334 files changed, 6736 insertions, 3455 deletions

diff --git a/Documentation/DocBook/80211.tmpl b/Documentation/DocBook/80211.tmpl
index 49267ea97568..f403ec3c5c9a 100644
--- a/Documentation/DocBook/80211.tmpl
+++ b/Documentation/DocBook/80211.tmpl
@@ -325,6 +325,7 @@
           <title>functions/definitions</title>
 !Finclude/net/mac80211.h ieee80211_rx_status
 !Finclude/net/mac80211.h mac80211_rx_flags
+!Finclude/net/mac80211.h mac80211_tx_info_flags
 !Finclude/net/mac80211.h mac80211_tx_control_flags
 !Finclude/net/mac80211.h mac80211_rate_control_flags
 !Finclude/net/mac80211.h ieee80211_tx_rate
diff --git a/MAINTAINERS b/MAINTAINERS
index b2887c5424d1..705bb96bc37e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -5792,7 +5792,7 @@ M:	Aloisio Almeida Jr <aloisio.almeida@openbossa.org>
 M:      Samuel Ortiz <sameo@linux.intel.com>
 L:      linux-wireless@vger.kernel.org
 L:      linux-nfc@lists.01.org (moderated for non-subscribers)
-S:      Maintained
+S:      Supported
 F:      net/nfc/
 F:      include/net/nfc/
 F:      include/uapi/linux/nfc.h
diff --git a/drivers/bcma/driver_pci.c b/drivers/bcma/driver_pci.c
index cf7a476a519f..c9fd6943ce45 100644
--- a/drivers/bcma/driver_pci.c
+++ b/drivers/bcma/driver_pci.c
@@ -31,7 +31,7 @@ static void bcma_pcie_write(struct bcma_drv_pci *pc, u32 address, u32 data)
         pcicore_write32(pc, BCMA_CORE_PCI_PCIEIND_DATA, data);
 }
 
-static void bcma_pcie_mdio_set_phy(struct bcma_drv_pci *pc, u8 phy)
+static void bcma_pcie_mdio_set_phy(struct bcma_drv_pci *pc, u16 phy)
 {
         u32 v;
         int i;
@@ -55,7 +55,7 @@ static void bcma_pcie_mdio_set_phy(struct bcma_drv_pci *pc, u8 phy)
         }
 }
 
-static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u8 device, u8 address)
+static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u16 device, u8 address)
 {
         int max_retries = 10;
         u16 ret = 0;
@@ -98,7 +98,7 @@ static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u8 device, u8 address)
         return ret;
 }
 
-static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u8 device,
+static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u16 device,
                                 u8 address, u16 data)
 {
         int max_retries = 10;
@@ -137,6 +137,13 @@ static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u8 device,
         pcicore_write32(pc, BCMA_CORE_PCI_MDIO_CONTROL, 0);
 }
 
+static u16 bcma_pcie_mdio_writeread(struct bcma_drv_pci *pc, u16 device,
+                                    u8 address, u16 data)
+{
+        bcma_pcie_mdio_write(pc, device, address, data);
+        return bcma_pcie_mdio_read(pc, device, address);
+}
+
 /**************************************************
  * Workarounds.
  **************************************************/
@@ -203,6 +210,25 @@ static void bcma_core_pci_config_fixup(struct bcma_drv_pci *pc)
         }
 }
 
+static void bcma_core_pci_power_save(struct bcma_drv_pci *pc, bool up)
+{
+        u16 data;
+
+        if (pc->core->id.rev >= 15 && pc->core->id.rev <= 20) {
+                data = up ? 0x74 : 0x7C;
+                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
+                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT1, 0x7F64);
+                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
+                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT3, data);
+        } else if (pc->core->id.rev >= 21 && pc->core->id.rev <= 22) {
+                data = up ? 0x75 : 0x7D;
+                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
+                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT1, 0x7E65);
+                bcma_pcie_mdio_writeread(pc, BCMA_CORE_PCI_MDIO_BLK1,
+                                         BCMA_CORE_PCI_MDIO_BLK1_MGMT3, data);
+        }
+}
+
 /**************************************************
  * Init.
  **************************************************/
@@ -262,7 +288,7 @@ out:
 }
 EXPORT_SYMBOL_GPL(bcma_core_pci_irq_ctl);
 
-void bcma_core_pci_extend_L1timer(struct bcma_drv_pci *pc, bool extend)
+static void bcma_core_pci_extend_L1timer(struct bcma_drv_pci *pc, bool extend)
 {
         u32 w;
 
@@ -274,4 +300,33 @@ void bcma_core_pci_extend_L1timer(struct bcma_drv_pci *pc, bool extend)
         bcma_pcie_write(pc, BCMA_CORE_PCI_DLLP_PMTHRESHREG, w);
         bcma_pcie_read(pc, BCMA_CORE_PCI_DLLP_PMTHRESHREG);
 }
-EXPORT_SYMBOL_GPL(bcma_core_pci_extend_L1timer);
+
+void bcma_core_pci_up(struct bcma_bus *bus)
+{
+        struct bcma_drv_pci *pc;
+
+        if (bus->hosttype != BCMA_HOSTTYPE_PCI)
+                return;
+
+        pc = &bus->drv_pci[0];
+
+        bcma_core_pci_power_save(pc, true);
+
+        bcma_core_pci_extend_L1timer(pc, true);
+}
+EXPORT_SYMBOL_GPL(bcma_core_pci_up);
+
+void bcma_core_pci_down(struct bcma_bus *bus)
+{
+        struct bcma_drv_pci *pc;
+
+        if (bus->hosttype != BCMA_HOSTTYPE_PCI)
+                return;
+
+        pc = &bus->drv_pci[0];
+
+        bcma_core_pci_extend_L1timer(pc, false);
+
+        bcma_core_pci_power_save(pc, false);
+}
+EXPORT_SYMBOL_GPL(bcma_core_pci_down);
diff --git a/drivers/bcma/driver_pci_host.c b/drivers/bcma/driver_pci_host.c
index 30629a3d44cc..c3d7b03c2fdc 100644
--- a/drivers/bcma/driver_pci_host.c
+++ b/drivers/bcma/driver_pci_host.c
@@ -581,6 +581,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_ANY_ID, PCI_ANY_ID, bcma_core_pci_fixup_addresses);
 int bcma_core_pci_plat_dev_init(struct pci_dev *dev)
 {
         struct bcma_drv_pci_host *pc_host;
+        int readrq;
 
         if (dev->bus->ops->read != bcma_core_pci_hostmode_read_config) {
                 /* This is not a device on the PCI-core bridge. */
@@ -595,6 +596,11 @@ int bcma_core_pci_plat_dev_init(struct pci_dev *dev)
         dev->irq = bcma_core_irq(pc_host->pdev->core);
         pci_write_config_byte(dev, PCI_INTERRUPT_LINE, dev->irq);
 
+        readrq = pcie_get_readrq(dev);
+        if (readrq > 128) {
+                pr_info("change PCIe max read request size from %i to 128\n", readrq);
+                pcie_set_readrq(dev, 128);
+        }
         return 0;
 }
 EXPORT_SYMBOL(bcma_core_pci_plat_dev_init);
diff --git a/drivers/bluetooth/btmrvl_debugfs.c b/drivers/bluetooth/btmrvl_debugfs.c
index db2c3c305df8..023d35e3c7a7 100644
--- a/drivers/bluetooth/btmrvl_debugfs.c
+++ b/drivers/bluetooth/btmrvl_debugfs.c
@@ -43,7 +43,7 @@ static ssize_t btmrvl_hscfgcmd_write(struct file *file,
         if (copy_from_user(&buf, ubuf, min_t(size_t, sizeof(buf) - 1, count)))
                 return -EFAULT;
 
-        ret = strict_strtol(buf, 10, &result);
+        ret = kstrtol(buf, 10, &result);
         if (ret)
                 return ret;
 
@@ -89,7 +89,7 @@ static ssize_t btmrvl_pscmd_write(struct file *file, const char __user *ubuf,
         if (copy_from_user(&buf, ubuf, min_t(size_t, sizeof(buf) - 1, count)))
                 return -EFAULT;
 
-        ret = strict_strtol(buf, 10, &result);
+        ret = kstrtol(buf, 10, &result);
         if (ret)
                 return ret;
 
@@ -135,7 +135,7 @@ static ssize_t btmrvl_hscmd_write(struct file *file, const char __user *ubuf,
         if (copy_from_user(&buf, ubuf, min_t(size_t, sizeof(buf) - 1, count)))
                 return -EFAULT;
 
-        ret = strict_strtol(buf, 10, &result);
+        ret = kstrtol(buf, 10, &result);
         if (ret)
                 return ret;
 
diff --git a/drivers/bluetooth/btmrvl_sdio.c b/drivers/bluetooth/btmrvl_sdio.c
index 75c262694632..00da6df9f71e 100644
--- a/drivers/bluetooth/btmrvl_sdio.c
+++ b/drivers/bluetooth/btmrvl_sdio.c
@@ -486,7 +486,7 @@ static int btmrvl_sdio_download_fw_w_helper(struct btmrvl_sdio_card *card)
                         if (firmwarelen - offset < txlen)
                                 txlen = firmwarelen - offset;
 
-                        tx_blocks = (txlen + blksz_dl - 1) / blksz_dl;
+                        tx_blocks = DIV_ROUND_UP(txlen, blksz_dl);
 
                         memcpy(fwbuf, &firmware[offset], txlen);
                 }
@@ -873,7 +873,7 @@ static int btmrvl_sdio_host_to_card(struct btmrvl_private *priv,
         }
 
         blksz = SDIO_BLOCK_SIZE;
-        buf_block_len = (nb + blksz - 1) / blksz;
+        buf_block_len = DIV_ROUND_UP(nb, blksz);
 
         sdio_claim_host(card->func);
 
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 90102652c82a..0d8f427ade93 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -2514,17 +2514,13 @@ int bond_3ad_lacpdu_recv(const struct sk_buff *skb, struct bonding *bond,
  */
 void bond_3ad_update_lacp_rate(struct bonding *bond)
 {
-        struct slave *slave;
         struct port *port = NULL;
+        struct slave *slave;
         int lacp_fast;
 
-        write_lock_bh(&bond->lock);
         lacp_fast = bond->params.lacp_fast;
-
         bond_for_each_slave(bond, slave) {
                 port = &(SLAVE_AD_INFO(slave).port);
-                if (port->slave == NULL)
-                        continue;
                 __get_state_machine_lock(port);
                 if (lacp_fast)
                         port->actor_oper_port_state |= AD_STATE_LACP_TIMEOUT;
@@ -2532,6 +2528,4 @@ void bond_3ad_update_lacp_rate(struct bonding *bond)
                         port->actor_oper_port_state &= ~AD_STATE_LACP_TIMEOUT;
                 __release_state_machine_lock(port);
         }
-
-        write_unlock_bh(&bond->lock);
 }
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 018235263596..91f179d5135c 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -512,7 +512,7 @@ static void rlb_update_client(struct rlb_client_info *client_info)
 
                 skb->dev = client_info->slave->dev;
 
-                if (client_info->tag) {
+                if (client_info->vlan_id) {
                         skb = vlan_put_tag(skb, htons(ETH_P_8021Q), client_info->vlan_id);
                         if (!skb) {
                                 pr_err("%s: Error: failed to insert VLAN tag\n",
@@ -694,10 +694,8 @@ static struct slave *rlb_choose_channel(struct sk_buff *skb, struct bonding *bon
                         client_info->ntt = 0;
                 }
 
-                if (bond_vlan_used(bond)) {
-                        if (!vlan_get_tag(skb, &client_info->vlan_id))
-                                client_info->tag = 1;
-                }
+                if (!vlan_get_tag(skb, &client_info->vlan_id))
+                        client_info->vlan_id = 0;
 
                 if (!client_info->assigned) {
                         u32 prev_tbl_head = bond_info->rx_hashtbl_used_head;
@@ -803,7 +801,7 @@ static void rlb_init_table_entry_dst(struct rlb_client_info *entry)
         entry->used_prev = RLB_NULL_INDEX;
         entry->assigned = 0;
         entry->slave = NULL;
-        entry->tag = 0;
+        entry->vlan_id = 0;
 }
 static void rlb_init_table_entry_src(struct rlb_client_info *entry)
 {
@@ -960,7 +958,7 @@ static void rlb_clear_vlan(struct bonding *bond, unsigned short vlan_id)
                 struct rlb_client_info *curr = &(bond_info->rx_hashtbl[curr_index]);
                 u32 next_index = bond_info->rx_hashtbl[curr_index].used_next;
 
-                if (curr->tag && (curr->vlan_id == vlan_id))
+                if (curr->vlan_id == vlan_id)
                         rlb_delete_table_entry(bond, curr_index);
 
                 curr_index = next_index;
diff --git a/drivers/net/bonding/bond_alb.h b/drivers/net/bonding/bond_alb.h
index e02c9c558c41..28d8e4c7dc06 100644
--- a/drivers/net/bonding/bond_alb.h
+++ b/drivers/net/bonding/bond_alb.h
@@ -125,7 +125,6 @@ struct rlb_client_info {
         u8  assigned;           /* checking whether this entry is assigned */
         u8  ntt;                /* flag - need to transmit client info */
         struct slave *slave;    /* the slave assigned to this client */
-        u8 tag;                 /* flag - need to tag skb */
         unsigned short vlan_id; /* VLAN tag associated with IP address */
 };
 
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index c50679f0a6b6..39e5b1c7ffe2 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -828,7 +828,6 @@ static bool bond_should_notify_peers(struct bonding *bond)
             test_bit(__LINK_STATE_LINKWATCH_PENDING, &slave->dev->state))
                 return false;
 
-        bond->send_peer_notif--;
         return true;
 }
 
@@ -1085,18 +1084,16 @@ static void bond_netpoll_cleanup(struct net_device *bond_dev)
 /*---------------------------------- IOCTL ----------------------------------*/
 
 static netdev_features_t bond_fix_features(struct net_device *dev,
-        netdev_features_t features)
+                                           netdev_features_t features)
 {
-        struct slave *slave;
         struct bonding *bond = netdev_priv(dev);
         netdev_features_t mask;
-
-        read_lock(&bond->lock);
+        struct slave *slave;
 
         if (list_empty(&bond->slave_list)) {
                 /* Disable adding VLANs to empty bond. But why? --mq */
                 features |= NETIF_F_VLAN_CHALLENGED;
-                goto out;
+                return features;
         }
 
         mask = features;
@@ -1110,8 +1107,6 @@ static netdev_features_t bond_fix_features(struct net_device *dev,
         }
         features = netdev_add_tso_features(features, mask);
 
-out:
-        read_unlock(&bond->lock);
         return features;
 }
 
@@ -1121,15 +1116,13 @@ out:
 
 static void bond_compute_features(struct bonding *bond)
 {
-        struct slave *slave;
-        struct net_device *bond_dev = bond->dev;
+        unsigned int flags, dst_release_flag = IFF_XMIT_DST_RELEASE;
         netdev_features_t vlan_features = BOND_VLAN_FEATURES;
         unsigned short max_hard_header_len = ETH_HLEN;
         unsigned int gso_max_size = GSO_MAX_SIZE;
+        struct net_device *bond_dev = bond->dev;
         u16 gso_max_segs = GSO_MAX_SEGS;
-        unsigned int flags, dst_release_flag = IFF_XMIT_DST_RELEASE;
-
-        read_lock(&bond->lock);
+        struct slave *slave;
 
         if (list_empty(&bond->slave_list))
                 goto done;
@@ -1155,8 +1148,6 @@ done:
         flags = bond_dev->priv_flags & ~IFF_XMIT_DST_RELEASE;
         bond_dev->priv_flags = flags | dst_release_flag;
 
-        read_unlock(&bond->lock);
-
         netdev_change_features(bond_dev);
 }
 
@@ -2259,12 +2250,8 @@ re_arm:
         read_unlock(&bond->lock);
 
         if (should_notify_peers) {
-                if (!rtnl_trylock()) {
-                        read_lock(&bond->lock);
-                        bond->send_peer_notif++;
-                        read_unlock(&bond->lock);
+                if (!rtnl_trylock())
                         return;
-                }
                 call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, bond->dev);
                 rtnl_unlock();
         }
@@ -2876,12 +2863,8 @@ re_arm:
         read_unlock(&bond->lock);
 
         if (should_notify_peers) {
-                if (!rtnl_trylock()) {
-                        read_lock(&bond->lock);
-                        bond->send_peer_notif++;
-                        read_unlock(&bond->lock);
+                if (!rtnl_trylock())
                         return;
-                }
                 call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, bond->dev);
                 rtnl_unlock();
         }
@@ -2916,6 +2899,10 @@ static int bond_master_netdev_event(unsigned long event,
         case NETDEV_REGISTER:
                 bond_create_proc_entry(event_bond);
                 break;
+        case NETDEV_NOTIFY_PEERS:
+                if (event_bond->send_peer_notif)
+                        event_bond->send_peer_notif--;
+                break;
         default:
                 break;
         }
@@ -3213,17 +3200,10 @@ static int bond_close(struct net_device *bond_dev)
 {
         struct bonding *bond = netdev_priv(bond_dev);
 
-        write_lock_bh(&bond->lock);
-        bond->send_peer_notif = 0;
-        write_unlock_bh(&bond->lock);
-
         bond_work_cancel_all(bond);
-        if (bond_is_lb(bond)) {
-                /* Must be called only after all
-                 * slaves have been released
-                 */
+        bond->send_peer_notif = 0;
+        if (bond_is_lb(bond))
                 bond_alb_deinitialize(bond);
-        }
         bond->recv_probe = NULL;
 
         return 0;
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 0f539de640dc..ce4677668e2c 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -852,8 +852,11 @@ static ssize_t bonding_store_lacp(struct device *d,
                                   struct device_attribute *attr,
                                   const char *buf, size_t count)
 {
-        int new_value, ret = count;
         struct bonding *bond = to_bond(d);
+        int new_value, ret = count;
+
+        if (!rtnl_trylock())
+                return restart_syscall();
 
         if (bond->dev->flags & IFF_UP) {
                 pr_err("%s: Unable to update LACP rate because interface is up.\n",
@@ -883,6 +886,8 @@ static ssize_t bonding_store_lacp(struct device *d,
                 ret = -EINVAL;
         }
 out:
+        rtnl_unlock();
+
         return ret;
 }
 static DEVICE_ATTR(lacp_rate, S_IRUGO | S_IWUSR,
diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
index 4abc925823e1..f7ab16185f68 100644
--- a/drivers/net/bonding/bonding.h
+++ b/drivers/net/bonding/bonding.h
@@ -261,24 +261,6 @@ struct bonding {
 #endif /* CONFIG_DEBUG_FS */
 };
 
-/* if we hold rtnl_lock() - call vlan_uses_dev() */
-static inline bool bond_vlan_used(struct bonding *bond)
-{
-        struct net_device *upper;
-        struct list_head *iter;
-
-        rcu_read_lock();
-        netdev_for_each_upper_dev_rcu(bond->dev, upper, iter) {
-                if (upper->priv_flags & IFF_802_1Q_VLAN) {
-                        rcu_read_unlock();
-                        return true;
-                }
-        }
-        rcu_read_unlock();
-
-        return false;
-}
-
 #define bond_slave_get_rcu(dev) \
         ((struct slave *) rcu_dereference(dev->rx_handler_data))
 
diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c
index 34dea95d58db..88a6a5810ec6 100644
--- a/drivers/net/caif/caif_serial.c
+++ b/drivers/net/caif/caif_serial.c
@@ -347,7 +347,9 @@ static int ldisc_open(struct tty_struct *tty)
         /* release devices to avoid name collision */
         ser_release(NULL);
 
-        sprintf(name, "cf%s", tty->name);
+        result = snprintf(name, sizeof(name), "cf%s", tty->name);
+        if (result >= IFNAMSIZ)
+                return -EINVAL;
         dev = alloc_netdev(sizeof(*ser), name, caifdev_setup);
         if (!dev)
                 return -ENOMEM;
diff --git a/drivers/net/can/mscan/mpc5xxx_can.c b/drivers/net/can/mscan/mpc5xxx_can.c
index 5b0ee8ef5885..e59b3a392af6 100644
--- a/drivers/net/can/mscan/mpc5xxx_can.c
+++ b/drivers/net/can/mscan/mpc5xxx_can.c
@@ -40,6 +40,7 @@ struct mpc5xxx_can_data {
         unsigned int type;
         u32 (*get_clock)(struct platform_device *ofdev, const char *clock_name,
                          int *mscan_clksrc);
+        void (*put_clock)(struct platform_device *ofdev);
 };
 
 #ifdef CONFIG_PPC_MPC52xx
@@ -148,7 +149,10 @@ static u32 mpc512x_can_get_clock(struct platform_device *ofdev,
                 goto exit_put;
         }
 
-        /* Determine the MSCAN device index from the physical address */
+        /* Determine the MSCAN device index from the peripheral's
+         * physical address. Register address offsets against the
+         * IMMR base are:  0x1300, 0x1380, 0x2300, 0x2380
+         */
         pval = of_get_property(ofdev->dev.of_node, "reg", &plen);
         BUG_ON(!pval || plen < sizeof(*pval));
         clockidx = (*pval & 0x80) ? 1 : 0;
@@ -177,7 +181,7 @@ static u32 mpc512x_can_get_clock(struct platform_device *ofdev,
                         clockdiv = 1;
 
                 if (!clock_name || !strcmp(clock_name, "sys")) {
-                        sys_clk = clk_get(&ofdev->dev, "sys_clk");
+                        sys_clk = devm_clk_get(&ofdev->dev, "sys_clk");
                         if (IS_ERR(sys_clk)) {
                                 dev_err(&ofdev->dev, "couldn't get sys_clk\n");
                                 goto exit_unmap;
@@ -200,7 +204,7 @@ static u32 mpc512x_can_get_clock(struct platform_device *ofdev,
                 }
 
                 if (clocksrc < 0) {
-                        ref_clk = clk_get(&ofdev->dev, "ref_clk");
+                        ref_clk = devm_clk_get(&ofdev->dev, "ref_clk");
                         if (IS_ERR(ref_clk)) {
                                 dev_err(&ofdev->dev, "couldn't get ref_clk\n");
                                 goto exit_unmap;
@@ -277,6 +281,8 @@ static int mpc5xxx_can_probe(struct platform_device *ofdev)
         dev = alloc_mscandev();
         if (!dev)
                 goto exit_dispose_irq;
+        platform_set_drvdata(ofdev, dev);
+        SET_NETDEV_DEV(dev, &ofdev->dev);
 
         priv = netdev_priv(dev);
         priv->reg_base = base;
@@ -293,8 +299,6 @@ static int mpc5xxx_can_probe(struct platform_device *ofdev)
                 goto exit_free_mscan;
         }
 
-        SET_NETDEV_DEV(dev, &ofdev->dev);
-
         err = register_mscandev(dev, mscan_clksrc);
         if (err) {
                 dev_err(&ofdev->dev, "registering %s failed (err=%d)\n",
@@ -302,8 +306,6 @@ static int mpc5xxx_can_probe(struct platform_device *ofdev)
                 goto exit_free_mscan;
         }
 
-        platform_set_drvdata(ofdev, dev);
-
         dev_info(&ofdev->dev, "MSCAN at 0x%p, irq %d, clock %d Hz\n",
                  priv->reg_base, dev->irq, priv->can.clock.freq);
 
@@ -321,10 +323,17 @@ exit_unmap_mem:
 
 static int mpc5xxx_can_remove(struct platform_device *ofdev)
 {
+        const struct of_device_id *match;
+        const struct mpc5xxx_can_data *data;
         struct net_device *dev = platform_get_drvdata(ofdev);
         struct mscan_priv *priv = netdev_priv(dev);
 
+        match = of_match_device(mpc5xxx_can_table, &ofdev->dev);
+        data = match ? match->data : NULL;
+
         unregister_mscandev(dev);
+        if (data && data->put_clock)
+                data->put_clock(ofdev);
         iounmap(priv->reg_base);
         irq_dispose_mapping(dev->irq);
         free_candev(dev);
diff --git a/drivers/net/can/mscan/mscan.c b/drivers/net/can/mscan/mscan.c
index e6b40954e204..a955ec8c4b97 100644
--- a/drivers/net/can/mscan/mscan.c
+++ b/drivers/net/can/mscan/mscan.c
@@ -573,10 +573,21 @@ static int mscan_open(struct net_device *dev)
         struct mscan_priv *priv = netdev_priv(dev);
         struct mscan_regs __iomem *regs = priv->reg_base;
 
+        if (priv->clk_ipg) {
+                ret = clk_prepare_enable(priv->clk_ipg);
+                if (ret)
+                        goto exit_retcode;
+        }
+        if (priv->clk_can) {
+                ret = clk_prepare_enable(priv->clk_can);
+                if (ret)
+                        goto exit_dis_ipg_clock;
+        }
+
         /* common open */
         ret = open_candev(dev);
         if (ret)
-                return ret;
+                goto exit_dis_can_clock;
 
         napi_enable(&priv->napi);
 
@@ -604,6 +615,13 @@ exit_free_irq:
 exit_napi_disable:
         napi_disable(&priv->napi);
         close_candev(dev);
+exit_dis_can_clock:
+        if (priv->clk_can)
+                clk_disable_unprepare(priv->clk_can);
+exit_dis_ipg_clock:
+        if (priv->clk_ipg)
+                clk_disable_unprepare(priv->clk_ipg);
+exit_retcode:
         return ret;
 }
 
@@ -621,6 +639,11 @@ static int mscan_close(struct net_device *dev)
         close_candev(dev);
         free_irq(dev->irq, dev);
 
+        if (priv->clk_can)
+                clk_disable_unprepare(priv->clk_can);
+        if (priv->clk_ipg)
+                clk_disable_unprepare(priv->clk_ipg);
+
         return 0;
 }
 
diff --git a/drivers/net/can/mscan/mscan.h b/drivers/net/can/mscan/mscan.h
index af2ed8baf0a3..9c24d60a23b1 100644
--- a/drivers/net/can/mscan/mscan.h
+++ b/drivers/net/can/mscan/mscan.h
@@ -21,6 +21,7 @@
 #ifndef __MSCAN_H__
 #define __MSCAN_H__
 
+#include <linux/clk.h>
 #include <linux/types.h>
 
 /* MSCAN control register 0 (CANCTL0) bits */
@@ -283,6 +284,8 @@ struct mscan_priv {
         unsigned int type;      /* MSCAN type variants */
         unsigned long flags;
         void __iomem *reg_base; /* ioremap'ed address to registers */
+        struct clk *clk_ipg;    /* clock for registers */
+        struct clk *clk_can;    /* clock for bitrates */
         u8 shadow_statflg;
         u8 shadow_canrier;
         u8 cur_pri;
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index 4f8a5357cedc..8142480d9770 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -1184,6 +1184,7 @@ error:
 static int cnic_alloc_bnx2x_context(struct cnic_dev *dev)
 {
         struct cnic_local *cp = dev->cnic_priv;
+        struct bnx2x *bp = netdev_priv(dev->netdev);
         int ctx_blk_size = cp->ethdev->ctx_blk_size;
         int total_mem, blks, i;
 
@@ -1201,7 +1202,7 @@ static int cnic_alloc_bnx2x_context(struct cnic_dev *dev)
 
         cp->ctx_blks = blks;
         cp->ctx_blk_size = ctx_blk_size;
-        if (!BNX2X_CHIP_IS_57710(cp->chip_id))
+        if (!CHIP_IS_E1(bp))
                 cp->ctx_align = 0;
         else
                 cp->ctx_align = ctx_blk_size;
@@ -1231,6 +1232,7 @@ static int cnic_alloc_bnx2x_context(struct cnic_dev *dev)
 static int cnic_alloc_bnx2x_resc(struct cnic_dev *dev)
 {
         struct cnic_local *cp = dev->cnic_priv;
+        struct bnx2x *bp = netdev_priv(dev->netdev);
         struct cnic_eth_dev *ethdev = cp->ethdev;
         u32 start_cid = ethdev->starting_cid;
         int i, j, n, ret, pages;
@@ -1240,7 +1242,7 @@ static int cnic_alloc_bnx2x_resc(struct cnic_dev *dev)
         cp->iscsi_start_cid = start_cid;
         cp->fcoe_start_cid = start_cid + MAX_ISCSI_TBL_SZ;
 
-        if (BNX2X_CHIP_IS_E2_PLUS(cp->chip_id)) {
+        if (BNX2X_CHIP_IS_E2_PLUS(bp)) {
                 cp->max_cid_space += dev->max_fcoe_conn;
                 cp->fcoe_init_cid = ethdev->fcoe_init_cid;
                 if (!cp->fcoe_init_cid)
@@ -1288,7 +1290,7 @@ static int cnic_alloc_bnx2x_resc(struct cnic_dev *dev)
         if (ret)
                 goto error;
 
-        if (CNIC_SUPPORTS_FCOE(cp)) {
+        if (CNIC_SUPPORTS_FCOE(bp)) {
                 ret = cnic_alloc_kcq(dev, &cp->kcq2, true);
                 if (ret)
                         goto error;
@@ -1382,6 +1384,7 @@ static int cnic_submit_kwqe_16(struct cnic_dev *dev, u32 cmd, u32 cid,
                                 u32 type, union l5cm_specific_data *l5_data)
 {
         struct cnic_local *cp = dev->cnic_priv;
+        struct bnx2x *bp = netdev_priv(dev->netdev);
         struct l5cm_spe kwqe;
         struct kwqe_16 *kwq[1];
         u16 type_16;
@@ -1389,10 +1392,10 @@ static int cnic_submit_kwqe_16(struct cnic_dev *dev, u32 cmd, u32 cid,
 
         kwqe.hdr.conn_and_cmd_data =
                 cpu_to_le32(((cmd << SPE_HDR_CMD_ID_SHIFT) |
-                             BNX2X_HW_CID(cp, cid)));
+                             BNX2X_HW_CID(bp, cid)));
 
         type_16 = (type << SPE_HDR_CONN_TYPE_SHIFT) & SPE_HDR_CONN_TYPE;
-        type_16 |= (cp->pfid << SPE_HDR_FUNCTION_ID_SHIFT) &
+        type_16 |= (bp->pfid << SPE_HDR_FUNCTION_ID_SHIFT) &
                    SPE_HDR_FUNCTION_ID;
 
         kwqe.hdr.type = cpu_to_le16(type_16);
@@ -1430,7 +1433,6 @@ static void cnic_reply_bnx2x_kcqes(struct cnic_dev *dev, int ulp_type,
 static void cnic_bnx2x_set_tcp_options(struct cnic_dev *dev, int time_stamps,
                                        int en_tcp_dack)
 {
-        struct cnic_local *cp = dev->cnic_priv;
         struct bnx2x *bp = netdev_priv(dev->netdev);
         u8 xstorm_flags = XSTORM_L5CM_TCP_FLAGS_WND_SCL_EN;
         u16 tstorm_flags = 0;
@@ -1443,10 +1445,10 @@ static void cnic_bnx2x_set_tcp_options(struct cnic_dev *dev, int time_stamps,
                 tstorm_flags |= TSTORM_L5CM_TCP_FLAGS_DELAYED_ACK_EN;
 
         CNIC_WR8(dev, BAR_XSTRORM_INTMEM +
-                 XSTORM_ISCSI_TCP_VARS_FLAGS_OFFSET(cp->pfid), xstorm_flags);
+                 XSTORM_ISCSI_TCP_VARS_FLAGS_OFFSET(bp->pfid), xstorm_flags);
 
         CNIC_WR16(dev, BAR_TSTRORM_INTMEM +
-                  TSTORM_ISCSI_TCP_VARS_FLAGS_OFFSET(cp->pfid), tstorm_flags);
+                  TSTORM_ISCSI_TCP_VARS_FLAGS_OFFSET(bp->pfid), tstorm_flags);
 }
 
 static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
@@ -1455,7 +1457,7 @@ static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
         struct bnx2x *bp = netdev_priv(dev->netdev);
         struct iscsi_kwqe_init1 *req1 = (struct iscsi_kwqe_init1 *) kwqe;
         int hq_bds, pages;
-        u32 pfid = cp->pfid;
+        u32 pfid = bp->pfid;
 
         cp->num_iscsi_tasks = req1->num_tasks_per_conn;
         cp->num_ccells = req1->num_ccells_per_conn;
@@ -1538,9 +1540,8 @@ static int cnic_bnx2x_iscsi_init1(struct cnic_dev *dev, struct kwqe *kwqe)
 static int cnic_bnx2x_iscsi_init2(struct cnic_dev *dev, struct kwqe *kwqe)
 {
         struct iscsi_kwqe_init2 *req2 = (struct iscsi_kwqe_init2 *) kwqe;
-        struct cnic_local *cp = dev->cnic_priv;
         struct bnx2x *bp = netdev_priv(dev->netdev);
-        u32 pfid = cp->pfid;
+        u32 pfid = bp->pfid;
         struct iscsi_kcqe kcqe;
         struct kcqe *cqes[1];
 
@@ -1679,6 +1680,7 @@ static int cnic_setup_bnx2x_ctx(struct cnic_dev *dev, struct kwqe *wqes[],
                                 u32 num)
 {
         struct cnic_local *cp = dev->cnic_priv;
+        struct bnx2x *bp = netdev_priv(dev->netdev);
         struct iscsi_kwqe_conn_offload1 *req1 =
                         (struct iscsi_kwqe_conn_offload1 *) wqes[0];
         struct iscsi_kwqe_conn_offload2 *req2 =
@@ -1687,11 +1689,11 @@ static int cnic_setup_bnx2x_ctx(struct cnic_dev *dev, struct kwqe *wqes[],
         struct cnic_context *ctx = &cp->ctx_tbl[req1->iscsi_conn_id];
         struct cnic_iscsi *iscsi = ctx->proto.iscsi;
         u32 cid = ctx->cid;
-        u32 hw_cid = BNX2X_HW_CID(cp, cid);
+        u32 hw_cid = BNX2X_HW_CID(bp, cid);
         struct iscsi_context *ictx;
         struct regpair context_addr;
         int i, j, n = 2, n_max;
-        u8 port = CNIC_PORT(cp);
+        u8 port = BP_PORT(bp);
 
         ctx->ctx_flags = 0;
         if (!req2->num_additional_wqes)
@@ -1745,8 +1747,8 @@ static int cnic_setup_bnx2x_ctx(struct cnic_dev *dev, struct kwqe *wqes[],
                 XSTORM_ISCSI_CONTEXT_FLAGS_B_INITIAL_R2T;
         ictx->xstorm_st_context.common.ethernet.reserved_vlan_type =
                 ETH_P_8021Q;
-        if (BNX2X_CHIP_IS_E2_PLUS(cp->chip_id) &&
-                cp->port_mode == CHIP_2_PORT_MODE) {
+        if (BNX2X_CHIP_IS_E2_PLUS(bp) &&
+            bp->common.chip_port_mode == CHIP_2_PORT_MODE) {
 
                 port = 0;
         }
@@ -1867,6 +1869,7 @@ static int cnic_bnx2x_iscsi_ofld1(struct cnic_dev *dev, struct kwqe *wqes[],
         struct iscsi_kwqe_conn_offload1 *req1;
         struct iscsi_kwqe_conn_offload2 *req2;
         struct cnic_local *cp = dev->cnic_priv;
+        struct bnx2x *bp = netdev_priv(dev->netdev);
         struct cnic_context *ctx;
         struct iscsi_kcqe kcqe;
         struct kcqe *cqes[1];
@@ -1920,7 +1923,7 @@ static int cnic_bnx2x_iscsi_ofld1(struct cnic_dev *dev, struct kwqe *wqes[],
         }
 
         kcqe.completion_status = ISCSI_KCQE_COMPLETION_STATUS_SUCCESS;
-        kcqe.iscsi_conn_context_id = BNX2X_HW_CID(cp, cp->ctx_tbl[l5_cid].cid);
+        kcqe.iscsi_conn_context_id = BNX2X_HW_CID(bp, cp->ctx_tbl[l5_cid].cid);
 
 done:
         cqes[0] = (struct kcqe *) &kcqe;
@@ -1956,6 +1959,7 @@ static int cnic_bnx2x_iscsi_update(struct cnic_dev *dev, struct kwqe *kwqe)
 static int cnic_bnx2x_destroy_ramrod(struct cnic_dev *dev, u32 l5_cid)
 {
         struct cnic_local *cp = dev->cnic_priv;
+        struct bnx2x *bp = netdev_priv(dev->netdev);
         struct cnic_context *ctx = &cp->ctx_tbl[l5_cid];
         union l5cm_specific_data l5_data;
         int ret;
@@ -1964,7 +1968,7 @@ static int cnic_bnx2x_destroy_ramrod(struct cnic_dev *dev, u32 l5_cid)
         init_waitqueue_head(&ctx->waitq);
         ctx->wait_cond = 0;
         memset(&l5_data, 0, sizeof(l5_data));
-        hw_cid = BNX2X_HW_CID(cp, ctx->cid);
+        hw_cid = BNX2X_HW_CID(bp, ctx->cid);
 
         ret = cnic_submit_kwqe_16(dev, RAMROD_CMD_ID_COMMON_CFC_DEL,
                                   hw_cid, NONE_CONNECTION_TYPE, &l5_data);
@@ -2072,9 +2076,8 @@ static void cnic_init_storm_conn_bufs(struct cnic_dev *dev,
 
 static void cnic_init_bnx2x_mac(struct cnic_dev *dev)
 {
-        struct cnic_local *cp = dev->cnic_priv;
         struct bnx2x *bp = netdev_priv(dev->netdev);
-        u32 pfid = cp->pfid;
+        u32 pfid = bp->pfid;
         u8 *mac = dev->mac_addr;
 
         CNIC_WR8(dev, BAR_XSTRORM_INTMEM +
@@ -2180,7 +2183,7 @@ static int cnic_bnx2x_connect(struct cnic_dev *dev, struct kwqe *wqes[],
         cnic_init_storm_conn_bufs(dev, kwqe1, kwqe3, conn_buf);
 
         CNIC_WR16(dev, BAR_XSTRORM_INTMEM +
-                  XSTORM_ISCSI_LOCAL_VLAN_OFFSET(cp->pfid), csk->vlan_id);
+                  XSTORM_ISCSI_LOCAL_VLAN_OFFSET(bp->pfid), csk->vlan_id);
 
         ret = cnic_submit_kwqe_16(dev, L5CM_RAMROD_CMD_ID_TCP_CONNECT,
                         kwqe1->cid, ISCSI_CONNECTION_TYPE, &l5_data);
@@ -2249,11 +2252,12 @@ static int cnic_bnx2x_fcoe_stat(struct cnic_dev *dev, struct kwqe *kwqe)
         struct fcoe_stat_ramrod_params *fcoe_stat;
         union l5cm_specific_data l5_data;
         struct cnic_local *cp = dev->cnic_priv;
+        struct bnx2x *bp = netdev_priv(dev->netdev);
         int ret;
         u32 cid;
 
         req = (struct fcoe_kwqe_stat *) kwqe;
-        cid = BNX2X_HW_CID(cp, cp->fcoe_init_cid);
+        cid = BNX2X_HW_CID(bp, cp->fcoe_init_cid);
 
         fcoe_stat = cnic_get_kwqe_16_data(cp, BNX2X_FCOE_L5_CID_BASE, &l5_data);
         if (!fcoe_stat)
@@ -2272,6 +2276,7 @@ static int cnic_bnx2x_fcoe_init1(struct cnic_dev *dev, struct kwqe *wqes[],
 {
         int ret;
         struct cnic_local *cp = dev->cnic_priv;
+        struct bnx2x *bp = netdev_priv(dev->netdev);
         u32 cid;
         struct fcoe_init_ramrod_params *fcoe_init;
         struct fcoe_kwqe_init1 *req1;
@@ -2316,7 +2321,7 @@ static int cnic_bnx2x_fcoe_init1(struct cnic_dev *dev, struct kwqe *wqes[],
         fcoe_init->sb_id = HC_INDEX_FCOE_EQ_CONS;
         cp->kcq2.sw_prod_idx = 0;
 
-        cid = BNX2X_HW_CID(cp, cp->fcoe_init_cid);
+        cid = BNX2X_HW_CID(bp, cp->fcoe_init_cid);
         ret = cnic_submit_kwqe_16(dev, FCOE_RAMROD_CMD_ID_INIT_FUNC, cid,
                                   FCOE_CONNECTION_TYPE, &l5_data);
         *work = 3;
@@ -2329,6 +2334,7 @@ static int cnic_bnx2x_fcoe_ofld1(struct cnic_dev *dev, struct kwqe *wqes[],
         int ret = 0;
         u32 cid = -1, l5_cid;
         struct cnic_local *cp = dev->cnic_priv;
+        struct bnx2x *bp = netdev_priv(dev->netdev);
         struct fcoe_kwqe_conn_offload1 *req1;
         struct fcoe_kwqe_conn_offload2 *req2;
         struct fcoe_kwqe_conn_offload3 *req3;
@@ -2371,7 +2377,7 @@ static int cnic_bnx2x_fcoe_ofld1(struct cnic_dev *dev, struct kwqe *wqes[],
 
         fctx = cnic_get_bnx2x_ctx(dev, cid, 1, &ctx_addr);
         if (fctx) {
-                u32 hw_cid = BNX2X_HW_CID(cp, cid);
+                u32 hw_cid = BNX2X_HW_CID(bp, cid);
                 u32 val;
 
                 val = CDU_RSRVD_VALUE_TYPE_A(hw_cid, CDU_REGION_NUMBER_XCM_AG,
@@ -2395,7 +2401,7 @@ static int cnic_bnx2x_fcoe_ofld1(struct cnic_dev *dev, struct kwqe *wqes[],
         memcpy(&fcoe_offload->offload_kwqe3, req3, sizeof(*req3));
         memcpy(&fcoe_offload->offload_kwqe4, req4, sizeof(*req4));
 
-        cid = BNX2X_HW_CID(cp, cid);
+        cid = BNX2X_HW_CID(bp, cid);
         ret = cnic_submit_kwqe_16(dev, FCOE_RAMROD_CMD_ID_OFFLOAD_CONN, cid,
                                   FCOE_CONNECTION_TYPE, &l5_data);
         if (!ret)
@@ -2553,13 +2559,14 @@ static int cnic_bnx2x_fcoe_fw_destroy(struct cnic_dev *dev, struct kwqe *kwqe)
         struct fcoe_kwqe_destroy *req;
         union l5cm_specific_data l5_data;
         struct cnic_local *cp = dev->cnic_priv;
+        struct bnx2x *bp = netdev_priv(dev->netdev);
         int ret;
         u32 cid;
 
         cnic_bnx2x_delete_wait(dev, MAX_ISCSI_TBL_SZ);
 
         req = (struct fcoe_kwqe_destroy *) kwqe;
-        cid = BNX2X_HW_CID(cp, cp->fcoe_init_cid);
+        cid = BNX2X_HW_CID(bp, cp->fcoe_init_cid);
 
         memset(&l5_data, 0, sizeof(l5_data));
         ret = cnic_submit_kwqe_16(dev, FCOE_RAMROD_CMD_ID_DESTROY_FUNC, cid,
@@ -2716,7 +2723,7 @@ static int cnic_submit_bnx2x_iscsi_kwqes(struct cnic_dev *dev,
 static int cnic_submit_bnx2x_fcoe_kwqes(struct cnic_dev *dev,
                                         struct kwqe *wqes[], u32 num_wqes)
 {
-        struct cnic_local *cp = dev->cnic_priv;
+        struct bnx2x *bp = netdev_priv(dev->netdev);
         int i, work, ret;
         u32 opcode;
         struct kwqe *kwqe;
@@ -2724,7 +2731,7 @@ static int cnic_submit_bnx2x_fcoe_kwqes(struct cnic_dev *dev,
         if (!test_bit(CNIC_F_CNIC_UP, &dev->flags))
                 return -EAGAIN;         /* bnx2 is down */
 
-        if (!BNX2X_CHIP_IS_E2_PLUS(cp->chip_id))
+        if (!BNX2X_CHIP_IS_E2_PLUS(bp))
                 return -EINVAL;
 
         for (i = 0; i < num_wqes; ) {
@@ -3040,8 +3047,8 @@ static irqreturn_t cnic_irq(int irq, void *dev_instance)
 static inline void cnic_ack_bnx2x_int(struct cnic_dev *dev, u8 id, u8 storm,
                                       u16 index, u8 op, u8 update)
 {
-        struct cnic_local *cp = dev->cnic_priv;
-        u32 hc_addr = (HC_REG_COMMAND_REG + CNIC_PORT(cp) * 32 +
+        struct bnx2x *bp = netdev_priv(dev->netdev);
+        u32 hc_addr = (HC_REG_COMMAND_REG + BP_PORT(bp) * 32 +
                        COMMAND_REG_INT_ACK);
         struct igu_ack_register igu_ack;
 
@@ -4218,10 +4225,9 @@ static void cnic_cm_stop_bnx2x_hw(struct cnic_dev *dev)
 
 static int cnic_cm_init_bnx2x_hw(struct cnic_dev *dev)
 {
-        struct cnic_local *cp = dev->cnic_priv;
         struct bnx2x *bp = netdev_priv(dev->netdev);
-        u32 pfid = cp->pfid;
-        u32 port = CNIC_PORT(cp);
+        u32 pfid = bp->pfid;
+        u32 port = BP_PORT(bp);
 
         cnic_init_bnx2x_mac(dev);
         cnic_bnx2x_set_tcp_options(dev, 0, 1);
@@ -4902,6 +4908,7 @@ static void cnic_init_bnx2x_tx_ring(struct cnic_dev *dev,
                                     struct client_init_ramrod_data *data)
 {
         struct cnic_local *cp = dev->cnic_priv;
+        struct bnx2x *bp = netdev_priv(dev->netdev);
         struct cnic_uio_dev *udev = cp->udev;
         union eth_tx_bd_types *txbd = (union eth_tx_bd_types *) udev->l2_ring;
         dma_addr_t buf_map, ring_map = udev->l2_ring_map;
@@ -4930,7 +4937,7 @@ static void cnic_init_bnx2x_tx_ring(struct cnic_dev *dev,
                 start_bd->general_data &= ~ETH_TX_START_BD_PARSE_NBDS;
                 start_bd->general_data |= (1 << ETH_TX_START_BD_HDR_NBDS_SHIFT);
 
-                if (BNX2X_CHIP_IS_E2_PLUS(cp->chip_id))
+                if (BNX2X_CHIP_IS_E2_PLUS(bp))
                         pbd_e2->parsing_data = (UNICAST_ADDRESS <<
                                 ETH_TX_PARSE_BD_E2_ETH_ADDR_TYPE_SHIFT);
                 else
@@ -4967,6 +4974,7 @@ static void cnic_init_bnx2x_rx_ring(struct cnic_dev *dev,
                                     struct client_init_ramrod_data *data)
 {
         struct cnic_local *cp = dev->cnic_priv;
+        struct bnx2x *bp = netdev_priv(dev->netdev);
         struct cnic_uio_dev *udev = cp->udev;
         struct eth_rx_bd *rxbd = (struct eth_rx_bd *) (udev->l2_ring +
                                 BNX2_PAGE_SIZE);
@@ -4975,7 +4983,7 @@ static void cnic_init_bnx2x_rx_ring(struct cnic_dev *dev,
         struct host_sp_status_block *sb = cp->bnx2x_def_status_blk;
         int i;
         u32 cli = cp->ethdev->iscsi_l2_client_id;
-        int cl_qzone_id = BNX2X_CL_QZONE_ID(cp, cli);
+        int cl_qzone_id = BNX2X_CL_QZONE_ID(bp, cli);
         u32 val;
         dma_addr_t ring_map = udev->l2_ring_map;
 
@@ -4984,7 +4992,7 @@ static void cnic_init_bnx2x_rx_ring(struct cnic_dev *dev,
         data->general.activate_flg = 1;
         data->general.sp_client_id = cli;
         data->general.mtu = cpu_to_le16(cp->l2_single_buf_size - 14);
-        data->general.func_id = cp->pfid;
+        data->general.func_id = bp->pfid;
 
         for (i = 0; i < BNX2X_MAX_RX_DESC_CNT; i++, rxbd++) {
                 dma_addr_t buf_map;
@@ -5034,13 +5042,13 @@ static void cnic_init_bnx2x_kcq(struct cnic_dev *dev)
 {
         struct cnic_local *cp = dev->cnic_priv;
         struct bnx2x *bp = netdev_priv(dev->netdev);
-        u32 pfid = cp->pfid;
+        u32 pfid = bp->pfid;
 
         cp->kcq1.io_addr = BAR_CSTRORM_INTMEM +
                            CSTORM_ISCSI_EQ_PROD_OFFSET(pfid, 0);
         cp->kcq1.sw_prod_idx = 0;
 
-        if (BNX2X_CHIP_IS_E2_PLUS(cp->chip_id)) {
+        if (BNX2X_CHIP_IS_E2_PLUS(bp)) {
                 struct host_hc_status_block_e2 *sb = cp->status_blk.gen;
 
                 cp->kcq1.hw_prod_idx_ptr =
@@ -5056,7 +5064,7 @@ static void cnic_init_bnx2x_kcq(struct cnic_dev *dev)
                         &sb->sb.running_index[SM_RX_ID];
         }
 
-        if (BNX2X_CHIP_IS_E2_PLUS(cp->chip_id)) {
+        if (BNX2X_CHIP_IS_E2_PLUS(bp)) {
                 struct host_hc_status_block_e2 *sb = cp->status_blk.gen;
 
                 cp->kcq2.io_addr = BAR_USTRORM_INTMEM +
@@ -5078,12 +5086,10 @@ static int cnic_start_bnx2x_hw(struct cnic_dev *dev)
         u32 pfid;
 
         dev->stats_addr = ethdev->addr_drv_info_to_mcp;
-        cp->port_mode = bp->common.chip_port_mode;
-        cp->pfid = bp->pfid;
         cp->func = bp->pf_num;
 
         func = CNIC_FUNC(cp);
-        pfid = cp->pfid;
+        pfid = bp->pfid;
 
         ret = cnic_init_id_tbl(&cp->cid_tbl, MAX_ISCSI_TBL_SZ,
                                cp->iscsi_start_cid, 0);
@@ -5091,7 +5097,7 @@ static int cnic_start_bnx2x_hw(struct cnic_dev *dev)
         if (ret)
                 return -ENOMEM;
 
-        if (BNX2X_CHIP_IS_E2_PLUS(cp->chip_id)) {
+        if (BNX2X_CHIP_IS_E2_PLUS(bp)) {
                 ret = cnic_init_id_tbl(&cp->fcoe_cid_tbl, dev->max_fcoe_conn,
                                         cp->fcoe_start_cid, 0);
 
@@ -5173,12 +5179,12 @@ static void cnic_init_rings(struct cnic_dev *dev)
                 rx_prods.cqe_prod = BNX2X_MAX_RCQ_DESC_CNT;
                 barrier();
 
-                cl_qzone_id = BNX2X_CL_QZONE_ID(cp, cli);
+                cl_qzone_id = BNX2X_CL_QZONE_ID(bp, cli);
 
                 off = BAR_USTRORM_INTMEM +
-                        (BNX2X_CHIP_IS_E2_PLUS(cp->chip_id) ?
+                        (BNX2X_CHIP_IS_E2_PLUS(bp) ?
                          USTORM_RX_PRODS_E2_OFFSET(cl_qzone_id) :
-                         USTORM_RX_PRODS_E1X_OFFSET(CNIC_PORT(cp), cli));
+                         USTORM_RX_PRODS_E1X_OFFSET(BP_PORT(bp), cli));
 
                 for (i = 0; i < sizeof(struct ustorm_eth_rx_producers) / 4; i++)
                         CNIC_WR(dev, off + i * 4, ((u32 *) &rx_prods)[i]);
@@ -5365,7 +5371,7 @@ static void cnic_stop_bnx2x_hw(struct cnic_dev *dev)
 
         cnic_free_irq(dev);
 
-        if (BNX2X_CHIP_IS_E2_PLUS(cp->chip_id)) {
+        if (BNX2X_CHIP_IS_E2_PLUS(bp)) {
                 idx_off = offsetof(struct hc_status_block_e2, index_values) +
                           (hc_index * sizeof(u16));
 
@@ -5382,7 +5388,7 @@ static void cnic_stop_bnx2x_hw(struct cnic_dev *dev)
 
         *cp->kcq1.hw_prod_idx_ptr = 0;
         CNIC_WR(dev, BAR_CSTRORM_INTMEM +
-                CSTORM_ISCSI_EQ_CONS_OFFSET(cp->pfid, 0), 0);
+                CSTORM_ISCSI_EQ_CONS_OFFSET(bp->pfid, 0), 0);
         CNIC_WR16(dev, cp->kcq1.io_addr, 0);
         cnic_free_resc(dev);
 }
@@ -5556,7 +5562,7 @@ static struct cnic_dev *init_bnx2x_cnic(struct net_device *dev)
 
         if (!(ethdev->drv_state & CNIC_DRV_STATE_NO_ISCSI))
                 cdev->max_iscsi_conn = ethdev->max_iscsi_conn;
-        if (CNIC_SUPPORTS_FCOE(cp)) {
+        if (CNIC_SUPPORTS_FCOE(bp)) {
                 cdev->max_fcoe_conn = ethdev->max_fcoe_conn;
                 cdev->max_fcoe_exchanges = ethdev->max_fcoe_exchanges;
         }
@@ -5576,7 +5582,7 @@ static struct cnic_dev *init_bnx2x_cnic(struct net_device *dev)
         cp->stop_cm = cnic_cm_stop_bnx2x_hw;
         cp->enable_int = cnic_enable_bnx2x_int;
         cp->disable_int_sync = cnic_disable_bnx2x_int_sync;
-        if (BNX2X_CHIP_IS_E2_PLUS(cp->chip_id)) {
+        if (BNX2X_CHIP_IS_E2_PLUS(bp)) {
                 cp->ack_int = cnic_ack_bnx2x_e2_msix;
                 cp->arm_int = cnic_arm_bnx2x_e2_msix;
         } else {
diff --git a/drivers/net/ethernet/broadcom/cnic.h b/drivers/net/ethernet/broadcom/cnic.h
index e7a247473596..0121a5d55192 100644
--- a/drivers/net/ethernet/broadcom/cnic.h
+++ b/drivers/net/ethernet/broadcom/cnic.h
@@ -303,8 +303,6 @@ struct cnic_local {
 
         u32                     chip_id;
         int                     func;
-        u32                     pfid;
-        u8                      port_mode;
 
         u32                     shmem_base;
 
@@ -364,47 +362,7 @@ struct bnx2x_bd_chain_next {
 
 #define BNX2X_FCOE_L5_CID_BASE          MAX_ISCSI_TBL_SZ
 
-#define BNX2X_CHIP_NUM_57710            0x164e
-#define BNX2X_CHIP_NUM_57711            0x164f
-#define BNX2X_CHIP_NUM_57711E           0x1650
-#define BNX2X_CHIP_NUM_57712            0x1662
-#define BNX2X_CHIP_NUM_57712E           0x1663
-#define BNX2X_CHIP_NUM_57713            0x1651
-#define BNX2X_CHIP_NUM_57713E           0x1652
-#define BNX2X_CHIP_NUM_57800            0x168a
-#define BNX2X_CHIP_NUM_57810            0x168e
-#define BNX2X_CHIP_NUM_57840            0x168d
-
-#define BNX2X_CHIP_NUM(x)               (x >> 16)
-#define BNX2X_CHIP_IS_57710(x)          \
-        (BNX2X_CHIP_NUM(x) == BNX2X_CHIP_NUM_57710)
-#define BNX2X_CHIP_IS_57711(x)          \
-        (BNX2X_CHIP_NUM(x) == BNX2X_CHIP_NUM_57711)
-#define BNX2X_CHIP_IS_57711E(x)         \
-        (BNX2X_CHIP_NUM(x) == BNX2X_CHIP_NUM_57711E)
-#define BNX2X_CHIP_IS_E1H(x)            \
-        (BNX2X_CHIP_IS_57711(x) || BNX2X_CHIP_IS_57711E(x))
-#define BNX2X_CHIP_IS_57712(x)          \
-        (BNX2X_CHIP_NUM(x) == BNX2X_CHIP_NUM_57712)
-#define BNX2X_CHIP_IS_57712E(x)         \
-        (BNX2X_CHIP_NUM(x) == BNX2X_CHIP_NUM_57712E)
-#define BNX2X_CHIP_IS_57713(x)          \
-        (BNX2X_CHIP_NUM(x) == BNX2X_CHIP_NUM_57713)
-#define BNX2X_CHIP_IS_57713E(x)         \
-        (BNX2X_CHIP_NUM(x) == BNX2X_CHIP_NUM_57713E)
-#define BNX2X_CHIP_IS_57800(x)          \
-        (BNX2X_CHIP_NUM(x) == BNX2X_CHIP_NUM_57800)
-#define BNX2X_CHIP_IS_57810(x)          \
-        (BNX2X_CHIP_NUM(x) == BNX2X_CHIP_NUM_57810)
-#define BNX2X_CHIP_IS_57840(x)          \
-        (BNX2X_CHIP_NUM(x) == BNX2X_CHIP_NUM_57840)
-#define BNX2X_CHIP_IS_E2(x)             \
-        (BNX2X_CHIP_IS_57712(x) || BNX2X_CHIP_IS_57712E(x) || \
-         BNX2X_CHIP_IS_57713(x) || BNX2X_CHIP_IS_57713E(x))
-#define BNX2X_CHIP_IS_E3(x)                     \
-        (BNX2X_CHIP_IS_57800(x) || BNX2X_CHIP_IS_57810(x) || \
-         BNX2X_CHIP_IS_57840(x))
-#define BNX2X_CHIP_IS_E2_PLUS(x) (BNX2X_CHIP_IS_E2(x) || BNX2X_CHIP_IS_E3(x))
+#define BNX2X_CHIP_IS_E2_PLUS(bp) (CHIP_IS_E2(bp) || CHIP_IS_E3(bp))
 
 #define BNX2X_RX_DESC_CNT               (BNX2_PAGE_SIZE / \
                                          sizeof(struct eth_rx_bd))
@@ -439,31 +397,26 @@ struct bnx2x_bd_chain_next {
 #define ETH_MAX_RX_CLIENTS_E2           ETH_MAX_RX_CLIENTS_E1H
 #endif
 
-#define CNIC_PORT(cp)                   ((cp)->pfid & 1)
 #define CNIC_FUNC(cp)                   ((cp)->func)
-#define CNIC_PATH(cp)                   (!BNX2X_CHIP_IS_E2_PLUS(cp->chip_id) ? \
-                                         0 : (CNIC_FUNC(cp) & 1))
-#define CNIC_E1HVN(cp)                  ((cp)->pfid >> 1)
 
-#define BNX2X_HW_CID(cp, x)             ((CNIC_PORT(cp) << 23) | \
-                                         (CNIC_E1HVN(cp) << 17) | (x))
+#define BNX2X_HW_CID(bp, x)             ((BP_PORT(bp) << 23) | \
+                                         (BP_VN(bp) << 17) | (x))
 
 #define BNX2X_SW_CID(x)                 (x & 0x1ffff)
 
-#define BNX2X_CL_QZONE_ID(cp, cli)                                      \
-                (BNX2X_CHIP_IS_E2_PLUS(cp->chip_id) ? cli :             \
-                 cli + (CNIC_PORT(cp) * ETH_MAX_RX_CLIENTS_E1H))
+#define BNX2X_CL_QZONE_ID(bp, cli)                                      \
+                (BNX2X_CHIP_IS_E2_PLUS(bp) ? cli :                      \
+                 cli + (BP_PORT(bp) * ETH_MAX_RX_CLIENTS_E1H))
 
 #ifndef MAX_STAT_COUNTER_ID
 #define MAX_STAT_COUNTER_ID                                             \
-        (BNX2X_CHIP_IS_E1H((cp)->chip_id) ? MAX_STAT_COUNTER_ID_E1H :   \
-         ((BNX2X_CHIP_IS_E2_PLUS((cp)->chip_id)) ? MAX_STAT_COUNTER_ID_E2 :\
+        (CHIP_IS_E1H(bp) ? MAX_STAT_COUNTER_ID_E1H :                    \
+         ((BNX2X_CHIP_IS_E2_PLUS(bp)) ? MAX_STAT_COUNTER_ID_E2 :        \
           MAX_STAT_COUNTER_ID_E1))
 #endif
 
-#define CNIC_SUPPORTS_FCOE(cp)                                  \
-        (BNX2X_CHIP_IS_E2_PLUS((cp)->chip_id) &&                \
-         !((cp)->ethdev->drv_state & CNIC_DRV_STATE_NO_FCOE))
+#define CNIC_SUPPORTS_FCOE(cp)                                          \
+        (BNX2X_CHIP_IS_E2_PLUS(bp) && !NO_FCOE(bp))
 
 #define CNIC_RAMROD_TMO                 (HZ / 4)
 
diff --git a/drivers/net/ethernet/broadcom/cnic_if.h b/drivers/net/ethernet/broadcom/cnic_if.h
index 95aff7642b85..0658b43e148c 100644
--- a/drivers/net/ethernet/broadcom/cnic_if.h
+++ b/drivers/net/ethernet/broadcom/cnic_if.h
@@ -14,8 +14,8 @@
 
 #include "bnx2x/bnx2x_mfw_req.h"
 
-#define CNIC_MODULE_VERSION     "2.5.17"
-#define CNIC_MODULE_RELDATE     "July 28, 2013"
+#define CNIC_MODULE_VERSION     "2.5.18"
+#define CNIC_MODULE_RELDATE     "Sept 01, 2013"
 
 #define CNIC_ULP_RDMA           0
 #define CNIC_ULP_ISCSI          1
diff --git a/drivers/net/ethernet/dec/tulip/de4x5.c b/drivers/net/ethernet/dec/tulip/de4x5.c
index 4c830030fb06..2db6c573cec7 100644
--- a/drivers/net/ethernet/dec/tulip/de4x5.c
+++ b/drivers/net/ethernet/dec/tulip/de4x5.c
@@ -2319,7 +2319,7 @@ static void de4x5_pci_remove(struct pci_dev *pdev)
         struct net_device *dev;
         u_long iobase;
 
-        dev = dev_get_drvdata(&pdev->dev);
+        dev = pci_get_drvdata(pdev);
         iobase = dev->base_addr;
 
         unregister_netdev (dev);
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index 52c9085ba5a1..1ab5dab11eff 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -2876,7 +2876,7 @@ int be_cmd_set_mac(struct be_adapter *adapter, u8 *mac, int if_id, u32 dom)
 }
 
 int be_cmd_set_hsw_config(struct be_adapter *adapter, u16 pvid,
-                        u32 domain, u16 intf_id)
+                          u32 domain, u16 intf_id, u16 hsw_mode)
 {
         struct be_mcc_wrb *wrb;
         struct be_cmd_req_set_hsw_config *req;
@@ -2903,6 +2903,13 @@ int be_cmd_set_hsw_config(struct be_adapter *adapter, u16 pvid,
                 AMAP_SET_BITS(struct amap_set_hsw_context, pvid_valid, ctxt, 1);
                 AMAP_SET_BITS(struct amap_set_hsw_context, pvid, ctxt, pvid);
         }
+        if (!BEx_chip(adapter) && hsw_mode) {
+                AMAP_SET_BITS(struct amap_set_hsw_context, interface_id,
+                              ctxt, adapter->hba_port_num);
+                AMAP_SET_BITS(struct amap_set_hsw_context, pport, ctxt, 1);
+                AMAP_SET_BITS(struct amap_set_hsw_context, port_fwd_type,
+                              ctxt, hsw_mode);
+        }
 
         be_dws_cpu_to_le(req->context, sizeof(req->context));
         status = be_mcc_notify_wait(adapter);
@@ -2914,7 +2921,7 @@ err:
 
 /* Get Hyper switch config */
 int be_cmd_get_hsw_config(struct be_adapter *adapter, u16 *pvid,
-                        u32 domain, u16 intf_id)
+                          u32 domain, u16 intf_id, u8 *mode)
 {
         struct be_mcc_wrb *wrb;
         struct be_cmd_req_get_hsw_config *req;
@@ -2937,9 +2944,15 @@ int be_cmd_get_hsw_config(struct be_adapter *adapter, u16 *pvid,
                         OPCODE_COMMON_GET_HSW_CONFIG, sizeof(*req), wrb, NULL);
 
         req->hdr.domain = domain;
-        AMAP_SET_BITS(struct amap_get_hsw_req_context, interface_id, ctxt,
-                                                                intf_id);
+        AMAP_SET_BITS(struct amap_get_hsw_req_context, interface_id,
+                      ctxt, intf_id);
         AMAP_SET_BITS(struct amap_get_hsw_req_context, pvid_valid, ctxt, 1);
+
+        if (!BEx_chip(adapter)) {
+                AMAP_SET_BITS(struct amap_get_hsw_req_context, interface_id,
+                              ctxt, adapter->hba_port_num);
+                AMAP_SET_BITS(struct amap_get_hsw_req_context, pport, ctxt, 1);
+        }
         be_dws_cpu_to_le(req->context, sizeof(req->context));
 
         status = be_mcc_notify_wait(adapter);
@@ -2950,7 +2963,11 @@ int be_cmd_get_hsw_config(struct be_adapter *adapter, u16 *pvid,
                                                 sizeof(resp->context));
                 vid = AMAP_GET_BITS(struct amap_get_hsw_resp_context,
                                                         pvid, &resp->context);
-                *pvid = le16_to_cpu(vid);
+                if (pvid)
+                        *pvid = le16_to_cpu(vid);
+                if (mode)
+                        *mode = AMAP_GET_BITS(struct amap_get_hsw_resp_context,
+                                              port_fwd_type, &resp->context);
         }
 
 err:
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index 52f3d4ca0056..d026226db88c 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -1533,12 +1533,17 @@ struct be_cmd_req_set_mac_list {
 } __packed;
 
 /*********************** HSW Config ***********************/
+#define PORT_FWD_TYPE_VEPA              0x3
+#define PORT_FWD_TYPE_VEB               0x2
+
 struct amap_set_hsw_context {
         u8 interface_id[16];
         u8 rsvd0[14];
         u8 pvid_valid;
-        u8 rsvd1;
-        u8 rsvd2[16];
+        u8 pport;
+        u8 rsvd1[6];
+        u8 port_fwd_type[3];
+        u8 rsvd2[7];
         u8 pvid[16];
         u8 rsvd3[32];
         u8 rsvd4[32];
@@ -1563,7 +1568,9 @@ struct amap_get_hsw_req_context {
 } __packed;
 
 struct amap_get_hsw_resp_context {
-        u8 rsvd1[16];
+        u8 rsvd0[6];
+        u8 port_fwd_type[3];
+        u8 rsvd1[7];
         u8 pvid[16];
         u8 rsvd2[32];
         u8 rsvd3[32];
@@ -1965,9 +1972,9 @@ extern int be_cmd_set_mac_list(struct be_adapter *adapter, u8 *mac_array,
 extern int be_cmd_set_mac(struct be_adapter *adapter, u8 *mac, int if_id,
                           u32 dom);
 extern int be_cmd_set_hsw_config(struct be_adapter *adapter, u16 pvid,
-                        u32 domain, u16 intf_id);
+                                 u32 domain, u16 intf_id, u16 hsw_mode);
 extern int be_cmd_get_hsw_config(struct be_adapter *adapter, u16 *pvid,
-                        u32 domain, u16 intf_id);
+                                 u32 domain, u16 intf_id, u8 *mode);
 extern int be_cmd_get_acpi_wol_cap(struct be_adapter *adapter);
 extern int be_cmd_get_ext_fat_capabilites(struct be_adapter *adapter,
                                           struct be_dma_mem *cmd);
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 39e0a7697a81..e104db7fcf27 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -21,6 +21,7 @@
 #include "be_cmds.h"
 #include <asm/div64.h>
 #include <linux/aer.h>
+#include <linux/if_bridge.h>
 
 MODULE_VERSION(DRV_VER);
 MODULE_DEVICE_TABLE(pci, be_dev_ids);
@@ -1212,14 +1213,14 @@ static int be_set_vf_vlan(struct net_device *netdev,
                         adapter->vf_cfg[vf].vlan_tag = vlan;
 
                         status = be_cmd_set_hsw_config(adapter, vlan,
-                                vf + 1, adapter->vf_cfg[vf].if_handle);
+                                vf + 1, adapter->vf_cfg[vf].if_handle, 0);
                 }
         } else {
                 /* Reset Transparent Vlan Tagging. */
                 adapter->vf_cfg[vf].vlan_tag = 0;
                 vlan = adapter->vf_cfg[vf].def_vid;
                 status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
-                        adapter->vf_cfg[vf].if_handle);
+                        adapter->vf_cfg[vf].if_handle, 0);
         }
 
 
@@ -2917,7 +2918,7 @@ static int be_vf_setup(struct be_adapter *adapter)
                         vf_cfg->tx_rate = lnk_speed;
 
                 status = be_cmd_get_hsw_config(adapter, &def_vlan,
-                                               vf + 1, vf_cfg->if_handle);
+                                               vf + 1, vf_cfg->if_handle, NULL);
                 if (status)
                         goto err;
                 vf_cfg->def_vid = def_vlan;
@@ -3795,6 +3796,74 @@ fw_exit:
         return status;
 }
 
+static int be_ndo_bridge_setlink(struct net_device *dev,
+                                    struct nlmsghdr *nlh)
+{
+        struct be_adapter *adapter = netdev_priv(dev);
+        struct nlattr *attr, *br_spec;
+        int rem;
+        int status = 0;
+        u16 mode = 0;
+
+        if (!sriov_enabled(adapter))
+                return -EOPNOTSUPP;
+
+        br_spec = nlmsg_find_attr(nlh, sizeof(struct ifinfomsg), IFLA_AF_SPEC);
+
+        nla_for_each_nested(attr, br_spec, rem) {
+                if (nla_type(attr) != IFLA_BRIDGE_MODE)
+                        continue;
+
+                mode = nla_get_u16(attr);
+                if (mode != BRIDGE_MODE_VEPA && mode != BRIDGE_MODE_VEB)
+                        return -EINVAL;
+
+                status = be_cmd_set_hsw_config(adapter, 0, 0,
+                                               adapter->if_handle,
+                                               mode == BRIDGE_MODE_VEPA ?
+                                               PORT_FWD_TYPE_VEPA :
+                                               PORT_FWD_TYPE_VEB);
+                if (status)
+                        goto err;
+
+                dev_info(&adapter->pdev->dev, "enabled switch mode: %s\n",
+                         mode == BRIDGE_MODE_VEPA ? "VEPA" : "VEB");
+
+                return status;
+        }
+err:
+        dev_err(&adapter->pdev->dev, "Failed to set switch mode %s\n",
+                mode == BRIDGE_MODE_VEPA ? "VEPA" : "VEB");
+
+        return status;
+}
+
+static int be_ndo_bridge_getlink(struct sk_buff *skb, u32 pid, u32 seq,
+                                    struct net_device *dev,
+                                    u32 filter_mask)
+{
+        struct be_adapter *adapter = netdev_priv(dev);
+        int status = 0;
+        u8 hsw_mode;
+
+        if (!sriov_enabled(adapter))
+                return 0;
+
+        /* BE and Lancer chips support VEB mode only */
+        if (BEx_chip(adapter) || lancer_chip(adapter)) {
+                hsw_mode = PORT_FWD_TYPE_VEB;
+        } else {
+                status = be_cmd_get_hsw_config(adapter, NULL, 0,
+                                               adapter->if_handle, &hsw_mode);
+                if (status)
+                        return 0;
+        }
+
+        return ndo_dflt_bridge_getlink(skb, pid, seq, dev,
+                                       hsw_mode == PORT_FWD_TYPE_VEPA ?
+                                       BRIDGE_MODE_VEPA : BRIDGE_MODE_VEB);
+}
+
 static const struct net_device_ops be_netdev_ops = {
         .ndo_open               = be_open,
         .ndo_stop               = be_close,
@@ -3813,6 +3882,8 @@ static const struct net_device_ops be_netdev_ops = {
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = be_netpoll,
 #endif
+        .ndo_bridge_setlink     = be_ndo_bridge_setlink,
+        .ndo_bridge_getlink     = be_ndo_bridge_getlink,
 };
 
 static void be_netdev_init(struct net_device *netdev)
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index b2c91dcd245f..c4eaadeb572f 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -2092,7 +2092,7 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
         int do_tstamp, do_csum, do_vlan;
         u32 bufaddr;
         unsigned long flags;
-        unsigned int nr_frags, nr_txbds, length, fcb_len = 0;
+        unsigned int nr_frags, nr_txbds, bytes_sent, fcb_len = 0;
 
         rq = skb->queue_mapping;
         tx_queue = priv->tx_queue[rq];
@@ -2147,7 +2147,10 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         /* Update transmit stats */
-        tx_queue->stats.tx_bytes += skb->len;
+        bytes_sent = skb->len;
+        tx_queue->stats.tx_bytes += bytes_sent;
+        /* keep Tx bytes on wire for BQL accounting */
+        GFAR_CB(skb)->bytes_sent = bytes_sent;
         tx_queue->stats.tx_packets++;
 
         txbdp = txbdp_start = tx_queue->cur_tx;
@@ -2167,12 +2170,13 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
         } else {
                 /* Place the fragment addresses and lengths into the TxBDs */
                 for (i = 0; i < nr_frags; i++) {
+                        unsigned int frag_len;
                         /* Point at the next BD, wrapping as needed */
                         txbdp = next_txbd(txbdp, base, tx_queue->tx_ring_size);
 
-                        length = skb_shinfo(skb)->frags[i].size;
+                        frag_len = skb_shinfo(skb)->frags[i].size;
 
-                        lstatus = txbdp->lstatus | length |
+                        lstatus = txbdp->lstatus | frag_len |
                                   BD_LFLAG(TXBD_READY);
 
                         /* Handle the last BD specially */
@@ -2182,7 +2186,7 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         bufaddr = skb_frag_dma_map(priv->dev,
                                                    &skb_shinfo(skb)->frags[i],
                                                    0,
-                                                   length,
+                                                   frag_len,
                                                    DMA_TO_DEVICE);
 
                         /* set the TxBD length and buffer pointer */
@@ -2250,7 +2254,7 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 lstatus |= BD_LFLAG(TXBD_CRC | TXBD_READY) | skb_headlen(skb);
         }
 
-        netdev_tx_sent_queue(txq, skb->len);
+        netdev_tx_sent_queue(txq, bytes_sent);
 
         /* We can work in parallel with gfar_clean_tx_ring(), except
          * when modifying num_txbdfree. Note that we didn't grab the lock
@@ -2570,7 +2574,7 @@ static void gfar_clean_tx_ring(struct gfar_priv_tx_q *tx_queue)
                         bdp = next_txbd(bdp, base, tx_ring_size);
                 }
 
-                bytes_sent += skb->len;
+                bytes_sent += GFAR_CB(skb)->bytes_sent;
 
                 dev_kfree_skb_any(skb);
 
diff --git a/drivers/net/ethernet/freescale/gianfar.h b/drivers/net/ethernet/freescale/gianfar.h
index 46f56f36118f..04112b98ff5d 100644
--- a/drivers/net/ethernet/freescale/gianfar.h
+++ b/drivers/net/ethernet/freescale/gianfar.h
@@ -575,7 +575,7 @@ struct rxfcb {
 };
 
 struct gianfar_skb_cb {
-        int alignamount;
+        unsigned int bytes_sent; /* bytes-on-wire (i.e. no FCB) */
 };
 
