco_watchdog_timer_set(struct ssb_chipcommon *cc, u32 ticks)
+u32 ssb_chipco_watchdog_timer_set(struct ssb_chipcommon *cc, u32 ticks)
 {
-        /* instant NMI */
+        u32 maxt;
-        chipco_write32(cc, SSB_CHIPCO_WATCHDOG, ticks);
+        enum ssb_clkmode clkmode;
+        maxt = ssb_chipco_watchdog_get_max_timer(cc);
+        if (cc->capabilities & SSB_CHIPCO_CAP_PMU) {
+                if (ticks == 1)
+                        ticks = 2;
+                else if (ticks > maxt)
+                        ticks = maxt;
+                chipco_write32(cc, SSB_CHIPCO_PMU_WATCHDOG, ticks);
+        } else {
+                clkmode = ticks ? SSB_CLKMODE_FAST : SSB_CLKMODE_DYNAMIC;
+                ssb_chipco_set_clockmode(cc, clkmode);
+                if (ticks > maxt)
+                        ticks = maxt;
+                /* instant NMI */
+                chipco_write32(cc, SSB_CHIPCO_WATCHDOG, ticks);
+        }
+        return ticks;
 }
 void ssb_chipco_irq_mask(struct ssb_chipcommon *cc, u32 mask, u32 value)
@@ -473,12 +560,7 @@ int ssb_chipco_serial_init(struct ssb_chipcommon *cc,
                                       chipco_read32(cc, SSB_CHIPCO_CORECTL)
                                       | SSB_CHIPCO_CORECTL_UARTCLK0);
                } else if ((ccrev >= 11) && (ccrev != 15)) {
-                        /* Fixed ALP clock */
+                        baud_base = ssb_chipco_alp_clock(cc);
-                        baud_base = 20000000;
-                        if (cc->capabilities & SSB_CHIPCO_CAP_PMU) {
-                                /* FIXME: baud_base is different for devices with a PMU */
-                                SSB_WARN_ON(1);
-                        }
                        div = 1;
                        if (ccrev >= 21) {
                                /* Turn off UART clock before switching clocksource. */
diff --git a/drivers/ssb/driver_chipcommon_pmu.c b/drivers/ssb/driver_chipcommon_pmu.c
index d7d58044b4bc..a43415a7fbed 100644
--- a/drivers/ssb/driver_chipcommon_pmu.c
+++ b/drivers/ssb/driver_chipcommon_pmu.c
@@ -618,6 +618,33 @@ void ssb_pmu_set_ldo_paref(struct ssb_chipcommon *cc, bool on)
 EXPORT_SYMBOL(ssb_pmu_set_ldo_voltage);
 EXPORT_SYMBOL(ssb_pmu_set_ldo_paref);
+static u32 ssb_pmu_get_alp_clock_clk0(struct ssb_chipcommon *cc)
+{
+        u32 crystalfreq;
+        const struct pmu0_plltab_entry *e = NULL;
+        crystalfreq = chipco_read32(cc, SSB_CHIPCO_PMU_CTL) &
+                      SSB_CHIPCO_PMU_CTL_XTALFREQ >> SSB_CHIPCO_PMU_CTL_XTALFREQ_SHIFT;
+        e = pmu0_plltab_find_entry(crystalfreq);
+        BUG_ON(!e);
+        return e->freq * 1000;
+}
+u32 ssb_pmu_get_alp_clock(struct ssb_chipcommon *cc)
+{
+        struct ssb_bus *bus = cc->dev->bus;
+        switch (bus->chip_id) {
+        case 0x5354:
+                ssb_pmu_get_alp_clock_clk0(cc);
+        default:
+                ssb_printk(KERN_ERR PFX
+                           "ERROR: PMU alp clock unknown for device %04X\n",
+                           bus->chip_id);
+                return 0;
+        }
+}
 u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc)
 {
        struct ssb_bus *bus = cc->dev->bus;
diff --git a/drivers/ssb/driver_extif.c b/drivers/ssb/driver_extif.c
index dc47f30e9cf7..553227a3062d 100644
--- a/drivers/ssb/driver_extif.c
+++ b/drivers/ssb/driver_extif.c
@@ -112,10 +112,30 @@ void ssb_extif_get_clockcontrol(struct ssb_extif *extif,
        *m = extif_read32(extif, SSB_EXTIF_CLOCK_SB);
 }
-void ssb_extif_watchdog_timer_set(struct ssb_extif *extif,
+u32 ssb_extif_watchdog_timer_set_wdt(struct bcm47xx_wdt *wdt, u32 ticks)
-                                  u32 ticks)
 {
+        struct ssb_extif *extif = bcm47xx_wdt_get_drvdata(wdt);
+        return ssb_extif_watchdog_timer_set(extif, ticks);
+}
+u32 ssb_extif_watchdog_timer_set_ms(struct bcm47xx_wdt *wdt, u32 ms)
+{
+        struct ssb_extif *extif = bcm47xx_wdt_get_drvdata(wdt);
+        u32 ticks = (SSB_EXTIF_WATCHDOG_CLK / 1000) * ms;
+        ticks = ssb_extif_watchdog_timer_set(extif, ticks);
+        return (ticks * 1000) / SSB_EXTIF_WATCHDOG_CLK;
+}
+u32 ssb_extif_watchdog_timer_set(struct ssb_extif *extif, u32 ticks)
+{
+        if (ticks > SSB_EXTIF_WATCHDOG_MAX_TIMER)
+                ticks = SSB_EXTIF_WATCHDOG_MAX_TIMER;
        extif_write32(extif, SSB_EXTIF_WATCHDOG, ticks);
+        return ticks;
 }
 u32 ssb_extif_gpio_in(struct ssb_extif *extif, u32 mask)
diff --git a/drivers/ssb/driver_mipscore.c b/drivers/ssb/driver_mipscore.c
index b918ba922306..5bd05b136d22 100644
--- a/drivers/ssb/driver_mipscore.c
+++ b/drivers/ssb/driver_mipscore.c
@@ -178,9 +178,9 @@ static void ssb_mips_serial_init(struct ssb_mipscore *mcore)
 {
        struct ssb_bus *bus = mcore->dev->bus;
-        if (bus->extif.dev)
+        if (ssb_extif_available(&bus->extif))
                mcore->nr_serial_ports = ssb_extif_serial_init(&bus->extif, mcore->serial_ports);
-        else if (bus->chipco.dev)
+        else if (ssb_chipco_available(&bus->chipco))
                mcore->nr_serial_ports = ssb_chipco_serial_init(&bus->chipco, mcore->serial_ports);
        else
                mcore->nr_serial_ports = 0;
@@ -191,7 +191,7 @@ static void ssb_mips_flash_detect(struct ssb_mipscore *mcore)
        struct ssb_bus *bus = mcore->dev->bus;
        /* When there is no chipcommon on the bus there is 4MB flash */
-        if (!bus->chipco.dev) {
+        if (!ssb_chipco_available(&bus->chipco)) {
                mcore->pflash.present = true;
                mcore->pflash.buswidth = 2;
                mcore->pflash.window = SSB_FLASH1;
@@ -227,9 +227,9 @@ u32 ssb_cpu_clock(struct ssb_mipscore *mcore)
        if (bus->chipco.capabilities & SSB_CHIPCO_CAP_PMU)
                return ssb_pmu_get_cpu_clock(&bus->chipco);
-        if (bus->extif.dev) {
+        if (ssb_extif_available(&bus->extif)) {
                ssb_extif_get_clockcontrol(&bus->extif, &pll_type, &n, &m);
-        } else if (bus->chipco.dev) {
+        } else if (ssb_chipco_available(&bus->chipco)) {
                ssb_chipco_get_clockcpu(&bus->chipco, &pll_type, &n, &m);
        } else
                return 0;
@@ -265,9 +265,9 @@ void ssb_mipscore_init(struct ssb_mipscore *mcore)
                hz = 100000000;
        ns = 1000000000 / hz;
-        if (bus->extif.dev)
+        if (ssb_extif_available(&bus->extif))
                ssb_extif_timing_init(&bus->extif, ns);
-        else if (bus->chipco.dev)
+        else if (ssb_chipco_available(&bus->chipco))
                ssb_chipco_timing_init(&bus->chipco, ns);
        /* Assign IRQs to all cores on the bus, start with irq line 2, because serial usually takes 1 */
diff --git a/drivers/ssb/embedded.c b/drivers/ssb/embedded.c
index 9ef124f9ee2d..bb18d76f9f2c 100644
--- a/drivers/ssb/embedded.c
+++ b/drivers/ssb/embedded.c
@@ -4,11 +4,13 @@
 *
 * Copyright 2005-2008, Broadcom Corporation
 * Copyright 2006-2008, Michael Buesch <m@bues.ch>
+ * Copyright 2012, Hauke Mehrtens <hauke@hauke-m.de>
 *
 * Licensed under the GNU/GPL. See COPYING for details.
 */
 #include <linux/export.h>
+#include <linux/platform_device.h>
 #include <linux/ssb/ssb.h>
 #include <linux/ssb/ssb_embedded.h>
 #include <linux/ssb/ssb_driver_pci.h>
@@ -32,6 +34,39 @@ int ssb_watchdog_timer_set(struct ssb_bus *bus, u32 ticks)
 }
 EXPORT_SYMBOL(ssb_watchdog_timer_set);
+int ssb_watchdog_register(struct ssb_bus *bus)
+{
+        struct bcm47xx_wdt wdt = {};
+        struct platform_device *pdev;
+        if (ssb_chipco_available(&bus->chipco)) {
+                wdt.driver_data = &bus->chipco;
+                wdt.timer_set = ssb_chipco_watchdog_timer_set_wdt;
+                wdt.timer_set_ms = ssb_chipco_watchdog_timer_set_ms;
+                wdt.max_timer_ms = bus->chipco.max_timer_ms;
+        } else if (ssb_extif_available(&bus->extif)) {
+                wdt.driver_data = &bus->extif;
+                wdt.timer_set = ssb_extif_watchdog_timer_set_wdt;
+                wdt.timer_set_ms = ssb_extif_watchdog_timer_set_ms;
+                wdt.max_timer_ms = SSB_EXTIF_WATCHDOG_MAX_TIMER_MS;
+        } else {
+                return -ENODEV;
+        }
+        pdev = platform_device_register_data(NULL, "bcm47xx-wdt",
+                                             bus->busnumber, &wdt,
+                                             sizeof(wdt));
+        if (IS_ERR(pdev)) {
+                ssb_dprintk(KERN_INFO PFX
+                            "can not register watchdog device, err: %li\n",
+                            PTR_ERR(pdev));
+                return PTR_ERR(pdev);
+        }
+        bus->watchdog = pdev;
+        return 0;
+}
 u32 ssb_gpio_in(struct ssb_bus *bus, u32 mask)
 {
        unsigned long flags;
diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c
index df0f145c22fc..58c7da29a37c 100644
--- a/drivers/ssb/main.c
+++ b/drivers/ssb/main.c
@@ -13,6 +13,7 @@
 #include <linux/delay.h>
 #include <linux/io.h>
 #include <linux/module.h>
+#include <linux/platform_device.h>
 #include <linux/ssb/ssb.h>
 #include <linux/ssb/ssb_regs.h>
 #include <linux/ssb/ssb_driver_gige.h>
@@ -433,6 +434,11 @@ static void ssb_devices_unregister(struct ssb_bus *bus)
                if (sdev->dev)
                        device_unregister(sdev->dev);
        }
+#ifdef CONFIG_SSB_EMBEDDED
+        if (bus->bustype == SSB_BUSTYPE_SSB)
+                platform_device_unregister(bus->watchdog);
+#endif
 }
 void ssb_bus_unregister(struct ssb_bus *bus)
@@ -561,6 +567,8 @@ static int __devinit ssb_attach_queued_buses(void)
                if (err)
                        goto error;
                ssb_pcicore_init(&bus->pcicore);
+                if (bus->bustype == SSB_BUSTYPE_SSB)
+                        ssb_watchdog_register(bus);
                ssb_bus_may_powerdown(bus);
                err = ssb_devices_register(bus);
diff --git a/drivers/ssb/ssb_private.h b/drivers/ssb/ssb_private.h
index a305550b4b65..8942db1d855a 100644
--- a/drivers/ssb/ssb_private.h
+++ b/drivers/ssb/ssb_private.h
@@ -3,6 +3,7 @@
 #include <linux/ssb/ssb.h>
 #include <linux/types.h>
+#include <linux/bcm47xx_wdt.h>
 #define PFX     "ssb: "
@@ -210,5 +211,35 @@ static inline void b43_pci_ssb_bridge_exit(void)
 /* driver_chipcommon_pmu.c */
 extern u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc);
 extern u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc);
+extern u32 ssb_pmu_get_alp_clock(struct ssb_chipcommon *cc);
+extern u32 ssb_chipco_watchdog_timer_set_wdt(struct bcm47xx_wdt *wdt,
+                                             u32 ticks);
+extern u32 ssb_chipco_watchdog_timer_set_ms(struct bcm47xx_wdt *wdt, u32 ms);
+#ifdef CONFIG_SSB_DRIVER_EXTIF
+extern u32 ssb_extif_watchdog_timer_set_wdt(struct bcm47xx_wdt *wdt, u32 ticks);
+extern u32 ssb_extif_watchdog_timer_set_ms(struct bcm47xx_wdt *wdt, u32 ms);
+#else
+static inline u32 ssb_extif_watchdog_timer_set_wdt(struct bcm47xx_wdt *wdt,
+                                                   u32 ticks)
+{
+        return 0;
+}
+static inline u32 ssb_extif_watchdog_timer_set_ms(struct bcm47xx_wdt *wdt,
+                                                  u32 ms)
+{
+        return 0;
+}
+#endif
+#ifdef CONFIG_SSB_EMBEDDED
+extern int ssb_watchdog_register(struct ssb_bus *bus);
+#else /* CONFIG_SSB_EMBEDDED */
+static inline int ssb_watchdog_register(struct ssb_bus *bus)
+{
+        return 0;
+}
+#endif /* CONFIG_SSB_EMBEDDED */
 #endif /* LINUX_SSB_PRIVATE_H_ */
diff --git a/include/linux/bcm47xx_wdt.h b/include/linux/bcm47xx_wdt.h
new file mode 100644
index 000000000000..e5dfc256485b
--- /dev/null
+++ b/include/linux/bcm47xx_wdt.h
@@ -0,0 +1,19 @@
+#ifndef LINUX_BCM47XX_WDT_H_
+#define LINUX_BCM47XX_WDT_H_
+#include <linux/types.h>
+struct bcm47xx_wdt {
+        u32 (*timer_set)(struct bcm47xx_wdt *, u32);
+        u32 (*timer_set_ms)(struct bcm47xx_wdt *, u32);
+        u32 max_timer_ms;
+        void *driver_data;
+};
+static inline void *bcm47xx_wdt_get_drvdata(struct bcm47xx_wdt *wdt)
+{
+        return wdt->driver_data;
+}
+#endif /* LINUX_BCM47XX_WDT_H_ */
diff --git a/include/linux/bcma/bcma_driver_chipcommon.h b/include/linux/bcma/bcma_driver_chipcommon.h
index 145f3c56227f..e51359180b6f 100644
--- a/include/linux/bcma/bcma_driver_chipcommon.h
+++ b/include/linux/bcma/bcma_driver_chipcommon.h
@@ -1,6 +1,8 @@
 #ifndef LINUX_BCMA_DRIVER_CC_H_
 #define LINUX_BCMA_DRIVER_CC_H_
+#include <linux/platform_device.h>
 /** ChipCommon core registers. **/
 #define BCMA_CC_ID                      0x0000
 #define  BCMA_CC_ID_ID                  0x0000FFFF
@@ -570,6 +572,8 @@ struct bcma_drv_cc {
        int nr_serial_ports;
        struct bcma_serial_port serial_ports[4];
 #endif /* CONFIG_BCMA_DRIVER_MIPS */
+        u32 ticks_per_ms;
+        struct platform_device *watchdog;
 };
 /* Register access */
@@ -593,8 +597,7 @@ extern void bcma_chipco_resume(struct bcma_drv_cc *cc);
 void bcma_chipco_bcm4331_ext_pa_lines_ctl(struct bcma_drv_cc *cc, bool enable);
-extern void bcma_chipco_watchdog_timer_set(struct bcma_drv_cc *cc,
+extern u32 bcma_chipco_watchdog_timer_set(struct bcma_drv_cc *cc, u32 ticks);
-                                          u32 ticks);
 void bcma_chipco_irq_mask(struct bcma_drv_cc *cc, u32 mask, u32 value);
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index f9c5a787d350..8f690e53dd89 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -1213,6 +1213,21 @@ struct ieee80211_vht_cap {
 } __packed;
 /**
+ * enum ieee80211_vht_chanwidth - VHT channel width
+ * @IEEE80211_VHT_CHANWIDTH_USE_HT: use the HT operation IE to
+ *      determine the channel width (20 or 40 MHz)
+ * @IEEE80211_VHT_CHANWIDTH_80MHZ: 80 MHz bandwidth
+ * @IEEE80211_VHT_CHANWIDTH_160MHZ: 160 MHz bandwidth
+ * @IEEE80211_VHT_CHANWIDTH_80P80MHZ: 80+80 MHz bandwidth
+ */
+enum ieee80211_vht_chanwidth {
+        IEEE80211_VHT_CHANWIDTH_USE_HT          = 0,
+        IEEE80211_VHT_CHANWIDTH_80MHZ           = 1,
+        IEEE80211_VHT_CHANWIDTH_160MHZ          = 2,
+        IEEE80211_VHT_CHANWIDTH_80P80MHZ        = 3,
+};
+/**
 * struct ieee80211_vht_operation - VHT operation IE
 *
 * This structure is the "VHT operation element" as
diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h
index bb674c02f306..1f64e3f1f22b 100644
--- a/include/linux/ssb/ssb.h
+++ b/include/linux/ssb/ssb.h
@@ -8,6 +8,7 @@
 #include <linux/pci.h>
 #include <linux/mod_devicetable.h>
 #include <linux/dma-mapping.h>
+#include <linux/platform_device.h>
 #include <linux/ssb/ssb_regs.h>
@@ -432,6 +433,7 @@ struct ssb_bus {
 #ifdef CONFIG_SSB_EMBEDDED
        /* Lock for GPIO register access. */
        spinlock_t gpio_lock;
+        struct platform_device *watchdog;
 #endif /* EMBEDDED */
        /* Internal-only stuff follows. Do not touch. */
diff --git a/include/linux/ssb/ssb_driver_chipcommon.h b/include/linux/ssb/ssb_driver_chipcommon.h
index c2b02a5c86ae..38339fd68a5f 100644
--- a/include/linux/ssb/ssb_driver_chipcommon.h
+++ b/include/linux/ssb/ssb_driver_chipcommon.h
@@ -591,6 +591,8 @@ struct ssb_chipcommon {
        /* Fast Powerup Delay constant */
        u16 fast_pwrup_delay;
        struct ssb_chipcommon_pmu pmu;
+        u32 ticks_per_ms;
+        u32 max_timer_ms;
 };
 static inline bool ssb_chipco_available(struct ssb_chipcommon *cc)
@@ -630,8 +632,7 @@ enum ssb_clkmode {
 extern void ssb_chipco_set_clockmode(struct ssb_chipcommon *cc,
                                     enum ssb_clkmode mode);
-extern void ssb_chipco_watchdog_timer_set(struct ssb_chipcommon *cc,
+extern u32 ssb_chipco_watchdog_timer_set(struct ssb_chipcommon *cc, u32 ticks);
-                                          u32 ticks);
 void ssb_chipco_irq_mask(struct ssb_chipcommon *cc, u32 mask, u32 value);
diff --git a/include/linux/ssb/ssb_driver_extif.h b/include/linux/ssb/ssb_driver_extif.h
index 91161f0aa22b..99511d0e931d 100644
--- a/include/linux/ssb/ssb_driver_extif.h
+++ b/include/linux/ssb/ssb_driver_extif.h
@@ -152,6 +152,9 @@
 /* watchdog */
 #define SSB_EXTIF_WATCHDOG_CLK          48000000        /* Hz */
+#define SSB_EXTIF_WATCHDOG_MAX_TIMER    ((1 << 28) - 1)
+#define SSB_EXTIF_WATCHDOG_MAX_TIMER_MS (SSB_EXTIF_WATCHDOG_MAX_TIMER \
+                                         / (SSB_EXTIF_WATCHDOG_CLK / 1000))
 #ifdef CONFIG_SSB_DRIVER_EXTIF
@@ -171,8 +174,7 @@ extern void ssb_extif_get_clockcontrol(struct ssb_extif *extif,
 extern void ssb_extif_timing_init(struct ssb_extif *extif,