 #define GFAR_CB(skb) ((struct gianfar_skb_cb *)((skb)->cb))
diff --git a/drivers/net/ethernet/ibm/emac/core.c b/drivers/net/ethernet/ibm/emac/core.c
index 2d3b064d6924..6b5c7222342c 100644
--- a/drivers/net/ethernet/ibm/emac/core.c
+++ b/drivers/net/ethernet/ibm/emac/core.c
@@ -2312,7 +2312,7 @@ static int emac_check_deps(struct emac_instance *dev,
                 if (deps[i].ofdev == NULL)
                         continue;
                 if (deps[i].drvdata == NULL)
-                        deps[i].drvdata = dev_get_drvdata(&deps[i].ofdev->dev);
+                        deps[i].drvdata = platform_get_drvdata(deps[i].ofdev);
                 if (deps[i].drvdata != NULL)
                         there++;
         }
@@ -2799,9 +2799,9 @@ static int emac_probe(struct platform_device *ofdev)
                 /*  display more info about what's missing ? */
                 goto err_reg_unmap;
         }
-        dev->mal = dev_get_drvdata(&dev->mal_dev->dev);
+        dev->mal = platform_get_drvdata(dev->mal_dev);
         if (dev->mdio_dev != NULL)
-                dev->mdio_instance = dev_get_drvdata(&dev->mdio_dev->dev);
+                dev->mdio_instance = platform_get_drvdata(dev->mdio_dev);
 
         /* Register with MAL */
         dev->commac.ops = &emac_commac_ops;
@@ -2892,7 +2892,7 @@ static int emac_probe(struct platform_device *ofdev)
          * fully initialized
          */
         wmb();
-        dev_set_drvdata(&ofdev->dev, dev);
+        platform_set_drvdata(ofdev, dev);
 
         /* There's a new kid in town ! Let's tell everybody */
         wake_up_all(&emac_probe_wait);
@@ -2951,7 +2951,7 @@ static int emac_probe(struct platform_device *ofdev)
 
 static int emac_remove(struct platform_device *ofdev)
 {
-        struct emac_instance *dev = dev_get_drvdata(&ofdev->dev);
+        struct emac_instance *dev = platform_get_drvdata(ofdev);
 
         DBG(dev, "remove" NL);
 
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index 70fd55968844..5d41aee69d16 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -106,7 +106,7 @@ struct ibmveth_stat ibmveth_stats[] = {
 /* simple methods of getting data from the current rxq entry */
 static inline u32 ibmveth_rxq_flags(struct ibmveth_adapter *adapter)
 {
-        return adapter->rx_queue.queue_addr[adapter->rx_queue.index].flags_off;
+        return be32_to_cpu(adapter->rx_queue.queue_addr[adapter->rx_queue.index].flags_off);
 }
 
 static inline int ibmveth_rxq_toggle(struct ibmveth_adapter *adapter)
@@ -132,7 +132,7 @@ static inline int ibmveth_rxq_frame_offset(struct ibmveth_adapter *adapter)
 
 static inline int ibmveth_rxq_frame_length(struct ibmveth_adapter *adapter)
 {
-        return adapter->rx_queue.queue_addr[adapter->rx_queue.index].length;
+        return be32_to_cpu(adapter->rx_queue.queue_addr[adapter->rx_queue.index].length);
 }
 
 static inline int ibmveth_rxq_csum_good(struct ibmveth_adapter *adapter)
diff --git a/drivers/net/ethernet/ibm/ibmveth.h b/drivers/net/ethernet/ibm/ibmveth.h
index 43a794fab9ff..84066bafe057 100644
--- a/drivers/net/ethernet/ibm/ibmveth.h
+++ b/drivers/net/ethernet/ibm/ibmveth.h
@@ -164,14 +164,26 @@ struct ibmveth_adapter {
     u64 tx_send_failed;
 };
 
+/*
+ * We pass struct ibmveth_buf_desc_fields to the hypervisor in registers,
+ * so we don't need to byteswap the two elements. However since we use
+ * a union (ibmveth_buf_desc) to convert from the struct to a u64 we
+ * do end up with endian specific ordering of the elements and that
+ * needs correcting.
+ */
 struct ibmveth_buf_desc_fields {
+#ifdef __BIG_ENDIAN
+        u32 flags_len;
+        u32 address;
+#else
+        u32 address;
         u32 flags_len;
+#endif
 #define IBMVETH_BUF_VALID       0x80000000
 #define IBMVETH_BUF_TOGGLE      0x40000000
 #define IBMVETH_BUF_NO_CSUM     0x02000000
 #define IBMVETH_BUF_CSUM_GOOD   0x01000000
 #define IBMVETH_BUF_LEN_MASK    0x00FFFFFF
-        u32 address;
 };
 
 union ibmveth_buf_desc {
@@ -180,7 +192,7 @@ union ibmveth_buf_desc {
 };
 
 struct ibmveth_rx_q_entry {
-        u32 flags_off;
+        __be32 flags_off;
 #define IBMVETH_RXQ_TOGGLE              0x80000000
 #define IBMVETH_RXQ_TOGGLE_SHIFT        31
 #define IBMVETH_RXQ_VALID               0x40000000
@@ -188,7 +200,8 @@ struct ibmveth_rx_q_entry {
 #define IBMVETH_RXQ_CSUM_GOOD           0x01000000
 #define IBMVETH_RXQ_OFF_MASK            0x0000FFFF
 
-        u32 length;
+        __be32 length;
+        /* correlator is only used by the OS, no need to byte swap */
         u64 correlator;
 };
 
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
index 1f5166ad6bb5..59a62bbfb371 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -488,8 +488,8 @@ static bool ixgbevf_clean_rx_irq(struct ixgbevf_q_vector *q_vector,
                  * source pruning.
                  */
                 if ((skb->pkt_type & (PACKET_BROADCAST | PACKET_MULTICAST)) &&
-                    !(compare_ether_addr(adapter->netdev->dev_addr,
-                                        eth_hdr(skb)->h_source))) {
+                    ether_addr_equal(adapter->netdev->dev_addr,
+                                     eth_hdr(skb)->h_source)) {
                         dev_kfree_skb_irq(skb);
                         goto next_desc;
                 }
diff --git a/drivers/net/ethernet/netx-eth.c b/drivers/net/ethernet/netx-eth.c
index 235fd51100aa..e6f0a4366f90 100644
--- a/drivers/net/ethernet/netx-eth.c
+++ b/drivers/net/ethernet/netx-eth.c
@@ -390,7 +390,7 @@ static int netx_eth_drv_probe(struct platform_device *pdev)
 
         priv = netdev_priv(ndev);
 
-        pdata = (struct netxeth_platform_data *)dev_get_platdata(&pdev->dev);
+        pdata = dev_get_platdata(&pdev->dev);
         priv->xc = request_xc(pdata->xcno, &pdev->dev);
         if (!priv->xc) {
                 dev_err(&pdev->dev, "unable to request xc engine\n");
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
index 2e10e7922cfe..d62d5ce432ec 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
@@ -248,7 +248,7 @@ static inline void __qlcnic_init_dcbnl_ops(struct qlcnic_adapter *adapter)
                 adapter->netdev->dcbnl_ops = &qlcnic_dcbnl_ops;
 }
 
-void qlcnic_set_dcb_ops(struct qlcnic_adapter *adapter)
+static void qlcnic_set_dcb_ops(struct qlcnic_adapter *adapter)
 {
         if (qlcnic_82xx_check(adapter))
                 adapter->dcb->ops = &qlcnic_82xx_dcb_ops;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index 332aa71798f6..4d7ad0074d1c 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -1709,7 +1709,7 @@ qlcnic_set_dump(struct net_device *netdev, struct ethtool_dump *val)
                 qlcnic_dev_request_reset(adapter, val->flag);
                 adapter->flags &= ~QLCNIC_FW_RESET_OWNER;
                 break;
-;
+
         case QLCNIC_SET_QUIESCENT:
         case QLCNIC_RESET_QUIESCENT:
                 state = QLC_SHARED_REG_RD32(adapter, QLCNIC_CRB_DEV_STATE);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
index a9bc651e9ffa..330d9a8774ad 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
@@ -1652,14 +1652,14 @@ int qlcnic_sriov_set_vf_mac(struct net_device *netdev, int vf, u8 *mac)
         if (!is_valid_ether_addr(mac) || vf >= num_vfs)
                 return -EINVAL;
 
-        if (!compare_ether_addr(adapter->mac_addr, mac)) {
+        if (ether_addr_equal(adapter->mac_addr, mac)) {
                 netdev_err(netdev, "MAC address is already in use by the PF\n");
                 return -EINVAL;
         }
 
         for (i = 0; i < num_vfs; i++) {
                 vf_info = &sriov->vf_info[i];
-                if (!compare_ether_addr(vf_info->vp->mac, mac)) {
+                if (ether_addr_equal(vf_info->vp->mac, mac)) {
                         netdev_err(netdev,
                                    "MAC address is already in use by VF %d\n",
                                    i);
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 06d8f62626e4..474c8a86a2af 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -416,6 +416,7 @@ static struct sh_eth_cpu_data r8a7790_data = {
         .tpauser        = 1,
         .hw_swap        = 1,
         .rmiimode       = 1,
+        .shift_rd0      = 1,
 };
 
 static void sh_eth_set_rate_sh7724(struct net_device *ndev)
@@ -1342,6 +1343,9 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                         mdp->rx_skbuff[entry] = NULL;
                         if (mdp->cd->rpadir)
                                 skb_reserve(skb, NET_IP_ALIGN);
+                        dma_sync_single_for_cpu(&ndev->dev, rxdesc->addr,
+                                                mdp->rx_buf_sz,
+                                                DMA_FROM_DEVICE);
                         skb_put(skb, pkt_len);
                         skb->protocol = eth_type_trans(skb, ndev);
                         netif_rx(skb);
diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c
index c67e683a36e1..e37b587b3860 100644
--- a/drivers/net/ethernet/sun/sunhme.c
+++ b/drivers/net/ethernet/sun/sunhme.c
@@ -2798,7 +2798,7 @@ static int happy_meal_sbus_probe_one(struct platform_device *op, int is_qfe)
                 goto err_out_free_coherent;
         }
 
-        dev_set_drvdata(&op->dev, hp);
+        platform_set_drvdata(op, hp);
 
         if (qfe_slot != -1)
                 printk(KERN_INFO "%s: Quattro HME slot %d (SBUS) 10/100baseT Ethernet ",
@@ -3111,7 +3111,7 @@ static int happy_meal_pci_probe(struct pci_dev *pdev,
                 goto err_out_iounmap;
         }
 
-        dev_set_drvdata(&pdev->dev, hp);
+        pci_set_drvdata(pdev, hp);
 
         if (!qfe_slot) {
                 struct pci_dev *qpdev = qp->quattro_dev;
@@ -3159,7 +3159,7 @@ err_out:
 
 static void happy_meal_pci_remove(struct pci_dev *pdev)
 {
-        struct happy_meal *hp = dev_get_drvdata(&pdev->dev);
+        struct happy_meal *hp = pci_get_drvdata(pdev);
         struct net_device *net_dev = hp->dev;
 
         unregister_netdev(net_dev);
@@ -3171,7 +3171,7 @@ static void happy_meal_pci_remove(struct pci_dev *pdev)
 
         free_netdev(net_dev);
 
-        dev_set_drvdata(&pdev->dev, NULL);
+        pci_set_drvdata(pdev, NULL);
 }
 
 static DEFINE_PCI_DEVICE_TABLE(happymeal_pci_ids) = {
diff --git a/drivers/net/ethernet/tile/tilegx.c b/drivers/net/ethernet/tile/tilegx.c
index 5d2a719fc688..949076f4e6ae 100644
--- a/drivers/net/ethernet/tile/tilegx.c
+++ b/drivers/net/ethernet/tile/tilegx.c
@@ -544,7 +544,7 @@ static inline bool filter_packet(struct net_device *dev, void *buf)
         /* Filter out packets that aren't for us. */
         if (!(dev->flags & IFF_PROMISC) &&
             !is_multicast_ether_addr(buf) &&
-            compare_ether_addr(dev->dev_addr, buf) != 0)
+            !ether_addr_equal(dev->dev_addr, buf))
                 return true;
 
         return false;
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 201ef1712ef5..64dfaa303dcc 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -823,7 +823,7 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
                 if (port->count)
                         return -EINVAL;
                 port->passthru = true;
-                memcpy(dev->dev_addr, lowerdev->dev_addr, ETH_ALEN);
+                eth_hw_addr_inherit(dev, lowerdev);
         }
 
         err = netdev_upper_dev_link(lowerdev, dev);
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index 4822aafe638b..dcb21347c670 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -102,6 +102,7 @@ struct netconsole_target {
         struct config_item      item;
 #endif
         int                     enabled;
+        struct mutex            mutex;
         struct netpoll          np;
 };
 
@@ -181,6 +182,7 @@ static struct netconsole_target *alloc_param_target(char *target_config)
         strlcpy(nt->np.dev_name, "eth0", IFNAMSIZ);
         nt->np.local_port = 6665;
         nt->np.remote_port = 6666;
+        mutex_init(&nt->mutex);
         memset(nt->np.remote_mac, 0xff, ETH_ALEN);
 
         /* Parse parameters and setup netpoll */
@@ -322,6 +324,7 @@ static ssize_t store_enabled(struct netconsole_target *nt,
                 return -EINVAL;
         }
 
+        mutex_lock(&nt->mutex);
         if (enabled) {  /* 1 */
 
                 /*
@@ -331,8 +334,10 @@ static ssize_t store_enabled(struct netconsole_target *nt,
                 netpoll_print_options(&nt->np);
 
                 err = netpoll_setup(&nt->np);
-                if (err)
+                if (err) {
+                        mutex_unlock(&nt->mutex);
                         return err;
+                }
 
                 printk(KERN_INFO "netconsole: network logging started\n");
 
@@ -341,6 +346,7 @@ static ssize_t store_enabled(struct netconsole_target *nt,
         }
 
         nt->enabled = enabled;
+        mutex_unlock(&nt->mutex);
 
         return strnlen(buf, count);
 }
@@ -597,6 +603,7 @@ static struct config_item *make_netconsole_target(struct config_group *group,
         strlcpy(nt->np.dev_name, "eth0", IFNAMSIZ);
         nt->np.local_port = 6665;
         nt->np.remote_port = 6666;
+        mutex_init(&nt->mutex);
         memset(nt->np.remote_mac, 0xff, ETH_ALEN);
 
         /* Initialize the config_item member */
@@ -682,7 +689,11 @@ restart:
                                  * we might sleep in __netpoll_cleanup()
                                  */
                                 spin_unlock_irqrestore(&target_list_lock, flags);
+
+                                mutex_lock(&nt->mutex);
                                 __netpoll_cleanup(&nt->np);
+                                mutex_unlock(&nt->mutex);
+
                                 spin_lock_irqsave(&target_list_lock, flags);
                                 dev_put(nt->np.dev);
                                 nt->np.dev = NULL;
diff --git a/drivers/net/phy/mdio-octeon.c b/drivers/net/phy/mdio-octeon.c
index 7f18f80e87c9..6aee02ed97ac 100644
--- a/drivers/net/phy/mdio-octeon.c
+++ b/drivers/net/phy/mdio-octeon.c
@@ -244,7 +244,7 @@ static int octeon_mdiobus_remove(struct platform_device *pdev)
         struct octeon_mdiobus *bus;
         union cvmx_smix_en smi_en;
 
-        bus = dev_get_drvdata(&pdev->dev);
+        bus = platform_get_drvdata(pdev);
 
         mdiobus_unregister(bus->mii_bus);
         mdiobus_free(bus->mii_bus);
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 9ccccd40c410..50e43e64d51d 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1974,7 +1974,7 @@ static void team_setup_by_port(struct net_device *dev,
         dev->addr_len = port_dev->addr_len;
         dev->mtu = port_dev->mtu;
         memcpy(dev->broadcast, port_dev->broadcast, port_dev->addr_len);
-        memcpy(dev->dev_addr, port_dev->dev_addr, port_dev->addr_len);
+        eth_hw_addr_inherit(dev, port_dev);
 }
 
 static int team_dev_type_check_change(struct net_device *dev,
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index d84bfd4109a4..40db31233313 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -268,6 +268,14 @@ config USB_NET_DM9601
           This option adds support for Davicom DM9601 based USB 1.1
           10/100 Ethernet adapters.
 
+config USB_NET_SR9700
+        tristate "CoreChip-sz SR9700 based USB 1.1 10/100 ethernet devices"
+        depends on USB_USBNET
+        select CRC32
+        help
+          This option adds support for CoreChip-sz SR9700 based USB 1.1
+          10/100 Ethernet adapters.
+
 config USB_NET_SMSC75XX
         tristate "SMSC LAN75XX based USB 2.0 gigabit ethernet devices"
         depends on USB_USBNET
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index e8171784529d..8b342cf992fd 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -14,6 +14,7 @@ obj-$(CONFIG_USB_NET_AX88179_178A)      += ax88179_178a.o
 obj-$(CONFIG_USB_NET_CDCETHER)  += cdc_ether.o r815x.o
 obj-$(CONFIG_USB_NET_CDC_EEM)   += cdc_eem.o
 obj-$(CONFIG_USB_NET_DM9601)    += dm9601.o
+obj-$(CONFIG_USB_NET_SR9700)    += sr9700.o
 obj-$(CONFIG_USB_NET_SMSC75XX)  += smsc75xx.o
 obj-$(CONFIG_USB_NET_SMSC95XX)  += smsc95xx.o
 obj-$(CONFIG_USB_NET_GL620A)    += gl620a.o
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 606eba2872bd..3a8131582e75 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -323,7 +323,7 @@ next_desc:
         /* Never use the same address on both ends of the link, even
          * if the buggy firmware told us to.
          */
-        if (!compare_ether_addr(dev->net->dev_addr, default_modem_addr))
+        if (ether_addr_equal(dev->net->dev_addr, default_modem_addr))
                 eth_hw_addr_random(dev->net);
 
         /* make MAC addr easily distinguishable from an IP header */
diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c
new file mode 100644
index 000000000000..7ec3e0ee0783
--- /dev/null
+++ b/drivers/net/usb/sr9700.c
@@ -0,0 +1,560 @@
+/*
+ * CoreChip-sz SR9700 one chip USB 1.1 Ethernet Devices
+ *
+ * Author : Liu Junliang <liujunliang_ljl@163.com>
+ *
+ * Based on dm9601.c
+ *
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2.  This program is licensed "as is" without any warranty of any
+ * kind, whether express or implied.
+ */
+
+#include <linux/module.h>
+#include <linux/sched.h>
+#include <linux/stddef.h>
+#include <linux/init.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/mii.h>
+#include <linux/usb.h>
+#include <linux/crc32.h>
+#include <linux/usb/usbnet.h>
+
+#include "sr9700.h"
+
+static int sr_read(struct usbnet *dev, u8 reg, u16 length, void *data)
+{
+        int err;
+
+        err = usbnet_read_cmd(dev, SR_RD_REGS, SR_REQ_RD_REG, 0, reg, data,
+                              length);
+        if ((err != length) && (err >= 0))
+                err = -EINVAL;
+        return err;
+}
+
+static int sr_write(struct usbnet *dev, u8 reg, u16 length, void *data)
+{
+        int err;
+
+        err = usbnet_write_cmd(dev, SR_WR_REGS, SR_REQ_WR_REG, 0, reg, data,
+                               length);
+        if ((err >= 0) && (err < length))
+                err = -EINVAL;
+        return err;
+}
+
+static int sr_read_reg(struct usbnet *dev, u8 reg, u8 *value)
+{
+        return sr_read(dev, reg, 1, value);
+}
+
+static int sr_write_reg(struct usbnet *dev, u8 reg, u8 value)
+{
+        return usbnet_write_cmd(dev, SR_WR_REGS, SR_REQ_WR_REG,
+                                value, reg, NULL, 0);
+}
+
+static void sr_write_async(struct usbnet *dev, u8 reg, u16 length, void *data)
+{
+        usbnet_write_cmd_async(dev, SR_WR_REGS, SR_REQ_WR_REG,
+                               0, reg, data, length);
+}
+
+static void sr_write_reg_async(struct usbnet *dev, u8 reg, u8 value)
+{
+        usbnet_write_cmd_async(dev, SR_WR_REGS, SR_REQ_WR_REG,
+                               value, reg, NULL, 0);
+}
+
+static int wait_phy_eeprom_ready(struct usbnet *dev, int phy)
+{
+        int i;
+
+        for (i = 0; i < SR_SHARE_TIMEOUT; i++) {
+                u8 tmp = 0;
+                int ret;
+
+                udelay(1);
+                ret = sr_read_reg(dev, EPCR, &tmp);
+                if (ret < 0)
+                        return ret;
+
+                /* ready */
+                if (!(tmp & EPCR_ERRE))
+                        return 0;
+        }
+
+        netdev_err(dev->net, "%s write timed out!\n", phy ? "phy" : "eeprom");
+
+        return -EIO;
+}
+
+static int sr_share_read_word(struct usbnet *dev, int phy, u8 reg,
+                              __le16 *value)
+{
+        int ret;
+
+        mutex_lock(&dev->phy_mutex);
+
+        sr_write_reg(dev, EPAR, phy ? (reg | EPAR_PHY_ADR) : reg);
+        sr_write_reg(dev, EPCR, phy ? (EPCR_EPOS | EPCR_ERPRR) : EPCR_ERPRR);
+
+        ret = wait_phy_eeprom_ready(dev, phy);
+        if (ret < 0)
+                goto out_unlock;
+
+        sr_write_reg(dev, EPCR, 0x0);
+        ret = sr_read(dev, EPDR, 2, value);
+
+        netdev_dbg(dev->net, "read shared %d 0x%02x returned 0x%04x, %d\n",
+                   phy, reg, *value, ret);
+
+out_unlock:
+        mutex_unlock(&dev->phy_mutex);
+        return ret;
+}
+
+static int sr_share_write_word(struct usbnet *dev, int phy, u8 reg,
+                               __le16 value)
+{
+        int ret;
+
+        mutex_lock(&dev->phy_mutex);
+
+        ret = sr_write(dev, EPDR, 2, &value);
+        if (ret < 0)
+                goto out_unlock;
+
+        sr_write_reg(dev, EPAR, phy ? (reg | EPAR_PHY_ADR) : reg);
+        sr_write_reg(dev, EPCR, phy ? (EPCR_WEP | EPCR_EPOS | EPCR_ERPRW) :
+                    (EPCR_WEP | EPCR_ERPRW));
+
+        ret = wait_phy_eeprom_ready(dev, phy);
+        if (ret < 0)
+                goto out_unlock;
+
+        sr_write_reg(dev, EPCR, 0x0);
+
+out_unlock:
+        mutex_unlock(&dev->phy_mutex);
+        return ret;
+}
+
+static int sr_read_eeprom_word(struct usbnet *dev, u8 offset, void *value)
+{
+        return sr_share_read_word(dev, 0, offset, value);
+}
+
+static int sr9700_get_eeprom_len(struct net_device *netdev)
+{
+        return SR_EEPROM_LEN;
+}
+
+static int sr9700_get_eeprom(struct net_device *netdev,
+                             struct ethtool_eeprom *eeprom, u8 *data)
+{
+        struct usbnet *dev = netdev_priv(netdev);
+        __le16 *buf = (__le16 *)data;
+        int ret = 0;
+        int i;
+
+        /* access is 16bit */
+        if ((eeprom->offset & 0x01) || (eeprom->len & 0x01))
+                return -EINVAL;
+
+        for (i = 0; i < eeprom->len / 2; i++) {
+                ret = sr_read_eeprom_word(dev, eeprom->offset / 2 + i, buf + i);
+                if (ret < 0)
+                        break;
+        }
+
+        return ret;
+}
+
+static int sr_mdio_read(struct net_device *netdev, int phy_id, int loc)
+{
+        struct usbnet *dev = netdev_priv(netdev);
+        __le16 res;
+        int rc = 0;
+
+        if (phy_id) {
+                netdev_dbg(netdev, "Only internal phy supported\n");
+                return 0;
+        }
+
+        /* Access NSR_LINKST bit for link status instead of MII_BMSR */
+        if (loc == MII_BMSR) {
+                u8 value;
+
+                sr_read_reg(dev, NSR, &value);
+                if (value & NSR_LINKST)
+                        rc = 1;
+        }
+        sr_share_read_word(dev, 1, loc, &res);
+        if (rc == 1)
+                res = le16_to_cpu(res) | BMSR_LSTATUS;
+        else
+                res = le16_to_cpu(res) & ~BMSR_LSTATUS;
+
+        netdev_dbg(netdev, "sr_mdio_read() phy_id=0x%02x, loc=0x%02x, returns=0x%04x\n",
+                   phy_id, loc, res);
+
+        return res;
+}
+
+static void sr_mdio_write(struct net_device *netdev, int phy_id, int loc,
+                          int val)
+{
+        struct usbnet *dev = netdev_priv(netdev);
+        __le16 res = cpu_to_le16(val);
+
+        if (phy_id) {
+                netdev_dbg(netdev, "Only internal phy supported\n");
+                return;
+        }
+
+        netdev_dbg(netdev, "sr_mdio_write() phy_id=0x%02x, loc=0x%02x, val=0x%04x\n",
+                   phy_id, loc, val);
+
+        sr_share_write_word(dev, 1, loc, res);
+}
+
+static u32 sr9700_get_link(struct net_device *netdev)
+{
+        struct usbnet *dev = netdev_priv(netdev);
+        u8 value = 0;
+        int rc = 0;
+
+        /* Get the Link Status directly */
+        sr_read_reg(dev, NSR, &value);
+        if (value & NSR_LINKST)
+                rc = 1;
+
+        return rc;
+}
+
+static int sr9700_ioctl(struct net_device *netdev, struct ifreq *rq, int cmd)
+{
+        struct usbnet *dev = netdev_priv(netdev);
+
+        return generic_mii_ioctl(&dev->mii, if_mii(rq), cmd, NULL);
+}
+
+static const struct ethtool_ops sr9700_ethtool_ops = {
+        .get_drvinfo    = usbnet_get_drvinfo,
+        .get_link       = sr9700_get_link,
+        .get_msglevel   = usbnet_get_msglevel,
+        .set_msglevel   = usbnet_set_msglevel,
+        .get_eeprom_len = sr9700_get_eeprom_len,
+        .get_eeprom     = sr9700_get_eeprom,
+        .get_settings   = usbnet_get_settings,
+        .set_settings   = usbnet_set_settings,
+        .nway_reset     = usbnet_nway_reset,
+};
+
+static void sr9700_set_multicast(struct net_device *netdev)
+{
+        struct usbnet *dev = netdev_priv(netdev);
+        /* We use the 20 byte dev->data for our 8 byte filter buffer
+         * to avoid allocating memory that is tricky to free later
+         */
+        u8 *hashes = (u8 *)&dev->data;
+        /* rx_ctl setting : enable, disable_long, disable_crc */
+        u8 rx_ctl = RCR_RXEN | RCR_DIS_CRC | RCR_DIS_LONG;
+
+        memset(hashes, 0x00, SR_MCAST_SIZE);
+        /* broadcast address */
+        hashes[SR_MCAST_SIZE - 1] |= SR_MCAST_ADDR_FLAG;
+        if (netdev->flags & IFF_PROMISC) {
+                rx_ctl |= RCR_PRMSC;
+        } else if (netdev->flags & IFF_ALLMULTI ||
+                   netdev_mc_count(netdev) > SR_MCAST_MAX) {
+                rx_ctl |= RCR_RUNT;
+        } else if (!netdev_mc_empty(netdev)) {
+                struct netdev_hw_addr *ha;
+
+                netdev_for_each_mc_addr(ha, netdev) {
+                        u32 crc = ether_crc(ETH_ALEN, ha->addr) >> 26;
+                        hashes[crc >> 3] |= 1 << (crc & 0x7);
+                }
+        }
+
+        sr_write_async(dev, MAR, SR_MCAST_SIZE, hashes);
+        sr_write_reg_async(dev, RCR, rx_ctl);
+}
+
+static int sr9700_set_mac_address(struct net_device *netdev, void *p)
+{
+        struct usbnet *dev = netdev_priv(netdev);
+        struct sockaddr *addr = p;
+
+        if (!is_valid_ether_addr(addr->sa_data)) {
+                netdev_err(netdev, "not setting invalid mac address %pM\n",
+                           addr->sa_data);
+                return -EINVAL;
+        }
+
+        memcpy(netdev->dev_addr, addr->sa_data, netdev->addr_len);
+        sr_write_async(dev, PAR, 6, netdev->dev_addr);
+
+        return 0;
+}
+
+static const struct net_device_ops sr9700_netdev_ops = {
+        .ndo_open               = usbnet_open,
+        .ndo_stop               = usbnet_stop,
+        .ndo_start_xmit         = usbnet_start_xmit,
+        .ndo_tx_timeout         = usbnet_tx_timeout,
+        .ndo_change_mtu         = usbnet_change_mtu,
+        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_do_ioctl           = sr9700_ioctl,
+        .ndo_set_rx_mode        = sr9700_set_multicast,
+        .ndo_set_mac_address    = sr9700_set_mac_address,
+};
+
+static int sr9700_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        struct net_device *netdev;
+        struct mii_if_info *mii;
+        int ret;
+
+        ret = usbnet_get_endpoints(dev, intf);
+        if (ret)
+                goto out;
+
+        netdev = dev->net;
+
+        netdev->netdev_ops = &sr9700_netdev_ops;
+        netdev->ethtool_ops = &sr9700_ethtool_ops;
+        netdev->hard_header_len += SR_TX_OVERHEAD;
+        dev->hard_mtu = netdev->mtu + netdev->hard_header_len;
+        /* bulkin buffer is preferably not less than 3K */
+        dev->rx_urb_size = 3072;
+
+        mii = &dev->mii;
+        mii->dev = netdev;
+        mii->mdio_read = sr_mdio_read;
+        mii->mdio_write = sr_mdio_write;
+        mii->phy_id_mask = 0x1f;
+        mii->reg_num_mask = 0x1f;
+
+        sr_write_reg(dev, NCR, NCR_RST);
+        udelay(20);
+
+        /* read MAC
+         * After Chip Power on, the Chip will reload the MAC from
+         * EEPROM automatically to PAR. In case there is no EEPROM externally,
+         * a default MAC address is stored in PAR for making chip work properly.
+         */
+        if (sr_read(dev, PAR, ETH_ALEN, netdev->dev_addr) < 0) {
+                netdev_err(netdev, "Error reading MAC address\n");
+                ret = -ENODEV;
+                goto out;
+        }
+
+        /* power up and reset phy */
+        sr_write_reg(dev, PRR, PRR_PHY_RST);
+        /* at least 10ms, here 20ms for safe */
+        mdelay(20);
+        sr_write_reg(dev, PRR, 0);
+        /* at least 1ms, here 2ms for reading right register */
+        udelay(2 * 1000);
+
+        /* receive broadcast packets */
+        sr9700_set_multicast(netdev);
+
+        sr_mdio_write(netdev, mii->phy_id, MII_BMCR, BMCR_RESET);
+        sr_mdio_write(netdev, mii->phy_id, MII_ADVERTISE, ADVERTISE_ALL |
+                      ADVERTISE_CSMA | ADVERTISE_PAUSE_CAP);
+        mii_nway_restart(mii);
+
+out:
+        return ret;
+}
+
+static int sr9700_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        struct sk_buff *sr_skb;
+        int len;
+
+        /* skb content (packets) format :
+         *                    p0            p1            p2    ......    pm
+         *                 /      \
+         *            /                \
+         *        /                            \
+         *  /                                        \
+         * p0b0 p0b1 p0b2 p0b3 ...... p0b(n-4) p0b(n-3)...p0bn
+         *
+         * p0 : packet 0
+         * p0b0 : packet 0 byte 0
+         *
+         * b0: rx status
+         * b1: packet length (incl crc) low
+         * b2: packet length (incl crc) high
+         * b3..n-4: packet data
+         * bn-3..bn: ethernet packet crc
+         */
+        if (unlikely(skb->len < SR_RX_OVERHEAD)) {
+                netdev_err(dev->net, "unexpected tiny rx frame\n");
+                return 0;
+        }
+
+        /* one skb may contains multiple packets */
+        while (skb->len > SR_RX_OVERHEAD) {
+                if (skb->data[0] != 0x40)
+                        return 0;
+
+                /* ignore the CRC length */
+                len = (skb->data[1] | (skb->data[2] << 8)) - 4;
+
+                if (len > ETH_FRAME_LEN)
+                        return 0;
+
+                /* the last packet of current skb */
+                if (skb->len == (len + SR_RX_OVERHEAD)) {
+                        skb_pull(skb, 3);
+                        skb->len = len;
+                        skb_set_tail_pointer(skb, len);
+                        skb->truesize = len + sizeof(struct sk_buff);
+                        return 2;
+                }
+
+                /* skb_clone is used for address align */
+                sr_skb = skb_clone(skb, GFP_ATOMIC);
+                if (!sr_skb)
+                        return 0;
+
+                sr_skb->len = len;
+                sr_skb->data = skb->data + 3;
+                skb_set_tail_pointer(sr_skb, len);
+                sr_skb->truesize = len + sizeof(struct sk_buff);
+                usbnet_skb_return(dev, sr_skb);
+
+                skb_pull(skb, len + SR_RX_OVERHEAD);
+        };
+
+        return 0;
+}
+
+static struct sk_buff *sr9700_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+                                       gfp_t flags)
+{
+        int len;
+
+        /* SR9700 can only send out one ethernet packet at once.
+         *
+         * b0 b1 b2 b3 ...... b(n-4) b(n-3)...bn
+         *
+         * b0: rx status
+         * b1: packet length (incl crc) low
+         * b2: packet length (incl crc) high
+         * b3..n-4: packet data
+         * bn-3..bn: ethernet packet crc
+         */
+
+        len = skb->len;
+
+        if (skb_headroom(skb) < SR_TX_OVERHEAD) {
+                struct sk_buff *skb2;
+
+                skb2 = skb_copy_expand(skb, SR_TX_OVERHEAD, 0, flags);
+                dev_kfree_skb_any(skb);
+                skb = skb2;
+                if (!skb)
+                        return NULL;
+        }
+
+        __skb_push(skb, SR_TX_OVERHEAD);
+
+        /* usbnet adds padding if length is a multiple of packet size
+         * if so, adjust length value in header
+         */
+        if ((skb->len % dev->maxpacket) == 0)
+                len++;
+
+        skb->data[0] = len;
+        skb->data[1] = len >> 8;
+
+        return skb;
+}
+
+static void sr9700_status(struct usbnet *dev, struct urb *urb)
+{
+        int link;
+        u8 *buf;
+
+        /* format:
+           b0: net status
+           b1: tx status 1
+           b2: tx status 2
+           b3: rx status
+           b4: rx overflow
+           b5: rx count
+           b6: tx count
+           b7: gpr
+        */
+
+        if (urb->actual_length < 8)
+                return;
+
+        buf = urb->transfer_buffer;
+
+        link = !!(buf[0] & 0x40);
+        if (netif_carrier_ok(dev->net) != link) {
+                usbnet_link_change(dev, link, 1);
+                netdev_dbg(dev->net, "Link Status is: %d\n", link);
+        }
+}
+
+static int sr9700_link_reset(struct usbnet *dev)
+{
+        struct ethtool_cmd ecmd;
+
+        mii_check_media(&dev->mii, 1, 1);
+        mii_ethtool_gset(&dev->mii, &ecmd);
+
+        netdev_dbg(dev->net, "link_reset() speed: %d duplex: %d\n",
+                   ecmd.speed, ecmd.duplex);
+
+        return 0;
+}
+
+static const struct driver_info sr9700_driver_info = {
+        .description    = "CoreChip SR9700 USB Ethernet",
+        .flags          = FLAG_ETHER,
+        .bind           = sr9700_bind,
+        .rx_fixup       = sr9700_rx_fixup,
+        .tx_fixup       = sr9700_tx_fixup,
+        .status         = sr9700_status,
+        .link_reset     = sr9700_link_reset,
+        .reset          = sr9700_link_reset,
+};
+
+static const struct usb_device_id products[] = {
+        {
+                USB_DEVICE(0x0fe6, 0x9700),     /* SR9700 device */
+                .driver_info = (unsigned long)&sr9700_driver_info,
+        },
+        {},                     /* END */
+};
+
+MODULE_DEVICE_TABLE(usb, products);
+
+static struct usb_driver sr9700_usb_driver = {
+        .name           = "sr9700",
+        .id_table       = products,
+        .probe          = usbnet_probe,
+        .disconnect     = usbnet_disconnect,
+        .suspend        = usbnet_suspend,
+        .resume         = usbnet_resume,
+        .disable_hub_initiated_lpm = 1,
+};
+
+module_usb_driver(sr9700_usb_driver);
+
+MODULE_AUTHOR("liujl <liujunliang_ljl@163.com>");
+MODULE_DESCRIPTION("SR9700 one chip USB 1.1 USB to Ethernet device from http://www.corechip-sz.com/");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/usb/sr9700.h b/drivers/net/usb/sr9700.h
new file mode 100644
index 000000000000..fd687c575e74
--- /dev/null
+++ b/drivers/net/usb/sr9700.h
@@ -0,0 +1,173 @@
+/*
+ * CoreChip-sz SR9700 one chip USB 1.1 Ethernet Devices
+ *
+ * Author : Liu Junliang <liujunliang_ljl@163.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ */
+
+#ifndef _SR9700_H
+#define _SR9700_H
+
+/* sr9700 spec. register table on Linux platform */
+
+/* Network Control Reg */
+#define NCR                     0x00
+#define         NCR_RST                 (1 << 0)
+#define         NCR_LBK                 (3 << 1)
+#define         NCR_FDX                 (1 << 3)
+#define         NCR_WAKEEN              (1 << 6)
+/* Network Status Reg */
+#define NSR                     0x01
+#define         NSR_RXRDY               (1 << 0)
+#define         NSR_RXOV                (1 << 1)
+#define         NSR_TX1END              (1 << 2)
+#define         NSR_TX2END              (1 << 3)
+#define         NSR_TXFULL              (1 << 4)
+#define         NSR_WAKEST              (1 << 5)
+#define         NSR_LINKST              (1 << 6)
+#define         NSR_SPEED               (1 << 7)
+/* Tx Control Reg */
+#define TCR                     0x02
+#define         TCR_CRC_DIS             (1 << 1)
+#define         TCR_PAD_DIS             (1 << 2)
+#define         TCR_LC_CARE             (1 << 3)
+#define         TCR_CRS_CARE    (1 << 4)
+#define         TCR_EXCECM              (1 << 5)
+#define         TCR_LF_EN               (1 << 6)
+/* Tx Status Reg for Packet Index 1 */
+#define TSR1            0x03
+#define         TSR1_EC                 (1 << 2)
+#define         TSR1_COL                (1 << 3)
+#define         TSR1_LC                 (1 << 4)
+#define         TSR1_NC                 (1 << 5)
+#define         TSR1_LOC                (1 << 6)
+#define         TSR1_TLF                (1 << 7)
+/* Tx Status Reg for Packet Index 2 */
+#define TSR2            0x04
+#define         TSR2_EC                 (1 << 2)
+#define         TSR2_COL                (1 << 3)
+#define         TSR2_LC                 (1 << 4)
+#define         TSR2_NC                 (1 << 5)
+#define         TSR2_LOC                (1 << 6)
+#define         TSR2_TLF                (1 << 7)
+/* Rx Control Reg*/
+#define RCR                     0x05
+#define         RCR_RXEN                (1 << 0)
+#define         RCR_PRMSC               (1 << 1)
+#define         RCR_RUNT                (1 << 2)
+#define         RCR_ALL                 (1 << 3)
+#define         RCR_DIS_CRC             (1 << 4)
+#define         RCR_DIS_LONG    (1 << 5)
+/* Rx Status Reg */
+#define RSR                     0x06
+#define         RSR_AE                  (1 << 2)
+#define         RSR_MF                  (1 << 6)
+#define         RSR_RF                  (1 << 7)
+/* Rx Overflow Counter Reg */
+#define ROCR            0x07
+#define         ROCR_ROC                (0x7F << 0)
+#define         ROCR_RXFU               (1 << 7)
+/* Back Pressure Threshold Reg */
+#define BPTR            0x08
+#define         BPTR_JPT                (0x0F << 0)
+#define         BPTR_BPHW               (0x0F << 4)
+/* Flow Control Threshold Reg */
+#define FCTR            0x09
+#define         FCTR_LWOT               (0x0F << 0)
+#define         FCTR_HWOT               (0x0F << 4)
+/* rx/tx Flow Control Reg */
+#define FCR                     0x0A
+#define         FCR_FLCE                (1 << 0)
+#define         FCR_BKPA                (1 << 4)
+#define         FCR_TXPEN               (1 << 5)
+#define         FCR_TXPF                (1 << 6)
+#define         FCR_TXP0                (1 << 7)
+/* Eeprom & Phy Control Reg */
+#define EPCR            0x0B
+#define         EPCR_ERRE               (1 << 0)
+#define         EPCR_ERPRW              (1 << 1)
+#define         EPCR_ERPRR              (1 << 2)
+#define         EPCR_EPOS               (1 << 3)
+#define         EPCR_WEP                (1 << 4)
+/* Eeprom & Phy Address Reg */
+#define EPAR            0x0C
+#define         EPAR_EROA               (0x3F << 0)
+#define         EPAR_PHY_ADR_MASK       (0x03 << 6)
+#define         EPAR_PHY_ADR            (0x01 << 6)
+/* Eeprom &     Phy Data Reg */
+#define EPDR            0x0D    /* 0x0D ~ 0x0E for Data Reg Low & High */
+/* Wakeup Control Reg */
+#define WCR                     0x0F
+#define         WCR_MAGICST             (1 << 0)
+#define         WCR_LINKST              (1 << 2)
+#define         WCR_MAGICEN             (1 << 3)
+#define         WCR_LINKEN              (1 << 5)
+/* Physical Address Reg */
+#define PAR                     0x10    /* 0x10 ~ 0x15 6 bytes for PAR */
+/* Multicast Address Reg */
+#define MAR                     0x16    /* 0x16 ~ 0x1D 8 bytes for MAR */
+/* 0x1e unused */
+/* Phy Reset Reg */
+#define PRR                     0x1F
+#define         PRR_PHY_RST             (1 << 0)
+/* Tx sdram Write Pointer Address Low */
+#define TWPAL           0x20
+/* Tx sdram Write Pointer Address High */
+#define TWPAH           0x21
+/* Tx sdram Read Pointer Address Low */
+#define TRPAL           0x22
+/* Tx sdram Read Pointer Address High */
+#define TRPAH           0x23
+/* Rx sdram Write Pointer Address Low */
+#define RWPAL           0x24
+/* Rx sdram Write Pointer Address High */
+#define RWPAH           0x25
+/* Rx sdram Read Pointer Address Low */
+#define RRPAL           0x26
+/* Rx sdram Read Pointer Address High */
+#define RRPAH           0x27
+/* Vendor ID register */
+#define VID                     0x28    /* 0x28 ~ 0x29 2 bytes for VID */
+/* Product ID register */
+#define PID                     0x2A    /* 0x2A ~ 0x2B 2 bytes for PID */
+/* CHIP Revision register */
+#define CHIPR           0x2C
+/* 0x2D --> 0xEF unused */
+/* USB Device Address */
+#define USBDA           0xF0
+#define         USBDA_USBFA             (0x7F << 0)
+/* RX packet Counter Reg */
+#define RXC                     0xF1
+/* Tx packet Counter & USB Status Reg */
+#define TXC_USBS        0xF2
+#define         TXC_USBS_TXC0           (1 << 0)
+#define         TXC_USBS_TXC1           (1 << 1)
+#define         TXC_USBS_TXC2           (1 << 2)
+#define         TXC_USBS_EP1RDY         (1 << 5)
+#define         TXC_USBS_SUSFLAG        (1 << 6)
+#define         TXC_USBS_RXFAULT        (1 << 7)
+/* USB Control register */
+#define USBC            0xF4
+#define         USBC_EP3NAK             (1 << 4)
+#define         USBC_EP3ACK             (1 << 5)
+
+/* Register access commands and flags */
+#define SR_RD_REGS              0x00
+#define SR_WR_REGS              0x01
+#define SR_WR_REG               0x03
+#define SR_REQ_RD_REG   (USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE)
+#define SR_REQ_WR_REG   (USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE)
+
+/* parameters */
+#define SR_SHARE_TIMEOUT        1000
+#define SR_EEPROM_LEN           256
+#define SR_MCAST_SIZE           8
+#define SR_MCAST_ADDR_FLAG      0x80
+#define SR_MCAST_MAX            64
+#define SR_TX_OVERHEAD          2       /* 2bytes header */
+#define SR_RX_OVERHEAD          7       /* 3bytes header + 4crc tail */
+
+#endif  /* _SR9700_H */
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index f21600277583..defec2b3c5a4 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1538,6 +1538,8 @@ static int virtnet_probe(struct virtio_device *vdev)
                         dev->features |= dev->hw_features & (NETIF_F_ALL_TSO|NETIF_F_UFO);
                 /* (!csum && gso) case will be fixed by register_netdev() */
         }
+        if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_CSUM))
+                dev->features |= NETIF_F_RXCSUM;
 
         dev->vlan_features = dev->features;
 
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 6b560f373fc3..ebda3a1c2f31 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -478,7 +478,7 @@ static struct vxlan_fdb *__vxlan_find_mac(struct vxlan_dev *vxlan,
         struct vxlan_fdb *f;
 
         hlist_for_each_entry_rcu(f, head, hlist) {
-                if (compare_ether_addr(mac, f->eth_addr) == 0)
+                if (ether_addr_equal(mac, f->eth_addr))
                         return f;
         }
 
@@ -1049,8 +1049,7 @@ static void vxlan_rcv(struct vxlan_sock *vs,
         skb->protocol = eth_type_trans(skb, vxlan->dev);
 
         /* Ignore packet loops (and multicast echo) */
-        if (compare_ether_addr(eth_hdr(skb)->h_source,
-                               vxlan->dev->dev_addr) == 0)
+        if (ether_addr_equal(eth_hdr(skb)->h_source, vxlan->dev->dev_addr))
                 goto drop;
 
         /* Re-examine inner Ethernet packet */
@@ -1320,7 +1319,7 @@ static bool route_shortcircuit(struct net_device *dev, struct sk_buff *skb)
         if (n) {
                 bool diff;
 
-                diff = compare_ether_addr(eth_hdr(skb)->h_dest, n->ha) != 0;
+                diff = !ether_addr_equal(eth_hdr(skb)->h_dest, n->ha);
                 if (diff) {
                         memcpy(eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest,
                                 dev->addr_len);
@@ -1381,7 +1380,7 @@ static int handle_offloads(struct sk_buff *skb)
 }
 
 #if IS_ENABLED(CONFIG_IPV6)
-static int vxlan6_xmit_skb(struct net *net, struct vxlan_sock *vs,
+static int vxlan6_xmit_skb(struct vxlan_sock *vs,
                            struct dst_entry *dst, struct sk_buff *skb,
                            struct net_device *dev, struct in6_addr *saddr,
                            struct in6_addr *daddr, __u8 prio, __u8 ttl,
@@ -1398,6 +1397,8 @@ static int vxlan6_xmit_skb(struct net *net, struct vxlan_sock *vs,
                 skb->encapsulation = 1;
         }
 
+        skb_scrub_packet(skb, false);
+
         min_headroom = LL_RESERVED_SPACE(dst->dev) + dst->header_len
                         + VXLAN_HLEN + sizeof(struct ipv6hdr)
                         + (vlan_tx_tag_present(skb) ? VLAN_HLEN : 0);
@@ -1433,7 +1434,6 @@ static int vxlan6_xmit_skb(struct net *net, struct vxlan_sock *vs,
         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
         IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
                               IPSKB_REROUTED);
-        skb_dst_drop(skb);
         skb_dst_set(skb, dst);
 
         if (!skb_is_gso(skb) && !(dst->dev->features & NETIF_F_IPV6_CSUM)) {
@@ -1476,7 +1476,7 @@ static int vxlan6_xmit_skb(struct net *net, struct vxlan_sock *vs,
 }
 #endif
 
-int vxlan_xmit_skb(struct net *net, struct vxlan_sock *vs,
+int vxlan_xmit_skb(struct vxlan_sock *vs,
                    struct rtable *rt, struct sk_buff *skb,
                    __be32 src, __be32 dst, __u8 tos, __u8 ttl, __be16 df,
                    __be16 src_port, __be16 dst_port, __be32 vni)
@@ -1529,8 +1529,8 @@ int vxlan_xmit_skb(struct net *net, struct vxlan_sock *vs,
         if (err)
                 return err;
 
-        return iptunnel_xmit(net, rt, skb, src, dst,
-                        IPPROTO_UDP, tos, ttl, df);
+        return iptunnel_xmit(rt, skb, src, dst, IPPROTO_UDP, tos, ttl, df,
+                             false);
 }
 EXPORT_SYMBOL_GPL(vxlan_xmit_skb);
 
@@ -1653,7 +1653,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                 tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
                 ttl = ttl ? : ip4_dst_hoplimit(&rt->dst);
 
-                err = vxlan_xmit_skb(dev_net(dev), vxlan->vn_sock, rt, skb,
+                err = vxlan_xmit_skb(vxlan->vn_sock, rt, skb,
                                      fl4.saddr, dst->sin.sin_addr.s_addr,
                                      tos, ttl, df, src_port, dst_port,
                                      htonl(vni << 8));
@@ -1705,7 +1705,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
 
                 ttl = ttl ? : ip6_dst_hoplimit(ndst);
 
-                err = vxlan6_xmit_skb(dev_net(dev), vxlan->vn_sock, ndst, skb,
+                err = vxlan6_xmit_skb(vxlan->vn_sock, ndst, skb,
                                       dev, &fl6.saddr, &fl6.daddr, 0, ttl,
                                       src_port, dst_port, htonl(vni << 8));
 #endif
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index d0adbaf86186..7fe19648f10e 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -2693,7 +2693,7 @@ static struct net_device *init_wifidev(struct airo_info *ai,
         dev->base_addr = ethdev->base_addr;
         dev->wireless_data = ethdev->wireless_data;
         SET_NETDEV_DEV(dev, ethdev->dev.parent);
-        memcpy(dev->dev_addr, ethdev->dev_addr, dev->addr_len);
+        eth_hw_addr_inherit(dev, ethdev);
         err = register_netdev(dev);
         if (err<0) {
                 free_netdev(dev);
diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c
index b40792900bd5..f8b969f518f8 100644
--- a/drivers/net/wireless/ath/ath10k/ce.c
+++ b/drivers/net/wireless/ath/ath10k/ce.c
@@ -637,6 +637,7 @@ static int ath10k_ce_completed_send_next_nolock(struct ce_state *ce_state,
                 ath10k_pci_wake(ar);
                 src_ring->hw_index =
                         ath10k_ce_src_ring_read_index_get(ar, ctrl_addr);
+                src_ring->hw_index &= nentries_mask;
                 ath10k_pci_sleep(ar);
         }
         read_index = src_ring->hw_index;
@@ -950,10 +951,12 @@ static int ath10k_ce_init_src_ring(struct ath10k *ar,
 
         ath10k_pci_wake(ar);
         src_ring->sw_index = ath10k_ce_src_ring_read_index_get(ar, ctrl_addr);
+        src_ring->sw_index &= src_ring->nentries_mask;
         src_ring->hw_index = src_ring->sw_index;
 
         src_ring->write_index =
                 ath10k_ce_src_ring_write_index_get(ar, ctrl_addr);
+        src_ring->write_index &= src_ring->nentries_mask;
         ath10k_pci_sleep(ar);
 
         src_ring->per_transfer_context = (void **)ptr;
@@ -1035,8 +1038,10 @@ static int ath10k_ce_init_dest_ring(struct ath10k *ar,
 
         ath10k_pci_wake(ar);
         dest_ring->sw_index = ath10k_ce_dest_ring_read_index_get(ar, ctrl_addr);
+        dest_ring->sw_index &= dest_ring->nentries_mask;
         dest_ring->write_index =
                 ath10k_ce_dest_ring_write_index_get(ar, ctrl_addr);
+        dest_ring->write_index &= dest_ring->nentries_mask;
         ath10k_pci_sleep(ar);
 
         dest_ring->per_transfer_context = (void **)ptr;
diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
index 9f21ecb239d7..e4bba563ed42 100644
--- a/drivers/net/wireless/ath/ath10k/core.h
+++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -38,6 +38,7 @@
 #define ATH10K_SCAN_ID 0
 #define WMI_READY_TIMEOUT (5 * HZ)
 #define ATH10K_FLUSH_TIMEOUT_HZ (5*HZ)
+#define ATH10K_NUM_CHANS 38
 
 /* Antenna noise floor */
 #define ATH10K_DEFAULT_NOISE_FLOOR -95
@@ -285,6 +286,7 @@ struct ath10k {
         u32 hw_max_tx_power;
         u32 ht_cap_info;
         u32 vht_cap_info;
+        u32 num_rf_chains;
 
         struct targetdef *targetdef;
         struct hostdef *hostdef;
@@ -374,6 +376,12 @@ struct ath10k {
 
         struct work_struct restart_work;
 
+        /* cycle count is reported twice for each visited channel during scan.
+         * access protected by data_lock */
+        u32 survey_last_rx_clear_count;
+        u32 survey_last_cycle_count;
+        struct survey_info survey[ATH10K_NUM_CHANS];
+
 #ifdef CONFIG_ATH10K_DEBUGFS
         struct ath10k_debug debug;
 #endif
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index 04f08d946479..e784c40b904b 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -804,6 +804,37 @@ static bool ath10k_htt_rx_has_fcs_err(struct sk_buff *skb)
         return false;
 }
 
+static int ath10k_htt_rx_get_csum_state(struct sk_buff *skb)
+{
+        struct htt_rx_desc *rxd;
+        u32 flags, info;
+        bool is_ip4, is_ip6;
+        bool is_tcp, is_udp;
+        bool ip_csum_ok, tcpudp_csum_ok;
+
+        rxd = (void *)skb->data - sizeof(*rxd);
+        flags = __le32_to_cpu(rxd->attention.flags);
+        info = __le32_to_cpu(rxd->msdu_start.info1);
+
+        is_ip4 = !!(info & RX_MSDU_START_INFO1_IPV4_PROTO);
+        is_ip6 = !!(info & RX_MSDU_START_INFO1_IPV6_PROTO);
+        is_tcp = !!(info & RX_MSDU_START_INFO1_TCP_PROTO);
+        is_udp = !!(info & RX_MSDU_START_INFO1_UDP_PROTO);
+        ip_csum_ok = !(flags & RX_ATTENTION_FLAGS_IP_CHKSUM_FAIL);
+        tcpudp_csum_ok = !(flags & RX_ATTENTION_FLAGS_TCP_UDP_CHKSUM_FAIL);
+
+        if (!is_ip4 && !is_ip6)
+                return CHECKSUM_NONE;
+        if (!is_tcp && !is_udp)
+                return CHECKSUM_NONE;
+        if (!ip_csum_ok)
+                return CHECKSUM_NONE;
+        if (!tcpudp_csum_ok)
+                return CHECKSUM_NONE;
+
+        return CHECKSUM_UNNECESSARY;
+}
+
 static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
                                   struct htt_rx_indication *rx)
 {
@@ -815,6 +846,7 @@ static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
         u8 *fw_desc;
         int i, j;
         int ret;
+        int ip_summed;
 
         memset(&info, 0, sizeof(info));
 
@@ -889,6 +921,11 @@ static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
                                 continue;
                         }
 
+                        /* The skb is not yet processed and it may be
+                         * reallocated. Since the offload is in the original
+                         * skb extract the checksum now and assign it later */
+                        ip_summed = ath10k_htt_rx_get_csum_state(msdu_head);
+
                         info.skb     = msdu_head;
                         info.fcs_err = ath10k_htt_rx_has_fcs_err(msdu_head);
                         info.signal  = ATH10K_DEFAULT_NOISE_FLOOR;
@@ -914,6 +951,8 @@ static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
                         if (ath10k_htt_rx_hdr_is_amsdu((void *)info.skb->data))
                                 ath10k_dbg(ATH10K_DBG_HTT, "htt mpdu is amsdu\n");
 
+                        info.skb->ip_summed = ip_summed;
+
                         ath10k_dbg_dump(ATH10K_DBG_HTT_DUMP, NULL, "htt mpdu: ",
                                         info.skb->data, info.skb->len);
                         ath10k_process_rx(htt->ar, &info);
@@ -980,6 +1019,7 @@ static void ath10k_htt_rx_frag_handler(struct ath10k_htt *htt,
         info.status = HTT_RX_IND_MPDU_STATUS_OK;
         info.encrypt_type = MS(__le32_to_cpu(rxd->mpdu_start.info0),
                                 RX_MPDU_START_INFO0_ENCRYPT_TYPE);
+        info.skb->ip_summed = ath10k_htt_rx_get_csum_state(info.skb);
 
         if (tkip_mic_err) {
                 ath10k_warn("tkip mic error\n");
diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c
index dc3f3e8de32b..656c2546b294 100644
--- a/drivers/net/wireless/ath/ath10k/htt_tx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
@@ -465,6 +465,8 @@ int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
         flags1  = 0;
         flags1 |= SM((u16)vdev_id, HTT_DATA_TX_DESC_FLAGS1_VDEV_ID);
         flags1 |= SM((u16)tid, HTT_DATA_TX_DESC_FLAGS1_EXT_TID);
+        flags1 |= HTT_DATA_TX_DESC_FLAGS1_CKSUM_L3_OFFLOAD;
+        flags1 |= HTT_DATA_TX_DESC_FLAGS1_CKSUM_L4_OFFLOAD;
 
         frags_paddr = ATH10K_SKB_CB(txfrag)->paddr;
 
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index d0a776124f13..cf2ba4d850c9 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -1406,9 +1406,9 @@ static void ath10k_tx_h_qos_workaround(struct ieee80211_hw *hw,
                 return;
 
         qos_ctl = ieee80211_get_qos_ctl(hdr);
-        memmove(qos_ctl, qos_ctl + IEEE80211_QOS_CTL_LEN,
-                skb->len - ieee80211_hdrlen(hdr->frame_control));
-        skb_trim(skb, skb->len - IEEE80211_QOS_CTL_LEN);
+        memmove(skb->data + IEEE80211_QOS_CTL_LEN,
+                skb->data, (void *)qos_ctl - (void *)skb->data);
+        skb_pull(skb, IEEE80211_QOS_CTL_LEN);
 }
 
 static void ath10k_tx_h_update_wep_key(struct sk_buff *skb)
@@ -1925,6 +1925,8 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
 
         mutex_lock(&ar->conf_mutex);
 
+        memset(arvif, 0, sizeof(*arvif));
+
         arvif->ar = ar;
         arvif->vif = vif;
 
@@ -2338,6 +2340,8 @@ static int ath10k_hw_scan(struct ieee80211_hw *hw,
                         arg.ssids[i].len  = req->ssids[i].ssid_len;
                         arg.ssids[i].ssid = req->ssids[i].ssid;
                 }
+        } else {
+                arg.scan_ctrl_flags |= WMI_SCAN_FLAG_PASSIVE;
         }
 
         if (req->n_channels) {
@@ -2934,6 +2938,41 @@ static void ath10k_restart_complete(struct ieee80211_hw *hw)
         mutex_unlock(&ar->conf_mutex);
 }
 
+static int ath10k_get_survey(struct ieee80211_hw *hw, int idx,
+                             struct survey_info *survey)
+{
+        struct ath10k *ar = hw->priv;
+        struct ieee80211_supported_band *sband;
+        struct survey_info *ar_survey = &ar->survey[idx];
+        int ret = 0;
+
+        mutex_lock(&ar->conf_mutex);
+
+        sband = hw->wiphy->bands[IEEE80211_BAND_2GHZ];
+        if (sband && idx >= sband->n_channels) {
+                idx -= sband->n_channels;
+                sband = NULL;
+        }
+
+        if (!sband)
+                sband = hw->wiphy->bands[IEEE80211_BAND_5GHZ];
+
+        if (!sband || idx >= sband->n_channels) {
+                ret = -ENOENT;
+                goto exit;
+        }
+
+        spin_lock_bh(&ar->data_lock);
+        memcpy(survey, ar_survey, sizeof(*survey));
+        spin_unlock_bh(&ar->data_lock);
+
+        survey->channel = &sband->channels[idx];
+
+exit:
+        mutex_unlock(&ar->conf_mutex);
+        return ret;
+}
+
 static const struct ieee80211_ops ath10k_ops = {
         .tx                             = ath10k_tx,
         .start                          = ath10k_start,
@@ -2955,6 +2994,7 @@ static const struct ieee80211_ops ath10k_ops = {
         .flush                          = ath10k_flush,
         .tx_last_beacon                 = ath10k_tx_last_beacon,
         .restart_complete               = ath10k_restart_complete,
+        .get_survey                     = ath10k_get_survey,
 #ifdef CONFIG_PM
         .suspend                        = ath10k_suspend,
         .resume                         = ath10k_resume,
@@ -3076,9 +3116,15 @@ static const struct ieee80211_iface_limit ath10k_if_limits[] = {
         .max    = 8,
         .types  = BIT(NL80211_IFTYPE_STATION)
                 | BIT(NL80211_IFTYPE_P2P_CLIENT)
-                | BIT(NL80211_IFTYPE_P2P_GO)
-                | BIT(NL80211_IFTYPE_AP)
-        }
+        },
+        {
+        .max    = 3,
+        .types  = BIT(NL80211_IFTYPE_P2P_GO)
+        },
+        {
+        .max    = 7,
+        .types  = BIT(NL80211_IFTYPE_AP)
+        },
 };
 
 static const struct ieee80211_iface_combination ath10k_if_comb = {
@@ -3093,19 +3139,18 @@ static struct ieee80211_sta_vht_cap ath10k_create_vht_cap(struct ath10k *ar)
 {
         struct ieee80211_sta_vht_cap vht_cap = {0};
         u16 mcs_map;
+        int i;
 
         vht_cap.vht_supported = 1;
         vht_cap.cap = ar->vht_cap_info;
 
-        /* FIXME: check dynamically how many streams board supports */
-        mcs_map = IEEE80211_VHT_MCS_SUPPORT_0_9 << 0 |
-                IEEE80211_VHT_MCS_SUPPORT_0_9 << 2 |
-                IEEE80211_VHT_MCS_SUPPORT_0_9 << 4 |
-                IEEE80211_VHT_MCS_NOT_SUPPORTED << 6 |
-                IEEE80211_VHT_MCS_NOT_SUPPORTED << 8 |
-                IEEE80211_VHT_MCS_NOT_SUPPORTED << 10 |
-                IEEE80211_VHT_MCS_NOT_SUPPORTED << 12 |
-                IEEE80211_VHT_MCS_NOT_SUPPORTED << 14;
+        mcs_map = 0;
+        for (i = 0; i < 8; i++) {
+                if (i < ar->num_rf_chains)
+                        mcs_map |= IEEE80211_VHT_MCS_SUPPORT_0_9 << (i*2);
+                else
+                        mcs_map |= IEEE80211_VHT_MCS_NOT_SUPPORTED << (i*2);
+        }
 
         vht_cap.vht_mcs.rx_mcs_map = cpu_to_le16(mcs_map);
         vht_cap.vht_mcs.tx_mcs_map = cpu_to_le16(mcs_map);
@@ -3168,7 +3213,7 @@ static struct ieee80211_sta_ht_cap ath10k_get_ht_cap(struct ath10k *ar)
         if (ar->vht_cap_info & WMI_VHT_CAP_MAX_MPDU_LEN_MASK)
                 ht_cap.cap |= IEEE80211_HT_CAP_MAX_AMSDU;
 
-        for (i = 0; i < WMI_MAX_SPATIAL_STREAM; i++)
+        for (i = 0; i < ar->num_rf_chains; i++)
                 ht_cap.mcs.rx_mask[i] = 0xFF;
 
         ht_cap.mcs.tx_params |= IEEE80211_HT_MCS_TX_DEFINED;
@@ -3310,6 +3355,8 @@ int ath10k_mac_register(struct ath10k *ar)
         ar->hw->wiphy->iface_combinations = &ath10k_if_comb;
         ar->hw->wiphy->n_iface_combinations = 1;
 
+        ar->hw->netdev_features = NETIF_F_HW_CSUM;
+
         ret = ath_regd_init(&ar->ath_common.regulatory, ar->hw->wiphy,
                             ath10k_reg_notifier);
         if (ret) {
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index c71b488eba9f..e2f9ef50b1bd 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -32,7 +32,7 @@
 #include "ce.h"
 #include "pci.h"
 
-unsigned int ath10k_target_ps;
+static unsigned int ath10k_target_ps;
 module_param(ath10k_target_ps, uint, 0644);
 MODULE_PARM_DESC(ath10k_target_ps, "Enable ath10k Target (SoC) PS option");
 
@@ -56,6 +56,8 @@ static void ath10k_pci_rx_pipe_cleanup(struct hif_ce_pipe_info *pipe_info);
 static void ath10k_pci_stop_ce(struct ath10k *ar);
 static void ath10k_pci_device_reset(struct ath10k *ar);
 static int ath10k_pci_reset_target(struct ath10k *ar);
+static int ath10k_pci_start_intr(struct ath10k *ar);
+static void ath10k_pci_stop_intr(struct ath10k *ar);
 
 static const struct ce_attr host_ce_config_wlan[] = {
         /* host->target HTC control and raw streams */
@@ -1254,10 +1256,25 @@ static void ath10k_pci_ce_deinit(struct ath10k *ar)
         }
 }
 
+static void ath10k_pci_disable_irqs(struct ath10k *ar)
+{
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+        int i;
+
+        for (i = 0; i < max(1, ar_pci->num_msi_intrs); i++)
+                disable_irq(ar_pci->pdev->irq + i);
+}
+
 static void ath10k_pci_hif_stop(struct ath10k *ar)
 {
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+
         ath10k_dbg(ATH10K_DBG_PCI, "%s\n", __func__);
 
+        /* Irqs are never explicitly re-enabled. They are implicitly re-enabled
+         * by ath10k_pci_start_intr(). */
+        ath10k_pci_disable_irqs(ar);
+
         ath10k_pci_stop_ce(ar);
 
         /* At this point, asynchronous threads are stopped, the target should
@@ -1267,6 +1284,8 @@ static void ath10k_pci_hif_stop(struct ath10k *ar)
         ath10k_pci_process_ce(ar);
         ath10k_pci_cleanup_ce(ar);
         ath10k_pci_buffer_cleanup(ar);
+
+        ar_pci->started = 0;
 }
 
 static int ath10k_pci_hif_exchange_bmi_msg(struct ath10k *ar,
@@ -1740,8 +1759,15 @@ static void ath10k_pci_fw_interrupt_handler(struct ath10k *ar)
 
 static int ath10k_pci_hif_power_up(struct ath10k *ar)
 {
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         int ret;
 
+        ret = ath10k_pci_start_intr(ar);
+        if (ret) {
+                ath10k_err("could not start interrupt handling (%d)\n", ret);
+                goto err;
+        }
+
         /*
          * Bring the target up cleanly.
          *
@@ -1756,15 +1782,11 @@ static int ath10k_pci_hif_power_up(struct ath10k *ar)
 
         ret = ath10k_pci_reset_target(ar);
         if (ret)
-                goto err;
+                goto err_irq;
 
-        if (ath10k_target_ps) {
-                ath10k_dbg(ATH10K_DBG_PCI, "on-chip power save enabled\n");
-        } else {
+        if (!test_bit(ATH10K_PCI_FEATURE_SOC_POWER_SAVE, ar_pci->features))
                 /* Force AWAKE forever */
-                ath10k_dbg(ATH10K_DBG_PCI, "on-chip power save disabled\n");
                 ath10k_do_pci_wake(ar);
-        }
 
         ret = ath10k_pci_ce_init(ar);
         if (ret)
@@ -1785,16 +1807,22 @@ static int ath10k_pci_hif_power_up(struct ath10k *ar)
 err_ce:
         ath10k_pci_ce_deinit(ar);
 err_ps:
-        if (!ath10k_target_ps)
+        if (!test_bit(ATH10K_PCI_FEATURE_SOC_POWER_SAVE, ar_pci->features))
                 ath10k_do_pci_sleep(ar);
+err_irq:
+        ath10k_pci_stop_intr(ar);
 err:
         return ret;
 }
 
 static void ath10k_pci_hif_power_down(struct ath10k *ar)
 {
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+
+        ath10k_pci_stop_intr(ar);
+
         ath10k_pci_ce_deinit(ar);
-        if (!ath10k_target_ps)
+        if (!test_bit(ATH10K_PCI_FEATURE_SOC_POWER_SAVE, ar_pci->features))
                 ath10k_do_pci_sleep(ar);
 }
 
@@ -1990,8 +2018,13 @@ static int ath10k_pci_start_intr_msix(struct ath10k *ar, int num)
         ret = request_irq(ar_pci->pdev->irq + MSI_ASSIGN_FW,
                           ath10k_pci_msi_fw_handler,
                           IRQF_SHARED, "ath10k_pci", ar);
-        if (ret)
+        if (ret) {
+                ath10k_warn("request_irq(%d) failed %d\n",
+                            ar_pci->pdev->irq + MSI_ASSIGN_FW, ret);
+
+                pci_disable_msi(ar_pci->pdev);
                 return ret;
+        }
 
         for (i = MSI_ASSIGN_CE_INITIAL; i <= MSI_ASSIGN_CE_MAX; i++) {
                 ret = request_irq(ar_pci->pdev->irq + i,
@@ -2239,6 +2272,9 @@ static void ath10k_pci_dump_features(struct ath10k_pci *ar_pci)
                 case ATH10K_PCI_FEATURE_HW_1_0_WORKAROUND:
                         ath10k_dbg(ATH10K_DBG_PCI, "QCA988X_1.0 workaround enabled\n");
                         break;
+                case ATH10K_PCI_FEATURE_SOC_POWER_SAVE:
+                        ath10k_dbg(ATH10K_DBG_PCI, "QCA98XX SoC power save enabled\n");
+                        break;
                 }
         }
 }
@@ -2274,6 +2310,9 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
                 goto err_ar_pci;
         }
 
+        if (ath10k_target_ps)
+                set_bit(ATH10K_PCI_FEATURE_SOC_POWER_SAVE, ar_pci->features);
+
         ath10k_pci_dump_features(ar_pci);
 
         ar = ath10k_core_create(ar_pci, ar_pci->dev, &ath10k_pci_hif_ops);
@@ -2358,22 +2397,14 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
 
         ar_pci->cacheline_sz = dma_get_cache_alignment();
 
-        ret = ath10k_pci_start_intr(ar);
-        if (ret) {
-                ath10k_err("could not start interrupt handling (%d)\n", ret);
-                goto err_iomap;
-        }
-
         ret = ath10k_core_register(ar);
         if (ret) {
                 ath10k_err("could not register driver core (%d)\n", ret);
-                goto err_intr;
+                goto err_iomap;
         }
 
         return 0;
 
-err_intr:
-        ath10k_pci_stop_intr(ar);
 err_iomap:
         pci_iounmap(pdev, mem);
 err_master:
@@ -2410,7 +2441,6 @@ static void ath10k_pci_remove(struct pci_dev *pdev)
         tasklet_kill(&ar_pci->msi_fw_err);
 
         ath10k_core_unregister(ar);
-        ath10k_pci_stop_intr(ar);
 
         pci_set_drvdata(pdev, NULL);
         pci_iounmap(pdev, ar_pci->mem);
diff --git a/drivers/net/wireless/ath/ath10k/pci.h b/drivers/net/wireless/ath/ath10k/pci.h
index d3a2e6cc9179..871bb339d56d 100644
--- a/drivers/net/wireless/ath/ath10k/pci.h
+++ b/drivers/net/wireless/ath/ath10k/pci.h
@@ -153,6 +153,7 @@ struct service_to_pipe {
 enum ath10k_pci_features {
         ATH10K_PCI_FEATURE_MSI_X                = 0,
         ATH10K_PCI_FEATURE_HW_1_0_WORKAROUND    = 1,
+        ATH10K_PCI_FEATURE_SOC_POWER_SAVE       = 2,
 
         /* keep last */
         ATH10K_PCI_FEATURE_COUNT
@@ -335,20 +336,22 @@ static inline u32 ath10k_pci_read32(struct ath10k *ar, u32 offset)
         return ioread32(ar_pci->mem + offset);
 }
 
-extern unsigned int ath10k_target_ps;
-
 void ath10k_do_pci_wake(struct ath10k *ar);
 void ath10k_do_pci_sleep(struct ath10k *ar);
 
 static inline void ath10k_pci_wake(struct ath10k *ar)
 {
-        if (ath10k_target_ps)
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+
+        if (test_bit(ATH10K_PCI_FEATURE_SOC_POWER_SAVE, ar_pci->features))
                 ath10k_do_pci_wake(ar);
 }
 
 static inline void ath10k_pci_sleep(struct ath10k *ar)
 {
-        if (ath10k_target_ps)
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+
+        if (test_bit(ATH10K_PCI_FEATURE_SOC_POWER_SAVE, ar_pci->features))
                 ath10k_do_pci_sleep(ar);
 }
 
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index 5e4246015cdc..55f90c761868 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -390,9 +390,82 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
         return 0;
 }
 
+static int freq_to_idx(struct ath10k *ar, int freq)
+{
+        struct ieee80211_supported_band *sband;
+        int band, ch, idx = 0;
+
+        for (band = IEEE80211_BAND_2GHZ; band < IEEE80211_NUM_BANDS; band++) {
+                sband = ar->hw->wiphy->bands[band];
+                if (!sband)
+                        continue;
+
+                for (ch = 0; ch < sband->n_channels; ch++, idx++)
+                        if (sband->channels[ch].center_freq == freq)
+                                goto exit;
+        }
+
+exit:
+        return idx;
+}
+
 static void ath10k_wmi_event_chan_info(struct ath10k *ar, struct sk_buff *skb)
 {
-        ath10k_dbg(ATH10K_DBG_WMI, "WMI_CHAN_INFO_EVENTID\n");
+        struct wmi_chan_info_event *ev;
+        struct survey_info *survey;
+        u32 err_code, freq, cmd_flags, noise_floor, rx_clear_count, cycle_count;
+        int idx;
+
+        ev = (struct wmi_chan_info_event *)skb->data;
+
+        err_code = __le32_to_cpu(ev->err_code);
+        freq = __le32_to_cpu(ev->freq);
+        cmd_flags = __le32_to_cpu(ev->cmd_flags);
+        noise_floor = __le32_to_cpu(ev->noise_floor);
+        rx_clear_count = __le32_to_cpu(ev->rx_clear_count);
+        cycle_count = __le32_to_cpu(ev->cycle_count);
+
+        ath10k_dbg(ATH10K_DBG_WMI,
+                   "chan info err_code %d freq %d cmd_flags %d noise_floor %d rx_clear_count %d cycle_count %d\n",
+                   err_code, freq, cmd_flags, noise_floor, rx_clear_count,
+                   cycle_count);
+
+        spin_lock_bh(&ar->data_lock);
+
+        if (!ar->scan.in_progress) {
+                ath10k_warn("chan info event without a scan request?\n");
+                goto exit;
+        }
+
+        idx = freq_to_idx(ar, freq);
+        if (idx >= ARRAY_SIZE(ar->survey)) {
+                ath10k_warn("chan info: invalid frequency %d (idx %d out of bounds)\n",
+                            freq, idx);
+                goto exit;
+        }
+
+        if (cmd_flags & WMI_CHAN_INFO_FLAG_COMPLETE) {
+                /* During scanning chan info is reported twice for each
+                 * visited channel. The reported cycle count is global
+                 * and per-channel cycle count must be calculated */
+
+                cycle_count -= ar->survey_last_cycle_count;
+                rx_clear_count -= ar->survey_last_rx_clear_count;
+
+                survey = &ar->survey[idx];
+                survey->channel_time = WMI_CHAN_INFO_MSEC(cycle_count);
+                survey->channel_time_rx = WMI_CHAN_INFO_MSEC(rx_clear_count);
+                survey->noise = noise_floor;
+                survey->filled = SURVEY_INFO_CHANNEL_TIME |
+                                 SURVEY_INFO_CHANNEL_TIME_RX |
+                                 SURVEY_INFO_NOISE_DBM;
+        }
+
+        ar->survey_last_rx_clear_count = rx_clear_count;
+        ar->survey_last_cycle_count = cycle_count;
+
+exit:
+        spin_unlock_bh(&ar->data_lock);
 }
 
 static void ath10k_wmi_event_echo(struct ath10k *ar, struct sk_buff *skb)
@@ -868,6 +941,13 @@ static void ath10k_wmi_service_ready_event_rx(struct ath10k *ar,
                 (__le32_to_cpu(ev->sw_version_1) & 0xffff0000) >> 16;
         ar->fw_version_build = (__le32_to_cpu(ev->sw_version_1) & 0x0000ffff);
         ar->phy_capability = __le32_to_cpu(ev->phy_capability);
+        ar->num_rf_chains = __le32_to_cpu(ev->num_rf_chains);
+
+        if (ar->num_rf_chains > WMI_MAX_SPATIAL_STREAM) {
+                ath10k_warn("hardware advertises support for more spatial streams than it should (%d > %d)\n",
+                            ar->num_rf_chains, WMI_MAX_SPATIAL_STREAM);
+                ar->num_rf_chains = WMI_MAX_SPATIAL_STREAM;
+        }
 
         ar->ath_common.regulatory.current_rd =
                 __le32_to_cpu(ev->hal_reg_capabilities.eeprom_rd);
@@ -892,7 +972,7 @@ static void ath10k_wmi_service_ready_event_rx(struct ath10k *ar,
         }
 
         ath10k_dbg(ATH10K_DBG_WMI,
-                   "wmi event service ready sw_ver 0x%08x sw_ver1 0x%08x abi_ver %u phy_cap 0x%08x ht_cap 0x%08x vht_cap 0x%08x vht_supp_msc 0x%08x sys_cap_info 0x%08x mem_reqs %u\n",
+                   "wmi event service ready sw_ver 0x%08x sw_ver1 0x%08x abi_ver %u phy_cap 0x%08x ht_cap 0x%08x vht_cap 0x%08x vht_supp_msc 0x%08x sys_cap_info 0x%08x mem_reqs %u num_rf_chains %u\n",
                    __le32_to_cpu(ev->sw_version),
                    __le32_to_cpu(ev->sw_version_1),
                    __le32_to_cpu(ev->abi_version),
@@ -901,7 +981,8 @@ static void ath10k_wmi_service_ready_event_rx(struct ath10k *ar,
                    __le32_to_cpu(ev->vht_cap_info),
                    __le32_to_cpu(ev->vht_supp_mcs),
                    __le32_to_cpu(ev->sys_cap_info),
-                   __le32_to_cpu(ev->num_mem_reqs));
+                   __le32_to_cpu(ev->num_mem_reqs),
+                   __le32_to_cpu(ev->num_rf_chains));
 
         complete(&ar->wmi.service_ready);
 }
diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
index da3b2bc4c88a..2c5a4f8daf2e 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.h
+++ b/drivers/net/wireless/ath/ath10k/wmi.h
@@ -2931,6 +2931,11 @@ struct wmi_chan_info_event {
         __le32 cycle_count;
 } __packed;
 
+#define WMI_CHAN_INFO_FLAG_COMPLETE BIT(0)
+
+/* FIXME: empirically extrapolated */
+#define WMI_CHAN_INFO_MSEC(x) ((x) / 76595)
+
 /* Beacon filter wmi command info */
 #define BCN_FLT_MAX_SUPPORTED_IES       256
 #define BCN_FLT_MAX_ELEMS_IE_LIST       (BCN_FLT_MAX_SUPPORTED_IES / 32)
diff --git a/drivers/net/wireless/ath/ath5k/ath5k.h b/drivers/net/wireless/ath/ath5k/ath5k.h
index 2d691b8b95b9..74bd54d6aceb 100644
--- a/drivers/net/wireless/ath/ath5k/ath5k.h
+++ b/drivers/net/wireless/ath/ath5k/ath5k.h
@@ -29,6 +29,7 @@
 #include <linux/average.h>
 #include <linux/leds.h>
 #include <net/mac80211.h>
+#include <net/cfg80211.h>
 
 /* RX/TX descriptor hw structs
  * TODO: Driver part should only see sw structs */
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index ce67ab791eae..48161edec8de 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -56,6 +56,7 @@
 #include <linux/etherdevice.h>
 #include <linux/nl80211.h>
 
+#include <net/cfg80211.h>
 #include <net/ieee80211_radiotap.h>
 
 #include <asm/unaligned.h>
@@ -165,28 +166,36 @@ static const struct ieee80211_rate ath5k_rates[] = {
           .flags = IEEE80211_RATE_SHORT_PREAMBLE },
         { .bitrate = 60,
           .hw_value = ATH5K_RATE_CODE_6M,
-          .flags = 0 },
+          .flags = IEEE80211_RATE_SUPPORTS_5MHZ |
+                   IEEE80211_RATE_SUPPORTS_10MHZ },
         { .bitrate = 90,
           .hw_value = ATH5K_RATE_CODE_9M,
-          .flags = 0 },
+          .flags = IEEE80211_RATE_SUPPORTS_5MHZ |
+                   IEEE80211_RATE_SUPPORTS_10MHZ },
         { .bitrate = 120,
           .hw_value = ATH5K_RATE_CODE_12M,
-          .flags = 0 },
+          .flags = IEEE80211_RATE_SUPPORTS_5MHZ |
+                   IEEE80211_RATE_SUPPORTS_10MHZ },
         { .bitrate = 180,
           .hw_value = ATH5K_RATE_CODE_18M,
-          .flags = 0 },
+          .flags = IEEE80211_RATE_SUPPORTS_5MHZ |
+                   IEEE80211_RATE_SUPPORTS_10MHZ },
         { .bitrate = 240,
           .hw_value = ATH5K_RATE_CODE_24M,
-          .flags = 0 },
+          .flags = IEEE80211_RATE_SUPPORTS_5MHZ |
+                   IEEE80211_RATE_SUPPORTS_10MHZ },
         { .bitrate = 360,
           .hw_value = ATH5K_RATE_CODE_36M,
-          .flags = 0 },
+          .flags = IEEE80211_RATE_SUPPORTS_5MHZ |
+                   IEEE80211_RATE_SUPPORTS_10MHZ },
         { .bitrate = 480,
           .hw_value = ATH5K_RATE_CODE_48M,
-          .flags = 0 },
+          .flags = IEEE80211_RATE_SUPPORTS_5MHZ |
+                   IEEE80211_RATE_SUPPORTS_10MHZ },
         { .bitrate = 540,
           .hw_value = ATH5K_RATE_CODE_54M,
-          .flags = 0 },
+          .flags = IEEE80211_RATE_SUPPORTS_5MHZ |
+                   IEEE80211_RATE_SUPPORTS_10MHZ },
 };
 
 static inline u64 ath5k_extend_tsf(struct ath5k_hw *ah, u32 rstamp)
@@ -435,11 +444,27 @@ ath5k_setup_bands(struct ieee80211_hw *hw)
  * Called with ah->lock.
  */
 int
-ath5k_chan_set(struct ath5k_hw *ah, struct ieee80211_channel *chan)
+ath5k_chan_set(struct ath5k_hw *ah, struct cfg80211_chan_def *chandef)
 {
         ATH5K_DBG(ah, ATH5K_DEBUG_RESET,
                   "channel set, resetting (%u -> %u MHz)\n",
-                  ah->curchan->center_freq, chan->center_freq);
+                  ah->curchan->center_freq, chandef->chan->center_freq);
+
+        switch (chandef->width) {
+        case NL80211_CHAN_WIDTH_20:
+        case NL80211_CHAN_WIDTH_20_NOHT:
+                ah->ah_bwmode = AR5K_BWMODE_DEFAULT;
+                break;
+        case NL80211_CHAN_WIDTH_5:
+                ah->ah_bwmode = AR5K_BWMODE_5MHZ;
+                break;
+        case NL80211_CHAN_WIDTH_10:
+                ah->ah_bwmode = AR5K_BWMODE_10MHZ;
+                break;
+        default:
+                WARN_ON(1);
+                return -EINVAL;
+        }
 
         /*
          * To switch channels clear any pending DMA operations;
@@ -447,7 +472,7 @@ ath5k_chan_set(struct ath5k_hw *ah, struct ieee80211_channel *chan)
          * hardware at the new frequency, and then re-enable
          * the relevant bits of the h/w.
          */
-        return ath5k_reset(ah, chan, true);
+        return ath5k_reset(ah, chandef->chan, true);
 }
 
 void ath5k_vif_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
@@ -1400,6 +1425,16 @@ ath5k_receive_frame(struct ath5k_hw *ah, struct sk_buff *skb,
 
         rxs->rate_idx = ath5k_hw_to_driver_rix(ah, rs->rs_rate);
         rxs->flag |= ath5k_rx_decrypted(ah, skb, rs);
+        switch (ah->ah_bwmode) {
+        case AR5K_BWMODE_5MHZ:
+                rxs->flag |= RX_FLAG_5MHZ;
+                break;
+        case AR5K_BWMODE_10MHZ:
+                rxs->flag |= RX_FLAG_10MHZ;
+                break;
+        default:
+                break;
+        }
 
         if (rxs->rate_idx >= 0 && rs->rs_rate ==
             ah->sbands[ah->curchan->band].bitrates[rxs->rate_idx].hw_value_short)
@@ -2507,6 +2542,8 @@ ath5k_init_ah(struct ath5k_hw *ah, const struct ath_bus_ops *bus_ops)
         /* SW support for IBSS_RSN is provided by mac80211 */
         hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
 
+        hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_5_10_MHZ;
+
         /* both antennas can be configured as RX or TX */
         hw->wiphy->available_antennas_tx = 0x3;
         hw->wiphy->available_antennas_rx = 0x3;
diff --git a/drivers/net/wireless/ath/ath5k/base.h b/drivers/net/wireless/ath/ath5k/base.h
index ca9a83ceeee1..97469d0fbad7 100644
--- a/drivers/net/wireless/ath/ath5k/base.h
+++ b/drivers/net/wireless/ath/ath5k/base.h
@@ -101,7 +101,7 @@ void ath5k_set_beacon_filter(struct ieee80211_hw *hw, bool enable);
 
 void ath5k_update_bssid_mask_and_opmode(struct ath5k_hw *ah,
                                         struct ieee80211_vif *vif);
-int ath5k_chan_set(struct ath5k_hw *ah, struct ieee80211_channel *chan);
+int ath5k_chan_set(struct ath5k_hw *ah, struct cfg80211_chan_def *chandef);
 void ath5k_txbuf_free_skb(struct ath5k_hw *ah, struct ath5k_buf *bf);
 void ath5k_rxbuf_free_skb(struct ath5k_hw *ah, struct ath5k_buf *bf);
 void ath5k_tx_queue(struct ieee80211_hw *hw, struct sk_buff *skb,
diff --git a/drivers/net/wireless/ath/ath5k/debug.c b/drivers/net/wireless/ath/ath5k/debug.c
index 9d00dab666a8..b8d031ae63c2 100644
--- a/drivers/net/wireless/ath/ath5k/debug.c
+++ b/drivers/net/wireless/ath/ath5k/debug.c
@@ -245,9 +245,11 @@ static ssize_t write_file_beacon(struct file *file,
         struct ath5k_hw *ah = file->private_data;
         char buf[20];
 
-        if (copy_from_user(buf, userbuf, min(count, sizeof(buf))))
+        count = min_t(size_t, count, sizeof(buf) - 1);
+        if (copy_from_user(buf, userbuf, count))
                 return -EFAULT;
 
+        buf[count] = '\0';
         if (strncmp(buf, "disable", 7) == 0) {
                 AR5K_REG_DISABLE_BITS(ah, AR5K_BEACON, AR5K_BEACON_ENABLE);
                 pr_info("debugfs disable beacons\n");
@@ -345,9 +347,11 @@ static ssize_t write_file_debug(struct file *file,
         unsigned int i;
         char buf[20];
 
-        if (copy_from_user(buf, userbuf, min(count, sizeof(buf))))
+        count = min_t(size_t, count, sizeof(buf) - 1);
+        if (copy_from_user(buf, userbuf, count))
                 return -EFAULT;
 
+        buf[count] = '\0';
         for (i = 0; i < ARRAY_SIZE(dbg_info); i++) {
                 if (strncmp(buf, dbg_info[i].name,
                                         strlen(dbg_info[i].name)) == 0) {
@@ -448,9 +452,11 @@ static ssize_t write_file_antenna(struct file *file,
         unsigned int i;
         char buf[20];
 
-        if (copy_from_user(buf, userbuf, min(count, sizeof(buf))))
+        count = min_t(size_t, count, sizeof(buf) - 1);
+        if (copy_from_user(buf, userbuf, count))
                 return -EFAULT;
 
+        buf[count] = '\0';
         if (strncmp(buf, "diversity", 9) == 0) {
                 ath5k_hw_set_antenna_mode(ah, AR5K_ANTMODE_DEFAULT);
                 pr_info("debug: enable diversity\n");
@@ -619,9 +625,11 @@ static ssize_t write_file_frameerrors(struct file *file,
         struct ath5k_statistics *st = &ah->stats;
         char buf[20];
 
-        if (copy_from_user(buf, userbuf, min(count, sizeof(buf))))
+        count = min_t(size_t, count, sizeof(buf) - 1);
+        if (copy_from_user(buf, userbuf, count))
                 return -EFAULT;
 
+        buf[count] = '\0';
         if (strncmp(buf, "clear", 5) == 0) {
                 st->rxerr_crc = 0;
                 st->rxerr_phy = 0;
@@ -766,9 +774,11 @@ static ssize_t write_file_ani(struct file *file,
         struct ath5k_hw *ah = file->private_data;
         char buf[20];
 
-        if (copy_from_user(buf, userbuf, min(count, sizeof(buf))))
+        count = min_t(size_t, count, sizeof(buf) - 1);
+        if (copy_from_user(buf, userbuf, count))
                 return -EFAULT;
 
+        buf[count] = '\0';
         if (strncmp(buf, "sens-low", 8) == 0) {
                 ath5k_ani_init(ah, ATH5K_ANI_MODE_MANUAL_HIGH);
         } else if (strncmp(buf, "sens-high", 9) == 0) {
@@ -862,9 +872,11 @@ static ssize_t write_file_queue(struct file *file,
         struct ath5k_hw *ah = file->private_data;
         char buf[20];
 
-        if (copy_from_user(buf, userbuf, min(count, sizeof(buf))))
+        count = min_t(size_t, count, sizeof(buf) - 1);
+        if (copy_from_user(buf, userbuf, count))
                 return -EFAULT;
 
+        buf[count] = '\0';
         if (strncmp(buf, "start", 5) == 0)
                 ieee80211_wake_queues(ah->hw);
         else if (strncmp(buf, "stop", 4) == 0)
diff --git a/drivers/net/wireless/ath/ath5k/mac80211-ops.c b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
index 40825d43322e..4ee01f654235 100644
--- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c
+++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
@@ -202,7 +202,7 @@ ath5k_config(struct ieee80211_hw *hw, u32 changed)
         mutex_lock(&ah->lock);
 
         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
-                ret = ath5k_chan_set(ah, conf->chandef.chan);
+                ret = ath5k_chan_set(ah, &conf->chandef);
                 if (ret < 0)
                         goto unlock;
         }
diff --git a/drivers/net/wireless/ath/ath5k/pcu.c b/drivers/net/wireless/ath/ath5k/pcu.c
index 1f16b4227d8f..c60d36aa13e2 100644
--- a/drivers/net/wireless/ath/ath5k/pcu.c
+++ b/drivers/net/wireless/ath/ath5k/pcu.c
@@ -144,11 +144,13 @@ ath5k_hw_get_frame_duration(struct ath5k_hw *ah, enum ieee80211_band band,
                 sifs = AR5K_INIT_SIFS_HALF_RATE;
                 preamble *= 2;
                 sym_time *= 2;
+                bitrate = DIV_ROUND_UP(bitrate, 2);
                 break;
         case AR5K_BWMODE_5MHZ:
                 sifs = AR5K_INIT_SIFS_QUARTER_RATE;
                 preamble *= 4;
                 sym_time *= 4;
+                bitrate = DIV_ROUND_UP(bitrate, 4);
                 break;
         default:
                 sifs = AR5K_INIT_SIFS_DEFAULT_BG;
diff --git a/drivers/net/wireless/ath/ath5k/qcu.c b/drivers/net/wireless/ath/ath5k/qcu.c
index 65fe929529a8..0583c69d26db 100644
--- a/drivers/net/wireless/ath/ath5k/qcu.c
+++ b/drivers/net/wireless/ath/ath5k/qcu.c
@@ -566,9 +566,11 @@ int ath5k_hw_set_ifs_intervals(struct ath5k_hw *ah, unsigned int slot_time)
 {
         struct ieee80211_channel *channel = ah->ah_current_channel;
         enum ieee80211_band band;
+        struct ieee80211_supported_band *sband;
         struct ieee80211_rate *rate;
         u32 ack_tx_time, eifs, eifs_clock, sifs, sifs_clock;
         u32 slot_time_clock = ath5k_hw_htoclock(ah, slot_time);
+        u32 rate_flags, i;
 
         if (slot_time < 6 || slot_time_clock > AR5K_SLOT_TIME_MAX)
                 return -EINVAL;
@@ -605,7 +607,28 @@ int ath5k_hw_set_ifs_intervals(struct ath5k_hw *ah, unsigned int slot_time)
         else
                 band = IEEE80211_BAND_2GHZ;
 
-        rate = &ah->sbands[band].bitrates[0];
+        switch (ah->ah_bwmode) {
+        case AR5K_BWMODE_5MHZ:
+                rate_flags = IEEE80211_RATE_SUPPORTS_5MHZ;
+                break;
+        case AR5K_BWMODE_10MHZ:
+                rate_flags = IEEE80211_RATE_SUPPORTS_10MHZ;
+                break;
+        default:
+                rate_flags = 0;
+                break;
+        }
+        sband = &ah->sbands[band];
+        rate = NULL;
+        for (i = 0; i < sband->n_bitrates; i++) {
+                if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
+                        continue;
+                rate = &sband->bitrates[i];
+                break;
+        }
+        if (WARN_ON(!rate))
+                return -EINVAL;
+
         ack_tx_time = ath5k_hw_get_frame_duration(ah, band, 10, rate, false);
 
         /* ack_tx_time includes an SIFS already */
diff --git a/drivers/net/wireless/ath/ath6kl/init.c b/drivers/net/wireless/ath/ath6kl/init.c
index 6a67881f94d6..4f316bdcbab5 100644
--- a/drivers/net/wireless/ath/ath6kl/init.c
+++ b/drivers/net/wireless/ath/ath6kl/init.c
@@ -1836,6 +1836,9 @@ void ath6kl_stop_txrx(struct ath6kl *ar)
 
         clear_bit(WMI_READY, &ar->flag);
 
+        if (ar->fw_recovery.enable)
+                del_timer_sync(&ar->fw_recovery.hb_timer);
+
         /*
          * After wmi_shudown all WMI events will be dropped. We
          * need to cleanup the buffers allocated in AP mode and
diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c
index d4fcfcad57d0..5839fc23bdc7 100644
--- a/drivers/net/wireless/ath/ath6kl/main.c
+++ b/drivers/net/wireless/ath/ath6kl/main.c
@@ -29,6 +29,9 @@ struct ath6kl_sta *ath6kl_find_sta(struct ath6kl_vif *vif, u8 *node_addr)
         struct ath6kl_sta *conn = NULL;
         u8 i, max_conn;
 
+        if (is_zero_ether_addr(node_addr))
+                return NULL;
+
         max_conn = (vif->nw_type == AP_NETWORK) ? AP_MAX_NUM_STA : 0;
 
         for (i = 0; i < max_conn; i++) {
diff --git a/drivers/net/wireless/ath/ath6kl/testmode.c b/drivers/net/wireless/ath/ath6kl/testmode.c
index acc9aa832f76..d67170ea1038 100644
--- a/drivers/net/wireless/ath/ath6kl/testmode.c
+++ b/drivers/net/wireless/ath/ath6kl/testmode.c
@@ -66,7 +66,8 @@ nla_put_failure:
         ath6kl_warn("nla_put failed on testmode rx skb!\n");
 }
 
-int ath6kl_tm_cmd(struct wiphy *wiphy, void *data, int len)
+int ath6kl_tm_cmd(struct wiphy *wiphy, struct wireless_dev *wdev,
+                  void *data, int len)
 {
         struct ath6kl *ar = wiphy_priv(wiphy);
         struct nlattr *tb[ATH6KL_TM_ATTR_MAX + 1];
diff --git a/drivers/net/wireless/ath/ath6kl/testmode.h b/drivers/net/wireless/ath/ath6kl/testmode.h
index fe651d6707df..9fbcdec3e208 100644
--- a/drivers/net/wireless/ath/ath6kl/testmode.h
+++ b/drivers/net/wireless/ath/ath6kl/testmode.h
@@ -20,7 +20,8 @@
 #ifdef CONFIG_NL80211_TESTMODE
 
 void ath6kl_tm_rx_event(struct ath6kl *ar, void *buf, size_t buf_len);
-int ath6kl_tm_cmd(struct wiphy *wiphy, void *data, int len);
+int ath6kl_tm_cmd(struct wiphy *wiphy, struct wireless_dev *wdev,
+                  void *data, int len);
 
 #else
 
@@ -29,7 +30,9 @@ static inline void ath6kl_tm_rx_event(struct ath6kl *ar, void *buf,
 {
 }
 
-static inline int ath6kl_tm_cmd(struct wiphy *wiphy, void *data, int len)
+static inline int ath6kl_tm_cmd(struct wiphy *wiphy,
+                                struct wireless_dev *wdev,
+                                void *data, int len)
 {
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index 87aefb4c4c23..546d5da0b894 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -568,8 +568,8 @@ static int ath6kl_wmi_rx_probe_req_event_rx(struct wmi *wmi, u8 *datap, int len,
                    dlen, freq, vif->probe_req_report);
 
         if (vif->probe_req_report || vif->nw_type == AP_NETWORK)
-                cfg80211_rx_mgmt(&vif->wdev, freq, 0,
-                                 ev->data, dlen, GFP_ATOMIC);
+                cfg80211_rx_mgmt(&vif->wdev, freq, 0, ev->data, dlen, 0,
+                                 GFP_ATOMIC);
 
         return 0;
 }
@@ -608,8 +608,7 @@ static int ath6kl_wmi_rx_action_event_rx(struct wmi *wmi, u8 *datap, int len,
                 return -EINVAL;
         }
         ath6kl_dbg(ATH6KL_DBG_WMI, "rx_action: len=%u freq=%u\n", dlen, freq);
-        cfg80211_rx_mgmt(&vif->wdev, freq, 0,
-                         ev->data, dlen, GFP_ATOMIC);
+        cfg80211_rx_mgmt(&vif->wdev, freq, 0, ev->data, dlen, 0, GFP_ATOMIC);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath9k/Kconfig b/drivers/net/wireless/ath/ath9k/Kconfig
index c91bc6111c23..7944c25c9a43 100644
--- a/drivers/net/wireless/ath/ath9k/Kconfig
+++ b/drivers/net/wireless/ath/ath9k/Kconfig
@@ -56,7 +56,7 @@ config ATH9K_AHB
 
 config ATH9K_DEBUGFS
         bool "Atheros ath9k debugging"
-        depends on ATH9K
+        depends on ATH9K && DEBUG_FS
         select MAC80211_DEBUGFS
         select RELAY
         ---help---
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index 4994bea809eb..be466b0ef7a7 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -319,9 +319,6 @@ void ath9k_ani_reset(struct ath_hw *ah, bool is_scanning)
                         ah->ani_function = 0;
         }
 
-        /* always allow mode (on/off) to be controlled */
-        ah->ani_function |= ATH9K_ANI_MODE;
-
         ofdm_nil = max_t(int, ATH9K_ANI_OFDM_DEF_LEVEL,
                          aniState->ofdmNoiseImmunityLevel);
         cck_nil = max_t(int, ATH9K_ANI_CCK_DEF_LEVEL,
diff --git a/drivers/net/wireless/ath/ath9k/ani.h b/drivers/net/wireless/ath/ath9k/ani.h
index b54a3fb01883..21e7b83c3f6a 100644
--- a/drivers/net/wireless/ath/ath9k/ani.h
+++ b/drivers/net/wireless/ath/ath9k/ani.h
@@ -48,15 +48,10 @@
 /* values here are relative to the INI */
 
 enum ath9k_ani_cmd {
-        ATH9K_ANI_PRESENT = 0x1,
-        ATH9K_ANI_NOISE_IMMUNITY_LEVEL = 0x2,
-        ATH9K_ANI_OFDM_WEAK_SIGNAL_DETECTION = 0x4,
-        ATH9K_ANI_CCK_WEAK_SIGNAL_THR = 0x8,
-        ATH9K_ANI_FIRSTEP_LEVEL = 0x10,
-        ATH9K_ANI_SPUR_IMMUNITY_LEVEL = 0x20,
-        ATH9K_ANI_MODE = 0x40,
-        ATH9K_ANI_PHYERR_RESET = 0x80,
-        ATH9K_ANI_MRC_CCK = 0x100,
+        ATH9K_ANI_OFDM_WEAK_SIGNAL_DETECTION = 0x1,
+        ATH9K_ANI_FIRSTEP_LEVEL = 0x2,
+        ATH9K_ANI_SPUR_IMMUNITY_LEVEL = 0x4,
+        ATH9K_ANI_MRC_CCK = 0x8,
         ATH9K_ANI_ALL = 0xfff
 };
 
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index 1576d58291d4..08656473c63e 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -1160,8 +1160,6 @@ static bool ar5008_hw_ani_control_new(struct ath_hw *ah,
                  */
                 WARN_ON(1);
                 break;
-        case ATH9K_ANI_PRESENT:
-                break;
         default:
                 ath_dbg(common, ANI, "invalid cmd %u\n", cmd);
                 return false;
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
index 8dc2d089cdef..fb61b081d172 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
@@ -269,13 +269,12 @@ static void ar9002_hw_configpcipowersave(struct ath_hw *ah,
                         if (ah->config.pcie_waen & AR_WA_D3_L1_DISABLE)
                                 val |= AR_WA_D3_L1_DISABLE;
                 } else {
-                        if (((AR_SREV_9285(ah) ||
-                              AR_SREV_9271(ah) ||
-                              AR_SREV_9287(ah)) &&
-                             (AR9285_WA_DEFAULT & AR_WA_D3_L1_DISABLE)) ||
-                            (AR_SREV_9280(ah) &&
-                             (AR9280_WA_DEFAULT & AR_WA_D3_L1_DISABLE))) {
-                                val |= AR_WA_D3_L1_DISABLE;
+                        if (AR_SREV_9285(ah) || AR_SREV_9271(ah) || AR_SREV_9287(ah)) {
+                                if (AR9285_WA_DEFAULT & AR_WA_D3_L1_DISABLE)
+                                        val |= AR_WA_D3_L1_DISABLE;
+                        } else if (AR_SREV_9280(ah)) {
+                                if (AR9280_WA_DEFAULT & AR_WA_D3_L1_DISABLE)
+                                        val |= AR_WA_D3_L1_DISABLE;
                         }
                 }
 
@@ -297,24 +296,18 @@ static void ar9002_hw_configpcipowersave(struct ath_hw *ah,
         } else {
                 if (ah->config.pcie_waen) {
                         val = ah->config.pcie_waen;
-                        if (!power_off)
-                                val &= (~AR_WA_D3_L1_DISABLE);
+                        val &= (~AR_WA_D3_L1_DISABLE);
                 } else {
-                        if (AR_SREV_9285(ah) ||
-                            AR_SREV_9271(ah) ||
-                            AR_SREV_9287(ah)) {
+                        if (AR_SREV_9285(ah) || AR_SREV_9271(ah) || AR_SREV_9287(ah)) {
                                 val = AR9285_WA_DEFAULT;
-                                if (!power_off)
-                                        val &= (~AR_WA_D3_L1_DISABLE);
-                        }
-                        else if (AR_SREV_9280(ah)) {
+                                val &= (~AR_WA_D3_L1_DISABLE);
+                        } else if (AR_SREV_9280(ah)) {
                                 /*
                                  * For AR9280 chips, bit 22 of 0x4004
                                  * needs to be set.
                                  */
                                 val = AR9280_WA_DEFAULT;
-                                if (!power_off)
-                                        val &= (~AR_WA_D3_L1_DISABLE);
+                                val &= (~AR_WA_D3_L1_DISABLE);
                         } else {
                                 val = AR_WA_DEFAULT;
                         }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index abdc7ee87413..f4864807e15b 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -3615,8 +3615,8 @@ static void ar9003_hw_ant_ctrl_apply(struct ath_hw *ah, bool is2ghz)
 
         value = ar9003_hw_ant_ctrl_common_2_get(ah, is2ghz);
         if (AR_SREV_9485(ah) && common->bt_ant_diversity) {
-                regval &= ~AR_SWITCH_TABLE_COM2_ALL;
-                regval |= ah->config.ant_ctrl_comm2g_switch_enable;
+                value &= ~AR_SWITCH_TABLE_COM2_ALL;
+                value |= ah->config.ant_ctrl_comm2g_switch_enable;
 
         }
         REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM_2, AR_SWITCH_TABLE_COM2_ALL, value);
@@ -3825,6 +3825,11 @@ static void ar9003_hw_atten_apply(struct ath_hw *ah, struct ath9k_channel *chan)
                         else
                                 value = ar9003_hw_atten_chain_get_margin(ah, i, chan);
 
+                        if (ah->config.alt_mingainidx)
+                                REG_RMW_FIELD(ah, AR_PHY_EXT_ATTEN_CTL_0,
+                                              AR_PHY_EXT_ATTEN_CTL_XATTEN1_MARGIN,
+                                              value);
+
                         REG_RMW_FIELD(ah, ext_atten_reg[i],
                                       AR_PHY_EXT_ATTEN_CTL_XATTEN1_MARGIN,
                                       value);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
index d402cb32283f..608bb4824e2a 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
@@ -153,7 +153,7 @@ static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
                 if (!ah->is_clk_25mhz)
                         INIT_INI_ARRAY(&ah->iniAdditional,
                                        ar9340_1p0_radio_core_40M);
-        } else if (AR_SREV_9485_11(ah)) {
+        } else if (AR_SREV_9485_11_OR_LATER(ah)) {
                 /* mac */
                 INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE],
                                 ar9485_1_1_mac_core);
@@ -424,7 +424,7 @@ static void ar9003_tx_gain_table_mode0(struct ath_hw *ah)
         else if (AR_SREV_9340(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9340Modes_lowest_ob_db_tx_gain_table_1p0);
-        else if (AR_SREV_9485_11(ah))
+        else if (AR_SREV_9485_11_OR_LATER(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9485_modes_lowest_ob_db_tx_gain_1_1);
         else if (AR_SREV_9550(ah))
@@ -458,7 +458,7 @@ static void ar9003_tx_gain_table_mode1(struct ath_hw *ah)
         else if (AR_SREV_9340(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9340Modes_high_ob_db_tx_gain_table_1p0);
-        else if (AR_SREV_9485_11(ah))
+        else if (AR_SREV_9485_11_OR_LATER(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9485Modes_high_ob_db_tx_gain_1_1);
         else if (AR_SREV_9580(ah))
@@ -492,7 +492,7 @@ static void ar9003_tx_gain_table_mode2(struct ath_hw *ah)
         else if (AR_SREV_9340(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9340Modes_low_ob_db_tx_gain_table_1p0);
-        else if (AR_SREV_9485_11(ah))
+        else if (AR_SREV_9485_11_OR_LATER(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9485Modes_low_ob_db_tx_gain_1_1);
         else if (AR_SREV_9580(ah))
@@ -517,7 +517,7 @@ static void ar9003_tx_gain_table_mode3(struct ath_hw *ah)
         else if (AR_SREV_9340(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9340Modes_high_power_tx_gain_table_1p0);
-        else if (AR_SREV_9485_11(ah))
+        else if (AR_SREV_9485_11_OR_LATER(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9485Modes_high_power_tx_gain_1_1);
         else if (AR_SREV_9580(ah))
@@ -552,7 +552,7 @@ static void ar9003_tx_gain_table_mode4(struct ath_hw *ah)
 
 static void ar9003_tx_gain_table_mode5(struct ath_hw *ah)
 {
-        if (AR_SREV_9485_11(ah))
+        if (AR_SREV_9485_11_OR_LATER(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9485Modes_green_ob_db_tx_gain_1_1);
         else if (AR_SREV_9340(ah))
@@ -571,7 +571,7 @@ static void ar9003_tx_gain_table_mode6(struct ath_hw *ah)
         if (AR_SREV_9340(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9340Modes_low_ob_db_and_spur_tx_gain_table_1p0);
-        else if (AR_SREV_9485_11(ah))
+        else if (AR_SREV_9485_11_OR_LATER(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9485Modes_green_spur_ob_db_tx_gain_1_1);
         else if (AR_SREV_9580(ah))
@@ -611,7 +611,7 @@ static void ar9003_rx_gain_table_mode0(struct ath_hw *ah)
         else if (AR_SREV_9340(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                                 ar9340Common_rx_gain_table_1p0);
-        else if (AR_SREV_9485_11(ah))
+        else if (AR_SREV_9485_11_OR_LATER(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                                ar9485_common_rx_gain_1_1);
         else if (AR_SREV_9550(ah)) {
@@ -644,7 +644,7 @@ static void ar9003_rx_gain_table_mode1(struct ath_hw *ah)
         else if (AR_SREV_9340(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                         ar9340Common_wo_xlna_rx_gain_table_1p0);
-        else if (AR_SREV_9485_11(ah))
+        else if (AR_SREV_9485_11_OR_LATER(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                         ar9485Common_wo_xlna_rx_gain_1_1);
         else if (AR_SREV_9462_21(ah))
@@ -745,16 +745,25 @@ static void ar9003_hw_init_mode_gain_regs(struct ath_hw *ah)
 static void ar9003_hw_configpcipowersave(struct ath_hw *ah,
                                          bool power_off)
 {
+        /*
+         * Increase L1 Entry Latency. Some WB222 boards don't have
+         * this change in eeprom/OTP.
+         *
+         */
+        if (AR_SREV_9462(ah)) {
+                u32 val = ah->config.aspm_l1_fix;
+                if ((val & 0xff000000) == 0x17000000) {
+                        val &= 0x00ffffff;
+                        val |= 0x27000000;
+                        REG_WRITE(ah, 0x570c, val);
+                }
+        }
+
         /* Nothing to do on restore for 11N */
         if (!power_off /* !restore */) {
                 /* set bit 19 to allow forcing of pcie core into L1 state */
                 REG_SET_BIT(ah, AR_PCIE_PM_CTRL, AR_PCIE_PM_CTRL_ENA);
-
-                /* Several PCIe massages to ensure proper behaviour */
-                if (ah->config.pcie_waen)
-                        REG_WRITE(ah, AR_WA, ah->config.pcie_waen);
-                else
-                        REG_WRITE(ah, AR_WA, ah->WARegVal);
+                REG_WRITE(ah, AR_WA, ah->WARegVal);
         }
 
         /*
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.c b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
index 5163abd3937c..f6c5c1b50471 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
@@ -491,6 +491,7 @@ int ath9k_hw_process_rxdesc_edma(struct ath_hw *ah, struct ath_rx_status *rxs,
         rxs->rs_rate = MS(rxsp->status1, AR_RxRate);
         rxs->rs_more = (rxsp->status2 & AR_RxMore) ? 1 : 0;
 
+        rxs->rs_firstaggr = (rxsp->status11 & AR_RxFirstAggr) ? 1 : 0;
         rxs->rs_isaggr = (rxsp->status11 & AR_RxAggr) ? 1 : 0;
         rxs->rs_moreaggr = (rxsp->status11 & AR_RxMoreAggr) ? 1 : 0;
         rxs->rs_antenna = (MS(rxsp->status4, AR_RxAntenna) & 0x7);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 39c37309f39e..e897648d3233 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -1172,6 +1172,10 @@ skip_ws_det:
                  * is_on == 0 means MRC CCK is OFF (more noise imm)
                  */
                 bool is_on = param ? 1 : 0;
+
+                if (ah->caps.rx_chainmask == 1)
+                        break;
+
                 REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
                               AR_PHY_MRC_CCK_ENABLE, is_on);
                 REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
@@ -1189,8 +1193,6 @@ skip_ws_det:
                 }
         break;
         }
-        case ATH9K_ANI_PRESENT:
-                break;
         default:
                 ath_dbg(common, ANI, "invalid cmd %u\n", cmd);
                 return false;
@@ -1445,7 +1447,7 @@ static void ar9003_hw_set_bt_ant_diversity(struct ath_hw *ah, bool enable)
         regval |= (ant_div_ctl1 & 0x3f) << AR_ANT_DIV_CTRL_ALL_S;
         REG_WRITE(ah, AR_PHY_MC_GAIN_CTRL, regval);
 
-        if (AR_SREV_9485_11(ah)) {
+        if (AR_SREV_9485_11_OR_LATER(ah)) {
                 /*
                  * Enable LNA diversity.
                  */
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index 23c019d0d9aa..6fd752321e36 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -148,6 +148,8 @@
 #define AR_PHY_SFCORR_SPUR_SUBCHNL_SD_S   28
 #define AR_PHY_EXT_CCA_THRESH62 0x007F0000
 #define AR_PHY_EXT_CCA_THRESH62_S       16
+#define AR_PHY_EXTCHN_PWRTHR1_ANT_DIV_ALT_ANT_MINGAINIDX    0x0000FF00
+#define AR_PHY_EXTCHN_PWRTHR1_ANT_DIV_ALT_ANT_MINGAINIDX_S  8
 #define AR_PHY_EXT_MINCCA_PWR   0x01FF0000
 #define AR_PHY_EXT_MINCCA_PWR_S 16
 #define AR_PHY_EXT_CYCPWR_THR1 0x0000FE00L
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 505c615ada1b..2ee35f677c0e 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -72,17 +72,12 @@ struct ath_config {
 /*************************/
 
 #define ATH_TXBUF_RESET(_bf) do {                               \
-                (_bf)->bf_stale = false;                        \
                 (_bf)->bf_lastbf = NULL;                        \
                 (_bf)->bf_next = NULL;                          \
                 memset(&((_bf)->bf_state), 0,                   \
                        sizeof(struct ath_buf_state));           \
         } while (0)
 
-#define ATH_RXBUF_RESET(_bf) do {               \
-                (_bf)->bf_stale = false;        \
-        } while (0)
-
 /**
  * enum buffer_type - Buffer type flags
  *
@@ -196,10 +191,10 @@ struct ath_txq {
 
 struct ath_atx_ac {
         struct ath_txq *txq;
-        int sched;
         struct list_head list;
         struct list_head tid_q;
         bool clear_ps_filter;
+        bool sched;
 };
 
 struct ath_frame_info {
@@ -216,6 +211,7 @@ struct ath_buf_state {
         u8 bf_type;
         u8 bfs_paprd;
         u8 ndelim;
+        bool stale;
         u16 seqno;
         unsigned long bfs_paprd_timestamp;
 };
@@ -229,7 +225,6 @@ struct ath_buf {
         void *bf_desc;                  /* virtual addr of desc */
         dma_addr_t bf_daddr;            /* physical addr of desc */
         dma_addr_t bf_buf_addr; /* physical addr of data buffer, for DMA */
-        bool bf_stale;
         struct ieee80211_tx_rate rates[4];
         struct ath_buf_state bf_state;
 };
@@ -241,13 +236,14 @@ struct ath_atx_tid {
         struct ath_node *an;
         struct ath_atx_ac *ac;
         unsigned long tx_buf[BITS_TO_LONGS(ATH_TID_MAX_BUFS)];
-        int bar_index;
         u16 seq_start;
         u16 seq_next;
         u16 baw_size;
-        int tidno;
+        u8 tidno;
         int baw_head;   /* first un-acked tx buffer */
         int baw_tail;   /* next unused tx buffer slot */
+
+        s8 bar_index;
         bool sched;
         bool paused;
         bool active;
@@ -259,17 +255,13 @@ struct ath_node {
         struct ieee80211_vif *vif; /* interface with which we're associated */
         struct ath_atx_tid tid[IEEE80211_NUM_TIDS];
         struct ath_atx_ac ac[IEEE80211_NUM_ACS];
-        int ps_key;
 
         u16 maxampdu;
         u8 mpdudensity;
+        s8 ps_key;
 
         bool sleeping;
         bool no_ps_filter;
-
-#if defined(CONFIG_MAC80211_DEBUGFS) && defined(CONFIG_ATH9K_DEBUGFS)
-        struct dentry *node_stat;
-#endif
 };
 
 struct ath_tx_control {
@@ -315,6 +307,7 @@ struct ath_rx {
         struct ath_descdma rxdma;
         struct ath_rx_edma rx_edma[ATH9K_RX_QUEUE_MAX];
 
+        struct ath_buf *buf_hold;
         struct sk_buff *frag;
 
         u32 ampdu_ref;
@@ -427,6 +420,7 @@ void ath9k_beacon_assign_slot(struct ath_softc *sc, struct ieee80211_vif *vif);
 void ath9k_beacon_remove_slot(struct ath_softc *sc, struct ieee80211_vif *vif);
 void ath9k_set_tsfadjust(struct ath_softc *sc, struct ieee80211_vif *vif);
 void ath9k_set_beacon(struct ath_softc *sc);
+bool ath9k_csa_is_finished(struct ath_softc *sc);
 
 /*******************/
 /* Link Monitoring */
@@ -637,6 +631,7 @@ void ath_ant_comb_scan(struct ath_softc *sc, struct ath_rx_status *rs);
 #define ATH9K_PCI_CUS217     0x0004
 #define ATH9K_PCI_WOW        0x0008
 #define ATH9K_PCI_BT_ANT_DIV 0x0010
+#define ATH9K_PCI_D3_L1_WAR  0x0020
 
 /*
  * Default cache line size, in bytes.
@@ -763,6 +758,7 @@ struct ath_softc {
 #endif
 
         struct ath_descdma txsdma;
+        struct ieee80211_vif *csa_vif;
 
         struct ath_ant_comb ant_comb;
         u8 ant_tx, ant_rx;
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index 1a17732bb089..b5c16b3a37b9 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -291,6 +291,23 @@ void ath9k_set_tsfadjust(struct ath_softc *sc, struct ieee80211_vif *vif)
                 (unsigned long long)tsfadjust, avp->av_bslot);
 }
 
+bool ath9k_csa_is_finished(struct ath_softc *sc)
+{
+        struct ieee80211_vif *vif;
+
+        vif = sc->csa_vif;
+        if (!vif || !vif->csa_active)
+                return false;
+
+        if (!ieee80211_csa_is_complete(vif))
+                return false;
+
+        ieee80211_csa_finish(vif);
+
+        sc->csa_vif = NULL;
+        return true;
+}
+
 void ath9k_beacon_tasklet(unsigned long data)
 {
         struct ath_softc *sc = (struct ath_softc *)data;
@@ -336,6 +353,10 @@ void ath9k_beacon_tasklet(unsigned long data)
                 return;
         }
 
+        /* EDMA devices check that in the tx completion function. */
+        if (!edma && ath9k_csa_is_finished(sc))
+                return;
+
         slot = ath9k_beacon_choose_slot(sc);
         vif = sc->beacon.bslot[slot];
 
diff --git a/drivers/net/wireless/ath/ath9k/common.c b/drivers/net/wireless/ath/ath9k/common.c
index 344fdde1d7a3..d3063c21e16c 100644
--- a/drivers/net/wireless/ath/ath9k/common.c
+++ b/drivers/net/wireless/ath/ath9k/common.c
@@ -49,37 +49,40 @@ int ath9k_cmn_get_hw_crypto_keytype(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(ath9k_cmn_get_hw_crypto_keytype);
 
-static u32 ath9k_get_extchanmode(struct ieee80211_channel *chan,
-                                 enum nl80211_channel_type channel_type)
+static u32 ath9k_get_extchanmode(struct cfg80211_chan_def *chandef)
 {
         u32 chanmode = 0;
 
-        switch (chan->band) {
+        switch (chandef->chan->band) {
         case IEEE80211_BAND_2GHZ:
-                switch (channel_type) {
-                case NL80211_CHAN_NO_HT:
-                case NL80211_CHAN_HT20:
+                switch (chandef->width) {
+                case NL80211_CHAN_WIDTH_20_NOHT:
+                case NL80211_CHAN_WIDTH_20:
                         chanmode = CHANNEL_G_HT20;
                         break;
-                case NL80211_CHAN_HT40PLUS:
-                        chanmode = CHANNEL_G_HT40PLUS;
+                case NL80211_CHAN_WIDTH_40:
+                        if (chandef->center_freq1 > chandef->chan->center_freq)
+                                chanmode = CHANNEL_G_HT40PLUS;
+                        else
+                                chanmode = CHANNEL_G_HT40MINUS;
                         break;
-                case NL80211_CHAN_HT40MINUS:
-                        chanmode = CHANNEL_G_HT40MINUS;
+                default:
                         break;
                 }
                 break;
         case IEEE80211_BAND_5GHZ:
-                switch (channel_type) {
-                case NL80211_CHAN_NO_HT:
-                case NL80211_CHAN_HT20:
+                switch (chandef->width) {
+                case NL80211_CHAN_WIDTH_20_NOHT:
+                case NL80211_CHAN_WIDTH_20:
                         chanmode = CHANNEL_A_HT20;
                         break;
-                case NL80211_CHAN_HT40PLUS:
-                        chanmode = CHANNEL_A_HT40PLUS;
+                case NL80211_CHAN_WIDTH_40:
+                        if (chandef->center_freq1 > chandef->chan->center_freq)
+                                chanmode = CHANNEL_A_HT40PLUS;
+                        else
+                                chanmode = CHANNEL_A_HT40MINUS;
                         break;
-                case NL80211_CHAN_HT40MINUS:
-                        chanmode = CHANNEL_A_HT40MINUS;
+                default:
                         break;
                 }
                 break;
@@ -94,13 +97,12 @@ static u32 ath9k_get_extchanmode(struct ieee80211_channel *chan,
  * Update internal channel flags.
  */
 void ath9k_cmn_update_ichannel(struct ath9k_channel *ichan,
-                               struct ieee80211_channel *chan,
-                               enum nl80211_channel_type channel_type)
+                               struct cfg80211_chan_def *chandef)
 {
-        ichan->channel = chan->center_freq;
-        ichan->chan = chan;
+        ichan->channel = chandef->chan->center_freq;
+        ichan->chan = chandef->chan;
 
-        if (chan->band == IEEE80211_BAND_2GHZ) {
+        if (chandef->chan->band == IEEE80211_BAND_2GHZ) {
                 ichan->chanmode = CHANNEL_G;
                 ichan->channelFlags = CHANNEL_2GHZ | CHANNEL_OFDM;
         } else {
@@ -108,8 +110,22 @@ void ath9k_cmn_update_ichannel(struct ath9k_channel *ichan,
                 ichan->channelFlags = CHANNEL_5GHZ | CHANNEL_OFDM;
         }
 
-        if (channel_type != NL80211_CHAN_NO_HT)
-                ichan->chanmode = ath9k_get_extchanmode(chan, channel_type);
+        switch (chandef->width) {
+        case NL80211_CHAN_WIDTH_5:
+                ichan->channelFlags |= CHANNEL_QUARTER;
+                break;
+        case NL80211_CHAN_WIDTH_10:
+                ichan->channelFlags |= CHANNEL_HALF;
+                break;
+        case NL80211_CHAN_WIDTH_20_NOHT:
+                break;
+        case NL80211_CHAN_WIDTH_20:
+        case NL80211_CHAN_WIDTH_40:
+                ichan->chanmode = ath9k_get_extchanmode(chandef);
+                break;
+        default:
+                WARN_ON(1);
+        }
 }
 EXPORT_SYMBOL(ath9k_cmn_update_ichannel);
 
@@ -125,8 +141,7 @@ struct ath9k_channel *ath9k_cmn_get_curchannel(struct ieee80211_hw *hw,
 
         chan_idx = curchan->hw_value;
         channel = &ah->channels[chan_idx];
-        ath9k_cmn_update_ichannel(channel, curchan,
-                                  cfg80211_get_chandef_type(&hw->conf.chandef));
+        ath9k_cmn_update_ichannel(channel, &hw->conf.chandef);
 
         return channel;
 }
diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
index 207d06995b15..e039bcbfbd79 100644
--- a/drivers/net/wireless/ath/ath9k/common.h
+++ b/drivers/net/wireless/ath/ath9k/common.h
@@ -44,8 +44,7 @@
 
 int ath9k_cmn_get_hw_crypto_keytype(struct sk_buff *skb);
 void ath9k_cmn_update_ichannel(struct ath9k_channel *ichan,
-                               struct ieee80211_channel *chan,
-                               enum nl80211_channel_type channel_type);
+                               struct cfg80211_chan_def *chandef);
 struct ath9k_channel *ath9k_cmn_get_curchannel(struct ieee80211_hw *hw,
                                                struct ath_hw *ah);
 int ath9k_cmn_count_streams(unsigned int chainmask, int max);
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index c10cec5650c6..c088744a6bfb 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -88,90 +88,6 @@ static const struct file_operations fops_debug = {
 
 #define DMA_BUF_LEN 1024
 
-static ssize_t read_file_tx_chainmask(struct file *file, char __user *user_buf,
-                             size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-        struct ath_hw *ah = sc->sc_ah;
-        char buf[32];
-        unsigned int len;
-
-        len = sprintf(buf, "0x%08x\n", ah->txchainmask);
-        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
-}
-
-static ssize_t write_file_tx_chainmask(struct file *file, const char __user *user_buf,
-                             size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-        struct ath_hw *ah = sc->sc_ah;
-        unsigned long mask;
-        char buf[32];
-        ssize_t len;
-
-        len = min(count, sizeof(buf) - 1);
-        if (copy_from_user(buf, user_buf, len))
-                return -EFAULT;
-
-        buf[len] = '\0';
-        if (kstrtoul(buf, 0, &mask))
-                return -EINVAL;
-
-        ah->txchainmask = mask;
-        ah->caps.tx_chainmask = mask;
-        return count;
-}
-
-static const struct file_operations fops_tx_chainmask = {
-        .read = read_file_tx_chainmask,
-        .write = write_file_tx_chainmask,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
-
-static ssize_t read_file_rx_chainmask(struct file *file, char __user *user_buf,
-                             size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-        struct ath_hw *ah = sc->sc_ah;
-        char buf[32];
-        unsigned int len;
-
-        len = sprintf(buf, "0x%08x\n", ah->rxchainmask);
-        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
-}
-
-static ssize_t write_file_rx_chainmask(struct file *file, const char __user *user_buf,
-                             size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-        struct ath_hw *ah = sc->sc_ah;
-        unsigned long mask;
-        char buf[32];
-        ssize_t len;
-
-        len = min(count, sizeof(buf) - 1);
-        if (copy_from_user(buf, user_buf, len))
-                return -EFAULT;
-
-        buf[len] = '\0';
-        if (kstrtoul(buf, 0, &mask))
-                return -EINVAL;
-
-        ah->rxchainmask = mask;
-        ah->caps.rx_chainmask = mask;
-        return count;
-}
-
-static const struct file_operations fops_rx_chainmask = {
-        .read = read_file_rx_chainmask,
-        .write = write_file_rx_chainmask,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
 
 static ssize_t read_file_ani(struct file *file, char __user *user_buf,
                              size_t count, loff_t *ppos)
@@ -1725,17 +1641,7 @@ void ath9k_sta_add_debugfs(struct ieee80211_hw *hw,
                            struct dentry *dir)
 {
         struct ath_node *an = (struct ath_node *)sta->drv_priv;
-        an->node_stat = debugfs_create_file("node_stat", S_IRUGO,
-                                            dir, an, &fops_node_stat);
-}
-
-void ath9k_sta_remove_debugfs(struct ieee80211_hw *hw,
-                              struct ieee80211_vif *vif,
-                              struct ieee80211_sta *sta,
-                              struct dentry *dir)
-{
-        struct ath_node *an = (struct ath_node *)sta->drv_priv;
-        debugfs_remove(an->node_stat);
+        debugfs_create_file("node_stat", S_IRUGO, dir, an, &fops_node_stat);
 }
 
 /* Ethtool support for get-stats */
@@ -1906,10 +1812,10 @@ int ath9k_init_debug(struct ath_hw *ah)
                             &fops_reset);
         debugfs_create_file("recv", S_IRUSR, sc->debug.debugfs_phy, sc,
                             &fops_recv);
-        debugfs_create_file("rx_chainmask", S_IRUSR | S_IWUSR,
-                            sc->debug.debugfs_phy, sc, &fops_rx_chainmask);
-        debugfs_create_file("tx_chainmask", S_IRUSR | S_IWUSR,
-                            sc->debug.debugfs_phy, sc, &fops_tx_chainmask);
+        debugfs_create_u8("rx_chainmask", S_IRUSR, sc->debug.debugfs_phy,
+                          &ah->rxchainmask);
+        debugfs_create_u8("tx_chainmask", S_IRUSR, sc->debug.debugfs_phy,
+                          &ah->txchainmask);
         debugfs_create_file("ani", S_IRUSR | S_IWUSR,
                             sc->debug.debugfs_phy, sc, &fops_ani);
         debugfs_create_bool("paprd", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index 01c5c6a22e1b..6e1556fa2f3e 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -292,10 +292,6 @@ void ath9k_sta_add_debugfs(struct ieee80211_hw *hw,
                            struct ieee80211_vif *vif,
                            struct ieee80211_sta *sta,
                            struct dentry *dir);
-void ath9k_sta_remove_debugfs(struct ieee80211_hw *hw,
-                              struct ieee80211_vif *vif,
-                              struct ieee80211_sta *sta,
-                              struct dentry *dir);
 void ath_debug_send_fft_sample(struct ath_softc *sc,
                                struct fft_sample_tlv *fft_sample);
 void ath9k_debug_stat_ant(struct ath_softc *sc,
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 5205a3625e84..6d5d716adc1b 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -115,10 +115,10 @@ static int hif_usb_send_regout(struct hif_device_usb *hif_dev,
         cmd->skb = skb;
         cmd->hif_dev = hif_dev;
 
-        usb_fill_bulk_urb(urb, hif_dev->udev,
-                         usb_sndbulkpipe(hif_dev->udev, USB_REG_OUT_PIPE),
+        usb_fill_int_urb(urb, hif_dev->udev,
+                         usb_sndintpipe(hif_dev->udev, USB_REG_OUT_PIPE),
                          skb->data, skb->len,
-                         hif_usb_regout_cb, cmd);
+                         hif_usb_regout_cb, cmd, 1);
 
         usb_anchor_urb(urb, &hif_dev->regout_submitted);
         ret = usb_submit_urb(urb, GFP_KERNEL);
@@ -723,11 +723,11 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
                         return;
                 }
 
-                usb_fill_bulk_urb(urb, hif_dev->udev,
-                                 usb_rcvbulkpipe(hif_dev->udev,
+                usb_fill_int_urb(urb, hif_dev->udev,
+                                 usb_rcvintpipe(hif_dev->udev,
                                                  USB_REG_IN_PIPE),
                                  nskb->data, MAX_REG_IN_BUF_SIZE,
-                                 ath9k_hif_usb_reg_in_cb, nskb);
+                                 ath9k_hif_usb_reg_in_cb, nskb, 1);
         }
 
 resubmit:
@@ -909,11 +909,11 @@ static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev)
                         goto err_skb;
                 }
 
-                usb_fill_bulk_urb(urb, hif_dev->udev,
-                                  usb_rcvbulkpipe(hif_dev->udev,
+                usb_fill_int_urb(urb, hif_dev->udev,
+                                  usb_rcvintpipe(hif_dev->udev,
                                                   USB_REG_IN_PIPE),
                                   skb->data, MAX_REG_IN_BUF_SIZE,
-                                  ath9k_hif_usb_reg_in_cb, skb);
+                                  ath9k_hif_usb_reg_in_cb, skb, 1);
 
                 /* Anchor URB */
                 usb_anchor_urb(urb, &hif_dev->reg_in_submitted);
@@ -1031,9 +1031,7 @@ static int ath9k_hif_usb_download_fw(struct hif_device_usb *hif_dev)
 
 static int ath9k_hif_usb_dev_init(struct hif_device_usb *hif_dev)
 {
-        struct usb_host_interface *alt = &hif_dev->interface->altsetting[0];
-        struct usb_endpoint_descriptor *endp;
-        int ret, idx;
+        int ret;
 
         ret = ath9k_hif_usb_download_fw(hif_dev);
         if (ret) {
@@ -1043,20 +1041,6 @@ static int ath9k_hif_usb_dev_init(struct hif_device_usb *hif_dev)
                 return ret;
         }
 
-        /* On downloading the firmware to the target, the USB descriptor of EP4
-         * is 'patched' to change the type of the endpoint to Bulk. This will
-         * bring down CPU usage during the scan period.
-         */
-        for (idx = 0; idx < alt->desc.bNumEndpoints; idx++) {
-                endp = &alt->endpoint[idx].desc;
-                if ((endp->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
-                                == USB_ENDPOINT_XFER_INT) {
-                        endp->bmAttributes &= ~USB_ENDPOINT_XFERTYPE_MASK;
-                        endp->bmAttributes |= USB_ENDPOINT_XFER_BULK;
-                        endp->bInterval = 0;
-                }
-        }
-
         /* Alloc URBs */
         ret = ath9k_hif_usb_alloc_urbs(hif_dev);
         if (ret) {
@@ -1268,7 +1252,7 @@ static void ath9k_hif_usb_reboot(struct usb_device *udev)
         if (!buf)
                 return;
 
-        ret = usb_bulk_msg(udev, usb_sndbulkpipe(udev, USB_REG_OUT_PIPE),
+        ret = usb_interrupt_msg(udev, usb_sndintpipe(udev, USB_REG_OUT_PIPE),
                            buf, 4, NULL, HZ);
         if (ret)
                 dev_err(&udev->dev, "ath9k_htc: USB reboot failed\n");
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index 5c1bec18c9e3..d44258172c0f 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -1203,16 +1203,13 @@ static int ath9k_htc_config(struct ieee80211_hw *hw, u32 changed)
 
         if ((changed & IEEE80211_CONF_CHANGE_CHANNEL) || chip_reset) {
                 struct ieee80211_channel *curchan = hw->conf.chandef.chan;
-                enum nl80211_channel_type channel_type =
-                        cfg80211_get_chandef_type(&hw->conf.chandef);
                 int pos = curchan->hw_value;
 
                 ath_dbg(common, CONFIG, "Set channel: %d MHz\n",
                         curchan->center_freq);
 
                 ath9k_cmn_update_ichannel(&priv->ah->channels[pos],
-                                          hw->conf.chandef.chan,
-                                          channel_type);
+                                          &hw->conf.chandef);
 
                 if (ath9k_htc_set_channel(priv, hw, &priv->ah->channels[pos]) < 0) {
                         ath_err(common, "Unable to set channel\n");
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index e602c9519709..c028df76b564 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -448,6 +448,7 @@ static void ath9k_htc_tx_process(struct ath9k_htc_priv *priv,
         struct ieee80211_conf *cur_conf = &priv->hw->conf;
         bool txok;
         int slot;
+        int hdrlen, padsize;
 
         slot = strip_drv_header(priv, skb);
         if (slot < 0) {
@@ -504,6 +505,15 @@ send_mac80211:
 
         ath9k_htc_tx_clear_slot(priv, slot);
 
+        /* Remove padding before handing frame back to mac80211 */
+        hdrlen = ieee80211_get_hdrlen_from_skb(skb);
+
+        padsize = hdrlen & 3;
+        if (padsize && skb->len > hdrlen + padsize) {
+                memmove(skb->data + padsize, skb->data, hdrlen);
+                skb_pull(skb, padsize);
+        }
+
         /* Send status to mac80211 */
         ieee80211_tx_status(priv->hw, skb);
 }
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 151443bddbde..ecc6ec4a1edb 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -450,7 +450,6 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
         ah->config.ack_6mb = 0x0;
         ah->config.cwm_ignore_extcca = 0;
         ah->config.pcie_clock_req = 0;
-        ah->config.pcie_waen = 0;
         ah->config.analog_shiftreg = 1;
 
         for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++) {
@@ -575,18 +574,17 @@ static int __ath9k_hw_init(struct ath_hw *ah)
          * We need to do this to avoid RMW of this register. We cannot
          * read the reg when chip is asleep.
          */
-        ah->WARegVal = REG_READ(ah, AR_WA);
-        ah->WARegVal |= (AR_WA_D3_L1_DISABLE |
-                         AR_WA_ASPM_TIMER_BASED_DISABLE);
+        if (AR_SREV_9300_20_OR_LATER(ah)) {
+                ah->WARegVal = REG_READ(ah, AR_WA);
+                ah->WARegVal |= (AR_WA_D3_L1_DISABLE |
+                                 AR_WA_ASPM_TIMER_BASED_DISABLE);
+        }
 
         if (!ath9k_hw_set_reset_reg(ah, ATH9K_RESET_POWER_ON)) {
                 ath_err(common, "Couldn't reset chip\n");
                 return -EIO;
         }
 
-        if (AR_SREV_9462(ah))
-                ah->WARegVal &= ~AR_WA_D3_L1_DISABLE;
-
         if (AR_SREV_9565(ah)) {
                 ah->WARegVal |= AR_WA_BIT22;
                 REG_WRITE(ah, AR_WA, ah->WARegVal);
@@ -656,8 +654,6 @@ static int __ath9k_hw_init(struct ath_hw *ah)
         ath9k_hw_init_cal_settings(ah);
 
         ah->ani_function = ATH9K_ANI_ALL;
-        if (AR_SREV_9280_20_OR_LATER(ah) && !AR_SREV_9300_20_OR_LATER(ah))
-                ah->ani_function &= ~ATH9K_ANI_NOISE_IMMUNITY_LEVEL;
         if (!AR_SREV_9300_20_OR_LATER(ah))
                 ah->ani_function &= ~ATH9K_ANI_MRC_CCK;
 
@@ -1069,7 +1065,7 @@ void ath9k_hw_init_global_settings(struct ath_hw *ah)
                 if (IS_CHAN_A_FAST_CLOCK(ah, chan))
                     tx_lat += 11;
 
-                sifstime *= 2;
+                sifstime = 32;
                 ack_offset = 16;
                 slottime = 13;
         } else if (IS_CHAN_QUARTER_RATE(chan)) {
@@ -1079,7 +1075,7 @@ void ath9k_hw_init_global_settings(struct ath_hw *ah)
                 if (IS_CHAN_A_FAST_CLOCK(ah, chan))
                     tx_lat += 22;
 
-                sifstime *= 4;
+                sifstime = 64;
                 ack_offset = 32;
                 slottime = 21;
         } else {
@@ -1116,7 +1112,6 @@ void ath9k_hw_init_global_settings(struct ath_hw *ah)
                 ctstimeout += 48 - sifstime - ah->slottime;
         }
 
-
         ath9k_hw_set_sifs_time(ah, sifstime);
         ath9k_hw_setslottime(ah, slottime);
         ath9k_hw_set_ack_timeout(ah, acktimeout);
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 64ff8e61c243..69a907b55a73 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -311,9 +311,11 @@ struct ath9k_ops_config {
         u16 ani_poll_interval; /* ANI poll interval in ms */
 
         /* Platform specific config */
+        u32 aspm_l1_fix;
         u32 xlna_gpio;
         u32 ant_ctrl_comm2g_switch_enable;
         bool xatten_margin_cfg;
+        bool alt_mingainidx;
 };
 
 enum ath9k_int {
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 3b56c2e7efe7..9a1f349f9260 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -146,14 +146,22 @@ static struct ieee80211_rate ath9k_legacy_rates[] = {
         RATE(20, 0x1a, IEEE80211_RATE_SHORT_PREAMBLE),
         RATE(55, 0x19, IEEE80211_RATE_SHORT_PREAMBLE),
         RATE(110, 0x18, IEEE80211_RATE_SHORT_PREAMBLE),
-        RATE(60, 0x0b, 0),
-        RATE(90, 0x0f, 0),
-        RATE(120, 0x0a, 0),
-        RATE(180, 0x0e, 0),
-        RATE(240, 0x09, 0),
-        RATE(360, 0x0d, 0),
-        RATE(480, 0x08, 0),
-        RATE(540, 0x0c, 0),
+        RATE(60, 0x0b, (IEEE80211_RATE_SUPPORTS_5MHZ |
+                        IEEE80211_RATE_SUPPORTS_10MHZ)),
+        RATE(90, 0x0f, (IEEE80211_RATE_SUPPORTS_5MHZ |
+                        IEEE80211_RATE_SUPPORTS_10MHZ)),
+        RATE(120, 0x0a, (IEEE80211_RATE_SUPPORTS_5MHZ |
+                         IEEE80211_RATE_SUPPORTS_10MHZ)),
+        RATE(180, 0x0e, (IEEE80211_RATE_SUPPORTS_5MHZ |
+                         IEEE80211_RATE_SUPPORTS_10MHZ)),
+        RATE(240, 0x09, (IEEE80211_RATE_SUPPORTS_5MHZ |
+                         IEEE80211_RATE_SUPPORTS_10MHZ)),
+        RATE(360, 0x0d, (IEEE80211_RATE_SUPPORTS_5MHZ |
+                         IEEE80211_RATE_SUPPORTS_10MHZ)),
+        RATE(480, 0x08, (IEEE80211_RATE_SUPPORTS_5MHZ |
+                         IEEE80211_RATE_SUPPORTS_10MHZ)),
+        RATE(540, 0x0c, (IEEE80211_RATE_SUPPORTS_5MHZ |
+                         IEEE80211_RATE_SUPPORTS_10MHZ)),
 };
 
 #ifdef CONFIG_MAC80211_LEDS
@@ -526,6 +534,7 @@ static void ath9k_init_platform(struct ath_softc *sc)
                                ATH9K_PCI_CUS230)) {
                 ah->config.xlna_gpio = 9;
                 ah->config.xatten_margin_cfg = true;
+                ah->config.alt_mingainidx = true;
                 ah->config.ant_ctrl_comm2g_switch_enable = 0x000BBB88;
                 sc->ant_comb.low_rssi_thresh = 20;
                 sc->ant_comb.fast_div_bias = 3;
@@ -542,6 +551,11 @@ static void ath9k_init_platform(struct ath_softc *sc)
                 pCap->hw_caps |= ATH9K_HW_CAP_BT_ANT_DIV;
                 ath_info(common, "Set BT/WLAN RX diversity capability\n");
         }
+
+        if (sc->driver_data & ATH9K_PCI_D3_L1_WAR) {
+                ah->config.pcie_waen = 0x0040473b;
+                ath_info(common, "Enable WAR for ASPM D3/L1\n");
+        }
 }
 
 static void ath9k_eeprom_request_cb(const struct firmware *eeprom_blob,
@@ -726,13 +740,15 @@ static void ath9k_init_band_txpower(struct ath_softc *sc, int band)
         struct ieee80211_supported_band *sband;
         struct ieee80211_channel *chan;
         struct ath_hw *ah = sc->sc_ah;
+        struct cfg80211_chan_def chandef;
         int i;
 
         sband = &sc->sbands[band];
         for (i = 0; i < sband->n_channels; i++) {
                 chan = &sband->channels[i];
                 ah->curchan = &ah->channels[chan->hw_value];
-                ath9k_cmn_update_ichannel(ah->curchan, chan, NL80211_CHAN_HT20);
+                cfg80211_chandef_create(&chandef, chan, NL80211_CHAN_HT20);
+                ath9k_cmn_update_ichannel(ah->curchan, &chandef);
                 ath9k_hw_set_txpowerlimit(ah, MAX_RATE_POWER, true);
         }
 }
@@ -818,7 +834,8 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                 IEEE80211_HW_PS_NULLFUNC_STACK |
                 IEEE80211_HW_SPECTRUM_MGMT |
                 IEEE80211_HW_REPORTS_TX_ACK_STATUS |
-                IEEE80211_HW_SUPPORTS_RC_TABLE;
+                IEEE80211_HW_SUPPORTS_RC_TABLE |
+                IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
 
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT) {
                 hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
@@ -850,6 +867,8 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
         hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
         hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
         hw->wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
+        hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_5_10_MHZ;
+        hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
 
 #ifdef CONFIG_PM_SLEEP
         if ((ah->caps.hw_caps & ATH9K_HW_WOW_DEVICE_CAPABLE) &&
diff --git a/drivers/net/wireless/ath/ath9k/link.c b/drivers/net/wireless/ath/ath9k/link.c
index fff5d3ccc663..2f831db396ac 100644
--- a/drivers/net/wireless/ath/ath9k/link.c
+++ b/drivers/net/wireless/ath/ath9k/link.c
@@ -41,7 +41,7 @@ void ath_tx_complete_poll_work(struct work_struct *work)
                                 txq->axq_tx_inprogress = true;
                         }
                 }
-                ath_txq_unlock_complete(sc, txq);
+                ath_txq_unlock(sc, txq);
         }
 
         if (needreset) {
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 2ef05ebffbcf..a3eff0986a3f 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -583,9 +583,9 @@ int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
         rs->rs_rate = MS(ads.ds_rxstatus0, AR_RxRate);
         rs->rs_more = (ads.ds_rxstatus1 & AR_RxMore) ? 1 : 0;
 
+        rs->rs_firstaggr = (ads.ds_rxstatus8 & AR_RxFirstAggr) ? 1 : 0;
         rs->rs_isaggr = (ads.ds_rxstatus8 & AR_RxAggr) ? 1 : 0;
-        rs->rs_moreaggr =
-                (ads.ds_rxstatus8 & AR_RxMoreAggr) ? 1 : 0;
+        rs->rs_moreaggr = (ads.ds_rxstatus8 & AR_RxMoreAggr) ? 1 : 0;
         rs->rs_antenna = MS(ads.ds_rxstatus3, AR_RxAntenna);
 
         /* directly mapped flags for ieee80211_rx_status */
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index b02dfce964b4..bfccaceed44e 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -140,6 +140,7 @@ struct ath_rx_status {
         int8_t rs_rssi_ext1;
         int8_t rs_rssi_ext2;
         u8 rs_isaggr;
+        u8 rs_firstaggr;
         u8 rs_moreaggr;
         u8 rs_num_delims;
         u8 rs_flags;
@@ -569,6 +570,7 @@ struct ar5416_desc {
 #define AR_RxAggr           0x00020000
 #define AR_PostDelimCRCErr  0x00040000
 #define AR_RxStatusRsvd71   0x3ff80000
+#define AR_RxFirstAggr      0x20000000
 #define AR_DecryptBusyErr   0x40000000
 #define AR_KeyMiss          0x80000000
 
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 911744f5c43c..e4f65900132d 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -173,8 +173,7 @@ static void ath_restart_work(struct ath_softc *sc)
 {
         ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
 
-        if (AR_SREV_9340(sc->sc_ah) || AR_SREV_9485(sc->sc_ah) ||
-            AR_SREV_9550(sc->sc_ah))
+        if (AR_SREV_9340(sc->sc_ah) || AR_SREV_9330(sc->sc_ah))
                 ieee80211_queue_delayed_work(sc->hw, &sc->hw_pll_work,
                                      msecs_to_jiffies(ATH_PLL_WORK_INTERVAL));
 
@@ -1032,6 +1031,9 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
         if (ath9k_uses_beacons(vif->type))
                 ath9k_beacon_remove_slot(sc, vif);
 
+        if (sc->csa_vif == vif)
+                sc->csa_vif = NULL;
+
         ath9k_ps_wakeup(sc);
         ath9k_calculate_summary_state(hw, NULL);
         ath9k_ps_restore(sc);
@@ -1201,8 +1203,6 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
 
         if ((changed & IEEE80211_CONF_CHANGE_CHANNEL) || reset_channel) {
                 struct ieee80211_channel *curchan = hw->conf.chandef.chan;
-                enum nl80211_channel_type channel_type =
-                        cfg80211_get_chandef_type(&conf->chandef);
                 int pos = curchan->hw_value;
                 int old_pos = -1;
                 unsigned long flags;
@@ -1210,8 +1210,8 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                 if (ah->curchan)
                         old_pos = ah->curchan - &ah->channels[0];
 
-                ath_dbg(common, CONFIG, "Set channel: %d MHz type: %d\n",
-                        curchan->center_freq, channel_type);
+                ath_dbg(common, CONFIG, "Set channel: %d MHz width: %d\n",
+                        curchan->center_freq, hw->conf.chandef.width);
 
                 /* update survey stats for the old channel before switching */
                 spin_lock_irqsave(&common->cc_lock, flags);
@@ -1219,7 +1219,7 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                 spin_unlock_irqrestore(&common->cc_lock, flags);
 
                 ath9k_cmn_update_ichannel(&sc->sc_ah->channels[pos],
-                                          curchan, channel_type);
+                                          &conf->chandef);
 
                 /*
                  * If the operating channel changes, change the survey in-use flags
@@ -2320,6 +2320,19 @@ static void ath9k_sw_scan_complete(struct ieee80211_hw *hw)
         clear_bit(SC_OP_SCANNING, &sc->sc_flags);
 }
 
+static void ath9k_channel_switch_beacon(struct ieee80211_hw *hw,
+                                        struct ieee80211_vif *vif,
+                                        struct cfg80211_chan_def *chandef)
+{
+        struct ath_softc *sc = hw->priv;
+
+        /* mac80211 does not support CSA in multi-if cases (yet) */
+        if (WARN_ON(sc->csa_vif))
+                return;
+
+        sc->csa_vif = vif;
+}
+
 struct ieee80211_ops ath9k_ops = {
         .tx                 = ath9k_tx,
         .start              = ath9k_start,
@@ -2364,8 +2377,8 @@ struct ieee80211_ops ath9k_ops = {
 
 #if defined(CONFIG_MAC80211_DEBUGFS) && defined(CONFIG_ATH9K_DEBUGFS)
         .sta_add_debugfs    = ath9k_sta_add_debugfs,
-        .sta_remove_debugfs = ath9k_sta_remove_debugfs,
 #endif
         .sw_scan_start      = ath9k_sw_scan_start,
         .sw_scan_complete   = ath9k_sw_scan_complete,
+        .channel_switch_beacon     = ath9k_channel_switch_beacon,
 };
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 76e8c359bbf8..d089a7cf01c4 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -30,6 +30,52 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
         { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI   */
         { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */
 