                                  unsigned long ns);
-extern void ssb_extif_watchdog_timer_set(struct ssb_extif *extif,
+extern u32 ssb_extif_watchdog_timer_set(struct ssb_extif *extif, u32 ticks);
-                                         u32 ticks);
 /* Extif GPIO pin access */
 u32 ssb_extif_gpio_in(struct ssb_extif *extif, u32 mask);
@@ -205,10 +207,52 @@ void ssb_extif_get_clockcontrol(struct ssb_extif *extif,
 }
 static inline
-void ssb_extif_watchdog_timer_set(struct ssb_extif *extif,
+void ssb_extif_timing_init(struct ssb_extif *extif, unsigned long ns)
-                                  u32 ticks)
 {
 }
+static inline
+u32 ssb_extif_watchdog_timer_set(struct ssb_extif *extif, u32 ticks)
+{
+        return 0;
+}
+static inline u32 ssb_extif_gpio_in(struct ssb_extif *extif, u32 mask)
+{
+        return 0;
+}
+static inline u32 ssb_extif_gpio_out(struct ssb_extif *extif, u32 mask,
+                                     u32 value)
+{
+        return 0;
+}
+static inline u32 ssb_extif_gpio_outen(struct ssb_extif *extif, u32 mask,
+                                       u32 value)
+{
+        return 0;
+}
+static inline u32 ssb_extif_gpio_polarity(struct ssb_extif *extif, u32 mask,
+                                          u32 value)
+{
+        return 0;
+}
+static inline u32 ssb_extif_gpio_intmask(struct ssb_extif *extif, u32 mask,
+                                         u32 value)
+{
+        return 0;
+}
+#ifdef CONFIG_SSB_SERIAL
+static inline int ssb_extif_serial_init(struct ssb_extif *extif,
+                                        struct ssb_serial_port *ports)
+{
+        return 0;
+}
+#endif /* CONFIG_SSB_SERIAL */
 #endif /* CONFIG_SSB_DRIVER_EXTIF */
 #endif /* LINUX_SSB_EXTIFCORE_H_ */
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index ef5b85dac3f7..014a2eaa5389 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -376,7 +376,7 @@ extern int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt);
 extern int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb,
                              u16 flags);
-extern int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr);
+extern int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags);
 extern void sco_connect_cfm(struct hci_conn *hcon, __u8 status);
 extern void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason);
 extern int sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb);
@@ -577,6 +577,7 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst);
 int hci_conn_del(struct hci_conn *conn);
 void hci_conn_hash_flush(struct hci_dev *hdev);
 void hci_conn_check_pending(struct hci_dev *hdev);
+void hci_conn_accept(struct hci_conn *conn, int mask);
 struct hci_chan *hci_chan_create(struct hci_conn *conn);
 void hci_chan_del(struct hci_chan *chan);
@@ -766,7 +767,7 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
 #define lmp_sniffsubr_capable(dev) ((dev)->features[5] & LMP_SNIFF_SUBR)
 #define lmp_pause_enc_capable(dev) ((dev)->features[5] & LMP_PAUSE_ENC)
 #define lmp_ext_inq_capable(dev)   ((dev)->features[6] & LMP_EXT_INQ)
-#define lmp_le_br_capable(dev)     ((dev)->features[6] & LMP_SIMUL_LE_BR)
+#define lmp_le_br_capable(dev)     !!((dev)->features[6] & LMP_SIMUL_LE_BR)
 #define lmp_ssp_capable(dev)       ((dev)->features[6] & LMP_SIMPLE_PAIR)
 #define lmp_no_flush_capable(dev)  ((dev)->features[6] & LMP_NO_FLUSH)
 #define lmp_lsto_capable(dev)      ((dev)->features[7] & LMP_LSTO)
@@ -775,12 +776,30 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
 /* ----- Extended LMP capabilities ----- */
 #define lmp_host_ssp_capable(dev)  ((dev)->host_features[0] & LMP_HOST_SSP)
-#define lmp_host_le_capable(dev)   ((dev)->host_features[0] & LMP_HOST_LE)
+#define lmp_host_le_capable(dev)   !!((dev)->host_features[0] & LMP_HOST_LE)
-#define lmp_host_le_br_capable(dev) ((dev)->host_features[0] & LMP_HOST_LE_BREDR)
+#define lmp_host_le_br_capable(dev) !!((dev)->host_features[0] & LMP_HOST_LE_BREDR)
+/* returns true if at least one AMP active */
+static inline bool hci_amp_capable(void)
+{
+        struct hci_dev *hdev;
+        bool ret = false;
+        read_lock(&hci_dev_list_lock);
+        list_for_each_entry(hdev, &hci_dev_list, list)
+                if (hdev->amp_type == HCI_AMP &&
+                    test_bit(HCI_UP, &hdev->flags))
+                        ret = true;
+        read_unlock(&hci_dev_list_lock);
+        return ret;
+}
 /* ----- HCI protocols ----- */
+#define HCI_PROTO_DEFER             0x01
 static inline int hci_proto_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                                                __u8 type)
+                                        __u8 type, __u8 *flags)
 {
        switch (type) {
        case ACL_LINK:
@@ -788,7 +807,7 @@ static inline int hci_proto_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr,
        case SCO_LINK:
        case ESCO_LINK:
-                return sco_connect_ind(hdev, bdaddr);
+                return sco_connect_ind(hdev, bdaddr, flags);
        default:
                BT_ERR("unknown link type %d", type);
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index f57fab04e7c5..7588ef44ebaf 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -611,7 +611,7 @@ enum {
        CONF_MTU_DONE,
        CONF_MODE_DONE,
        CONF_CONNECT_PEND,
-        CONF_NO_FCS_RECV,
+        CONF_RECV_NO_FCS,
        CONF_STATE2_DEVICE,
        CONF_EWS_RECV,
        CONF_LOC_CONF_PEND,
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index e78db2cf3d1b..8e6a6b73b9c9 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -58,6 +58,8 @@
 * structures here describe these capabilities in detail.
 */
+struct wiphy;
 /*
 * wireless hardware capability structures
 */
@@ -388,6 +390,22 @@ cfg80211_chandef_compatible(const struct cfg80211_chan_def *chandef1,
                            const struct cfg80211_chan_def *chandef2);
 /**
+ * cfg80211_chandef_valid - check if a channel definition is valid
+ * @chandef: the channel definition to check
+ */
+bool cfg80211_chandef_valid(const struct cfg80211_chan_def *chandef);
+/**
+ * cfg80211_chandef_usable - check if secondary channels can be used
+ * @wiphy: the wiphy to validate against
+ * @chandef: the channel definition to check
+ * @prohibited_flags: the regulatory chanenl flags that must not be set
+ */
+bool cfg80211_chandef_usable(struct wiphy *wiphy,
+                             const struct cfg80211_chan_def *chandef,
+                             u32 prohibited_flags);
+/**
 * enum survey_info_flags - survey information flags
 *
 * @SURVEY_INFO_NOISE_DBM: noise (in dBm) was filled in
@@ -520,6 +538,8 @@ struct cfg80211_beacon_data {
 * @privacy: the BSS uses privacy
 * @auth_type: Authentication type (algorithm)
 * @inactivity_timeout: time in seconds to determine station's inactivity.
+ * @p2p_ctwindow: P2P CT Window
+ * @p2p_opp_ps: P2P opportunistic PS
 */
 struct cfg80211_ap_settings {
        struct cfg80211_chan_def chandef;
@@ -534,6 +554,8 @@ struct cfg80211_ap_settings {
        bool privacy;
        enum nl80211_auth_type auth_type;
        int inactivity_timeout;
+        u8 p2p_ctwindow;
+        bool p2p_opp_ps;
 };
 /**
@@ -895,6 +917,8 @@ struct mpath_info {
 * @ap_isolate: do not forward packets between connected stations
 * @ht_opmode: HT Operation mode
 *      (u16 = opmode, -1 = do not change)
+ * @p2p_ctwindow: P2P CT Window (-1 = no change)
+ * @p2p_opp_ps: P2P opportunistic PS (-1 = no change)
 */
 struct bss_parameters {
        int use_cts_prot;
@@ -904,6 +928,7 @@ struct bss_parameters {
        u8 basic_rates_len;
        int ap_isolate;
        int ht_opmode;
+        s8 p2p_ctwindow, p2p_opp_ps;
 };
 /**
@@ -1045,9 +1070,6 @@ struct ieee80211_txq_params {
        u8 aifs;
 };
-/* from net/wireless.h */
-struct wiphy;
 /**
 * DOC: Scanning and BSS list handling
 *
@@ -1184,6 +1206,18 @@ enum cfg80211_signal_type {
 };
 /**
+ * struct cfg80211_bss_ie_data - BSS entry IE data
+ * @rcu_head: internal use, for freeing
+ * @len: length of the IEs
+ * @data: IE data
+ */
+struct cfg80211_bss_ies {
+        struct rcu_head rcu_head;
+        int len;
+        u8 data[];
+};
+/**
 * struct cfg80211_bss - BSS description
 *
 * This structure describes a BSS (which may also be a mesh network)
@@ -1194,36 +1228,34 @@ enum cfg80211_signal_type {
 * @tsf: timestamp of last received update
 * @beacon_interval: the beacon interval as from the frame
 * @capability: the capability field in host byte order
- * @information_elements: the information elements (Note that there
+ * @ies: the information elements (Note that there
 *      is no guarantee that these are well-formed!); this is a pointer to
 *      either the beacon_ies or proberesp_ies depending on whether Probe
 *      Response frame has been received
- * @len_information_elements: total length of the information elements
 * @beacon_ies: the information elements from the last Beacon frame
- * @len_beacon_ies: total length of the beacon_ies
 * @proberesp_ies: the information elements from the last Probe Response frame
- * @len_proberesp_ies: total length of the proberesp_ies
 * @signal: signal strength value (type depends on the wiphy's signal_type)
 * @free_priv: function pointer to free private data
 * @priv: private area for driver use, has at least wiphy->bss_priv_size bytes
 */
 struct cfg80211_bss {
+        u64 tsf;
        struct ieee80211_channel *channel;
-        u8 bssid[ETH_ALEN];
+        const struct cfg80211_bss_ies __rcu *ies;
-        u64 tsf;
+        const struct cfg80211_bss_ies __rcu *beacon_ies;
+        const struct cfg80211_bss_ies __rcu *proberesp_ies;
+        void (*free_priv)(struct cfg80211_bss *bss);
+        s32 signal;
        u16 beacon_interval;
        u16 capability;
-        u8 *information_elements;
-        size_t len_information_elements;
-        u8 *beacon_ies;
-        size_t len_beacon_ies;
-        u8 *proberesp_ies;
-        size_t len_proberesp_ies;
-        s32 signal;
+        u8 bssid[ETH_ALEN];
-        void (*free_priv)(struct cfg80211_bss *bss);
        u8 priv[0] __attribute__((__aligned__(sizeof(void *))));
 };
@@ -1231,6 +1263,9 @@ struct cfg80211_bss {
 * ieee80211_bss_get_ie - find IE with given ID
 * @bss: the bss to search
 * @ie: the IE ID
+ *
+ * Note that the return value is an RCU-protected pointer, so
+ * rcu_read_lock() must be held when calling this function.
 * Returns %NULL if not found.
 */
 const u8 *ieee80211_bss_get_ie(struct cfg80211_bss *bss, u8 ie);
diff --git a/include/net/ieee80211_radiotap.h b/include/net/ieee80211_radiotap.h
index 7f0df133d119..c3999632e616 100644
--- a/include/net/ieee80211_radiotap.h
+++ b/include/net/ieee80211_radiotap.h
@@ -186,6 +186,10 @@ struct ieee80211_radiotap_header {
 * IEEE80211_RADIOTAP_AMPDU_STATUS      u32, u16, u8, u8        unitless
 *
 *      Contains the AMPDU information for the subframe.
+ *
+ * IEEE80211_RADIOTAP_VHT       u16, u8, u8, u8[4], u8, u8, u16
+ *
+ *      Contains VHT information about this frame.
 */
 enum ieee80211_radiotap_type {
        IEEE80211_RADIOTAP_TSFT = 0,
@@ -209,6 +213,7 @@ enum ieee80211_radiotap_type {
        IEEE80211_RADIOTAP_MCS = 19,
        IEEE80211_RADIOTAP_AMPDU_STATUS = 20,
+        IEEE80211_RADIOTAP_VHT = 21,
        /* valid in every it_present bitmap, even vendor namespaces */
        IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE = 29,
@@ -282,6 +287,25 @@ enum ieee80211_radiotap_type {
 #define IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR          0x0010
 #define IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN        0x0020
+/* For IEEE80211_RADIOTAP_VHT */
+#define IEEE80211_RADIOTAP_VHT_KNOWN_STBC                       0x0001
+#define IEEE80211_RADIOTAP_VHT_KNOWN_TXOP_PS_NA                 0x0002
+#define IEEE80211_RADIOTAP_VHT_KNOWN_GI                         0x0004
+#define IEEE80211_RADIOTAP_VHT_KNOWN_SGI_NSYM_DIS               0x0008
+#define IEEE80211_RADIOTAP_VHT_KNOWN_LDPC_EXTRA_OFDM_SYM        0x0010
+#define IEEE80211_RADIOTAP_VHT_KNOWN_BEAMFORMED                 0x0020
+#define IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH                  0x0040
+#define IEEE80211_RADIOTAP_VHT_KNOWN_GROUP_ID                   0x0080
+#define IEEE80211_RADIOTAP_VHT_KNOWN_PARTIAL_AID                0x0100
+#define IEEE80211_RADIOTAP_VHT_FLAG_STBC                        0x01
+#define IEEE80211_RADIOTAP_VHT_FLAG_TXOP_PS_NA                  0x02
+#define IEEE80211_RADIOTAP_VHT_FLAG_SGI                         0x04
+#define IEEE80211_RADIOTAP_VHT_FLAG_SGI_NSYM_M10_9              0x08
+#define IEEE80211_RADIOTAP_VHT_FLAG_LDPC_EXTRA_OFDM_SYM         0x10
+#define IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED                  0x20
 /* helpers */
 static inline int ieee80211_get_radiotap_len(unsigned char *data)
 {
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index db7680acd0da..1c02fb3b3817 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -164,7 +164,7 @@ enum ieee80211_chanctx_change {
 *      active on the channel to receive MIMO transmissions
 * @rx_chains_dynamic: The number of RX chains that must be enabled
 *      after RTS/CTS handshake to receive SMPS MIMO transmissions;
- *      this will always be >= @rx_chains_always.
+ *      this will always be >= @rx_chains_static.
 * @drv_priv: data area for driver use, will always be aligned to
 *      sizeof(void *), size is determined in hw information.
 */
@@ -1473,6 +1473,10 @@ enum ieee80211_hw_flags {
 *      include _FMT. Use %IEEE80211_RADIOTAP_MCS_HAVE_* values, only
 *      adding _BW is supported today.
 *
+ * @radiotap_vht_details: lists which VHT MCS information the HW reports,
+ *      the default is _GI | _BANDWIDTH.
+ *      Use the %IEEE80211_RADIOTAP_VHT_KNOWN_* values.
+ *
 * @netdev_features: netdev features to be set in each netdev created
 *      from this HW. Note only HW checksum features are currently
 *      compatible with mac80211. Other feature bits will be rejected.
@@ -1499,6 +1503,7 @@ struct ieee80211_hw {
        u8 max_tx_aggregation_subframes;
        u8 offchannel_tx_hw_queue;
        u8 radiotap_mcs_details;
+        u16 radiotap_vht_details;
        netdev_features_t netdev_features;
 };
@@ -3139,8 +3144,7 @@ struct sk_buff *ieee80211_nullfunc_get(struct ieee80211_hw *hw,
 * @vif: &struct ieee80211_vif pointer from the add_interface callback.
 * @ssid: SSID buffer
 * @ssid_len: length of SSID
- * @ie: buffer containing all IEs except SSID for the template
+ * @tailroom: tailroom to reserve at end of SKB for IEs
- * @ie_len: length of the IE buffer
 *
 * Creates a Probe Request template which can, for example, be uploaded to
 * hardware.
@@ -3148,7 +3152,7 @@ struct sk_buff *ieee80211_nullfunc_get(struct ieee80211_hw *hw,
 struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
                                       struct ieee80211_vif *vif,
                                       const u8 *ssid, size_t ssid_len,
-                                       const u8 *ie, size_t ie_len);
+                                       size_t tailroom);
 /**
 * ieee80211_rts_get - RTS frame generation function
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 33a417481ad8..e3e19f8b16f2 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -1303,6 +1303,13 @@ enum nl80211_commands {
 *
 * @NL80211_ATTR_SCAN_FLAGS: scan request control flags (u32)
 *
+ * @NL80211_ATTR_P2P_CTWINDOW: P2P GO Client Traffic Window (u8), used with
+ *      the START_AP and SET_BSS commands
+ * @NL80211_ATTR_P2P_OPPPS: P2P GO opportunistic PS (u8), used with the
+ *      START_AP and SET_BSS commands. This can have the values 0 or 1;
+ *      if not given in START_AP 0 is assumed, if not given in SET_BSS
+ *      no change is made.
+ *
 * @NL80211_ATTR_MAX: highest attribute number currently defined
 * @__NL80211_ATTR_AFTER_LAST: internal use
 */
@@ -1570,6 +1577,9 @@ enum nl80211_attrs {
        NL80211_ATTR_CENTER_FREQ1,
        NL80211_ATTR_CENTER_FREQ2,
+        NL80211_ATTR_P2P_CTWINDOW,
+        NL80211_ATTR_P2P_OPPPS,
        /* add attributes here, update the policy in nl80211.c */
        __NL80211_ATTR_AFTER_LAST,
@@ -3126,6 +3136,10 @@ enum nl80211_ap_sme_features {
 * @NL80211_FEATURE_NEED_OBSS_SCAN: The driver expects userspace to perform
 *      OBSS scans and generate 20/40 BSS coex reports. This flag is used only
 *      for drivers implementing the CONNECT API, for AUTH/ASSOC it is implied.
+ * @NL80211_FEATURE_P2P_GO_CTWIN: P2P GO implementation supports CT Window
+ *      setting
+ * @NL80211_FEATURE_P2P_GO_OPPPS: P2P GO implementation supports opportunistic
+ *      powersave
 */
 enum nl80211_feature_flags {
        NL80211_FEATURE_SK_TX_STATUS                    = 1 << 0,
@@ -3139,6 +3153,8 @@ enum nl80211_feature_flags {
        NL80211_FEATURE_AP_SCAN                         = 1 << 8,
        NL80211_FEATURE_VIF_TXPOWER                     = 1 << 9,
        NL80211_FEATURE_NEED_OBSS_SCAN                  = 1 << 10,
+        NL80211_FEATURE_P2P_GO_CTWIN                    = 1 << 11,
+        NL80211_FEATURE_P2P_GO_OPPPS                    = 1 << 12,
 };
 /**
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 7140f83328a2..596660d37c5e 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -861,6 +861,9 @@ static int hci_dev_do_close(struct hci_dev *hdev)
        /* Clear flags */
        hdev->flags = 0;
+        /* Controller radio is available but is currently powered down */
+        hdev->amp_status = 0;
        memset(hdev->eir, 0, sizeof(hdev->eir));
        memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
@@ -1854,6 +1857,8 @@ void hci_unregister_dev(struct hci_dev *hdev)
        for (i = 0; i < NUM_REASSEMBLY; i++)
                kfree_skb(hdev->reassembly[i]);
+        cancel_work_sync(&hdev->power_on);
        if (!test_bit(HCI_INIT, &hdev->flags) &&
            !test_bit(HCI_SETUP, &hdev->dev_flags)) {
                hci_dev_lock(hdev);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 9f5c5f244502..705078a0cc39 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -794,10 +794,10 @@ static void hci_set_le_support(struct hci_dev *hdev)
        if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
                cp.le = 1;
-                cp.simul = !!lmp_le_br_capable(hdev);
+                cp.simul = lmp_le_br_capable(hdev);
        }
-        if (cp.le != !!lmp_host_le_capable(hdev))
+        if (cp.le != lmp_host_le_capable(hdev))
                hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
                             &cp);
 }
@@ -2047,15 +2047,53 @@ unlock:
        hci_conn_check_pending(hdev);
 }
+void hci_conn_accept(struct hci_conn *conn, int mask)
+{
+        struct hci_dev *hdev = conn->hdev;
+        BT_DBG("conn %p", conn);
+        conn->state = BT_CONFIG;
+        if (!lmp_esco_capable(hdev)) {
+                struct hci_cp_accept_conn_req cp;
+                bacpy(&cp.bdaddr, &conn->dst);
+                if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
+                        cp.role = 0x00; /* Become master */
+                else
+                        cp.role = 0x01; /* Remain slave */
+                hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
+        } else /* lmp_esco_capable(hdev)) */ {
+                struct hci_cp_accept_sync_conn_req cp;
+                bacpy(&cp.bdaddr, &conn->dst);
+                cp.pkt_type = cpu_to_le16(conn->pkt_type);
+                cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
+                cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
+                cp.max_latency    = __constant_cpu_to_le16(0xffff);
+                cp.content_format = cpu_to_le16(hdev->voice_setting);
+                cp.retrans_effort = 0xff;
+                hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
+                             sizeof(cp), &cp);
+        }
+}
 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
        struct hci_ev_conn_request *ev = (void *) skb->data;
        int mask = hdev->link_mode;
+        __u8 flags = 0;
        BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
               ev->link_type);
-        mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
+        mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
+                                      &flags);
        if ((mask & HCI_LM_ACCEPT) &&
            !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
@@ -2081,12 +2119,13 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
                }
                memcpy(conn->dev_class, ev->dev_class, 3);
-                conn->state = BT_CONNECT;
                hci_dev_unlock(hdev);
-                if (ev->link_type == ACL_LINK || !lmp_esco_capable(hdev)) {
+                if (ev->link_type == ACL_LINK ||
+                    (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
                        struct hci_cp_accept_conn_req cp;
+                        conn->state = BT_CONNECT;
                        bacpy(&cp.bdaddr, &ev->bdaddr);
@@ -2097,8 +2136,9 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
                        hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp),
                                     &cp);
-                } else {
+                } else if (!(flags & HCI_PROTO_DEFER)) {
                        struct hci_cp_accept_sync_conn_req cp;
+                        conn->state = BT_CONNECT;
                        bacpy(&cp.bdaddr, &ev->bdaddr);
                        cp.pkt_type = cpu_to_le16(conn->pkt_type);
@@ -2111,6 +2151,10 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
                        hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
                                     sizeof(cp), &cp);
+                } else {
+                        conn->state = BT_CONNECT2;
+                        hci_proto_connect_cfm(conn, 0);
+                        hci_conn_put(conn);
                }
        } else {
                /* Connection rejected */
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index b52f66d22437..2c78208d793e 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -53,8 +53,7 @@ static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
                           void *data);
 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
-static void l2cap_send_disconn_req(struct l2cap_conn *conn,
+static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
-                                   struct l2cap_chan *chan, int err);
 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
                     struct sk_buff_head *skbs, u8 event);
@@ -632,7 +631,7 @@ void l2cap_chan_close(struct l2cap_chan *chan, int reason)
                if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
                    conn->hcon->type == ACL_LINK) {
                        __set_chan_timer(chan, sk->sk_sndtimeo);
-                        l2cap_send_disconn_req(conn, chan, reason);
+                        l2cap_send_disconn_req(chan, reason);
                } else
                        l2cap_chan_del(chan, reason);
                break;
@@ -1014,6 +1013,7 @@ static bool __amp_capable(struct l2cap_chan *chan)
        struct l2cap_conn *conn = chan->conn;
        if (enable_hs &&
+            hci_amp_capable() &&
            chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED &&
            conn->fixed_chan_mask & L2CAP_FC_A2MP)
                return true;
@@ -1180,10 +1180,10 @@ static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
        }
 }
-static void l2cap_send_disconn_req(struct l2cap_conn *conn,
+static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err)
-                                   struct l2cap_chan *chan, int err)
 {
        struct sock *sk = chan->sk;
+        struct l2cap_conn *conn = chan->conn;
        struct l2cap_disconn_req req;
        if (!conn)
@@ -1960,7 +1960,7 @@ static void l2cap_ertm_resend(struct l2cap_chan *chan)
                if (chan->max_tx != 0 &&
                    bt_cb(skb)->control.retries > chan->max_tx) {
                        BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
-                        l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
+                        l2cap_send_disconn_req(chan, ECONNRESET);
                        l2cap_seq_list_clear(&chan->retrans_list);
                        break;
                }
@@ -2666,7 +2666,7 @@ static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,
                        __set_monitor_timer(chan);
                        chan->retry_count++;
                } else {
-                        l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
+                        l2cap_send_disconn_req(chan, ECONNABORTED);
                }
                break;
        default:
@@ -3106,18 +3106,17 @@ done:
                if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
                        l2cap_add_opt_efs(&ptr, chan);
-                if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
-                        break;
-                if (chan->fcs == L2CAP_FCS_NONE ||
-                    test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
-                        chan->fcs = L2CAP_FCS_NONE;
-                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
-                }
                if (test_bit(FLAG_EXT_CTRL, &chan->flags))
                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
                                           chan->tx_win);
+                if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
+                        if (chan->fcs == L2CAP_FCS_NONE ||
+                            test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
+                                chan->fcs = L2CAP_FCS_NONE;
+                                l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
+                                                   chan->fcs);
+                        }
                break;
        case L2CAP_MODE_STREAMING:
@@ -3139,14 +3138,13 @@ done:
                if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
                        l2cap_add_opt_efs(&ptr, chan);
-                if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
+                if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
-                        break;
+                        if (chan->fcs == L2CAP_FCS_NONE ||
+                            test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
-                if (chan->fcs == L2CAP_FCS_NONE ||
+                                chan->fcs = L2CAP_FCS_NONE;
-                    test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
+                                l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
-                        chan->fcs = L2CAP_FCS_NONE;
+                                                   chan->fcs);
-                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
+                        }
-                }
                break;
        }
@@ -3198,7 +3196,7 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
                case L2CAP_CONF_FCS:
                        if (val == L2CAP_FCS_NONE)
-                                set_bit(CONF_NO_FCS_RECV, &chan->conf_state);
+                                set_bit(CONF_RECV_NO_FCS, &chan->conf_state);
                        break;
                case L2CAP_CONF_EFS:
@@ -3433,6 +3431,13 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
                                           (unsigned long) &efs);
                        break;
+                case L2CAP_CONF_FCS:
+                        if (*result == L2CAP_CONF_PENDING)
+                                if (val == L2CAP_FCS_NONE)
+                                        set_bit(CONF_RECV_NO_FCS,
+                                                &chan->conf_state);
+                        break;
                }
        }
@@ -3802,7 +3807,7 @@ static inline void set_default_fcs(struct l2cap_chan *chan)
         */
        if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
                chan->fcs = L2CAP_FCS_NONE;
-        else if (!test_bit(CONF_NO_FCS_RECV, &chan->conf_state))
+        else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state))
                chan->fcs = L2CAP_FCS_CRC16;
 }
@@ -3877,7 +3882,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn,
        /* Complete config. */
        len = l2cap_parse_conf_req(chan, rsp);
        if (len < 0) {
-                l2cap_send_disconn_req(conn, chan, ECONNRESET);
+                l2cap_send_disconn_req(chan, ECONNRESET);
                goto unlock;
        }
@@ -3899,7 +3904,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn,
                        err = l2cap_ertm_init(chan);
                if (err < 0)
-                        l2cap_send_disconn_req(chan->conn, chan, -err);
+                        l2cap_send_disconn_req(chan, -err);
                else
                        l2cap_chan_ready(chan);
@@ -3967,7 +3972,7 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn,
                        len = l2cap_parse_conf_rsp(chan, rsp->data, len,
                                                   buf, &result);
                        if (len < 0) {
-                                l2cap_send_disconn_req(conn, chan, ECONNRESET);
+                                l2cap_send_disconn_req(chan, ECONNRESET);
                                goto done;
                        }
@@ -3988,7 +3993,7 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn,
                        char req[64];
                        if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
-                                l2cap_send_disconn_req(conn, chan, ECONNRESET);
+                                l2cap_send_disconn_req(chan, ECONNRESET);
                                goto done;
                        }
@@ -3997,7 +4002,7 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn,
                        len = l2cap_parse_conf_rsp(chan, rsp->data, len,
                                                   req, &result);
                        if (len < 0) {
-                                l2cap_send_disconn_req(conn, chan, ECONNRESET);
+                                l2cap_send_disconn_req(chan, ECONNRESET);
                                goto done;
                        }
@@ -4013,7 +4018,7 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn,
                l2cap_chan_set_err(chan, ECONNRESET);
                __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
-                l2cap_send_disconn_req(conn, chan, ECONNRESET);
+                l2cap_send_disconn_req(chan, ECONNRESET);
                goto done;
        }
@@ -4030,7 +4035,7 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn,
                        err = l2cap_ertm_init(chan);
                if (err < 0)
-                        l2cap_send_disconn_req(chan->conn, chan, -err);
+                        l2cap_send_disconn_req(chan, -err);
                else
                        l2cap_chan_ready(chan);
        }
@@ -4392,7 +4397,7 @@ static void l2cap_logical_fail(struct l2cap_chan *chan)
        /* Logical link setup failed */
        if (chan->state != BT_CONNECTED) {
                /* Create channel failure, disconnect */
-                l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
+                l2cap_send_disconn_req(chan, ECONNRESET);
                return;
        }
@@ -4435,7 +4440,7 @@ static void l2cap_logical_finish_create(struct l2cap_chan *chan,
                err = l2cap_ertm_init(chan);
                if (err < 0)
-                        l2cap_send_disconn_req(chan->conn, chan, -err);
+                        l2cap_send_disconn_req(chan, -err);
                else
                        l2cap_chan_ready(chan);
        }
@@ -5400,7 +5405,7 @@ static void l2cap_handle_srej(struct l2cap_chan *chan,
        if (control->reqseq == chan->next_tx_seq) {
                BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
-                l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
+                l2cap_send_disconn_req(chan, ECONNRESET);
                return;
        }
@@ -5414,7 +5419,7 @@ static void l2cap_handle_srej(struct l2cap_chan *chan,
        if (chan->max_tx != 0 && bt_cb(skb)->control.retries >= chan->max_tx) {
                BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
-                l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
+                l2cap_send_disconn_req(chan, ECONNRESET);
                return;
        }
@@ -5458,7 +5463,7 @@ static void l2cap_handle_rej(struct l2cap_chan *chan,
        if (control->reqseq == chan->next_tx_seq) {
                BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
-                l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
+                l2cap_send_disconn_req(chan, ECONNRESET);
                return;
        }
@@ -5467,7 +5472,7 @@ static void l2cap_handle_rej(struct l2cap_chan *chan,
        if (chan->max_tx && skb &&
            bt_cb(skb)->control.retries >= chan->max_tx) {
                BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
-                l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
+                l2cap_send_disconn_req(chan, ECONNRESET);
                return;
        }
@@ -5651,8 +5656,7 @@ static int l2cap_rx_state_recv(struct l2cap_chan *chan,
                        break;
                case L2CAP_TXSEQ_INVALID:
                default:
-                        l2cap_send_disconn_req(chan->conn, chan,
+                        l2cap_send_disconn_req(chan, ECONNRESET);
-                                               ECONNRESET);
                        break;
                }
                break;
@@ -5785,8 +5789,7 @@ static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
                        break;
                case L2CAP_TXSEQ_INVALID:
                default:
-                        l2cap_send_disconn_req(chan->conn, chan,
+                        l2cap_send_disconn_req(chan, ECONNRESET);
-                                               ECONNRESET);
                        break;
                }
                break;
@@ -5981,7 +5984,7 @@ static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
                BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d",
                       control->reqseq, chan->next_tx_seq,
                       chan->expected_ack_seq);
-                l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
+                l2cap_send_disconn_req(chan, ECONNRESET);
        }
        return err;
@@ -6050,7 +6053,7 @@ static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
                len -= L2CAP_FCS_SIZE;
        if (len > chan->mps) {
-                l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
+                l2cap_send_disconn_req(chan, ECONNRESET);
                goto drop;
        }
@@ -6075,8 +6078,7 @@ static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
                }
                if (err)
-                        l2cap_send_disconn_req(chan->conn, chan,
+                        l2cap_send_disconn_req(chan, ECONNRESET);
-                                               ECONNRESET);
        } else {
                const u8 rx_func_to_event[4] = {
                        L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ,
@@ -6093,7 +6095,7 @@ static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
                if (len != 0) {
                        BT_ERR("Trailing bytes: %d in sframe", len);
-                        l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
+                        l2cap_send_disconn_req(chan, ECONNRESET);
                        goto drop;
                }
@@ -6104,7 +6106,7 @@ static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
                event = rx_func_to_event[control->super];
                if (l2cap_rx(chan, control, skb, event))
-                        l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
+                        l2cap_send_disconn_req(chan, ECONNRESET);
        }
        return 0;
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 142764aec2af..f559b966279c 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1226,7 +1226,7 @@ static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
        }
        val = !!cp->val;
-        enabled = !!lmp_host_le_capable(hdev);
+        enabled = lmp_host_le_capable(hdev);
        if (!hdev_is_powered(hdev) || val == enabled) {
                bool changed = false;
@@ -1262,7 +1262,7 @@ static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
        if (val) {
                hci_cp.le = val;
-                hci_cp.simul = !!lmp_le_br_capable(hdev);
+                hci_cp.simul = lmp_le_br_capable(hdev);
        }
        err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
@@ -2926,13 +2926,13 @@ int mgmt_powered(struct hci_dev *hdev, u8 powered)
                        struct hci_cp_write_le_host_supported cp;
                        cp.le = 1;
-                        cp.simul = !!lmp_le_br_capable(hdev);
+                        cp.simul = lmp_le_br_capable(hdev);
                        /* Check first if we already have the right
                         * host state (host features set)
                         */
-                        if (cp.le != !!lmp_host_le_capable(hdev) ||
+                        if (cp.le != lmp_host_le_capable(hdev) ||
-                            cp.simul != !!lmp_host_le_br_capable(hdev))
+                            cp.simul != lmp_host_le_br_capable(hdev))
                                hci_send_cmd(hdev,
                                             HCI_OP_WRITE_LE_HOST_SUPPORTED,
                                             sizeof(cp), &cp);
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 4ddef57d03a7..ce3f6658f4b2 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -467,7 +467,7 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int f
        long timeo;
        int err = 0;
-        lock_sock(sk);
+        lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
        if (sk->sk_type != SOCK_STREAM) {
                err = -EINVAL;
@@ -504,7 +504,7 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int f
                release_sock(sk);
                timeo = schedule_timeout(timeo);
-                lock_sock(sk);
+                lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
        }
        __set_current_state(TASK_RUNNING);
        remove_wait_queue(sk_sleep(sk), &wait);
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 450cdcd88e5c..531a93d613d4 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -131,15 +131,6 @@ static int sco_conn_del(struct hci_conn *hcon, int err)
                sco_sock_clear_timer(sk);
                sco_chan_del(sk, err);
                bh_unlock_sock(sk);
-                sco_conn_lock(conn);
-                conn->sk = NULL;
-                sco_pi(sk)->conn = NULL;
-                sco_conn_unlock(conn);
-                if (conn->hcon)
-                        hci_conn_put(conn->hcon);
                sco_sock_kill(sk);
        }
@@ -397,6 +388,7 @@ static void sco_sock_init(struct sock *sk, struct sock *parent)