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x002A,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x1C71),
+          .driver_data = ATH9K_PCI_D3_L1_WAR },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x002A,
+                         PCI_VENDOR_ID_FOXCONN,
+                         0xE01F),
+          .driver_data = ATH9K_PCI_D3_L1_WAR },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x002A,
+                         0x11AD, /* LITEON */
+                         0x6632),
+          .driver_data = ATH9K_PCI_D3_L1_WAR },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x002A,
+                         0x11AD, /* LITEON */
+                         0x6642),
+          .driver_data = ATH9K_PCI_D3_L1_WAR },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x002A,
+                         PCI_VENDOR_ID_QMI,
+                         0x0306),
+          .driver_data = ATH9K_PCI_D3_L1_WAR },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x002A,
+                         0x185F, /* WNC */
+                         0x309D),
+          .driver_data = ATH9K_PCI_D3_L1_WAR },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x002A,
+                         0x10CF, /* Fujitsu */
+                         0x147C),
+          .driver_data = ATH9K_PCI_D3_L1_WAR },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x002A,
+                         0x10CF, /* Fujitsu */
+                         0x147D),
+          .driver_data = ATH9K_PCI_D3_L1_WAR },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x002A,
+                         0x10CF, /* Fujitsu */
+                         0x1536),
+          .driver_data = ATH9K_PCI_D3_L1_WAR },
+
         /* AR9285 card for Asus */
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x002B,
@@ -59,6 +105,11 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
                          PCI_VENDOR_ID_AZWAVE,
                          0x2126),
           .driver_data = ATH9K_PCI_CUS198 | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0032,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x126A),
+          .driver_data = ATH9K_PCI_CUS198 | ATH9K_PCI_BT_ANT_DIV },
 
         /* PCI-E CUS230 */
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
@@ -309,6 +360,22 @@ static void ath_pci_aspm_init(struct ath_common *common)
                 return;
         }
 
+        /*
+         * 0x70c - Ack Frequency Register.
+         *
+         * Bits 27:29 - DEFAULT_L1_ENTRANCE_LATENCY.
+         *
+         * 000 : 1 us
+         * 001 : 2 us
+         * 010 : 4 us
+         * 011 : 8 us
+         * 100 : 16 us
+         * 101 : 32 us
+         * 110/111 : 64 us
+         */
+        if (AR_SREV_9462(ah))
+                pci_read_config_dword(pdev, 0x70c, &ah->config.aspm_l1_fix);
+
         pcie_capability_read_word(parent, PCI_EXP_LNKCTL, &aspm);
         if (aspm & (PCI_EXP_LNKCTL_ASPM_L0S | PCI_EXP_LNKCTL_ASPM_L1)) {
                 ah->aspm_enabled = true;
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index a3c4ca0c94bf..d3d7c51fa6c8 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -1282,9 +1282,14 @@ static void ath_rate_init(void *priv, struct ieee80211_supported_band *sband,
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_rate_priv *ath_rc_priv = priv_sta;
         int i, j = 0;
+        u32 rate_flags = ieee80211_chandef_rate_flags(&sc->hw->conf.chandef);
 
         for (i = 0; i < sband->n_bitrates; i++) {
                 if (sta->supp_rates[sband->band] & BIT(i)) {
+                        if ((rate_flags & sband->bitrates[i].flags)
+                            != rate_flags)
+                                continue;
+
                         ath_rc_priv->neg_rates.rs_rates[j]
                                 = (sband->bitrates[i].bitrate * 2) / 10;
                         j++;
@@ -1326,8 +1331,8 @@ static void ath_rate_update(void *priv, struct ieee80211_supported_band *sband,
                 ath_rc_init(sc, priv_sta);
 
                 ath_dbg(ath9k_hw_common(sc->sc_ah), CONFIG,
-                        "Operating HT Bandwidth changed to: %d\n",
-                        cfg80211_get_chandef_type(&sc->hw->conf.chandef));
+                        "Operating Bandwidth changed to: %d\n",
+                        sc->hw->conf.chandef.width);
         }
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 62dff97c1ae4..4ee472a5a4e4 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -42,8 +42,6 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
         struct ath_desc *ds;
         struct sk_buff *skb;
 
-        ATH_RXBUF_RESET(bf);
-
         ds = bf->bf_desc;
         ds->ds_link = 0; /* link to null */
         ds->ds_data = bf->bf_buf_addr;
@@ -70,6 +68,14 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
         sc->rx.rxlink = &ds->ds_link;
 }
 
+static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_buf *bf)
+{
+        if (sc->rx.buf_hold)
+                ath_rx_buf_link(sc, sc->rx.buf_hold);
+
+        sc->rx.buf_hold = bf;
+}
+
 static void ath_setdefantenna(struct ath_softc *sc, u32 antenna)
 {
         /* XXX block beacon interrupts */
@@ -117,7 +123,6 @@ static bool ath_rx_edma_buf_link(struct ath_softc *sc,
 
         skb = bf->bf_mpdu;
 
-        ATH_RXBUF_RESET(bf);
         memset(skb->data, 0, ah->caps.rx_status_len);
         dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
                                 ah->caps.rx_status_len, DMA_TO_DEVICE);
@@ -185,7 +190,7 @@ static void ath_rx_edma_cleanup(struct ath_softc *sc)
 
 static void ath_rx_edma_init_queue(struct ath_rx_edma *rx_edma, int size)
 {
-        skb_queue_head_init(&rx_edma->rx_fifo);
+        __skb_queue_head_init(&rx_edma->rx_fifo);
         rx_edma->rx_fifo_hwsize = size;
 }
 
@@ -432,6 +437,7 @@ int ath_startrecv(struct ath_softc *sc)
         if (list_empty(&sc->rx.rxbuf))
                 goto start_recv;
 
+        sc->rx.buf_hold = NULL;
         sc->rx.rxlink = NULL;
         list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) {
                 ath_rx_buf_link(sc, bf);
@@ -677,6 +683,9 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
         }
 
         bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list);
+        if (bf == sc->rx.buf_hold)
+                return NULL;
+
         ds = bf->bf_desc;
 
         /*
@@ -755,7 +764,6 @@ static bool ath9k_rx_accept(struct ath_common *common,
         bool is_mc, is_valid_tkip, strip_mic, mic_error;
         struct ath_hw *ah = common->ah;
         __le16 fc;
-        u8 rx_status_len = ah->caps.rx_status_len;
 
         fc = hdr->frame_control;
 
@@ -777,25 +785,6 @@ static bool ath9k_rx_accept(struct ath_common *common,
             !test_bit(rx_stats->rs_keyix, common->ccmp_keymap))
                 rx_stats->rs_status &= ~ATH9K_RXERR_KEYMISS;
 
-        if (!rx_stats->rs_datalen) {
-                RX_STAT_INC(rx_len_err);
-                return false;
-        }
-
-        /*
-         * rs_status follows rs_datalen so if rs_datalen is too large
-         * we can take a hint that hardware corrupted it, so ignore
-         * those frames.
-         */
-        if (rx_stats->rs_datalen > (common->rx_bufsize - rx_status_len)) {
-                RX_STAT_INC(rx_len_err);
-                return false;
-        }
-
-        /* Only use error bits from the last fragment */
-        if (rx_stats->rs_more)
-                return true;
-
         mic_error = is_valid_tkip && !ieee80211_is_ctl(fc) &&
                 !ieee80211_has_morefrags(fc) &&
                 !(le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG) &&
@@ -814,8 +803,6 @@ static bool ath9k_rx_accept(struct ath_common *common,
                         rxs->flag |= RX_FLAG_FAILED_FCS_CRC;
                         mic_error = false;
                 }
-                if (rx_stats->rs_status & ATH9K_RXERR_PHY)
-                        return false;
 
                 if ((rx_stats->rs_status & ATH9K_RXERR_DECRYPT) ||
                     (!is_mc && (rx_stats->rs_status & ATH9K_RXERR_KEYMISS))) {
@@ -865,6 +852,17 @@ static int ath9k_process_rate(struct ath_common *common,
         band = hw->conf.chandef.chan->band;
         sband = hw->wiphy->bands[band];
 
+        switch (hw->conf.chandef.width) {
+        case NL80211_CHAN_WIDTH_5:
+                rxs->flag |= RX_FLAG_5MHZ;
+                break;
+        case NL80211_CHAN_WIDTH_10:
+                rxs->flag |= RX_FLAG_10MHZ;
+                break;
+        default:
+                break;
+        }
+
         if (rx_stats->rs_rate & 0x80) {
                 /* HT rate */
                 rxs->flag |= RX_FLAG_HT;
@@ -898,129 +896,65 @@ static int ath9k_process_rate(struct ath_common *common,
 
 static void ath9k_process_rssi(struct ath_common *common,
                                struct ieee80211_hw *hw,
-                               struct ieee80211_hdr *hdr,
-                               struct ath_rx_status *rx_stats)
+                               struct ath_rx_status *rx_stats,
+                               struct ieee80211_rx_status *rxs)
 {
         struct ath_softc *sc = hw->priv;
         struct ath_hw *ah = common->ah;
         int last_rssi;
         int rssi = rx_stats->rs_rssi;
 
-        if (!rx_stats->is_mybeacon ||
-            ((ah->opmode != NL80211_IFTYPE_STATION) &&
-             (ah->opmode != NL80211_IFTYPE_ADHOC)))
+        /*
+         * RSSI is not available for subframes in an A-MPDU.
+         */
+        if (rx_stats->rs_moreaggr) {
+                rxs->flag |= RX_FLAG_NO_SIGNAL_VAL;
                 return;
-
-        if (rx_stats->rs_rssi != ATH9K_RSSI_BAD && !rx_stats->rs_moreaggr)
-                ATH_RSSI_LPF(sc->last_rssi, rx_stats->rs_rssi);
-
-        last_rssi = sc->last_rssi;
-        if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
-                rssi = ATH_EP_RND(last_rssi, ATH_RSSI_EP_MULTIPLIER);
-        if (rssi < 0)
-                rssi = 0;
-
-        /* Update Beacon RSSI, this is used by ANI. */
-        ah->stats.avgbrssi = rssi;
-}
-
-/*
- * For Decrypt or Demic errors, we only mark packet status here and always push
- * up the frame up to let mac80211 handle the actual error case, be it no
- * decryption key or real decryption error. This let us keep statistics there.
- */
-static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
-                                   struct ieee80211_hdr *hdr,
-                                   struct ath_rx_status *rx_stats,
-                                   struct ieee80211_rx_status *rx_status,
-                                   bool *decrypt_error)
-{
-        struct ieee80211_hw *hw = sc->hw;
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath_common *common = ath9k_hw_common(ah);
-        bool discard_current = sc->rx.discard_next;
-
-        sc->rx.discard_next = rx_stats->rs_more;
-        if (discard_current)
-                return -EINVAL;
+        }
 
         /*
-         * everything but the rate is checked here, the rate check is done
-         * separately to avoid doing two lookups for a rate for each frame.
+         * Check if the RSSI for the last subframe in an A-MPDU
+         * or an unaggregated frame is valid.
          */
-        if (!ath9k_rx_accept(common, hdr, rx_status, rx_stats, decrypt_error))
-                return -EINVAL;
-
-        /* Only use status info from the last fragment */
-        if (rx_stats->rs_more)
-                return 0;
+        if (rx_stats->rs_rssi == ATH9K_RSSI_BAD) {
+                rxs->flag |= RX_FLAG_NO_SIGNAL_VAL;
+                return;
+        }
 
-        if (ath9k_process_rate(common, hw, rx_stats, rx_status))
-                return -EINVAL;
+        /*
+         * Update Beacon RSSI, this is used by ANI.
+         */
+        if (rx_stats->is_mybeacon &&
+            ((ah->opmode == NL80211_IFTYPE_STATION) ||
+             (ah->opmode == NL80211_IFTYPE_ADHOC))) {
+                ATH_RSSI_LPF(sc->last_rssi, rx_stats->rs_rssi);
+                last_rssi = sc->last_rssi;
 
-        ath9k_process_rssi(common, hw, hdr, rx_stats);
+                if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
+                        rssi = ATH_EP_RND(last_rssi, ATH_RSSI_EP_MULTIPLIER);
+                if (rssi < 0)
+                        rssi = 0;
 
-        rx_status->band = hw->conf.chandef.chan->band;
-        rx_status->freq = hw->conf.chandef.chan->center_freq;
-        rx_status->signal = ah->noise + rx_stats->rs_rssi;
-        rx_status->antenna = rx_stats->rs_antenna;
-        rx_status->flag |= RX_FLAG_MACTIME_END;
-        if (rx_stats->rs_moreaggr)
-                rx_status->flag |= RX_FLAG_NO_SIGNAL_VAL;
+                ah->stats.avgbrssi = rssi;
+        }
 
-        sc->rx.discard_next = false;
-        return 0;
+        rxs->signal = ah->noise + rx_stats->rs_rssi;
 }
 
-static void ath9k_rx_skb_postprocess(struct ath_common *common,
-                                     struct sk_buff *skb,
-                                     struct ath_rx_status *rx_stats,
-                                     struct ieee80211_rx_status *rxs,
-                                     bool decrypt_error)
+static void ath9k_process_tsf(struct ath_rx_status *rs,
+                              struct ieee80211_rx_status *rxs,
+                              u64 tsf)
 {
-        struct ath_hw *ah = common->ah;
-        struct ieee80211_hdr *hdr;
-        int hdrlen, padpos, padsize;
-        u8 keyix;
-        __le16 fc;
-
-        /* see if any padding is done by the hw and remove it */
-        hdr = (struct ieee80211_hdr *) skb->data;
-        hdrlen = ieee80211_get_hdrlen_from_skb(skb);
-        fc = hdr->frame_control;
-        padpos = ieee80211_hdrlen(fc);
-
-        /* The MAC header is padded to have 32-bit boundary if the
-         * packet payload is non-zero. The general calculation for
-         * padsize would take into account odd header lengths:
-         * padsize = (4 - padpos % 4) % 4; However, since only
-         * even-length headers are used, padding can only be 0 or 2
-         * bytes and we can optimize this a bit. In addition, we must
-         * not try to remove padding from short control frames that do
-         * not have payload. */
-        padsize = padpos & 3;
-        if (padsize && skb->len>=padpos+padsize+FCS_LEN) {
-                memmove(skb->data + padsize, skb->data, padpos);
-                skb_pull(skb, padsize);
-        }
-
-        keyix = rx_stats->rs_keyix;
+        u32 tsf_lower = tsf & 0xffffffff;
 
-        if (!(keyix == ATH9K_RXKEYIX_INVALID) && !decrypt_error &&
-            ieee80211_has_protected(fc)) {
-                rxs->flag |= RX_FLAG_DECRYPTED;
-        } else if (ieee80211_has_protected(fc)
-                   && !decrypt_error && skb->len >= hdrlen + 4) {
-                keyix = skb->data[hdrlen + 3] >> 6;
+        rxs->mactime = (tsf & ~0xffffffffULL) | rs->rs_tstamp;
+        if (rs->rs_tstamp > tsf_lower &&
+            unlikely(rs->rs_tstamp - tsf_lower > 0x10000000))
+                rxs->mactime -= 0x100000000ULL;
 
-                if (test_bit(keyix, common->keymap))
-                        rxs->flag |= RX_FLAG_DECRYPTED;
-        }
-        if (ah->sw_mgmt_crypto &&
-            (rxs->flag & RX_FLAG_DECRYPTED) &&
-            ieee80211_is_mgmt(fc))
-                /* Use software decrypt for management frames. */
-                rxs->flag &= ~RX_FLAG_DECRYPTED;
+        if (rs->rs_tstamp < tsf_lower &&
+            unlikely(tsf_lower - rs->rs_tstamp > 0x10000000))
+                rxs->mactime += 0x100000000ULL;
 }
 
 #ifdef CONFIG_ATH9K_DEBUGFS
@@ -1133,6 +1067,234 @@ static int ath_process_fft(struct ath_softc *sc, struct ieee80211_hdr *hdr,
 #endif
 }
 
+static bool ath9k_is_mybeacon(struct ath_softc *sc, struct ieee80211_hdr *hdr)
+{
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        if (ieee80211_is_beacon(hdr->frame_control)) {
+                RX_STAT_INC(rx_beacons);
+                if (!is_zero_ether_addr(common->curbssid) &&
+                    ether_addr_equal(hdr->addr3, common->curbssid))
+                        return true;
+        }
+
+        return false;
+}
+
+/*
+ * For Decrypt or Demic errors, we only mark packet status here and always push
+ * up the frame up to let mac80211 handle the actual error case, be it no
+ * decryption key or real decryption error. This let us keep statistics there.
+ */
+static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
+                                   struct sk_buff *skb,
+                                   struct ath_rx_status *rx_stats,
+                                   struct ieee80211_rx_status *rx_status,
+                                   bool *decrypt_error, u64 tsf)
+{
+        struct ieee80211_hw *hw = sc->hw;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ieee80211_hdr *hdr;
+        bool discard_current = sc->rx.discard_next;
+        int ret = 0;
+
+        /*
+         * Discard corrupt descriptors which are marked in
+         * ath_get_next_rx_buf().
+         */
+        sc->rx.discard_next = rx_stats->rs_more;
+        if (discard_current)
+                return -EINVAL;
+
+        /*
+         * Discard zero-length packets.
+         */
+        if (!rx_stats->rs_datalen) {
+                RX_STAT_INC(rx_len_err);
+                return -EINVAL;
+        }
+
+        /*
+         * rs_status follows rs_datalen so if rs_datalen is too large
+         * we can take a hint that hardware corrupted it, so ignore
+         * those frames.
+         */
+        if (rx_stats->rs_datalen > (common->rx_bufsize - ah->caps.rx_status_len)) {
+                RX_STAT_INC(rx_len_err);
+                return -EINVAL;
+        }
+
+        /* Only use status info from the last fragment */
+        if (rx_stats->rs_more)
+                return 0;
+
+        /*
+         * Return immediately if the RX descriptor has been marked
+         * as corrupt based on the various error bits.
+         *
+         * This is different from the other corrupt descriptor
+         * condition handled above.
+         */
+        if (rx_stats->rs_status & ATH9K_RXERR_CORRUPT_DESC) {
+                ret = -EINVAL;
+                goto exit;
+        }
+
+        hdr = (struct ieee80211_hdr *) (skb->data + ah->caps.rx_status_len);
+
+        ath9k_process_tsf(rx_stats, rx_status, tsf);
+        ath_debug_stat_rx(sc, rx_stats);
+
+        /*
+         * Process PHY errors and return so that the packet
+         * can be dropped.
+         */
+        if (rx_stats->rs_status & ATH9K_RXERR_PHY) {
+                ath9k_dfs_process_phyerr(sc, hdr, rx_stats, rx_status->mactime);
+                if (ath_process_fft(sc, hdr, rx_stats, rx_status->mactime))
+                        RX_STAT_INC(rx_spectral);
+
+                ret = -EINVAL;
+                goto exit;
+        }
+
+        /*
+         * everything but the rate is checked here, the rate check is done
+         * separately to avoid doing two lookups for a rate for each frame.
+         */
+        if (!ath9k_rx_accept(common, hdr, rx_status, rx_stats, decrypt_error)) {
+                ret = -EINVAL;
+                goto exit;
+        }
+
+        rx_stats->is_mybeacon = ath9k_is_mybeacon(sc, hdr);
+        if (rx_stats->is_mybeacon) {
+                sc->hw_busy_count = 0;
+                ath_start_rx_poll(sc, 3);
+        }
+
+        if (ath9k_process_rate(common, hw, rx_stats, rx_status)) {
+                ret =-EINVAL;
+                goto exit;
+        }
+
+        ath9k_process_rssi(common, hw, rx_stats, rx_status);
+
+        rx_status->band = hw->conf.chandef.chan->band;
+        rx_status->freq = hw->conf.chandef.chan->center_freq;
+        rx_status->antenna = rx_stats->rs_antenna;
+        rx_status->flag |= RX_FLAG_MACTIME_END;
+
+#ifdef CONFIG_ATH9K_BTCOEX_SUPPORT
+        if (ieee80211_is_data_present(hdr->frame_control) &&
+            !ieee80211_is_qos_nullfunc(hdr->frame_control))
+                sc->rx.num_pkts++;
+#endif
+
+exit:
+        sc->rx.discard_next = false;
+        return ret;
+}
+
+static void ath9k_rx_skb_postprocess(struct ath_common *common,
+                                     struct sk_buff *skb,
+                                     struct ath_rx_status *rx_stats,
+                                     struct ieee80211_rx_status *rxs,
+                                     bool decrypt_error)
+{
+        struct ath_hw *ah = common->ah;
+        struct ieee80211_hdr *hdr;
+        int hdrlen, padpos, padsize;
+        u8 keyix;
+        __le16 fc;
+
+        /* see if any padding is done by the hw and remove it */
+        hdr = (struct ieee80211_hdr *) skb->data;
+        hdrlen = ieee80211_get_hdrlen_from_skb(skb);
+        fc = hdr->frame_control;
+        padpos = ieee80211_hdrlen(fc);
+
+        /* The MAC header is padded to have 32-bit boundary if the
+         * packet payload is non-zero. The general calculation for
+         * padsize would take into account odd header lengths:
+         * padsize = (4 - padpos % 4) % 4; However, since only
+         * even-length headers are used, padding can only be 0 or 2
+         * bytes and we can optimize this a bit. In addition, we must
+         * not try to remove padding from short control frames that do
+         * not have payload. */
+        padsize = padpos & 3;
+        if (padsize && skb->len>=padpos+padsize+FCS_LEN) {
+                memmove(skb->data + padsize, skb->data, padpos);
+                skb_pull(skb, padsize);
+        }
+
+        keyix = rx_stats->rs_keyix;
+
+        if (!(keyix == ATH9K_RXKEYIX_INVALID) && !decrypt_error &&
+            ieee80211_has_protected(fc)) {
+                rxs->flag |= RX_FLAG_DECRYPTED;
+        } else if (ieee80211_has_protected(fc)
+                   && !decrypt_error && skb->len >= hdrlen + 4) {
+                keyix = skb->data[hdrlen + 3] >> 6;
+
+                if (test_bit(keyix, common->keymap))
+                        rxs->flag |= RX_FLAG_DECRYPTED;
+        }
+        if (ah->sw_mgmt_crypto &&
+            (rxs->flag & RX_FLAG_DECRYPTED) &&
+            ieee80211_is_mgmt(fc))
+                /* Use software decrypt for management frames. */
+                rxs->flag &= ~RX_FLAG_DECRYPTED;
+}
+
+/*
+ * Run the LNA combining algorithm only in these cases:
+ *
+ * Standalone WLAN cards with both LNA/Antenna diversity
+ * enabled in the EEPROM.
+ *
+ * WLAN+BT cards which are in the supported card list
+ * in ath_pci_id_table and the user has loaded the
+ * driver with "bt_ant_diversity" set to true.
+ */
+static void ath9k_antenna_check(struct ath_softc *sc,
+                                struct ath_rx_status *rs)
+{
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath9k_hw_capabilities *pCap = &ah->caps;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        if (!(ah->caps.hw_caps & ATH9K_HW_CAP_ANT_DIV_COMB))
+                return;
+
+        /*
+         * All MPDUs in an aggregate will use the same LNA
+         * as the first MPDU.
+         */
+        if (rs->rs_isaggr && !rs->rs_firstaggr)
+                return;
+
+        /*
+         * Change the default rx antenna if rx diversity
+         * chooses the other antenna 3 times in a row.
+         */
+        if (sc->rx.defant != rs->rs_antenna) {
+                if (++sc->rx.rxotherant >= 3)
+                        ath_setdefantenna(sc, rs->rs_antenna);
+        } else {
+                sc->rx.rxotherant = 0;
+        }
+
+        if (pCap->hw_caps & ATH9K_HW_CAP_BT_ANT_DIV) {
+                if (common->bt_ant_diversity)
+                        ath_ant_comb_scan(sc, rs);
+        } else {
+                ath_ant_comb_scan(sc, rs);
+        }
+}
+
 static void ath9k_apply_ampdu_details(struct ath_softc *sc,
         struct ath_rx_status *rs, struct ieee80211_rx_status *rxs)
 {
@@ -1157,18 +1319,14 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
         struct sk_buff *skb = NULL, *requeue_skb, *hdr_skb;
         struct ieee80211_rx_status *rxs;
         struct ath_hw *ah = sc->sc_ah;
-        struct ath9k_hw_capabilities *pCap = &ah->caps;
         struct ath_common *common = ath9k_hw_common(ah);
         struct ieee80211_hw *hw = sc->hw;
-        struct ieee80211_hdr *hdr;
         int retval;
         struct ath_rx_status rs;
         enum ath9k_rx_qtype qtype;
         bool edma = !!(ah->caps.hw_caps & ATH9K_HW_CAP_EDMA);
         int dma_type;
-        u8 rx_status_len = ah->caps.rx_status_len;
         u64 tsf = 0;
-        u32 tsf_lower = 0;
         unsigned long flags;
         dma_addr_t new_buf_addr;
 
@@ -1180,7 +1338,6 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
         qtype = hp ? ATH9K_RX_QUEUE_HP : ATH9K_RX_QUEUE_LP;
 
         tsf = ath9k_hw_gettsf64(ah);
-        tsf_lower = tsf & 0xffffffff;
 
         do {
                 bool decrypt_error = false;
@@ -1207,55 +1364,14 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                 else
                         hdr_skb = skb;
 
-                hdr = (struct ieee80211_hdr *) (hdr_skb->data + rx_status_len);
                 rxs = IEEE80211_SKB_RXCB(hdr_skb);
-                if (ieee80211_is_beacon(hdr->frame_control)) {
-                        RX_STAT_INC(rx_beacons);
-                        if (!is_zero_ether_addr(common->curbssid) &&
-                            ether_addr_equal(hdr->addr3, common->curbssid))
-                                rs.is_mybeacon = true;
-                        else
-                                rs.is_mybeacon = false;
-                }
-                else
-                        rs.is_mybeacon = false;
-
-                if (ieee80211_is_data_present(hdr->frame_control) &&
-                    !ieee80211_is_qos_nullfunc(hdr->frame_control))
-                        sc->rx.num_pkts++;
-
-                ath_debug_stat_rx(sc, &rs);
-
                 memset(rxs, 0, sizeof(struct ieee80211_rx_status));
 
-                rxs->mactime = (tsf & ~0xffffffffULL) | rs.rs_tstamp;
-                if (rs.rs_tstamp > tsf_lower &&
-                    unlikely(rs.rs_tstamp - tsf_lower > 0x10000000))
-                        rxs->mactime -= 0x100000000ULL;
-
-                if (rs.rs_tstamp < tsf_lower &&
-                    unlikely(tsf_lower - rs.rs_tstamp > 0x10000000))
-                        rxs->mactime += 0x100000000ULL;
-
-                if (rs.rs_phyerr == ATH9K_PHYERR_RADAR)
-                        ath9k_dfs_process_phyerr(sc, hdr, &rs, rxs->mactime);
-
-                if (rs.rs_status & ATH9K_RXERR_PHY) {
-                        if (ath_process_fft(sc, hdr, &rs, rxs->mactime)) {
-                                RX_STAT_INC(rx_spectral);
-                                goto requeue_drop_frag;
-                        }
-                }
-
-                retval = ath9k_rx_skb_preprocess(sc, hdr, &rs, rxs,
-                                                 &decrypt_error);
+                retval = ath9k_rx_skb_preprocess(sc, hdr_skb, &rs, rxs,
+                                                 &decrypt_error, tsf);
                 if (retval)
                         goto requeue_drop_frag;
 
-                if (rs.is_mybeacon) {
-                        sc->hw_busy_count = 0;
-                        ath_start_rx_poll(sc, 3);
-                }
                 /* Ensure we always have an skb to requeue once we are done
                  * processing the current buffer's skb */
                 requeue_skb = ath_rxbuf_alloc(common, common->rx_bufsize, GFP_ATOMIC);
@@ -1309,8 +1425,6 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                         sc->rx.frag = skb;
                         goto requeue;
                 }
-                if (rs.rs_status & ATH9K_RXERR_CORRUPT_DESC)
-                        goto requeue_drop_frag;
 
                 if (sc->rx.frag) {
                         int space = skb->len - skb_tailroom(hdr_skb);
@@ -1340,35 +1454,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                         ath_rx_ps(sc, skb, rs.is_mybeacon);
                 spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
 
-                /*
-                 * Run the LNA combining algorithm only in these cases:
-                 *
-                 * Standalone WLAN cards with both LNA/Antenna diversity
-                 * enabled in the EEPROM.
-                 *
-                 * WLAN+BT cards which are in the supported card list
-                 * in ath_pci_id_table and the user has loaded the
-                 * driver with "bt_ant_diversity" set to true.
-                 */
-                if (ah->caps.hw_caps & ATH9K_HW_CAP_ANT_DIV_COMB) {
-                        /*
-                         * Change the default rx antenna if rx diversity
-                         * chooses the other antenna 3 times in a row.
-                         */
-                        if (sc->rx.defant != rs.rs_antenna) {
-                                if (++sc->rx.rxotherant >= 3)
-                                        ath_setdefantenna(sc, rs.rs_antenna);
-                        } else {
-                                sc->rx.rxotherant = 0;
-                        }
-
-                        if (pCap->hw_caps & ATH9K_HW_CAP_BT_ANT_DIV) {
-                                if (common->bt_ant_diversity)
-                                        ath_ant_comb_scan(sc, &rs);
-                        } else {
-                                ath_ant_comb_scan(sc, &rs);
-                        }
-                }
+                ath9k_antenna_check(sc, &rs);
 
                 ath9k_apply_ampdu_details(sc, &rs, rxs);
 
@@ -1387,7 +1473,7 @@ requeue:
                 if (edma) {
                         ath_rx_edma_buf_link(sc, qtype);
                 } else {
-                        ath_rx_buf_link(sc, bf);
+                        ath_rx_buf_relink(sc, bf);
                         ath9k_hw_rxena(ah);
                 }
         } while (1);
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index 5af97442ac37..a13b2d143d9e 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -893,9 +893,9 @@
 
 #define AR_SREV_9485(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9485))
-#define AR_SREV_9485_11(_ah) \
-        (AR_SREV_9485(_ah) && \
-         ((_ah)->hw_version.macRev == AR_SREV_REVISION_9485_11))
+#define AR_SREV_9485_11_OR_LATER(_ah) \
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9485) && \
+         ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9485_11))
 #define AR_SREV_9485_OR_LATER(_ah) \
         (((_ah)->hw_version.macVersion >= AR_SREV_VERSION_9485))
 
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index d8dfb3ec818a..35b515fe3ffa 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -312,12 +312,6 @@ static void ath_tx_addto_baw(struct ath_softc *sc, struct ath_atx_tid *tid,
         }
 }
 
-/*
- * TODO: For frame(s) that are in the retry state, we will reuse the
- * sequence number(s) without setting the retry bit. The
- * alternative is to give up on these and BAR the receiver's window
- * forward.
- */
 static void ath_tid_drain(struct ath_softc *sc, struct ath_txq *txq,
                           struct ath_atx_tid *tid)
 
@@ -341,14 +335,8 @@ static void ath_tid_drain(struct ath_softc *sc, struct ath_txq *txq,
                 }
 
                 list_add_tail(&bf->list, &bf_head);
-
-                ath_tx_update_baw(sc, tid, bf->bf_state.seqno);
                 ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0);
         }
-
-        tid->seq_next = tid->seq_start;
-        tid->baw_tail = tid->baw_head;
-        tid->bar_index = -1;
 }
 
 static void ath_tx_set_retry(struct ath_softc *sc, struct ath_txq *txq,
@@ -493,7 +481,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                 while (bf) {
                         bf_next = bf->bf_next;
 
-                        if (!bf->bf_stale || bf_next != NULL)
+                        if (!bf->bf_state.stale || bf_next != NULL)
                                 list_move_tail(&bf->list, &bf_head);
 
                         ath_tx_complete_buf(sc, bf, txq, &bf_head, ts, 0);
@@ -586,7 +574,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                  * not a holding desc.
                  */
                 INIT_LIST_HEAD(&bf_head);
-                if (bf_next != NULL || !bf_last->bf_stale)
+                if (bf_next != NULL || !bf_last->bf_state.stale)
                         list_move_tail(&bf->list, &bf_head);
 
                 if (!txpending) {
@@ -610,7 +598,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                                 ieee80211_sta_eosp(sta);
                         }
                         /* retry the un-acked ones */
-                        if (bf->bf_next == NULL && bf_last->bf_stale) {
+                        if (bf->bf_next == NULL && bf_last->bf_state.stale) {
                                 struct ath_buf *tbf;
 
                                 tbf = ath_clone_txbuf(sc, bf_last);
@@ -900,6 +888,8 @@ ath_tx_get_tid_subframe(struct ath_softc *sc, struct ath_txq *txq,
                 bf = fi->bf;
                 if (!fi->bf)
                         bf = ath_tx_setup_buffer(sc, txq, tid, skb);
+                else
+                        bf->bf_state.stale = false;
 
                 if (!bf) {
                         __skb_unlink(skb, *q);
@@ -1734,7 +1724,7 @@ static void ath_drain_txq_list(struct ath_softc *sc, struct ath_txq *txq,
         while (!list_empty(list)) {
                 bf = list_first_entry(list, struct ath_buf, list);
 
-                if (bf->bf_stale) {
+                if (bf->bf_state.stale) {
                         list_del(&bf->list);
 
                         ath_tx_return_buffer(sc, bf);
@@ -2490,7 +2480,7 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
                  * it with the STALE flag.
                  */
                 bf_held = NULL;
-                if (bf->bf_stale) {
+                if (bf->bf_state.stale) {
                         bf_held = bf;
                         if (list_is_last(&bf_held->list, &txq->axq_q))
                                 break;
@@ -2514,7 +2504,7 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
                  * however leave the last descriptor back as the holding
                  * descriptor for hw.
                  */
-                lastbf->bf_stale = true;
+                lastbf->bf_state.stale = true;
                 INIT_LIST_HEAD(&bf_head);
                 if (!list_is_singular(&lastbf->list))
                         list_cut_position(&bf_head,
@@ -2569,6 +2559,8 @@ void ath_tx_edma_tasklet(struct ath_softc *sc)
                 if (ts.qid == sc->beacon.beaconq) {
                         sc->beacon.tx_processed = true;
                         sc->beacon.tx_last = !(ts.ts_status & ATH9K_TXERR_MASK);
+
+                        ath9k_csa_is_finished(sc);
                         continue;
                 }
 
@@ -2585,7 +2577,7 @@ void ath_tx_edma_tasklet(struct ath_softc *sc)
                 }
 
                 bf = list_first_entry(fifo_list, struct ath_buf, list);
-                if (bf->bf_stale) {
+                if (bf->bf_state.stale) {
                         list_del(&bf->list);
                         ath_tx_return_buffer(sc, bf);
                         bf = list_first_entry(fifo_list, struct ath_buf, list);
@@ -2607,7 +2599,7 @@ void ath_tx_edma_tasklet(struct ath_softc *sc)
                                 ath_tx_txqaddbuf(sc, txq, &bf_q, true);
                         }
                 } else {
-                        lastbf->bf_stale = true;
+                        lastbf->bf_state.stale = true;
                         if (bf != lastbf)
                                 list_cut_position(&bf_head, fifo_list,
                                                   lastbf->list.prev);
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 4a33c6e39ca2..349fa22a921a 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -1860,7 +1860,8 @@ void *carl9170_alloc(size_t priv_size)
                      IEEE80211_HW_PS_NULLFUNC_STACK |
                      IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC |
                      IEEE80211_HW_SUPPORTS_RC_TABLE |
-                     IEEE80211_HW_SIGNAL_DBM;
+                     IEEE80211_HW_SIGNAL_DBM |
+                     IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
 
         if (!modparam_noht) {
                 /*
diff --git a/drivers/net/wireless/ath/carl9170/rx.c b/drivers/net/wireless/ath/carl9170/rx.c
index 4684dd989496..e935f61c7fad 100644
--- a/drivers/net/wireless/ath/carl9170/rx.c
+++ b/drivers/net/wireless/ath/carl9170/rx.c
@@ -602,8 +602,8 @@ static void carl9170_ba_check(struct ar9170 *ar, void *data, unsigned int len)
 
                 if (bar->start_seq_num == entry_bar->start_seq_num &&
                     TID_CHECK(bar->control, entry_bar->control) &&
-                    compare_ether_addr(bar->ra, entry_bar->ta) == 0 &&
-                    compare_ether_addr(bar->ta, entry_bar->ra) == 0) {
+                    ether_addr_equal(bar->ra, entry_bar->ta) &&
+                    ether_addr_equal(bar->ta, entry_bar->ra)) {
                         struct ieee80211_tx_info *tx_info;
 
                         tx_info = IEEE80211_SKB_CB(entry_skb);
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index ea1abeb18e5b..d505b2676a73 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -416,13 +416,13 @@ static struct sk_buff *wil_vring_reap_rx(struct wil6210_priv *wil,
          */
         if (d->dma.status & RX_DMA_STATUS_L4_IDENT) {
                 /* L4 protocol identified, csum calculated */
-                if ((d->dma.error & RX_DMA_ERROR_L4_ERR) == 0) {
+                if ((d->dma.error & RX_DMA_ERROR_L4_ERR) == 0)
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
-                } else {
-                        wil_err(wil, "Incorrect checksum reported\n");
-                        kfree_skb(skb);
-                        return NULL;
-                }
+                /* If HW reports bad checksum, let IP stack re-check it
+                 * For example, HW don't understand Microsoft IP stack that
+                 * mis-calculates TCP checksum - if it should be 0x0,
+                 * it writes 0xffff in violation of RFC 1624
+                 */
         }
 
         ds_bits = wil_rxdesc_ds_bits(d);
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
index 5220f158b8f5..063963ee422a 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.c
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -339,7 +339,7 @@ static void wmi_evt_rx_mgmt(struct wil6210_priv *wil, int id, void *d, int len)
                 }
         } else {
                 cfg80211_rx_mgmt(wil->wdev, freq, signal,
-                                 (void *)rx_mgmt_frame, d_len, GFP_KERNEL);
+                                 (void *)rx_mgmt_frame, d_len, 0, GFP_KERNEL);
         }
 }
 
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 0e933bb71543..ccd24f0acb8d 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -4645,6 +4645,19 @@ static void b43_wireless_core_exit(struct b43_wldev *dev)
         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_PSM_RUN,
                       B43_MACCTL_PSM_JMP0);
 
+        switch (dev->dev->bus_type) {
+#ifdef CONFIG_B43_BCMA
+        case B43_BUS_BCMA:
+                bcma_core_pci_down(dev->dev->bdev->bus);
+                break;
+#endif
+#ifdef CONFIG_B43_SSB
+        case B43_BUS_SSB:
+                /* TODO */
+                break;
+#endif
+        }
+
         b43_dma_free(dev);
         b43_pio_free(dev);
         b43_chip_exit(dev);
@@ -4684,6 +4697,7 @@ static int b43_wireless_core_init(struct b43_wldev *dev)
         case B43_BUS_BCMA:
                 bcma_core_pci_irq_ctl(&dev->dev->bdev->bus->drv_pci[0],
                                       dev->dev->bdev, true);
+                bcma_core_pci_up(dev->dev->bdev->bus);
                 break;
 #endif
 #ifdef CONFIG_B43_SSB
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
index e3f3c48f86d4..e13b1a65c65f 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
@@ -592,6 +592,7 @@ brcmf_sdcard_send_buf(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
                       uint flags, u8 *buf, uint nbytes)
 {
         struct sk_buff *mypkt;
+        struct sk_buff_head pktq;
         int err;
 
         mypkt = brcmu_pkt_buf_get_skb(nbytes);
@@ -602,7 +603,10 @@ brcmf_sdcard_send_buf(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
         }
 
         memcpy(mypkt->data, buf, nbytes);
-        err = brcmf_sdcard_send_pkt(sdiodev, addr, fn, flags, mypkt);
+        __skb_queue_head_init(&pktq);
+        __skb_queue_tail(&pktq, mypkt);
+        err = brcmf_sdcard_send_pkt(sdiodev, addr, fn, flags, &pktq);
+        __skb_dequeue_tail(&pktq);
 
         brcmu_pkt_buf_free_skb(mypkt);
         return err;
@@ -611,22 +615,18 @@ brcmf_sdcard_send_buf(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
 
 int
 brcmf_sdcard_send_pkt(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
-                      uint flags, struct sk_buff *pkt)
+                      uint flags, struct sk_buff_head *pktq)
 {
         uint width;
         int err = 0;
-        struct sk_buff_head pkt_list;
 
         brcmf_dbg(SDIO, "fun = %d, addr = 0x%x, size = %d\n",
-                  fn, addr, pkt->len);
+                  fn, addr, pktq->qlen);
 
         width = (flags & SDIO_REQ_4BYTE) ? 4 : 2;
         brcmf_sdio_addrprep(sdiodev, width, &addr);
 
-        skb_queue_head_init(&pkt_list);
-        skb_queue_tail(&pkt_list, pkt);
-        err = brcmf_sdio_buffrw(sdiodev, fn, true, addr, &pkt_list);
-        skb_dequeue_tail(&pkt_list);
+        err = brcmf_sdio_buffrw(sdiodev, fn, true, addr, pktq);
 
         return err;
 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
index 289e386f01f6..64f4a2bc8dde 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
@@ -350,7 +350,6 @@ static int brcmf_ops_sdio_probe(struct sdio_func *func,
 
         sdiodev->bus_if = bus_if;
         bus_if->bus_priv.sdio = sdiodev;
-        bus_if->align = BRCMF_SDALIGN;
         dev_set_drvdata(&func->dev, bus_if);
         dev_set_drvdata(&sdiodev->func[1]->dev, bus_if);
         sdiodev->dev = &sdiodev->func[1]->dev;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
index 86cbfe2c7c6c..2eb9e642c9bf 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
@@ -194,6 +194,8 @@
 #define BRCMF_E_IF_DEL                          2
 #define BRCMF_E_IF_CHANGE                       3
 
+#define BRCMF_E_IF_FLAG_NOIF                    1
+
 #define BRCMF_E_IF_ROLE_STA                     0
 #define BRCMF_E_IF_ROLE_AP                      1
 #define BRCMF_E_IF_ROLE_WDS                     2
@@ -209,6 +211,8 @@
 #define BRCMF_DCMD_MEDLEN       1536
 #define BRCMF_DCMD_MAXLEN       8192
 
+#define BRCMF_AMPDU_RX_REORDER_MAXFLOWS         256
+
 /* Pattern matching filter. Specifies an offset within received packets to
  * start matching, the pattern to match, the size of the pattern, and a bitmask
  * that indicates which bits within the pattern should be matched.
@@ -505,6 +509,25 @@ struct brcmf_dcmd {
         uint needed;            /* bytes needed (optional) */
 };
 
+/**
+ * struct brcmf_ampdu_rx_reorder - AMPDU receive reorder info
+ *
+ * @pktslots: dynamic allocated array for ordering AMPDU packets.
+ * @flow_id: AMPDU flow identifier.
+ * @cur_idx: last AMPDU index from firmware.
+ * @exp_idx: expected next AMPDU index.
+ * @max_idx: maximum amount of packets per AMPDU.
+ * @pend_pkts: number of packets currently in @pktslots.
+ */
+struct brcmf_ampdu_rx_reorder {
+        struct sk_buff **pktslots;
+        u8 flow_id;
+        u8 cur_idx;
+        u8 exp_idx;
+        u8 max_idx;
+        u8 pend_pkts;
+};
+
 /* Forward decls for struct brcmf_pub (see below) */
 struct brcmf_proto;     /* device communication protocol info */
 struct brcmf_cfg80211_dev; /* cfg80211 device info */
@@ -536,9 +559,10 @@ struct brcmf_pub {
 
         struct brcmf_fweh_info fweh;
 
-        bool fw_signals;
         struct brcmf_fws_info *fws;
-        spinlock_t fws_spinlock;
+
+        struct brcmf_ampdu_rx_reorder
+                *reorder_flows[BRCMF_AMPDU_RX_REORDER_MAXFLOWS];
 #ifdef DEBUG
         struct dentry *dbgfs_dir;
 #endif
@@ -604,6 +628,9 @@ struct brcmf_if {
         wait_queue_head_t pend_8021x_wait;
 };
 
+struct brcmf_skb_reorder_data {
+        u8 *reorder;
+};
 
 extern int brcmf_netdev_wait_pend8021x(struct net_device *ndev);
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
index 080395f49fa5..f7c1985844e4 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
@@ -36,7 +36,11 @@ struct brcmf_bus_dcmd {
  *
  * @init: prepare for communication with dongle.
  * @stop: clear pending frames, disable data flow.
- * @txdata: send a data frame to the dongle (callee disposes skb).
+ * @txdata: send a data frame to the dongle. When the data
+ *      has been transferred, the common driver must be
+ *      notified using brcmf_txcomplete(). The common
+ *      driver calls this function with interrupts
+ *      disabled.
  * @txctl: transmit a control request message to dongle.
  * @rxctl: receive a control response message from dongle.
  * @gettxq: obtain a reference of bus transmit queue (optional).
@@ -65,7 +69,6 @@ struct brcmf_bus_ops {
  * @maxctl: maximum size for rxctl request message.
  * @tx_realloc: number of tx packets realloced for headroom.
  * @dstats: dongle-based statistical data.
- * @align: alignment requirement for the bus.
  * @dcmd_list: bus/device specific dongle initialization commands.
  * @chip: device identifier of the dongle chip.
  * @chiprev: revision of the dongle chip.
@@ -80,7 +83,6 @@ struct brcmf_bus {
         enum brcmf_bus_state state;
         uint maxctl;
         unsigned long tx_realloc;
-        u8 align;
         u32 chip;
         u32 chiprev;
         struct list_head dcmd_list;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index 80099016d21f..e067aec1fbf1 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -38,6 +38,19 @@ MODULE_LICENSE("Dual BSD/GPL");
 
 #define MAX_WAIT_FOR_8021X_TX           50      /* msecs */
 
+/* AMPDU rx reordering definitions */
+#define BRCMF_RXREORDER_FLOWID_OFFSET           0
+#define BRCMF_RXREORDER_MAXIDX_OFFSET           2
+#define BRCMF_RXREORDER_FLAGS_OFFSET            4
+#define BRCMF_RXREORDER_CURIDX_OFFSET           6
+#define BRCMF_RXREORDER_EXPIDX_OFFSET           8
+
+#define BRCMF_RXREORDER_DEL_FLOW                0x01
+#define BRCMF_RXREORDER_FLUSH_ALL               0x02
+#define BRCMF_RXREORDER_CURIDX_VALID            0x04
+#define BRCMF_RXREORDER_EXPIDX_VALID            0x08
+#define BRCMF_RXREORDER_NEW_HOLE                0x10
+
 /* Error bits */
 int brcmf_msg_level;
 module_param_named(debug, brcmf_msg_level, int, S_IRUSR | S_IWUSR);
@@ -265,17 +278,234 @@ void brcmf_txflowblock(struct device *dev, bool state)
 {
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_pub *drvr = bus_if->drvr;
-        int i;
 
         brcmf_dbg(TRACE, "Enter\n");
 
-        if (brcmf_fws_fc_active(drvr->fws)) {
-                brcmf_fws_bus_blocked(drvr, state);
+        brcmf_fws_bus_blocked(drvr, state);
+}
+
+static void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb)
+{
+        skb->dev = ifp->ndev;
+        skb->protocol = eth_type_trans(skb, skb->dev);
+
+        if (skb->pkt_type == PACKET_MULTICAST)
+                ifp->stats.multicast++;
+
+        /* Process special event packets */
+        brcmf_fweh_process_skb(ifp->drvr, skb);
+
+        if (!(ifp->ndev->flags & IFF_UP)) {
+                brcmu_pkt_buf_free_skb(skb);
+                return;
+        }
+
+        ifp->stats.rx_bytes += skb->len;
+        ifp->stats.rx_packets++;
+
+        brcmf_dbg(DATA, "rx proto=0x%X\n", ntohs(skb->protocol));
+        if (in_interrupt())
+                netif_rx(skb);
+        else
+                /* If the receive is not processed inside an ISR,
+                 * the softirqd must be woken explicitly to service
+                 * the NET_RX_SOFTIRQ.  This is handled by netif_rx_ni().
+                 */
+                netif_rx_ni(skb);
+}
+
+static void brcmf_rxreorder_get_skb_list(struct brcmf_ampdu_rx_reorder *rfi,
+                                         u8 start, u8 end,
+                                         struct sk_buff_head *skb_list)
+{
+        /* initialize return list */
+        __skb_queue_head_init(skb_list);
+
+        if (rfi->pend_pkts == 0) {
+                brcmf_dbg(INFO, "no packets in reorder queue\n");
+                return;
+        }
+
+        do {
+                if (rfi->pktslots[start]) {
+                        __skb_queue_tail(skb_list, rfi->pktslots[start]);
+                        rfi->pktslots[start] = NULL;
+                }
+                start++;
+                if (start > rfi->max_idx)
+                        start = 0;
+        } while (start != end);
+        rfi->pend_pkts -= skb_queue_len(skb_list);
+}
+
+static void brcmf_rxreorder_process_info(struct brcmf_if *ifp, u8 *reorder_data,
+                                         struct sk_buff *pkt)
+{
+        u8 flow_id, max_idx, cur_idx, exp_idx, end_idx;
+        struct brcmf_ampdu_rx_reorder *rfi;
+        struct sk_buff_head reorder_list;
+        struct sk_buff *pnext;
+        u8 flags;
+        u32 buf_size;
+
+        flow_id = reorder_data[BRCMF_RXREORDER_FLOWID_OFFSET];
+        flags = reorder_data[BRCMF_RXREORDER_FLAGS_OFFSET];
+
+        /* validate flags and flow id */
+        if (flags == 0xFF) {
+                brcmf_err("invalid flags...so ignore this packet\n");
+                brcmf_netif_rx(ifp, pkt);
+                return;
+        }
+
+        rfi = ifp->drvr->reorder_flows[flow_id];
+        if (flags & BRCMF_RXREORDER_DEL_FLOW) {
+                brcmf_dbg(INFO, "flow-%d: delete\n",
+                          flow_id);
+
+                if (rfi == NULL) {
+                        brcmf_dbg(INFO, "received flags to cleanup, but no flow (%d) yet\n",
+                                  flow_id);
+                        brcmf_netif_rx(ifp, pkt);
+                        return;
+                }
+
+                brcmf_rxreorder_get_skb_list(rfi, rfi->exp_idx, rfi->exp_idx,
+                                             &reorder_list);
+                /* add the last packet */
+                __skb_queue_tail(&reorder_list, pkt);
+                kfree(rfi);
+                ifp->drvr->reorder_flows[flow_id] = NULL;
+                goto netif_rx;
+        }
+        /* from here on we need a flow reorder instance */
+        if (rfi == NULL) {
+                buf_size = sizeof(*rfi);
+                max_idx = reorder_data[BRCMF_RXREORDER_MAXIDX_OFFSET];
+
+                buf_size += (max_idx + 1) * sizeof(pkt);
+
+                /* allocate space for flow reorder info */
+                brcmf_dbg(INFO, "flow-%d: start, maxidx %d\n",
+                          flow_id, max_idx);
+                rfi = kzalloc(buf_size, GFP_ATOMIC);
+                if (rfi == NULL) {
+                        brcmf_err("failed to alloc buffer\n");
+                        brcmf_netif_rx(ifp, pkt);
+                        return;
+                }
+
+                ifp->drvr->reorder_flows[flow_id] = rfi;
+                rfi->pktslots = (struct sk_buff **)(rfi+1);
+                rfi->max_idx = max_idx;
+        }
+        if (flags & BRCMF_RXREORDER_NEW_HOLE)  {
+                if (rfi->pend_pkts) {
+                        brcmf_rxreorder_get_skb_list(rfi, rfi->exp_idx,
+                                                     rfi->exp_idx,
+                                                     &reorder_list);
+                        WARN_ON(rfi->pend_pkts);
+                } else {
+                        __skb_queue_head_init(&reorder_list);
+                }
+                rfi->cur_idx = reorder_data[BRCMF_RXREORDER_CURIDX_OFFSET];
+                rfi->exp_idx = reorder_data[BRCMF_RXREORDER_EXPIDX_OFFSET];
+                rfi->max_idx = reorder_data[BRCMF_RXREORDER_MAXIDX_OFFSET];
+                rfi->pktslots[rfi->cur_idx] = pkt;
+                rfi->pend_pkts++;
+                brcmf_dbg(DATA, "flow-%d: new hole %d (%d), pending %d\n",
+                          flow_id, rfi->cur_idx, rfi->exp_idx, rfi->pend_pkts);
+        } else if (flags & BRCMF_RXREORDER_CURIDX_VALID) {
+                cur_idx = reorder_data[BRCMF_RXREORDER_CURIDX_OFFSET];
+                exp_idx = reorder_data[BRCMF_RXREORDER_EXPIDX_OFFSET];
+
+                if ((exp_idx == rfi->exp_idx) && (cur_idx != rfi->exp_idx)) {
+                        /* still in the current hole */
+                        /* enqueue the current on the buffer chain */
+                        if (rfi->pktslots[cur_idx] != NULL) {
+                                brcmf_dbg(INFO, "HOLE: ERROR buffer pending..free it\n");
+                                brcmu_pkt_buf_free_skb(rfi->pktslots[cur_idx]);
+                                rfi->pktslots[cur_idx] = NULL;
+                        }
+                        rfi->pktslots[cur_idx] = pkt;
+                        rfi->pend_pkts++;
+                        rfi->cur_idx = cur_idx;
+                        brcmf_dbg(DATA, "flow-%d: store pkt %d (%d), pending %d\n",
+                                  flow_id, cur_idx, exp_idx, rfi->pend_pkts);
+
+                        /* can return now as there is no reorder
+                         * list to process.
+                         */
+                        return;
+                }
+                if (rfi->exp_idx == cur_idx) {
+                        if (rfi->pktslots[cur_idx] != NULL) {
+                                brcmf_dbg(INFO, "error buffer pending..free it\n");
+                                brcmu_pkt_buf_free_skb(rfi->pktslots[cur_idx]);
+                                rfi->pktslots[cur_idx] = NULL;
+                        }
+                        rfi->pktslots[cur_idx] = pkt;
+                        rfi->pend_pkts++;
+
+                        /* got the expected one. flush from current to expected
+                         * and update expected
+                         */
+                        brcmf_dbg(DATA, "flow-%d: expected %d (%d), pending %d\n",
+                                  flow_id, cur_idx, exp_idx, rfi->pend_pkts);
+
+                        rfi->cur_idx = cur_idx;
+                        rfi->exp_idx = exp_idx;
+
+                        brcmf_rxreorder_get_skb_list(rfi, cur_idx, exp_idx,
+                                                     &reorder_list);
+                        brcmf_dbg(DATA, "flow-%d: freeing buffers %d, pending %d\n",
+                                  flow_id, skb_queue_len(&reorder_list),
+                                  rfi->pend_pkts);
+                } else {
+                        u8 end_idx;
+
+                        brcmf_dbg(DATA, "flow-%d (0x%x): both moved, old %d/%d, new %d/%d\n",
+                                  flow_id, flags, rfi->cur_idx, rfi->exp_idx,
+                                  cur_idx, exp_idx);
+                        if (flags & BRCMF_RXREORDER_FLUSH_ALL)
+                                end_idx = rfi->exp_idx;
+                        else
+                                end_idx = exp_idx;
+
+                        /* flush pkts first */
+                        brcmf_rxreorder_get_skb_list(rfi, rfi->exp_idx, end_idx,
+                                                     &reorder_list);
+
+                        if (exp_idx == ((cur_idx + 1) % (rfi->max_idx + 1))) {
+                                __skb_queue_tail(&reorder_list, pkt);
+                        } else {
+                                rfi->pktslots[cur_idx] = pkt;
+                                rfi->pend_pkts++;
+                        }
+                        rfi->exp_idx = exp_idx;
+                        rfi->cur_idx = cur_idx;
+                }
         } else {
-                for (i = 0; i < BRCMF_MAX_IFS; i++)
-                        brcmf_txflowblock_if(drvr->iflist[i],
-                                             BRCMF_NETIF_STOP_REASON_BLOCK_BUS,
-                                             state);
+                /* explicity window move updating the expected index */
+                exp_idx = reorder_data[BRCMF_RXREORDER_EXPIDX_OFFSET];
+
+                brcmf_dbg(DATA, "flow-%d (0x%x): change expected: %d -> %d\n",
+                          flow_id, flags, rfi->exp_idx, exp_idx);
+                if (flags & BRCMF_RXREORDER_FLUSH_ALL)
+                        end_idx =  rfi->exp_idx;
+                else
+                        end_idx =  exp_idx;
+
+                brcmf_rxreorder_get_skb_list(rfi, rfi->exp_idx, end_idx,
+                                             &reorder_list);
+                __skb_queue_tail(&reorder_list, pkt);
+                /* set the new expected idx */
+                rfi->exp_idx = exp_idx;
+        }
+netif_rx:
+        skb_queue_walk_safe(&reorder_list, pkt, pnext) {
+                __skb_unlink(pkt, &reorder_list);
+                brcmf_netif_rx(ifp, pkt);
         }
 }
 
@@ -285,16 +515,18 @@ void brcmf_rx_frames(struct device *dev, struct sk_buff_head *skb_list)
         struct brcmf_if *ifp;
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_pub *drvr = bus_if->drvr;
+        struct brcmf_skb_reorder_data *rd;
         u8 ifidx;
         int ret;
 
-        brcmf_dbg(DATA, "Enter\n");
+        brcmf_dbg(DATA, "Enter: %s: count=%u\n", dev_name(dev),
+                  skb_queue_len(skb_list));
 
         skb_queue_walk_safe(skb_list, skb, pnext) {
                 skb_unlink(skb, skb_list);
 
                 /* process and remove protocol-specific header */
-                ret = brcmf_proto_hdrpull(drvr, drvr->fw_signals, &ifidx, skb);
+                ret = brcmf_proto_hdrpull(drvr, true, &ifidx, skb);
                 ifp = drvr->iflist[ifidx];
 
                 if (ret || !ifp || !ifp->ndev) {
@@ -304,31 +536,11 @@ void brcmf_rx_frames(struct device *dev, struct sk_buff_head *skb_list)
                         continue;
                 }
 
-                skb->dev = ifp->ndev;
-                skb->protocol = eth_type_trans(skb, skb->dev);
-
-                if (skb->pkt_type == PACKET_MULTICAST)
-                        ifp->stats.multicast++;
-
-                /* Process special event packets */
-                brcmf_fweh_process_skb(drvr, skb);
-
-                if (!(ifp->ndev->flags & IFF_UP)) {
-                        brcmu_pkt_buf_free_skb(skb);
-                        continue;
-                }
-
-                ifp->stats.rx_bytes += skb->len;
-                ifp->stats.rx_packets++;
-
-                if (in_interrupt())
-                        netif_rx(skb);
+                rd = (struct brcmf_skb_reorder_data *)skb->cb;
+                if (rd->reorder)
+                        brcmf_rxreorder_process_info(ifp, rd->reorder, skb);
                 else
-                        /* If the receive is not processed inside an ISR,
-                         * the softirqd must be woken explicitly to service the
-                         * NET_RX_SOFTIRQ. This is handled by netif_rx_ni().
-                         */
-                        netif_rx_ni(skb);
+                        brcmf_netif_rx(ifp, skb);
         }
 }
 
@@ -889,7 +1101,6 @@ int brcmf_bus_start(struct device *dev)
         if (ret < 0)
                 goto fail;
 
-        drvr->fw_signals = true;
         ret = brcmf_fws_init(drvr);
         if (ret < 0)
                 goto fail;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index 264111968320..1aa75d5951b8 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -201,13 +201,6 @@ struct rte_console {
 #define SFC_CRC4WOOS    (1 << 2)        /* CRC error for write out of sync */
 #define SFC_ABORTALL    (1 << 3)        /* Abort all in-progress frames */
 
-/* HW frame tag */
-#define SDPCM_FRAMETAG_LEN      4       /* 2 bytes len, 2 bytes check val */
-
-/* Total length of frame header for dongle protocol */
-#define SDPCM_HDRLEN    (SDPCM_FRAMETAG_LEN + SDPCM_SWHEADER_LEN)
-#define SDPCM_RESERVE   (SDPCM_HDRLEN + BRCMF_SDALIGN)
-
 /*
  * Software allocation of To SB Mailbox resources
  */
@@ -250,38 +243,6 @@ struct rte_console {
 /* Current protocol version */
 #define SDPCM_PROT_VERSION      4
 
-/* SW frame header */
-#define SDPCM_PACKET_SEQUENCE(p)        (((u8 *)p)[0] & 0xff)
-
-#define SDPCM_CHANNEL_MASK              0x00000f00
-#define SDPCM_CHANNEL_SHIFT             8
-#define SDPCM_PACKET_CHANNEL(p)         (((u8 *)p)[1] & 0x0f)
-
-#define SDPCM_NEXTLEN_OFFSET            2
-
-/* Data Offset from SOF (HW Tag, SW Tag, Pad) */
-#define SDPCM_DOFFSET_OFFSET            3       /* Data Offset */
-#define SDPCM_DOFFSET_VALUE(p)          (((u8 *)p)[SDPCM_DOFFSET_OFFSET] & 0xff)
-#define SDPCM_DOFFSET_MASK              0xff000000
-#define SDPCM_DOFFSET_SHIFT             24
-#define SDPCM_FCMASK_OFFSET             4       /* Flow control */
-#define SDPCM_FCMASK_VALUE(p)           (((u8 *)p)[SDPCM_FCMASK_OFFSET] & 0xff)
-#define SDPCM_WINDOW_OFFSET             5       /* Credit based fc */
-#define SDPCM_WINDOW_VALUE(p)           (((u8 *)p)[SDPCM_WINDOW_OFFSET] & 0xff)
-
-#define SDPCM_SWHEADER_LEN      8       /* SW header is 64 bits */
-
-/* logical channel numbers */
-#define SDPCM_CONTROL_CHANNEL   0       /* Control channel Id */
-#define SDPCM_EVENT_CHANNEL     1       /* Asyc Event Indication Channel Id */
-#define SDPCM_DATA_CHANNEL      2       /* Data Xmit/Recv Channel Id */
-#define SDPCM_GLOM_CHANNEL      3       /* For coalesced packets */
-#define SDPCM_TEST_CHANNEL      15      /* Reserved for test/debug packets */
-
-#define SDPCM_SEQUENCE_WRAP     256     /* wrap-around val for 8bit frame seq */
-
-#define SDPCM_GLOMDESC(p)       (((u8 *)p)[1] & 0x80)
-
 /*
  * Shared structure between dongle and the host.
  * The structure contains pointers to trap or assert information.
@@ -396,8 +357,8 @@ struct sdpcm_shared_le {
         __le32 brpt_addr;
 };
 
-/* SDIO read frame info */
-struct brcmf_sdio_read {
+/* dongle SDIO bus specific header info */
+struct brcmf_sdio_hdrinfo {
         u8 seq_num;
         u8 channel;
         u16 len;
@@ -431,7 +392,7 @@ struct brcmf_sdio {
         u8 hdrbuf[MAX_HDR_READ + BRCMF_SDALIGN];
         u8 *rxhdr;              /* Header of current rx frame (in hdrbuf) */
         u8 rx_seq;              /* Receive sequence number (expected) */
-        struct brcmf_sdio_read cur_read;
+        struct brcmf_sdio_hdrinfo cur_read;
                                 /* info of current read frame */
         bool rxskip;            /* Skip receive (awaiting NAK ACK) */
         bool rxpending;         /* Data frame pending in dongle */
@@ -500,6 +461,8 @@ struct brcmf_sdio {
         struct brcmf_sdio_count sdcnt;
         bool sr_enabled; /* SaveRestore enabled */
         bool sleeping; /* SDIO bus sleeping */
+
+        u8 tx_hdrlen;           /* sdio bus header length for tx packet */
 };
 
 /* clkstate */
@@ -510,7 +473,6 @@ struct brcmf_sdio {
 
 #ifdef DEBUG
 static int qcount[NUMPRIO];
-static int tx_packets[NUMPRIO];
 #endif                          /* DEBUG */
 
 #define DEFAULT_SDIO_DRIVE_STRENGTH     6       /* in milliamps */
@@ -1043,18 +1005,63 @@ static void brcmf_sdbrcm_free_glom(struct brcmf_sdio *bus)
         }
 }
 
-static int brcmf_sdio_hdparser(struct brcmf_sdio *bus, u8 *header,
-                               struct brcmf_sdio_read *rd,
-                               enum brcmf_sdio_frmtype type)
+/**
+ * brcmfmac sdio bus specific header
+ * This is the lowest layer header wrapped on the packets transmitted between
+ * host and WiFi dongle which contains information needed for SDIO core and
+ * firmware
+ *
+ * It consists of 2 parts: hw header and software header
+ * hardware header (frame tag) - 4 bytes
+ * Byte 0~1: Frame length
+ * Byte 2~3: Checksum, bit-wise inverse of frame length
+ * software header - 8 bytes
+ * Byte 0: Rx/Tx sequence number
+ * Byte 1: 4 MSB Channel number, 4 LSB arbitrary flag
+ * Byte 2: Length of next data frame, reserved for Tx
+ * Byte 3: Data offset
+ * Byte 4: Flow control bits, reserved for Tx
+ * Byte 5: Maximum Sequence number allowed by firmware for Tx, N/A for Tx packet
+ * Byte 6~7: Reserved
+ */
+#define SDPCM_HWHDR_LEN                 4
+#define SDPCM_SWHDR_LEN                 8
+#define SDPCM_HDRLEN                    (SDPCM_HWHDR_LEN + SDPCM_SWHDR_LEN)
+/* software header */
+#define SDPCM_SEQ_MASK                  0x000000ff
+#define SDPCM_SEQ_WRAP                  256
+#define SDPCM_CHANNEL_MASK              0x00000f00
+#define SDPCM_CHANNEL_SHIFT             8
+#define SDPCM_CONTROL_CHANNEL           0       /* Control */
+#define SDPCM_EVENT_CHANNEL             1       /* Asyc Event Indication */
+#define SDPCM_DATA_CHANNEL              2       /* Data Xmit/Recv */
+#define SDPCM_GLOM_CHANNEL              3       /* Coalesced packets */
+#define SDPCM_TEST_CHANNEL              15      /* Test/debug packets */
+#define SDPCM_GLOMDESC(p)               (((u8 *)p)[1] & 0x80)
+#define SDPCM_NEXTLEN_MASK              0x00ff0000
+#define SDPCM_NEXTLEN_SHIFT             16
+#define SDPCM_DOFFSET_MASK              0xff000000
+#define SDPCM_DOFFSET_SHIFT             24
+#define SDPCM_FCMASK_MASK               0x000000ff
+#define SDPCM_WINDOW_MASK               0x0000ff00
+#define SDPCM_WINDOW_SHIFT              8
+
+static inline u8 brcmf_sdio_getdatoffset(u8 *swheader)
+{
+        u32 hdrvalue;
+        hdrvalue = *(u32 *)swheader;
+        return (u8)((hdrvalue & SDPCM_DOFFSET_MASK) >> SDPCM_DOFFSET_SHIFT);
+}
+
+static int brcmf_sdio_hdparse(struct brcmf_sdio *bus, u8 *header,
+                              struct brcmf_sdio_hdrinfo *rd,
+                              enum brcmf_sdio_frmtype type)
 {
         u16 len, checksum;
         u8 rx_seq, fc, tx_seq_max;
+        u32 swheader;
 
-        /*
-         * 4 bytes hardware header (frame tag)
-         * Byte 0~1: Frame length
-         * Byte 2~3: Checksum, bit-wise inverse of frame length
-         */
+        /* hw header */
         len = get_unaligned_le16(header);
         checksum = get_unaligned_le16(header + sizeof(u16));
         /* All zero means no more to read */
@@ -1083,24 +1090,16 @@ static int brcmf_sdio_hdparser(struct brcmf_sdio *bus, u8 *header,
         }
         rd->len = len;
 
-        /*
-         * 8 bytes hardware header
-         * Byte 0: Rx sequence number
-         * Byte 1: 4 MSB Channel number, 4 LSB arbitrary flag
-         * Byte 2: Length of next data frame
-         * Byte 3: Data offset
-         * Byte 4: Flow control bits
-         * Byte 5: Maximum Sequence number allow for Tx
-         * Byte 6~7: Reserved
-         */
-        if (type == BRCMF_SDIO_FT_SUPER &&
-            SDPCM_GLOMDESC(&header[SDPCM_FRAMETAG_LEN])) {
+        /* software header */
+        header += SDPCM_HWHDR_LEN;
+        swheader = le32_to_cpu(*(__le32 *)header);
+        if (type == BRCMF_SDIO_FT_SUPER && SDPCM_GLOMDESC(header)) {
                 brcmf_err("Glom descriptor found in superframe head\n");
                 rd->len = 0;
                 return -EINVAL;
         }
-        rx_seq = SDPCM_PACKET_SEQUENCE(&header[SDPCM_FRAMETAG_LEN]);
-        rd->channel = SDPCM_PACKET_CHANNEL(&header[SDPCM_FRAMETAG_LEN]);
+        rx_seq = (u8)(swheader & SDPCM_SEQ_MASK);
+        rd->channel = (swheader & SDPCM_CHANNEL_MASK) >> SDPCM_CHANNEL_SHIFT;
         if (len > MAX_RX_DATASZ && rd->channel != SDPCM_CONTROL_CHANNEL &&
             type != BRCMF_SDIO_FT_SUPER) {
                 brcmf_err("HW header length too long\n");
@@ -1120,7 +1119,7 @@ static int brcmf_sdio_hdparser(struct brcmf_sdio *bus, u8 *header,
                 rd->len = 0;
                 return -EINVAL;
         }
-        rd->dat_offset = SDPCM_DOFFSET_VALUE(&header[SDPCM_FRAMETAG_LEN]);
+        rd->dat_offset = brcmf_sdio_getdatoffset(header);
         if (rd->dat_offset < SDPCM_HDRLEN || rd->dat_offset > rd->len) {
                 brcmf_err("seq %d: bad data offset\n", rx_seq);
                 bus->sdcnt.rx_badhdr++;
@@ -1137,14 +1136,15 @@ static int brcmf_sdio_hdparser(struct brcmf_sdio *bus, u8 *header,
         /* no need to check the reset for subframe */
         if (type == BRCMF_SDIO_FT_SUB)
                 return 0;
-        rd->len_nxtfrm = header[SDPCM_FRAMETAG_LEN + SDPCM_NEXTLEN_OFFSET];
+        rd->len_nxtfrm = (swheader & SDPCM_NEXTLEN_MASK) >> SDPCM_NEXTLEN_SHIFT;
         if (rd->len_nxtfrm << 4 > MAX_RX_DATASZ) {
                 /* only warm for NON glom packet */
                 if (rd->channel != SDPCM_GLOM_CHANNEL)
                         brcmf_err("seq %d: next length error\n", rx_seq);
                 rd->len_nxtfrm = 0;
         }
-        fc = SDPCM_FCMASK_VALUE(&header[SDPCM_FRAMETAG_LEN]);
+        swheader = le32_to_cpu(*(__le32 *)(header + 4));
+        fc = swheader & SDPCM_FCMASK_MASK;
         if (bus->flowcontrol != fc) {
                 if (~bus->flowcontrol & fc)
                         bus->sdcnt.fc_xoff++;
@@ -1153,7 +1153,7 @@ static int brcmf_sdio_hdparser(struct brcmf_sdio *bus, u8 *header,
                 bus->sdcnt.fc_rcvd++;
                 bus->flowcontrol = fc;
         }
-        tx_seq_max = SDPCM_WINDOW_VALUE(&header[SDPCM_FRAMETAG_LEN]);
+        tx_seq_max = (swheader & SDPCM_WINDOW_MASK) >> SDPCM_WINDOW_SHIFT;
         if ((u8)(tx_seq_max - bus->tx_seq) > 0x40) {
                 brcmf_err("seq %d: max tx seq number error\n", rx_seq);
                 tx_seq_max = bus->tx_seq + 2;
@@ -1163,18 +1163,40 @@ static int brcmf_sdio_hdparser(struct brcmf_sdio *bus, u8 *header,
         return 0;
 }
 
+static inline void brcmf_sdio_update_hwhdr(u8 *header, u16 frm_length)
+{
+        *(__le16 *)header = cpu_to_le16(frm_length);
+        *(((__le16 *)header) + 1) = cpu_to_le16(~frm_length);
+}
+
+static void brcmf_sdio_hdpack(struct brcmf_sdio *bus, u8 *header,
+                              struct brcmf_sdio_hdrinfo *hd_info)
+{
+        u32 sw_header;
+
+        brcmf_sdio_update_hwhdr(header, hd_info->len);
+
+        sw_header = bus->tx_seq;
+        sw_header |= (hd_info->channel << SDPCM_CHANNEL_SHIFT) &
+                     SDPCM_CHANNEL_MASK;
+        sw_header |= (hd_info->dat_offset << SDPCM_DOFFSET_SHIFT) &
+                     SDPCM_DOFFSET_MASK;
+        *(((__le32 *)header) + 1) = cpu_to_le32(sw_header);
+        *(((__le32 *)header) + 2) = 0;
+}
+
 static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
 {
         u16 dlen, totlen;
         u8 *dptr, num = 0;
-
+        u32 align = 0;
         u16 sublen;
         struct sk_buff *pfirst, *pnext;
 
         int errcode;
         u8 doff, sfdoff;
 
-        struct brcmf_sdio_read rd_new;
+        struct brcmf_sdio_hdrinfo rd_new;
 
         /* If packets, issue read(s) and send up packet chain */
         /* Return sequence numbers consumed? */
@@ -1182,6 +1204,11 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
         brcmf_dbg(SDIO, "start: glomd %p glom %p\n",
                   bus->glomd, skb_peek(&bus->glom));
 
+        if (bus->sdiodev->pdata)
+                align = bus->sdiodev->pdata->sd_sgentry_align;
+        if (align < 4)
+                align = 4;
+
         /* If there's a descriptor, generate the packet chain */
         if (bus->glomd) {
                 pfirst = pnext = NULL;
@@ -1205,9 +1232,9 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                                 pnext = NULL;
                                 break;
                         }
-                        if (sublen % BRCMF_SDALIGN) {
+                        if (sublen % align) {
                                 brcmf_err("sublen %d not multiple of %d\n",
-                                          sublen, BRCMF_SDALIGN);
+                                          sublen, align);
                         }
                         totlen += sublen;
 
@@ -1220,7 +1247,7 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                         }
 
                         /* Allocate/chain packet for next subframe */
-                        pnext = brcmu_pkt_buf_get_skb(sublen + BRCMF_SDALIGN);
+                        pnext = brcmu_pkt_buf_get_skb(sublen + align);
                         if (pnext == NULL) {
                                 brcmf_err("bcm_pkt_buf_get_skb failed, num %d len %d\n",
                                           num, sublen);
@@ -1229,7 +1256,7 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                         skb_queue_tail(&bus->glom, pnext);
 
                         /* Adhere to start alignment requirements */
-                        pkt_align(pnext, sublen, BRCMF_SDALIGN);
+                        pkt_align(pnext, sublen, align);
                 }
 
                 /* If all allocations succeeded, save packet chain
@@ -1305,8 +1332,8 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                 rd_new.seq_num = rxseq;
                 rd_new.len = dlen;
                 sdio_claim_host(bus->sdiodev->func[1]);
-                errcode = brcmf_sdio_hdparser(bus, pfirst->data, &rd_new,
-                                              BRCMF_SDIO_FT_SUPER);
+                errcode = brcmf_sdio_hdparse(bus, pfirst->data, &rd_new,
+                                             BRCMF_SDIO_FT_SUPER);
                 sdio_release_host(bus->sdiodev->func[1]);
                 bus->cur_read.len = rd_new.len_nxtfrm << 4;
 