        if (parent) {
                sk->sk_type = parent->sk_type;
+                bt_sk(sk)->flags = bt_sk(parent)->flags;
                security_sk_clone(parent, sk);
        }
 }
@@ -662,16 +654,57 @@ static int sco_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
        return err;
 }
+static int sco_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
+                            struct msghdr *msg, size_t len, int flags)
+{
+        struct sock *sk = sock->sk;
+        struct sco_pinfo *pi = sco_pi(sk);
+        lock_sock(sk);
+        if (sk->sk_state == BT_CONNECT2 &&
+            test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
+                hci_conn_accept(pi->conn->hcon, 0);
+                sk->sk_state = BT_CONFIG;
+                release_sock(sk);
+                return 0;
+        }
+        release_sock(sk);
+        return bt_sock_recvmsg(iocb, sock, msg, len, flags);
+}
 static int sco_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
 {
        struct sock *sk = sock->sk;
        int err = 0;
+        u32 opt;
        BT_DBG("sk %p", sk);
        lock_sock(sk);
        switch (optname) {
+        case BT_DEFER_SETUP:
+                if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
+                        err = -EINVAL;
+                        break;
+                }
+                if (get_user(opt, (u32 __user *) optval)) {
+                        err = -EFAULT;
+                        break;
+                }
+                if (opt)
+                        set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
+                else
+                        clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
+                break;
        default:
                err = -ENOPROTOOPT;
                break;
@@ -753,6 +786,19 @@ static int sco_sock_getsockopt(struct socket *sock, int level, int optname, char
        lock_sock(sk);
        switch (optname) {
+        case BT_DEFER_SETUP:
+                if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
+                        err = -EINVAL;
+                        break;
+                }
+                if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
+                             (u32 __user *) optval))
+                        err = -EFAULT;
+                break;
        default:
                err = -ENOPROTOOPT;
                break;
@@ -830,6 +876,16 @@ static void sco_chan_del(struct sock *sk, int err)
        BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
+        if (conn) {
+                sco_conn_lock(conn);
+                conn->sk = NULL;
+                sco_pi(sk)->conn = NULL;
+                sco_conn_unlock(conn);
+                if (conn->hcon)
+                        hci_conn_put(conn->hcon);
+        }
        sk->sk_state = BT_CLOSED;
        sk->sk_err   = err;
        sk->sk_state_change(sk);
@@ -874,7 +930,10 @@ static void sco_conn_ready(struct sco_conn *conn)
                hci_conn_hold(conn->hcon);
                __sco_chan_add(conn, sk, parent);
-                sk->sk_state = BT_CONNECTED;
+                if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
+                        sk->sk_state = BT_CONNECT2;
+                else
+                        sk->sk_state = BT_CONNECTED;
                /* Wake up parent */
                parent->sk_data_ready(parent, 1);
@@ -887,7 +946,7 @@ done:
 }
 /* ----- SCO interface with lower layer (HCI) ----- */
-int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
+int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
 {
        struct sock *sk;
        struct hlist_node *node;
@@ -904,6 +963,9 @@ int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
                if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr) ||
                    !bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
                        lm |= HCI_LM_ACCEPT;
+                        if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))
+                                *flags |= HCI_PROTO_DEFER;
                        break;
                }
        }
@@ -992,7 +1054,7 @@ static const struct proto_ops sco_sock_ops = {
        .accept         = sco_sock_accept,
        .getname        = sco_sock_getname,
        .sendmsg        = sco_sock_sendmsg,
-        .recvmsg        = bt_sock_recvmsg,
+        .recvmsg        = sco_sock_recvmsg,
        .poll           = bt_sock_poll,
        .ioctl          = bt_sock_ioctl,
        .mmap           = sock_no_mmap,
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 4965aa6424ec..5c61677487cf 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -398,6 +398,38 @@ void sta_set_rate_info_tx(struct sta_info *sta,
                rinfo->flags |= RATE_INFO_FLAGS_SHORT_GI;
 }
+void sta_set_rate_info_rx(struct sta_info *sta, struct rate_info *rinfo)
+{
+        rinfo->flags = 0;
+        if (sta->last_rx_rate_flag & RX_FLAG_HT) {
+                rinfo->flags |= RATE_INFO_FLAGS_MCS;
+                rinfo->mcs = sta->last_rx_rate_idx;
+        } else if (sta->last_rx_rate_flag & RX_FLAG_VHT) {
+                rinfo->flags |= RATE_INFO_FLAGS_VHT_MCS;
+                rinfo->nss = sta->last_rx_rate_vht_nss;
+                rinfo->mcs = sta->last_rx_rate_idx;
+        } else {
+                struct ieee80211_supported_band *sband;
+                sband = sta->local->hw.wiphy->bands[
+                                ieee80211_get_sdata_band(sta->sdata)];
+                rinfo->legacy =
+                        sband->bitrates[sta->last_rx_rate_idx].bitrate;
+        }
+        if (sta->last_rx_rate_flag & RX_FLAG_40MHZ)
+                rinfo->flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
+        if (sta->last_rx_rate_flag & RX_FLAG_SHORT_GI)
+                rinfo->flags |= RATE_INFO_FLAGS_SHORT_GI;
+        if (sta->last_rx_rate_flag & RX_FLAG_80MHZ)
+                rinfo->flags |= RATE_INFO_FLAGS_80_MHZ_WIDTH;
+        if (sta->last_rx_rate_flag & RX_FLAG_80P80MHZ)
+                rinfo->flags |= RATE_INFO_FLAGS_80P80_MHZ_WIDTH;
+        if (sta->last_rx_rate_flag & RX_FLAG_160MHZ)
+                rinfo->flags |= RATE_INFO_FLAGS_160_MHZ_WIDTH;
+}
 static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
 {
        struct ieee80211_sub_if_data *sdata = sta->sdata;
@@ -444,34 +476,7 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
        }
        sta_set_rate_info_tx(sta, &sta->last_tx_rate, &sinfo->txrate);
+        sta_set_rate_info_rx(sta, &sinfo->rxrate);
-        sinfo->rxrate.flags = 0;
-        if (sta->last_rx_rate_flag & RX_FLAG_HT) {
-                sinfo->rxrate.flags |= RATE_INFO_FLAGS_MCS;
-                sinfo->rxrate.mcs = sta->last_rx_rate_idx;
-        } else if (sta->last_rx_rate_flag & RX_FLAG_VHT) {
-                sinfo->rxrate.flags |= RATE_INFO_FLAGS_VHT_MCS;
-                sinfo->rxrate.nss = sta->last_rx_rate_vht_nss;
-                sinfo->rxrate.mcs = sta->last_rx_rate_idx;
-        } else {
-                struct ieee80211_supported_band *sband;
-                sband = sta->local->hw.wiphy->bands[
-                                ieee80211_get_sdata_band(sta->sdata)];
-                sinfo->rxrate.legacy =
-                        sband->bitrates[sta->last_rx_rate_idx].bitrate;
-        }
-        if (sta->last_rx_rate_flag & RX_FLAG_40MHZ)
-                sinfo->rxrate.flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
-        if (sta->last_rx_rate_flag & RX_FLAG_SHORT_GI)
-                sinfo->rxrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
-        if (sta->last_rx_rate_flag & RX_FLAG_80MHZ)
-                sinfo->rxrate.flags |= RATE_INFO_FLAGS_80_MHZ_WIDTH;
-        if (sta->last_rx_rate_flag & RX_FLAG_80P80MHZ)
-                sinfo->rxrate.flags |= RATE_INFO_FLAGS_80P80_MHZ_WIDTH;
-        if (sta->last_rx_rate_flag & RX_FLAG_160MHZ)
-                sinfo->rxrate.flags |= RATE_INFO_FLAGS_160_MHZ_WIDTH;
        if (ieee80211_vif_is_mesh(&sdata->vif)) {
 #ifdef CONFIG_MAC80211_MESH
@@ -893,7 +898,8 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
        u32 changed = BSS_CHANGED_BEACON_INT |
                      BSS_CHANGED_BEACON_ENABLED |
                      BSS_CHANGED_BEACON |
-                      BSS_CHANGED_SSID;
+                      BSS_CHANGED_SSID |
+                      BSS_CHANGED_P2P_PS;
        int err;
        old = rtnl_dereference(sdata->u.ap.beacon);
@@ -932,6 +938,9 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
        sdata->vif.bss_conf.hidden_ssid =
                (params->hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE);
+        sdata->vif.bss_conf.p2p_ctwindow = params->p2p_ctwindow;
+        sdata->vif.bss_conf.p2p_oppps = params->p2p_opp_ps;
        err = ieee80211_assign_beacon(sdata, &params->beacon);
        if (err < 0)
                return err;
@@ -1807,6 +1816,16 @@ static int ieee80211_change_bss(struct wiphy *wiphy,
                changed |= BSS_CHANGED_HT;
        }
+        if (params->p2p_ctwindow >= 0) {
+                sdata->vif.bss_conf.p2p_ctwindow = params->p2p_ctwindow;
+                changed |= BSS_CHANGED_P2P_PS;
+        }
+        if (params->p2p_opp_ps >= 0) {
+                sdata->vif.bss_conf.p2p_oppps = params->p2p_opp_ps;
+                changed |= BSS_CHANGED_P2P_PS;
+        }
        ieee80211_bss_info_change_notify(sdata, changed);
        return 0;
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 89281d24b094..49a1c70bbd70 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -53,6 +53,7 @@ static const struct file_operations sta_ ##name## _ops = {		\
 STA_FILE(aid, sta.aid, D);
 STA_FILE(dev, sdata->name, S);
 STA_FILE(last_signal, last_signal, D);
+STA_FILE(last_ack_signal, last_ack_signal, D);
 static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
                              size_t count, loff_t *ppos)
@@ -321,6 +322,38 @@ static ssize_t sta_ht_capa_read(struct file *file, char __user *userbuf,
 }
 STA_OPS(ht_capa);
+static ssize_t sta_current_tx_rate_read(struct file *file, char __user *userbuf,
+                                        size_t count, loff_t *ppos)
+{
+        struct sta_info *sta = file->private_data;
+        struct rate_info rinfo;
+        u16 rate;
+        sta_set_rate_info_tx(sta, &sta->last_tx_rate, &rinfo);
+        rate = cfg80211_calculate_bitrate(&rinfo);
+        return mac80211_format_buffer(userbuf, count, ppos,
+                                      "%d.%d MBit/s\n",
+                                      rate/10, rate%10);
+}
+STA_OPS(current_tx_rate);
+static ssize_t sta_last_rx_rate_read(struct file *file, char __user *userbuf,
+                                     size_t count, loff_t *ppos)
+{
+        struct sta_info *sta = file->private_data;
+        struct rate_info rinfo;
+        u16 rate;
+        sta_set_rate_info_rx(sta, &rinfo);
+        rate = cfg80211_calculate_bitrate(&rinfo);
+        return mac80211_format_buffer(userbuf, count, ppos,
+                                      "%d.%d MBit/s\n",
+                                      rate/10, rate%10);
+}
+STA_OPS(last_rx_rate);
 #define DEBUGFS_ADD(name) \
        debugfs_create_file(#name, 0400, \
                sta->debugfs.dir, sta, &sta_ ##name## _ops);
@@ -369,6 +402,9 @@ void ieee80211_sta_debugfs_add(struct sta_info *sta)
        DEBUGFS_ADD(dev);
        DEBUGFS_ADD(last_signal);
        DEBUGFS_ADD(ht_capa);
+        DEBUGFS_ADD(last_ack_signal);
+        DEBUGFS_ADD(current_tx_rate);
+        DEBUGFS_ADD(last_rx_rate);
        DEBUGFS_ADD_COUNTER(rx_packets, rx_packets);
        DEBUGFS_ADD_COUNTER(tx_packets, tx_packets);
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 5c0d5a6946c1..42d0d0267730 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -371,6 +371,8 @@ enum ieee80211_sta_flags {
        IEEE80211_STA_RESET_SIGNAL_AVE  = BIT(9),
        IEEE80211_STA_DISABLE_40MHZ     = BIT(10),
        IEEE80211_STA_DISABLE_VHT       = BIT(11),
+        IEEE80211_STA_DISABLE_80P80MHZ  = BIT(12),
+        IEEE80211_STA_DISABLE_160MHZ    = BIT(13),
 };
 struct ieee80211_mgd_auth_data {
@@ -1032,6 +1034,7 @@ struct ieee80211_local {
        enum ieee80211_band hw_scan_band;
        int scan_channel_idx;
        int scan_ies_len;
+        int hw_scan_ies_bufsize;
        struct work_struct sched_scan_stopped_work;
        struct ieee80211_sub_if_data __rcu *sched_scan_sdata;
@@ -1573,7 +1576,7 @@ void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
                                    const u8 *bssid, u16 stype, u16 reason,
                                    bool send_frame, u8 *frame_buf);
 int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
-                             const u8 *ie, size_t ie_len,
+                             size_t buffer_len, const u8 *ie, size_t ie_len,
                             enum ieee80211_band band, u32 rate_mask,
                             u8 channel);
 struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 5331662489f7..40c36d5d7377 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -223,6 +223,47 @@ static int ieee80211_change_mtu(struct net_device *dev, int new_mtu)
        return 0;
 }
+static int ieee80211_verify_mac(struct ieee80211_local *local, u8 *addr)
+{
+        struct ieee80211_sub_if_data *sdata;
+        u64 new, mask, tmp;
+        u8 *m;
+        int ret = 0;
+        if (is_zero_ether_addr(local->hw.wiphy->addr_mask))
+                return 0;
+        m = addr;
+        new =   ((u64)m[0] << 5*8) | ((u64)m[1] << 4*8) |
+                ((u64)m[2] << 3*8) | ((u64)m[3] << 2*8) |
+                ((u64)m[4] << 1*8) | ((u64)m[5] << 0*8);
+        m = local->hw.wiphy->addr_mask;
+        mask =  ((u64)m[0] << 5*8) | ((u64)m[1] << 4*8) |
+                ((u64)m[2] << 3*8) | ((u64)m[3] << 2*8) |
+                ((u64)m[4] << 1*8) | ((u64)m[5] << 0*8);
+        mutex_lock(&local->iflist_mtx);
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
+                        continue;
+                m = sdata->vif.addr;
+                tmp =   ((u64)m[0] << 5*8) | ((u64)m[1] << 4*8) |
+                        ((u64)m[2] << 3*8) | ((u64)m[3] << 2*8) |
+                        ((u64)m[4] << 1*8) | ((u64)m[5] << 0*8);
+                if ((new & ~mask) != (tmp & ~mask)) {
+                        ret = -EINVAL;
+                        break;
+                }
+        }
+        mutex_unlock(&local->iflist_mtx);
+        return ret;
+}
 static int ieee80211_change_mac(struct net_device *dev, void *addr)
 {
        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
@@ -232,6 +273,10 @@ static int ieee80211_change_mac(struct net_device *dev, void *addr)
        if (ieee80211_sdata_running(sdata))
                return -EBUSY;
+        ret = ieee80211_verify_mac(sdata->local, sa->sa_data);
+        if (ret)
+                return ret;
        ret = eth_mac_addr(dev, sa);
        if (ret == 0)
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index f5e4c1f24bf2..1b087fff93e7 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -474,7 +474,8 @@ ieee80211_default_mgmt_stypes[NUM_NL80211_IFTYPES] = {
                .tx = 0xffff,
                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
                        BIT(IEEE80211_STYPE_AUTH >> 4) |
-                        BIT(IEEE80211_STYPE_DEAUTH >> 4),
+                        BIT(IEEE80211_STYPE_DEAUTH >> 4) |
+                        BIT(IEEE80211_STYPE_PROBE_REQ >> 4),
        },
        [NL80211_IFTYPE_STATION] = {
                .tx = 0xffff,
@@ -638,6 +639,8 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
        local->hw.radiotap_mcs_details = IEEE80211_RADIOTAP_MCS_HAVE_MCS |
                                         IEEE80211_RADIOTAP_MCS_HAVE_GI |
                                         IEEE80211_RADIOTAP_MCS_HAVE_BW;
+        local->hw.radiotap_vht_details = IEEE80211_RADIOTAP_VHT_KNOWN_GI |
+                                         IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
        local->user_power_level = IEEE80211_UNSET_POWER_LEVEL;
        wiphy->ht_capa_mod_mask = &mac80211_ht_capa_mod_mask;
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index ca52dfdd5375..4b274e9c91a5 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -391,7 +391,8 @@ static struct sta_info *mesh_peer_init(struct ieee80211_sub_if_data *sdata,
                sta->ch_width = chandef.width;
        }
-        rate_control_rate_init(sta);
+        if (insert)
+                rate_control_rate_init(sta);
        spin_unlock_bh(&sta->lock);
        if (insert && sta_info_insert(sta))
diff --git a/net/mac80211/mesh_sync.c b/net/mac80211/mesh_sync.c
index 0f40086cce18..aa8d1e437385 100644
--- a/net/mac80211/mesh_sync.c
+++ b/net/mac80211/mesh_sync.c
@@ -195,11 +195,15 @@ static void mesh_sync_offset_adjust_tbtt(struct ieee80211_sub_if_data *sdata)
                          ifmsh->sync_offset_clockdrift_max);
                set_bit(MESH_WORK_DRIFT_ADJUST,
                        &ifmsh->wrkq_flags);
+                ifmsh->adjusting_tbtt = true;
        } else {
                msync_dbg(sdata,
                          "TBTT : max clockdrift=%lld; too small to adjust\n",
                          (long long)ifmsh->sync_offset_clockdrift_max);
                ifmsh->sync_offset_clockdrift_max = 0;
+                ifmsh->adjusting_tbtt = false;
        }
        spin_unlock_bh(&ifmsh->sync_offset_lock);
 }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index d2a4f78b4b0f..09556303c7e1 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -354,6 +354,16 @@ static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
        /* determine capability flags */
        cap = vht_cap.cap;
+        if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_80P80MHZ) {
+                cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
+                cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
+        }
+        if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_160MHZ) {
+                cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
+                cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
+        }
        /* reserve and fill IE */
        pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
        ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
@@ -543,6 +553,10 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                offset = noffset;
        }
+        if (WARN_ON_ONCE((ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
+                         !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)))
+                ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
        if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
                ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
                                    sband, chan, sdata->smps_mode);
@@ -775,6 +789,7 @@ void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
                           "not handling channel switch with channel contexts\n");
                ieee80211_queue_work(&sdata->local->hw,
                                     &ifmgd->csa_connection_drop_work);
+                return;
        }
        mutex_lock(&sdata->local->chanctx_mtx);
@@ -1368,19 +1383,26 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
        sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;
        if (sdata->vif.p2p) {
-                u8 noa[2];
+                const struct cfg80211_bss_ies *ies;
-                int ret;
-                ret = cfg80211_get_p2p_attr(cbss->information_elements,
+                rcu_read_lock();
-                                            cbss->len_information_elements,
+                ies = rcu_dereference(cbss->ies);
-                                            IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
+                if (ies) {
-                                            noa, sizeof(noa));
+                        u8 noa[2];
-                if (ret >= 2) {
+                        int ret;
-                        bss_conf->p2p_oppps = noa[1] & 0x80;
-                        bss_conf->p2p_ctwindow = noa[1] & 0x7f;
+                        ret = cfg80211_get_p2p_attr(
-                        bss_info_changed |= BSS_CHANGED_P2P_PS;
+                                        ies->data, ies->len,
-                        sdata->u.mgd.p2p_noa_index = noa[0];
+                                        IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
+                                        noa, sizeof(noa));
+                        if (ret >= 2) {
+                                bss_conf->p2p_oppps = noa[1] & 0x80;
+                                bss_conf->p2p_ctwindow = noa[1] & 0x7f;
+                                bss_info_changed |= BSS_CHANGED_P2P_PS;
+                                sdata->u.mgd.p2p_noa_index = noa[0];
+                        }
                }
+                rcu_read_unlock();
        }
        /* just to be sure */
@@ -1645,6 +1667,7 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
        } else {
                int ssid_len;
+                rcu_read_lock();
                ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
                if (WARN_ON_ONCE(ssid == NULL))
                        ssid_len = 0;
@@ -1654,6 +1677,7 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
                ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid_len, NULL,
                                         0, (u32) -1, true, false,
                                         ifmgd->associated->channel, false);
+                rcu_read_unlock();
        }
        ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
@@ -1749,6 +1773,7 @@ struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
        else
                return NULL;
+        rcu_read_lock();
        ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
        if (WARN_ON_ONCE(ssid == NULL))
                ssid_len = 0;
@@ -1759,6 +1784,7 @@ struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
                                        (u32) -1, cbss->channel,
                                        ssid + 2, ssid_len,
                                        NULL, 0, true);
+        rcu_read_unlock();
        return skb;
 }
@@ -2844,9 +2870,12 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
                           auth_data->bss->bssid, auth_data->tries,
                           IEEE80211_AUTH_MAX_TRIES);
+                rcu_read_lock();
                ssidie = ieee80211_bss_get_ie(auth_data->bss, WLAN_EID_SSID);
-                if (!ssidie)
+                if (!ssidie) {
+                        rcu_read_unlock();
                        return -EINVAL;
+                }
                /*
                 * Direct probe is sent to broadcast address as some APs
                 * will not answer to direct packet in unassociated state.