@@ -1324,8 +1351,8 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                         rd_new.len = pnext->len;
                         rd_new.seq_num = rxseq++;
                         sdio_claim_host(bus->sdiodev->func[1]);
-                        errcode = brcmf_sdio_hdparser(bus, pnext->data, &rd_new,
-                                                      BRCMF_SDIO_FT_SUB);
+                        errcode = brcmf_sdio_hdparse(bus, pnext->data, &rd_new,
+                                                     BRCMF_SDIO_FT_SUB);
                         sdio_release_host(bus->sdiodev->func[1]);
                         brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
                                            pnext->data, 32, "subframe:\n");
@@ -1357,7 +1384,7 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                 skb_queue_walk_safe(&bus->glom, pfirst, pnext) {
                         dptr = (u8 *) (pfirst->data);
                         sublen = get_unaligned_le16(dptr);
-                        doff = SDPCM_DOFFSET_VALUE(&dptr[SDPCM_FRAMETAG_LEN]);
+                        doff = brcmf_sdio_getdatoffset(&dptr[SDPCM_HWHDR_LEN]);
 
                         brcmf_dbg_hex_dump(BRCMF_BYTES_ON() && BRCMF_DATA_ON(),
                                            dptr, pfirst->len,
@@ -1535,7 +1562,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
         uint rxleft = 0;        /* Remaining number of frames allowed */
         int ret;                /* Return code from calls */
         uint rxcount = 0;       /* Total frames read */
-        struct brcmf_sdio_read *rd = &bus->cur_read, rd_new;
+        struct brcmf_sdio_hdrinfo *rd = &bus->cur_read, rd_new;
         u8 head_read = 0;
 
         brcmf_dbg(TRACE, "Enter\n");
@@ -1583,8 +1610,8 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
                                            bus->rxhdr, SDPCM_HDRLEN,
                                            "RxHdr:\n");
 
-                        if (brcmf_sdio_hdparser(bus, bus->rxhdr, rd,
-                                                BRCMF_SDIO_FT_NORMAL)) {
+                        if (brcmf_sdio_hdparse(bus, bus->rxhdr, rd,
+                                               BRCMF_SDIO_FT_NORMAL)) {
                                 sdio_release_host(bus->sdiodev->func[1]);
                                 if (!bus->rxpending)
                                         break;
@@ -1648,8 +1675,8 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
                         memcpy(bus->rxhdr, pkt->data, SDPCM_HDRLEN);
                         rd_new.seq_num = rd->seq_num;
                         sdio_claim_host(bus->sdiodev->func[1]);
-                        if (brcmf_sdio_hdparser(bus, bus->rxhdr, &rd_new,
-                                                BRCMF_SDIO_FT_NORMAL)) {
+                        if (brcmf_sdio_hdparse(bus, bus->rxhdr, &rd_new,
+                                               BRCMF_SDIO_FT_NORMAL)) {
                                 rd->len = 0;
                                 brcmu_pkt_buf_free_skb(pkt);
                         }
@@ -1693,7 +1720,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
 
                 /* Save superframe descriptor and allocate packet frame */
                 if (rd->channel == SDPCM_GLOM_CHANNEL) {
-                        if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_FRAMETAG_LEN])) {
+                        if (SDPCM_GLOMDESC(&bus->rxhdr[SDPCM_HWHDR_LEN])) {
                                 brcmf_dbg(GLOM, "glom descriptor, %d bytes:\n",
                                           rd->len);
                                 brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
@@ -1759,85 +1786,168 @@ brcmf_sdbrcm_wait_event_wakeup(struct brcmf_sdio *bus)
         return;
 }
 
+/* flag marking a dummy skb added for DMA alignment requirement */
+#define DUMMY_SKB_FLAG          0x10000
+/* bit mask of data length chopped from the previous packet */
+#define DUMMY_SKB_CHOP_LEN_MASK 0xffff
+/**
+ * brcmf_sdio_txpkt_prep - packet preparation for transmit
+ * @bus: brcmf_sdio structure pointer
+ * @pktq: packet list pointer
+ * @chan: virtual channel to transmit the packet
+ *
+ * Processes to be applied to the packet
+ *      - Align data buffer pointer
+ *      - Align data buffer length
+ *      - Prepare header
+ * Return: negative value if there is error
+ */
+static int
+brcmf_sdio_txpkt_prep(struct brcmf_sdio *bus, struct sk_buff_head *pktq,
+                      uint chan)
+{
+        u16 head_pad, tail_pad, tail_chop, head_align, sg_align;
+        int ntail;
+        struct sk_buff *pkt_next, *pkt_new;
+        u8 *dat_buf;
+        unsigned blksize = bus->sdiodev->func[SDIO_FUNC_2]->cur_blksize;
+        struct brcmf_sdio_hdrinfo hd_info = {0};
+
+        /* SDIO ADMA requires at least 32 bit alignment */
+        head_align = 4;
+        sg_align = 4;
+        if (bus->sdiodev->pdata) {
+                head_align = bus->sdiodev->pdata->sd_head_align > 4 ?
+                             bus->sdiodev->pdata->sd_head_align : 4;
+                sg_align = bus->sdiodev->pdata->sd_sgentry_align > 4 ?
+                           bus->sdiodev->pdata->sd_sgentry_align : 4;
+        }
+        /* sg entry alignment should be a divisor of block size */
+        WARN_ON(blksize % sg_align);
+
+        pkt_next = pktq->next;
+        dat_buf = (u8 *)(pkt_next->data);
+
+        /* Check head padding */
+        head_pad = ((unsigned long)dat_buf % head_align);
+        if (head_pad) {
+                if (skb_headroom(pkt_next) < head_pad) {
+                        bus->sdiodev->bus_if->tx_realloc++;
+                        head_pad = 0;
+                        if (skb_cow(pkt_next, head_pad))
+                                return -ENOMEM;
+                }
+                skb_push(pkt_next, head_pad);
+                dat_buf = (u8 *)(pkt_next->data);
+                memset(dat_buf, 0, head_pad + bus->tx_hdrlen);
+        }
+
+        /* Check tail padding */
+        pkt_new = NULL;
+        tail_chop = pkt_next->len % sg_align;
+        tail_pad = sg_align - tail_chop;
+        tail_pad += blksize - (pkt_next->len + tail_pad) % blksize;
+        if (skb_tailroom(pkt_next) < tail_pad && pkt_next->len > blksize) {
+                pkt_new = brcmu_pkt_buf_get_skb(tail_pad + tail_chop);
+                if (pkt_new == NULL)
+                        return -ENOMEM;
+                memcpy(pkt_new->data,
+                       pkt_next->data + pkt_next->len - tail_chop,
+                       tail_chop);
+                *(u32 *)(pkt_new->cb) = DUMMY_SKB_FLAG + tail_chop;
+                skb_trim(pkt_next, pkt_next->len - tail_chop);
+                __skb_queue_after(pktq, pkt_next, pkt_new);
+        } else {
+                ntail = pkt_next->data_len + tail_pad -
+                        (pkt_next->end - pkt_next->tail);
+                if (skb_cloned(pkt_next) || ntail > 0)
+                        if (pskb_expand_head(pkt_next, 0, ntail, GFP_ATOMIC))
+                                return -ENOMEM;
+                if (skb_linearize(pkt_next))
+                        return -ENOMEM;
+                dat_buf = (u8 *)(pkt_next->data);
+                __skb_put(pkt_next, tail_pad);
+        }
+
+        /* Now prep the header */
+        if (pkt_new)
+                hd_info.len = pkt_next->len + tail_chop;
+        else
+                hd_info.len = pkt_next->len - tail_pad;
+        hd_info.channel = chan;
+        hd_info.dat_offset = head_pad + bus->tx_hdrlen;
+        brcmf_sdio_hdpack(bus, dat_buf, &hd_info);
+
+        if (BRCMF_BYTES_ON() &&
+            ((BRCMF_CTL_ON() && chan == SDPCM_CONTROL_CHANNEL) ||
+             (BRCMF_DATA_ON() && chan != SDPCM_CONTROL_CHANNEL)))
+                brcmf_dbg_hex_dump(true, pkt_next, hd_info.len, "Tx Frame:\n");
+        else if (BRCMF_HDRS_ON())
+                brcmf_dbg_hex_dump(true, pkt_next, head_pad + bus->tx_hdrlen,
+                                   "Tx Header:\n");
+
+        return 0;
+}
+
+/**
+ * brcmf_sdio_txpkt_postp - packet post processing for transmit
+ * @bus: brcmf_sdio structure pointer
+ * @pktq: packet list pointer
+ *
+ * Processes to be applied to the packet
+ *      - Remove head padding
+ *      - Remove tail padding
+ */
+static void
+brcmf_sdio_txpkt_postp(struct brcmf_sdio *bus, struct sk_buff_head *pktq)
+{
+        u8 *hdr;
+        u32 dat_offset;
+        u32 dummy_flags, chop_len;
+        struct sk_buff *pkt_next, *tmp, *pkt_prev;
+
+        skb_queue_walk_safe(pktq, pkt_next, tmp) {
+                dummy_flags = *(u32 *)(pkt_next->cb);
+                if (dummy_flags & DUMMY_SKB_FLAG) {
+                        chop_len = dummy_flags & DUMMY_SKB_CHOP_LEN_MASK;
+                        if (chop_len) {
+                                pkt_prev = pkt_next->prev;
+                                memcpy(pkt_prev->data + pkt_prev->len,
+                                       pkt_next->data, chop_len);
+                                skb_put(pkt_prev, chop_len);
+                        }
+                        __skb_unlink(pkt_next, pktq);
+                        brcmu_pkt_buf_free_skb(pkt_next);
+                } else {
+                        hdr = pkt_next->data + SDPCM_HWHDR_LEN;
+                        dat_offset = le32_to_cpu(*(__le32 *)hdr);
+                        dat_offset = (dat_offset & SDPCM_DOFFSET_MASK) >>
+                                     SDPCM_DOFFSET_SHIFT;
+                        skb_pull(pkt_next, dat_offset);
+                }
+        }
+}
+
 /* Writes a HW/SW header into the packet and sends it. */
 /* Assumes: (a) header space already there, (b) caller holds lock */
 static int brcmf_sdbrcm_txpkt(struct brcmf_sdio *bus, struct sk_buff *pkt,
                               uint chan)
 {
         int ret;
-        u8 *frame;
-        u16 len, pad = 0;
-        u32 swheader;
         int i;
+        struct sk_buff_head localq;
 
         brcmf_dbg(TRACE, "Enter\n");
 
-        frame = (u8 *) (pkt->data);
-
-        /* Add alignment padding, allocate new packet if needed */
-        pad = ((unsigned long)frame % BRCMF_SDALIGN);
-        if (pad) {
-                if (skb_headroom(pkt) < pad) {
-                        brcmf_dbg(INFO, "insufficient headroom %d for %d pad\n",
-                                  skb_headroom(pkt), pad);
-                        bus->sdiodev->bus_if->tx_realloc++;
-                        ret = skb_cow(pkt, BRCMF_SDALIGN);
-                        if (ret)
-                                goto done;
-                        pad = ((unsigned long)frame % BRCMF_SDALIGN);
-                }
-                skb_push(pkt, pad);
-                frame = (u8 *) (pkt->data);
-                memset(frame, 0, pad + SDPCM_HDRLEN);
-        }
-        /* precondition: pad < BRCMF_SDALIGN */
-
-        /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
-        len = (u16) (pkt->len);
-        *(__le16 *) frame = cpu_to_le16(len);
-        *(((__le16 *) frame) + 1) = cpu_to_le16(~len);
-
-        /* Software tag: channel, sequence number, data offset */
-        swheader =
-            ((chan << SDPCM_CHANNEL_SHIFT) & SDPCM_CHANNEL_MASK) | bus->tx_seq |
-            (((pad +
-               SDPCM_HDRLEN) << SDPCM_DOFFSET_SHIFT) & SDPCM_DOFFSET_MASK);
-
-        *(((__le32 *) frame) + 1) = cpu_to_le32(swheader);
-        *(((__le32 *) frame) + 2) = 0;
-
-#ifdef DEBUG
-        tx_packets[pkt->priority]++;
-#endif
-
-        brcmf_dbg_hex_dump(BRCMF_BYTES_ON() &&
-                           ((BRCMF_CTL_ON() && chan == SDPCM_CONTROL_CHANNEL) ||
-                            (BRCMF_DATA_ON() && chan != SDPCM_CONTROL_CHANNEL)),
-                           frame, len, "Tx Frame:\n");
-        brcmf_dbg_hex_dump(!(BRCMF_BYTES_ON() &&
-                             ((BRCMF_CTL_ON() &&
-                               chan == SDPCM_CONTROL_CHANNEL) ||
-                              (BRCMF_DATA_ON() &&
-                               chan != SDPCM_CONTROL_CHANNEL))) &&
-                           BRCMF_HDRS_ON(),
-                           frame, min_t(u16, len, 16), "TxHdr:\n");
-
-        /* Raise len to next SDIO block to eliminate tail command */
-        if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
-                u16 pad = bus->blocksize - (len % bus->blocksize);
-                if ((pad <= bus->roundup) && (pad < bus->blocksize))
-                                len += pad;
-        } else if (len % BRCMF_SDALIGN) {
-                len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
-        }
-
-        /* Some controllers have trouble with odd bytes -- round to even */
-        if (len & (ALIGNMENT - 1))
-                        len = roundup(len, ALIGNMENT);
+        __skb_queue_head_init(&localq);
+        __skb_queue_tail(&localq, pkt);
+        ret = brcmf_sdio_txpkt_prep(bus, &localq, chan);
+        if (ret)
+                goto done;
 
         sdio_claim_host(bus->sdiodev->func[1]);
         ret = brcmf_sdcard_send_pkt(bus->sdiodev, bus->sdiodev->sbwad,
-                                    SDIO_FUNC_2, F2SYNC, pkt);
+                                    SDIO_FUNC_2, F2SYNC, &localq);
         bus->sdcnt.f2txdata++;
 
         if (ret < 0) {
@@ -1865,11 +1975,11 @@ static int brcmf_sdbrcm_txpkt(struct brcmf_sdio *bus, struct sk_buff *pkt,
         }
         sdio_release_host(bus->sdiodev->func[1]);
         if (ret == 0)
-                bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
+                bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQ_WRAP;
 
 done:
-        /* restore pkt buffer pointer before calling tx complete routine */
-        skb_pull(pkt, SDPCM_HDRLEN + pad);
+        brcmf_sdio_txpkt_postp(bus, &localq);
+        __skb_dequeue_tail(&localq);
         brcmf_txcomplete(bus->sdiodev->dev, pkt, ret == 0);
         return ret;
 }
@@ -1880,7 +1990,6 @@ static uint brcmf_sdbrcm_sendfromq(struct brcmf_sdio *bus, uint maxframes)
         u32 intstatus = 0;
         int ret = 0, prec_out;
         uint cnt = 0;
-        uint datalen;
         u8 tx_prec_map;
 
         brcmf_dbg(TRACE, "Enter\n");
@@ -1896,7 +2005,6 @@ static uint brcmf_sdbrcm_sendfromq(struct brcmf_sdio *bus, uint maxframes)
                         break;
                 }
                 spin_unlock_bh(&bus->txqlock);
-                datalen = pkt->len - SDPCM_HDRLEN;
 
                 ret = brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_DATA_CHANNEL);
 
@@ -2221,7 +2329,7 @@ static void brcmf_sdbrcm_dpc(struct brcmf_sdio *bus)
                         }
 
                 } else {
-                        bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
+                        bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQ_WRAP;
                 }
                 sdio_release_host(bus->sdiodev->func[1]);
                 bus->ctrl_frame_stat = false;
@@ -2276,13 +2384,14 @@ static int brcmf_sdbrcm_bus_txdata(struct device *dev, struct sk_buff *pkt)
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
         struct brcmf_sdio *bus = sdiodev->bus;
+        ulong flags;
 
         brcmf_dbg(TRACE, "Enter\n");
 
         datalen = pkt->len;
 
         /* Add space for the header */
-        skb_push(pkt, SDPCM_HDRLEN);
+        skb_push(pkt, bus->tx_hdrlen);
         /* precondition: IS_ALIGNED((unsigned long)(pkt->data), 2) */
 
         prec = prio2prec((pkt->priority & PRIOMASK));
@@ -2293,10 +2402,9 @@ static int brcmf_sdbrcm_bus_txdata(struct device *dev, struct sk_buff *pkt)
         bus->sdcnt.fcqueued++;
 
         /* Priority based enq */
-        spin_lock_bh(&bus->txqlock);
+        spin_lock_irqsave(&bus->txqlock, flags);
         if (!brcmf_c_prec_enq(bus->sdiodev->dev, &bus->txq, pkt, prec)) {
-                skb_pull(pkt, SDPCM_HDRLEN);
-                brcmf_txcomplete(bus->sdiodev->dev, pkt, false);
+                skb_pull(pkt, bus->tx_hdrlen);
                 brcmf_err("out of bus->txq !!!\n");
                 ret = -ENOSR;
         } else {
@@ -2307,7 +2415,7 @@ static int brcmf_sdbrcm_bus_txdata(struct device *dev, struct sk_buff *pkt)
                 bus->txoff = true;
                 brcmf_txflowblock(bus->sdiodev->dev, true);
         }
-        spin_unlock_bh(&bus->txqlock);
+        spin_unlock_irqrestore(&bus->txqlock, flags);
 
 #ifdef DEBUG
         if (pktq_plen(&bus->txq, prec) > qcount[prec])
@@ -2436,7 +2544,7 @@ static int brcmf_tx_frame(struct brcmf_sdio *bus, u8 *frame, u16 len)
                 return ret;
         }
 
-        bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQUENCE_WRAP;
+        bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQ_WRAP;
 
         return ret;
 }
@@ -2446,19 +2554,19 @@ brcmf_sdbrcm_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
 {
         u8 *frame;
         u16 len;
-        u32 swheader;
         uint retries = 0;
         u8 doff = 0;
         int ret = -1;
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
         struct brcmf_sdio *bus = sdiodev->bus;
+        struct brcmf_sdio_hdrinfo hd_info = {0};
 
         brcmf_dbg(TRACE, "Enter\n");
 
         /* Back the pointer to make a room for bus header */
-        frame = msg - SDPCM_HDRLEN;
-        len = (msglen += SDPCM_HDRLEN);
+        frame = msg - bus->tx_hdrlen;
+        len = (msglen += bus->tx_hdrlen);
 
         /* Add alignment padding (optional for ctl frames) */
         doff = ((unsigned long)frame % BRCMF_SDALIGN);
@@ -2466,10 +2574,10 @@ brcmf_sdbrcm_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
                 frame -= doff;
                 len += doff;
                 msglen += doff;
-                memset(frame, 0, doff + SDPCM_HDRLEN);
+                memset(frame, 0, doff + bus->tx_hdrlen);
         }
         /* precondition: doff < BRCMF_SDALIGN */
-        doff += SDPCM_HDRLEN;
+        doff += bus->tx_hdrlen;
 
         /* Round send length to next SDIO block */
         if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
@@ -2491,18 +2599,10 @@ brcmf_sdbrcm_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
         brcmf_sdbrcm_bus_sleep(bus, false, false);
         sdio_release_host(bus->sdiodev->func[1]);
 
-        /* Hardware tag: 2 byte len followed by 2 byte ~len check (all LE) */
-        *(__le16 *) frame = cpu_to_le16((u16) msglen);
-        *(((__le16 *) frame) + 1) = cpu_to_le16(~msglen);
-
-        /* Software tag: channel, sequence number, data offset */
-        swheader =
-            ((SDPCM_CONTROL_CHANNEL << SDPCM_CHANNEL_SHIFT) &
-             SDPCM_CHANNEL_MASK)
-            | bus->tx_seq | ((doff << SDPCM_DOFFSET_SHIFT) &
-                             SDPCM_DOFFSET_MASK);
-        put_unaligned_le32(swheader, frame + SDPCM_FRAMETAG_LEN);
-        put_unaligned_le32(0, frame + SDPCM_FRAMETAG_LEN + sizeof(swheader));
+        hd_info.len = (u16)msglen;
+        hd_info.channel = SDPCM_CONTROL_CHANNEL;
+        hd_info.dat_offset = doff;
+        brcmf_sdio_hdpack(bus, frame, &hd_info);
 
         if (!data_ok(bus)) {
                 brcmf_dbg(INFO, "No bus credit bus->tx_max %d, bus->tx_seq %d\n",
@@ -3733,7 +3833,7 @@ void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev)
         struct brcmf_sdio *bus;
         struct brcmf_bus_dcmd *dlst;
         u32 dngl_txglom;
-        u32 dngl_txglomalign;
+        u32 txglomalign = 0;
         u8 idx;
 
         brcmf_dbg(TRACE, "Enter\n");
@@ -3752,7 +3852,7 @@ void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev)
         bus->txbound = BRCMF_TXBOUND;
         bus->rxbound = BRCMF_RXBOUND;
         bus->txminmax = BRCMF_TXMINMAX;
-        bus->tx_seq = SDPCM_SEQUENCE_WRAP - 1;
+        bus->tx_seq = SDPCM_SEQ_WRAP - 1;
 
         INIT_WORK(&bus->datawork, brcmf_sdio_dataworker);
         bus->brcmf_wq = create_singlethread_workqueue("brcmf_wq");
@@ -3794,8 +3894,11 @@ void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev)
         bus->sdiodev->bus_if->chip = bus->ci->chip;
         bus->sdiodev->bus_if->chiprev = bus->ci->chiprev;
 
-        /* Attach to the brcmf/OS/network interface */
-        ret = brcmf_attach(SDPCM_RESERVE, bus->sdiodev->dev);
+        /* default sdio bus header length for tx packet */
+        bus->tx_hdrlen = SDPCM_HWHDR_LEN + SDPCM_SWHDR_LEN;
+
+        /* Attach to the common layer, reserve hdr space */
+        ret = brcmf_attach(bus->tx_hdrlen, bus->sdiodev->dev);
         if (ret != 0) {
                 brcmf_err("brcmf_attach failed\n");
                 goto fail;
@@ -3827,9 +3930,13 @@ void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev)
                         dlst->param_len = sizeof(u32);
                 } else {
                         /* otherwise, set txglomalign */
-                        dngl_txglomalign = bus->sdiodev->bus_if->align;
+                        if (sdiodev->pdata)
+                                txglomalign = sdiodev->pdata->sd_sgentry_align;
+                        /* SDIO ADMA requires at least 32 bit alignment */
+                        if (txglomalign < 4)
+                                txglomalign = 4;
                         dlst->name = "bus:txglomalign";
-                        dlst->param = (char *)&dngl_txglomalign;
+                        dlst->param = (char *)&txglomalign;
                         dlst->param_len = sizeof(u32);
                 }
                 list_add(&dlst->list, &bus->sdiodev->bus_if->dcmd_list);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
index 83ee53a7c76e..fad77dd2a3a5 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
@@ -185,6 +185,10 @@ static void brcmf_fweh_handle_if_event(struct brcmf_pub *drvr,
                   ifevent->action, ifevent->ifidx, ifevent->bssidx,
                   ifevent->flags, ifevent->role);
 
+        if (ifevent->flags & BRCMF_E_IF_FLAG_NOIF) {
+                brcmf_dbg(EVENT, "event can be ignored\n");
+                return;
+        }
         if (ifevent->ifidx >= BRCMF_MAX_IFS) {
                 brcmf_err("invalid interface index: %u\n",
                           ifevent->ifidx);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
index 665ef69e974b..ecabb04f33c3 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
@@ -69,4 +69,25 @@ struct brcmf_fil_bss_enable_le {
         __le32 enable;
 };
 
+/**
+ * struct tdls_iovar - common structure for tdls iovars.
+ *
+ * @ea: ether address of peer station.
+ * @mode: mode value depending on specific tdls iovar.
+ * @chanspec: channel specification.
+ * @pad: unused (for future use).
+ */
+struct brcmf_tdls_iovar_le {
+        u8 ea[ETH_ALEN];                /* Station address */
+        u8 mode;                        /* mode: depends on iovar */
+        __le16 chanspec;
+        __le32 pad;                     /* future */
+};
+
+enum brcmf_tdls_manual_ep_ops {
+        BRCMF_TDLS_MANUAL_EP_CREATE = 1,
+        BRCMF_TDLS_MANUAL_EP_DELETE = 3,
+        BRCMF_TDLS_MANUAL_EP_DISCOVERY = 6
+};
+
 #endif /* FWIL_TYPES_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
index 29b1f24c2d0f..82f9140f3d35 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
@@ -422,9 +422,12 @@ struct brcmf_fws_macdesc_table {
 
 struct brcmf_fws_info {
         struct brcmf_pub *drvr;
+        spinlock_t spinlock;
+        ulong flags;
         struct brcmf_fws_stats stats;
         struct brcmf_fws_hanger hanger;
         enum brcmf_fws_fcmode fcmode;
+        bool fw_signals;
         bool bcmc_credit_check;
         struct brcmf_fws_macdesc_table desc;
         struct workqueue_struct *fws_wq;
@@ -483,6 +486,18 @@ static int brcmf_fws_get_tlv_len(struct brcmf_fws_info *fws,
 }
 #undef BRCMF_FWS_TLV_DEF
 
+static void brcmf_fws_lock(struct brcmf_fws_info *fws)
+                __acquires(&fws->spinlock)
+{
+        spin_lock_irqsave(&fws->spinlock, fws->flags);
+}
+
+static void brcmf_fws_unlock(struct brcmf_fws_info *fws)
+                __releases(&fws->spinlock)
+{
+        spin_unlock_irqrestore(&fws->spinlock, fws->flags);
+}
+
 static bool brcmf_fws_ifidx_match(struct sk_buff *skb, void *arg)
 {
         u32 ifidx = brcmf_skb_if_flags_get_field(skb, INDEX);
@@ -869,8 +884,11 @@ static bool brcmf_fws_tim_update(struct brcmf_fws_info *fws,
                 skcb->state = BRCMF_FWS_SKBSTATE_TIM;
                 bus = fws->drvr->bus_if;
                 err = brcmf_fws_hdrpush(fws, skb);
-                if (err == 0)
+                if (err == 0) {
+                        brcmf_fws_unlock(fws);
                         err = brcmf_bus_txdata(bus, skb);
+                        brcmf_fws_lock(fws);
+                }
                 if (err)
                         brcmu_pkt_buf_free_skb(skb);
                 return true;
@@ -905,26 +923,10 @@ static int brcmf_fws_rssi_indicate(struct brcmf_fws_info *fws, s8 rssi)
         return 0;
 }
 
-/* using macro so sparse checking does not complain
- * about locking imbalance.
- */
-#define brcmf_fws_lock(drvr, flags)                             \
-do {                                                            \
-        flags = 0;                                              \
-        spin_lock_irqsave(&((drvr)->fws_spinlock), (flags));    \
-} while (0)
-
-/* using macro so sparse checking does not complain
- * about locking imbalance.
- */
-#define brcmf_fws_unlock(drvr, flags) \
-        spin_unlock_irqrestore(&((drvr)->fws_spinlock), (flags))
-
 static
 int brcmf_fws_macdesc_indicate(struct brcmf_fws_info *fws, u8 type, u8 *data)
 {
         struct brcmf_fws_mac_descriptor *entry, *existing;
-        ulong flags;
         u8 mac_handle;
         u8 ifidx;
         u8 *addr;
@@ -938,10 +940,10 @@ int brcmf_fws_macdesc_indicate(struct brcmf_fws_info *fws, u8 type, u8 *data)
                 if (entry->occupied) {
                         brcmf_dbg(TRACE, "deleting %s mac %pM\n",
                                   entry->name, addr);
-                        brcmf_fws_lock(fws->drvr, flags);
+                        brcmf_fws_lock(fws);
                         brcmf_fws_macdesc_cleanup(fws, entry, -1);
                         brcmf_fws_macdesc_deinit(entry);
-                        brcmf_fws_unlock(fws->drvr, flags);
+                        brcmf_fws_unlock(fws);
                 } else
                         fws->stats.mac_update_failed++;
                 return 0;
@@ -950,13 +952,13 @@ int brcmf_fws_macdesc_indicate(struct brcmf_fws_info *fws, u8 type, u8 *data)
         existing = brcmf_fws_macdesc_lookup(fws, addr);
         if (IS_ERR(existing)) {
                 if (!entry->occupied) {
-                        brcmf_fws_lock(fws->drvr, flags);
+                        brcmf_fws_lock(fws);
                         entry->mac_handle = mac_handle;
                         brcmf_fws_macdesc_init(entry, addr, ifidx);
                         brcmf_fws_macdesc_set_name(fws, entry);
                         brcmu_pktq_init(&entry->psq, BRCMF_FWS_PSQ_PREC_COUNT,
                                         BRCMF_FWS_PSQ_LEN);
-                        brcmf_fws_unlock(fws->drvr, flags);
+                        brcmf_fws_unlock(fws);
                         brcmf_dbg(TRACE, "add %s mac %pM\n", entry->name, addr);
                 } else {
                         fws->stats.mac_update_failed++;
@@ -964,13 +966,13 @@ int brcmf_fws_macdesc_indicate(struct brcmf_fws_info *fws, u8 type, u8 *data)
         } else {
                 if (entry != existing) {
                         brcmf_dbg(TRACE, "copy mac %s\n", existing->name);
-                        brcmf_fws_lock(fws->drvr, flags);
+                        brcmf_fws_lock(fws);
                         memcpy(entry, existing,
                                offsetof(struct brcmf_fws_mac_descriptor, psq));
                         entry->mac_handle = mac_handle;
                         brcmf_fws_macdesc_deinit(existing);
                         brcmf_fws_macdesc_set_name(fws, entry);
-                        brcmf_fws_unlock(fws->drvr, flags);
+                        brcmf_fws_unlock(fws);
                         brcmf_dbg(TRACE, "relocate %s mac %pM\n", entry->name,
                                   addr);
                 } else {
@@ -986,7 +988,6 @@ static int brcmf_fws_macdesc_state_indicate(struct brcmf_fws_info *fws,
                                             u8 type, u8 *data)
 {
         struct brcmf_fws_mac_descriptor *entry;
-        ulong flags;
         u8 mac_handle;
         int ret;
 
@@ -996,7 +997,7 @@ static int brcmf_fws_macdesc_state_indicate(struct brcmf_fws_info *fws,
                 fws->stats.mac_ps_update_failed++;
                 return -ESRCH;
         }
-        brcmf_fws_lock(fws->drvr, flags);
+        brcmf_fws_lock(fws);
         /* a state update should wipe old credits */
         entry->requested_credit = 0;
         entry->requested_packet = 0;
@@ -1011,7 +1012,7 @@ static int brcmf_fws_macdesc_state_indicate(struct brcmf_fws_info *fws,
                 brcmf_fws_tim_update(fws, entry, BRCMF_FWS_FIFO_AC_VO, true);
                 ret = BRCMF_FWS_RET_OK_NOSCHEDULE;
         }
-        brcmf_fws_unlock(fws->drvr, flags);
+        brcmf_fws_unlock(fws);
         return ret;
 }
 
@@ -1019,7 +1020,6 @@ static int brcmf_fws_interface_state_indicate(struct brcmf_fws_info *fws,
                                               u8 type, u8 *data)
 {
         struct brcmf_fws_mac_descriptor *entry;
-        ulong flags;
         u8 ifidx;
         int ret;
 
@@ -1038,7 +1038,7 @@ static int brcmf_fws_interface_state_indicate(struct brcmf_fws_info *fws,
 
         brcmf_dbg(TRACE, "%s (%d): %s\n", brcmf_fws_get_tlv_name(type), type,
                   entry->name);
-        brcmf_fws_lock(fws->drvr, flags);
+        brcmf_fws_lock(fws);
         switch (type) {
         case BRCMF_FWS_TYPE_INTERFACE_OPEN:
                 entry->state = BRCMF_FWS_STATE_OPEN;
@@ -1050,10 +1050,10 @@ static int brcmf_fws_interface_state_indicate(struct brcmf_fws_info *fws,
                 break;
         default:
                 ret = -EINVAL;
-                brcmf_fws_unlock(fws->drvr, flags);
+                brcmf_fws_unlock(fws);
                 goto fail;
         }
-        brcmf_fws_unlock(fws->drvr, flags);
+        brcmf_fws_unlock(fws);
         return ret;
 
 fail:
@@ -1065,7 +1065,6 @@ static int brcmf_fws_request_indicate(struct brcmf_fws_info *fws, u8 type,
                                       u8 *data)
 {
         struct brcmf_fws_mac_descriptor *entry;
-        ulong flags;
 
         entry = &fws->desc.nodes[data[1] & 0x1F];
         if (!entry->occupied) {
@@ -1079,14 +1078,14 @@ static int brcmf_fws_request_indicate(struct brcmf_fws_info *fws, u8 type,
         brcmf_dbg(TRACE, "%s (%d): %s cnt %d bmp %d\n",
                   brcmf_fws_get_tlv_name(type), type, entry->name,
                   data[0], data[2]);
-        brcmf_fws_lock(fws->drvr, flags);
+        brcmf_fws_lock(fws);
         if (type == BRCMF_FWS_TYPE_MAC_REQUEST_CREDIT)
                 entry->requested_credit = data[0];
         else
                 entry->requested_packet = data[0];
 
         entry->ac_bitmap = data[2];
-        brcmf_fws_unlock(fws->drvr, flags);
+        brcmf_fws_unlock(fws);
         return BRCMF_FWS_RET_OK_SCHEDULE;
 }
 
@@ -1160,7 +1159,8 @@ static void brcmf_fws_return_credits(struct brcmf_fws_info *fws,
 static void brcmf_fws_schedule_deq(struct brcmf_fws_info *fws)
 {
         /* only schedule dequeue when there are credits for delayed traffic */
-        if (fws->fifo_credit_map & fws->fifo_delay_map)
+        if ((fws->fifo_credit_map & fws->fifo_delay_map) ||
+            (!brcmf_fws_fc_active(fws) && fws->fifo_delay_map))
                 queue_work(fws->fws_wq, &fws->fws_dequeue_work);
 }
 
@@ -1383,7 +1383,6 @@ brcmf_fws_txs_process(struct brcmf_fws_info *fws, u8 flags, u32 hslot,
 static int brcmf_fws_fifocreditback_indicate(struct brcmf_fws_info *fws,
                                              u8 *data)
 {
-        ulong flags;
         int i;
 
         if (fws->fcmode != BRCMF_FWS_FCMODE_EXPLICIT_CREDIT) {
@@ -1392,19 +1391,18 @@ static int brcmf_fws_fifocreditback_indicate(struct brcmf_fws_info *fws,
         }
 
         brcmf_dbg(DATA, "enter: data %pM\n", data);
-        brcmf_fws_lock(fws->drvr, flags);
+        brcmf_fws_lock(fws);
         for (i = 0; i < BRCMF_FWS_FIFO_COUNT; i++)
                 brcmf_fws_return_credits(fws, i, data[i]);
 
         brcmf_dbg(DATA, "map: credit %x delay %x\n", fws->fifo_credit_map,
                   fws->fifo_delay_map);
-        brcmf_fws_unlock(fws->drvr, flags);
+        brcmf_fws_unlock(fws);
         return BRCMF_FWS_RET_OK_SCHEDULE;
 }
 
 static int brcmf_fws_txstatus_indicate(struct brcmf_fws_info *fws, u8 *data)
 {
-        ulong lflags;
         __le32 status_le;
         u32 status;
         u32 hslot;
@@ -1418,9 +1416,9 @@ static int brcmf_fws_txstatus_indicate(struct brcmf_fws_info *fws, u8 *data)
         hslot = brcmf_txstatus_get_field(status, HSLOT);
         genbit = brcmf_txstatus_get_field(status, GENERATION);
 
-        brcmf_fws_lock(fws->drvr, lflags);
+        brcmf_fws_lock(fws);
         brcmf_fws_txs_process(fws, flags, hslot, genbit);
-        brcmf_fws_unlock(fws->drvr, lflags);
+        brcmf_fws_unlock(fws);
         return BRCMF_FWS_RET_OK_NOSCHEDULE;
 }
 
@@ -1440,7 +1438,6 @@ static int brcmf_fws_notify_credit_map(struct brcmf_if *ifp,
 {
         struct brcmf_fws_info *fws = ifp->drvr->fws;
         int i;
-        ulong flags;
         u8 *credits = data;
 
         if (e->datalen < BRCMF_FWS_FIFO_COUNT) {
@@ -1453,7 +1450,7 @@ static int brcmf_fws_notify_credit_map(struct brcmf_if *ifp,
         fws->creditmap_received = true;
 
         brcmf_dbg(TRACE, "enter: credits %pM\n", credits);
-        brcmf_fws_lock(ifp->drvr, flags);
+        brcmf_fws_lock(fws);
         for (i = 0; i < ARRAY_SIZE(fws->fifo_credit); i++) {
                 if (*credits)
                         fws->fifo_credit_map |= 1 << i;
@@ -1462,7 +1459,7 @@ static int brcmf_fws_notify_credit_map(struct brcmf_if *ifp,
                 fws->fifo_credit[i] = *credits++;
         }
         brcmf_fws_schedule_deq(fws);
-        brcmf_fws_unlock(ifp->drvr, flags);
+        brcmf_fws_unlock(fws);
         return 0;
 }
 
@@ -1471,18 +1468,18 @@ static int brcmf_fws_notify_bcmc_credit_support(struct brcmf_if *ifp,
                                                 void *data)
 {
         struct brcmf_fws_info *fws = ifp->drvr->fws;
-        ulong flags;
 
-        brcmf_fws_lock(ifp->drvr, flags);
+        brcmf_fws_lock(fws);
         if (fws)
                 fws->bcmc_credit_check = true;
-        brcmf_fws_unlock(ifp->drvr, flags);
+        brcmf_fws_unlock(fws);
         return 0;
 }
 
 int brcmf_fws_hdrpull(struct brcmf_pub *drvr, int ifidx, s16 signal_len,
                       struct sk_buff *skb)
 {
+        struct brcmf_skb_reorder_data *rd;
         struct brcmf_fws_info *fws = drvr->fws;
         u8 *signal_data;
         s16 data_len;
@@ -1497,8 +1494,10 @@ int brcmf_fws_hdrpull(struct brcmf_pub *drvr, int ifidx, s16 signal_len,
 
         WARN_ON(signal_len > skb->len);
 
+        if (!signal_len)
+                return 0;
         /* if flow control disabled, skip to packet data and leave */
-        if (!signal_len || !drvr->fw_signals) {
+        if (!fws->fw_signals) {
                 skb_pull(skb, signal_len);
                 return 0;
         }
@@ -1536,9 +1535,12 @@ int brcmf_fws_hdrpull(struct brcmf_pub *drvr, int ifidx, s16 signal_len,
 
                 err = BRCMF_FWS_RET_OK_NOSCHEDULE;
                 switch (type) {
-                case BRCMF_FWS_TYPE_HOST_REORDER_RXPKTS:
                 case BRCMF_FWS_TYPE_COMP_TXSTATUS:
                         break;
+                case BRCMF_FWS_TYPE_HOST_REORDER_RXPKTS:
+                        rd = (struct brcmf_skb_reorder_data *)skb->cb;
+                        rd->reorder = data;
+                        break;
                 case BRCMF_FWS_TYPE_MACDESC_ADD:
                 case BRCMF_FWS_TYPE_MACDESC_DEL:
                         brcmf_fws_macdesc_indicate(fws, type, data);
@@ -1694,17 +1696,22 @@ static int brcmf_fws_commit_skb(struct brcmf_fws_info *fws, int fifo,
                 return PTR_ERR(entry);
 
         brcmf_fws_precommit_skb(fws, fifo, skb);
+        entry->transit_count++;
+        if (entry->suppressed)
+                entry->suppr_transit_count++;
+        brcmf_fws_unlock(fws);
         rc = brcmf_bus_txdata(bus, skb);
+        brcmf_fws_lock(fws);
         brcmf_dbg(DATA, "%s flags %X htod %X bus_tx %d\n", entry->name,
                   skcb->if_flags, skcb->htod, rc);
         if (rc < 0) {
+                entry->transit_count--;
+                if (entry->suppressed)
+                        entry->suppr_transit_count--;
                 brcmf_proto_hdrpull(fws->drvr, false, &ifidx, skb);
                 goto rollback;
         }
 
-        entry->transit_count++;
-        if (entry->suppressed)
-                entry->suppr_transit_count++;
         fws->stats.pkt2bus++;
         fws->stats.send_pkts[fifo]++;
         if (brcmf_skb_if_flags_get_field(skb, REQUESTED))
@@ -1741,11 +1748,11 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
         struct brcmf_fws_info *fws = drvr->fws;
         struct brcmf_skbuff_cb *skcb = brcmf_skbcb(skb);
         struct ethhdr *eh = (struct ethhdr *)(skb->data);
-        ulong flags;
         int fifo = BRCMF_FWS_FIFO_BCMC;
         bool multicast = is_multicast_ether_addr(eh->h_dest);
         bool pae = eh->h_proto == htons(ETH_P_PAE);
 
+        brcmf_dbg(DATA, "tx proto=0x%X\n", ntohs(eh->h_proto));
         /* determine the priority */
         if (!skb->priority)
                 skb->priority = cfg80211_classify8021d(skb);
@@ -1754,14 +1761,6 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
         if (pae)
                 atomic_inc(&ifp->pend_8021x_cnt);
 
-        if (!brcmf_fws_fc_active(fws)) {
-                /* If the protocol uses a data header, apply it */
-                brcmf_proto_hdrpush(drvr, ifp->ifidx, 0, skb);
-
-                /* Use bus module to send data frame */
-                return brcmf_bus_txdata(drvr->bus_if, skb);
-        }
-
         /* set control buffer information */
         skcb->if_flags = 0;
         skcb->state = BRCMF_FWS_SKBSTATE_NEW;
@@ -1769,7 +1768,7 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
         if (!multicast)
                 fifo = brcmf_fws_prio2fifo[skb->priority];
 
-        brcmf_fws_lock(drvr, flags);
+        brcmf_fws_lock(fws);
         if (fifo != BRCMF_FWS_FIFO_AC_BE && fifo < BRCMF_FWS_FIFO_BCMC)
                 fws->borrow_defer_timestamp = jiffies +
                                               BRCMF_FWS_BORROW_DEFER_PERIOD;
@@ -1789,7 +1788,7 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
                 }
                 brcmu_pkt_buf_free_skb(skb);
         }
-        brcmf_fws_unlock(drvr, flags);
+        brcmf_fws_unlock(fws);
         return 0;
 }
 
@@ -1809,7 +1808,7 @@ void brcmf_fws_add_interface(struct brcmf_if *ifp)
         struct brcmf_fws_info *fws = ifp->drvr->fws;
         struct brcmf_fws_mac_descriptor *entry;
 
-        if (!ifp->ndev || !ifp->drvr->fw_signals)
+        if (!ifp->ndev)
                 return;
 
         entry = &fws->desc.iface[ifp->ifidx];
@@ -1824,31 +1823,54 @@ void brcmf_fws_add_interface(struct brcmf_if *ifp)
 void brcmf_fws_del_interface(struct brcmf_if *ifp)
 {
         struct brcmf_fws_mac_descriptor *entry = ifp->fws_desc;
-        ulong flags;
 
         if (!entry)
                 return;
 
-        brcmf_fws_lock(ifp->drvr, flags);
+        brcmf_fws_lock(ifp->drvr->fws);
         ifp->fws_desc = NULL;
         brcmf_dbg(TRACE, "deleting %s\n", entry->name);
         brcmf_fws_macdesc_deinit(entry);
         brcmf_fws_cleanup(ifp->drvr->fws, ifp->ifidx);
-        brcmf_fws_unlock(ifp->drvr, flags);
+        brcmf_fws_unlock(ifp->drvr->fws);
 }
 
 static void brcmf_fws_dequeue_worker(struct work_struct *worker)
 {
         struct brcmf_fws_info *fws;
+        struct brcmf_pub *drvr;
         struct sk_buff *skb;
-        ulong flags;
         int fifo;
+        u32 hslot;
+        u32 ifidx;
+        int ret;
 
         fws = container_of(worker, struct brcmf_fws_info, fws_dequeue_work);
+        drvr = fws->drvr;
 
-        brcmf_fws_lock(fws->drvr, flags);
+        brcmf_fws_lock(fws);
         for (fifo = BRCMF_FWS_FIFO_BCMC; fifo >= 0 && !fws->bus_flow_blocked;
              fifo--) {
+                if (!brcmf_fws_fc_active(fws)) {
+                        while ((skb = brcmf_fws_deq(fws, fifo)) != NULL) {
+                                hslot = brcmf_skb_htod_tag_get_field(skb,
+                                                                     HSLOT);
+                                brcmf_fws_hanger_poppkt(&fws->hanger, hslot,
+                                                        &skb, true);
+                                ifidx = brcmf_skb_if_flags_get_field(skb,
+                                                                     INDEX);
+                                brcmf_proto_hdrpush(drvr, ifidx, 0, skb);
+                                /* Use bus module to send data frame */
+                                brcmf_fws_unlock(fws);
+                                ret = brcmf_bus_txdata(drvr->bus_if, skb);
+                                brcmf_fws_lock(fws);
+                                if (ret < 0)
+                                        brcmf_txfinalize(drvr, skb, false);
+                                if (fws->bus_flow_blocked)
+                                        break;
+                        }
+                        continue;
+                }
                 while ((fws->fifo_credit[fifo]) || ((!fws->bcmc_credit_check) &&
                        (fifo == BRCMF_FWS_FIFO_BCMC))) {
                         skb = brcmf_fws_deq(fws, fifo);
@@ -1876,42 +1898,43 @@ static void brcmf_fws_dequeue_worker(struct work_struct *worker)
                         }
                 }
         }
-        brcmf_fws_unlock(fws->drvr, flags);
+        brcmf_fws_unlock(fws);
 }
 
 int brcmf_fws_init(struct brcmf_pub *drvr)
 {
+        struct brcmf_fws_info *fws;
         u32 tlv = BRCMF_FWS_FLAGS_RSSI_SIGNALS;
         int rc;
 
-        if (!drvr->fw_signals)
-                return 0;
-
-        spin_lock_init(&drvr->fws_spinlock);
-
         drvr->fws = kzalloc(sizeof(*(drvr->fws)), GFP_KERNEL);
         if (!drvr->fws) {
                 rc = -ENOMEM;
                 goto fail;
         }
 
+        fws = drvr->fws;
+
+        spin_lock_init(&fws->spinlock);
+
         /* set linkage back */
-        drvr->fws->drvr = drvr;
-        drvr->fws->fcmode = fcmode;
+        fws->drvr = drvr;
+        fws->fcmode = fcmode;
 
-        drvr->fws->fws_wq = create_singlethread_workqueue("brcmf_fws_wq");
-        if (drvr->fws->fws_wq == NULL) {
+        fws->fws_wq = create_singlethread_workqueue("brcmf_fws_wq");
+        if (fws->fws_wq == NULL) {
                 brcmf_err("workqueue creation failed\n");
                 rc = -EBADF;
                 goto fail;
         }
-        INIT_WORK(&drvr->fws->fws_dequeue_work, brcmf_fws_dequeue_worker);
+        INIT_WORK(&fws->fws_dequeue_work, brcmf_fws_dequeue_worker);
 
         /* enable firmware signalling if fcmode active */
-        if (drvr->fws->fcmode != BRCMF_FWS_FCMODE_NONE)
+        if (fws->fcmode != BRCMF_FWS_FCMODE_NONE)
                 tlv |= BRCMF_FWS_FLAGS_XONXOFF_SIGNALS |
                        BRCMF_FWS_FLAGS_CREDIT_STATUS_SIGNALS |
-                       BRCMF_FWS_FLAGS_HOST_PROPTXSTATUS_ACTIVE;
+                       BRCMF_FWS_FLAGS_HOST_PROPTXSTATUS_ACTIVE |
+                       BRCMF_FWS_FLAGS_HOST_RXREORDER_ACTIVE;
 
         rc = brcmf_fweh_register(drvr, BRCMF_E_FIFO_CREDIT_MAP,
                                  brcmf_fws_notify_credit_map);
@@ -1927,31 +1950,33 @@ int brcmf_fws_init(struct brcmf_pub *drvr)
                 goto fail;
         }
 
-        /* setting the iovar may fail if feature is unsupported
+        /* Setting the iovar may fail if feature is unsupported
          * so leave the rc as is so driver initialization can
-         * continue.
+         * continue. Set mode back to none indicating not enabled.
          */
+        fws->fw_signals = true;
         if (brcmf_fil_iovar_int_set(drvr->iflist[0], "tlv", tlv)) {
                 brcmf_err("failed to set bdcv2 tlv signaling\n");
-                goto fail_event;
+                fws->fcmode = BRCMF_FWS_FCMODE_NONE;
+                fws->fw_signals = false;
         }
 
-        brcmf_fws_hanger_init(&drvr->fws->hanger);
-        brcmf_fws_macdesc_init(&drvr->fws->desc.other, NULL, 0);
-        brcmf_fws_macdesc_set_name(drvr->fws, &drvr->fws->desc.other);
-        brcmu_pktq_init(&drvr->fws->desc.other.psq, BRCMF_FWS_PSQ_PREC_COUNT,
+        if (brcmf_fil_iovar_int_set(drvr->iflist[0], "ampdu_hostreorder", 1))
+                brcmf_dbg(INFO, "enabling AMPDU host-reorder failed\n");
+
+        brcmf_fws_hanger_init(&fws->hanger);
+        brcmf_fws_macdesc_init(&fws->desc.other, NULL, 0);
+        brcmf_fws_macdesc_set_name(fws, &fws->desc.other);
+        brcmu_pktq_init(&fws->desc.other.psq, BRCMF_FWS_PSQ_PREC_COUNT,
                         BRCMF_FWS_PSQ_LEN);
 
         /* create debugfs file for statistics */
-        brcmf_debugfs_create_fws_stats(drvr, &drvr->fws->stats);
+        brcmf_debugfs_create_fws_stats(drvr, &fws->stats);
 
         brcmf_dbg(INFO, "%s bdcv2 tlv signaling [%x]\n",
-                  drvr->fw_signals ? "enabled" : "disabled", tlv);
+                  fws->fw_signals ? "enabled" : "disabled", tlv);
         return 0;
 
-fail_event:
-        brcmf_fweh_unregister(drvr, BRCMF_E_BCMC_CREDIT_SUPPORT);
-        brcmf_fweh_unregister(drvr, BRCMF_E_FIFO_CREDIT_MAP);
 fail:
         brcmf_fws_deinit(drvr);
         return rc;
@@ -1960,24 +1985,18 @@ fail:
 void brcmf_fws_deinit(struct brcmf_pub *drvr)
 {
         struct brcmf_fws_info *fws = drvr->fws;
-        ulong flags;
 
         if (!fws)
                 return;
 
-        /* disable firmware signalling entirely
-         * to avoid using the workqueue.
-         */
-        drvr->fw_signals = false;
-
         if (drvr->fws->fws_wq)
                 destroy_workqueue(drvr->fws->fws_wq);
 
         /* cleanup */
-        brcmf_fws_lock(drvr, flags);
+        brcmf_fws_lock(fws);
         brcmf_fws_cleanup(fws, -1);
         drvr->fws = NULL;
-        brcmf_fws_unlock(drvr, flags);
+        brcmf_fws_unlock(fws);
 
         /* free top structure */
         kfree(fws);
@@ -1985,7 +2004,7 @@ void brcmf_fws_deinit(struct brcmf_pub *drvr)
 
 bool brcmf_fws_fc_active(struct brcmf_fws_info *fws)
 {
-        if (!fws)
+        if (!fws->creditmap_received)
                 return false;
 
         return fws->fcmode != BRCMF_FWS_FCMODE_NONE;
@@ -1993,17 +2012,16 @@ bool brcmf_fws_fc_active(struct brcmf_fws_info *fws)
 
 void brcmf_fws_bustxfail(struct brcmf_fws_info *fws, struct sk_buff *skb)
 {
-        ulong flags;
         u32 hslot;
 
         if (brcmf_skbcb(skb)->state == BRCMF_FWS_SKBSTATE_TIM) {
                 brcmu_pkt_buf_free_skb(skb);
                 return;
         }
-        brcmf_fws_lock(fws->drvr, flags);
+        brcmf_fws_lock(fws);
         hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
         brcmf_fws_txs_process(fws, BRCMF_FWS_TXSTATUS_HOST_TOSSED, hslot, 0);
-        brcmf_fws_unlock(fws->drvr, flags);
+        brcmf_fws_unlock(fws);
 }
 
 void brcmf_fws_bus_blocked(struct brcmf_pub *drvr, bool flow_blocked)
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
index 79555f006d53..d7a974532909 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
@@ -1430,7 +1430,7 @@ int brcmf_p2p_notify_action_frame_rx(struct brcmf_if *ifp,
                                               IEEE80211_BAND_5GHZ);
 
         wdev = &ifp->vif->wdev;
-        cfg80211_rx_mgmt(wdev, freq, 0, (u8 *)mgmt_frame, mgmt_frame_len,
+        cfg80211_rx_mgmt(wdev, freq, 0, (u8 *)mgmt_frame, mgmt_frame_len, 0,
                          GFP_ATOMIC);
 
         kfree(mgmt_frame);
@@ -1895,7 +1895,7 @@ s32 brcmf_p2p_notify_rx_mgmt_p2p_probereq(struct brcmf_if *ifp,
                                               IEEE80211_BAND_2GHZ :
                                               IEEE80211_BAND_5GHZ);
 
-        cfg80211_rx_mgmt(&vif->wdev, freq, 0, mgmt_frame, mgmt_frame_len,
+        cfg80211_rx_mgmt(&vif->wdev, freq, 0, mgmt_frame, mgmt_frame_len, 0,
                          GFP_ATOMIC);
 
         brcmf_dbg(INFO, "mgmt_frame_len (%d) , e->datalen (%d), chanspec (%04x), freq (%d)\n",
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h b/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
index 09786a539950..2b5407f002e5 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
@@ -208,7 +208,7 @@ extern int brcmf_sdio_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
  */
 extern int
 brcmf_sdcard_send_pkt(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
-                      uint flags, struct sk_buff *pkt);
+                      uint flags, struct sk_buff_head *pktq);
 extern int
 brcmf_sdcard_send_buf(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
                       uint flags, u8 *buf, uint nbytes);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index 322cadc51ded..39e01a7c8556 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -614,7 +614,6 @@ static int brcmf_usb_tx(struct device *dev, struct sk_buff *skb)
         return 0;
 
 fail:
-        brcmf_txcomplete(dev, skb, false);
         return ret;
 }
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index c3dfea3f307d..571f013cebbb 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -3155,7 +3155,9 @@ static int brcmf_cfg80211_sched_scan_stop(struct wiphy *wiphy,
 }
 
 #ifdef CONFIG_NL80211_TESTMODE
-static int brcmf_cfg80211_testmode(struct wiphy *wiphy, void *data, int len)
+static int brcmf_cfg80211_testmode(struct wiphy *wiphy,
+                                   struct wireless_dev *wdev,
+                                   void *data, int len)
 {
         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
         struct net_device *ndev = cfg_to_ndev(cfg);
@@ -4126,6 +4128,53 @@ static void brcmf_cfg80211_crit_proto_stop(struct wiphy *wiphy,
         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
 }
 
+static int brcmf_convert_nl80211_tdls_oper(enum nl80211_tdls_operation oper)
+{
+        int ret;
+
+        switch (oper) {
+        case NL80211_TDLS_DISCOVERY_REQ:
+                ret = BRCMF_TDLS_MANUAL_EP_DISCOVERY;
+                break;
+        case NL80211_TDLS_SETUP:
+                ret = BRCMF_TDLS_MANUAL_EP_CREATE;
+                break;
+        case NL80211_TDLS_TEARDOWN:
+                ret = BRCMF_TDLS_MANUAL_EP_DELETE;
+                break;
+        default:
+                brcmf_err("unsupported operation: %d\n", oper);
+                ret = -EOPNOTSUPP;
+        }
+        return ret;
+}
+
+static int brcmf_cfg80211_tdls_oper(struct wiphy *wiphy,
+                                    struct net_device *ndev, u8 *peer,
+                                    enum nl80211_tdls_operation oper)
+{
+        struct brcmf_if *ifp;
+        struct brcmf_tdls_iovar_le info;
+        int ret = 0;
+
+        ret = brcmf_convert_nl80211_tdls_oper(oper);
+        if (ret < 0)
+                return ret;
+
+        ifp = netdev_priv(ndev);
+        memset(&info, 0, sizeof(info));
+        info.mode = (u8)ret;
+        if (peer)
+                memcpy(info.ea, peer, ETH_ALEN);
+
+        ret = brcmf_fil_iovar_data_set(ifp, "tdls_endpoint",
+                                       &info, sizeof(info));
+        if (ret < 0)
+                brcmf_err("tdls_endpoint iovar failed: ret=%d\n", ret);
+
+        return ret;
+}
+
 static struct cfg80211_ops wl_cfg80211_ops = {
         .add_virtual_intf = brcmf_cfg80211_add_iface,
         .del_virtual_intf = brcmf_cfg80211_del_iface,
@@ -4164,6 +4213,7 @@ static struct cfg80211_ops wl_cfg80211_ops = {
         .stop_p2p_device = brcmf_p2p_stop_device,
         .crit_proto_start = brcmf_cfg80211_crit_proto_start,
         .crit_proto_stop = brcmf_cfg80211_crit_proto_stop,
+        .tdls_oper = brcmf_cfg80211_tdls_oper,
         CFG80211_TESTMODE_CMD(brcmf_cfg80211_testmode)
 };
 
@@ -4285,7 +4335,8 @@ static struct wiphy *brcmf_setup_wiphy(struct device *phydev)
         wiphy->n_cipher_suites = ARRAY_SIZE(__wl_cipher_suites);
         wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT |
                         WIPHY_FLAG_OFFCHAN_TX |
-                        WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
+                        WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
+                        WIPHY_FLAG_SUPPORTS_TDLS;
         wiphy->mgmt_stypes = brcmf_txrx_stypes;
         wiphy->max_remain_on_channel_duration = 5000;
         brcmf_wiphy_pno_params(wiphy);
@@ -4906,6 +4957,12 @@ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
                 goto cfg80211_p2p_attach_out;
         }
 
+        err = brcmf_fil_iovar_int_set(ifp, "tdls_enable", 1);
+        if (err) {
+                brcmf_dbg(INFO, "TDLS not enabled (%d)\n", err);
+                wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_TDLS;
+        }
+
         err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_VERSION,
                                     &io_type);
         if (err) {
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/aiutils.c b/drivers/net/wireless/brcm80211/brcmsmac/aiutils.c
index e4fd1ee3d690..53365977bfd6 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/aiutils.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/aiutils.c
@@ -679,27 +679,6 @@ bool ai_clkctl_cc(struct si_pub *sih, enum bcma_clkmode mode)
         return mode == BCMA_CLKMODE_FAST;
 }
 
-void ai_pci_up(struct si_pub *sih)
-{
-        struct si_info *sii;
-
-        sii = container_of(sih, struct si_info, pub);
-
-        if (sii->icbus->hosttype == BCMA_HOSTTYPE_PCI)
-                bcma_core_pci_extend_L1timer(&sii->icbus->drv_pci[0], true);
-}
-
-/* Unconfigure and/or apply various WARs when going down */
-void ai_pci_down(struct si_pub *sih)
-{
-        struct si_info *sii;
-
-        sii = container_of(sih, struct si_info, pub);
-
-        if (sii->icbus->hosttype == BCMA_HOSTTYPE_PCI)
-                bcma_core_pci_extend_L1timer(&sii->icbus->drv_pci[0], false);
-}
-
 /* Enable BT-COEX & Ex-PA for 4313 */
 void ai_epa_4313war(struct si_pub *sih)
 {
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/aiutils.h b/drivers/net/wireless/brcm80211/brcmsmac/aiutils.h
index 89562c1fbf49..a8a267b5b87a 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/aiutils.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/aiutils.h
@@ -183,9 +183,6 @@ extern u16 ai_clkctl_fast_pwrup_delay(struct si_pub *sih);
 extern bool ai_clkctl_cc(struct si_pub *sih, enum bcma_clkmode mode);
 extern bool ai_deviceremoved(struct si_pub *sih);
 
-extern void ai_pci_down(struct si_pub *sih);
-extern void ai_pci_up(struct si_pub *sih);
-
 /* Enable Ex-PA for 4313 */
 extern void ai_epa_4313war(struct si_pub *sih);
 
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/dma.c b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
index 1860c572b3c4..4fb9635d3919 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/dma.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
@@ -1015,9 +1015,10 @@ static bool dma64_txidle(struct dma_info *di)
 
 /*
  * post receive buffers
- *  return false is refill failed completely and ring is empty this will stall
- *  the rx dma and user might want to call rxfill again asap. This unlikely
- *  happens on memory-rich NIC, but often on memory-constrained dongle
+ *  Return false if refill failed completely or dma mapping failed. The ring
+ *  is empty, which will stall the rx dma and user might want to call rxfill
+ *  again asap. This is unlikely to happen on a memory-rich NIC, but often on
+ *  memory-constrained dongle.
  */
 bool dma_rxfill(struct dma_pub *pub)
 {
@@ -1078,6 +1079,8 @@ bool dma_rxfill(struct dma_pub *pub)
 
                 pa = dma_map_single(di->dmadev, p->data, di->rxbufsize,
                                     DMA_FROM_DEVICE);
+                if (dma_mapping_error(di->dmadev, pa))
+                        return false;
 
                 /* save the free packet pointer */
                 di->rxp[rxout] = p;
@@ -1284,7 +1287,11 @@ static void dma_txenq(struct dma_info *di, struct sk_buff *p)
 
         /* get physical address of buffer start */
         pa = dma_map_single(di->dmadev, data, len, DMA_TO_DEVICE);
-
+        /* if mapping failed, free skb */
+        if (dma_mapping_error(di->dmadev, pa)) {
+                brcmu_pkt_buf_free_skb(p);
+                return;
+        }
         /* With a DMA segment list, Descriptor table is filled
          * using the segment list instead of looping over
          * buffers in multi-chain DMA. Therefore, EOF for SGLIST
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 7ca10bf4a4d3..4608e0eb1493 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -4652,7 +4652,9 @@ static int brcms_b_attach(struct brcms_c_info *wlc, struct bcma_device *core,
                 wlc->band->phyrev = wlc_hw->band->phyrev;
                 wlc->band->radioid = wlc_hw->band->radioid;
                 wlc->band->radiorev = wlc_hw->band->radiorev;
-
+                brcms_dbg_info(core, "wl%d: phy %u/%u radio %x/%u\n", unit,
+                               wlc->band->phytype, wlc->band->phyrev,
+                               wlc->band->radioid, wlc->band->radiorev);
                 /* default contention windows size limits */
                 wlc_hw->band->CWmin = APHY_CWMIN;
                 wlc_hw->band->CWmax = PHY_CWMAX;
@@ -4667,7 +4669,7 @@ static int brcms_b_attach(struct brcms_c_info *wlc, struct bcma_device *core,
         brcms_c_coredisable(wlc_hw);
 
         /* Match driver "down" state */
-        ai_pci_down(wlc_hw->sih);
+        bcma_core_pci_down(wlc_hw->d11core->bus);
 
         /* turn off pll and xtal to match driver "down" state */
         brcms_b_xtal(wlc_hw, OFF);
@@ -5010,12 +5012,12 @@ static int brcms_b_up_prep(struct brcms_hardware *wlc_hw)
          */
         if (brcms_b_radio_read_hwdisabled(wlc_hw)) {
                 /* put SB PCI in down state again */
-                ai_pci_down(wlc_hw->sih);
+                bcma_core_pci_down(wlc_hw->d11core->bus);
                 brcms_b_xtal(wlc_hw, OFF);
                 return -ENOMEDIUM;
         }
 
-        ai_pci_up(wlc_hw->sih);
+        bcma_core_pci_up(wlc_hw->d11core->bus);
 
         /* reset the d11 core */
         brcms_b_corereset(wlc_hw, BRCMS_USE_COREFLAGS);
@@ -5212,7 +5214,7 @@ static int brcms_b_down_finish(struct brcms_hardware *wlc_hw)
 
                 /* turn off primary xtal and pll */
                 if (!wlc_hw->noreset) {
-                        ai_pci_down(wlc_hw->sih);
+                        bcma_core_pci_down(wlc_hw->d11core->bus);
                         brcms_b_xtal(wlc_hw, OFF);
                 }
         }
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
index 3d6b16ce4687..b2d6d6da3daf 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
@@ -1137,8 +1137,9 @@ wlc_lcnphy_set_rx_gain_by_distribution(struct brcms_phy *pi,
         gain0_15 = ((biq1 & 0xf) << 12) |
                    ((tia & 0xf) << 8) |
                    ((lna2 & 0x3) << 6) |
-                   ((lna2 &
-                     0x3) << 4) | ((lna1 & 0x3) << 2) | ((lna1 & 0x3) << 0);
+                   ((lna2 & 0x3) << 4) |
+                   ((lna1 & 0x3) << 2) |
+                   ((lna1 & 0x3) << 0);
 
         mod_phy_reg(pi, 0x4b6, (0xffff << 0), gain0_15 << 0);
         mod_phy_reg(pi, 0x4b7, (0xf << 0), gain16_19 << 0);
@@ -1328,6 +1329,43 @@ static u32 wlc_lcnphy_measure_digital_power(struct brcms_phy *pi, u16 nsamples)
         return (iq_est.i_pwr + iq_est.q_pwr) / nsamples;
 }
 
+static bool wlc_lcnphy_rx_iq_cal_gain(struct brcms_phy *pi, u16 biq1_gain,
+                                      u16 tia_gain, u16 lna2_gain)
+{
+        u32 i_thresh_l, q_thresh_l;
+        u32 i_thresh_h, q_thresh_h;
+        struct lcnphy_iq_est iq_est_h, iq_est_l;
+
+        wlc_lcnphy_set_rx_gain_by_distribution(pi, 0, 0, 0, biq1_gain, tia_gain,
+                                               lna2_gain, 0);
+
+        wlc_lcnphy_rx_gain_override_enable(pi, true);
+        wlc_lcnphy_start_tx_tone(pi, 2000, (40 >> 1), 0);
+        udelay(500);
+        write_radio_reg(pi, RADIO_2064_REG112, 0);
+        if (!wlc_lcnphy_rx_iq_est(pi, 1024, 32, &iq_est_l))
+                return false;
+
+        wlc_lcnphy_start_tx_tone(pi, 2000, 40, 0);
+        udelay(500);
+        write_radio_reg(pi, RADIO_2064_REG112, 0);
+        if (!wlc_lcnphy_rx_iq_est(pi, 1024, 32, &iq_est_h))
+                return false;
+
+        i_thresh_l = (iq_est_l.i_pwr << 1);
+        i_thresh_h = (iq_est_l.i_pwr << 2) + iq_est_l.i_pwr;
+
+        q_thresh_l = (iq_est_l.q_pwr << 1);
+        q_thresh_h = (iq_est_l.q_pwr << 2) + iq_est_l.q_pwr;
+        if ((iq_est_h.i_pwr > i_thresh_l) &&
+            (iq_est_h.i_pwr < i_thresh_h) &&
+            (iq_est_h.q_pwr > q_thresh_l) &&
+            (iq_est_h.q_pwr < q_thresh_h))
+                return true;
+
+        return false;
+}
+
 static bool
 wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
                      const struct lcnphy_rx_iqcomp *iqcomp,
@@ -1342,8 +1380,8 @@ wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
             RFOverrideVal0_old, rfoverride2_old, rfoverride2val_old,
             rfoverride3_old, rfoverride3val_old, rfoverride4_old,
             rfoverride4val_old, afectrlovr_old, afectrlovrval_old;
-        int tia_gain;
-        u32 received_power, rx_pwr_threshold;
+        int tia_gain, lna2_gain, biq1_gain;
+        bool set_gain;
         u16 old_sslpnCalibClkEnCtrl, old_sslpnRxFeClkEnCtrl;
         u16 values_to_save[11];
         s16 *ptr;
@@ -1368,126 +1406,125 @@ wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
                 goto cal_done;
         }
 
-        if (module == 1) {
+        WARN_ON(module != 1);
+        tx_pwr_ctrl = wlc_lcnphy_get_tx_pwr_ctrl(pi);
+        wlc_lcnphy_set_tx_pwr_ctrl(pi, LCNPHY_TX_PWR_CTRL_OFF);
 
-                tx_pwr_ctrl = wlc_lcnphy_get_tx_pwr_ctrl(pi);
-                wlc_lcnphy_set_tx_pwr_ctrl(pi, LCNPHY_TX_PWR_CTRL_OFF);
+        for (i = 0; i < 11; i++)
+                values_to_save[i] =
+                        read_radio_reg(pi, rxiq_cal_rf_reg[i]);
+        Core1TxControl_old = read_phy_reg(pi, 0x631);
+
+        or_phy_reg(pi, 0x631, 0x0015);
+
+        RFOverride0_old = read_phy_reg(pi, 0x44c);
+        RFOverrideVal0_old = read_phy_reg(pi, 0x44d);
+        rfoverride2_old = read_phy_reg(pi, 0x4b0);
+        rfoverride2val_old = read_phy_reg(pi, 0x4b1);
+        rfoverride3_old = read_phy_reg(pi, 0x4f9);
+        rfoverride3val_old = read_phy_reg(pi, 0x4fa);
+        rfoverride4_old = read_phy_reg(pi, 0x938);
+        rfoverride4val_old = read_phy_reg(pi, 0x939);
+        afectrlovr_old = read_phy_reg(pi, 0x43b);
+        afectrlovrval_old = read_phy_reg(pi, 0x43c);
+        old_sslpnCalibClkEnCtrl = read_phy_reg(pi, 0x6da);
+        old_sslpnRxFeClkEnCtrl = read_phy_reg(pi, 0x6db);
 
-                for (i = 0; i < 11; i++)
-                        values_to_save[i] =
-                                read_radio_reg(pi, rxiq_cal_rf_reg[i]);
-                Core1TxControl_old = read_phy_reg(pi, 0x631);
-
-                or_phy_reg(pi, 0x631, 0x0015);
-
-                RFOverride0_old = read_phy_reg(pi, 0x44c);
-                RFOverrideVal0_old = read_phy_reg(pi, 0x44d);
-                rfoverride2_old = read_phy_reg(pi, 0x4b0);
-                rfoverride2val_old = read_phy_reg(pi, 0x4b1);
-                rfoverride3_old = read_phy_reg(pi, 0x4f9);
-                rfoverride3val_old = read_phy_reg(pi, 0x4fa);
-                rfoverride4_old = read_phy_reg(pi, 0x938);
-                rfoverride4val_old = read_phy_reg(pi, 0x939);
-                afectrlovr_old = read_phy_reg(pi, 0x43b);
-                afectrlovrval_old = read_phy_reg(pi, 0x43c);
-                old_sslpnCalibClkEnCtrl = read_phy_reg(pi, 0x6da);
-                old_sslpnRxFeClkEnCtrl = read_phy_reg(pi, 0x6db);
-
-                tx_gain_override_old = wlc_lcnphy_tx_gain_override_enabled(pi);
-                if (tx_gain_override_old) {
-                        wlc_lcnphy_get_tx_gain(pi, &old_gains);
-                        tx_gain_index_old = pi_lcn->lcnphy_current_index;
-                }
+        tx_gain_override_old = wlc_lcnphy_tx_gain_override_enabled(pi);
+        if (tx_gain_override_old) {
+                wlc_lcnphy_get_tx_gain(pi, &old_gains);
+                tx_gain_index_old = pi_lcn->lcnphy_current_index;
+        }
 
-                wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_idx);
+        wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_idx);
 
-                mod_phy_reg(pi, 0x4f9, (0x1 << 0), 1 << 0);
-                mod_phy_reg(pi, 0x4fa, (0x1 << 0), 0 << 0);
+        mod_phy_reg(pi, 0x4f9, (0x1 << 0), 1 << 0);
+        mod_phy_reg(pi, 0x4fa, (0x1 << 0), 0 << 0);
 
-                mod_phy_reg(pi, 0x43b, (0x1 << 1), 1 << 1);
-                mod_phy_reg(pi, 0x43c, (0x1 << 1), 0 << 1);
+        mod_phy_reg(pi, 0x43b, (0x1 << 1), 1 << 1);
+        mod_phy_reg(pi, 0x43c, (0x1 << 1), 0 << 1);
 
-                write_radio_reg(pi, RADIO_2064_REG116, 0x06);
-                write_radio_reg(pi, RADIO_2064_REG12C, 0x07);
-                write_radio_reg(pi, RADIO_2064_REG06A, 0xd3);
-                write_radio_reg(pi, RADIO_2064_REG098, 0x03);
-                write_radio_reg(pi, RADIO_2064_REG00B, 0x7);
-                mod_radio_reg(pi, RADIO_2064_REG113, 1 << 4, 1 << 4);
-                write_radio_reg(pi, RADIO_2064_REG01D, 0x01);
-                write_radio_reg(pi, RADIO_2064_REG114, 0x01);
-                write_radio_reg(pi, RADIO_2064_REG02E, 0x10);
-                write_radio_reg(pi, RADIO_2064_REG12A, 0x08);
-
-                mod_phy_reg(pi, 0x938, (0x1 << 0), 1 << 0);
-                mod_phy_reg(pi, 0x939, (0x1 << 0), 0 << 0);
-                mod_phy_reg(pi, 0x938, (0x1 << 1), 1 << 1);
-                mod_phy_reg(pi, 0x939, (0x1 << 1), 1 << 1);
-                mod_phy_reg(pi, 0x938, (0x1 << 2), 1 << 2);
-                mod_phy_reg(pi, 0x939, (0x1 << 2), 1 << 2);
-                mod_phy_reg(pi, 0x938, (0x1 << 3), 1 << 3);
-                mod_phy_reg(pi, 0x939, (0x1 << 3), 1 << 3);
-                mod_phy_reg(pi, 0x938, (0x1 << 5), 1 << 5);
-                mod_phy_reg(pi, 0x939, (0x1 << 5), 0 << 5);
-
-                mod_phy_reg(pi, 0x43b, (0x1 << 0), 1 << 0);
-                mod_phy_reg(pi, 0x43c, (0x1 << 0), 0 << 0);
-
-                wlc_lcnphy_start_tx_tone(pi, 2000, 120, 0);
-                write_phy_reg(pi, 0x6da, 0xffff);
-                or_phy_reg(pi, 0x6db, 0x3);
-                wlc_lcnphy_set_trsw_override(pi, tx_switch, rx_switch);
-                wlc_lcnphy_rx_gain_override_enable(pi, true);
-
-                tia_gain = 8;
-                rx_pwr_threshold = 950;
-                while (tia_gain > 0) {
-                        tia_gain -= 1;
-                        wlc_lcnphy_set_rx_gain_by_distribution(pi,
-                                                               0, 0, 2, 2,
-                                                               (u16)
-                                                               tia_gain, 1, 0);
-                        udelay(500);
+        write_radio_reg(pi, RADIO_2064_REG116, 0x06);
+        write_radio_reg(pi, RADIO_2064_REG12C, 0x07);
+        write_radio_reg(pi, RADIO_2064_REG06A, 0xd3);
+        write_radio_reg(pi, RADIO_2064_REG098, 0x03);
+        write_radio_reg(pi, RADIO_2064_REG00B, 0x7);
+        mod_radio_reg(pi, RADIO_2064_REG113, 1 << 4, 1 << 4);
+        write_radio_reg(pi, RADIO_2064_REG01D, 0x01);
+        write_radio_reg(pi, RADIO_2064_REG114, 0x01);
+        write_radio_reg(pi, RADIO_2064_REG02E, 0x10);
+        write_radio_reg(pi, RADIO_2064_REG12A, 0x08);
+
+        mod_phy_reg(pi, 0x938, (0x1 << 0), 1 << 0);
+        mod_phy_reg(pi, 0x939, (0x1 << 0), 0 << 0);
+        mod_phy_reg(pi, 0x938, (0x1 << 1), 1 << 1);
+        mod_phy_reg(pi, 0x939, (0x1 << 1), 1 << 1);
+        mod_phy_reg(pi, 0x938, (0x1 << 2), 1 << 2);
+        mod_phy_reg(pi, 0x939, (0x1 << 2), 1 << 2);
+        mod_phy_reg(pi, 0x938, (0x1 << 3), 1 << 3);
+        mod_phy_reg(pi, 0x939, (0x1 << 3), 1 << 3);
+        mod_phy_reg(pi, 0x938, (0x1 << 5), 1 << 5);
+        mod_phy_reg(pi, 0x939, (0x1 << 5), 0 << 5);
 