@@ -2854,6 +2883,7 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
                ieee80211_send_probe_req(sdata, NULL, ssidie + 2, ssidie[1],
                                         NULL, 0, (u32) -1, true, false,
                                         auth_data->bss->channel, false);
+                rcu_read_unlock();
        }
        auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
@@ -3183,106 +3213,313 @@ int ieee80211_max_network_latency(struct notifier_block *nb,
        return 0;
 }
+static u32 chandef_downgrade(struct cfg80211_chan_def *c)
+{
+        u32 ret;
+        int tmp;
+        switch (c->width) {
+        case NL80211_CHAN_WIDTH_20:
+                c->width = NL80211_CHAN_WIDTH_20_NOHT;
+                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
+                break;
+        case NL80211_CHAN_WIDTH_40:
+                c->width = NL80211_CHAN_WIDTH_20;
+                c->center_freq1 = c->chan->center_freq;
+                ret = IEEE80211_STA_DISABLE_40MHZ |
+                      IEEE80211_STA_DISABLE_VHT;
+                break;
+        case NL80211_CHAN_WIDTH_80:
+                tmp = (30 + c->chan->center_freq - c->center_freq1)/20;
+                /* n_P40 */
+                tmp /= 2;
+                /* freq_P40 */
+                c->center_freq1 = c->center_freq1 - 20 + 40 * tmp;
+                c->width = NL80211_CHAN_WIDTH_40;
+                ret = IEEE80211_STA_DISABLE_VHT;
+                break;
+        case NL80211_CHAN_WIDTH_80P80:
+                c->center_freq2 = 0;
+                c->width = NL80211_CHAN_WIDTH_80;
+                ret = IEEE80211_STA_DISABLE_80P80MHZ |
+                      IEEE80211_STA_DISABLE_160MHZ;
+                break;
+        case NL80211_CHAN_WIDTH_160:
+                /* n_P20 */
+                tmp = (70 + c->chan->center_freq - c->center_freq1)/20;
+                /* n_P80 */
+                tmp /= 4;
+                c->center_freq1 = c->center_freq1 - 40 + 80 * tmp;
+                c->width = NL80211_CHAN_WIDTH_80;
+                ret = IEEE80211_STA_DISABLE_80P80MHZ |
+                      IEEE80211_STA_DISABLE_160MHZ;
+                break;
+        default:
+        case NL80211_CHAN_WIDTH_20_NOHT:
+                WARN_ON_ONCE(1);
+                c->width = NL80211_CHAN_WIDTH_20_NOHT;
+                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
+                break;
+        }
+        WARN_ON_ONCE(!cfg80211_chandef_valid(c));
+        return ret;
+}
+static u32
+ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
+                             struct ieee80211_supported_band *sband,
+                             struct ieee80211_channel *channel,
+                             const struct ieee80211_ht_operation *ht_oper,
+                             const struct ieee80211_vht_operation *vht_oper,
+                             struct cfg80211_chan_def *chandef)
+{
+        struct cfg80211_chan_def vht_chandef;
+        u32 ht_cfreq, ret;
+        chandef->chan = channel;
+        chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
+        chandef->center_freq1 = channel->center_freq;
+        chandef->center_freq2 = 0;
+        if (!ht_oper || !sband->ht_cap.ht_supported) {
+                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+        chandef->width = NL80211_CHAN_WIDTH_20;
+        ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
+                                                  channel->band);
+        /* check that channel matches the right operating channel */
+        if (channel->center_freq != ht_cfreq) {
+                /*
+                 * It's possible that some APs are confused here;
+                 * Netgear WNDR3700 sometimes reports 4 higher than
+                 * the actual channel in association responses, but
+                 * since we look at probe response/beacon data here
+                 * it should be OK.
+                 */
+                sdata_info(sdata,
+                           "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
+                           channel->center_freq, ht_cfreq,
+                           ht_oper->primary_chan, channel->band);
+                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+        /* check 40 MHz support, if we have it */
+        if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
+                switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
+                case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
+                        chandef->width = NL80211_CHAN_WIDTH_40;
+                        chandef->center_freq1 += 10;
+                        break;
+                case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
+                        chandef->width = NL80211_CHAN_WIDTH_40;
+                        chandef->center_freq1 -= 10;
+                        break;
+                }
+        } else {
+                /* 40 MHz (and 80 MHz) must be supported for VHT */
+                ret = IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+        if (!vht_oper || !sband->vht_cap.vht_supported) {
+                ret = IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+        vht_chandef.chan = channel;
+        vht_chandef.center_freq1 =
+                ieee80211_channel_to_frequency(vht_oper->center_freq_seg1_idx,
+                                               channel->band);
+        vht_chandef.center_freq2 = 0;
+        if (vht_oper->center_freq_seg2_idx)
+                vht_chandef.center_freq2 =
+                        ieee80211_channel_to_frequency(
+                                vht_oper->center_freq_seg2_idx,
+                                channel->band);
+        switch (vht_oper->chan_width) {
+        case IEEE80211_VHT_CHANWIDTH_USE_HT:
+                vht_chandef.width = chandef->width;
+                break;
+        case IEEE80211_VHT_CHANWIDTH_80MHZ:
+                vht_chandef.width = NL80211_CHAN_WIDTH_80;
+                break;
+        case IEEE80211_VHT_CHANWIDTH_160MHZ:
+                vht_chandef.width = NL80211_CHAN_WIDTH_160;
+                break;
+        case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
+                vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
+                break;
+        default:
+                sdata_info(sdata,
+                           "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
+                           vht_oper->chan_width);
+                ret = IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+        if (!cfg80211_chandef_valid(&vht_chandef)) {
+                sdata_info(sdata,
+                           "AP VHT information is invalid, disable VHT\n");
+                ret = IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+        if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
+                ret = 0;
+                goto out;
+        }
+        if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
+                sdata_info(sdata,
+                           "AP VHT information doesn't match HT, disable VHT\n");
+                ret = IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+        *chandef = vht_chandef;
+        ret = 0;
+        while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
+                                        IEEE80211_CHAN_DISABLED)) {
+                if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
+                        ret = IEEE80211_STA_DISABLE_HT |
+                              IEEE80211_STA_DISABLE_VHT;
+                        goto out;
+                }
+                ret = chandef_downgrade(chandef);
+        }
+        if (chandef->width != vht_chandef.width)
+                sdata_info(sdata,
+                           "local regulatory prevented using AP HT/VHT configuration, downgraded\n");
+out:
+        WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
+        return ret;
+}
+static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
+                                     struct cfg80211_bss *cbss)
+{
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        const u8 *ht_cap_ie, *vht_cap_ie;
+        const struct ieee80211_ht_cap *ht_cap;
+        const struct ieee80211_vht_cap *vht_cap;
+        u8 chains = 1;
+        if (ifmgd->flags & IEEE80211_STA_DISABLE_HT)
+                return chains;
+        ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
+        if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) {
+                ht_cap = (void *)(ht_cap_ie + 2);
+                chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
+                /*
+                 * TODO: use "Tx Maximum Number Spatial Streams Supported" and
+                 *       "Tx Unequal Modulation Supported" fields.
+                 */
+        }
+        if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
+                return chains;
+        vht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
+        if (vht_cap_ie && vht_cap_ie[1] >= sizeof(*vht_cap)) {
+                u8 nss;
+                u16 tx_mcs_map;
+                vht_cap = (void *)(vht_cap_ie + 2);
+                tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
+                for (nss = 8; nss > 0; nss--) {
+                        if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
+                                        IEEE80211_VHT_MCS_NOT_SUPPORTED)
+                                break;
+                }
+                /* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
+                chains = max(chains, nss);
+        }
+        return chains;
+}
 static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
                                  struct cfg80211_bss *cbss)
 {
        struct ieee80211_local *local = sdata->local;
        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        int ht_cfreq;
-        enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
-        const u8 *ht_oper_ie;
        const struct ieee80211_ht_operation *ht_oper = NULL;
+        const struct ieee80211_vht_operation *vht_oper = NULL;
        struct ieee80211_supported_band *sband;
        struct cfg80211_chan_def chandef;
+        int ret;
        sband = local->hw.wiphy->bands[cbss->channel->band];
-        ifmgd->flags &= ~IEEE80211_STA_DISABLE_40MHZ;
+        ifmgd->flags &= ~(IEEE80211_STA_DISABLE_40MHZ |
+                          IEEE80211_STA_DISABLE_80P80MHZ |
+                          IEEE80211_STA_DISABLE_160MHZ);
-        if (sband->ht_cap.ht_supported) {
+        rcu_read_lock();
-                ht_oper_ie = cfg80211_find_ie(WLAN_EID_HT_OPERATION,
-                                              cbss->information_elements,
+        if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
-                                              cbss->len_information_elements);
+            sband->ht_cap.ht_supported) {
+                const u8 *ht_oper_ie;
+                ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
                if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
                        ht_oper = (void *)(ht_oper_ie + 2);
        }
-        if (ht_oper) {
+        if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
-                ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
+            sband->vht_cap.vht_supported) {
-                                                          cbss->channel->band);
+                const u8 *vht_oper_ie;
-                /* check that channel matches the right operating channel */
-                if (cbss->channel->center_freq != ht_cfreq) {
+                vht_oper_ie = ieee80211_bss_get_ie(cbss,
-                        /*
+                                                   WLAN_EID_VHT_OPERATION);
-                         * It's possible that some APs are confused here;
+                if (vht_oper_ie && vht_oper_ie[1] >= sizeof(*vht_oper))
-                         * Netgear WNDR3700 sometimes reports 4 higher than
+                        vht_oper = (void *)(vht_oper_ie + 2);
-                         * the actual channel in association responses, but
+                if (vht_oper && !ht_oper) {
-                         * since we look at probe response/beacon data here
+                        vht_oper = NULL;
-                         * it should be OK.
-                         */
                        sdata_info(sdata,
-                                   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
+                                   "AP advertised VHT without HT, disabling both\n");
-                                   cbss->channel->center_freq,
+                        sdata->flags |= IEEE80211_STA_DISABLE_HT;
-                                   ht_cfreq, ht_oper->primary_chan,
+                        sdata->flags |= IEEE80211_STA_DISABLE_VHT;
-                                   cbss->channel->band);
-                        ht_oper = NULL;
                }
        }
-        if (ht_oper) {
+        ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
-                /*
+                                                     cbss->channel,
-                 * cfg80211 already verified that the channel itself can
+                                                     ht_oper, vht_oper,
-                 * be used, but it didn't check that we can do the right
+                                                     &chandef);
-                 * HT type, so do that here as well. If HT40 isn't allowed
-                 * on this channel, disable 40 MHz operation.
-                 */
-                const u8 *ht_cap_ie;
-                const struct ieee80211_ht_cap *ht_cap;
-                u8 chains = 1;
-                channel_type = NL80211_CHAN_HT20;
-                if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
-                        switch (ht_oper->ht_param &
-                                        IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
-                        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
-                                if (cbss->channel->flags &
-                                                IEEE80211_CHAN_NO_HT40PLUS)
-                                        ifmgd->flags |=
-                                                IEEE80211_STA_DISABLE_40MHZ;
-                                else
-                                        channel_type = NL80211_CHAN_HT40PLUS;
-                                break;
-                        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
-                                if (cbss->channel->flags &
-                                                IEEE80211_CHAN_NO_HT40MINUS)
-                                        ifmgd->flags |=
-                                                IEEE80211_STA_DISABLE_40MHZ;
-                                else
-                                        channel_type = NL80211_CHAN_HT40MINUS;
-                                break;
-                        }
-                }
-                ht_cap_ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY,
+        sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
-                                             cbss->information_elements,
+                                      local->rx_chains);
-                                             cbss->len_information_elements);
-                if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) {
+        rcu_read_unlock();
-                        ht_cap = (void *)(ht_cap_ie + 2);
-                        chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
-                }
-                sdata->needed_rx_chains = min(chains, local->rx_chains);
-        } else {
-                sdata->needed_rx_chains = 1;
-                sdata->u.mgd.flags |= IEEE80211_STA_DISABLE_HT;
-        }
        /* will change later if needed */
        sdata->smps_mode = IEEE80211_SMPS_OFF;
-        ieee80211_vif_release_channel(sdata);
+        /*
-        cfg80211_chandef_create(&chandef, cbss->channel, channel_type);
+         * If this fails (possibly due to channel context sharing
-        return ieee80211_vif_use_channel(sdata, &chandef,
+         * on incompatible channels, e.g. 80+80 and 160 sharing the
-                                         IEEE80211_CHANCTX_SHARED);
+         * same control channel) try to use a smaller bandwidth.
+         */
+        ret = ieee80211_vif_use_channel(sdata, &chandef,
+                                        IEEE80211_CHANCTX_SHARED);
+        while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT)
+                ifmgd->flags |= chandef_downgrade(&chandef);
+        return ret;
 }
 static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
@@ -3510,14 +3747,21 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
        const u8 *ssidie, *ht_ie;
        int i, err;
-        ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
-        if (!ssidie)
-                return -EINVAL;
        assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
        if (!assoc_data)
                return -ENOMEM;
+        rcu_read_lock();
+        ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
+        if (!ssidie) {
+                rcu_read_unlock();
+                kfree(assoc_data);
+                return -EINVAL;
+        }
+        memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
+        assoc_data->ssid_len = ssidie[1];
+        rcu_read_unlock();
        mutex_lock(&ifmgd->mtx);
        if (ifmgd->associated)
@@ -3612,12 +3856,14 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
        assoc_data->supp_rates = bss->supp_rates;
        assoc_data->supp_rates_len = bss->supp_rates_len;
+        rcu_read_lock();
        ht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
        if (ht_ie && ht_ie[1] >= sizeof(struct ieee80211_ht_operation))
                assoc_data->ap_ht_param =
                        ((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
        else
                ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
+        rcu_read_unlock();
        if (bss->wmm_used && bss->uapsd_supported &&
            (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)) {
@@ -3628,9 +3874,6 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
        }
-        memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
-        assoc_data->ssid_len = ssidie[1];
        if (req->prev_bssid)
                memcpy(assoc_data->prev_bssid, req->prev_bssid, ETH_ALEN);
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index 5abddfe3e101..a5379aea7d09 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -462,8 +462,6 @@ void ieee80211_roc_purge(struct ieee80211_sub_if_data *sdata)
                list_move_tail(&roc->list, &tmp_list);
                roc->abort = true;
        }
-        ieee80211_start_next_roc(local);
        mutex_unlock(&local->mtx);
        list_for_each_entry_safe(roc, tmp, &tmp_list, list) {
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index fb1d4aa65e8c..9f9c453bc45d 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -389,9 +389,9 @@ minstrel_ht_tx_status(void *priv, struct ieee80211_supported_band *sband,
        struct ieee80211_tx_rate *ar = info->status.rates;
        struct minstrel_rate_stats *rate, *rate2;
        struct minstrel_priv *mp = priv;
-        bool last = false;
+        bool last;
        int group;
-        int i = 0;
+        int i;
        if (!msp->is_ht)
                return mac80211_minstrel.tx_status(priv, sband, sta, &msp->legacy, skb);
@@ -419,13 +419,11 @@ minstrel_ht_tx_status(void *priv, struct ieee80211_supported_band *sband,
        if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)
                mi->sample_packets += info->status.ampdu_len;
+        last = !minstrel_ht_txstat_valid(&ar[0]);
        for (i = 0; !last; i++) {
                last = (i == IEEE80211_TX_MAX_RATES - 1) ||
                       !minstrel_ht_txstat_valid(&ar[i + 1]);
-                if (!minstrel_ht_txstat_valid(&ar[i]))
-                        break;
                group = minstrel_ht_get_group_idx(&ar[i]);
                rate = &mi->groups[group].rates[ar[i].idx % 8];
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 825f33cf7bbc..db343fa8033c 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -49,7 +49,7 @@ static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
                        /* driver bug */
                        WARN_ON(1);
                        dev_kfree_skb(skb);
-                        skb = NULL;
+                        return NULL;
                }
        }
@@ -111,6 +111,11 @@ ieee80211_rx_radiotap_space(struct ieee80211_local *local,
                len += 8;
        }
+        if (status->flag & RX_FLAG_VHT) {
+                len = ALIGN(len, 2);
+                len += 12;
+        }
        if (status->vendor_radiotap_len) {
                if (WARN_ON_ONCE(status->vendor_radiotap_align == 0))
                        status->vendor_radiotap_align = 1;
@@ -297,6 +302,41 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                *pos++ = 0;
        }
+        if (status->flag & RX_FLAG_VHT) {
+                u16 known = local->hw.radiotap_vht_details;
+                rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);
+                /* known field - how to handle 80+80? */
+                if (status->flag & RX_FLAG_80P80MHZ)
+                        known &= ~IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
+                put_unaligned_le16(known, pos);
+                pos += 2;
+                /* flags */
+                if (status->flag & RX_FLAG_SHORT_GI)
+                        *pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
+                pos++;
+                /* bandwidth */
+                if (status->flag & RX_FLAG_80MHZ)
+                        *pos++ = 4;
+                else if (status->flag & RX_FLAG_80P80MHZ)
+                        *pos++ = 0; /* marked not known above */
+                else if (status->flag & RX_FLAG_160MHZ)
+                        *pos++ = 11;
+                else if (status->flag & RX_FLAG_40MHZ)
+                        *pos++ = 1;
+                else /* 20 MHz */
+                        *pos++ = 0;
+                /* MCS/NSS */
+                *pos = (status->rate_idx << 4) | status->vht_nss;
+                pos += 4;
+                /* coding field */
+                pos++;
+                /* group ID */
+                pos++;
+                /* partial_aid */
+                pos += 2;
+        }
        if (status->vendor_radiotap_len) {
                /* ensure 2 byte alignment for the vendor field as required */