-                        received_power =
-                                wlc_lcnphy_measure_digital_power(pi, 2000);
-                        if (received_power < rx_pwr_threshold)
-                                break;
-                }
-                result = wlc_lcnphy_calc_rx_iq_comp(pi, 0xffff);
+        mod_phy_reg(pi, 0x43b, (0x1 << 0), 1 << 0);
+        mod_phy_reg(pi, 0x43c, (0x1 << 0), 0 << 0);
 
-                wlc_lcnphy_stop_tx_tone(pi);
+        write_phy_reg(pi, 0x6da, 0xffff);
+        or_phy_reg(pi, 0x6db, 0x3);
+
+        wlc_lcnphy_set_trsw_override(pi, tx_switch, rx_switch);
+        for (lna2_gain = 3; lna2_gain >= 0; lna2_gain--) {
+                for (tia_gain = 4; tia_gain >= 0; tia_gain--) {
+                        for (biq1_gain = 6; biq1_gain >= 0; biq1_gain--) {
+                                set_gain = wlc_lcnphy_rx_iq_cal_gain(pi,
+                                                                     (u16)
+                                                                     biq1_gain,
+                                                                     (u16)
+                                                                     tia_gain,
+                                                                     (u16)
+                                                                     lna2_gain);
+                                if (!set_gain)
+                                        continue;
+
+                                result = wlc_lcnphy_calc_rx_iq_comp(pi, 1024);
+                                goto stop_tone;
+                        }
+                }
+        }
 
-                write_phy_reg(pi, 0x631, Core1TxControl_old);
+stop_tone:
+        wlc_lcnphy_stop_tx_tone(pi);
 
-                write_phy_reg(pi, 0x44c, RFOverrideVal0_old);
-                write_phy_reg(pi, 0x44d, RFOverrideVal0_old);
-                write_phy_reg(pi, 0x4b0, rfoverride2_old);
-                write_phy_reg(pi, 0x4b1, rfoverride2val_old);
-                write_phy_reg(pi, 0x4f9, rfoverride3_old);
-                write_phy_reg(pi, 0x4fa, rfoverride3val_old);
-                write_phy_reg(pi, 0x938, rfoverride4_old);
-                write_phy_reg(pi, 0x939, rfoverride4val_old);
-                write_phy_reg(pi, 0x43b, afectrlovr_old);
-                write_phy_reg(pi, 0x43c, afectrlovrval_old);
-                write_phy_reg(pi, 0x6da, old_sslpnCalibClkEnCtrl);
-                write_phy_reg(pi, 0x6db, old_sslpnRxFeClkEnCtrl);
+        write_phy_reg(pi, 0x631, Core1TxControl_old);
+
+        write_phy_reg(pi, 0x44c, RFOverrideVal0_old);
+        write_phy_reg(pi, 0x44d, RFOverrideVal0_old);
+        write_phy_reg(pi, 0x4b0, rfoverride2_old);
+        write_phy_reg(pi, 0x4b1, rfoverride2val_old);
+        write_phy_reg(pi, 0x4f9, rfoverride3_old);
+        write_phy_reg(pi, 0x4fa, rfoverride3val_old);
+        write_phy_reg(pi, 0x938, rfoverride4_old);
+        write_phy_reg(pi, 0x939, rfoverride4val_old);
+        write_phy_reg(pi, 0x43b, afectrlovr_old);
+        write_phy_reg(pi, 0x43c, afectrlovrval_old);
+        write_phy_reg(pi, 0x6da, old_sslpnCalibClkEnCtrl);
+        write_phy_reg(pi, 0x6db, old_sslpnRxFeClkEnCtrl);
 
-                wlc_lcnphy_clear_trsw_override(pi);
+        wlc_lcnphy_clear_trsw_override(pi);
 
-                mod_phy_reg(pi, 0x44c, (0x1 << 2), 0 << 2);
+        mod_phy_reg(pi, 0x44c, (0x1 << 2), 0 << 2);
 
-                for (i = 0; i < 11; i++)
-                        write_radio_reg(pi, rxiq_cal_rf_reg[i],
-                                        values_to_save[i]);
+        for (i = 0; i < 11; i++)
+                write_radio_reg(pi, rxiq_cal_rf_reg[i],
+                                values_to_save[i]);
 
-                if (tx_gain_override_old)
-                        wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_index_old);
-                else
-                        wlc_lcnphy_disable_tx_gain_override(pi);
+        if (tx_gain_override_old)
+                wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_index_old);
+        else
+                wlc_lcnphy_disable_tx_gain_override(pi);
 
-                wlc_lcnphy_set_tx_pwr_ctrl(pi, tx_pwr_ctrl);
-                wlc_lcnphy_rx_gain_override_enable(pi, false);
-        }
+        wlc_lcnphy_set_tx_pwr_ctrl(pi, tx_pwr_ctrl);
+        wlc_lcnphy_rx_gain_override_enable(pi, false);
 
 cal_done:
         kfree(ptr);
@@ -1789,6 +1826,19 @@ wlc_lcnphy_radio_2064_channel_tune_4313(struct brcms_phy *pi, u8 channel)
                 write_radio_reg(pi, RADIO_2064_REG038, 3);
                 write_radio_reg(pi, RADIO_2064_REG091, 7);
         }
+
+        if (!(pi->sh->boardflags & BFL_FEM)) {
+                static const u8 reg038[14] = {
+                        0xd, 0xe, 0xd, 0xd, 0xd, 0xc, 0xa,
+                        0xb, 0xb, 0x3, 0x3, 0x2, 0x0, 0x0
+                };
+
+                write_radio_reg(pi, RADIO_2064_REG02A, 0xf);
+                write_radio_reg(pi, RADIO_2064_REG091, 0x3);
+                write_radio_reg(pi, RADIO_2064_REG038, 0x3);
+
+                write_radio_reg(pi, RADIO_2064_REG038, reg038[channel - 1]);
+        }
 }
 
 static int
@@ -1983,6 +2033,16 @@ wlc_lcnphy_set_tssi_mux(struct brcms_phy *pi, enum lcnphy_tssi_mode pos)
                 } else {
                         mod_radio_reg(pi, RADIO_2064_REG03A, 1, 0x1);
                         mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 0x8);
+                        mod_radio_reg(pi, RADIO_2064_REG028, 0x1, 0x0);
+                        mod_radio_reg(pi, RADIO_2064_REG11A, 0x4, 1<<2);
+                        mod_radio_reg(pi, RADIO_2064_REG036, 0x10, 0x0);
+                        mod_radio_reg(pi, RADIO_2064_REG11A, 0x10, 1<<4);
+                        mod_radio_reg(pi, RADIO_2064_REG036, 0x3, 0x0);
+                        mod_radio_reg(pi, RADIO_2064_REG035, 0xff, 0x77);
+                        mod_radio_reg(pi, RADIO_2064_REG028, 0x1e, 0xe<<1);
+                        mod_radio_reg(pi, RADIO_2064_REG112, 0x80, 1<<7);
+                        mod_radio_reg(pi, RADIO_2064_REG005, 0x7, 1<<1);
+                        mod_radio_reg(pi, RADIO_2064_REG029, 0xf0, 0<<4);
                 }
         } else {
                 mod_phy_reg(pi, 0x4d9, (0x1 << 2), (0x1) << 2);
@@ -2069,13 +2129,23 @@ static void wlc_lcnphy_pwrctrl_rssiparams(struct brcms_phy *pi)
                     (auxpga_vmid_temp << 0) | (auxpga_gain_temp << 12));
 
         mod_radio_reg(pi, RADIO_2064_REG082, (1 << 5), (1 << 5));
+        mod_radio_reg(pi, RADIO_2064_REG07C, (1 << 0), (1 << 0));
 }
 
 static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
 {
         struct phytbl_info tab;
         u32 rfseq, ind;
+        enum lcnphy_tssi_mode mode;
+        u8 tssi_sel;
 
+        if (pi->sh->boardflags & BFL_FEM) {
+                tssi_sel = 0x1;
+                mode = LCNPHY_TSSI_EXT;
+        } else {
+                tssi_sel = 0xe;
+                mode = LCNPHY_TSSI_POST_PA;
+        }
         tab.tbl_id = LCNPHY_TBL_ID_TXPWRCTL;
         tab.tbl_width = 32;
         tab.tbl_ptr = &ind;
@@ -2096,7 +2166,7 @@ static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
 
         mod_phy_reg(pi, 0x503, (0x1 << 4), (1) << 4);
 
-        wlc_lcnphy_set_tssi_mux(pi, LCNPHY_TSSI_EXT);
+        wlc_lcnphy_set_tssi_mux(pi, mode);
         mod_phy_reg(pi, 0x4a4, (0x1 << 14), (0) << 14);
 
         mod_phy_reg(pi, 0x4a4, (0x1 << 15), (1) << 15);
@@ -2132,9 +2202,10 @@ static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
         mod_phy_reg(pi, 0x49a, (0x1ff << 0), (0xff) << 0);
 
         if (LCNREV_IS(pi->pubpi.phy_rev, 2)) {
-                mod_radio_reg(pi, RADIO_2064_REG028, 0xf, 0xe);
+                mod_radio_reg(pi, RADIO_2064_REG028, 0xf, tssi_sel);
                 mod_radio_reg(pi, RADIO_2064_REG086, 0x4, 0x4);
         } else {
+                mod_radio_reg(pi, RADIO_2064_REG028, 0x1e, tssi_sel << 1);
                 mod_radio_reg(pi, RADIO_2064_REG03A, 0x1, 1);
                 mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 1 << 3);
         }
@@ -2181,6 +2252,10 @@ static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
 
         mod_phy_reg(pi, 0x4d7, (0xf << 8), (0) << 8);
 
+        mod_radio_reg(pi, RADIO_2064_REG035, 0xff, 0x0);
+        mod_radio_reg(pi, RADIO_2064_REG036, 0x3, 0x0);
+        mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 0x8);
+
         wlc_lcnphy_pwrctrl_rssiparams(pi);
 }
 
@@ -2799,6 +2874,8 @@ static void wlc_lcnphy_idle_tssi_est(struct brcms_phy_pub *ppi)
                 read_radio_reg(pi, RADIO_2064_REG007) & 1;
         u16 SAVE_jtag_auxpga = read_radio_reg(pi, RADIO_2064_REG0FF) & 0x10;
         u16 SAVE_iqadc_aux_en = read_radio_reg(pi, RADIO_2064_REG11F) & 4;
+        u8 SAVE_bbmult = wlc_lcnphy_get_bbmult(pi);
+
         idleTssi = read_phy_reg(pi, 0x4ab);
         suspend = (0 == (bcma_read32(pi->d11core, D11REGOFFS(maccontrol)) &
                          MCTL_EN_MAC));
@@ -2816,6 +2893,12 @@ static void wlc_lcnphy_idle_tssi_est(struct brcms_phy_pub *ppi)
         mod_radio_reg(pi, RADIO_2064_REG0FF, 0x10, 1 << 4);
         mod_radio_reg(pi, RADIO_2064_REG11F, 0x4, 1 << 2);
         wlc_lcnphy_tssi_setup(pi);
+
+        mod_phy_reg(pi, 0x4d7, (0x1 << 0), (1 << 0));
+        mod_phy_reg(pi, 0x4d7, (0x1 << 6), (1 << 6));
+
+        wlc_lcnphy_set_bbmult(pi, 0x0);
+
         wlc_phy_do_dummy_tx(pi, true, OFF);
         idleTssi = ((read_phy_reg(pi, 0x4ab) & (0x1ff << 0))
                     >> 0);
@@ -2837,6 +2920,7 @@ static void wlc_lcnphy_idle_tssi_est(struct brcms_phy_pub *ppi)
 
         mod_phy_reg(pi, 0x44c, (0x1 << 12), (0) << 12);
 
+        wlc_lcnphy_set_bbmult(pi, SAVE_bbmult);
         wlc_lcnphy_set_tx_gain_override(pi, tx_gain_override_old);
         wlc_lcnphy_set_tx_gain(pi, &old_gains);
         wlc_lcnphy_set_tx_pwr_ctrl(pi, SAVE_txpwrctrl);
@@ -3050,6 +3134,11 @@ static void wlc_lcnphy_tx_pwr_ctrl_init(struct brcms_phy_pub *ppi)
                         wlc_lcnphy_write_table(pi, &tab);
                         tab.tbl_offset++;
                 }
+                mod_phy_reg(pi, 0x4d0, (0x1 << 0), (0) << 0);
+                mod_phy_reg(pi, 0x4d3, (0xff << 0), (0) << 0);
+                mod_phy_reg(pi, 0x4d3, (0xff << 8), (0) << 8);
+                mod_phy_reg(pi, 0x4d0, (0x1 << 4), (0) << 4);
+                mod_phy_reg(pi, 0x4d0, (0x1 << 2), (0) << 2);
 
                 mod_phy_reg(pi, 0x410, (0x1 << 7), (0) << 7);
 
@@ -3851,7 +3940,6 @@ static void wlc_lcnphy_txpwrtbl_iqlo_cal(struct brcms_phy *pi)
         target_gains.pad_gain = 21;
         target_gains.dac_gain = 0;
         wlc_lcnphy_set_tx_gain(pi, &target_gains);
-        wlc_lcnphy_set_tx_pwr_by_index(pi, 16);
 
         if (LCNREV_IS(pi->pubpi.phy_rev, 1) || pi_lcn->lcnphy_hw_iqcal_en) {
 
@@ -3862,6 +3950,7 @@ static void wlc_lcnphy_txpwrtbl_iqlo_cal(struct brcms_phy *pi)
                                         lcnphy_recal ? LCNPHY_CAL_RECAL :
                                         LCNPHY_CAL_FULL), false);
         } else {
+                wlc_lcnphy_set_tx_pwr_by_index(pi, 16);
                 wlc_lcnphy_tx_iqlo_soft_cal_full(pi);
         }
 
@@ -4283,20 +4372,20 @@ wlc_lcnphy_load_tx_gain_table(struct brcms_phy *pi,
         u16 pa_gain;
         u16 gm_gain;
 
-        if (CHSPEC_IS5G(pi->radio_chanspec))
-                pa_gain = 0x70;
-        else
-                pa_gain = 0x70;
-
         if (pi->sh->boardflags & BFL_FEM)
                 pa_gain = 0x10;
+        else
+                pa_gain = 0x60;
         tab.tbl_id = LCNPHY_TBL_ID_TXPWRCTL;
         tab.tbl_width = 32;
         tab.tbl_len = 1;
         tab.tbl_ptr = &val;
 
+        /* fixed gm_gain value for iPA */
+        gm_gain = 15;
         for (j = 0; j < 128; j++) {
-                gm_gain = gain_table[j].gm;
+                if (pi->sh->boardflags & BFL_FEM)
+                        gm_gain = gain_table[j].gm;
                 val = (((u32) pa_gain << 24) |
                        (gain_table[j].pad << 16) |
                        (gain_table[j].pga << 8) | gm_gain);
@@ -4507,7 +4596,10 @@ static void wlc_radio_2064_init(struct brcms_phy *pi)
 
         write_phy_reg(pi, 0x4ea, 0x4688);
 
-        mod_phy_reg(pi, 0x4eb, (0x7 << 0), 2 << 0);
+        if (pi->sh->boardflags & BFL_FEM)
+                mod_phy_reg(pi, 0x4eb, (0x7 << 0), 2 << 0);
+        else
+                mod_phy_reg(pi, 0x4eb, (0x7 << 0), 3 << 0);
 
         mod_phy_reg(pi, 0x4eb, (0x7 << 6), 0 << 6);
 
@@ -4518,6 +4610,13 @@ static void wlc_radio_2064_init(struct brcms_phy *pi)
         wlc_lcnphy_rcal(pi);
 
         wlc_lcnphy_rc_cal(pi);
+
+        if (!(pi->sh->boardflags & BFL_FEM)) {
+                write_radio_reg(pi, RADIO_2064_REG032, 0x6f);
+                write_radio_reg(pi, RADIO_2064_REG033, 0x19);
+                write_radio_reg(pi, RADIO_2064_REG039, 0xe);
+        }
+
 }
 
 static void wlc_lcnphy_radio_init(struct brcms_phy *pi)
@@ -4530,6 +4629,7 @@ static void wlc_lcnphy_tbl_init(struct brcms_phy *pi)
         uint idx;
         u8 phybw40;
         struct phytbl_info tab;
+        const struct phytbl_info *tb;
         u32 val;
 
         phybw40 = CHSPEC_IS40(pi->radio_chanspec);
@@ -4547,22 +4647,20 @@ static void wlc_lcnphy_tbl_init(struct brcms_phy *pi)
                 wlc_lcnphy_write_table(pi, &tab);
         }
 
-        tab.tbl_id = LCNPHY_TBL_ID_RFSEQ;
-        tab.tbl_width = 16;
-        tab.tbl_ptr = &val;
-        tab.tbl_len = 1;
-
-        val = 114;
-        tab.tbl_offset = 0;
-        wlc_lcnphy_write_table(pi, &tab);
+        if (!(pi->sh->boardflags & BFL_FEM)) {
+                tab.tbl_id = LCNPHY_TBL_ID_RFSEQ;
+                tab.tbl_width = 16;
+                tab.tbl_ptr = &val;
+                tab.tbl_len = 1;
 
-        val = 130;
-        tab.tbl_offset = 1;
-        wlc_lcnphy_write_table(pi, &tab);
+                val = 150;
+                tab.tbl_offset = 0;
+                wlc_lcnphy_write_table(pi, &tab);
 
-        val = 6;
-        tab.tbl_offset = 8;
-        wlc_lcnphy_write_table(pi, &tab);
+                val = 220;
+                tab.tbl_offset = 1;
+                wlc_lcnphy_write_table(pi, &tab);
+        }
 
         if (CHSPEC_IS2G(pi->radio_chanspec)) {
                 if (pi->sh->boardflags & BFL_FEM)
@@ -4576,7 +4674,6 @@ static void wlc_lcnphy_tbl_init(struct brcms_phy *pi)
         }
 
         if (LCNREV_IS(pi->pubpi.phy_rev, 2)) {
-                const struct phytbl_info *tb;
                 int l;
 
                 if (CHSPEC_IS2G(pi->radio_chanspec)) {
@@ -4597,21 +4694,22 @@ static void wlc_lcnphy_tbl_init(struct brcms_phy *pi)
                         wlc_lcnphy_write_table(pi, &tb[idx]);
         }
 
-        if ((pi->sh->boardflags & BFL_FEM)
-            && !(pi->sh->boardflags & BFL_FEM_BT))
-                wlc_lcnphy_write_table(pi, &dot11lcn_sw_ctrl_tbl_info_4313_epa);
-        else if (pi->sh->boardflags & BFL_FEM_BT) {
-                if (pi->sh->boardrev < 0x1250)
-                        wlc_lcnphy_write_table(
-                                pi,
-                                &dot11lcn_sw_ctrl_tbl_info_4313_bt_epa);
+        if (pi->sh->boardflags & BFL_FEM) {
+                if (pi->sh->boardflags & BFL_FEM_BT) {
+                        if (pi->sh->boardrev < 0x1250)
+                                tb = &dot11lcn_sw_ctrl_tbl_info_4313_bt_epa;
+                        else
+                                tb = &dot11lcn_sw_ctrl_tbl_info_4313_bt_epa_p250;
+                } else {
+                        tb = &dot11lcn_sw_ctrl_tbl_info_4313_epa;
+                }
+        } else {
+                if (pi->sh->boardflags & BFL_FEM_BT)
+                        tb = &dot11lcn_sw_ctrl_tbl_info_4313_bt_ipa;
                 else
-                        wlc_lcnphy_write_table(
-                                pi,
-                                &dot11lcn_sw_ctrl_tbl_info_4313_bt_epa_p250);
-        } else
-                wlc_lcnphy_write_table(pi, &dot11lcn_sw_ctrl_tbl_info_4313);
-
+                        tb = &dot11lcn_sw_ctrl_tbl_info_4313;
+        }
+        wlc_lcnphy_write_table(pi, tb);
         wlc_lcnphy_load_rfpower(pi);
 
         wlc_lcnphy_clear_papd_comptable(pi);
@@ -4955,6 +5053,8 @@ void wlc_phy_chanspec_set_lcnphy(struct brcms_phy *pi, u16 chanspec)
                 wlc_lcnphy_load_tx_iir_filter(pi, true, 3);
 
         mod_phy_reg(pi, 0x4eb, (0x7 << 3), (1) << 3);
+        if (wlc_lcnphy_tssi_based_pwr_ctrl_enabled(pi))
+                wlc_lcnphy_tssi_setup(pi);
 }
 
 void wlc_phy_detach_lcnphy(struct brcms_phy *pi)
@@ -4993,8 +5093,7 @@ bool wlc_phy_attach_lcnphy(struct brcms_phy *pi)
         if (!wlc_phy_txpwr_srom_read_lcnphy(pi))
                 return false;
 
-        if ((pi->sh->boardflags & BFL_FEM) &&
-            (LCNREV_IS(pi->pubpi.phy_rev, 1))) {
+        if (LCNREV_IS(pi->pubpi.phy_rev, 1)) {
                 if (pi_lcn->lcnphy_tempsense_option == 3) {
                         pi->hwpwrctrl = true;
                         pi->hwpwrctrl_capable = true;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
index 622c01ca72c5..d7fa312214f3 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
@@ -1507,117 +1507,103 @@ static const u32 dot11lcn_gain_tbl_5G[] = {
 
 const struct phytbl_info dot11lcnphytbl_rx_gain_info_rev0[] = {
         {&dot11lcn_gain_tbl_rev0,
-         sizeof(dot11lcn_gain_tbl_rev0) / sizeof(dot11lcn_gain_tbl_rev0[0]), 18,
+         ARRAY_SIZE(dot11lcn_gain_tbl_rev0), 18,
          0, 32}
         ,
         {&dot11lcn_aux_gain_idx_tbl_rev0,
-         sizeof(dot11lcn_aux_gain_idx_tbl_rev0) /
-         sizeof(dot11lcn_aux_gain_idx_tbl_rev0[0]), 14, 0, 16}
+         ARRAY_SIZE(dot11lcn_aux_gain_idx_tbl_rev0), 14, 0, 16}
         ,
         {&dot11lcn_gain_idx_tbl_rev0,
-         sizeof(dot11lcn_gain_idx_tbl_rev0) /
-         sizeof(dot11lcn_gain_idx_tbl_rev0[0]), 13, 0, 32}
+         ARRAY_SIZE(dot11lcn_gain_idx_tbl_rev0), 13, 0, 32}
         ,
 };
 
 static const struct phytbl_info dot11lcnphytbl_rx_gain_info_rev1[] = {
         {&dot11lcn_gain_tbl_rev1,
-         sizeof(dot11lcn_gain_tbl_rev1) / sizeof(dot11lcn_gain_tbl_rev1[0]), 18,
+         ARRAY_SIZE(dot11lcn_gain_tbl_rev1), 18,
          0, 32}
         ,
         {&dot11lcn_aux_gain_idx_tbl_rev0,
-         sizeof(dot11lcn_aux_gain_idx_tbl_rev0) /
-         sizeof(dot11lcn_aux_gain_idx_tbl_rev0[0]), 14, 0, 16}
+         ARRAY_SIZE(dot11lcn_aux_gain_idx_tbl_rev0), 14, 0, 16}
         ,
         {&dot11lcn_gain_idx_tbl_rev0,
-         sizeof(dot11lcn_gain_idx_tbl_rev0) /
-         sizeof(dot11lcn_gain_idx_tbl_rev0[0]), 13, 0, 32}
+         ARRAY_SIZE(dot11lcn_gain_idx_tbl_rev0), 13, 0, 32}
         ,
 };
 
 const struct phytbl_info dot11lcnphytbl_rx_gain_info_2G_rev2[] = {
         {&dot11lcn_gain_tbl_2G,
-         sizeof(dot11lcn_gain_tbl_2G) / sizeof(dot11lcn_gain_tbl_2G[0]), 18, 0,
+         ARRAY_SIZE(dot11lcn_gain_tbl_2G), 18, 0,
          32}
         ,
         {&dot11lcn_aux_gain_idx_tbl_2G,
-         sizeof(dot11lcn_aux_gain_idx_tbl_2G) /
-         sizeof(dot11lcn_aux_gain_idx_tbl_2G[0]), 14, 0, 16}
+         ARRAY_SIZE(dot11lcn_aux_gain_idx_tbl_2G), 14, 0, 16}
         ,
         {&dot11lcn_gain_idx_tbl_2G,
-         sizeof(dot11lcn_gain_idx_tbl_2G) / sizeof(dot11lcn_gain_idx_tbl_2G[0]),
+         ARRAY_SIZE(dot11lcn_gain_idx_tbl_2G),
          13, 0, 32}
         ,
         {&dot11lcn_gain_val_tbl_2G,
-         sizeof(dot11lcn_gain_val_tbl_2G) / sizeof(dot11lcn_gain_val_tbl_2G[0]),
+         ARRAY_SIZE(dot11lcn_gain_val_tbl_2G),
          17, 0, 8}
 };
 
 const struct phytbl_info dot11lcnphytbl_rx_gain_info_5G_rev2[] = {
         {&dot11lcn_gain_tbl_5G,
-         sizeof(dot11lcn_gain_tbl_5G) / sizeof(dot11lcn_gain_tbl_5G[0]), 18, 0,
+         ARRAY_SIZE(dot11lcn_gain_tbl_5G), 18, 0,
          32}
         ,
         {&dot11lcn_aux_gain_idx_tbl_5G,
-         sizeof(dot11lcn_aux_gain_idx_tbl_5G) /
-         sizeof(dot11lcn_aux_gain_idx_tbl_5G[0]), 14, 0, 16}
+         ARRAY_SIZE(dot11lcn_aux_gain_idx_tbl_5G), 14, 0, 16}
         ,
         {&dot11lcn_gain_idx_tbl_5G,
-         sizeof(dot11lcn_gain_idx_tbl_5G) / sizeof(dot11lcn_gain_idx_tbl_5G[0]),
+         ARRAY_SIZE(dot11lcn_gain_idx_tbl_5G),
          13, 0, 32}
         ,
         {&dot11lcn_gain_val_tbl_5G,
-         sizeof(dot11lcn_gain_val_tbl_5G) / sizeof(dot11lcn_gain_val_tbl_5G[0]),
+         ARRAY_SIZE(dot11lcn_gain_val_tbl_5G),
          17, 0, 8}
 };
 
 const struct phytbl_info dot11lcnphytbl_rx_gain_info_extlna_2G_rev2[] = {
         {&dot11lcn_gain_tbl_extlna_2G,
-         sizeof(dot11lcn_gain_tbl_extlna_2G) /
-         sizeof(dot11lcn_gain_tbl_extlna_2G[0]), 18, 0, 32}
+         ARRAY_SIZE(dot11lcn_gain_tbl_extlna_2G), 18, 0, 32}
         ,
         {&dot11lcn_aux_gain_idx_tbl_extlna_2G,
-         sizeof(dot11lcn_aux_gain_idx_tbl_extlna_2G) /
-         sizeof(dot11lcn_aux_gain_idx_tbl_extlna_2G[0]), 14, 0, 16}
+         ARRAY_SIZE(dot11lcn_aux_gain_idx_tbl_extlna_2G), 14, 0, 16}
         ,
         {&dot11lcn_gain_idx_tbl_extlna_2G,
-         sizeof(dot11lcn_gain_idx_tbl_extlna_2G) /
-         sizeof(dot11lcn_gain_idx_tbl_extlna_2G[0]), 13, 0, 32}
+         ARRAY_SIZE(dot11lcn_gain_idx_tbl_extlna_2G), 13, 0, 32}
         ,
         {&dot11lcn_gain_val_tbl_extlna_2G,
-         sizeof(dot11lcn_gain_val_tbl_extlna_2G) /
-         sizeof(dot11lcn_gain_val_tbl_extlna_2G[0]), 17, 0, 8}
+         ARRAY_SIZE(dot11lcn_gain_val_tbl_extlna_2G), 17, 0, 8}
 };
 
 const struct phytbl_info dot11lcnphytbl_rx_gain_info_extlna_5G_rev2[] = {
         {&dot11lcn_gain_tbl_5G,
-         sizeof(dot11lcn_gain_tbl_5G) / sizeof(dot11lcn_gain_tbl_5G[0]), 18, 0,
+         ARRAY_SIZE(dot11lcn_gain_tbl_5G), 18, 0,
          32}
         ,
         {&dot11lcn_aux_gain_idx_tbl_5G,
-         sizeof(dot11lcn_aux_gain_idx_tbl_5G) /
-         sizeof(dot11lcn_aux_gain_idx_tbl_5G[0]), 14, 0, 16}
+         ARRAY_SIZE(dot11lcn_aux_gain_idx_tbl_5G), 14, 0, 16}
         ,
         {&dot11lcn_gain_idx_tbl_5G,
-         sizeof(dot11lcn_gain_idx_tbl_5G) / sizeof(dot11lcn_gain_idx_tbl_5G[0]),
+         ARRAY_SIZE(dot11lcn_gain_idx_tbl_5G),
          13, 0, 32}
         ,
         {&dot11lcn_gain_val_tbl_5G,
-         sizeof(dot11lcn_gain_val_tbl_5G) / sizeof(dot11lcn_gain_val_tbl_5G[0]),
+         ARRAY_SIZE(dot11lcn_gain_val_tbl_5G),
          17, 0, 8}
 };
 
 const u32 dot11lcnphytbl_rx_gain_info_sz_rev0 =
-        sizeof(dot11lcnphytbl_rx_gain_info_rev0) /
-        sizeof(dot11lcnphytbl_rx_gain_info_rev0[0]);
+        ARRAY_SIZE(dot11lcnphytbl_rx_gain_info_rev0);
 
 const u32 dot11lcnphytbl_rx_gain_info_2G_rev2_sz =
-        sizeof(dot11lcnphytbl_rx_gain_info_2G_rev2) /
-        sizeof(dot11lcnphytbl_rx_gain_info_2G_rev2[0]);
+        ARRAY_SIZE(dot11lcnphytbl_rx_gain_info_2G_rev2);
 
 const u32 dot11lcnphytbl_rx_gain_info_5G_rev2_sz =
-        sizeof(dot11lcnphytbl_rx_gain_info_5G_rev2) /
-        sizeof(dot11lcnphytbl_rx_gain_info_5G_rev2[0]);
+        ARRAY_SIZE(dot11lcnphytbl_rx_gain_info_5G_rev2);
 
 static const u16 dot11lcn_min_sig_sq_tbl_rev0[] = {
         0x014d,
@@ -2058,6 +2044,73 @@ static const u16 dot11lcn_sw_ctrl_tbl_4313_rev0[] = {
         0x0005,
 };
 
+static const u16 dot11lcn_sw_ctrl_tbl_4313_ipa_rev0_combo[] = {
+        0x0005,
+        0x0006,
+        0x0009,
+        0x000a,
+        0x0005,
+        0x0006,
+        0x0009,
+        0x000a,
+        0x0005,
+        0x0006,
+        0x0009,
+        0x000a,
+        0x0005,
+        0x0006,
+        0x0009,
+        0x000a,
+        0x0005,
+        0x0006,
+        0x0009,
+        0x000a,
+        0x0005,
+        0x0006,
+        0x0009,
+        0x000a,
+        0x0005,
+        0x0006,
+        0x0009,
+        0x000a,
+        0x0005,
+        0x0006,
+        0x0009,
+        0x000a,
+        0x0005,
+        0x0006,
+        0x0009,
+        0x000a,
+        0x0005,
+        0x0006,
+        0x0009,
+        0x000a,
+        0x0005,
+        0x0006,
+        0x0009,
+        0x000a,
+        0x0005,
+        0x0006,
+        0x0009,
+        0x000a,
+        0x0005,
+        0x0006,
+        0x0009,
+        0x000a,
+        0x0005,
+        0x0006,
+        0x0009,
+        0x000a,
+        0x0005,
+        0x0006,
+        0x0009,
+        0x000a,
+        0x0005,
+        0x0006,
+        0x0009,
+        0x000a,
+};
+
 static const u16 dot11lcn_sw_ctrl_tbl_rev0[] = {
         0x0004,
         0x0004,
@@ -2771,89 +2824,79 @@ static const u32 dot11lcn_papd_compdelta_tbl_rev0[] = {
 
 const struct phytbl_info dot11lcnphytbl_info_rev0[] = {
         {&dot11lcn_min_sig_sq_tbl_rev0,
-         sizeof(dot11lcn_min_sig_sq_tbl_rev0) /
-         sizeof(dot11lcn_min_sig_sq_tbl_rev0[0]), 2, 0, 16}
+         ARRAY_SIZE(dot11lcn_min_sig_sq_tbl_rev0), 2, 0, 16}
         ,
         {&dot11lcn_noise_scale_tbl_rev0,
-         sizeof(dot11lcn_noise_scale_tbl_rev0) /
-         sizeof(dot11lcn_noise_scale_tbl_rev0[0]), 1, 0, 16}
+         ARRAY_SIZE(dot11lcn_noise_scale_tbl_rev0), 1, 0, 16}
         ,
         {&dot11lcn_fltr_ctrl_tbl_rev0,
-         sizeof(dot11lcn_fltr_ctrl_tbl_rev0) /
-         sizeof(dot11lcn_fltr_ctrl_tbl_rev0[0]), 11, 0, 32}
+         ARRAY_SIZE(dot11lcn_fltr_ctrl_tbl_rev0), 11, 0, 32}
         ,
         {&dot11lcn_ps_ctrl_tbl_rev0,
-         sizeof(dot11lcn_ps_ctrl_tbl_rev0) /
-         sizeof(dot11lcn_ps_ctrl_tbl_rev0[0]), 12, 0, 32}
+         ARRAY_SIZE(dot11lcn_ps_ctrl_tbl_rev0), 12, 0, 32}
         ,
         {&dot11lcn_gain_idx_tbl_rev0,
-         sizeof(dot11lcn_gain_idx_tbl_rev0) /
-         sizeof(dot11lcn_gain_idx_tbl_rev0[0]), 13, 0, 32}
+         ARRAY_SIZE(dot11lcn_gain_idx_tbl_rev0), 13, 0, 32}
         ,
         {&dot11lcn_aux_gain_idx_tbl_rev0,
-         sizeof(dot11lcn_aux_gain_idx_tbl_rev0) /
-         sizeof(dot11lcn_aux_gain_idx_tbl_rev0[0]), 14, 0, 16}
+         ARRAY_SIZE(dot11lcn_aux_gain_idx_tbl_rev0), 14, 0, 16}
         ,
         {&dot11lcn_sw_ctrl_tbl_rev0,
-         sizeof(dot11lcn_sw_ctrl_tbl_rev0) /
-         sizeof(dot11lcn_sw_ctrl_tbl_rev0[0]), 15, 0, 16}
+         ARRAY_SIZE(dot11lcn_sw_ctrl_tbl_rev0), 15, 0, 16}
         ,
         {&dot11lcn_nf_table_rev0,
-         sizeof(dot11lcn_nf_table_rev0) / sizeof(dot11lcn_nf_table_rev0[0]), 16,
+         ARRAY_SIZE(dot11lcn_nf_table_rev0), 16,
          0, 8}
         ,
         {&dot11lcn_gain_val_tbl_rev0,
-         sizeof(dot11lcn_gain_val_tbl_rev0) /
-         sizeof(dot11lcn_gain_val_tbl_rev0[0]), 17, 0, 8}
+         ARRAY_SIZE(dot11lcn_gain_val_tbl_rev0), 17, 0, 8}
         ,
         {&dot11lcn_gain_tbl_rev0,
-         sizeof(dot11lcn_gain_tbl_rev0) / sizeof(dot11lcn_gain_tbl_rev0[0]), 18,
+         ARRAY_SIZE(dot11lcn_gain_tbl_rev0), 18,
          0, 32}
         ,
         {&dot11lcn_spur_tbl_rev0,
-         sizeof(dot11lcn_spur_tbl_rev0) / sizeof(dot11lcn_spur_tbl_rev0[0]), 20,
+         ARRAY_SIZE(dot11lcn_spur_tbl_rev0), 20,
          0, 8}
         ,
         {&dot11lcn_unsup_mcs_tbl_rev0,
-         sizeof(dot11lcn_unsup_mcs_tbl_rev0) /
-         sizeof(dot11lcn_unsup_mcs_tbl_rev0[0]), 23, 0, 16}
+         ARRAY_SIZE(dot11lcn_unsup_mcs_tbl_rev0), 23, 0, 16}
         ,
         {&dot11lcn_iq_local_tbl_rev0,
-         sizeof(dot11lcn_iq_local_tbl_rev0) /
-         sizeof(dot11lcn_iq_local_tbl_rev0[0]), 0, 0, 16}
+         ARRAY_SIZE(dot11lcn_iq_local_tbl_rev0), 0, 0, 16}
         ,
         {&dot11lcn_papd_compdelta_tbl_rev0,
-         sizeof(dot11lcn_papd_compdelta_tbl_rev0) /
-         sizeof(dot11lcn_papd_compdelta_tbl_rev0[0]), 24, 0, 32}
+         ARRAY_SIZE(dot11lcn_papd_compdelta_tbl_rev0), 24, 0, 32}
         ,
 };
 
 const struct phytbl_info dot11lcn_sw_ctrl_tbl_info_4313 = {
         &dot11lcn_sw_ctrl_tbl_4313_rev0,
-        sizeof(dot11lcn_sw_ctrl_tbl_4313_rev0) /
-        sizeof(dot11lcn_sw_ctrl_tbl_4313_rev0[0]), 15, 0, 16
+        ARRAY_SIZE(dot11lcn_sw_ctrl_tbl_4313_rev0), 15, 0, 16
+};
+
+const struct phytbl_info dot11lcn_sw_ctrl_tbl_info_4313_bt_ipa = {
+        &dot11lcn_sw_ctrl_tbl_4313_ipa_rev0_combo,
+        ARRAY_SIZE(dot11lcn_sw_ctrl_tbl_4313_ipa_rev0_combo), 15, 0, 16
 };
 
 const struct phytbl_info dot11lcn_sw_ctrl_tbl_info_4313_epa = {
         &dot11lcn_sw_ctrl_tbl_4313_epa_rev0,
-        sizeof(dot11lcn_sw_ctrl_tbl_4313_epa_rev0) /
-        sizeof(dot11lcn_sw_ctrl_tbl_4313_epa_rev0[0]), 15, 0, 16
+        ARRAY_SIZE(dot11lcn_sw_ctrl_tbl_4313_epa_rev0), 15, 0, 16
 };
 
 const struct phytbl_info dot11lcn_sw_ctrl_tbl_info_4313_bt_epa = {
         &dot11lcn_sw_ctrl_tbl_4313_epa_rev0_combo,
-        sizeof(dot11lcn_sw_ctrl_tbl_4313_epa_rev0_combo) /
-        sizeof(dot11lcn_sw_ctrl_tbl_4313_epa_rev0_combo[0]), 15, 0, 16
+        ARRAY_SIZE(dot11lcn_sw_ctrl_tbl_4313_epa_rev0_combo), 15, 0, 16
 };
 
 const struct phytbl_info dot11lcn_sw_ctrl_tbl_info_4313_bt_epa_p250 = {
         &dot11lcn_sw_ctrl_tbl_4313_bt_epa_p250_rev0,
-        sizeof(dot11lcn_sw_ctrl_tbl_4313_bt_epa_p250_rev0) /
-        sizeof(dot11lcn_sw_ctrl_tbl_4313_bt_epa_p250_rev0[0]), 15, 0, 16
+        ARRAY_SIZE(dot11lcn_sw_ctrl_tbl_4313_bt_epa_p250_rev0), 15, 0, 16
 };
 
 const u32 dot11lcnphytbl_info_sz_rev0 =
-        sizeof(dot11lcnphytbl_info_rev0) / sizeof(dot11lcnphytbl_info_rev0[0]);
+        ARRAY_SIZE(dot11lcnphytbl_info_rev0);
 
 const struct lcnphy_tx_gain_tbl_entry
 dot11lcnphy_2GHz_extPA_gaintable_rev0[128] = {
@@ -2988,134 +3031,134 @@ dot11lcnphy_2GHz_extPA_gaintable_rev0[128] = {
 };
 
 const struct lcnphy_tx_gain_tbl_entry dot11lcnphy_2GHz_gaintable_rev0[128] = {
-        {7, 0, 31, 0, 72},
-        {7, 0, 31, 0, 70},
-        {7, 0, 31, 0, 68},
-        {7, 0, 30, 0, 67},
-        {7, 0, 29, 0, 68},
-        {7, 0, 28, 0, 68},
-        {7, 0, 27, 0, 69},
-        {7, 0, 26, 0, 70},
-        {7, 0, 25, 0, 70},
-        {7, 0, 24, 0, 71},
-        {7, 0, 23, 0, 72},
-        {7, 0, 23, 0, 70},
-        {7, 0, 22, 0, 71},
-        {7, 0, 21, 0, 72},
-        {7, 0, 21, 0, 70},
-        {7, 0, 21, 0, 68},
-        {7, 0, 21, 0, 66},
-        {7, 0, 21, 0, 64},
-        {7, 0, 21, 0, 63},
-        {7, 0, 20, 0, 64},
-        {7, 0, 19, 0, 65},
-        {7, 0, 19, 0, 64},
-        {7, 0, 18, 0, 65},
-        {7, 0, 18, 0, 64},
-        {7, 0, 17, 0, 65},
-        {7, 0, 17, 0, 64},
-        {7, 0, 16, 0, 65},
-        {7, 0, 16, 0, 64},
-        {7, 0, 16, 0, 62},
-        {7, 0, 16, 0, 60},
-        {7, 0, 16, 0, 58},
-        {7, 0, 15, 0, 61},
-        {7, 0, 15, 0, 59},
-        {7, 0, 14, 0, 61},
-        {7, 0, 14, 0, 60},
-        {7, 0, 14, 0, 58},
-        {7, 0, 13, 0, 60},
-        {7, 0, 13, 0, 59},
-        {7, 0, 12, 0, 62},
-        {7, 0, 12, 0, 60},
-        {7, 0, 12, 0, 58},
-        {7, 0, 11, 0, 62},
-        {7, 0, 11, 0, 60},
-        {7, 0, 11, 0, 59},
-        {7, 0, 11, 0, 57},
-        {7, 0, 10, 0, 61},
-        {7, 0, 10, 0, 59},
-        {7, 0, 10, 0, 57},
-        {7, 0, 9, 0, 62},
-        {7, 0, 9, 0, 60},
-        {7, 0, 9, 0, 58},
-        {7, 0, 9, 0, 57},
-        {7, 0, 8, 0, 62},
-        {7, 0, 8, 0, 60},
-        {7, 0, 8, 0, 58},
-        {7, 0, 8, 0, 57},
-        {7, 0, 8, 0, 55},
-        {7, 0, 7, 0, 61},
+        {15, 0, 31, 0, 72},
+        {15, 0, 31, 0, 70},
+        {15, 0, 31, 0, 68},
+        {15, 0, 30, 0, 68},
+        {15, 0, 29, 0, 69},
+        {15, 0, 28, 0, 69},
+        {15, 0, 27, 0, 70},
+        {15, 0, 26, 0, 70},
+        {15, 0, 25, 0, 71},
+        {15, 0, 24, 0, 72},
+        {15, 0, 23, 0, 73},
+        {15, 0, 23, 0, 71},
+        {15, 0, 22, 0, 72},
+        {15, 0, 21, 0, 73},
+        {15, 0, 21, 0, 71},
+        {15, 0, 21, 0, 69},
+        {15, 0, 21, 0, 67},
+        {15, 0, 21, 0, 65},
+        {15, 0, 21, 0, 63},
+        {15, 0, 20, 0, 65},
+        {15, 0, 19, 0, 66},
+        {15, 0, 19, 0, 64},
+        {15, 0, 18, 0, 66},
+        {15, 0, 18, 0, 64},
+        {15, 0, 17, 0, 66},
+        {15, 0, 17, 0, 64},
+        {15, 0, 16, 0, 66},
+        {15, 0, 16, 0, 64},
+        {15, 0, 16, 0, 62},
+        {15, 0, 16, 0, 61},
+        {15, 0, 16, 0, 59},
+        {15, 0, 15, 0, 61},
+        {15, 0, 15, 0, 59},
+        {15, 0, 14, 0, 62},
+        {15, 0, 14, 0, 60},
+        {15, 0, 14, 0, 58},
+        {15, 0, 13, 0, 61},
+        {15, 0, 13, 0, 59},
+        {15, 0, 12, 0, 62},
+        {15, 0, 12, 0, 61},
+        {15, 0, 12, 0, 59},
+        {15, 0, 11, 0, 62},
+        {15, 0, 11, 0, 61},
+        {15, 0, 11, 0, 59},
+        {15, 0, 11, 0, 57},
+        {15, 0, 10, 0, 61},
+        {15, 0, 10, 0, 59},
+        {15, 0, 10, 0, 58},
+        {15, 0, 9, 0, 62},
+        {15, 0, 9, 0, 61},
+        {15, 0, 9, 0, 59},
+        {15, 0, 9, 0, 57},
+        {15, 0, 8, 0, 62},
+        {15, 0, 8, 0, 61},
+        {15, 0, 8, 0, 59},
+        {15, 0, 8, 0, 57},
+        {15, 0, 8, 0, 56},
+        {15, 0, 8, 0, 54},
+        {15, 0, 8, 0, 53},
+        {15, 0, 8, 0, 51},
+        {15, 0, 8, 0, 50},
+        {7, 0, 7, 0, 69},
+        {7, 0, 7, 0, 67},
+        {7, 0, 7, 0, 65},
+        {7, 0, 7, 0, 64},
+        {7, 0, 7, 0, 62},
         {7, 0, 7, 0, 60},
         {7, 0, 7, 0, 58},
-        {7, 0, 7, 0, 56},
+        {7, 0, 7, 0, 57},
         {7, 0, 7, 0, 55},
         {7, 0, 6, 0, 62},
-        {7, 0, 6, 0, 60},
-        {7, 0, 6, 0, 58},
+        {7, 0, 6, 0, 61},
+        {7, 0, 6, 0, 59},
         {7, 0, 6, 0, 57},
-        {7, 0, 6, 0, 55},
+        {7, 0, 6, 0, 56},
         {7, 0, 6, 0, 54},
-        {7, 0, 6, 0, 52},
+        {7, 0, 6, 0, 53},
         {7, 0, 5, 0, 61},
-        {7, 0, 5, 0, 59},
-        {7, 0, 5, 0, 57},
+        {7, 0, 5, 0, 60},
+        {7, 0, 5, 0, 58},
         {7, 0, 5, 0, 56},
-        {7, 0, 5, 0, 54},
+        {7, 0, 5, 0, 55},
         {7, 0, 5, 0, 53},
-        {7, 0, 5, 0, 51},
-        {7, 0, 4, 0, 62},
-        {7, 0, 4, 0, 60},
-        {7, 0, 4, 0, 58},
+        {7, 0, 5, 0, 52},
+        {7, 0, 5, 0, 50},
+        {7, 0, 5, 0, 49},
+        {7, 0, 5, 0, 47},
         {7, 0, 4, 0, 57},
-        {7, 0, 4, 0, 55},
+        {7, 0, 4, 0, 56},
         {7, 0, 4, 0, 54},
-        {7, 0, 4, 0, 52},
+        {7, 0, 4, 0, 53},
         {7, 0, 4, 0, 51},
-        {7, 0, 4, 0, 49},
+        {7, 0, 4, 0, 50},
         {7, 0, 4, 0, 48},
+        {7, 0, 4, 0, 47},
         {7, 0, 4, 0, 46},
-        {7, 0, 3, 0, 60},
-        {7, 0, 3, 0, 58},
-        {7, 0, 3, 0, 57},
-        {7, 0, 3, 0, 55},
-        {7, 0, 3, 0, 54},
-        {7, 0, 3, 0, 52},
+        {7, 0, 4, 0, 44},
+        {7, 0, 4, 0, 43},
+        {7, 0, 4, 0, 42},
+        {7, 0, 4, 0, 41},
+        {7, 0, 4, 0, 40},
         {7, 0, 3, 0, 51},
-        {7, 0, 3, 0, 49},
+        {7, 0, 3, 0, 50},
         {7, 0, 3, 0, 48},
+        {7, 0, 3, 0, 47},
         {7, 0, 3, 0, 46},
-        {7, 0, 3, 0, 45},
         {7, 0, 3, 0, 44},
         {7, 0, 3, 0, 43},
+        {7, 0, 3, 0, 42},
         {7, 0, 3, 0, 41},
-        {7, 0, 2, 0, 61},
-        {7, 0, 2, 0, 59},
-        {7, 0, 2, 0, 57},
-        {7, 0, 2, 0, 56},
-        {7, 0, 2, 0, 54},
-        {7, 0, 2, 0, 53},
-        {7, 0, 2, 0, 51},
-        {7, 0, 2, 0, 50},
-        {7, 0, 2, 0, 48},
-        {7, 0, 2, 0, 47},
-        {7, 0, 2, 0, 46},
-        {7, 0, 2, 0, 44},
-        {7, 0, 2, 0, 43},
-        {7, 0, 2, 0, 42},
-        {7, 0, 2, 0, 41},
-        {7, 0, 2, 0, 39},
-        {7, 0, 2, 0, 38},
-        {7, 0, 2, 0, 37},
-        {7, 0, 2, 0, 36},
-        {7, 0, 2, 0, 35},
-        {7, 0, 2, 0, 34},
-        {7, 0, 2, 0, 33},
-        {7, 0, 2, 0, 32},
-        {7, 0, 1, 0, 63},
-        {7, 0, 1, 0, 61},
-        {7, 0, 1, 0, 59},
-        {7, 0, 1, 0, 57},
+        {3, 0, 3, 0, 56},
+        {3, 0, 3, 0, 54},
+        {3, 0, 3, 0, 53},
+        {3, 0, 3, 0, 51},
+        {3, 0, 3, 0, 50},
+        {3, 0, 3, 0, 48},
+        {3, 0, 3, 0, 47},
+        {3, 0, 3, 0, 46},
+        {3, 0, 3, 0, 44},
+        {3, 0, 3, 0, 43},
+        {3, 0, 3, 0, 42},
+        {3, 0, 3, 0, 41},
+        {3, 0, 3, 0, 39},
+        {3, 0, 3, 0, 38},
+        {3, 0, 3, 0, 37},
+        {3, 0, 3, 0, 36},
+        {3, 0, 3, 0, 35},
+        {3, 0, 3, 0, 34},
 };
 
 const struct lcnphy_tx_gain_tbl_entry dot11lcnphy_5GHz_gaintable_rev0[128] = {
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.h b/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.h
index 5f75e16bf5a7..489422a36085 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.h
@@ -20,6 +20,7 @@
 extern const struct phytbl_info dot11lcnphytbl_rx_gain_info_rev0[];
 extern const u32 dot11lcnphytbl_rx_gain_info_sz_rev0;
 extern const struct phytbl_info dot11lcn_sw_ctrl_tbl_info_4313;
+extern const struct phytbl_info dot11lcn_sw_ctrl_tbl_info_4313_bt_ipa;
 extern const struct phytbl_info dot11lcn_sw_ctrl_tbl_info_4313_epa;
 extern const struct phytbl_info dot11lcn_sw_ctrl_tbl_info_4313_epa_combo;
 extern const struct phytbl_info dot11lcn_sw_ctrl_tbl_info_4313_bt_epa;
diff --git a/drivers/net/wireless/cw1200/bh.c b/drivers/net/wireless/cw1200/bh.c
index c1ec2a4dd8c0..92d299aa257c 100644
--- a/drivers/net/wireless/cw1200/bh.c
+++ b/drivers/net/wireless/cw1200/bh.c
@@ -465,8 +465,8 @@ static int cw1200_bh(void *arg)
                                 (rx || tx || term || suspend || priv->bh_error);
                         }), status);
 
-                pr_debug("[BH] - rx: %d, tx: %d, term: %d, suspend: %d, status: %ld\n",
-                         rx, tx, term, suspend, status);
+                pr_debug("[BH] - rx: %d, tx: %d, term: %d, bh_err: %d, suspend: %d, status: %ld\n",
+                         rx, tx, term, suspend, priv->bh_error, status);
 
                 /* Did an error occur? */
                 if ((status < 0 && status != -ERESTARTSYS) ||
diff --git a/drivers/net/wireless/cw1200/main.c b/drivers/net/wireless/cw1200/main.c
index 3724e739cbf4..090f01577dd2 100644
--- a/drivers/net/wireless/cw1200/main.c
+++ b/drivers/net/wireless/cw1200/main.c
@@ -507,7 +507,7 @@ u32 cw1200_dpll_from_clk(u16 clk_khz)
         case 0xCB20: /* 52000 KHz */
                 return 0x07627091;
         default:
-                pr_err("Unknown Refclk freq (0x%04x), using 2600KHz\n",
+                pr_err("Unknown Refclk freq (0x%04x), using 26000KHz\n",
                        clk_khz);
                 return 0x0EC4F121;
         }
diff --git a/drivers/net/wireless/hostap/hostap_hw.c b/drivers/net/wireless/hostap/hostap_hw.c
index 6307a4e36c85..c275dc1623fe 100644
--- a/drivers/net/wireless/hostap/hostap_hw.c
+++ b/drivers/net/wireless/hostap/hostap_hw.c
@@ -1425,7 +1425,7 @@ static int prism2_hw_init2(struct net_device *dev, int initial)
                 }
                 list_for_each(ptr, &local->hostap_interfaces) {
                         iface = list_entry(ptr, struct hostap_interface, list);
-                        memcpy(iface->dev->dev_addr, dev->dev_addr, ETH_ALEN);
+                        eth_hw_addr_inherit(iface->dev, dev);
                 }
         } else if (local->fw_ap)
                 prism2_check_sta_fw_version(local);
diff --git a/drivers/net/wireless/hostap/hostap_main.c b/drivers/net/wireless/hostap/hostap_main.c
index e4f56ad26cd8..a1257c92afc4 100644
--- a/drivers/net/wireless/hostap/hostap_main.c
+++ b/drivers/net/wireless/hostap/hostap_main.c
@@ -66,7 +66,7 @@ struct net_device * hostap_add_interface(struct local_info *local,
         list_add(&iface->list, &local->hostap_interfaces);
 
         mdev = local->dev;
-        memcpy(dev->dev_addr, mdev->dev_addr, ETH_ALEN);
+        eth_hw_addr_inherit(dev, mdev);
         dev->base_addr = mdev->base_addr;
         dev->irq = mdev->irq;
         dev->mem_start = mdev->mem_start;
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index b411ab905284..5ab50a5b48b1 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -4470,9 +4470,9 @@ il4965_irq_tasklet(struct il_priv *il)
                         set_bit(S_RFKILL, &il->status);
                 } else {
                         clear_bit(S_RFKILL, &il->status);
-                        wiphy_rfkill_set_hw_state(il->hw->wiphy, hw_rf_kill);
                         il_force_reset(il, true);
                 }
+                wiphy_rfkill_set_hw_state(il->hw->wiphy, hw_rf_kill);
 
                 handled |= CSR_INT_BIT_RF_KILL;
         }
diff --git a/drivers/net/wireless/iwlwifi/Kconfig b/drivers/net/wireless/iwlwifi/Kconfig
index e5c133ee7901..3eb2102ce236 100644
--- a/drivers/net/wireless/iwlwifi/Kconfig
+++ b/drivers/net/wireless/iwlwifi/Kconfig
@@ -22,6 +22,8 @@ config IWLWIFI
                 Intel Wireless WiFi Link 6150BGN 2 Adapter
                 Intel 100 Series Wi-Fi Adapters (100BGN and 130BGN)
                 Intel 2000 Series Wi-Fi Adapters
+                Intel 7260 Wi-Fi Adapter
+                Intel 3160 Wi-Fi Adapter
 
 
           This driver uses the kernel's mac80211 subsystem.
@@ -46,17 +48,16 @@ config IWLDVM
         depends on IWLWIFI
         default IWLWIFI
         help
-          This is the driver supporting the DVM firmware which is
-          currently the only firmware available for existing devices.
+          This is the driver that supports the DVM firmware which is
+          used by most existing devices (with the exception of 7260
+          and 3160).
 
 config IWLMVM
         tristate "Intel Wireless WiFi MVM Firmware support"
         depends on IWLWIFI
         help
-          This is the driver supporting the MVM firmware which is
-          currently only available for 7000 series devices.
-
-          Say yes if you have such a device.
+          This is the driver that supports the MVM firmware which is
+          currently only available for 7260 and 3160 devices.
 
 # don't call it _MODULE -- will confuse Kconfig/fixdep/...
 config IWLWIFI_OPMODE_MODULAR
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index 3db0bbb1d123..da442b81370a 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -87,7 +87,7 @@ static void iwlagn_tx_cmd_build_basic(struct iwl_priv *priv,
                  priv->lib->bt_params->advanced_bt_coexist &&
                  (ieee80211_is_auth(fc) || ieee80211_is_assoc_req(fc) ||
                  ieee80211_is_reassoc_req(fc) ||
-                 skb->protocol == cpu_to_be16(ETH_P_PAE)))
+                 info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO))
                 tx_flags |= TX_CMD_FLG_IGNORE_BT;
 
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.h b/drivers/net/wireless/iwlwifi/iwl-debug.h
index 7edb8519c8a4..b2bb32a781dd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debug.h
+++ b/drivers/net/wireless/iwlwifi/iwl-debug.h
@@ -145,6 +145,7 @@ do {                                            			\
 #define IWL_DL_RX               0x01000000
 #define IWL_DL_ISR              0x02000000
 #define IWL_DL_HT               0x04000000
+#define IWL_DL_EXTERNAL         0x08000000
 /* 0xF0000000 - 0x10000000 */
 #define IWL_DL_11H              0x10000000
 #define IWL_DL_STATS            0x20000000
@@ -153,6 +154,7 @@ do {                                            			\
 
 #define IWL_DEBUG_INFO(p, f, a...)      IWL_DEBUG(p, IWL_DL_INFO, f, ## a)
 #define IWL_DEBUG_MAC80211(p, f, a...)  IWL_DEBUG(p, IWL_DL_MAC80211, f, ## a)
+#define IWL_DEBUG_EXTERNAL(p, f, a...)  IWL_DEBUG(p, IWL_DL_EXTERNAL, f, ## a)
 #define IWL_DEBUG_TEMP(p, f, a...)      IWL_DEBUG(p, IWL_DL_TEMP, f, ## a)
 #define IWL_DEBUG_SCAN(p, f, a...)      IWL_DEBUG(p, IWL_DL_SCAN, f, ## a)
 #define IWL_DEBUG_RX(p, f, a...)        IWL_DEBUG(p, IWL_DL_RX, f, ## a)
diff --git a/drivers/net/wireless/iwlwifi/iwl-devtrace.h b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
index 4491c1c72cc7..684c416d3493 100644
--- a/drivers/net/wireless/iwlwifi/iwl-devtrace.h
+++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
@@ -33,10 +33,11 @@
 static inline bool iwl_trace_data(struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr = (void *)skb->data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
-        if (ieee80211_is_data(hdr->frame_control))
-                return skb->protocol != cpu_to_be16(ETH_P_PAE);
-        return false;
+        if (!ieee80211_is_data(hdr->frame_control))
+                return false;
+        return !(info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO);
 }
 
 static inline size_t iwl_rx_trace_len(const struct iwl_trans *trans,
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index d0162d426f88..99e1da3123c9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -843,7 +843,7 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
         int i;
         bool load_module = false;
 
-        fw->ucode_capa.max_probe_length = 200;
+        fw->ucode_capa.max_probe_length = IWL_DEFAULT_MAX_PROBE_LENGTH;
         fw->ucode_capa.standard_phy_calibration_size =
                         IWL_DEFAULT_STANDARD_PHY_CALIBRATE_TBL_SIZE;
 
@@ -1032,8 +1032,10 @@ struct iwl_drv *iwl_drv_start(struct iwl_trans *trans,
         int ret;
 
         drv = kzalloc(sizeof(*drv), GFP_KERNEL);
-        if (!drv)
-                return NULL;
+        if (!drv) {
+                ret = -ENOMEM;
+                goto err;
+        }
 
         drv->trans = trans;
         drv->dev = trans->dev;
@@ -1078,7 +1080,7 @@ err_free_dbgfs:
 err_free_drv:
 #endif
         kfree(drv);
-
+err:
         return ERR_PTR(ret);
 }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw.h b/drivers/net/wireless/iwlwifi/iwl-fw.h
index bd335f0c40d1..a1223680bc70 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw.h
@@ -76,6 +76,7 @@
  * @IWL_UCODE_TLV_FLAGS_DW_BC_TABLE: The SCD byte count table is in DWORDS
  * @IWL_UCODE_TLV_FLAGS_UAPSD: This uCode image supports uAPSD
  * @IWL_UCODE_TLV_FLAGS_RX_ENERGY_API: supports rx signal strength api
+ * @IWL_UCODE_TLV_FLAGS_TIME_EVENT_API_V2: using the new time event API.
  * @IWL_UCODE_TLV_FLAGS_D3_6_IPV6_ADDRS: D3 image supports up to six
  *      (rather than two) IPv6 addresses
  * @IWL_UCODE_TLV_FLAGS_BF_UPDATED: new beacon filtering API
@@ -88,6 +89,7 @@ enum iwl_ucode_tlv_flag {
         IWL_UCODE_TLV_FLAGS_DW_BC_TABLE         = BIT(4),
         IWL_UCODE_TLV_FLAGS_UAPSD               = BIT(6),
         IWL_UCODE_TLV_FLAGS_RX_ENERGY_API       = BIT(8),
+        IWL_UCODE_TLV_FLAGS_TIME_EVENT_API_V2   = BIT(9),
         IWL_UCODE_TLV_FLAGS_D3_6_IPV6_ADDRS     = BIT(10),
         IWL_UCODE_TLV_FLAGS_BF_UPDATED          = BIT(11),
 };
@@ -97,6 +99,9 @@ enum iwl_ucode_tlv_flag {
 #define IWL_MAX_STANDARD_PHY_CALIBRATE_TBL_SIZE         19
 #define IWL_MAX_PHY_CALIBRATE_TBL_SIZE                  253
 
+/* The default max probe length if not specified by the firmware file */
+#define IWL_DEFAULT_MAX_PROBE_LENGTH    200
+
 /**
  * enum iwl_ucode_type
  *
diff --git a/drivers/net/wireless/iwlwifi/mvm/constants.h b/drivers/net/wireless/iwlwifi/mvm/constants.h
index 64656e0c8f91..2bf29f7992ee 100644
--- a/drivers/net/wireless/iwlwifi/mvm/constants.h
+++ b/drivers/net/wireless/iwlwifi/mvm/constants.h
@@ -67,5 +67,14 @@
 #define IWL_MVM_DEFAULT_PS_RX_DATA_TIMEOUT      (100 * USEC_PER_MSEC)
 #define IWL_MVM_WOWLAN_PS_TX_DATA_TIMEOUT       (10 * USEC_PER_MSEC)
 #define IWL_MVM_WOWLAN_PS_RX_DATA_TIMEOUT       (10 * USEC_PER_MSEC)
+#define IWL_MVM_UAPSD_RX_DATA_TIMEOUT           (50 * USEC_PER_MSEC)
+#define IWL_MVM_UAPSD_TX_DATA_TIMEOUT           (50 * USEC_PER_MSEC)
+#define IWL_MVM_PS_HEAVY_TX_THLD_PACKETS        20
+#define IWL_MVM_PS_HEAVY_RX_THLD_PACKETS        20
+#define IWL_MVM_PS_HEAVY_TX_THLD_PERCENT        50
+#define IWL_MVM_PS_HEAVY_RX_THLD_PERCENT        50
+#define IWL_MVM_PS_SNOOZE_INTERVAL              25
+#define IWL_MVM_PS_SNOOZE_WINDOW                50
+#define IWL_MVM_WOWLAN_PS_SNOOZE_WINDOW         25
 
 #endif /* __MVM_CONSTANTS_H */
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index d0d7a20266e6..417639f77b01 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -1109,73 +1109,16 @@ int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
         return __iwl_mvm_suspend(hw, wowlan, false);
 }
 
-static void iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
-                                         struct ieee80211_vif *vif)
+static void iwl_mvm_report_wakeup_reasons(struct iwl_mvm *mvm,
+                                          struct ieee80211_vif *vif,
+                                          struct iwl_wowlan_status *status)
 {
-        u32 base = mvm->error_event_table;
-        struct error_table_start {
-                /* cf. struct iwl_error_event_table */
-                u32 valid;
-                u32 error_id;
-        } err_info;
+        struct sk_buff *pkt = NULL;
         struct cfg80211_wowlan_wakeup wakeup = {
                 .pattern_idx = -1,
         };
         struct cfg80211_wowlan_wakeup *wakeup_report = &wakeup;
-        struct iwl_host_cmd cmd = {
-                .id = WOWLAN_GET_STATUSES,
-                .flags = CMD_SYNC | CMD_WANT_SKB,
-        };
-        struct iwl_wowlan_status *status;
-        u32 reasons;
-        int ret, len;
-        struct sk_buff *pkt = NULL;
-
-        iwl_trans_read_mem_bytes(mvm->trans, base,
-                                 &err_info, sizeof(err_info));
-
-        if (err_info.valid) {
-                IWL_INFO(mvm, "error table is valid (%d)\n",
-                         err_info.valid);
-                if (err_info.error_id == RF_KILL_INDICATOR_FOR_WOWLAN) {
-                        wakeup.rfkill_release = true;
-                        ieee80211_report_wowlan_wakeup(vif, &wakeup,
-                                                       GFP_KERNEL);
-                }
-                return;
-        }
-
-        /* only for tracing for now */
-        ret = iwl_mvm_send_cmd_pdu(mvm, OFFLOADS_QUERY_CMD, CMD_SYNC, 0, NULL);
-        if (ret)
-                IWL_ERR(mvm, "failed to query offload statistics (%d)\n", ret);
-
-        ret = iwl_mvm_send_cmd(mvm, &cmd);
-        if (ret) {
-                IWL_ERR(mvm, "failed to query status (%d)\n", ret);
-                return;
-        }
-
-        /* RF-kill already asserted again... */
-        if (!cmd.resp_pkt)
-                return;
-
-        len = le32_to_cpu(cmd.resp_pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
-        if (len - sizeof(struct iwl_cmd_header) < sizeof(*status)) {
-                IWL_ERR(mvm, "Invalid WoWLAN status response!\n");
-                goto out;
-        }
-
-        status = (void *)cmd.resp_pkt->data;
-
-        if (len - sizeof(struct iwl_cmd_header) !=
-            sizeof(*status) +
-            ALIGN(le32_to_cpu(status->wake_packet_bufsize), 4)) {
-                IWL_ERR(mvm, "Invalid WoWLAN status response!\n");
-                goto out;
-        }
-
-        reasons = le32_to_cpu(status->wakeup_reasons);
+        u32 reasons = le32_to_cpu(status->wakeup_reasons);
 
         if (reasons == IWL_WOWLAN_WAKEUP_BY_NON_WIRELESS) {
                 wakeup_report = NULL;
@@ -1238,6 +1181,12 @@ static void iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
                         pktsize -= hdrlen;
 
                         if (ieee80211_has_protected(hdr->frame_control)) {
+                                /*
+                                 * This is unlocked and using gtk_i(c)vlen,
+                                 * but since everything is under RTNL still
+                                 * that's not really a problem - changing
+                                 * it would be difficult.
+                                 */
                                 if (is_multicast_ether_addr(hdr->addr1)) {
                                         ivlen = mvm->gtk_ivlen;
                                         icvlen += mvm->gtk_icvlen;
@@ -1288,9 +1237,82 @@ static void iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
  report:
         ieee80211_report_wowlan_wakeup(vif, wakeup_report, GFP_KERNEL);
         kfree_skb(pkt);
+}
 
- out:
+/* releases the MVM mutex */
+static void iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
+                                         struct ieee80211_vif *vif)
+{
+        u32 base = mvm->error_event_table;
+        struct error_table_start {
+                /* cf. struct iwl_error_event_table */
+                u32 valid;
+                u32 error_id;
+        } err_info;
+        struct iwl_host_cmd cmd = {
+                .id = WOWLAN_GET_STATUSES,
+                .flags = CMD_SYNC | CMD_WANT_SKB,
+        };
+        struct iwl_wowlan_status *status;
+        int ret, len;
+
+        iwl_trans_read_mem_bytes(mvm->trans, base,
+                                 &err_info, sizeof(err_info));
+
+        if (err_info.valid) {
+                IWL_INFO(mvm, "error table is valid (%d)\n",
+                         err_info.valid);
+                if (err_info.error_id == RF_KILL_INDICATOR_FOR_WOWLAN) {
+                        struct cfg80211_wowlan_wakeup wakeup = {
+                                .rfkill_release = true,
+                        };
+                        ieee80211_report_wowlan_wakeup(vif, &wakeup,
+                                                       GFP_KERNEL);
+                }
+                goto out_unlock;
+        }
+
+        /* only for tracing for now */
+        ret = iwl_mvm_send_cmd_pdu(mvm, OFFLOADS_QUERY_CMD, CMD_SYNC, 0, NULL);
+        if (ret)
+                IWL_ERR(mvm, "failed to query offload statistics (%d)\n", ret);
+
+        ret = iwl_mvm_send_cmd(mvm, &cmd);
+        if (ret) {
+                IWL_ERR(mvm, "failed to query status (%d)\n", ret);
+                goto out_unlock;
+        }
+
+        /* RF-kill already asserted again... */
+        if (!cmd.resp_pkt)
+                goto out_unlock;
+
+        len = le32_to_cpu(cmd.resp_pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
+        if (len - sizeof(struct iwl_cmd_header) < sizeof(*status)) {
+                IWL_ERR(mvm, "Invalid WoWLAN status response!\n");
+                goto out_free_resp;
+        }
+
+        status = (void *)cmd.resp_pkt->data;
+
+        if (len - sizeof(struct iwl_cmd_header) !=
+            sizeof(*status) +
+            ALIGN(le32_to_cpu(status->wake_packet_bufsize), 4)) {
+                IWL_ERR(mvm, "Invalid WoWLAN status response!\n");
+                goto out_free_resp;
+        }
+
+        /* now we have all the data we need, unlock to avoid mac80211 issues */
+        mutex_unlock(&mvm->mutex);
+
+        iwl_mvm_report_wakeup_reasons(mvm, vif, status);
+        iwl_free_resp(&cmd);
+        return;
+
+ out_free_resp:
         iwl_free_resp(&cmd);
+ out_unlock:
+        mutex_unlock(&mvm->mutex);
 }
 
 static void iwl_mvm_read_d3_sram(struct iwl_mvm *mvm)
@@ -1347,10 +1369,13 @@ static int __iwl_mvm_resume(struct iwl_mvm *mvm, bool test)
         iwl_mvm_read_d3_sram(mvm);
 
         iwl_mvm_query_wakeup_reasons(mvm, vif);
+        /* has unlocked the mutex, so skip that */
+        goto out;
 
  out_unlock:
         mutex_unlock(&mvm->mutex);
 
+ out:
         if (!test && vif)
                 ieee80211_resume_disconnect(vif);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index cc157734eb21..aac81b8984b0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -352,6 +352,10 @@ static void iwl_dbgfs_update_pm(struct iwl_mvm *mvm,
                 IWL_DEBUG_POWER(mvm, "lprx_rssi_threshold=%d\n", val);
                 dbgfs_pm->lprx_rssi_threshold = val;
                 break;
+        case MVM_DEBUGFS_PM_SNOOZE_ENABLE:
+                IWL_DEBUG_POWER(mvm, "snooze_enable=%d\n", val);
+                dbgfs_pm->snooze_ena = val;
+                break;
         }
 }
 
@@ -405,6 +409,10 @@ static ssize_t iwl_dbgfs_pm_params_write(struct file *file,
                     POWER_LPRX_RSSI_THRESHOLD_MIN)
                         return -EINVAL;
                 param = MVM_DEBUGFS_PM_LPRX_RSSI_THRESHOLD;
+        } else if (!strncmp("snooze_enable=", buf, 14)) {
+                if (sscanf(buf + 14, "%d", &val) != 1)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_PM_SNOOZE_ENABLE;
         } else {
                 return -EINVAL;
         }
@@ -424,7 +432,7 @@ static ssize_t iwl_dbgfs_pm_params_read(struct file *file,
         struct ieee80211_vif *vif = file->private_data;
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_mvm *mvm = mvmvif->dbgfs_data;
-        char buf[256];
+        char buf[512];
         int bufsz = sizeof(buf);
         int pos;
 
@@ -895,10 +903,7 @@ static ssize_t iwl_dbgfs_bf_params_write(struct file *file,
         if (param == MVM_DEBUGFS_BF_ENABLE_BEACON_FILTER && !value) {
                 ret = iwl_mvm_disable_beacon_filter(mvm, vif);
         } else {
-                if (mvmvif->bf_enabled)
-                        ret = iwl_mvm_enable_beacon_filter(mvm, vif);
-                else
-                        ret = iwl_mvm_disable_beacon_filter(mvm, vif);
+                ret = iwl_mvm_enable_beacon_filter(mvm, vif);
         }
         mutex_unlock(&mvm->mutex);
 