                if ((pos - (u8 *)rthdr) & 1)
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index f3340279aba3..f7176ac5a535 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -247,6 +247,7 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
        local->hw_scan_req->n_channels = n_chans;
        ielen = ieee80211_build_preq_ies(local, (u8 *)local->hw_scan_req->ie,
+                                         local->hw_scan_ies_bufsize,
                                         req->ie, req->ie_len, band,
                                         req->rates[band], 0);
        local->hw_scan_req->ie_len = ielen;
@@ -445,11 +446,13 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
        if (local->ops->hw_scan) {
                u8 *ies;
+                local->hw_scan_ies_bufsize = 2 + IEEE80211_MAX_SSID_LEN +
+                                             local->scan_ies_len +
+                                             req->ie_len;
                local->hw_scan_req = kmalloc(
                                sizeof(*local->hw_scan_req) +
                                req->n_channels * sizeof(req->channels[0]) +
-                                2 + IEEE80211_MAX_SSID_LEN + local->scan_ies_len +
+                                local->hw_scan_ies_bufsize, GFP_KERNEL);
-                                req->ie_len, GFP_KERNEL);
                if (!local->hw_scan_req)
                        return -ENOMEM;
@@ -928,7 +931,10 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
 {
        struct ieee80211_local *local = sdata->local;
        struct ieee80211_sched_scan_ies sched_scan_ies = {};
-        int ret, i;
+        int ret, i, iebufsz;
+        iebufsz = 2 + IEEE80211_MAX_SSID_LEN +
+                  local->scan_ies_len + req->ie_len;
        mutex_lock(&local->mtx);
@@ -946,10 +952,7 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
                if (!local->hw.wiphy->bands[i])
                        continue;
-                sched_scan_ies.ie[i] = kzalloc(2 + IEEE80211_MAX_SSID_LEN +
+                sched_scan_ies.ie[i] = kzalloc(iebufsz, GFP_KERNEL);
-                                               local->scan_ies_len +
-                                               req->ie_len,
-                                               GFP_KERNEL);
                if (!sched_scan_ies.ie[i]) {
                        ret = -ENOMEM;
                        goto out_free;
@@ -957,8 +960,8 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
                sched_scan_ies.len[i] =
                        ieee80211_build_preq_ies(local, sched_scan_ies.ie[i],
-                                                 req->ie, req->ie_len, i,
+                                                 iebufsz, req->ie, req->ie_len,
-                                                 (u32) -1, 0);
+                                                 i, (u32) -1, 0);
        }
        ret = drv_sched_scan_start(local, sdata, req, &sched_scan_ies);
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 6835cea4e402..1489bca9ea97 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -250,6 +250,7 @@ struct sta_ampdu_mlme {
 * @rx_dropped: number of dropped MPDUs from this STA
 * @last_signal: signal of last received frame from this STA
 * @avg_signal: moving average of signal of received frames from this STA
+ * @last_ack_signal: signal of last received Ack frame from this STA
 * @last_seq_ctrl: last received seq/frag number from this STA (per RX queue)
 * @tx_filtered_count: number of frames the hardware filtered for this STA
 * @tx_retry_failed: number of frames that failed retry
@@ -329,6 +330,7 @@ struct sta_info {
        unsigned long rx_dropped;
        int last_signal;
        struct ewma avg_signal;
+        int last_ack_signal;
        /* Plus 1 for non-QoS frames */
        __le16 last_seq_ctrl[IEEE80211_NUM_TIDS + 1];
@@ -552,6 +554,8 @@ int sta_info_flush(struct ieee80211_local *local,
 void sta_set_rate_info_tx(struct sta_info *sta,
                          const struct ieee80211_tx_rate *rate,
                          struct rate_info *rinfo);
+void sta_set_rate_info_rx(struct sta_info *sta,
+                          struct rate_info *rinfo);
 void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
                          unsigned long exp_time);
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index ab63237107c8..ab50285fcbab 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -539,6 +539,9 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                                sta->lost_packets = 0;
                        }
                }
+                if (acked)
+                        sta->last_ack_signal = info->status.ack_signal;
        }
        rcu_read_unlock();
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index d287a4f2c01b..e9eadc40c09c 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2623,7 +2623,7 @@ EXPORT_SYMBOL(ieee80211_nullfunc_get);
 struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
                                       struct ieee80211_vif *vif,
                                       const u8 *ssid, size_t ssid_len,
-                                       const u8 *ie, size_t ie_len)
+                                       size_t tailroom)
 {
        struct ieee80211_sub_if_data *sdata;
        struct ieee80211_local *local;
@@ -2637,7 +2637,7 @@ struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
        ie_ssid_len = 2 + ssid_len;
        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*hdr) +
-                            ie_ssid_len + ie_len);
+                            ie_ssid_len + tailroom);
        if (!skb)
                return NULL;
@@ -2658,11 +2658,6 @@ struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
                memcpy(pos, ssid, ssid_len);
        pos += ssid_len;
-        if (ie) {
-                pos = skb_put(skb, ie_len);
-                memcpy(pos, ie, ie_len);
-        }
        return skb;
 }
 EXPORT_SYMBOL(ieee80211_probereq_get);
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 08132ff98155..f11e8c540db4 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1107,12 +1107,12 @@ void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
 }
 int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
-                             const u8 *ie, size_t ie_len,
+                             size_t buffer_len, const u8 *ie, size_t ie_len,
                             enum ieee80211_band band, u32 rate_mask,
                             u8 channel)
 {
        struct ieee80211_supported_band *sband;
-        u8 *pos;
+        u8 *pos = buffer, *end = buffer + buffer_len;
        size_t offset = 0, noffset;
        int supp_rates_len, i;
        u8 rates[32];
@@ -1123,8 +1123,6 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
        if (WARN_ON_ONCE(!sband))
                return 0;
-        pos = buffer;
        num_rates = 0;
        for (i = 0; i < sband->n_bitrates; i++) {
                if ((BIT(i) & rate_mask) == 0)
@@ -1134,6 +1132,8 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
        supp_rates_len = min_t(int, num_rates, 8);
+        if (end - pos < 2 + supp_rates_len)
+                goto out_err;
        *pos++ = WLAN_EID_SUPP_RATES;
        *pos++ = supp_rates_len;
        memcpy(pos, rates, supp_rates_len);
@@ -1150,6 +1150,8 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                                             before_extrates,
                                             ARRAY_SIZE(before_extrates),
                                             offset);
+                if (end - pos < noffset - offset)
+                        goto out_err;
                memcpy(pos, ie + offset, noffset - offset);
                pos += noffset - offset;
                offset = noffset;
@@ -1157,6 +1159,8 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
        ext_rates_len = num_rates - supp_rates_len;
        if (ext_rates_len > 0) {
+                if (end - pos < 2 + ext_rates_len)
+                        goto out_err;
                *pos++ = WLAN_EID_EXT_SUPP_RATES;
                *pos++ = ext_rates_len;
                memcpy(pos, rates + supp_rates_len, ext_rates_len);
@@ -1164,6 +1168,8 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
        }
        if (channel && sband->band == IEEE80211_BAND_2GHZ) {
+                if (end - pos < 3)
+                        goto out_err;
                *pos++ = WLAN_EID_DS_PARAMS;
                *pos++ = 1;
                *pos++ = channel;
@@ -1182,14 +1188,19 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                noffset = ieee80211_ie_split(ie, ie_len,
                                             before_ht, ARRAY_SIZE(before_ht),
                                             offset);
+                if (end - pos < noffset - offset)
+                        goto out_err;
                memcpy(pos, ie + offset, noffset - offset);
                pos += noffset - offset;
                offset = noffset;
        }
-        if (sband->ht_cap.ht_supported)
+        if (sband->ht_cap.ht_supported) {
+                if (end - pos < 2 + sizeof(struct ieee80211_ht_cap))
+                        goto out_err;
                pos = ieee80211_ie_build_ht_cap(pos, &sband->ht_cap,
                                                sband->ht_cap.cap);
+        }
        /*
         * If adding more here, adjust code in main.c
@@ -1199,15 +1210,23 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
        /* add any remaining custom IEs */
        if (ie && ie_len) {
                noffset = ie_len;
+                if (end - pos < noffset - offset)
+                        goto out_err;
                memcpy(pos, ie + offset, noffset - offset);
                pos += noffset - offset;
        }
-        if (sband->vht_cap.vht_supported)
+        if (sband->vht_cap.vht_supported) {
+                if (end - pos < 2 + sizeof(struct ieee80211_vht_cap))
+                        goto out_err;
                pos = ieee80211_ie_build_vht_cap(pos, &sband->vht_cap,
                                                 sband->vht_cap.cap);
+        }
        return pos - buffer;
+ out_err:
+        WARN_ONCE(1, "not enough space for preq IEs\n");
+        return pos - buffer;
 }
 struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
@@ -1220,14 +1239,8 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
        struct ieee80211_local *local = sdata->local;
        struct sk_buff *skb;
        struct ieee80211_mgmt *mgmt;
-        size_t buf_len;
-        u8 *buf;
        u8 chan_no;
+        int ies_len;
-        /* FIXME: come up with a proper value */
-        buf = kmalloc(200 + ie_len, GFP_KERNEL);
-        if (!buf)
-                return NULL;
        /*
         * Do not send DS Channel parameter for directed probe requests
@@ -1239,14 +1252,16 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
        else
                chan_no = ieee80211_frequency_to_channel(chan->center_freq);
-        buf_len = ieee80211_build_preq_ies(local, buf, ie, ie_len, chan->band,
-                                           ratemask, chan_no);
        skb = ieee80211_probereq_get(&local->hw, &sdata->vif,
-                                     ssid, ssid_len,
+                                     ssid, ssid_len, 100 + ie_len);
-                                     buf, buf_len);
        if (!skb)
-                goto out;
+                return NULL;
+        ies_len = ieee80211_build_preq_ies(local, skb_tail_pointer(skb),
+                                           skb_tailroom(skb),
+                                           ie, ie_len, chan->band,
+                                           ratemask, chan_no);
+        skb_put(skb, ies_len);
        if (dst) {
                mgmt = (struct ieee80211_mgmt *) skb->data;
@@ -1256,9 +1271,6 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
- out:
-        kfree(buf);
        return skb;
 }
@@ -1527,7 +1539,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                        changed |= BSS_CHANGED_IBSS;
                        /* fall through */
                case NL80211_IFTYPE_AP:
-                        changed |= BSS_CHANGED_SSID;
+                        changed |= BSS_CHANGED_SSID | BSS_CHANGED_P2P_PS;
                        if (sdata->vif.type == NL80211_IFTYPE_AP) {
                                changed |= BSS_CHANGED_AP_PROBE_RESP;
diff --git a/net/nfc/llcp/llcp.c b/net/nfc/llcp/llcp.c
index 2df87056c6df..ec43914c92a9 100644
--- a/net/nfc/llcp/llcp.c
+++ b/net/nfc/llcp/llcp.c
@@ -985,15 +985,18 @@ static void nfc_llcp_recv_hdlc(struct nfc_llcp_local *local,
        /* Remove skbs from the pending queue */
        if (llcp_sock->send_ack_n != nr) {
                struct sk_buff *s, *tmp;
+                u8 n;
                llcp_sock->send_ack_n = nr;
                /* Remove and free all skbs until ns == nr */
                skb_queue_walk_safe(&llcp_sock->tx_pending_queue, s, tmp) {
+                        n = nfc_llcp_ns(s);
                        skb_unlink(s, &llcp_sock->tx_pending_queue);
                        kfree_skb(s);
-                        if (nfc_llcp_ns(s) == nr)
+                        if (n == nr)
                                break;
                }
diff --git a/net/rfkill/rfkill-gpio.c b/net/rfkill/rfkill-gpio.c
index 865adb61685a..78fc0937948d 100644
--- a/net/rfkill/rfkill-gpio.c
+++ b/net/rfkill/rfkill-gpio.c
@@ -213,7 +213,7 @@ static int rfkill_gpio_remove(struct platform_device *pdev)
 static struct platform_driver rfkill_gpio_driver = {
        .probe = rfkill_gpio_probe,
-        .remove = __devexit_p(rfkill_gpio_remove),
+        .remove = rfkill_gpio_remove,
        .driver = {
                   .name = "rfkill_gpio",
                   .owner = THIS_MODULE,
diff --git a/net/rfkill/rfkill-regulator.c b/net/rfkill/rfkill-regulator.c
index 11da3018a853..4b5ab21ecb24 100644
--- a/net/rfkill/rfkill-regulator.c
+++ b/net/rfkill/rfkill-regulator.c
@@ -55,7 +55,7 @@ struct rfkill_ops rfkill_regulator_ops = {
        .set_block = rfkill_regulator_set_block,
 };
-static int __devinit rfkill_regulator_probe(struct platform_device *pdev)
+static int rfkill_regulator_probe(struct platform_device *pdev)
 {
        struct rfkill_regulator_platform_data *pdata = pdev->dev.platform_data;
        struct rfkill_regulator_data *rfkill_data;
@@ -122,7 +122,7 @@ out:
        return ret;
 }
-static int __devexit rfkill_regulator_remove(struct platform_device *pdev)
+static int rfkill_regulator_remove(struct platform_device *pdev)
 {
        struct rfkill_regulator_data *rfkill_data = platform_get_drvdata(pdev);
        struct rfkill *rf_kill = rfkill_data->rf_kill;
@@ -137,7 +137,7 @@ static int __devexit rfkill_regulator_remove(struct platform_device *pdev)
 static struct platform_driver rfkill_regulator_driver = {
        .probe = rfkill_regulator_probe,
-        .remove = __devexit_p(rfkill_regulator_remove),
+        .remove = rfkill_regulator_remove,
        .driver = {
                .name = "rfkill-regulator",
                .owner = THIS_MODULE,
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index bf2dfd54ff3b..b5f69831e318 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -44,7 +44,7 @@ void cfg80211_chandef_create(struct cfg80211_chan_def *chandef,
 }
 EXPORT_SYMBOL(cfg80211_chandef_create);
-bool cfg80211_chan_def_valid(const struct cfg80211_chan_def *chandef)
+bool cfg80211_chandef_valid(const struct cfg80211_chan_def *chandef)
 {
        u32 control_freq;
@@ -105,6 +105,7 @@ bool cfg80211_chan_def_valid(const struct cfg80211_chan_def *chandef)
        return true;
 }
+EXPORT_SYMBOL(cfg80211_chandef_valid);
 static void chandef_primary_freqs(const struct cfg80211_chan_def *c,
                                  int *pri40, int *pri80)
@@ -187,9 +188,9 @@ cfg80211_chandef_compatible(const struct cfg80211_chan_def *c1,
 }
 EXPORT_SYMBOL(cfg80211_chandef_compatible);
-bool cfg80211_secondary_chans_ok(struct wiphy *wiphy,
+static bool cfg80211_secondary_chans_ok(struct wiphy *wiphy,
-                                 u32 center_freq, u32 bandwidth,
+                                        u32 center_freq, u32 bandwidth,
-                                 u32 prohibited_flags)
+                                        u32 prohibited_flags)
 {
        struct ieee80211_channel *c;
        u32 freq;
@@ -205,55 +206,88 @@ bool cfg80211_secondary_chans_ok(struct wiphy *wiphy,
        return true;
 }
-static bool cfg80211_check_beacon_chans(struct wiphy *wiphy,
+bool cfg80211_chandef_usable(struct wiphy *wiphy,
-                                        u32 center_freq, u32 bw)
+                             const struct cfg80211_chan_def *chandef,
+                             u32 prohibited_flags)
 {
-        return cfg80211_secondary_chans_ok(wiphy, center_freq, bw,
+        struct ieee80211_sta_ht_cap *ht_cap;
-                                           IEEE80211_CHAN_DISABLED |
+        struct ieee80211_sta_vht_cap *vht_cap;
-                                           IEEE80211_CHAN_PASSIVE_SCAN |
+        u32 width, control_freq;
-                                           IEEE80211_CHAN_NO_IBSS |
-                                           IEEE80211_CHAN_RADAR);
-}
-bool cfg80211_reg_can_beacon(struct wiphy *wiphy,
+        if (WARN_ON(!cfg80211_chandef_valid(chandef)))
-                             struct cfg80211_chan_def *chandef)
+                return false;
-{
-        u32 width;
-        bool res;
-        trace_cfg80211_reg_can_beacon(wiphy, chandef);
+        ht_cap = &wiphy->bands[chandef->chan->band]->ht_cap;
+        vht_cap = &wiphy->bands[chandef->chan->band]->vht_cap;
-        if (WARN_ON(!cfg80211_chan_def_valid(chandef))) {
+        control_freq = chandef->chan->center_freq;
-                trace_cfg80211_return_bool(false);
-                return false;
-        }
        switch (chandef->width) {
-        case NL80211_CHAN_WIDTH_20_NOHT:
        case NL80211_CHAN_WIDTH_20:
+                if (!ht_cap->ht_supported)
+                        return false;
+        case NL80211_CHAN_WIDTH_20_NOHT:
                width = 20;
                break;
        case NL80211_CHAN_WIDTH_40:
                width = 40;
+                if (!ht_cap->ht_supported)
+                        return false;
+                if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
+                    ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT)
+                        return false;
+                if (chandef->center_freq1 < control_freq &&
+                    chandef->chan->flags & IEEE80211_CHAN_NO_HT40MINUS)
+                        return false;
+                if (chandef->center_freq1 > control_freq &&
+                    chandef->chan->flags & IEEE80211_CHAN_NO_HT40PLUS)
+                        return false;
                break;
-        case NL80211_CHAN_WIDTH_80:
        case NL80211_CHAN_WIDTH_80P80:
+                if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ))
+                        return false;
+        case NL80211_CHAN_WIDTH_80:
+                if (!vht_cap->vht_supported)
+                        return false;
                width = 80;
                break;
        case NL80211_CHAN_WIDTH_160:
+                if (!vht_cap->vht_supported)
+                        return false;
+                if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ))
+                        return false;
                width = 160;
                break;
        default:
                WARN_ON_ONCE(1);
-                trace_cfg80211_return_bool(false);
                return false;
        }
-        res = cfg80211_check_beacon_chans(wiphy, chandef->center_freq1, width);
+        /* TODO: missing regulatory check on 80/160 bandwidth */
+        if (!cfg80211_secondary_chans_ok(wiphy, chandef->center_freq1,
+                                         width, prohibited_flags))
+                return false;
+        if (!chandef->center_freq2)
+                return true;
+        return cfg80211_secondary_chans_ok(wiphy, chandef->center_freq2,
+                                           width, prohibited_flags);
+}
+EXPORT_SYMBOL(cfg80211_chandef_usable);
+bool cfg80211_reg_can_beacon(struct wiphy *wiphy,
+                             struct cfg80211_chan_def *chandef)
+{
+        bool res;
+        trace_cfg80211_reg_can_beacon(wiphy, chandef);
-        if (res && chandef->center_freq2)
+        res = cfg80211_chandef_usable(wiphy, chandef,
-                res = cfg80211_check_beacon_chans(wiphy, chandef->center_freq2,
+                                      IEEE80211_CHAN_DISABLED |
-                                                  width);
+                                      IEEE80211_CHAN_PASSIVE_SCAN |
+                                      IEEE80211_CHAN_NO_IBSS |
+                                      IEEE80211_CHAN_RADAR);
        trace_cfg80211_return_bool(res);
        return res;
diff --git a/net/wireless/core.h b/net/wireless/core.h
index a0c8decf6a47..3563097169cb 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -138,8 +138,6 @@ struct cfg80211_internal_bss {
        unsigned long ts;
        struct kref ref;
        atomic_t hold;
-        bool beacon_ies_allocated;
-        bool proberesp_ies_allocated;
        /* must be last because of priv member */
        struct cfg80211_bss pub;
@@ -483,12 +481,6 @@ int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
 void cfg80211_update_iface_num(struct cfg80211_registered_device *rdev,
                               enum nl80211_iftype iftype, int num);
-bool cfg80211_chan_def_valid(const struct cfg80211_chan_def *chandef);
-bool cfg80211_secondary_chans_ok(struct wiphy *wiphy,
-                                 u32 center_freq, u32 bandwidth,
-                                 u32 prohibited_flags);
 #define CFG80211_MAX_NUM_DIFFERENT_CHANNELS 10
 #ifdef CONFIG_CFG80211_DEVELOPER_WARNINGS
diff --git a/net/wireless/mesh.c b/net/wireless/mesh.c
index 3ee5a7282283..f9d6ce5cfabb 100644
--- a/net/wireless/mesh.c
+++ b/net/wireless/mesh.c
@@ -146,7 +146,8 @@ int __cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
                if (!setup->chandef.chan)
                        return -EINVAL;
-                setup->chandef.width = NL80211_CHAN_WIDTH_20_NOHT;;
+                setup->chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
+                setup->chandef.center_freq1 = setup->chandef.chan->center_freq;
        }
        if (!cfg80211_reg_can_beacon(&rdev->wiphy, &setup->chandef))
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index d038fa45ecd1..f45706adaf34 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -363,6 +363,8 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
        [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
        [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
        [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
+        [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
+        [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 };
 /* policy for the key attributes */
@@ -1369,9 +1371,7 @@ static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
                                 struct genl_info *info,
                                 struct cfg80211_chan_def *chandef)
 {
-        struct ieee80211_sta_ht_cap *ht_cap;
+        u32 control_freq;
-        struct ieee80211_sta_vht_cap *vht_cap;
-        u32 control_freq, width;
        if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
                return -EINVAL;
@@ -1417,67 +1417,13 @@ static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
                                        info->attrs[NL80211_ATTR_CENTER_FREQ2]);
        }
-        ht_cap = &rdev->wiphy.bands[chandef->chan->band]->ht_cap;
+        if (!cfg80211_chandef_valid(chandef))
-        vht_cap = &rdev->wiphy.bands[chandef->chan->band]->vht_cap;
-        if (!cfg80211_chan_def_valid(chandef))
                return -EINVAL;
-        switch (chandef->width) {
+        if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
-        case NL80211_CHAN_WIDTH_20:
+                                     IEEE80211_CHAN_DISABLED))
-                if (!ht_cap->ht_supported)
-                        return -EINVAL;
-        case NL80211_CHAN_WIDTH_20_NOHT:
-                width = 20;
-                break;
-        case NL80211_CHAN_WIDTH_40:
-                width = 40;
-                /* quick early regulatory check */
-                if (chandef->center_freq1 < control_freq &&
-                    chandef->chan->flags & IEEE80211_CHAN_NO_HT40MINUS)
-                        return -EINVAL;
-                if (chandef->center_freq1 > control_freq &&
-                    chandef->chan->flags & IEEE80211_CHAN_NO_HT40PLUS)
-                        return -EINVAL;
-                if (!ht_cap->ht_supported)
-                        return -EINVAL;
-                if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
-                    ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT)
-                        return -EINVAL;
-                break;
-        case NL80211_CHAN_WIDTH_80:
-                width = 80;
-                if (!vht_cap->vht_supported)
-                        return -EINVAL;
-                break;
-        case NL80211_CHAN_WIDTH_80P80:
-                width = 80;
-                if (!vht_cap->vht_supported)
-                        return -EINVAL;
-                if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ))
-                        return -EINVAL;
-                break;
-        case NL80211_CHAN_WIDTH_160:
-                width = 160;
-                if (!vht_cap->vht_supported)
-                        return -EINVAL;
-                if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ))
-                        return -EINVAL;
-                break;
-        default:
-                return -EINVAL;
-        }
-        if (!cfg80211_secondary_chans_ok(&rdev->wiphy, chandef->center_freq1,
-                                         width, IEEE80211_CHAN_DISABLED))
-                return -EINVAL;
-        if (chandef->center_freq2 &&
-            !cfg80211_secondary_chans_ok(&rdev->wiphy, chandef->center_freq2,
-                                         width, IEEE80211_CHAN_DISABLED))
                return -EINVAL;
-        /* TODO: missing regulatory check on bandwidth */
        return 0;
 }
@@ -1841,7 +1787,7 @@ static inline u64 wdev_id(struct wireless_dev *wdev)
 static int nl80211_send_chandef(struct sk_buff *msg,
                                 struct cfg80211_chan_def *chandef)
 {
-        WARN_ON(!cfg80211_chan_def_valid(chandef));
+        WARN_ON(!cfg80211_chandef_valid(chandef));
        if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
                        chandef->chan->center_freq))
@@ -2732,6 +2678,32 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
                        info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
        }
+        if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
+                if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
+                        return -EINVAL;
+                params.p2p_ctwindow =
+                        nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
+                if (params.p2p_ctwindow > 127)
+                        return -EINVAL;
+                if (params.p2p_ctwindow != 0 &&
+                    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
+                        return -EINVAL;
+        }
+        if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
+                u8 tmp;
+                if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
+                        return -EINVAL;
+                tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
+                if (tmp > 1)
+                        return -EINVAL;
+                params.p2p_opp_ps = tmp;
+                if (params.p2p_opp_ps != 0 &&
+                    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
+                        return -EINVAL;
+        }
        if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
                err = nl80211_parse_chandef(rdev, info, &params.chandef);
                if (err)
@@ -3698,6 +3670,8 @@ static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
        params.use_short_slot_time = -1;
        params.ap_isolate = -1;
        params.ht_opmode = -1;
+        params.p2p_ctwindow = -1;
+        params.p2p_opp_ps = -1;
        if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
                params.use_cts_prot =
@@ -3720,6 +3694,32 @@ static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
                params.ht_opmode =
                        nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
+        if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
+                if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
+                        return -EINVAL;
+                params.p2p_ctwindow =
+                        nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
+                if (params.p2p_ctwindow < 0)
+                        return -EINVAL;
+                if (params.p2p_ctwindow != 0 &&
+                    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
+                        return -EINVAL;
+        }
+        if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
+                u8 tmp;
+                if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
+                        return -EINVAL;
+                tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
+                if (tmp > 1)
+                        return -EINVAL;
+                params.p2p_opp_ps = tmp;
+                if (params.p2p_opp_ps &&
+                    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
+                        return -EINVAL;
+        }
        if (!rdev->ops->change_bss)
                return -EOPNOTSUPP;
@@ -4808,6 +4808,7 @@ static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
                            struct cfg80211_internal_bss *intbss)
 {
        struct cfg80211_bss *res = &intbss->pub;
+        const struct cfg80211_bss_ies *ies;
        void *hdr;
        struct nlattr *bss;
@@ -4828,16 +4829,24 @@ static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
        if (!bss)
                goto nla_put_failure;
        if ((!is_zero_ether_addr(res->bssid) &&
-             nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)) ||
+             nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
-            (res->information_elements && res->len_information_elements &&
+                goto nla_put_failure;
-             nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
-                     res->len_information_elements,
+        rcu_read_lock();
-                     res->information_elements)) ||
+        ies = rcu_dereference(res->ies);
-            (res->beacon_ies && res->len_beacon_ies &&
+        if (ies && ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
-             res->beacon_ies != res->information_elements &&
+                                       ies->len, ies->data)) {
-             nla_put(msg, NL80211_BSS_BEACON_IES,
+                rcu_read_unlock();
-                     res->len_beacon_ies, res->beacon_ies)))
+                goto nla_put_failure;
+        }
+        ies = rcu_dereference(res->beacon_ies);
+        if (ies && ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
+                                       ies->len, ies->data)) {
+                rcu_read_unlock();
                goto nla_put_failure;
+        }
+        rcu_read_unlock();
        if (res->tsf &&
            nla_put_u64(msg, NL80211_BSS_TSF, res->tsf))
                goto nla_put_failure;
@@ -5502,6 +5511,7 @@ static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
                return -EINVAL;
        if (ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
            !(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
+                return -EINVAL;
        ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
        ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
@@ -6529,14 +6539,13 @@ nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
 };
 static int nl80211_set_cqm_txe(struct genl_info *info,
-                                u32 rate, u32 pkts, u32 intvl)
+                               u32 rate, u32 pkts, u32 intvl)
 {
        struct cfg80211_registered_device *rdev = info->user_ptr[0];
        struct wireless_dev *wdev;
        struct net_device *dev = info->user_ptr[1];
-        if ((rate < 0 || rate > 100) ||
+        if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
-            (intvl < 0 || intvl > NL80211_CQM_TXE_MAX_INTVL))
                return -EINVAL;
        wdev = dev->ieee80211_ptr;
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index b75756b05af7..6e5308998e30 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1796,7 +1796,7 @@ EXPORT_SYMBOL(regulatory_hint);
 */
 void regulatory_hint_11d(struct wiphy *wiphy,
                         enum ieee80211_band band,
-                         u8 *country_ie,
+                         const u8 *country_ie,
                         u8 country_ie_len)
 {
        char alpha2[2];
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index f023c8a31c60..4c0a32ffd530 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -81,7 +81,7 @@ int regulatory_hint_found_beacon(struct wiphy *wiphy,
 */
 void regulatory_hint_11d(struct wiphy *wiphy,
                         enum ieee80211_band band,
-                         u8 *country_ie,
+                         const u8 *country_ie,
                         u8 country_ie_len);
 /**
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 9596015975d2..01592d7d4789 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -23,18 +23,23 @@
 static void bss_release(struct kref *ref)
 {
+        struct cfg80211_bss_ies *ies;
        struct cfg80211_internal_bss *bss;
        bss = container_of(ref, struct cfg80211_internal_bss, ref);
+        if (WARN_ON(atomic_read(&bss->hold)))
+                return;
        if (bss->pub.free_priv)
                bss->pub.free_priv(&bss->pub);
-        if (bss->beacon_ies_allocated)
+        ies = (void *)rcu_access_pointer(bss->pub.beacon_ies);
-                kfree(bss->pub.beacon_ies);
+        if (ies)
-        if (bss->proberesp_ies_allocated)
+                kfree_rcu(ies, rcu_head);
-                kfree(bss->pub.proberesp_ies);
+        ies = (void *)rcu_access_pointer(bss->pub.proberesp_ies);
+        if (ies)
-        BUG_ON(atomic_read(&bss->hold));
+                kfree_rcu(ies, rcu_head);
        kfree(bss);
 }
@@ -236,9 +241,8 @@ void cfg80211_bss_age(struct cfg80211_registered_device *dev,
        struct cfg80211_internal_bss *bss;
        unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);
-        list_for_each_entry(bss, &dev->bss_list, list) {
+        list_for_each_entry(bss, &dev->bss_list, list)
                bss->ts -= age_jiffies;
-        }
 }
 void cfg80211_bss_expire(struct cfg80211_registered_device *dev)
@@ -287,7 +291,7 @@ const u8 *cfg80211_find_vendor_ie(unsigned int oui, u8 oui_type,
 }
 EXPORT_SYMBOL(cfg80211_find_vendor_ie);
-static int cmp_ies(u8 num, u8 *ies1, size_t len1, u8 *ies2, size_t len2)
+static int cmp_ies(u8 num, const u8 *ies1, int len1, const u8 *ies2, int len2)
 {
        const u8 *ie1 = cfg80211_find_ie(num, ies1, len1);
        const u8 *ie2 = cfg80211_find_ie(num, ies2, len2);
@@ -307,10 +311,10 @@ static int cmp_ies(u8 num, u8 *ies1, size_t len1, u8 *ies2, size_t len2)
        return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
 }
-static bool is_bss(struct cfg80211_bss *a,
+static bool is_bss(struct cfg80211_bss *a, const u8 *bssid,
-                   const u8 *bssid,
                   const u8 *ssid, size_t ssid_len)
 {
+        const struct cfg80211_bss_ies *ies;
        const u8 *ssidie;
        if (bssid && !ether_addr_equal(a->bssid, bssid))
@@ -319,9 +323,10 @@ static bool is_bss(struct cfg80211_bss *a,
        if (!ssid)
                return true;
-        ssidie = cfg80211_find_ie(WLAN_EID_SSID,
+        ies = rcu_access_pointer(a->ies);
-                                  a->information_elements,
+        if (!ies)
-                                  a->len_information_elements);
+                return false;
+        ssidie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
        if (!ssidie)
                return false;
        if (ssidie[1] != ssid_len)
@@ -331,20 +336,21 @@ static bool is_bss(struct cfg80211_bss *a,
 static bool is_mesh_bss(struct cfg80211_bss *a)
 {
+        const struct cfg80211_bss_ies *ies;
        const u8 *ie;
        if (!WLAN_CAPABILITY_IS_STA_BSS(a->capability))
                return false;
-        ie = cfg80211_find_ie(WLAN_EID_MESH_ID,
+        ies = rcu_access_pointer(a->ies);
-                              a->information_elements,
+        if (!ies)
-                              a->len_information_elements);
+                return false;
+        ie = cfg80211_find_ie(WLAN_EID_MESH_ID, ies->data, ies->len);
        if (!ie)
                return false;
-        ie = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
+        ie = cfg80211_find_ie(WLAN_EID_MESH_CONFIG, ies->data, ies->len);
-                              a->information_elements,
-                              a->len_information_elements);
        if (!ie)
                return false;
@@ -355,14 +361,17 @@ static bool is_mesh(struct cfg80211_bss *a,
                    const u8 *meshid, size_t meshidlen,
                    const u8 *meshcfg)
 {
+        const struct cfg80211_bss_ies *ies;
        const u8 *ie;
        if (!WLAN_CAPABILITY_IS_STA_BSS(a->capability))
                return false;
-        ie = cfg80211_find_ie(WLAN_EID_MESH_ID,
+        ies = rcu_access_pointer(a->ies);
-                              a->information_elements,
+        if (!ies)
-                              a->len_information_elements);
+                return false;
+        ie = cfg80211_find_ie(WLAN_EID_MESH_ID, ies->data, ies->len);
        if (!ie)
                return false;
        if (ie[1] != meshidlen)
@@ -370,9 +379,7 @@ static bool is_mesh(struct cfg80211_bss *a,
        if (memcmp(ie + 2, meshid, meshidlen))
                return false;
-        ie = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
+        ie = cfg80211_find_ie(WLAN_EID_MESH_CONFIG, ies->data, ies->len);
-                              a->information_elements,
-                              a->len_information_elements);
        if (!ie)
                return false;
        if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
@@ -384,30 +391,33 @@ static bool is_mesh(struct cfg80211_bss *a,
         * part in the same mesh.
         */
        return memcmp(ie + 2, meshcfg,
-            sizeof(struct ieee80211_meshconf_ie) - 2) == 0;
+                      sizeof(struct ieee80211_meshconf_ie) - 2) == 0;
 }
-static int cmp_bss_core(struct cfg80211_bss *a,
+static int cmp_bss_core(struct cfg80211_bss *a, struct cfg80211_bss *b)
-                        struct cfg80211_bss *b)
 {
+        const struct cfg80211_bss_ies *a_ies, *b_ies;
        int r;
        if (a->channel != b->channel)
                return b->channel->center_freq - a->channel->center_freq;
        if (is_mesh_bss(a) && is_mesh_bss(b)) {
+                a_ies = rcu_access_pointer(a->ies);
+                if (!a_ies)
+                        return -1;
+                b_ies = rcu_access_pointer(b->ies);
+                if (!b_ies)
+                        return 1;
                r = cmp_ies(WLAN_EID_MESH_ID,
-                            a->information_elements,
+                            a_ies->data, a_ies->len,
-                            a->len_information_elements,
+                            b_ies->data, b_ies->len);
-                            b->information_elements,
-                            b->len_information_elements);
                if (r)
                        return r;
                return cmp_ies(WLAN_EID_MESH_CONFIG,
-                               a->information_elements,
+                               a_ies->data, a_ies->len,
-                               a->len_information_elements,
+                               b_ies->data, b_ies->len);
-                               b->information_elements,
-                               b->len_information_elements);
        }
        /*
@@ -420,22 +430,28 @@ static int cmp_bss_core(struct cfg80211_bss *a,
 static int cmp_bss(struct cfg80211_bss *a,
                   struct cfg80211_bss *b)
 {
+        const struct cfg80211_bss_ies *a_ies, *b_ies;
        int r;
        r = cmp_bss_core(a, b);
        if (r)
                return r;
+        a_ies = rcu_access_pointer(a->ies);
+        if (!a_ies)
+                return -1;
+        b_ies = rcu_access_pointer(b->ies);
+        if (!b_ies)
+                return 1;
        return cmp_ies(WLAN_EID_SSID,
-                       a->information_elements,
+                       a_ies->data, a_ies->len,
-                       a->len_information_elements,
+                       b_ies->data, b_ies->len);
-                       b->information_elements,
-                       b->len_information_elements);
 }
-static int cmp_hidden_bss(struct cfg80211_bss *a,
+static int cmp_hidden_bss(struct cfg80211_bss *a, struct cfg80211_bss *b)
-                   struct cfg80211_bss *b)
 {
+        const struct cfg80211_bss_ies *a_ies, *b_ies;
        const u8 *ie1;
        const u8 *ie2;
        int i;
@@ -445,17 +461,26 @@ static int cmp_hidden_bss(struct cfg80211_bss *a,
        if (r)
                return r;
-        ie1 = cfg80211_find_ie(WLAN_EID_SSID,
+        a_ies = rcu_access_pointer(a->ies);
-                        a->information_elements,
+        if (!a_ies)
-                        a->len_information_elements);
+                return -1;
-        ie2 = cfg80211_find_ie(WLAN_EID_SSID,
+        b_ies = rcu_access_pointer(b->ies);
-                        b->information_elements,
+        if (!b_ies)
-                        b->len_information_elements);
+                return 1;
+        ie1 = cfg80211_find_ie(WLAN_EID_SSID, a_ies->data, a_ies->len);
+        ie2 = cfg80211_find_ie(WLAN_EID_SSID, b_ies->data, b_ies->len);
-        /* Key comparator must use same algorithm in any rb-tree
+        /*
+         * Key comparator must use same algorithm in any rb-tree
         * search function (order is important), otherwise ordering
         * of items in the tree is broken and search gives incorrect
-         * results. This code uses same order as cmp_ies() does. */
+         * results. This code uses same order as cmp_ies() does.
+         *
+         * Note that due to the differring behaviour with hidden SSIDs
+         * this function only works when "b" is the tree element and
+         * "a" is the key we're looking for.
+         */
        /* sort missing IE before (left of) present IE */
        if (!ie1)
@@ -471,10 +496,14 @@ static int cmp_hidden_bss(struct cfg80211_bss *a,
        if (ie1[1] != ie2[1])
                return ie2[1] - ie1[1];
-        /* zeroed SSID ie is another indication of a hidden bss */
+        /*
+         * zeroed SSID ie is another indication of a hidden bss;
+         * if it isn't zeroed just return the regular sort value
+         * to find the next candidate
+         */
        for (i = 0; i < ie2[1]; i++)
                if (ie2[i + 2])
-                        return -1;
+                        return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
        return 0;
 }
@@ -600,7 +629,7 @@ rb_find_bss(struct cfg80211_registered_device *dev,
 static struct cfg80211_internal_bss *
 rb_find_hidden_bss(struct cfg80211_registered_device *dev,
-            struct cfg80211_internal_bss *res)
+                   struct cfg80211_internal_bss *res)
 {
        struct rb_node *n = dev->bss_tree.rb_node;
        struct cfg80211_internal_bss *bss;
@@ -623,127 +652,86 @@ rb_find_hidden_bss(struct cfg80211_registered_device *dev,
 static void
 copy_hidden_ies(struct cfg80211_internal_bss *res,
-                 struct cfg80211_internal_bss *hidden)
+                struct cfg80211_internal_bss *hidden)
 {
-        if (unlikely(res->pub.beacon_ies))
+        const struct cfg80211_bss_ies *ies;
-                return;
-        if (WARN_ON(!hidden->pub.beacon_ies))
+        if (rcu_access_pointer(res->pub.beacon_ies))
                return;
-        res->pub.beacon_ies = kmalloc(hidden->pub.len_beacon_ies, GFP_ATOMIC);
+        ies = rcu_access_pointer(hidden->pub.beacon_ies);
-        if (unlikely(!res->pub.beacon_ies))
+        if (WARN_ON(!ies))
                return;
-        res->beacon_ies_allocated = true;
+        ies = kmemdup(ies, sizeof(*ies) + ies->len, GFP_ATOMIC);
-        res->pub.len_beacon_ies = hidden->pub.len_beacon_ies;
+        if (unlikely(!ies))
-        memcpy(res->pub.beacon_ies, hidden->pub.beacon_ies,
+                return;
-                        res->pub.len_beacon_ies);
+        rcu_assign_pointer(res->pub.beacon_ies, ies);
 }
 static struct cfg80211_internal_bss *
 cfg80211_bss_update(struct cfg80211_registered_device *dev,
-                    struct cfg80211_internal_bss *res)
+                    struct cfg80211_internal_bss *tmp)
 {
        struct cfg80211_internal_bss *found = NULL;
-        /*
+        if (WARN_ON(!tmp->pub.channel))
-         * The reference to "res" is donated to this function.