@@ -923,7 +928,7 @@ static ssize_t iwl_dbgfs_bf_params_read(struct file *file,
         };
 
         iwl_mvm_beacon_filter_debugfs_parameters(vif, &cmd);
-        if (mvmvif->bf_enabled)
+        if (mvmvif->bf_data.bf_enabled)
                 cmd.bf_enable_beacon_filter = cpu_to_le32(1);
         else
                 cmd.bf_enable_beacon_filter = 0;
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
index 060e630b3d82..8e7ab41079ca 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
@@ -155,8 +155,12 @@ struct iwl_powertable_cmd {
  * @lprx_rssi_threshold: Signal strength up to which LP RX can be enabled.
  *                      Default: 80dbm
  * @num_skip_dtim:      Number of DTIMs to skip if Skip over DTIM flag is set
- * @snooze_interval:    TBD
- * @snooze_window:      TBD
+ * @snooze_interval:    Maximum time between attempts to retrieve buffered data
+ *                      from the AP [msec]
+ * @snooze_window:      A window of time in which PBW snoozing insures that all
+ *                      packets received. It is also the minimum time from last
+ *                      received unicast RX packet, before client stops snoozing
+ *                      for data. [msec]
  * @snooze_step:        TBD
  * @qndp_tid:           TID client shall use for uAPSD QNDP triggers
  * @uapsd_ac_flags:     Set trigger-enabled and delivery-enabled indication for
@@ -164,10 +168,10 @@ struct iwl_powertable_cmd {
  *                      Use IEEE80211_WMM_IE_STA_QOSINFO_AC* for correct values.
  * @uapsd_max_sp:       Use IEEE80211_WMM_IE_STA_QOSINFO_SP_* for correct
  *                      values.
- * @heavy_traffic_thr_tx_pkts:  TX threshold measured in number of packets
- * @heavy_traffic_thr_rx_pkts:  RX threshold measured in number of packets
- * @heavy_traffic_thr_tx_load:  TX threshold measured in load's percentage
- * @heavy_traffic_thr_rx_load:  RX threshold measured in load's percentage
+ * @heavy_tx_thld_packets:      TX threshold measured in number of packets
+ * @heavy_rx_thld_packets:      RX threshold measured in number of packets
+ * @heavy_tx_thld_percentage:   TX threshold measured in load's percentage
+ * @heavy_rx_thld_percentage:   RX threshold measured in load's percentage
  * @limited_ps_threshold:
 */
 struct iwl_mac_power_cmd {
@@ -189,10 +193,10 @@ struct iwl_mac_power_cmd {
         u8 qndp_tid;
         u8 uapsd_ac_flags;
         u8 uapsd_max_sp;
-        u8 heavy_traffic_threshold_tx_packets;
-        u8 heavy_traffic_threshold_rx_packets;
-        u8 heavy_traffic_threshold_tx_percentage;
-        u8 heavy_traffic_threshold_rx_percentage;
+        u8 heavy_tx_thld_packets;
+        u8 heavy_rx_thld_packets;
+        u8 heavy_tx_thld_percentage;
+        u8 heavy_rx_thld_percentage;
         u8 limited_ps_threshold;
         u8 reserved;
 } __packed;
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api.h b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
index 55854a309f94..66264cc5a016 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
@@ -499,71 +499,199 @@ enum iwl_time_event_type {
         TE_MAX
 }; /* MAC_EVENT_TYPE_API_E_VER_1 */
 
+
+
+/* Time event - defines for command API v1 */
+
+/*
+ * @TE_V1_FRAG_NONE: fragmentation of the time event is NOT allowed.
+ * @TE_V1_FRAG_SINGLE: fragmentation of the time event is allowed, but only
+ *      the first fragment is scheduled.
+ * @TE_V1_FRAG_DUAL: fragmentation of the time event is allowed, but only
+ *      the first 2 fragments are scheduled.
+ * @TE_V1_FRAG_ENDLESS: fragmentation of the time event is allowed, and any
+ *      number of fragments are valid.
+ *
+ * Other than the constant defined above, specifying a fragmentation value 'x'
+ * means that the event can be fragmented but only the first 'x' will be
+ * scheduled.
+ */
+enum {
+        TE_V1_FRAG_NONE = 0,
+        TE_V1_FRAG_SINGLE = 1,
+        TE_V1_FRAG_DUAL = 2,
+        TE_V1_FRAG_ENDLESS = 0xffffffff
+};
+
+/* If a Time Event can be fragmented, this is the max number of fragments */
+#define TE_V1_FRAG_MAX_MSK      0x0fffffff
+/* Repeat the time event endlessly (until removed) */
+#define TE_V1_REPEAT_ENDLESS    0xffffffff
+/* If a Time Event has bounded repetitions, this is the maximal value */
+#define TE_V1_REPEAT_MAX_MSK_V1 0x0fffffff
+
 /* Time Event dependencies: none, on another TE, or in a specific time */
 enum {
-        TE_INDEPENDENT          = 0,
-        TE_DEP_OTHER            = 1,
-        TE_DEP_TSF              = 2,
-        TE_EVENT_SOCIOPATHIC    = 4,
+        TE_V1_INDEPENDENT               = 0,
+        TE_V1_DEP_OTHER                 = BIT(0),
+        TE_V1_DEP_TSF                   = BIT(1),
+        TE_V1_EVENT_SOCIOPATHIC         = BIT(2),
 }; /* MAC_EVENT_DEPENDENCY_POLICY_API_E_VER_2 */
+
 /*
+ * @TE_V1_NOTIF_NONE: no notifications
+ * @TE_V1_NOTIF_HOST_EVENT_START: request/receive notification on event start
+ * @TE_V1_NOTIF_HOST_EVENT_END:request/receive notification on event end
+ * @TE_V1_NOTIF_INTERNAL_EVENT_START: internal FW use
+ * @TE_V1_NOTIF_INTERNAL_EVENT_END: internal FW use.
+ * @TE_V1_NOTIF_HOST_FRAG_START: request/receive notification on frag start
+ * @TE_V1_NOTIF_HOST_FRAG_END:request/receive notification on frag end
+ * @TE_V1_NOTIF_INTERNAL_FRAG_START: internal FW use.
+ * @TE_V1_NOTIF_INTERNAL_FRAG_END: internal FW use.
+ *
  * Supported Time event notifications configuration.
  * A notification (both event and fragment) includes a status indicating weather
  * the FW was able to schedule the event or not. For fragment start/end
  * notification the status is always success. There is no start/end fragment
  * notification for monolithic events.
- *
- * @TE_NOTIF_NONE: no notifications
- * @TE_NOTIF_HOST_EVENT_START: request/receive notification on event start
- * @TE_NOTIF_HOST_EVENT_END:request/receive notification on event end
- * @TE_NOTIF_INTERNAL_EVENT_START: internal FW use
- * @TE_NOTIF_INTERNAL_EVENT_END: internal FW use.
- * @TE_NOTIF_HOST_FRAG_START: request/receive notification on frag start
- * @TE_NOTIF_HOST_FRAG_END:request/receive notification on frag end
- * @TE_NOTIF_INTERNAL_FRAG_START: internal FW use.
- * @TE_NOTIF_INTERNAL_FRAG_END: internal FW use.
  */
 enum {
-        TE_NOTIF_NONE = 0,
-        TE_NOTIF_HOST_EVENT_START = 0x1,
-        TE_NOTIF_HOST_EVENT_END = 0x2,
-        TE_NOTIF_INTERNAL_EVENT_START = 0x4,
-        TE_NOTIF_INTERNAL_EVENT_END = 0x8,
-        TE_NOTIF_HOST_FRAG_START = 0x10,
-        TE_NOTIF_HOST_FRAG_END = 0x20,
-        TE_NOTIF_INTERNAL_FRAG_START = 0x40,
-        TE_NOTIF_INTERNAL_FRAG_END = 0x80
+        TE_V1_NOTIF_NONE = 0,
+        TE_V1_NOTIF_HOST_EVENT_START = BIT(0),
+        TE_V1_NOTIF_HOST_EVENT_END = BIT(1),
+        TE_V1_NOTIF_INTERNAL_EVENT_START = BIT(2),
+        TE_V1_NOTIF_INTERNAL_EVENT_END = BIT(3),
+        TE_V1_NOTIF_HOST_FRAG_START = BIT(4),
+        TE_V1_NOTIF_HOST_FRAG_END = BIT(5),
+        TE_V1_NOTIF_INTERNAL_FRAG_START = BIT(6),
+        TE_V1_NOTIF_INTERNAL_FRAG_END = BIT(7),
 }; /* MAC_EVENT_ACTION_API_E_VER_2 */
 
+
+/**
+ * struct iwl_time_event_cmd_api_v1 - configuring Time Events
+ * with struct MAC_TIME_EVENT_DATA_API_S_VER_1 (see also
+ * with version 2. determined by IWL_UCODE_TLV_FLAGS)
+ * ( TIME_EVENT_CMD = 0x29 )
+ * @id_and_color: ID and color of the relevant MAC
+ * @action: action to perform, one of FW_CTXT_ACTION_*
+ * @id: this field has two meanings, depending on the action:
+ *      If the action is ADD, then it means the type of event to add.
+ *      For all other actions it is the unique event ID assigned when the
+ *      event was added by the FW.
+ * @apply_time: When to start the Time Event (in GP2)
+ * @max_delay: maximum delay to event's start (apply time), in TU
+ * @depends_on: the unique ID of the event we depend on (if any)
+ * @interval: interval between repetitions, in TU
+ * @interval_reciprocal: 2^32 / interval
+ * @duration: duration of event in TU
+ * @repeat: how many repetitions to do, can be TE_REPEAT_ENDLESS
+ * @dep_policy: one of TE_V1_INDEPENDENT, TE_V1_DEP_OTHER, TE_V1_DEP_TSF
+ *      and TE_V1_EVENT_SOCIOPATHIC
+ * @is_present: 0 or 1, are we present or absent during the Time Event
+ * @max_frags: maximal number of fragments the Time Event can be divided to
+ * @notify: notifications using TE_V1_NOTIF_* (whom to notify when)
+ */
+struct iwl_time_event_cmd_v1 {
+        /* COMMON_INDEX_HDR_API_S_VER_1 */
+        __le32 id_and_color;
+        __le32 action;
+        __le32 id;
+        /* MAC_TIME_EVENT_DATA_API_S_VER_1 */
+        __le32 apply_time;
+        __le32 max_delay;
+        __le32 dep_policy;
+        __le32 depends_on;
+        __le32 is_present;
+        __le32 max_frags;
+        __le32 interval;
+        __le32 interval_reciprocal;
+        __le32 duration;
+        __le32 repeat;
+        __le32 notify;
+} __packed; /* MAC_TIME_EVENT_CMD_API_S_VER_1 */
+
+
+/* Time event - defines for command API v2 */
+
 /*
- * @TE_FRAG_NONE: fragmentation of the time event is NOT allowed.
- * @TE_FRAG_SINGLE: fragmentation of the time event is allowed, but only
+ * @TE_V2_FRAG_NONE: fragmentation of the time event is NOT allowed.
+ * @TE_V2_FRAG_SINGLE: fragmentation of the time event is allowed, but only
  *  the first fragment is scheduled.
- * @TE_FRAG_DUAL: fragmentation of the time event is allowed, but only
+ * @TE_V2_FRAG_DUAL: fragmentation of the time event is allowed, but only
  *  the first 2 fragments are scheduled.
- * @TE_FRAG_ENDLESS: fragmentation of the time event is allowed, and any number
- *  of fragments are valid.
+ * @TE_V2_FRAG_ENDLESS: fragmentation of the time event is allowed, and any
+ *  number of fragments are valid.
  *
  * Other than the constant defined above, specifying a fragmentation value 'x'
  * means that the event can be fragmented but only the first 'x' will be
  * scheduled.
  */
 enum {
-        TE_FRAG_NONE = 0,
-        TE_FRAG_SINGLE = 1,
-        TE_FRAG_DUAL = 2,
-        TE_FRAG_ENDLESS = 0xffffffff
+        TE_V2_FRAG_NONE = 0,
+        TE_V2_FRAG_SINGLE = 1,
+        TE_V2_FRAG_DUAL = 2,
+        TE_V2_FRAG_MAX = 0xfe,
+        TE_V2_FRAG_ENDLESS = 0xff
 };
 
 /* Repeat the time event endlessly (until removed) */
-#define TE_REPEAT_ENDLESS       (0xffffffff)
+#define TE_V2_REPEAT_ENDLESS    0xff
 /* If a Time Event has bounded repetitions, this is the maximal value */
-#define TE_REPEAT_MAX_MSK       (0x0fffffff)
-/* If a Time Event can be fragmented, this is the max number of fragments */
-#define TE_FRAG_MAX_MSK         (0x0fffffff)
+#define TE_V2_REPEAT_MAX        0xfe
+
+#define TE_V2_PLACEMENT_POS     12
+#define TE_V2_ABSENCE_POS       15
+
+/* Time event policy values (for time event cmd api v2)
+ * A notification (both event and fragment) includes a status indicating weather
+ * the FW was able to schedule the event or not. For fragment start/end
+ * notification the status is always success. There is no start/end fragment
+ * notification for monolithic events.
+ *
+ * @TE_V2_DEFAULT_POLICY: independent, social, present, unoticable
+ * @TE_V2_NOTIF_HOST_EVENT_START: request/receive notification on event start
+ * @TE_V2_NOTIF_HOST_EVENT_END:request/receive notification on event end
+ * @TE_V2_NOTIF_INTERNAL_EVENT_START: internal FW use
+ * @TE_V2_NOTIF_INTERNAL_EVENT_END: internal FW use.
+ * @TE_V2_NOTIF_HOST_FRAG_START: request/receive notification on frag start
+ * @TE_V2_NOTIF_HOST_FRAG_END:request/receive notification on frag end
+ * @TE_V2_NOTIF_INTERNAL_FRAG_START: internal FW use.
+ * @TE_V2_NOTIF_INTERNAL_FRAG_END: internal FW use.
+ * @TE_V2_DEP_OTHER: depends on another time event
+ * @TE_V2_DEP_TSF: depends on a specific time
+ * @TE_V2_EVENT_SOCIOPATHIC: can't co-exist with other events of tha same MAC
+ * @TE_V2_ABSENCE: are we present or absent during the Time Event.
+ */
+enum {
+        TE_V2_DEFAULT_POLICY = 0x0,
+
+        /* notifications (event start/stop, fragment start/stop) */
+        TE_V2_NOTIF_HOST_EVENT_START = BIT(0),
+        TE_V2_NOTIF_HOST_EVENT_END = BIT(1),
+        TE_V2_NOTIF_INTERNAL_EVENT_START = BIT(2),
+        TE_V2_NOTIF_INTERNAL_EVENT_END = BIT(3),
+
+        TE_V2_NOTIF_HOST_FRAG_START = BIT(4),
+        TE_V2_NOTIF_HOST_FRAG_END = BIT(5),
+        TE_V2_NOTIF_INTERNAL_FRAG_START = BIT(6),
+        TE_V2_NOTIF_INTERNAL_FRAG_END = BIT(7),
+
+        TE_V2_NOTIF_MSK = 0xff,
+
+        /* placement characteristics */
+        TE_V2_DEP_OTHER = BIT(TE_V2_PLACEMENT_POS),
+        TE_V2_DEP_TSF = BIT(TE_V2_PLACEMENT_POS + 1),
+        TE_V2_EVENT_SOCIOPATHIC = BIT(TE_V2_PLACEMENT_POS + 2),
+
+        /* are we present or absent during the Time Event. */
+        TE_V2_ABSENCE = BIT(TE_V2_ABSENCE_POS),
+};
 
 /**
- * struct iwl_time_event_cmd - configuring Time Events
+ * struct iwl_time_event_cmd_api_v2 - configuring Time Events
+ * with struct MAC_TIME_EVENT_DATA_API_S_VER_2 (see also
+ * with version 1. determined by IWL_UCODE_TLV_FLAGS)
  * ( TIME_EVENT_CMD = 0x29 )
  * @id_and_color: ID and color of the relevant MAC
  * @action: action to perform, one of FW_CTXT_ACTION_*
@@ -575,32 +703,30 @@ enum {
  * @max_delay: maximum delay to event's start (apply time), in TU
  * @depends_on: the unique ID of the event we depend on (if any)
  * @interval: interval between repetitions, in TU
- * @interval_reciprocal: 2^32 / interval
  * @duration: duration of event in TU
  * @repeat: how many repetitions to do, can be TE_REPEAT_ENDLESS
- * @dep_policy: one of TE_INDEPENDENT, TE_DEP_OTHER, TE_DEP_TSF
- * @is_present: 0 or 1, are we present or absent during the Time Event
  * @max_frags: maximal number of fragments the Time Event can be divided to
- * @notify: notifications using TE_NOTIF_* (whom to notify when)
+ * @policy: defines whether uCode shall notify the host or other uCode modules
+ *      on event and/or fragment start and/or end
+ *      using one of TE_INDEPENDENT, TE_DEP_OTHER, TE_DEP_TSF
+ *      TE_EVENT_SOCIOPATHIC
+ *      using TE_ABSENCE and using TE_NOTIF_*
  */
-struct iwl_time_event_cmd {
+struct iwl_time_event_cmd_v2 {
         /* COMMON_INDEX_HDR_API_S_VER_1 */
         __le32 id_and_color;
         __le32 action;
         __le32 id;
-        /* MAC_TIME_EVENT_DATA_API_S_VER_1 */
+        /* MAC_TIME_EVENT_DATA_API_S_VER_2 */
         __le32 apply_time;
         __le32 max_delay;
-        __le32 dep_policy;
         __le32 depends_on;
-        __le32 is_present;
-        __le32 max_frags;
         __le32 interval;
-        __le32 interval_reciprocal;
         __le32 duration;
-        __le32 repeat;
-        __le32 notify;
-} __packed; /* MAC_TIME_EVENT_CMD_API_S_VER_1 */
+        u8 repeat;
+        u8 max_frags;
+        __le16 policy;
+} __packed; /* MAC_TIME_EVENT_CMD_API_S_VER_2 */
 
 /**
  * struct iwl_time_event_resp - response structure to iwl_time_event_cmd
@@ -1195,7 +1321,7 @@ struct mvm_statistics_general {
         struct mvm_statistics_general_common common;
         __le32 beacon_filtered;
         __le32 missed_beacons;
-        __s8 beacon_filter_everage_energy;
+        __s8 beacon_filter_average_energy;
         __s8 beacon_filter_reason;
         __s8 beacon_filter_current_energy;
         __s8 beacon_filter_reserved;
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 995f0250105e..9833cdf6177c 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -155,7 +155,8 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                     IEEE80211_HW_TIMING_BEACON_ONLY |
                     IEEE80211_HW_CONNECTION_MONITOR |
                     IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS |
-                    IEEE80211_HW_SUPPORTS_STATIC_SMPS;
+                    IEEE80211_HW_SUPPORTS_STATIC_SMPS |
+                    IEEE80211_HW_SUPPORTS_UAPSD;
 
         hw->queues = IWL_MVM_FIRST_AGG_QUEUE;
         hw->offchannel_tx_hw_queue = IWL_MVM_OFFCHANNEL_QUEUE;
@@ -190,6 +191,8 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
 
         hw->wiphy->max_remain_on_channel_duration = 10000;
         hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
+        hw->uapsd_queues = IWL_UAPSD_AC_INFO;
+        hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
 
         /* Extract MAC address */
         memcpy(mvm->addresses[0].addr, mvm->nvm_data->hw_addr, ETH_ALEN);
@@ -577,7 +580,8 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
             vif->type == NL80211_IFTYPE_STATION && !vif->p2p &&
             mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BF_UPDATED){
                 mvm->bf_allowed_vif = mvmvif;
-                vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER;
+                vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
+                                     IEEE80211_VIF_SUPPORTS_CQM_RSSI;
         }
 
         /*
@@ -617,7 +621,8 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
  out_free_bf:
         if (mvm->bf_allowed_vif == mvmvif) {
                 mvm->bf_allowed_vif = NULL;
-                vif->driver_flags &= ~IEEE80211_VIF_BEACON_FILTER;
+                vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
+                                       IEEE80211_VIF_SUPPORTS_CQM_RSSI);
         }
  out_remove_mac:
         mvmvif->phy_ctxt = NULL;
@@ -683,7 +688,8 @@ static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
 
         if (mvm->bf_allowed_vif == mvmvif) {
                 mvm->bf_allowed_vif = NULL;
-                vif->driver_flags &= ~IEEE80211_VIF_BEACON_FILTER;
+                vif->driver_flags &= ~(IEEE80211_VIF_BEACON_FILTER |
+                                       IEEE80211_VIF_SUPPORTS_CQM_RSSI);
         }
 
         iwl_mvm_vif_dbgfs_clean(mvm, vif);
@@ -801,6 +807,10 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                         if (ret)
                                 IWL_ERR(mvm, "failed to update quotas\n");
                 }
+
+                /* reset rssi values */
+                mvmvif->bf_data.ave_beacon_signal = 0;
+
                 if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD)) {
                         /* Workaround for FW bug, otherwise FW disables device
                          * power save upon disassociation
@@ -817,7 +827,7 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                  */
                 iwl_mvm_remove_time_event(mvm, mvmvif,
                                           &mvmvif->time_event_data);
-        } else if (changes & BSS_CHANGED_PS) {
+        } else if (changes & (BSS_CHANGED_PS | BSS_CHANGED_QOS)) {
                 ret = iwl_mvm_power_update_mode(mvm, vif);
                 if (ret)
                         IWL_ERR(mvm, "failed to update power mode\n");
@@ -827,6 +837,15 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                                 bss_conf->txpower);
                 iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
         }
+
+        if (changes & BSS_CHANGED_CQM) {
+                IWL_DEBUG_MAC80211(mvm, "cqm info_changed");
+                /* reset cqm events tracking */
+                mvmvif->bf_data.last_cqm_event = 0;
+                ret = iwl_mvm_update_beacon_filter(mvm, vif);
+                if (ret)
+                        IWL_ERR(mvm, "failed to update CQM thresholds\n");
+        }
 }
 
 static int iwl_mvm_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index 4173bb57585f..b0389279cc1e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -153,6 +153,11 @@ enum iwl_power_scheme {
 };
 
 #define IWL_CONN_MAX_LISTEN_INTERVAL    70
+#define IWL_UAPSD_AC_INFO               (IEEE80211_WMM_IE_STA_QOSINFO_AC_VO |\
+                                         IEEE80211_WMM_IE_STA_QOSINFO_AC_VI |\
+                                         IEEE80211_WMM_IE_STA_QOSINFO_AC_BK |\
+                                         IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
+#define IWL_UAPSD_MAX_SP                IEEE80211_WMM_IE_STA_QOSINFO_SP_2
 
 struct iwl_mvm_power_ops {
         int (*power_update_mode)(struct iwl_mvm *mvm,
@@ -175,6 +180,7 @@ enum iwl_dbgfs_pm_mask {
         MVM_DEBUGFS_PM_DISABLE_POWER_OFF = BIT(5),
         MVM_DEBUGFS_PM_LPRX_ENA = BIT(6),
         MVM_DEBUGFS_PM_LPRX_RSSI_THRESHOLD = BIT(7),
+        MVM_DEBUGFS_PM_SNOOZE_ENABLE = BIT(8),
 };
 
 struct iwl_dbgfs_pm {
@@ -186,6 +192,7 @@ struct iwl_dbgfs_pm {
         bool disable_power_off;
         bool lprx_ena;
         u32 lprx_rssi_threshold;
+        bool snooze_ena;
         int mask;
 };
 
@@ -228,6 +235,21 @@ enum iwl_mvm_smps_type_request {
 };
 
 /**
+* struct iwl_mvm_vif_bf_data - beacon filtering related data
+* @bf_enabled: indicates if beacon filtering is enabled
+* @ba_enabled: indicated if beacon abort is enabled
+* @last_beacon_signal: last beacon rssi signal in dbm
+* @ave_beacon_signal: average beacon signal
+* @last_cqm_event: rssi of the last cqm event
+*/
+struct iwl_mvm_vif_bf_data {
+        bool bf_enabled;
+        bool ba_enabled;
+        s8 ave_beacon_signal;
+        s8 last_cqm_event;
+};
+
+/**
  * struct iwl_mvm_vif - data per Virtual Interface, it is a MAC context
  * @id: between 0 and 3
  * @color: to solve races upon MAC addition and removal
@@ -252,8 +274,7 @@ struct iwl_mvm_vif {
         bool uploaded;
         bool ap_active;
         bool monitor_active;
-        /* indicate whether beacon filtering is enabled */
-        bool bf_enabled;
+        struct iwl_mvm_vif_bf_data bf_data;
 
         u32 ap_beacon_time;
 
@@ -754,6 +775,8 @@ int iwl_mvm_beacon_filter_send_cmd(struct iwl_mvm *mvm,
                                    struct iwl_beacon_filter_cmd *cmd);
 int iwl_mvm_update_beacon_abort(struct iwl_mvm *mvm,
                                 struct ieee80211_vif *vif, bool enable);
+int iwl_mvm_update_beacon_filter(struct iwl_mvm *mvm,
+                                  struct ieee80211_vif *vif);
 
 /* SMPS */
 void iwl_mvm_update_smps(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
diff --git a/drivers/net/wireless/iwlwifi/mvm/power.c b/drivers/net/wireless/iwlwifi/mvm/power.c
index 4e7c9f245846..21407a353a3b 100644
--- a/drivers/net/wireless/iwlwifi/mvm/power.c
+++ b/drivers/net/wireless/iwlwifi/mvm/power.c
@@ -110,6 +110,23 @@ int iwl_mvm_beacon_filter_send_cmd(struct iwl_mvm *mvm,
         return ret;
 }
 
+static
+void iwl_mvm_beacon_filter_set_cqm_params(struct iwl_mvm *mvm,
+                                          struct ieee80211_vif *vif,
+                                          struct iwl_beacon_filter_cmd *cmd)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
+        if (vif->bss_conf.cqm_rssi_thold) {
+                cmd->bf_energy_delta =
+                        cpu_to_le32(vif->bss_conf.cqm_rssi_hyst);
+                /* fw uses an absolute value for this */
+                cmd->bf_roaming_state =
+                        cpu_to_le32(-vif->bss_conf.cqm_rssi_thold);
+        }
+        cmd->ba_enable_beacon_abort = cpu_to_le32(mvmvif->bf_data.ba_enabled);
+}
+
 int iwl_mvm_update_beacon_abort(struct iwl_mvm *mvm,
                                 struct ieee80211_vif *vif, bool enable)
 {
@@ -120,12 +137,14 @@ int iwl_mvm_update_beacon_abort(struct iwl_mvm *mvm,
                 .ba_enable_beacon_abort = cpu_to_le32(enable),
         };
 
-        if (!mvmvif->bf_enabled)
+        if (!mvmvif->bf_data.bf_enabled)
                 return 0;
 
         if (mvm->cur_ucode == IWL_UCODE_WOWLAN)
                 cmd.ba_escape_timer = cpu_to_le32(IWL_BA_ESCAPE_TIMER_D3);
 
+        mvmvif->bf_data.ba_enabled = enable;
+        iwl_mvm_beacon_filter_set_cqm_params(mvm, vif, &cmd);
         iwl_mvm_beacon_filter_debugfs_parameters(vif, &cmd);
         return iwl_mvm_beacon_filter_send_cmd(mvm, &cmd);
 }
@@ -140,17 +159,30 @@ static void iwl_mvm_power_log(struct iwl_mvm *mvm,
         IWL_DEBUG_POWER(mvm, "Keep alive = %u sec\n",
                         le16_to_cpu(cmd->keep_alive_seconds));
 
-        if (cmd->flags & cpu_to_le16(POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK)) {
-                IWL_DEBUG_POWER(mvm, "Rx timeout = %u usec\n",
-                                le32_to_cpu(cmd->rx_data_timeout));
-                IWL_DEBUG_POWER(mvm, "Tx timeout = %u usec\n",
-                                le32_to_cpu(cmd->tx_data_timeout));
-                if (cmd->flags & cpu_to_le16(POWER_FLAGS_SKIP_OVER_DTIM_MSK))
-                        IWL_DEBUG_POWER(mvm, "DTIM periods to skip = %u\n",
-                                        cmd->skip_dtim_periods);
-                if (cmd->flags & cpu_to_le16(POWER_FLAGS_LPRX_ENA_MSK))
-                        IWL_DEBUG_POWER(mvm, "LP RX RSSI threshold = %u\n",
-                                        cmd->lprx_rssi_threshold);
+        if (!(cmd->flags & cpu_to_le16(POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK))) {
+                IWL_DEBUG_POWER(mvm, "Disable power management\n");
+                return;
+        }
+
+        IWL_DEBUG_POWER(mvm, "Rx timeout = %u usec\n",
+                        le32_to_cpu(cmd->rx_data_timeout));
+        IWL_DEBUG_POWER(mvm, "Tx timeout = %u usec\n",
+                        le32_to_cpu(cmd->tx_data_timeout));
+        if (cmd->flags & cpu_to_le16(POWER_FLAGS_SKIP_OVER_DTIM_MSK))
+                IWL_DEBUG_POWER(mvm, "DTIM periods to skip = %u\n",
+                                cmd->skip_dtim_periods);
+        if (cmd->flags & cpu_to_le16(POWER_FLAGS_LPRX_ENA_MSK))
+                IWL_DEBUG_POWER(mvm, "LP RX RSSI threshold = %u\n",
+                                cmd->lprx_rssi_threshold);
+        if (cmd->flags & cpu_to_le16(POWER_FLAGS_ADVANCE_PM_ENA_MSK)) {
+                IWL_DEBUG_POWER(mvm, "uAPSD enabled\n");
+                IWL_DEBUG_POWER(mvm, "Rx timeout (uAPSD) = %u usec\n",
+                                le32_to_cpu(cmd->rx_data_timeout_uapsd));
+                IWL_DEBUG_POWER(mvm, "Tx timeout (uAPSD) = %u usec\n",
+                                le32_to_cpu(cmd->tx_data_timeout_uapsd));
+                IWL_DEBUG_POWER(mvm, "QNDP TID = %d\n", cmd->qndp_tid);
+                IWL_DEBUG_POWER(mvm, "ACs flags = 0x%x\n", cmd->uapsd_ac_flags);
+                IWL_DEBUG_POWER(mvm, "Max SP = %d\n", cmd->uapsd_max_sp);
         }
 }
 
@@ -166,6 +198,8 @@ static void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm,
         bool radar_detect = false;
         struct iwl_mvm_vif *mvmvif __maybe_unused =
                 iwl_mvm_vif_from_mac80211(vif);
+        enum ieee80211_ac_numbers ac;
+        bool tid_found = false;
 
         cmd->id_and_color = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
                                                             mvmvif->color));
@@ -235,6 +269,63 @@ static void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm,
                         cpu_to_le32(IWL_MVM_WOWLAN_PS_TX_DATA_TIMEOUT);
         }
 
+        for (ac = IEEE80211_AC_VO; ac <= IEEE80211_AC_BK; ac++) {
+                if (!mvmvif->queue_params[ac].uapsd)
+                        continue;
+
+                cmd->flags |= cpu_to_le16(POWER_FLAGS_ADVANCE_PM_ENA_MSK);
+                cmd->uapsd_ac_flags |= BIT(ac);
+
+                /* QNDP TID - the highest TID with no admission control */
+                if (!tid_found && !mvmvif->queue_params[ac].acm) {
+                        tid_found = true;
+                        switch (ac) {
+                        case IEEE80211_AC_VO:
+                                cmd->qndp_tid = 6;
+                                break;
+                        case IEEE80211_AC_VI:
+                                cmd->qndp_tid = 5;
+                                break;
+                        case IEEE80211_AC_BE:
+                                cmd->qndp_tid = 0;
+                                break;
+                        case IEEE80211_AC_BK:
+                                cmd->qndp_tid = 1;
+                                break;
+                        }
+                }
+        }
+
+        if (cmd->flags & cpu_to_le16(POWER_FLAGS_ADVANCE_PM_ENA_MSK)) {
+                cmd->rx_data_timeout_uapsd =
+                        cpu_to_le32(IWL_MVM_UAPSD_RX_DATA_TIMEOUT);
+                cmd->tx_data_timeout_uapsd =
+                        cpu_to_le32(IWL_MVM_UAPSD_TX_DATA_TIMEOUT);
+
+                if (cmd->uapsd_ac_flags == (BIT(IEEE80211_AC_VO) |
+                                            BIT(IEEE80211_AC_VI) |
+                                            BIT(IEEE80211_AC_BE) |
+                                            BIT(IEEE80211_AC_BK))) {
+                        cmd->flags |= cpu_to_le16(POWER_FLAGS_SNOOZE_ENA_MSK);
+                        cmd->snooze_interval =
+                                cpu_to_le16(IWL_MVM_PS_SNOOZE_INTERVAL);
+                        cmd->snooze_window =
+                                (mvm->cur_ucode == IWL_UCODE_WOWLAN) ?
+                                cpu_to_le16(IWL_MVM_WOWLAN_PS_SNOOZE_WINDOW) :
+                                cpu_to_le16(IWL_MVM_PS_SNOOZE_WINDOW);
+                }
+
+                cmd->uapsd_max_sp = IWL_UAPSD_MAX_SP;
+                cmd->heavy_tx_thld_packets =
+                        IWL_MVM_PS_HEAVY_TX_THLD_PACKETS;
+                cmd->heavy_rx_thld_packets =
+                        IWL_MVM_PS_HEAVY_RX_THLD_PACKETS;
+                cmd->heavy_tx_thld_percentage =
+                        IWL_MVM_PS_HEAVY_TX_THLD_PERCENT;
+                cmd->heavy_rx_thld_percentage =
+                        IWL_MVM_PS_HEAVY_RX_THLD_PERCENT;
+        }
+
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_KEEP_ALIVE)
                 cmd->keep_alive_seconds =
@@ -263,6 +354,14 @@ static void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm,
         }
         if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_LPRX_RSSI_THRESHOLD)
                 cmd->lprx_rssi_threshold = mvmvif->dbgfs_pm.lprx_rssi_threshold;
+        if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_SNOOZE_ENABLE) {
+                if (mvmvif->dbgfs_pm.snooze_ena)
+                        cmd->flags |=
+                                cpu_to_le16(POWER_FLAGS_SNOOZE_ENA_MSK);
+                else
+                        cmd->flags &=
+                                cpu_to_le16(~POWER_FLAGS_SNOOZE_ENA_MSK);
+        }
 #endif /* CONFIG_IWLWIFI_DEBUGFS */
 }
 
@@ -342,8 +441,6 @@ static int iwl_mvm_power_mac_dbgfs_read(struct iwl_mvm *mvm,
                          (cmd.flags &
                          cpu_to_le16(POWER_FLAGS_POWER_SAVE_ENA_MSK)) ?
                          0 : 1);
-        pos += scnprintf(buf+pos, bufsz-pos, "skip_dtim_periods = %d\n",
-                         cmd.skip_dtim_periods);
         pos += scnprintf(buf+pos, bufsz-pos, "power_scheme = %d\n",
                          iwlmvm_mod_params.power_scheme);
         pos += scnprintf(buf+pos, bufsz-pos, "flags = 0x%x\n",
@@ -356,14 +453,64 @@ static int iwl_mvm_power_mac_dbgfs_read(struct iwl_mvm *mvm,
                                  (cmd.flags &
                                  cpu_to_le16(POWER_FLAGS_SKIP_OVER_DTIM_MSK)) ?
                                  1 : 0);
-                pos += scnprintf(buf+pos, bufsz-pos, "rx_data_timeout = %d\n",
-                                 le32_to_cpu(cmd.rx_data_timeout));
-                pos += scnprintf(buf+pos, bufsz-pos, "tx_data_timeout = %d\n",
-                                 le32_to_cpu(cmd.tx_data_timeout));
+                pos += scnprintf(buf+pos, bufsz-pos, "skip_dtim_periods = %d\n",
+                                 cmd.skip_dtim_periods);
+                if (!(cmd.flags &
+                      cpu_to_le16(POWER_FLAGS_ADVANCE_PM_ENA_MSK))) {
+                        pos += scnprintf(buf+pos, bufsz-pos,
+                                         "rx_data_timeout = %d\n",
+                                         le32_to_cpu(cmd.rx_data_timeout));
+                        pos += scnprintf(buf+pos, bufsz-pos,
+                                         "tx_data_timeout = %d\n",
+                                         le32_to_cpu(cmd.tx_data_timeout));
+                }
                 if (cmd.flags & cpu_to_le16(POWER_FLAGS_LPRX_ENA_MSK))
                         pos += scnprintf(buf+pos, bufsz-pos,
                                          "lprx_rssi_threshold = %d\n",
                                          cmd.lprx_rssi_threshold);
+                if (cmd.flags & cpu_to_le16(POWER_FLAGS_ADVANCE_PM_ENA_MSK)) {
+                        pos +=
+                        scnprintf(buf+pos, bufsz-pos,
+                                  "rx_data_timeout_uapsd = %d\n",
+                                  le32_to_cpu(cmd.rx_data_timeout_uapsd));
+                        pos +=
+                        scnprintf(buf+pos, bufsz-pos,
+                                  "tx_data_timeout_uapsd = %d\n",
+                                  le32_to_cpu(cmd.tx_data_timeout_uapsd));
+                        pos += scnprintf(buf+pos, bufsz-pos, "qndp_tid = %d\n",
+                                         cmd.qndp_tid);
+                        pos += scnprintf(buf+pos, bufsz-pos,
+                                         "uapsd_ac_flags = 0x%x\n",
+                                         cmd.uapsd_ac_flags);
+                        pos += scnprintf(buf+pos, bufsz-pos,
+                                         "uapsd_max_sp = %d\n",
+                                         cmd.uapsd_max_sp);
+                        pos += scnprintf(buf+pos, bufsz-pos,
+                                         "heavy_tx_thld_packets = %d\n",
+                                         cmd.heavy_tx_thld_packets);
+                        pos += scnprintf(buf+pos, bufsz-pos,
+                                         "heavy_rx_thld_packets = %d\n",
+                                         cmd.heavy_rx_thld_packets);
+                        pos += scnprintf(buf+pos, bufsz-pos,
+                                         "heavy_tx_thld_percentage = %d\n",
+                                         cmd.heavy_tx_thld_percentage);
+                        pos += scnprintf(buf+pos, bufsz-pos,
+                                         "heavy_rx_thld_percentage = %d\n",
+                                         cmd.heavy_rx_thld_percentage);
+                        pos +=
+                        scnprintf(buf+pos, bufsz-pos, "snooze_enable = %d\n",
+                                  (cmd.flags &
+                                   cpu_to_le16(POWER_FLAGS_SNOOZE_ENA_MSK)) ?
+                                  1 : 0);
+                }
+                if (cmd.flags & cpu_to_le16(POWER_FLAGS_SNOOZE_ENA_MSK)) {
+                        pos += scnprintf(buf+pos, bufsz-pos,
+                                         "snooze_interval = %d\n",
+                                         cmd.snooze_interval);
+                        pos += scnprintf(buf+pos, bufsz-pos,
+                                         "snooze_window = %d\n",
+                                         cmd.snooze_window);
+                }
         }
         return pos;
 }
@@ -417,11 +564,12 @@ int iwl_mvm_enable_beacon_filter(struct iwl_mvm *mvm,
             vif->type != NL80211_IFTYPE_STATION || vif->p2p)
                 return 0;
 
+        iwl_mvm_beacon_filter_set_cqm_params(mvm, vif, &cmd);
         iwl_mvm_beacon_filter_debugfs_parameters(vif, &cmd);
         ret = iwl_mvm_beacon_filter_send_cmd(mvm, &cmd);
 
         if (!ret)
-                mvmvif->bf_enabled = true;
+                mvmvif->bf_data.bf_enabled = true;
 
         return ret;
 }
@@ -440,11 +588,22 @@ int iwl_mvm_disable_beacon_filter(struct iwl_mvm *mvm,
         ret = iwl_mvm_beacon_filter_send_cmd(mvm, &cmd);
 
         if (!ret)
-                mvmvif->bf_enabled = false;
+                mvmvif->bf_data.bf_enabled = false;
 
         return ret;
 }
 
+int iwl_mvm_update_beacon_filter(struct iwl_mvm *mvm,
+                                 struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
+        if (!mvmvif->bf_data.bf_enabled)
+                return 0;
+
+        return iwl_mvm_enable_beacon_filter(mvm, vif);
+}
+
 const struct iwl_mvm_power_ops pm_mac_ops = {
         .power_update_mode = iwl_mvm_power_mac_update_mode,
         .power_disable = iwl_mvm_power_mac_disable,
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
index c47a635b56ff..4ffaa3fa153f 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
@@ -82,41 +82,35 @@ static const u8 ant_toggle_lookup[] = {
         [ANT_ABC] = ANT_ABC,
 };
 
-#define IWL_DECLARE_RATE_INFO(r, s, ip, in, rp, rn, pp, np)    \
+#define IWL_DECLARE_RATE_INFO(r, s, rp, rn)                    \
         [IWL_RATE_##r##M_INDEX] = { IWL_RATE_##r##M_PLCP,      \
                                     IWL_RATE_SISO_##s##M_PLCP, \
                                     IWL_RATE_MIMO2_##s##M_PLCP,\
-                                    IWL_RATE_MIMO3_##s##M_PLCP,\
-                                    IWL_RATE_##r##M_IEEE,      \
-                                    IWL_RATE_##ip##M_INDEX,    \
-                                    IWL_RATE_##in##M_INDEX,    \
                                     IWL_RATE_##rp##M_INDEX,    \
-                                    IWL_RATE_##rn##M_INDEX,    \
-                                    IWL_RATE_##pp##M_INDEX,    \
-                                    IWL_RATE_##np##M_INDEX }
+                                    IWL_RATE_##rn##M_INDEX }
 
 /*
  * Parameter order:
- *   rate, ht rate, prev rate, next rate, prev tgg rate, next tgg rate
+ *   rate, ht rate, prev rate, next rate
  *
  * If there isn't a valid next or previous rate then INV is used which
  * maps to IWL_RATE_INVALID
  *
  */
 static const struct iwl_rs_rate_info iwl_rates[IWL_RATE_COUNT] = {
-        IWL_DECLARE_RATE_INFO(1, INV, INV, 2, INV, 2, INV, 2),    /*  1mbps */
-        IWL_DECLARE_RATE_INFO(2, INV, 1, 5, 1, 5, 1, 5),          /*  2mbps */
-        IWL_DECLARE_RATE_INFO(5, INV, 2, 6, 2, 11, 2, 11),        /*5.5mbps */
-        IWL_DECLARE_RATE_INFO(11, INV, 9, 12, 9, 12, 5, 18),      /* 11mbps */
-        IWL_DECLARE_RATE_INFO(6, 6, 5, 9, 5, 11, 5, 11),        /*  6mbps */
-        IWL_DECLARE_RATE_INFO(9, 6, 6, 11, 6, 11, 5, 11),       /*  9mbps */
-        IWL_DECLARE_RATE_INFO(12, 12, 11, 18, 11, 18, 11, 18),   /* 12mbps */
-        IWL_DECLARE_RATE_INFO(18, 18, 12, 24, 12, 24, 11, 24),   /* 18mbps */
-        IWL_DECLARE_RATE_INFO(24, 24, 18, 36, 18, 36, 18, 36),   /* 24mbps */
-        IWL_DECLARE_RATE_INFO(36, 36, 24, 48, 24, 48, 24, 48),   /* 36mbps */
-        IWL_DECLARE_RATE_INFO(48, 48, 36, 54, 36, 54, 36, 54),   /* 48mbps */
-        IWL_DECLARE_RATE_INFO(54, 54, 48, INV, 48, INV, 48, INV),/* 54mbps */
-        IWL_DECLARE_RATE_INFO(60, 60, 48, INV, 48, INV, 48, INV),/* 60mbps */
+        IWL_DECLARE_RATE_INFO(1, INV, INV, 2),   /*  1mbps */
+        IWL_DECLARE_RATE_INFO(2, INV, 1, 5),     /*  2mbps */
+        IWL_DECLARE_RATE_INFO(5, INV, 2, 11),    /*5.5mbps */
+        IWL_DECLARE_RATE_INFO(11, INV, 9, 12),   /* 11mbps */
+        IWL_DECLARE_RATE_INFO(6, 6, 5, 11),      /*  6mbps */
+        IWL_DECLARE_RATE_INFO(9, 6, 6, 11),      /*  9mbps */
+        IWL_DECLARE_RATE_INFO(12, 12, 11, 18),   /* 12mbps */
+        IWL_DECLARE_RATE_INFO(18, 18, 12, 24),   /* 18mbps */
+        IWL_DECLARE_RATE_INFO(24, 24, 18, 36),   /* 24mbps */
+        IWL_DECLARE_RATE_INFO(36, 36, 24, 48),   /* 36mbps */
+        IWL_DECLARE_RATE_INFO(48, 48, 36, 54),   /* 48mbps */
+        IWL_DECLARE_RATE_INFO(54, 54, 48, INV),  /* 54mbps */
+        IWL_DECLARE_RATE_INFO(60, 60, 48, INV),  /* 60mbps */
         /* FIXME:RS:          ^^    should be INV (legacy) */
 };
 
@@ -134,9 +128,8 @@ static int iwl_hwrate_to_plcp_idx(u32 rate_n_flags)
         if (rate_n_flags & RATE_MCS_HT_MSK) {
                 idx = rs_extract_rate(rate_n_flags);
 
-                if (idx >= IWL_RATE_MIMO3_6M_PLCP)
-                        idx = idx - IWL_RATE_MIMO3_6M_PLCP;
-                else if (idx >= IWL_RATE_MIMO2_6M_PLCP)
+                WARN_ON_ONCE(idx >= IWL_RATE_MIMO3_6M_PLCP);
+                if (idx >= IWL_RATE_MIMO2_6M_PLCP)
                         idx = idx - IWL_RATE_MIMO2_6M_PLCP;
 
                 idx += IWL_FIRST_OFDM_RATE;
@@ -168,10 +161,10 @@ static void rs_stay_in_table(struct iwl_lq_sta *lq_sta, bool force_search);
 
 #ifdef CONFIG_MAC80211_DEBUGFS
 static void rs_dbgfs_set_mcs(struct iwl_lq_sta *lq_sta,
-                             u32 *rate_n_flags, int index);
+                             u32 *rate_n_flags);
 #else
 static void rs_dbgfs_set_mcs(struct iwl_lq_sta *lq_sta,
-                             u32 *rate_n_flags, int index)
+                             u32 *rate_n_flags)
 {}
 #endif
 
@@ -218,20 +211,6 @@ static s32 expected_tpt_mimo2_40MHz[4][IWL_RATE_COUNT] = {
         {0, 0, 0, 0, 186, 0, 329, 439, 527, 667, 764, 803, 838}, /* AGG+SGI */
 };
 
-static s32 expected_tpt_mimo3_20MHz[4][IWL_RATE_COUNT] = {
-        {0, 0, 0, 0,  99, 0, 153, 186, 208, 239, 256, 263, 268}, /* Norm */
-        {0, 0, 0, 0, 106, 0, 162, 194, 215, 246, 262, 268, 273}, /* SGI */
-        {0, 0, 0, 0, 134, 0, 249, 346, 431, 574, 685, 732, 775}, /* AGG */
-        {0, 0, 0, 0, 148, 0, 272, 376, 465, 614, 727, 775, 818}, /* AGG+SGI */
-};
-
-static s32 expected_tpt_mimo3_40MHz[4][IWL_RATE_COUNT] = {
-        {0, 0, 0, 0, 152, 0, 211, 239, 255, 279,  290,  294,  297}, /* Norm */
-        {0, 0, 0, 0, 160, 0, 219, 245, 261, 284,  294,  297,  300}, /* SGI */
-        {0, 0, 0, 0, 254, 0, 443, 584, 695, 868,  984, 1030, 1070}, /* AGG */
-        {0, 0, 0, 0, 277, 0, 478, 624, 737, 911, 1026, 1070, 1109}, /* AGG+SGI */
-};
-
 /* mbps, mcs */
 static const struct iwl_rate_mcs_info iwl_rate_mcs[IWL_RATE_COUNT] = {
         {  "1", "BPSK DSSS"},
@@ -279,7 +258,6 @@ static void rs_program_fix_rate(struct iwl_mvm *mvm,
         lq_sta->active_legacy_rate = 0x0FFF;    /* 1 - 54 MBits, includes CCK */
         lq_sta->active_siso_rate   = 0x1FD0;    /* 6 - 60 MBits, no 9, no CCK */
         lq_sta->active_mimo2_rate  = 0x1FD0;    /* 6 - 60 MBits, no 9, no CCK */
-        lq_sta->active_mimo3_rate  = 0x1FD0;    /* 6 - 60 MBits, no 9, no CCK */
 
         IWL_DEBUG_RATE(mvm, "sta_id %d rate 0x%X\n",
                        lq_sta->lq.sta_id, lq_sta->dbg_fixed_rate);
@@ -459,7 +437,7 @@ static u32 rate_n_flags_from_tbl(struct iwl_mvm *mvm,
                 else if (is_mimo2(tbl->lq_type))
                         rate_n_flags |= iwl_rates[index].plcp_mimo2;
                 else
-                        rate_n_flags |= iwl_rates[index].plcp_mimo3;
+                        WARN_ON_ONCE(1);
         } else {
                 IWL_ERR(mvm, "Invalid tbl->lq_type %d\n", tbl->lq_type);
         }
@@ -497,7 +475,7 @@ static int rs_get_tbl_info_from_mcs(const u32 rate_n_flags,
         u8 num_of_ant = get_num_of_ant_from_rate(rate_n_flags);
         u8 mcs;
 
-        memset(tbl, 0, sizeof(struct iwl_scale_tbl_info));
+        memset(tbl, 0, offsetof(struct iwl_scale_tbl_info, win));
         *rate_idx = iwl_hwrate_to_plcp_idx(rate_n_flags);
 
         if (*rate_idx  == IWL_RATE_INVALID) {
@@ -536,12 +514,8 @@ static int rs_get_tbl_info_from_mcs(const u32 rate_n_flags,
                 } else if (mcs <= IWL_RATE_MIMO2_60M_PLCP) {
                         if (num_of_ant == 2)
                                 tbl->lq_type = LQ_MIMO2;
-                /* MIMO3 */
                 } else {
-                        if (num_of_ant == 3) {
-                                tbl->max_search = IWL_MAX_11N_MIMO3_SEARCH;
-                                tbl->lq_type = LQ_MIMO3;
-                        }
+                        WARN_ON_ONCE(num_of_ant == 3);
                 }
         }
         return 0;
@@ -607,10 +581,10 @@ static u16 rs_get_supported_rates(struct iwl_lq_sta *lq_sta,
         } else {
                 if (is_siso(rate_type))
                         return lq_sta->active_siso_rate;
-                else if (is_mimo2(rate_type))
+                else {
+                        WARN_ON_ONCE(!is_mimo2(rate_type));
                         return lq_sta->active_mimo2_rate;
-                else
-                        return lq_sta->active_mimo3_rate;
+                }
         }
 }
 
@@ -985,7 +959,7 @@ static void rs_set_expected_tpt_table(struct iwl_lq_sta *lq_sta,
         }
 
         /* Choose among many HT tables depending on number of streams
-         * (SISO/MIMO2/MIMO3), channel width (20/40), SGI, and aggregation
+         * (SISO/MIMO2), channel width (20/40), SGI, and aggregation
          * status */
         if (is_siso(tbl->lq_type) && !tbl->is_ht40)
                 ht_tbl_pointer = expected_tpt_siso20MHz;
@@ -993,12 +967,10 @@ static void rs_set_expected_tpt_table(struct iwl_lq_sta *lq_sta,
                 ht_tbl_pointer = expected_tpt_siso40MHz;
         else if (is_mimo2(tbl->lq_type) && !tbl->is_ht40)
                 ht_tbl_pointer = expected_tpt_mimo2_20MHz;
-        else if (is_mimo2(tbl->lq_type))
+        else {
+                WARN_ON_ONCE(!is_mimo2(tbl->lq_type));
                 ht_tbl_pointer = expected_tpt_mimo2_40MHz;
-        else if (is_mimo3(tbl->lq_type) && !tbl->is_ht40)
-                ht_tbl_pointer = expected_tpt_mimo3_20MHz;
-        else /* if (is_mimo3(tbl->lq_type)) <-- must be true */
-                ht_tbl_pointer = expected_tpt_mimo3_40MHz;
+        }
 
         if (!tbl->is_SGI && !lq_sta->is_agg)            /* Normal */
                 tbl->expected_tpt = ht_tbl_pointer[0];
@@ -1170,58 +1142,6 @@ static int rs_switch_to_mimo2(struct iwl_mvm *mvm,
 }
 
 /*
- * Set up search table for MIMO3
- */
-static int rs_switch_to_mimo3(struct iwl_mvm *mvm,
-                             struct iwl_lq_sta *lq_sta,
-                             struct ieee80211_sta *sta,
-                             struct iwl_scale_tbl_info *tbl, int index)
-{
-        u16 rate_mask;
-        s32 rate;
-        s8 is_green = lq_sta->is_green;
-
-        if (!sta->ht_cap.ht_supported)
-                return -1;
-
-        if (sta->smps_mode == IEEE80211_SMPS_STATIC)
-                return -1;
-
-        /* Need both Tx chains/antennas to support MIMO */
-        if (num_of_ant(iwl_fw_valid_tx_ant(mvm->fw)) < 3)
-                return -1;
-
-        IWL_DEBUG_RATE(mvm, "LQ: try to switch to MIMO3\n");
-
-        tbl->lq_type = LQ_MIMO3;
-        tbl->action = 0;
-        tbl->max_search = IWL_MAX_11N_MIMO3_SEARCH;
-        rate_mask = lq_sta->active_mimo3_rate;
-
-        if (iwl_is_ht40_tx_allowed(sta))
-                tbl->is_ht40 = 1;
-        else
-                tbl->is_ht40 = 0;
-
-        rs_set_expected_tpt_table(lq_sta, tbl);
-
-        rate = rs_get_best_rate(mvm, lq_sta, tbl, rate_mask, index);
-
-        IWL_DEBUG_RATE(mvm, "LQ: MIMO3 best rate %d mask %X\n",
-                       rate, rate_mask);
-        if ((rate == IWL_RATE_INVALID) || !((1 << rate) & rate_mask)) {
-                IWL_DEBUG_RATE(mvm, "Can't switch with index %d rate mask %x\n",
-                               rate, rate_mask);
-                return -1;
-        }
-        tbl->current_rate = rate_n_flags_from_tbl(mvm, tbl, rate, is_green);
-
-        IWL_DEBUG_RATE(mvm, "LQ: Switch to new mcs %X index is green %X\n",
-                       tbl->current_rate, is_green);
-        return 0;
-}
-
-/*
  * Set up search table for SISO
  */
 static int rs_switch_to_siso(struct iwl_mvm *mvm,
@@ -1330,21 +1250,14 @@ static int rs_move_legacy_other(struct iwl_mvm *mvm,
                         }
 
                         break;
-                case IWL_LEGACY_SWITCH_MIMO2_AB:
-                case IWL_LEGACY_SWITCH_MIMO2_AC:
-                case IWL_LEGACY_SWITCH_MIMO2_BC:
+                case IWL_LEGACY_SWITCH_MIMO2:
                         IWL_DEBUG_RATE(mvm, "LQ: Legacy switch to MIMO2\n");
 
                         /* Set up search table to try MIMO */
                         memcpy(search_tbl, tbl, sz);
                         search_tbl->is_SGI = 0;
 
-                        if (tbl->action == IWL_LEGACY_SWITCH_MIMO2_AB)
-                                search_tbl->ant_type = ANT_AB;
-                        else if (tbl->action == IWL_LEGACY_SWITCH_MIMO2_AC)
-                                search_tbl->ant_type = ANT_AC;
-                        else
-                                search_tbl->ant_type = ANT_BC;
+                        search_tbl->ant_type = ANT_AB;
 
                         if (!rs_is_valid_ant(valid_tx_ant,
                                              search_tbl->ant_type))
@@ -1357,30 +1270,11 @@ static int rs_move_legacy_other(struct iwl_mvm *mvm,
                                 goto out;
                         }
                         break;
-
-                case IWL_LEGACY_SWITCH_MIMO3_ABC:
-                        IWL_DEBUG_RATE(mvm, "LQ: Legacy switch to MIMO3\n");
-
-                        /* Set up search table to try MIMO3 */
-                        memcpy(search_tbl, tbl, sz);
-                        search_tbl->is_SGI = 0;
-
-                        search_tbl->ant_type = ANT_ABC;
-
-                        if (!rs_is_valid_ant(valid_tx_ant,
-                                             search_tbl->ant_type))
-                                break;
-
-                        ret = rs_switch_to_mimo3(mvm, lq_sta, sta,
-                                                 search_tbl, index);
-                        if (!ret) {
-                                lq_sta->action_counter = 0;
-                                goto out;
-                        }
-                        break;
+                default:
+                        WARN_ON_ONCE(1);
                 }
                 tbl->action++;
-                if (tbl->action > IWL_LEGACY_SWITCH_MIMO3_ABC)
+                if (tbl->action > IWL_LEGACY_SWITCH_MIMO2)
                         tbl->action = IWL_LEGACY_SWITCH_ANTENNA1;
 
                 if (tbl->action == start_action)
@@ -1392,7 +1286,7 @@ static int rs_move_legacy_other(struct iwl_mvm *mvm,
 out:
         lq_sta->search_better_tbl = 1;
         tbl->action++;
-        if (tbl->action > IWL_LEGACY_SWITCH_MIMO3_ABC)
+        if (tbl->action > IWL_LEGACY_SWITCH_MIMO2)
                 tbl->action = IWL_LEGACY_SWITCH_ANTENNA1;
         if (update_search_tbl_counter)
                 search_tbl->action = tbl->action;
@@ -1427,7 +1321,7 @@ static int rs_move_siso_to_other(struct iwl_mvm *mvm,
         case IWL_BT_COEX_TRAFFIC_LOAD_LOW:
                 /* avoid antenna B unless MIMO */
                 if (tbl->action == IWL_SISO_SWITCH_ANTENNA2)
-                        tbl->action = IWL_SISO_SWITCH_MIMO2_AB;
+                        tbl->action = IWL_SISO_SWITCH_MIMO2;
                 break;
         case IWL_BT_COEX_TRAFFIC_LOAD_HIGH:
         case IWL_BT_COEX_TRAFFIC_LOAD_CONTINUOUS:
@@ -1469,19 +1363,12 @@ static int rs_move_siso_to_other(struct iwl_mvm *mvm,
                                 goto out;
                         }
                         break;
-                case IWL_SISO_SWITCH_MIMO2_AB:
-                case IWL_SISO_SWITCH_MIMO2_AC:
-                case IWL_SISO_SWITCH_MIMO2_BC:
+                case IWL_SISO_SWITCH_MIMO2:
                         IWL_DEBUG_RATE(mvm, "LQ: SISO switch to MIMO2\n");
                         memcpy(search_tbl, tbl, sz);
                         search_tbl->is_SGI = 0;
 
-                        if (tbl->action == IWL_SISO_SWITCH_MIMO2_AB)
-                                search_tbl->ant_type = ANT_AB;
-                        else if (tbl->action == IWL_SISO_SWITCH_MIMO2_AC)
-                                search_tbl->ant_type = ANT_AC;
-                        else
-                                search_tbl->ant_type = ANT_BC;
+                        search_tbl->ant_type = ANT_AB;
 
                         if (!rs_is_valid_ant(valid_tx_ant,
                                              search_tbl->ant_type))
@@ -1522,24 +1409,11 @@ static int rs_move_siso_to_other(struct iwl_mvm *mvm,
                                                       index, is_green);
                         update_search_tbl_counter = 1;
                         goto out;
-                case IWL_SISO_SWITCH_MIMO3_ABC:
-                        IWL_DEBUG_RATE(mvm, "LQ: SISO switch to MIMO3\n");
-                        memcpy(search_tbl, tbl, sz);
-                        search_tbl->is_SGI = 0;
-                        search_tbl->ant_type = ANT_ABC;
-
-                        if (!rs_is_valid_ant(valid_tx_ant,
-                                             search_tbl->ant_type))
-                                break;
-
-                        ret = rs_switch_to_mimo3(mvm, lq_sta, sta,
-                                                 search_tbl, index);
-                        if (!ret)
-                                goto out;
-                        break;
+                default:
+                        WARN_ON_ONCE(1);
                 }
                 tbl->action++;
-                if (tbl->action > IWL_LEGACY_SWITCH_MIMO3_ABC)
+                if (tbl->action > IWL_SISO_SWITCH_GI)
                         tbl->action = IWL_SISO_SWITCH_ANTENNA1;
 
                 if (tbl->action == start_action)
@@ -1551,7 +1425,7 @@ static int rs_move_siso_to_other(struct iwl_mvm *mvm,
  out:
         lq_sta->search_better_tbl = 1;
         tbl->action++;
-        if (tbl->action > IWL_SISO_SWITCH_MIMO3_ABC)
+        if (tbl->action > IWL_SISO_SWITCH_GI)
                 tbl->action = IWL_SISO_SWITCH_ANTENNA1;
         if (update_search_tbl_counter)
                 search_tbl->action = tbl->action;
@@ -1592,8 +1466,7 @@ static int rs_move_mimo2_to_other(struct iwl_mvm *mvm,
                 break;
         case IWL_BT_COEX_TRAFFIC_LOAD_LOW:
                 /* avoid antenna B unless MIMO */
-                if (tbl->action == IWL_MIMO2_SWITCH_SISO_B ||
-                    tbl->action == IWL_MIMO2_SWITCH_SISO_C)
+                if (tbl->action == IWL_MIMO2_SWITCH_SISO_B)
                         tbl->action = IWL_MIMO2_SWITCH_SISO_A;
                 break;
         default:
@@ -1626,7 +1499,6 @@ static int rs_move_mimo2_to_other(struct iwl_mvm *mvm,
                         break;
                 case IWL_MIMO2_SWITCH_SISO_A:
                 case IWL_MIMO2_SWITCH_SISO_B:
-                case IWL_MIMO2_SWITCH_SISO_C:
                         IWL_DEBUG_RATE(mvm, "LQ: MIMO2 switch to SISO\n");
 
                         /* Set up new search table for SISO */
@@ -1634,10 +1506,8 @@ static int rs_move_mimo2_to_other(struct iwl_mvm *mvm,
 
                         if (tbl->action == IWL_MIMO2_SWITCH_SISO_A)
                                 search_tbl->ant_type = ANT_A;
-                        else if (tbl->action == IWL_MIMO2_SWITCH_SISO_B)
+                        else /* tbl->action == IWL_MIMO2_SWITCH_SISO_B */
                                 search_tbl->ant_type = ANT_B;
-                        else
-                                search_tbl->ant_type = ANT_C;
 
                         if (!rs_is_valid_ant(valid_tx_ant,
                                              search_tbl->ant_type))
@@ -1680,26 +1550,11 @@ static int rs_move_mimo2_to_other(struct iwl_mvm *mvm,
                                                       index, is_green);
                         update_search_tbl_counter = 1;
                         goto out;
-
-                case IWL_MIMO2_SWITCH_MIMO3_ABC:
-                        IWL_DEBUG_RATE(mvm, "LQ: MIMO2 switch to MIMO3\n");
-                        memcpy(search_tbl, tbl, sz);
-                        search_tbl->is_SGI = 0;
-                        search_tbl->ant_type = ANT_ABC;
-
-                        if (!rs_is_valid_ant(valid_tx_ant,
-                                             search_tbl->ant_type))
-                                break;
-
-                        ret = rs_switch_to_mimo3(mvm, lq_sta, sta,
-                                                 search_tbl, index);
-                        if (!ret)
-                                goto out;
-
-                        break;
+                default:
+                        WARN_ON_ONCE(1);
                 }
                 tbl->action++;
-                if (tbl->action > IWL_MIMO2_SWITCH_MIMO3_ABC)
+                if (tbl->action > IWL_MIMO2_SWITCH_GI)
                         tbl->action = IWL_MIMO2_SWITCH_ANTENNA1;
 
                 if (tbl->action == start_action)
@@ -1710,7 +1565,7 @@ static int rs_move_mimo2_to_other(struct iwl_mvm *mvm,
  out:
         lq_sta->search_better_tbl = 1;
         tbl->action++;
-        if (tbl->action > IWL_MIMO2_SWITCH_MIMO3_ABC)
+        if (tbl->action > IWL_MIMO2_SWITCH_GI)
                 tbl->action = IWL_MIMO2_SWITCH_ANTENNA1;
         if (update_search_tbl_counter)
                 search_tbl->action = tbl->action;
@@ -1719,171 +1574,6 @@ static int rs_move_mimo2_to_other(struct iwl_mvm *mvm,
 }
 
 /*
- * Try to switch to new modulation mode from MIMO3
- */
-static int rs_move_mimo3_to_other(struct iwl_mvm *mvm,
-                                 struct iwl_lq_sta *lq_sta,
-                                 struct ieee80211_sta *sta, int index)
-{
-        s8 is_green = lq_sta->is_green;
-        struct iwl_scale_tbl_info *tbl = &(lq_sta->lq_info[lq_sta->active_tbl]);
-        struct iwl_scale_tbl_info *search_tbl =
-                                &(lq_sta->lq_info[(1 - lq_sta->active_tbl)]);
-        struct iwl_rate_scale_data *window = &(tbl->win[index]);
-        struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
-        u32 sz = (sizeof(struct iwl_scale_tbl_info) -
-                  (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
-        u8 start_action;
-        u8 valid_tx_ant = iwl_fw_valid_tx_ant(mvm->fw);
-        u8 tx_chains_num = num_of_ant(valid_tx_ant);
-        int ret;
-        u8 update_search_tbl_counter = 0;
-
-        switch (BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD)) {
-        case IWL_BT_COEX_TRAFFIC_LOAD_NONE:
-                /* nothing */
-                break;
-        case IWL_BT_COEX_TRAFFIC_LOAD_HIGH:
-        case IWL_BT_COEX_TRAFFIC_LOAD_CONTINUOUS:
-                /* avoid antenna B and MIMO */
-                if (tbl->action != IWL_MIMO3_SWITCH_SISO_A)
-                        tbl->action = IWL_MIMO3_SWITCH_SISO_A;
-                break;
-        case IWL_BT_COEX_TRAFFIC_LOAD_LOW:
-                /* avoid antenna B unless MIMO */
-                if (tbl->action == IWL_MIMO3_SWITCH_SISO_B ||
-                    tbl->action == IWL_MIMO3_SWITCH_SISO_C)
-                        tbl->action = IWL_MIMO3_SWITCH_SISO_A;
-                break;
-        default:
-                IWL_ERR(mvm, "Invalid BT load %d",
-                        BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD));
-                break;
-        }
-
-        start_action = tbl->action;
-        while (1) {
-                lq_sta->action_counter++;
-                switch (tbl->action) {
-                case IWL_MIMO3_SWITCH_ANTENNA1:
-                case IWL_MIMO3_SWITCH_ANTENNA2:
-                        IWL_DEBUG_RATE(mvm, "LQ: MIMO3 toggle Antennas\n");
-
-                        if (tx_chains_num <= 3)
-                                break;
-
-                        if (window->success_ratio >= IWL_RS_GOOD_RATIO)
-                                break;
-
-                        memcpy(search_tbl, tbl, sz);
-                        if (rs_toggle_antenna(valid_tx_ant,
-                                              &search_tbl->current_rate,
-                                              search_tbl))
-                                goto out;
-                        break;
-                case IWL_MIMO3_SWITCH_SISO_A:
-                case IWL_MIMO3_SWITCH_SISO_B:
-                case IWL_MIMO3_SWITCH_SISO_C:
-                        IWL_DEBUG_RATE(mvm, "LQ: MIMO3 switch to SISO\n");
-
-                        /* Set up new search table for SISO */
-                        memcpy(search_tbl, tbl, sz);
-
-                        if (tbl->action == IWL_MIMO3_SWITCH_SISO_A)
-                                search_tbl->ant_type = ANT_A;
-                        else if (tbl->action == IWL_MIMO3_SWITCH_SISO_B)
-                                search_tbl->ant_type = ANT_B;
-                        else
-                                search_tbl->ant_type = ANT_C;
-
-                        if (!rs_is_valid_ant(valid_tx_ant,
-                                             search_tbl->ant_type))
-                                break;
-
-                        ret = rs_switch_to_siso(mvm, lq_sta, sta,
-                                                search_tbl, index);
-                        if (!ret)
-                                goto out;
-
-                        break;
-
-                case IWL_MIMO3_SWITCH_MIMO2_AB:
-                case IWL_MIMO3_SWITCH_MIMO2_AC:
-                case IWL_MIMO3_SWITCH_MIMO2_BC:
-                        IWL_DEBUG_RATE(mvm, "LQ: MIMO3 switch to MIMO2\n");
-
-                        memcpy(search_tbl, tbl, sz);
-                        search_tbl->is_SGI = 0;
-                        if (tbl->action == IWL_MIMO3_SWITCH_MIMO2_AB)
-                                search_tbl->ant_type = ANT_AB;
-                        else if (tbl->action == IWL_MIMO3_SWITCH_MIMO2_AC)
-                                search_tbl->ant_type = ANT_AC;
-                        else
-                                search_tbl->ant_type = ANT_BC;
-
-                        if (!rs_is_valid_ant(valid_tx_ant,
-                                             search_tbl->ant_type))
-                                break;
-
-                        ret = rs_switch_to_mimo2(mvm, lq_sta, sta,
-                                                 search_tbl, index);
-                        if (!ret)
-                                goto out;
-
-                        break;
-
-                case IWL_MIMO3_SWITCH_GI:
-                        if (!tbl->is_ht40 && !(ht_cap->cap &
-                                                IEEE80211_HT_CAP_SGI_20))
-                                break;
-                        if (tbl->is_ht40 && !(ht_cap->cap &
-                                                IEEE80211_HT_CAP_SGI_40))
-                                break;
-
-                        IWL_DEBUG_RATE(mvm, "LQ: MIMO3 toggle SGI/NGI\n");
-
-                        /* Set up new search table for MIMO */
-                        memcpy(search_tbl, tbl, sz);
-                        search_tbl->is_SGI = !tbl->is_SGI;
-                        rs_set_expected_tpt_table(lq_sta, search_tbl);
-                        /*
-                         * If active table already uses the fastest possible
-                         * modulation (dual stream with short guard interval),
-                         * and it's working well, there's no need to look
-                         * for a better type of modulation!
-                         */
-                        if (tbl->is_SGI) {
-                                s32 tpt = lq_sta->last_tpt / 100;
-                                if (tpt >= search_tbl->expected_tpt[index])
-                                        break;
-                        }
-                        search_tbl->current_rate =
-                                rate_n_flags_from_tbl(mvm, search_tbl,
-                                                      index, is_green);
-                        update_search_tbl_counter = 1;
-                        goto out;
-                }
-                tbl->action++;
-                if (tbl->action > IWL_MIMO3_SWITCH_GI)
-                        tbl->action = IWL_MIMO3_SWITCH_ANTENNA1;
-
-                if (tbl->action == start_action)
-                        break;
-        }
-        search_tbl->lq_type = LQ_NONE;
-        return 0;
- out:
-        lq_sta->search_better_tbl = 1;
-        tbl->action++;
-        if (tbl->action > IWL_MIMO3_SWITCH_GI)
-                tbl->action = IWL_MIMO3_SWITCH_ANTENNA1;
-        if (update_search_tbl_counter)
-                search_tbl->action = tbl->action;
-
-        return 0;
-}
-
-/*
  * Check whether we should continue using same modulation mode, or
  * begin search for a new mode, based on:
  * 1) # tx successes or failures while using this mode
@@ -2289,8 +1979,7 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
                 scale_action = 0;
 
         if ((BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD) >=
-             IWL_BT_COEX_TRAFFIC_LOAD_HIGH) &&
-             (is_mimo2(tbl->lq_type) || is_mimo3(tbl->lq_type))) {
+             IWL_BT_COEX_TRAFFIC_LOAD_HIGH) && (is_mimo(tbl->lq_type))) {
                 if (lq_sta->last_bt_traffic >
                     BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD)) {
                         /*
@@ -2307,8 +1996,7 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
                 BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD);
 
         if ((BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD) >=
-             IWL_BT_COEX_TRAFFIC_LOAD_HIGH) &&
-             (is_mimo2(tbl->lq_type) || is_mimo3(tbl->lq_type))) {
+             IWL_BT_COEX_TRAFFIC_LOAD_HIGH) && is_mimo(tbl->lq_type)) {
                 /* search for a new modulation */
                 rs_stay_in_table(lq_sta, true);
                 goto lq_update;
@@ -2368,7 +2056,7 @@ lq_update:
                 else if (is_mimo2(tbl->lq_type))
                         rs_move_mimo2_to_other(mvm, lq_sta, sta, index);
                 else
-                        rs_move_mimo3_to_other(mvm, lq_sta, sta, index);
+                        WARN_ON_ONCE(1);
 
                 /* If new "search" mode was selected, set up in uCode table */
                 if (lq_sta->search_better_tbl) {
@@ -2533,11 +2221,10 @@ static void rs_get_rate(void *mvm_r, struct ieee80211_sta *sta, void *mvm_sta,
                 rate_idx -= IWL_FIRST_OFDM_RATE;
                 /* 6M and 9M shared same MCS index */
                 rate_idx = (rate_idx > 0) ? (rate_idx - 1) : 0;
+                WARN_ON_ONCE(rs_extract_rate(lq_sta->last_rate_n_flags) >=
+                             IWL_RATE_MIMO3_6M_PLCP);
                 if (rs_extract_rate(lq_sta->last_rate_n_flags) >=
-                    IWL_RATE_MIMO3_6M_PLCP)
-                        rate_idx = rate_idx + (2 * MCS_INDEX_PER_STREAM);
-                else if (rs_extract_rate(lq_sta->last_rate_n_flags) >=
-                         IWL_RATE_MIMO2_6M_PLCP)
+                    IWL_RATE_MIMO2_6M_PLCP)
                         rate_idx = rate_idx + MCS_INDEX_PER_STREAM;
                 info->control.rates[0].flags = IEEE80211_TX_RC_MCS;
                 if (lq_sta->last_rate_n_flags & RATE_MCS_SGI_MSK)
@@ -2636,16 +2323,10 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         lq_sta->active_mimo2_rate &= ~((u16)0x2);
         lq_sta->active_mimo2_rate <<= IWL_FIRST_OFDM_RATE;
 
-        lq_sta->active_mimo3_rate = ht_cap->mcs.rx_mask[2] << 1;
-        lq_sta->active_mimo3_rate |= ht_cap->mcs.rx_mask[2] & 0x1;
-        lq_sta->active_mimo3_rate &= ~((u16)0x2);
-        lq_sta->active_mimo3_rate <<= IWL_FIRST_OFDM_RATE;
-
         IWL_DEBUG_RATE(mvm,
-                       "SISO-RATE=%X MIMO2-RATE=%X MIMO3-RATE=%X\n",
+                       "SISO-RATE=%X MIMO2-RATE=%X\n",
                        lq_sta->active_siso_rate,
-                       lq_sta->active_mimo2_rate,
-                       lq_sta->active_mimo3_rate);
+                       lq_sta->active_mimo2_rate);
 
         /* These values will be overridden later */
         lq_sta->lq.single_stream_ant_msk =
@@ -2689,7 +2370,7 @@ static void rs_fill_link_cmd(struct iwl_mvm *mvm,
         struct iwl_lq_cmd *lq_cmd = &lq_sta->lq;
 
         /* Override starting rate (index 0) if needed for debug purposes */
-        rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
+        rs_dbgfs_set_mcs(lq_sta, &new_rate);
 
         /* Interpret new_rate (rate_n_flags) */
         rs_get_tbl_info_from_mcs(new_rate, lq_sta->band,
@@ -2736,7 +2417,7 @@ static void rs_fill_link_cmd(struct iwl_mvm *mvm,
                         }
 
                         /* Override next rate if needed for debug purposes */
-                        rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
+                        rs_dbgfs_set_mcs(lq_sta, &new_rate);
 
                         /* Fill next table entry */
                         lq_cmd->rs_table[index] =
@@ -2778,7 +2459,7 @@ static void rs_fill_link_cmd(struct iwl_mvm *mvm,
                 use_ht_possible = 0;
 
                 /* Override next rate if needed for debug purposes */
-                rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
+                rs_dbgfs_set_mcs(lq_sta, &new_rate);
 
                 /* Fill next table entry */
                 lq_cmd->rs_table[index] = cpu_to_le32(new_rate);
@@ -2823,7 +2504,7 @@ static void rs_free_sta(void *mvm_r, struct ieee80211_sta *sta,
 