-         */
-        if (WARN_ON(!res->pub.channel)) {
-                kref_put(&res->ref, bss_release);
                return NULL;
-        }
-        res->ts = jiffies;
+        tmp->ts = jiffies;
        spin_lock_bh(&dev->bss_lock);
-        found = rb_find_bss(dev, res);
+        if (WARN_ON(!rcu_access_pointer(tmp->pub.ies))) {
+                spin_unlock_bh(&dev->bss_lock);
+                return NULL;
+        }
+        found = rb_find_bss(dev, tmp);
        if (found) {
-                found->pub.beacon_interval = res->pub.beacon_interval;
+                found->pub.beacon_interval = tmp->pub.beacon_interval;
-                found->pub.tsf = res->pub.tsf;
+                found->pub.tsf = tmp->pub.tsf;
-                found->pub.signal = res->pub.signal;
+                found->pub.signal = tmp->pub.signal;
-                found->pub.capability = res->pub.capability;
+                found->pub.capability = tmp->pub.capability;
-                found->ts = res->ts;
+                found->ts = tmp->ts;
                /* Update IEs */
-                if (res->pub.proberesp_ies) {
+                if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
-                        size_t used = dev->wiphy.bss_priv_size + sizeof(*res);
+                        const struct cfg80211_bss_ies *old;
-                        size_t ielen = res->pub.len_proberesp_ies;
-                        if (found->pub.proberesp_ies &&
-                            !found->proberesp_ies_allocated &&
-                            ksize(found) >= used + ielen) {
-                                memcpy(found->pub.proberesp_ies,
-                                       res->pub.proberesp_ies, ielen);
-                                found->pub.len_proberesp_ies = ielen;
-                        } else {
-                                u8 *ies = found->pub.proberesp_ies;
-                                if (found->proberesp_ies_allocated)
-                                        ies = krealloc(ies, ielen, GFP_ATOMIC);
-                                else
-                                        ies = kmalloc(ielen, GFP_ATOMIC);
-                                if (ies) {
-                                        memcpy(ies, res->pub.proberesp_ies,
-                                               ielen);
-                                        found->proberesp_ies_allocated = true;
-                                        found->pub.proberesp_ies = ies;
-                                        found->pub.len_proberesp_ies = ielen;
-                                }
-                        }
+                        old = rcu_access_pointer(found->pub.proberesp_ies);
+                        rcu_assign_pointer(found->pub.proberesp_ies,
+                                           tmp->pub.proberesp_ies);
                        /* Override possible earlier Beacon frame IEs */
-                        found->pub.information_elements =
+                        rcu_assign_pointer(found->pub.ies,
-                                found->pub.proberesp_ies;
+                                           tmp->pub.proberesp_ies);
-                        found->pub.len_information_elements =
+                        if (old)
-                                found->pub.len_proberesp_ies;
+                                kfree_rcu((struct cfg80211_bss_ies *)old,
-                }
+                                          rcu_head);
-                if (res->pub.beacon_ies) {
+                } else if (rcu_access_pointer(tmp->pub.beacon_ies)) {
-                        size_t used = dev->wiphy.bss_priv_size + sizeof(*res);
+                        const struct cfg80211_bss_ies *old, *ies;
-                        size_t ielen = res->pub.len_beacon_ies;
-                        bool information_elements_is_beacon_ies =
+                        old = rcu_access_pointer(found->pub.beacon_ies);
-                                (found->pub.information_elements ==
+                        ies = rcu_access_pointer(found->pub.ies);
-                                 found->pub.beacon_ies);
+                        rcu_assign_pointer(found->pub.beacon_ies,
-                        if (found->pub.beacon_ies &&
+                                           tmp->pub.beacon_ies);
-                            !found->beacon_ies_allocated &&
-                            ksize(found) >= used + ielen) {
-                                memcpy(found->pub.beacon_ies,
-                                       res->pub.beacon_ies, ielen);
-                                found->pub.len_beacon_ies = ielen;
-                        } else {
-                                u8 *ies = found->pub.beacon_ies;
-                                if (found->beacon_ies_allocated)
-                                        ies = krealloc(ies, ielen, GFP_ATOMIC);
-                                else
-                                        ies = kmalloc(ielen, GFP_ATOMIC);
-                                if (ies) {
-                                        memcpy(ies, res->pub.beacon_ies,
-                                               ielen);
-                                        found->beacon_ies_allocated = true;
-                                        found->pub.beacon_ies = ies;
-                                        found->pub.len_beacon_ies = ielen;
-                                }
-                        }
                        /* Override IEs if they were from a beacon before */
-                        if (information_elements_is_beacon_ies) {
+                        if (old == ies)
-                                found->pub.information_elements =
+                                rcu_assign_pointer(found->pub.ies,
-                                        found->pub.beacon_ies;
+                                                   tmp->pub.beacon_ies);
-                                found->pub.len_information_elements =
-                                        found->pub.len_beacon_ies;
-                        }
-                }
-                kref_put(&res->ref, bss_release);
+                        if (old)
+                                kfree_rcu((struct cfg80211_bss_ies *)old,
+                                          rcu_head);
+                }
        } else {
+                struct cfg80211_internal_bss *new;
                struct cfg80211_internal_bss *hidden;
+                struct cfg80211_bss_ies *ies;
                /* First check if the beacon is a probe response from
                 * a hidden bss. If so, copy beacon ies (with nullified
@@ -754,14 +742,32 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                /* TODO: The code is not trying to update existing probe
                 * response bss entries when beacon ies are
                 * getting changed. */
-                hidden = rb_find_hidden_bss(dev, res);
+                hidden = rb_find_hidden_bss(dev, tmp);
                if (hidden)
-                        copy_hidden_ies(res, hidden);
+                        copy_hidden_ies(tmp, hidden);
-                /* this "consumes" the reference */
+                /*
-                list_add_tail(&res->list, &dev->bss_list);
+                 * create a copy -- the "res" variable that is passed in
-                rb_insert_bss(dev, res);
+                 * is allocated on the stack since it's not needed in the
-                found = res;
+                 * more common case of an update
+                 */
+                new = kzalloc(sizeof(*new) + dev->wiphy.bss_priv_size,
+                              GFP_ATOMIC);
+                if (!new) {
+                        ies = (void *)rcu_dereference(tmp->pub.beacon_ies);
+                        if (ies)
+                                kfree_rcu(ies, rcu_head);
+                        ies = (void *)rcu_dereference(tmp->pub.proberesp_ies);
+                        if (ies)
+                                kfree_rcu(ies, rcu_head);
+                        spin_unlock_bh(&dev->bss_lock);
+                        return NULL;
+                }
+                memcpy(new, tmp, sizeof(*new));
+                kref_init(&new->ref);
+                list_add_tail(&new->list, &dev->bss_list);
+                rb_insert_bss(dev, new);
+                found = new;
        }
        dev->bss_generation++;
@@ -810,14 +816,12 @@ cfg80211_inform_bss(struct wiphy *wiphy,
                    u16 beacon_interval, const u8 *ie, size_t ielen,
                    s32 signal, gfp_t gfp)
 {
-        struct cfg80211_internal_bss *res;
+        struct cfg80211_bss_ies *ies;
-        size_t privsz;
+        struct cfg80211_internal_bss tmp = {}, *res;
        if (WARN_ON(!wiphy))
                return NULL;
-        privsz = wiphy->bss_priv_size;
        if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
                        (signal < 0 || signal > 100)))
                return NULL;
@@ -826,36 +830,33 @@ cfg80211_inform_bss(struct wiphy *wiphy,
        if (!channel)
                return NULL;
-        res = kzalloc(sizeof(*res) + privsz + ielen, gfp);
+        memcpy(tmp.pub.bssid, bssid, ETH_ALEN);
-        if (!res)
+        tmp.pub.channel = channel;
-                return NULL;
+        tmp.pub.signal = signal;
+        tmp.pub.tsf = tsf;
-        memcpy(res->pub.bssid, bssid, ETH_ALEN);
+        tmp.pub.beacon_interval = beacon_interval;
-        res->pub.channel = channel;
+        tmp.pub.capability = capability;
-        res->pub.signal = signal;
-        res->pub.tsf = tsf;
-        res->pub.beacon_interval = beacon_interval;
-        res->pub.capability = capability;
        /*
         * Since we do not know here whether the IEs are from a Beacon or Probe
         * Response frame, we need to pick one of the options and only use it
         * with the driver that does not provide the full Beacon/Probe Response
         * frame. Use Beacon frame pointer to avoid indicating that this should
-         * override the information_elements pointer should we have received an
+         * override the iies pointer should we have received an earlier
-         * earlier indication of Probe Response data.
+         * indication of Probe Response data.
         *
         * The initial buffer for the IEs is allocated with the BSS entry and
         * is located after the private area.
         */
-        res->pub.beacon_ies = (u8 *)res + sizeof(*res) + privsz;
+        ies = kmalloc(sizeof(*ies) + ielen, gfp);
-        memcpy(res->pub.beacon_ies, ie, ielen);
+        if (!ies)
-        res->pub.len_beacon_ies = ielen;
+                return NULL;
-        res->pub.information_elements = res->pub.beacon_ies;
+        ies->len = ielen;
-        res->pub.len_information_elements = res->pub.len_beacon_ies;
+        memcpy(ies->data, ie, ielen);
-        kref_init(&res->ref);
+        rcu_assign_pointer(tmp.pub.beacon_ies, ies);
+        rcu_assign_pointer(tmp.pub.ies, ies);
-        res = cfg80211_bss_update(wiphy_to_dev(wiphy), res);
+        res = cfg80211_bss_update(wiphy_to_dev(wiphy), &tmp);
        if (!res)
                return NULL;
@@ -874,10 +875,10 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
                          struct ieee80211_mgmt *mgmt, size_t len,
                          s32 signal, gfp_t gfp)
 {
-        struct cfg80211_internal_bss *res;
+        struct cfg80211_internal_bss tmp = {}, *res;
+        struct cfg80211_bss_ies *ies;
        size_t ielen = len - offsetof(struct ieee80211_mgmt,
                                      u.probe_resp.variable);
-        size_t privsz;
        BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) !=
                        offsetof(struct ieee80211_mgmt, u.beacon.variable));
@@ -897,45 +898,31 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
        if (WARN_ON(len < offsetof(struct ieee80211_mgmt, u.probe_resp.variable)))
                return NULL;
-        privsz = wiphy->bss_priv_size;
        channel = cfg80211_get_bss_channel(wiphy, mgmt->u.beacon.variable,
                                           ielen, channel);
        if (!channel)
                return NULL;
-        res = kzalloc(sizeof(*res) + privsz + ielen, gfp);
+        ies = kmalloc(sizeof(*ies) + ielen, gfp);
-        if (!res)
+        if (!ies)
                return NULL;
+        ies->len = ielen;
+        memcpy(ies->data, mgmt->u.probe_resp.variable, ielen);
-        memcpy(res->pub.bssid, mgmt->bssid, ETH_ALEN);
+        if (ieee80211_is_probe_resp(mgmt->frame_control))
-        res->pub.channel = channel;
+                rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
-        res->pub.signal = signal;
+        else
-        res->pub.tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
+                rcu_assign_pointer(tmp.pub.beacon_ies, ies);
-        res->pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
+        rcu_assign_pointer(tmp.pub.ies, ies);
-        res->pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
+        
-        /*
+        memcpy(tmp.pub.bssid, mgmt->bssid, ETH_ALEN);
-         * The initial buffer for the IEs is allocated with the BSS entry and
+        tmp.pub.channel = channel;
-         * is located after the private area.
+        tmp.pub.signal = signal;
-         */
+        tmp.pub.tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
-        if (ieee80211_is_probe_resp(mgmt->frame_control)) {
+        tmp.pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
-                res->pub.proberesp_ies = (u8 *) res + sizeof(*res) + privsz;
+        tmp.pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
-                memcpy(res->pub.proberesp_ies, mgmt->u.probe_resp.variable,
-                       ielen);
+        res = cfg80211_bss_update(wiphy_to_dev(wiphy), &tmp);
-                res->pub.len_proberesp_ies = ielen;
-                res->pub.information_elements = res->pub.proberesp_ies;
-                res->pub.len_information_elements = res->pub.len_proberesp_ies;
-        } else {
-                res->pub.beacon_ies = (u8 *) res + sizeof(*res) + privsz;
-                memcpy(res->pub.beacon_ies, mgmt->u.beacon.variable, ielen);
-                res->pub.len_beacon_ies = ielen;
-                res->pub.information_elements = res->pub.beacon_ies;
-                res->pub.len_information_elements = res->pub.len_beacon_ies;
-        }
-        kref_init(&res->ref);
-        res = cfg80211_bss_update(wiphy_to_dev(wiphy), res);
        if (!res)
                return NULL;
@@ -1127,22 +1114,21 @@ int cfg80211_wext_siwscan(struct net_device *dev,
 EXPORT_SYMBOL_GPL(cfg80211_wext_siwscan);
 static void ieee80211_scan_add_ies(struct iw_request_info *info,
-                                   struct cfg80211_bss *bss,
+                                   const struct cfg80211_bss_ies *ies,
                                   char **current_ev, char *end_buf)
 {
-        u8 *pos, *end, *next;
+        const u8 *pos, *end, *next;
        struct iw_event iwe;
-        if (!bss->information_elements ||
+        if (!ies)
-            !bss->len_information_elements)
                return;
        /*
         * If needed, fragment the IEs buffer (at IE boundaries) into short
         * enough fragments to fit into IW_GENERIC_IE_MAX octet messages.
         */
-        pos = bss->information_elements;
+        pos = ies->data;
-        end = pos + bss->len_information_elements;
+        end = pos + ies->len;
        while (end - pos > IW_GENERIC_IE_MAX) {
                next = pos + 2 + pos[1];
@@ -1153,7 +1139,8 @@ static void ieee80211_scan_add_ies(struct iw_request_info *info,
                iwe.cmd = IWEVGENIE;
                iwe.u.data.length = next - pos;
                *current_ev = iwe_stream_add_point(info, *current_ev,
-                                                   end_buf, &iwe, pos);
+                                                   end_buf, &iwe,
+                                                   (void *)pos);
                pos = next;
        }
@@ -1163,7 +1150,8 @@ static void ieee80211_scan_add_ies(struct iw_request_info *info,
                iwe.cmd = IWEVGENIE;
                iwe.u.data.length = end - pos;
                *current_ev = iwe_stream_add_point(info, *current_ev,
-                                                   end_buf, &iwe, pos);
+                                                   end_buf, &iwe,
+                                                   (void *)pos);
        }
 }
@@ -1182,10 +1170,11 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
              struct cfg80211_internal_bss *bss, char *current_ev,
              char *end_buf)
 {
+        const struct cfg80211_bss_ies *ies;
        struct iw_event iwe;
+        const u8 *ie;
        u8 *buf, *cfg, *p;
-        u8 *ie = bss->pub.information_elements;
+        int rem, i, sig;
-        int rem = bss->pub.len_information_elements, i, sig;
        bool ismesh = false;
        memset(&iwe, 0, sizeof(iwe));
@@ -1250,7 +1239,17 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
        current_ev = iwe_stream_add_point(info, current_ev, end_buf,
                                          &iwe, "");
-        while (rem >= 2) {
+        rcu_read_lock();
+        ies = rcu_dereference(bss->pub.ies);
+        if (ies) {
+                rem = ies->len;
+                ie = ies->data;
+        } else {
+                rem = 0;
+                ie = NULL;
+        }
+        while (ies && rem >= 2) {
                /* invalid data */
                if (ie[1] > rem - 2)
                        break;
@@ -1262,7 +1261,7 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
                        iwe.u.data.length = ie[1];
                        iwe.u.data.flags = 1;
                        current_ev = iwe_stream_add_point(info, current_ev, end_buf,
-                                                          &iwe, ie + 2);
+                                                          &iwe, (u8 *)ie + 2);
                        break;
                case WLAN_EID_MESH_ID:
                        memset(&iwe, 0, sizeof(iwe));
@@ -1270,7 +1269,7 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
                        iwe.u.data.length = ie[1];
                        iwe.u.data.flags = 1;
                        current_ev = iwe_stream_add_point(info, current_ev, end_buf,
-                                                          &iwe, ie + 2);
+                                                          &iwe, (u8 *)ie + 2);
                        break;
                case WLAN_EID_MESH_CONFIG:
                        ismesh = true;
@@ -1279,7 +1278,7 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
                        buf = kmalloc(50, GFP_ATOMIC);
                        if (!buf)
                                break;
-                        cfg = ie + 2;
+                        cfg = (u8 *)ie + 2;
                        memset(&iwe, 0, sizeof(iwe));
                        iwe.cmd = IWEVCUSTOM;
                        sprintf(buf, "Mesh Network Path Selection Protocol ID: "
@@ -1377,7 +1376,8 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
                kfree(buf);
        }
-        ieee80211_scan_add_ies(info, &bss->pub, &current_ev, end_buf);
+        ieee80211_scan_add_ies(info, ies, &current_ev, end_buf);
+        rcu_read_unlock();
        return current_ev;
 }
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index c7490027237d..f2431e41a373 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -417,7 +417,7 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                               struct cfg80211_bss *bss)
 {
        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        u8 *country_ie;
+        const u8 *country_ie;
 #ifdef CONFIG_CFG80211_WEXT
        union iwreq_data wrqu;
 #endif
@@ -501,7 +501,15 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
        wdev->sme_state = CFG80211_SME_CONNECTED;
        cfg80211_upload_connect_keys(wdev);
-        country_ie = (u8 *) ieee80211_bss_get_ie(bss, WLAN_EID_COUNTRY);
+        rcu_read_lock();
+        country_ie = ieee80211_bss_get_ie(bss, WLAN_EID_COUNTRY);
+        if (!country_ie) {
+                rcu_read_unlock();
+                return;
+        }
+        country_ie = kmemdup(country_ie, 2 + country_ie[1], GFP_ATOMIC);
+        rcu_read_unlock();
        if (!country_ie)
                return;
@@ -515,6 +523,7 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                            bss->channel->band,
                            country_ie + 2,
                            country_ie[1]);
+        kfree(country_ie);
 }
 void cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 3cce6e486219..16d76a807c2f 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -688,10 +688,13 @@ EXPORT_SYMBOL(cfg80211_classify8021d);
 const u8 *ieee80211_bss_get_ie(struct cfg80211_bss *bss, u8 ie)
 {
-        if (bss->information_elements == NULL)
+        const struct cfg80211_bss_ies *ies;
+        ies = rcu_dereference(bss->ies);
+        if (!ies)
                return NULL;
-        return cfg80211_find_ie(ie, bss->information_elements,
-                                 bss->len_information_elements);
+        return cfg80211_find_ie(ie, ies->data, ies->len);
 }
 EXPORT_SYMBOL(ieee80211_bss_get_ie);
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
index 873af63187c0..fb9622f6d99c 100644
--- a/net/wireless/wext-sme.c
+++ b/net/wireless/wext-sme.c
@@ -242,13 +242,17 @@ int cfg80211_mgd_wext_giwessid(struct net_device *dev,
        wdev_lock(wdev);
        if (wdev->current_bss) {
-                const u8 *ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
+                const u8 *ie;
-                                                    WLAN_EID_SSID);
+                rcu_read_lock();
+                ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
+                                          WLAN_EID_SSID);
                if (ie) {
                        data->flags = 1;
                        data->length = ie[1];
                        memcpy(ssid, ie + 2, data->length);
                }
+                rcu_read_unlock();
        } else if (wdev->wext.connect.ssid && wdev->wext.connect.ssid_len) {
                data->flags = 1;
                data->length = wdev->wext.connect.ssid_len;