 #ifdef CONFIG_MAC80211_DEBUGFS
 static void rs_dbgfs_set_mcs(struct iwl_lq_sta *lq_sta,
-                             u32 *rate_n_flags, int index)
+                             u32 *rate_n_flags)
 {
         struct iwl_mvm *mvm;
         u8 valid_tx_ant;
@@ -2908,8 +2589,7 @@ static ssize_t rs_sta_dbgfs_scale_table_read(struct file *file,
            (is_legacy(tbl->lq_type)) ? "legacy" : "HT");
         if (is_Ht(tbl->lq_type)) {
                 desc += sprintf(buff+desc, " %s",
-                   (is_siso(tbl->lq_type)) ? "SISO" :
-                   ((is_mimo2(tbl->lq_type)) ? "MIMO2" : "MIMO3"));
+                   (is_siso(tbl->lq_type)) ? "SISO" : "MIMO2");
                    desc += sprintf(buff+desc, " %s",
                    (tbl->is_ht40) ? "40MHz" : "20MHz");
                    desc += sprintf(buff+desc, " %s %s %s\n",
@@ -3009,32 +2689,6 @@ static const struct file_operations rs_sta_dbgfs_stats_table_ops = {
         .llseek = default_llseek,
 };
 
-static ssize_t rs_sta_dbgfs_rate_scale_data_read(struct file *file,
-                        char __user *user_buf, size_t count, loff_t *ppos)
-{
-        struct iwl_lq_sta *lq_sta = file->private_data;
-        struct iwl_scale_tbl_info *tbl = &lq_sta->lq_info[lq_sta->active_tbl];
-        char buff[120];
-        int desc = 0;
-
-        if (is_Ht(tbl->lq_type))
-                desc += sprintf(buff+desc,
-                                "Bit Rate= %d Mb/s\n",
-                                tbl->expected_tpt[lq_sta->last_txrate_idx]);
-        else
-                desc += sprintf(buff+desc,
-                                "Bit Rate= %d Mb/s\n",
-                                iwl_rates[lq_sta->last_txrate_idx].ieee >> 1);
-
-        return simple_read_from_buffer(user_buf, count, ppos, buff, desc);
-}
-
-static const struct file_operations rs_sta_dbgfs_rate_scale_data_ops = {
-        .read = rs_sta_dbgfs_rate_scale_data_read,
-        .open = simple_open,
-        .llseek = default_llseek,
-};
-
 static void rs_add_debugfs(void *mvm, void *mvm_sta, struct dentry *dir)
 {
         struct iwl_lq_sta *lq_sta = mvm_sta;
@@ -3044,9 +2698,6 @@ static void rs_add_debugfs(void *mvm, void *mvm_sta, struct dentry *dir)
         lq_sta->rs_sta_dbgfs_stats_table_file =
                 debugfs_create_file("rate_stats_table", S_IRUSR, dir,
                                     lq_sta, &rs_sta_dbgfs_stats_table_ops);
-        lq_sta->rs_sta_dbgfs_rate_scale_data_file =
-                debugfs_create_file("rate_scale_data", S_IRUSR, dir,
-                                    lq_sta, &rs_sta_dbgfs_rate_scale_data_ops);
         lq_sta->rs_sta_dbgfs_tx_agg_tid_en_file =
                 debugfs_create_u8("tx_agg_tid_enable", S_IRUSR | S_IWUSR, dir,
                                   &lq_sta->tx_agg_tid_en);
@@ -3057,7 +2708,6 @@ static void rs_remove_debugfs(void *mvm, void *mvm_sta)
         struct iwl_lq_sta *lq_sta = mvm_sta;
         debugfs_remove(lq_sta->rs_sta_dbgfs_scale_table_file);
         debugfs_remove(lq_sta->rs_sta_dbgfs_stats_table_file);
-        debugfs_remove(lq_sta->rs_sta_dbgfs_rate_scale_data_file);
         debugfs_remove(lq_sta->rs_sta_dbgfs_tx_agg_tid_en_file);
 }
 #endif
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.h b/drivers/net/wireless/iwlwifi/mvm/rs.h
index 4a99a4d200ac..335cf1682902 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.h
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.h
@@ -38,14 +38,8 @@ struct iwl_rs_rate_info {
         u8 plcp;        /* uCode API:  IWL_RATE_6M_PLCP, etc. */
         u8 plcp_siso;   /* uCode API:  IWL_RATE_SISO_6M_PLCP, etc. */
         u8 plcp_mimo2;  /* uCode API:  IWL_RATE_MIMO2_6M_PLCP, etc. */
-        u8 plcp_mimo3;  /* uCode API:  IWL_RATE_MIMO3_6M_PLCP, etc. */
-        u8 ieee;        /* MAC header:  IWL_RATE_6M_IEEE, etc. */
-        u8 prev_ieee;    /* previous rate in IEEE speeds */
-        u8 next_ieee;    /* next rate in IEEE speeds */
         u8 prev_rs;      /* previous rate used in rs algo */
         u8 next_rs;      /* next rate used in rs algo */
-        u8 prev_rs_tgg;  /* previous rate used in TGG rs algo */
-        u8 next_rs_tgg;  /* next rate used in TGG rs algo */
 };
 
 #define IWL_RATE_60M_PLCP 3
@@ -120,23 +114,6 @@ enum {
         IWL_RATE_MIMO3_INVM_PLCP = IWL_RATE_SISO_INVM_PLCP,
 };
 
-/* MAC header values for bit rates */
-enum {
-        IWL_RATE_6M_IEEE  = 12,
-        IWL_RATE_9M_IEEE  = 18,
-        IWL_RATE_12M_IEEE = 24,
-        IWL_RATE_18M_IEEE = 36,
-        IWL_RATE_24M_IEEE = 48,
-        IWL_RATE_36M_IEEE = 72,
-        IWL_RATE_48M_IEEE = 96,
-        IWL_RATE_54M_IEEE = 108,
-        IWL_RATE_60M_IEEE = 120,
-        IWL_RATE_1M_IEEE  = 2,
-        IWL_RATE_2M_IEEE  = 4,
-        IWL_RATE_5M_IEEE  = 11,
-        IWL_RATE_11M_IEEE = 22,
-};
-
 #define IWL_RATES_MASK ((1 << IWL_RATE_COUNT) - 1)
 
 #define IWL_INVALID_VALUE    -1
@@ -165,47 +142,22 @@ enum {
 #define IWL_LEGACY_SWITCH_ANTENNA1      0
 #define IWL_LEGACY_SWITCH_ANTENNA2      1
 #define IWL_LEGACY_SWITCH_SISO          2
-#define IWL_LEGACY_SWITCH_MIMO2_AB      3
-#define IWL_LEGACY_SWITCH_MIMO2_AC      4
-#define IWL_LEGACY_SWITCH_MIMO2_BC      5
-#define IWL_LEGACY_SWITCH_MIMO3_ABC     6
+#define IWL_LEGACY_SWITCH_MIMO2         3
 
 /* possible actions when in siso mode */
 #define IWL_SISO_SWITCH_ANTENNA1        0
 #define IWL_SISO_SWITCH_ANTENNA2        1
-#define IWL_SISO_SWITCH_MIMO2_AB        2
-#define IWL_SISO_SWITCH_MIMO2_AC        3
-#define IWL_SISO_SWITCH_MIMO2_BC        4
-#define IWL_SISO_SWITCH_GI              5
-#define IWL_SISO_SWITCH_MIMO3_ABC       6
-
+#define IWL_SISO_SWITCH_MIMO2           2
+#define IWL_SISO_SWITCH_GI              3
 
 /* possible actions when in mimo mode */
 #define IWL_MIMO2_SWITCH_ANTENNA1       0
 #define IWL_MIMO2_SWITCH_ANTENNA2       1
 #define IWL_MIMO2_SWITCH_SISO_A         2
 #define IWL_MIMO2_SWITCH_SISO_B         3
-#define IWL_MIMO2_SWITCH_SISO_C         4
-#define IWL_MIMO2_SWITCH_GI             5
-#define IWL_MIMO2_SWITCH_MIMO3_ABC      6
-
-
-/* possible actions when in mimo3 mode */
-#define IWL_MIMO3_SWITCH_ANTENNA1       0
-#define IWL_MIMO3_SWITCH_ANTENNA2       1
-#define IWL_MIMO3_SWITCH_SISO_A         2
-#define IWL_MIMO3_SWITCH_SISO_B         3
-#define IWL_MIMO3_SWITCH_SISO_C         4
-#define IWL_MIMO3_SWITCH_MIMO2_AB       5
-#define IWL_MIMO3_SWITCH_MIMO2_AC       6
-#define IWL_MIMO3_SWITCH_MIMO2_BC       7
-#define IWL_MIMO3_SWITCH_GI             8
-
-
-#define IWL_MAX_11N_MIMO3_SEARCH IWL_MIMO3_SWITCH_GI
-#define IWL_MAX_SEARCH IWL_MIMO2_SWITCH_MIMO3_ABC
+#define IWL_MIMO2_SWITCH_GI             4
 
-/*FIXME:RS:add possible actions for MIMO3*/
+#define IWL_MAX_SEARCH IWL_MIMO2_SWITCH_GI
 
 #define IWL_ACTION_LIMIT                3       /* # possible actions */
 
@@ -240,15 +192,13 @@ enum iwl_table_type {
         LQ_A,
         LQ_SISO,        /* high-throughput types */
         LQ_MIMO2,
-        LQ_MIMO3,
         LQ_MAX,
 };
 
 #define is_legacy(tbl) (((tbl) == LQ_G) || ((tbl) == LQ_A))
 #define is_siso(tbl) ((tbl) == LQ_SISO)
 #define is_mimo2(tbl) ((tbl) == LQ_MIMO2)
-#define is_mimo3(tbl) ((tbl) == LQ_MIMO3)
-#define is_mimo(tbl) (is_mimo2(tbl) || is_mimo3(tbl))
+#define is_mimo(tbl) is_mimo2(tbl)
 #define is_Ht(tbl) (is_siso(tbl) || is_mimo(tbl))
 #define is_a_band(tbl) ((tbl) == LQ_A)
 #define is_g_and(tbl) ((tbl) == LQ_G)
@@ -320,7 +270,6 @@ struct iwl_lq_sta {
         u16 active_legacy_rate;
         u16 active_siso_rate;
         u16 active_mimo2_rate;
-        u16 active_mimo3_rate;
         s8 max_rate_idx;     /* Max rate set by user */
         u8 missed_rate_counter;
 
@@ -330,7 +279,6 @@ struct iwl_lq_sta {
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct dentry *rs_sta_dbgfs_scale_table_file;
         struct dentry *rs_sta_dbgfs_stats_table_file;
-        struct dentry *rs_sta_dbgfs_rate_scale_data_file;
         struct dentry *rs_sta_dbgfs_tx_agg_tid_en_file;
         u32 dbg_fixed_rate;
 #endif
diff --git a/drivers/net/wireless/iwlwifi/mvm/rx.c b/drivers/net/wireless/iwlwifi/mvm/rx.c
index ee6547d22287..2a8cb5a60535 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rx.c
@@ -396,11 +396,62 @@ static void iwl_mvm_update_rx_statistics(struct iwl_mvm *mvm,
         memcpy(&mvm->rx_stats, &stats->rx, sizeof(struct mvm_statistics_rx));
 }
 
+struct iwl_mvm_stat_data {
+        struct iwl_notif_statistics *stats;
+        struct iwl_mvm *mvm;
+};
+
+static void iwl_mvm_stat_iterator(void *_data, u8 *mac,
+                                  struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_stat_data *data = _data;
+        struct iwl_notif_statistics *stats = data->stats;
+        struct iwl_mvm *mvm = data->mvm;
+        int sig = -stats->general.beacon_filter_average_energy;
+        int last_event;
+        int thold = vif->bss_conf.cqm_rssi_thold;
+        int hyst = vif->bss_conf.cqm_rssi_hyst;
+        u16 id = le32_to_cpu(stats->rx.general.mac_id);
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
+        if (mvmvif->id != id)
+                return;
+
+        if (vif->type != NL80211_IFTYPE_STATION)
+                return;
+
+        mvmvif->bf_data.ave_beacon_signal = sig;
+
+        if (!(vif->driver_flags & IEEE80211_VIF_SUPPORTS_CQM_RSSI))
+                return;
+
+        /* CQM Notification */
+        last_event = mvmvif->bf_data.last_cqm_event;
+        if (thold && sig < thold && (last_event == 0 ||
+                                     sig < last_event - hyst)) {
+                mvmvif->bf_data.last_cqm_event = sig;
+                IWL_DEBUG_RX(mvm, "cqm_iterator cqm low %d\n",
+                             sig);
+                ieee80211_cqm_rssi_notify(
+                        vif,
+                        NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
+                        GFP_KERNEL);
+        } else if (sig > thold &&
+                   (last_event == 0 || sig > last_event + hyst)) {
+                mvmvif->bf_data.last_cqm_event = sig;
+                IWL_DEBUG_RX(mvm, "cqm_iterator cqm high %d\n",
+                             sig);
+                ieee80211_cqm_rssi_notify(
+                        vif,
+                        NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
+                        GFP_KERNEL);
+        }
+}
+
 /*
  * iwl_mvm_rx_statistics - STATISTICS_NOTIFICATION handler
  *
  * TODO: This handler is implemented partially.
- * It only gets the NIC's temperature.
  */
 int iwl_mvm_rx_statistics(struct iwl_mvm *mvm,
                           struct iwl_rx_cmd_buffer *rxb,
@@ -409,6 +460,10 @@ int iwl_mvm_rx_statistics(struct iwl_mvm *mvm,
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_notif_statistics *stats = (void *)&pkt->data;
         struct mvm_statistics_general_common *common = &stats->general.common;
+        struct iwl_mvm_stat_data data = {
+                .stats = stats,
+                .mvm = mvm,
+        };
 
         if (mvm->temperature != le32_to_cpu(common->temperature)) {
                 mvm->temperature = le32_to_cpu(common->temperature);
@@ -416,5 +471,9 @@ int iwl_mvm_rx_statistics(struct iwl_mvm *mvm,
         }
         iwl_mvm_update_rx_statistics(mvm, stats);
 
+        ieee80211_iterate_active_interfaces(mvm->hw,
+                                            IEEE80211_IFACE_ITER_NORMAL,
+                                            iwl_mvm_stat_iterator,
+                                            &data);
         return 0;
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index 7fd6fbfbc1b3..c17b74c31398 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -73,7 +73,6 @@
 #include "iwl-prph.h"
 
 /* A TimeUnit is 1024 microsecond */
-#define TU_TO_JIFFIES(_tu)      (usecs_to_jiffies((_tu) * 1024))
 #define MSEC_TO_TU(_msec)       (_msec*1000/1024)
 
 /*
@@ -185,7 +184,7 @@ static void iwl_mvm_te_handle_notif(struct iwl_mvm *mvm,
                 }
         }
 
-        if (le32_to_cpu(notif->action) & TE_NOTIF_HOST_EVENT_END) {
+        if (le32_to_cpu(notif->action) & TE_V2_NOTIF_HOST_EVENT_END) {
                 IWL_DEBUG_TE(mvm,
                              "TE ended - current time %lu, estimated end %lu\n",
                              jiffies, te_data->end_jiffies);
@@ -202,10 +201,9 @@ static void iwl_mvm_te_handle_notif(struct iwl_mvm *mvm,
                 iwl_mvm_te_check_disconnect(mvm, te_data->vif,
                         "No assocation and the time event is over already...");
                 iwl_mvm_te_clear_data(mvm, te_data);
-        } else if (le32_to_cpu(notif->action) & TE_NOTIF_HOST_EVENT_START) {
+        } else if (le32_to_cpu(notif->action) & TE_V2_NOTIF_HOST_EVENT_START) {
                 te_data->running = true;
-                te_data->end_jiffies = jiffies +
-                        TU_TO_JIFFIES(te_data->duration);
+                te_data->end_jiffies = TU_TO_EXP_TIME(te_data->duration);
 
                 if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE) {
                         set_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status);
@@ -270,10 +268,67 @@ static bool iwl_mvm_time_event_response(struct iwl_notif_wait_data *notif_wait,
         return true;
 }
 
+/* used to convert from time event API v2 to v1 */
+#define TE_V2_DEP_POLICY_MSK (TE_V2_DEP_OTHER | TE_V2_DEP_TSF |\
+                             TE_V2_EVENT_SOCIOPATHIC)
+static inline u16 te_v2_get_notify(__le16 policy)
+{
+        return le16_to_cpu(policy) & TE_V2_NOTIF_MSK;
+}
+
+static inline u16 te_v2_get_dep_policy(__le16 policy)
+{
+        return (le16_to_cpu(policy) & TE_V2_DEP_POLICY_MSK) >>
+                TE_V2_PLACEMENT_POS;
+}
+
+static inline u16 te_v2_get_absence(__le16 policy)
+{
+        return (le16_to_cpu(policy) & TE_V2_ABSENCE) >> TE_V2_ABSENCE_POS;
+}
+
+static void iwl_mvm_te_v2_to_v1(const struct iwl_time_event_cmd_v2 *cmd_v2,
+                                struct iwl_time_event_cmd_v1 *cmd_v1)
+{
+        cmd_v1->id_and_color = cmd_v2->id_and_color;
+        cmd_v1->action = cmd_v2->action;
+        cmd_v1->id = cmd_v2->id;
+        cmd_v1->apply_time = cmd_v2->apply_time;
+        cmd_v1->max_delay = cmd_v2->max_delay;
+        cmd_v1->depends_on = cmd_v2->depends_on;
+        cmd_v1->interval = cmd_v2->interval;
+        cmd_v1->duration = cmd_v2->duration;
+        if (cmd_v2->repeat == TE_V2_REPEAT_ENDLESS)
+                cmd_v1->repeat = cpu_to_le32(TE_V1_REPEAT_ENDLESS);
+        else
+                cmd_v1->repeat = cpu_to_le32(cmd_v2->repeat);
+        cmd_v1->max_frags = cpu_to_le32(cmd_v2->max_frags);
+        cmd_v1->interval_reciprocal = 0; /* unused */
+
+        cmd_v1->dep_policy = cpu_to_le32(te_v2_get_dep_policy(cmd_v2->policy));
+        cmd_v1->is_present = cpu_to_le32(!te_v2_get_absence(cmd_v2->policy));
+        cmd_v1->notify = cpu_to_le32(te_v2_get_notify(cmd_v2->policy));
+}
+
+static int iwl_mvm_send_time_event_cmd(struct iwl_mvm *mvm,
+                                       const struct iwl_time_event_cmd_v2 *cmd)
+{
+        struct iwl_time_event_cmd_v1 cmd_v1;
+
+        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_TIME_EVENT_API_V2)
+                return iwl_mvm_send_cmd_pdu(mvm, TIME_EVENT_CMD, CMD_SYNC,
+                                            sizeof(*cmd), cmd);
+
+        iwl_mvm_te_v2_to_v1(cmd, &cmd_v1);
+        return iwl_mvm_send_cmd_pdu(mvm, TIME_EVENT_CMD, CMD_SYNC,
+                                    sizeof(cmd_v1), &cmd_v1);
+}
+
+
 static int iwl_mvm_time_event_send_add(struct iwl_mvm *mvm,
                                        struct ieee80211_vif *vif,
                                        struct iwl_mvm_time_event_data *te_data,
-                                       struct iwl_time_event_cmd *te_cmd)
+                                       struct iwl_time_event_cmd_v2 *te_cmd)
 {
         static const u8 time_event_response[] = { TIME_EVENT_CMD };
         struct iwl_notification_wait wait_time_event;
@@ -309,8 +364,7 @@ static int iwl_mvm_time_event_send_add(struct iwl_mvm *mvm,
                                    ARRAY_SIZE(time_event_response),
                                    iwl_mvm_time_event_response, te_data);
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, TIME_EVENT_CMD, CMD_SYNC,
-                                   sizeof(*te_cmd), te_cmd);
+        ret = iwl_mvm_send_time_event_cmd(mvm, te_cmd);
         if (ret) {
                 IWL_ERR(mvm, "Couldn't send TIME_EVENT_CMD: %d\n", ret);
                 iwl_remove_notification(&mvm->notif_wait, &wait_time_event);
@@ -337,13 +391,12 @@ void iwl_mvm_protect_session(struct iwl_mvm *mvm,
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_mvm_time_event_data *te_data = &mvmvif->time_event_data;
-        struct iwl_time_event_cmd time_cmd = {};
+        struct iwl_time_event_cmd_v2 time_cmd = {};
 
         lockdep_assert_held(&mvm->mutex);
 
         if (te_data->running &&
-            time_after(te_data->end_jiffies,
-                       jiffies + TU_TO_JIFFIES(min_duration))) {
+            time_after(te_data->end_jiffies, TU_TO_EXP_TIME(min_duration))) {
                 IWL_DEBUG_TE(mvm, "We have enough time in the current TE: %u\n",
                              jiffies_to_msecs(te_data->end_jiffies - jiffies));
                 return;
@@ -372,17 +425,14 @@ void iwl_mvm_protect_session(struct iwl_mvm *mvm,
         time_cmd.apply_time =
                 cpu_to_le32(iwl_read_prph(mvm->trans, DEVICE_SYSTEM_TIME_REG));
 
-        time_cmd.dep_policy = TE_INDEPENDENT;
-        time_cmd.is_present = cpu_to_le32(1);
-        time_cmd.max_frags = cpu_to_le32(TE_FRAG_NONE);
+        time_cmd.max_frags = TE_V2_FRAG_NONE;
         time_cmd.max_delay = cpu_to_le32(500);
         /* TODO: why do we need to interval = bi if it is not periodic? */
         time_cmd.interval = cpu_to_le32(1);
-        time_cmd.interval_reciprocal = cpu_to_le32(iwl_mvm_reciprocal(1));
         time_cmd.duration = cpu_to_le32(duration);
-        time_cmd.repeat = cpu_to_le32(1);
-        time_cmd.notify = cpu_to_le32(TE_NOTIF_HOST_EVENT_START |
-                                      TE_NOTIF_HOST_EVENT_END);
+        time_cmd.repeat = 1;
+        time_cmd.policy = cpu_to_le16(TE_V2_NOTIF_HOST_EVENT_START |
+                                      TE_V2_NOTIF_HOST_EVENT_END);
 
         iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd);
 }
@@ -396,7 +446,7 @@ void iwl_mvm_remove_time_event(struct iwl_mvm *mvm,
                                struct iwl_mvm_vif *mvmvif,
                                struct iwl_mvm_time_event_data *te_data)
 {
-        struct iwl_time_event_cmd time_cmd = {};
+        struct iwl_time_event_cmd_v2 time_cmd = {};
         u32 id, uid;
         int ret;
 
@@ -433,8 +483,7 @@ void iwl_mvm_remove_time_event(struct iwl_mvm *mvm,
                 cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color));
 
         IWL_DEBUG_TE(mvm, "Removing TE 0x%x\n", le32_to_cpu(time_cmd.id));
-        ret = iwl_mvm_send_cmd_pdu(mvm, TIME_EVENT_CMD, CMD_SYNC,
-                                   sizeof(time_cmd), &time_cmd);
+        ret = iwl_mvm_send_time_event_cmd(mvm, &time_cmd);
         if (WARN_ON(ret))
                 return;
 }
@@ -454,7 +503,7 @@ int iwl_mvm_start_p2p_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_mvm_time_event_data *te_data = &mvmvif->time_event_data;
-        struct iwl_time_event_cmd time_cmd = {};
+        struct iwl_time_event_cmd_v2 time_cmd = {};
 
         lockdep_assert_held(&mvm->mutex);
         if (te_data->running) {
@@ -485,8 +534,6 @@ int iwl_mvm_start_p2p_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         }
 
         time_cmd.apply_time = cpu_to_le32(0);
-        time_cmd.dep_policy = cpu_to_le32(TE_INDEPENDENT);
-        time_cmd.is_present = cpu_to_le32(1);
         time_cmd.interval = cpu_to_le32(1);
 
         /*
@@ -495,12 +542,12 @@ int iwl_mvm_start_p2p_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
          * scheduled. To improve the chances of it being scheduled, allow them
          * to be fragmented, and in addition allow them to be delayed.
          */
-        time_cmd.max_frags = cpu_to_le32(MSEC_TO_TU(duration)/20);
+        time_cmd.max_frags = min(MSEC_TO_TU(duration)/50, TE_V2_FRAG_ENDLESS);
         time_cmd.max_delay = cpu_to_le32(MSEC_TO_TU(duration/2));
         time_cmd.duration = cpu_to_le32(MSEC_TO_TU(duration));
-        time_cmd.repeat = cpu_to_le32(1);
-        time_cmd.notify = cpu_to_le32(TE_NOTIF_HOST_EVENT_START |
-                                      TE_NOTIF_HOST_EVENT_END);
+        time_cmd.repeat = 1;
+        time_cmd.policy = cpu_to_le16(TE_V2_NOTIF_HOST_EVENT_START |
+                                      TE_V2_NOTIF_HOST_EVENT_END);
 
         return iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd);
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index f68ef9dd6a70..e05440d90319 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -91,11 +91,10 @@ static void iwl_mvm_set_tx_cmd(struct iwl_mvm *mvm, struct sk_buff *skb,
                 tx_flags |= TX_CMD_FLG_ACK | TX_CMD_FLG_BAR;
 
         /* High prio packet (wrt. BT coex) if it is EAPOL, MCAST or MGMT */
-        if (info->band == IEEE80211_BAND_2GHZ        &&
-            (skb->protocol == cpu_to_be16(ETH_P_PAE)  ||
-             is_multicast_ether_addr(hdr->addr1)      ||
-             ieee80211_is_back_req(fc)                ||
-             ieee80211_is_mgmt(fc)))
+        if (info->band == IEEE80211_BAND_2GHZ &&
+            (info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO ||
+             is_multicast_ether_addr(hdr->addr1) ||
+             ieee80211_is_back_req(fc) || ieee80211_is_mgmt(fc)))
                 tx_flags |= TX_CMD_FLG_BT_DIS;
 
         if (ieee80211_has_morefrags(fc))
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 158669ee4ce5..dc02cb9792af 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -325,15 +325,15 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         int ret;
 
         iwl_trans = iwl_trans_pcie_alloc(pdev, ent, cfg);
-        if (iwl_trans == NULL)
-                return -ENOMEM;
+        if (IS_ERR(iwl_trans))
+                return PTR_ERR(iwl_trans);
 
         pci_set_drvdata(pdev, iwl_trans);
 
         trans_pcie = IWL_TRANS_GET_PCIE_TRANS(iwl_trans);
         trans_pcie->drv = iwl_drv_start(iwl_trans, cfg);
 
-        if (IS_ERR_OR_NULL(trans_pcie->drv)) {
+        if (IS_ERR(trans_pcie->drv)) {
                 ret = PTR_ERR(trans_pcie->drv);
                 goto out_free_trans;
         }
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index 5fdb4eea146d..3f237b42eb36 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -112,15 +112,16 @@
  */
 static int iwl_rxq_space(const struct iwl_rxq *rxq)
 {
-        int s = rxq->read - rxq->write;
-
-        if (s <= 0)
-                s += RX_QUEUE_SIZE;
-        /* keep some buffer to not confuse full and empty queue */
-        s -= 2;
-        if (s < 0)
-                s = 0;
-        return s;
+        /* Make sure RX_QUEUE_SIZE is a power of 2 */
+        BUILD_BUG_ON(RX_QUEUE_SIZE & (RX_QUEUE_SIZE - 1));
+
+        /*
+         * There can be up to (RX_QUEUE_SIZE - 1) free slots, to avoid ambiguity
+         * between empty and completely full queues.
+         * The following is equivalent to modulo by RX_QUEUE_SIZE and is well
+         * defined for negative dividends.
+         */
+        return (rxq->read - rxq->write - 1) & (RX_QUEUE_SIZE - 1);
 }
 
 /*
@@ -1120,6 +1121,7 @@ static irqreturn_t iwl_pcie_isr(int irq, void *data)
         struct iwl_trans *trans = data;
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         u32 inta, inta_mask;
+        irqreturn_t ret = IRQ_NONE;
 
         lockdep_assert_held(&trans_pcie->irq_lock);
 
@@ -1168,10 +1170,8 @@ static irqreturn_t iwl_pcie_isr(int irq, void *data)
         /* the thread will service interrupts and re-enable them */
         if (likely(inta))
                 return IRQ_WAKE_THREAD;
-        else if (test_bit(STATUS_INT_ENABLED, &trans_pcie->status) &&
-                 !trans_pcie->inta)
-                iwl_enable_interrupts(trans);
-        return IRQ_HANDLED;
+
+        ret = IRQ_HANDLED;
 
 none:
         /* re-enable interrupts here since we don't have anything to service. */
@@ -1180,7 +1180,7 @@ none:
             !trans_pcie->inta)
                 iwl_enable_interrupts(trans);
 
-        return IRQ_NONE;
+        return ret;
 }
 
 /* interrupt handler using ict table, with this interrupt driver will
@@ -1199,6 +1199,7 @@ irqreturn_t iwl_pcie_isr_ict(int irq, void *data)
         u32 val = 0;
         u32 read;
         unsigned long flags;
+        irqreturn_t ret = IRQ_NONE;
 
         if (!trans)
                 return IRQ_NONE;
@@ -1211,7 +1212,7 @@ irqreturn_t iwl_pcie_isr_ict(int irq, void *data)
          * use legacy interrupt.
          */
         if (unlikely(!trans_pcie->use_ict)) {
-                irqreturn_t ret = iwl_pcie_isr(irq, data);
+                ret = iwl_pcie_isr(irq, data);
                 spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
                 return ret;
         }
@@ -1280,17 +1281,9 @@ irqreturn_t iwl_pcie_isr_ict(int irq, void *data)
         if (likely(inta)) {
                 spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
                 return IRQ_WAKE_THREAD;
-        } else if (test_bit(STATUS_INT_ENABLED, &trans_pcie->status) &&
-                 !trans_pcie->inta) {
-                /* Allow interrupt if was disabled by this handler and
-                 * no tasklet was schedules, We should not enable interrupt,
-                 * tasklet will enable it.
-                 */
-                iwl_enable_interrupts(trans);
         }
 
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
-        return IRQ_HANDLED;
+        ret = IRQ_HANDLED;
 
  none:
         /* re-enable interrupts here since we don't have anything to service.
@@ -1301,5 +1294,5 @@ irqreturn_t iwl_pcie_isr_ict(int irq, void *data)
                 iwl_enable_interrupts(trans);
 
         spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
-        return IRQ_NONE;
+        return ret;
 }
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index eca44299c512..bad95d28d50d 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -1386,9 +1386,10 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
 
         trans = kzalloc(sizeof(struct iwl_trans) +
                         sizeof(struct iwl_trans_pcie), GFP_KERNEL);
-
-        if (!trans)
-                return NULL;
+        if (!trans) {
+                err = -ENOMEM;
+                goto out;
+        }
 
         trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
 
@@ -1411,15 +1412,9 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
                                        PCIE_LINK_STATE_CLKPM);
         }
 
-        if (pci_enable_device(pdev)) {
-                err = -ENODEV;
+        err = pci_enable_device(pdev);
+        if (err)
                 goto out_no_pci;
-        }
-
-        /* W/A - seems to solve weird behavior. We need to remove this if we
-         * don't want to stay in L1 all the time. This wastes a lot of power */
-        pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1 |
-                               PCIE_LINK_STATE_CLKPM);
 
         pci_set_master(pdev);
 
@@ -1488,17 +1483,20 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
                                   SLAB_HWCACHE_ALIGN,
                                   NULL);
 
-        if (!trans->dev_cmd_pool)
+        if (!trans->dev_cmd_pool) {
+                err = -ENOMEM;
                 goto out_pci_disable_msi;
+        }
 
         trans_pcie->inta_mask = CSR_INI_SET_MASK;
 
         if (iwl_pcie_alloc_ict(trans))
                 goto out_free_cmd_pool;
 
-        if (request_threaded_irq(pdev->irq, iwl_pcie_isr_ict,
-                                 iwl_pcie_irq_handler,
-                                 IRQF_SHARED, DRV_NAME, trans)) {
+        err = request_threaded_irq(pdev->irq, iwl_pcie_isr_ict,
+                                   iwl_pcie_irq_handler,
+                                   IRQF_SHARED, DRV_NAME, trans);
+        if (err) {
                 IWL_ERR(trans, "Error allocating IRQ %d\n", pdev->irq);
                 goto out_free_ict;
         }
@@ -1517,5 +1515,6 @@ out_pci_disable_device:
         pci_disable_device(pdev);
 out_no_pci:
         kfree(trans);
-        return NULL;
+out:
+        return ERR_PTR(err);
 }
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 011167c22da8..f45eb29c2ede 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -65,18 +65,30 @@
  ***************************************************/
 static int iwl_queue_space(const struct iwl_queue *q)
 {
-        int s = q->read_ptr - q->write_ptr;
-
-        if (q->read_ptr > q->write_ptr)
-                s -= q->n_bd;
-
-        if (s <= 0)
-                s += q->n_window;
-        /* keep some reserve to not confuse empty and full situations */
-        s -= 2;
-        if (s < 0)
-                s = 0;
-        return s;
+        unsigned int max;
+        unsigned int used;
+
+        /*
+         * To avoid ambiguity between empty and completely full queues, there
+         * should always be less than q->n_bd elements in the queue.
+         * If q->n_window is smaller than q->n_bd, there is no need to reserve
+         * any queue entries for this purpose.
+         */
+        if (q->n_window < q->n_bd)
+                max = q->n_window;
+        else
+                max = q->n_bd - 1;
+
+        /*
+         * q->n_bd is a power of 2, so the following is equivalent to modulo by
+         * q->n_bd and is well defined for negative dividends.
+         */
+        used = (q->write_ptr - q->read_ptr) & (q->n_bd - 1);
+
+        if (WARN_ON(used > max))
+                return 0;
+
+        return max - used;
 }
 
 /*
@@ -826,7 +838,7 @@ static int iwl_pcie_tx_alloc(struct iwl_trans *trans)
                                   sizeof(struct iwl_txq), GFP_KERNEL);
         if (!trans_pcie->txq) {
                 IWL_ERR(trans, "Not enough memory for txq\n");
-                ret = ENOMEM;
+                ret = -ENOMEM;
                 goto error;
         }
 
diff --git a/drivers/net/wireless/libertas/mesh.c b/drivers/net/wireless/libertas/mesh.c
index efae07e05c80..6fef746345bc 100644
--- a/drivers/net/wireless/libertas/mesh.c
+++ b/drivers/net/wireless/libertas/mesh.c
@@ -1017,7 +1017,7 @@ static int lbs_add_mesh(struct lbs_private *priv)
 
         mesh_dev->netdev_ops = &mesh_netdev_ops;
         mesh_dev->ethtool_ops = &lbs_ethtool_ops;
-        memcpy(mesh_dev->dev_addr, priv->dev->dev_addr, ETH_ALEN);
+        eth_hw_addr_inherit(mesh_dev, priv->dev);
 
         SET_NETDEV_DEV(priv->mesh_dev, priv->dev->dev.parent);
 
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 7b2a6229eedb..2cd3f54e1efa 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -1364,6 +1364,7 @@ static const struct nla_policy hwsim_testmode_policy[HWSIM_TM_ATTR_MAX + 1] = {
 static int hwsim_fops_ps_write(void *dat, u64 val);
 
 static int mac80211_hwsim_testmode_cmd(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif,
                                        void *data, int len)
 {
         struct mac80211_hwsim_data *hwsim = hw->priv;
@@ -2527,8 +2528,10 @@ static int __init init_mac80211_hwsim(void)
         }
 
         hwsim_mon = alloc_netdev(0, "hwsim%d", hwsim_mon_setup);
-        if (hwsim_mon == NULL)
+        if (hwsim_mon == NULL) {
+                err = -ENOMEM;
                 goto failed;
+        }
 
         rtnl_lock();
 
diff --git a/drivers/net/wireless/mwifiex/11n.c b/drivers/net/wireless/mwifiex/11n.c
index 41e9d25a2d8e..0b803c05cab3 100644
--- a/drivers/net/wireless/mwifiex/11n.c
+++ b/drivers/net/wireless/mwifiex/11n.c
@@ -292,6 +292,7 @@ mwifiex_cmd_append_11n_tlv(struct mwifiex_private *priv,
         struct mwifiex_ie_types_extcap *ext_cap;
         int ret_len = 0;
         struct ieee80211_supported_band *sband;
+        struct ieee_types_header *hdr;
         u8 radio_type;
 
         if (!buffer || !*buffer)
@@ -388,17 +389,24 @@ mwifiex_cmd_append_11n_tlv(struct mwifiex_private *priv,
         }
 
         if (bss_desc->bcn_ext_cap) {
+                hdr = (void *)bss_desc->bcn_ext_cap;
                 ext_cap = (struct mwifiex_ie_types_extcap *) *buffer;
                 memset(ext_cap, 0, sizeof(struct mwifiex_ie_types_extcap));
                 ext_cap->header.type = cpu_to_le16(WLAN_EID_EXT_CAPABILITY);
-                ext_cap->header.len = cpu_to_le16(sizeof(ext_cap->ext_cap));
+                ext_cap->header.len = cpu_to_le16(hdr->len);
 
-                memcpy((u8 *)ext_cap + sizeof(struct mwifiex_ie_types_header),
+                memcpy((u8 *)ext_cap->ext_capab,
                        bss_desc->bcn_ext_cap + sizeof(struct ieee_types_header),
                        le16_to_cpu(ext_cap->header.len));
 
-                *buffer += sizeof(struct mwifiex_ie_types_extcap);
-                ret_len += sizeof(struct mwifiex_ie_types_extcap);
+                if (hdr->len > 3 &&
+                    ext_cap->ext_capab[3] & WLAN_EXT_CAPA4_INTERWORKING_ENABLED)
+                        priv->hs2_enabled = true;
+                else
+                        priv->hs2_enabled = false;
+
+                *buffer += sizeof(struct mwifiex_ie_types_extcap) + hdr->len;
+                ret_len += sizeof(struct mwifiex_ie_types_extcap) + hdr->len;
         }
 
         return ret_len;
diff --git a/drivers/net/wireless/mwifiex/11n_aggr.c b/drivers/net/wireless/mwifiex/11n_aggr.c
index 8f9f54231a1c..21c688264708 100644
--- a/drivers/net/wireless/mwifiex/11n_aggr.c
+++ b/drivers/net/wireless/mwifiex/11n_aggr.c
@@ -69,7 +69,8 @@ mwifiex_11n_form_amsdu_pkt(struct sk_buff *skb_aggr,
         memcpy(&tx_header->eth803_hdr, skb_src->data, dt_offset);
 
         /* Copy SNAP header */
-        snap.snap_type = *(u16 *) ((u8 *)skb_src->data + dt_offset);
+        snap.snap_type =
+                le16_to_cpu(*(__le16 *) ((u8 *)skb_src->data + dt_offset));
         dt_offset += sizeof(u16);
 
         memcpy(&tx_header->rfc1042_hdr, &snap, sizeof(struct rfc_1042_hdr));
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index ca149aea1517..fbad00a5abc8 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -1508,6 +1508,7 @@ mwifiex_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *dev,
                 " reason code %d\n", priv->cfg_bssid, reason_code);
 
         memset(priv->cfg_bssid, 0, ETH_ALEN);
+        priv->hs2_enabled = false;
 
         return 0;
 }
diff --git a/drivers/net/wireless/mwifiex/decl.h b/drivers/net/wireless/mwifiex/decl.h
index a5993475daef..5c85d7803d00 100644
--- a/drivers/net/wireless/mwifiex/decl.h
+++ b/drivers/net/wireless/mwifiex/decl.h
@@ -26,6 +26,7 @@
 #include <linux/wait.h>
 #include <linux/timer.h>
 #include <linux/ieee80211.h>
+#include <uapi/linux/if_arp.h>
 #include <net/mac80211.h>
 
 
@@ -152,4 +153,12 @@ struct mwifiex_types_wmm_info {
         u8 reserved;
         struct ieee_types_wmm_ac_parameters ac_params[IEEE80211_NUM_ACS];
 } __packed;
+
+struct mwifiex_arp_eth_header {
+        struct arphdr hdr;
+        u8 ar_sha[ETH_ALEN];
+        u8 ar_sip[4];
+        u8 ar_tha[ETH_ALEN];
+        u8 ar_tip[4];
+} __packed;
 #endif /* !_MWIFIEX_DECL_H_ */
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index c9ad1c0d338d..f80f30b6160e 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -1330,7 +1330,7 @@ struct mwifiex_ie_types_2040bssco {
 
 struct mwifiex_ie_types_extcap {
         struct mwifiex_ie_types_header header;
-        u8 ext_cap;
+        u8 ext_capab[0];
 } __packed;
 
 struct host_cmd_ds_mac_reg_access {
diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c
index e021a581a143..6499117fce43 100644
--- a/drivers/net/wireless/mwifiex/init.c
+++ b/drivers/net/wireless/mwifiex/init.c
@@ -136,6 +136,7 @@ int mwifiex_init_priv(struct mwifiex_private *priv)
         priv->csa_chan = 0;
         priv->csa_expire_time = 0;
         priv->del_list_idx = 0;
+        priv->hs2_enabled = false;
 
         return mwifiex_add_bss_prio_tbl(priv);
 }
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 3402bffdd016..fd778337deee 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -477,20 +477,6 @@ static void mwifiex_fw_dpc(const struct firmware *firmware, void *context)
                 dev_err(adapter->dev, "cannot create default STA interface\n");
                 goto err_add_intf;
         }
-
-        /* Create AP interface by default */
-        if (!mwifiex_add_virtual_intf(adapter->wiphy, "uap%d",
-                                      NL80211_IFTYPE_AP, NULL, NULL)) {
-                dev_err(adapter->dev, "cannot create default AP interface\n");
-                goto err_add_intf;
-        }
-
-        /* Create P2P interface by default */
-        if (!mwifiex_add_virtual_intf(adapter->wiphy, "p2p%d",
-                                      NL80211_IFTYPE_P2P_CLIENT, NULL, NULL)) {
-                dev_err(adapter->dev, "cannot create default P2P interface\n");
-                goto err_add_intf;
-        }
         rtnl_unlock();
 
         mwifiex_drv_get_driver_version(adapter, fmt, sizeof(fmt) - 1);
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index d2e5ccd891da..1d72f13adb9d 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -516,6 +516,7 @@ struct mwifiex_private {
         u8 csa_chan;
         unsigned long csa_expire_time;
         u8 del_list_idx;
+        bool hs2_enabled;
 };
 
 enum mwifiex_ba_status {
@@ -1025,7 +1026,7 @@ mwifiex_netdev_get_priv(struct net_device *dev)
  */
 static inline bool mwifiex_is_skb_mgmt_frame(struct sk_buff *skb)
 {
-        return (*(u32 *)skb->data == PKT_TYPE_MGMT);
+        return (le32_to_cpu(*(__le32 *)skb->data) == PKT_TYPE_MGMT);
 }
 
 /* This function retrieves channel closed for operation by Channel
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index 0e2070f72fed..1576104e3d95 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -1062,7 +1062,7 @@ static int mwifiex_decode_rx_packet(struct mwifiex_adapter *adapter,
 
         case MWIFIEX_TYPE_EVENT:
                 dev_dbg(adapter->dev, "info: --- Rx: Event ---\n");
-                adapter->event_cause = *(u32 *) skb->data;
+                adapter->event_cause = le32_to_cpu(*(__le32 *) skb->data);
 
                 if ((skb->len > 0) && (skb->len  < MAX_EVENT_SIZE))
                         memcpy(adapter->event_body,
@@ -1207,8 +1207,8 @@ static int mwifiex_sdio_card_to_host_mp_aggr(struct mwifiex_adapter *adapter,
                 for (pind = 0; pind < card->mpa_rx.pkt_cnt; pind++) {
 
                         /* get curr PKT len & type */
-                        pkt_len = *(u16 *) &curr_ptr[0];
-                        pkt_type = *(u16 *) &curr_ptr[2];
+                        pkt_len = le16_to_cpu(*(__le16 *) &curr_ptr[0]);
+                        pkt_type = le16_to_cpu(*(__le16 *) &curr_ptr[2]);
 
                         /* copy pkt to deaggr buf */
                         skb_deaggr = card->mpa_rx.skb_arr[pind];
diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c
index 6a814eb2671a..58a6013712d2 100644
--- a/drivers/net/wireless/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c
@@ -280,7 +280,7 @@ static int mwifiex_ret_tx_rate_cfg(struct mwifiex_private *priv,
 
         tlv_buf = ((u8 *)rate_cfg) +
                         sizeof(struct host_cmd_ds_tx_rate_cfg);
-        tlv_buf_len = *(u16 *) (tlv_buf + sizeof(u16));
+        tlv_buf_len = le16_to_cpu(*(__le16 *) (tlv_buf + sizeof(u16)));
 
         while (tlv_buf && tlv_buf_len > 0) {
                 tlv = (*tlv_buf);
diff --git a/drivers/net/wireless/mwifiex/sta_rx.c b/drivers/net/wireless/mwifiex/sta_rx.c
index b5c109504393..bb22664923ef 100644
--- a/drivers/net/wireless/mwifiex/sta_rx.c
+++ b/drivers/net/wireless/mwifiex/sta_rx.c
@@ -17,6 +17,8 @@
  * this warranty disclaimer.
  */
 
+#include <uapi/linux/ipv6.h>
+#include <net/ndisc.h>
 #include "decl.h"
 #include "ioctl.h"
 #include "util.h"
@@ -25,6 +27,46 @@
 #include "11n_aggr.h"
 #include "11n_rxreorder.h"
 
+/* This function checks if a frame is IPv4 ARP or IPv6 Neighbour advertisement
+ * frame. If frame has both source and destination mac address as same, this
+ * function drops such gratuitous frames.
+ */
+static bool
+mwifiex_discard_gratuitous_arp(struct mwifiex_private *priv,
+                               struct sk_buff *skb)
+{
+        const struct mwifiex_arp_eth_header *arp;
+        struct ethhdr *eth_hdr;
+        struct ipv6hdr *ipv6;
+        struct icmp6hdr *icmpv6;
+
+        eth_hdr = (struct ethhdr *)skb->data;
+        switch (ntohs(eth_hdr->h_proto)) {
+        case ETH_P_ARP:
+                arp = (void *)(skb->data + sizeof(struct ethhdr));
+                if (arp->hdr.ar_op == htons(ARPOP_REPLY) ||
+                    arp->hdr.ar_op == htons(ARPOP_REQUEST)) {
+                        if (!memcmp(arp->ar_sip, arp->ar_tip, 4))
+                                return true;
+                }
+                break;
+        case ETH_P_IPV6:
+                ipv6 = (void *)(skb->data + sizeof(struct ethhdr));
+                icmpv6 = (void *)(skb->data + sizeof(struct ethhdr) +
+                                  sizeof(struct ipv6hdr));
+                if (NDISC_NEIGHBOUR_ADVERTISEMENT == icmpv6->icmp6_type) {
+                        if (!memcmp(&ipv6->saddr, &ipv6->daddr,
+                                    sizeof(struct in6_addr)))
+                                return true;
+                }
+                break;
+        default:
+                break;
+        }
+
+        return false;
+}
+
 /*
  * This function processes the received packet and forwards it
  * to kernel/upper layer.
@@ -90,6 +132,13 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,
            either the reconstructed EthII frame or the 802.2/llc/snap frame */
         skb_pull(skb, hdr_chop);
 
+        if (priv->hs2_enabled &&
+            mwifiex_discard_gratuitous_arp(priv, skb)) {
+                dev_dbg(priv->adapter->dev, "Bypassed Gratuitous ARP\n");
+                dev_kfree_skb_any(skb);
+                return 0;
+        }
+
         priv->rxpd_rate = local_rx_pd->rx_rate;
 
         priv->rxpd_htinfo = local_rx_pd->ht_info;
diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
index fca98b5d7de4..2472d4b7f00e 100644
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -24,9 +24,9 @@
 
 static const char usbdriver_name[] = "usb8797";
 
-static u8 user_rmmod;
 static struct mwifiex_if_ops usb_ops;
 static struct semaphore add_remove_card_sem;
+static struct usb_card_rec *usb_card;
 
 static struct usb_device_id mwifiex_usb_table[] = {
         {USB_DEVICE(USB8797_VID, USB8797_PID_1)},
@@ -350,6 +350,7 @@ static int mwifiex_usb_probe(struct usb_interface *intf,
 
         card->udev = udev;
         card->intf = intf;
+        usb_card = card;
 
         pr_debug("info: bcdUSB=%#x Device Class=%#x SubClass=%#x Protocol=%#x\n",
                  udev->descriptor.bcdUSB, udev->descriptor.bDeviceClass,
@@ -532,7 +533,6 @@ static void mwifiex_usb_disconnect(struct usb_interface *intf)
 {
         struct usb_card_rec *card = usb_get_intfdata(intf);
         struct mwifiex_adapter *adapter;
-        int i;
 
         if (!card || !card->adapter) {
                 pr_err("%s: card or card->adapter is NULL\n", __func__);
@@ -543,27 +543,6 @@ static void mwifiex_usb_disconnect(struct usb_interface *intf)
         if (!adapter->priv_num)
                 return;
 
-        /* In case driver is removed when asynchronous FW downloading is
-         * in progress
-         */
-        wait_for_completion(&adapter->fw_load);
-
-        if (user_rmmod) {
-#ifdef CONFIG_PM
-                if (adapter->is_suspended)
-                        mwifiex_usb_resume(intf);
-#endif
-                for (i = 0; i < adapter->priv_num; i++)
-                        if ((GET_BSS_ROLE(adapter->priv[i]) ==
-                             MWIFIEX_BSS_ROLE_STA) &&
-                            adapter->priv[i]->media_connected)
-                                mwifiex_deauthenticate(adapter->priv[i], NULL);
-
-                mwifiex_init_shutdown_fw(mwifiex_get_priv(adapter,
-                                                          MWIFIEX_BSS_ROLE_ANY),
-                                         MWIFIEX_FUNC_SHUTDOWN);
-        }
-
         mwifiex_usb_free(card);
 
         dev_dbg(adapter->dev, "%s: removing card\n", __func__);
@@ -1032,8 +1011,29 @@ static void mwifiex_usb_cleanup_module(void)
         if (!down_interruptible(&add_remove_card_sem))
                 up(&add_remove_card_sem);
 
-        /* set the flag as user is removing this module */
-        user_rmmod = 1;
+        if (usb_card) {
+                struct mwifiex_adapter *adapter = usb_card->adapter;
+                int i;
+
+                /* In case driver is removed when asynchronous FW downloading is
+                 * in progress
+                 */
+                wait_for_completion(&adapter->fw_load);
+
+#ifdef CONFIG_PM
+                if (adapter->is_suspended)
+                        mwifiex_usb_resume(usb_card->intf);
+#endif
+                for (i = 0; i < adapter->priv_num; i++)
+                        if ((GET_BSS_ROLE(adapter->priv[i]) ==
+                             MWIFIEX_BSS_ROLE_STA) &&
+                            adapter->priv[i]->media_connected)
+                                mwifiex_deauthenticate(adapter->priv[i], NULL);
+
+                mwifiex_init_shutdown_fw(mwifiex_get_priv(adapter,
+                                                          MWIFIEX_BSS_ROLE_ANY),
+                                         MWIFIEX_FUNC_SHUTDOWN);
+        }
 
         usb_deregister(&mwifiex_usb_driver);
 }
diff --git a/drivers/net/wireless/mwifiex/util.c b/drivers/net/wireless/mwifiex/util.c
index e57ac0dd3ab5..5d9e150f4111 100644
--- a/drivers/net/wireless/mwifiex/util.c
+++ b/drivers/net/wireless/mwifiex/util.c
@@ -171,8 +171,8 @@ mwifiex_process_mgmt_packet(struct mwifiex_private *priv,
         rx_pd->rx_pkt_length = cpu_to_le16(pkt_len);
 
         cfg80211_rx_mgmt(priv->wdev, priv->roc_cfg.chan.center_freq,
-                         CAL_RSSI(rx_pd->snr, rx_pd->nf),
-                         skb->data, pkt_len, GFP_ATOMIC);
+                         CAL_RSSI(rx_pd->snr, rx_pd->nf), skb->data, pkt_len,
+                         0, GFP_ATOMIC);
 
         return 0;
 }
diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h
index a3132414ac9f..fa33b5edf931 100644
--- a/drivers/net/wireless/rt2x00/rt2800.h
+++ b/drivers/net/wireless/rt2x00/rt2800.h
@@ -2019,11 +2019,13 @@ struct mac_iveiv_entry {
 #define HW_BEACON_BASE6                 0x5dc0
 #define HW_BEACON_BASE7                 0x5bc0
 
-#define HW_BEACON_OFFSET(__index) \
+#define HW_BEACON_BASE(__index) \
         (((__index) < 4) ? (HW_BEACON_BASE0 + (__index * 0x0200)) : \
           (((__index) < 6) ? (HW_BEACON_BASE4 + ((__index - 4) * 0x0200)) : \
           (HW_BEACON_BASE6 - ((__index - 6) * 0x0200))))
 
+#define BEACON_BASE_TO_OFFSET(_base)    (((_base) - 0x4000) / 64)
+
 /*
  * BBP registers.
  * The wordsize of the BBP is 8 bits.
@@ -2794,6 +2796,7 @@ enum rt2800_eeprom_word {
 #define MCU_RADAR                       0x60
 #define MCU_BOOT_SIGNAL                 0x72
 #define MCU_ANT_SELECT                  0X73
+#define MCU_FREQ_OFFSET                 0x74
 #define MCU_BBP_SIGNAL                  0x80
 #define MCU_POWER_SAVE                  0x83
 #define MCU_BAND_SELECT         0x91
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index dedc3d4ae365..95e6e61c3de0 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -521,6 +521,29 @@ void rt2800_disable_wpdma(struct rt2x00_dev *rt2x00dev)
 }
 EXPORT_SYMBOL_GPL(rt2800_disable_wpdma);
 
+void rt2800_get_txwi_rxwi_size(struct rt2x00_dev *rt2x00dev,
+                               unsigned short *txwi_size,
+                               unsigned short *rxwi_size)
+{
+        switch (rt2x00dev->chip.rt) {
+        case RT3593:
+                *txwi_size = TXWI_DESC_SIZE_4WORDS;
+                *rxwi_size = RXWI_DESC_SIZE_5WORDS;
+                break;
+
+        case RT5592:
+                *txwi_size = TXWI_DESC_SIZE_5WORDS;
+                *rxwi_size = RXWI_DESC_SIZE_6WORDS;
+                break;
+
+        default:
+                *txwi_size = TXWI_DESC_SIZE_4WORDS;
+                *rxwi_size = RXWI_DESC_SIZE_4WORDS;
+                break;
+        }
+}
+EXPORT_SYMBOL_GPL(rt2800_get_txwi_rxwi_size);
+
 static bool rt2800_check_firmware_crc(const u8 *data, const size_t len)
 {
         u16 fw_crc;
@@ -917,6 +940,18 @@ void rt2800_txdone_entry(struct queue_entry *entry, u32 status, __le32 *txwi)
 }
 EXPORT_SYMBOL_GPL(rt2800_txdone_entry);
 
+static unsigned int rt2800_hw_beacon_base(struct rt2x00_dev *rt2x00dev,
+                                          unsigned int index)
+{
+        return HW_BEACON_BASE(index);
+}
+
+static inline u8 rt2800_get_beacon_offset(struct rt2x00_dev *rt2x00dev,
+                                          unsigned int index)
+{
+        return BEACON_BASE_TO_OFFSET(rt2800_hw_beacon_base(rt2x00dev, index));
+}
+
 void rt2800_write_beacon(struct queue_entry *entry, struct txentry_desc *txdesc)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
@@ -969,7 +1004,8 @@ void rt2800_write_beacon(struct queue_entry *entry, struct txentry_desc *txdesc)
                 return;
         }
 
-        beacon_base = HW_BEACON_OFFSET(entry->entry_idx);
+        beacon_base = rt2800_hw_beacon_base(rt2x00dev, entry->entry_idx);
+
         rt2800_register_multiwrite(rt2x00dev, beacon_base, entry->skb->data,
                                    entry->skb->len + padding_len);
 
@@ -988,10 +1024,13 @@ void rt2800_write_beacon(struct queue_entry *entry, struct txentry_desc *txdesc)
 EXPORT_SYMBOL_GPL(rt2800_write_beacon);
 
 static inline void rt2800_clear_beacon_register(struct rt2x00_dev *rt2x00dev,
-                                                unsigned int beacon_base)
+                                                unsigned int index)
 {
         int i;
         const int txwi_desc_size = rt2x00dev->bcn->winfo_size;
+        unsigned int beacon_base;
+
+        beacon_base = rt2800_hw_beacon_base(rt2x00dev, index);
 
         /*
          * For the Beacon base registers we only need to clear
@@ -1018,8 +1057,7 @@ void rt2800_clear_beacon(struct queue_entry *entry)
         /*
          * Clear beacon.
          */
-        rt2800_clear_beacon_register(rt2x00dev,
-                                     HW_BEACON_OFFSET(entry->entry_idx));
+        rt2800_clear_beacon_register(rt2x00dev, entry->entry_idx);
 
         /*
          * Enabled beaconing again.
@@ -1850,6 +1888,43 @@ static void rt2800_config_lna_gain(struct rt2x00_dev *rt2x00dev,
         rt2x00dev->lna_gain = lna_gain;
 }
 
+#define FREQ_OFFSET_BOUND       0x5f
+
+static void rt2800_adjust_freq_offset(struct rt2x00_dev *rt2x00dev)
+{
+        u8 freq_offset, prev_freq_offset;
+        u8 rfcsr, prev_rfcsr;
+
+        freq_offset = rt2x00_get_field8(rt2x00dev->freq_offset, RFCSR17_CODE);
+        freq_offset = min_t(u8, freq_offset, FREQ_OFFSET_BOUND);
+
+        rt2800_rfcsr_read(rt2x00dev, 17, &rfcsr);
+        prev_rfcsr = rfcsr;
+
+        rt2x00_set_field8(&rfcsr, RFCSR17_CODE, freq_offset);
+        if (rfcsr == prev_rfcsr)
+                return;
+
+        if (rt2x00_is_usb(rt2x00dev)) {
+                rt2800_mcu_request(rt2x00dev, MCU_FREQ_OFFSET, 0xff,
+                                   freq_offset, prev_rfcsr);
+                return;
+        }
+
+        prev_freq_offset = rt2x00_get_field8(prev_rfcsr, RFCSR17_CODE);
+        while (prev_freq_offset != freq_offset) {
+                if (prev_freq_offset < freq_offset)
+                        prev_freq_offset++;
+                else
+                        prev_freq_offset--;
+
+                rt2x00_set_field8(&rfcsr, RFCSR17_CODE, prev_freq_offset);
+                rt2800_rfcsr_write(rt2x00dev, 17, rfcsr);
+
+                usleep_range(1000, 1500);
+        }
+}
+
 static void rt2800_config_channel_rf2xxx(struct rt2x00_dev *rt2x00dev,
                                          struct ieee80211_conf *conf,
                                          struct rf_channel *rf,
@@ -2298,7 +2373,7 @@ static void rt2800_config_channel_rf3053(struct rt2x00_dev *rt2x00dev,
         }
         rt2800_rfcsr_write(rt2x00dev, 1, rfcsr);
 
-        /* TODO: frequency calibration? */
+        rt2800_adjust_freq_offset(rt2x00dev);
 
         if (conf_is_ht40(conf)) {
                 txrx_agc_fc = rt2x00_get_field8(drv_data->calibration_bw40,
@@ -2467,19 +2542,6 @@ static void rt2800_config_channel_rf3053(struct rt2x00_dev *rt2x00dev,
 
 #define POWER_BOUND             0x27
 #define POWER_BOUND_5G          0x2b
-#define FREQ_OFFSET_BOUND       0x5f
-
-static void rt2800_adjust_freq_offset(struct rt2x00_dev *rt2x00dev)
-{
-        u8 rfcsr;
-
-        rt2800_rfcsr_read(rt2x00dev, 17, &rfcsr);
-        if (rt2x00dev->freq_offset > FREQ_OFFSET_BOUND)
-                rt2x00_set_field8(&rfcsr, RFCSR17_CODE, FREQ_OFFSET_BOUND);
-        else
-                rt2x00_set_field8(&rfcsr, RFCSR17_CODE, rt2x00dev->freq_offset);
-        rt2800_rfcsr_write(rt2x00dev, 17, rfcsr);
-}
 
 static void rt2800_config_channel_rf3290(struct rt2x00_dev *rt2x00dev,
                                          struct ieee80211_conf *conf,
@@ -3346,6 +3408,13 @@ static int rt2800_get_gain_calibration_delta(struct rt2x00_dev *rt2x00dev)
         int i;
 
         /*
+         * First check if temperature compensation is supported.
+         */
+        rt2800_eeprom_read(rt2x00dev, EEPROM_NIC_CONF1, &eeprom);
+        if (!rt2x00_get_field16(eeprom, EEPROM_NIC_CONF1_EXTERNAL_TX_ALC))
+                return 0;
+
+        /*
          * Read TSSI boundaries for temperature compensation from
          * the EEPROM.
          *
@@ -4418,17 +4487,25 @@ static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
                 return ret;
 
         rt2800_register_read(rt2x00dev, BCN_OFFSET0, &reg);
-        rt2x00_set_field32(&reg, BCN_OFFSET0_BCN0, 0xe0); /* 0x3800 */
-        rt2x00_set_field32(&reg, BCN_OFFSET0_BCN1, 0xe8); /* 0x3a00 */
-        rt2x00_set_field32(&reg, BCN_OFFSET0_BCN2, 0xf0); /* 0x3c00 */
-        rt2x00_set_field32(&reg, BCN_OFFSET0_BCN3, 0xf8); /* 0x3e00 */
+        rt2x00_set_field32(&reg, BCN_OFFSET0_BCN0,
+                           rt2800_get_beacon_offset(rt2x00dev, 0));
+        rt2x00_set_field32(&reg, BCN_OFFSET0_BCN1,
+                           rt2800_get_beacon_offset(rt2x00dev, 1));
+        rt2x00_set_field32(&reg, BCN_OFFSET0_BCN2,
+                           rt2800_get_beacon_offset(rt2x00dev, 2));
+        rt2x00_set_field32(&reg, BCN_OFFSET0_BCN3,
+                           rt2800_get_beacon_offset(rt2x00dev, 3));
         rt2800_register_write(rt2x00dev, BCN_OFFSET0, reg);
 
         rt2800_register_read(rt2x00dev, BCN_OFFSET1, &reg);
-        rt2x00_set_field32(&reg, BCN_OFFSET1_BCN4, 0xc8); /* 0x3200 */
-        rt2x00_set_field32(&reg, BCN_OFFSET1_BCN5, 0xd0); /* 0x3400 */
-        rt2x00_set_field32(&reg, BCN_OFFSET1_BCN6, 0x77); /* 0x1dc0 */
-        rt2x00_set_field32(&reg, BCN_OFFSET1_BCN7, 0x6f); /* 0x1bc0 */
+        rt2x00_set_field32(&reg, BCN_OFFSET1_BCN4,
+                           rt2800_get_beacon_offset(rt2x00dev, 4));
+        rt2x00_set_field32(&reg, BCN_OFFSET1_BCN5,
+                           rt2800_get_beacon_offset(rt2x00dev, 5));
+        rt2x00_set_field32(&reg, BCN_OFFSET1_BCN6,
+                           rt2800_get_beacon_offset(rt2x00dev, 6));
+        rt2x00_set_field32(&reg, BCN_OFFSET1_BCN7,
+                           rt2800_get_beacon_offset(rt2x00dev, 7));
         rt2800_register_write(rt2x00dev, BCN_OFFSET1, reg);
 
         rt2800_register_write(rt2x00dev, LEGACY_BASIC_RATE, 0x0000013f);
@@ -4780,14 +4857,8 @@ static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
         /*
          * Clear all beacons
          */
-        rt2800_clear_beacon_register(rt2x00dev, HW_BEACON_BASE0);
-        rt2800_clear_beacon_register(rt2x00dev, HW_BEACON_BASE1);
-        rt2800_clear_beacon_register(rt2x00dev, HW_BEACON_BASE2);
-        rt2800_clear_beacon_register(rt2x00dev, HW_BEACON_BASE3);
-        rt2800_clear_beacon_register(rt2x00dev, HW_BEACON_BASE4);
-        rt2800_clear_beacon_register(rt2x00dev, HW_BEACON_BASE5);
-        rt2800_clear_beacon_register(rt2x00dev, HW_BEACON_BASE6);
-        rt2800_clear_beacon_register(rt2x00dev, HW_BEACON_BASE7);
+        for (i = 0; i < 8; i++)
+                rt2800_clear_beacon_register(rt2x00dev, i);
 
         if (rt2x00_is_usb(rt2x00dev)) {
                 rt2800_register_read(rt2x00dev, US_CYC_CNT, &reg);
@@ -7418,7 +7489,8 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
             IEEE80211_HW_SUPPORTS_PS |
             IEEE80211_HW_PS_NULLFUNC_STACK |
             IEEE80211_HW_AMPDU_AGGREGATION |
-            IEEE80211_HW_REPORTS_TX_ACK_STATUS;
+            IEEE80211_HW_REPORTS_TX_ACK_STATUS |
+            IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
 
         /*
          * Don't set IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING for USB devices
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.h b/drivers/net/wireless/rt2x00/rt2800lib.h
index 6ec739466db4..a94ba447e63c 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.h
+++ b/drivers/net/wireless/rt2x00/rt2800lib.h
@@ -226,4 +226,8 @@ int rt2800_get_survey(struct ieee80211_hw *hw, int idx,
                       struct survey_info *survey);
 void rt2800_disable_wpdma(struct rt2x00_dev *rt2x00dev);
 
+void rt2800_get_txwi_rxwi_size(struct rt2x00_dev *rt2x00dev,
+                               unsigned short *txwi_size,
+                               unsigned short *rxwi_size);
+
 #endif /* RT2800LIB_H */
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index 00055627eb8d..f8f2abbfbb65 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -507,9 +507,13 @@ static int rt2800pci_init_registers(struct rt2x00_dev *rt2x00dev)
         rt2x00mmio_register_write(rt2x00dev, PBF_SYS_CTRL, 0x00000e00);
 
         if (rt2x00_is_pcie(rt2x00dev) &&
-            (rt2x00_rt(rt2x00dev, RT3572) ||
+            (rt2x00_rt(rt2x00dev, RT3090) ||
+             rt2x00_rt(rt2x00dev, RT3390) ||
+             rt2x00_rt(rt2x00dev, RT3572) ||
+             rt2x00_rt(rt2x00dev, RT3593) ||
              rt2x00_rt(rt2x00dev, RT5390) ||
-             rt2x00_rt(rt2x00dev, RT5392))) {
+             rt2x00_rt(rt2x00dev, RT5392) ||
+             rt2x00_rt(rt2x00dev, RT5592))) {
                 rt2x00mmio_register_read(rt2x00dev, AUX_CTRL, &reg);
                 rt2x00_set_field32(&reg, AUX_CTRL_FORCE_PCIE_CLK, 1);
                 rt2x00_set_field32(&reg, AUX_CTRL_WAKE_PCIE_EN, 1);
@@ -1189,12 +1193,17 @@ static const struct rt2x00lib_ops rt2800pci_rt2x00_ops = {
 
 static void rt2800pci_queue_init(struct data_queue *queue)
 {
+        struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
+        unsigned short txwi_size, rxwi_size;
+
+        rt2800_get_txwi_rxwi_size(rt2x00dev, &txwi_size, &rxwi_size);
+
         switch (queue->qid) {
         case QID_RX:
                 queue->limit = 128;
                 queue->data_size = AGGREGATION_SIZE;
                 queue->desc_size = RXD_DESC_SIZE;
-                queue->winfo_size = RXWI_DESC_SIZE_4WORDS;
+                queue->winfo_size = rxwi_size;
                 queue->priv_size = sizeof(struct queue_entry_priv_mmio);
                 break;
 
@@ -1205,7 +1214,7 @@ static void rt2800pci_queue_init(struct data_queue *queue)
                 queue->limit = 64;
                 queue->data_size = AGGREGATION_SIZE;
                 queue->desc_size = TXD_DESC_SIZE;
-                queue->winfo_size = TXWI_DESC_SIZE_4WORDS;
+                queue->winfo_size = txwi_size;
                 queue->priv_size = sizeof(struct queue_entry_priv_mmio);
                 break;
 
@@ -1213,7 +1222,7 @@ static void rt2800pci_queue_init(struct data_queue *queue)
                 queue->limit = 8;
                 queue->data_size = 0; /* No DMA required for beacons */
                 queue->desc_size = TXD_DESC_SIZE;
-                queue->winfo_size = TXWI_DESC_SIZE_4WORDS;
+                queue->winfo_size = txwi_size;
                 queue->priv_size = sizeof(struct queue_entry_priv_mmio);
                 break;
 
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index fc9efdfca8f2..96961b9a395c 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -854,16 +854,7 @@ static void rt2800usb_queue_init(struct data_queue *queue)
         struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
         unsigned short txwi_size, rxwi_size;
 
-        if (rt2x00_rt(rt2x00dev, RT3593)) {
-                txwi_size = TXWI_DESC_SIZE_4WORDS;
-                rxwi_size = RXWI_DESC_SIZE_5WORDS;
-        } else if (rt2x00_rt(rt2x00dev, RT5592)) {
-                txwi_size = TXWI_DESC_SIZE_5WORDS;
-                rxwi_size = RXWI_DESC_SIZE_6WORDS;
-        } else {
-                txwi_size = TXWI_DESC_SIZE_4WORDS;
-                rxwi_size = RXWI_DESC_SIZE_4WORDS;
-        }
+        rt2800_get_txwi_rxwi_size(rt2x00dev, &txwi_size, &rxwi_size);
 
         switch (queue->qid) {
         case QID_RX:
@@ -980,6 +971,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x0411, 0x016f) },
         { USB_DEVICE(0x0411, 0x01a2) },
         { USB_DEVICE(0x0411, 0x01ee) },
+        { USB_DEVICE(0x0411, 0x01a8) },
         /* Corega */
         { USB_DEVICE(0x07aa, 0x002f) },
         { USB_DEVICE(0x07aa, 0x003c) },
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index b16521e6bf4a..712eea9d398f 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -566,10 +566,10 @@ static void rt2x00lib_rxdone_check_ba(struct rt2x00_dev *rt2x00dev,
 
 #undef TID_CHECK
 
-                if (compare_ether_addr(ba->ra, entry->ta))
+                if (!ether_addr_equal(ba->ra, entry->ta))
                         continue;
 
-                if (compare_ether_addr(ba->ta, entry->ra))
+                if (!ether_addr_equal(ba->ta, entry->ra))
                         continue;
 
                 /* Mark BAR since we received the according BA */
diff --git a/drivers/net/wireless/rtl818x/rtl8180/dev.c b/drivers/net/wireless/rtl818x/rtl8180/dev.c
index 91a04e2b8ece..fc207b268e4f 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/dev.c
@@ -3,10 +3,10 @@
  * Linux device driver for RTL8180 / RTL8185
  *
  * Copyright 2007 Michael Wu <flamingice@sourmilk.net>
- * Copyright 2007 Andrea Merello <andreamrl@tiscali.it>
+ * Copyright 2007 Andrea Merello <andrea.merello@gmail.com>
  *
  * Based on the r8180 driver, which is:
- * Copyright 2004-2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ * Copyright 2004-2005 Andrea Merello <andrea.merello@gmail.com>, et al.
  *
  * Thanks to Realtek for their support!
  *
@@ -32,7 +32,7 @@
 #include "grf5101.h"
 
 MODULE_AUTHOR("Michael Wu <flamingice@sourmilk.net>");
-MODULE_AUTHOR("Andrea Merello <andreamrl@tiscali.it>");
+MODULE_AUTHOR("Andrea Merello <andrea.merello@gmail.com>");
 MODULE_DESCRIPTION("RTL8180 / RTL8185 PCI wireless driver");
 MODULE_LICENSE("GPL");
 
diff --git a/drivers/net/wireless/rtl818x/rtl8180/grf5101.c b/drivers/net/wireless/rtl818x/rtl8180/grf5101.c
index 077ff92cc139..dc845693f321 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/grf5101.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/grf5101.c
@@ -2,7 +2,7 @@
 /*
  * Radio tuning for GCT GRF5101 on RTL8180
  *
- * Copyright 2007 Andrea Merello <andreamrl@tiscali.it>
+ * Copyright 2007 Andrea Merello <andrea.merello@gmail.com>
  *
  * Code from the BSD driver and the rtl8181 project have been
  * very useful to understand certain things
diff --git a/drivers/net/wireless/rtl818x/rtl8180/grf5101.h b/drivers/net/wireless/rtl818x/rtl8180/grf5101.h
index 76647111bcff..4d80a2785123 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/grf5101.h
+++ b/drivers/net/wireless/rtl818x/rtl8180/grf5101.h
@@ -4,7 +4,7 @@
 /*
  * Radio tuning for GCT GRF5101 on RTL8180
  *
- * Copyright 2007 Andrea Merello <andreamrl@tiscali.it>
+ * Copyright 2007 Andrea Merello <andrea.merello@gmail.com>
  *
  * Code from the BSD driver and the rtl8181 project have been
  * very useful to understand certain things
diff --git a/drivers/net/wireless/rtl818x/rtl8180/max2820.c b/drivers/net/wireless/rtl818x/rtl8180/max2820.c
index 4715000c94dd..a63c443c3c6f 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/max2820.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/max2820.c
@@ -1,7 +1,7 @@
 /*
  * Radio tuning for Maxim max2820 on RTL8180
  *
- * Copyright 2007 Andrea Merello <andreamrl@tiscali.it>
+ * Copyright 2007 Andrea Merello <andrea.merello@gmail.com>
  *
  * Code from the BSD driver and the rtl8181 project have been
  * very useful to understand certain things
diff --git a/drivers/net/wireless/rtl818x/rtl8180/max2820.h b/drivers/net/wireless/rtl818x/rtl8180/max2820.h
index 61cf6d1e7d57..8e982b72b690 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/max2820.h
+++ b/drivers/net/wireless/rtl818x/rtl8180/max2820.h
@@ -4,7 +4,7 @@
 /*
  * Radio tuning for Maxim max2820 on RTL8180
  *
- * Copyright 2007 Andrea Merello <andreamrl@tiscali.it>
+ * Copyright 2007 Andrea Merello <andrea.merello@gmail.com>
  *
  * Code from the BSD driver and the rtl8181 project have been
  * very useful to understand certain things
diff --git a/drivers/net/wireless/rtl818x/rtl8180/rtl8225.c b/drivers/net/wireless/rtl818x/rtl8180/rtl8225.c
index cc2a5412c1f0..ee638d0749d6 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/rtl8225.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/rtl8225.c
@@ -3,10 +3,10 @@
  * Radio tuning for RTL8225 on RTL8180
  *
  * Copyright 2007 Michael Wu <flamingice@sourmilk.net>
- * Copyright 2007 Andrea Merello <andreamrl@tiscali.it>
+ * Copyright 2007 Andrea Merello <andrea.merello@gmail.com>
  *
  * Based on the r8180 driver, which is:
- * Copyright 2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ * Copyright 2005 Andrea Merello <andrea.merello@gmail.com>, et al.
  *
  * Thanks to Realtek for their support!
  *
diff --git a/drivers/net/wireless/rtl818x/rtl8180/sa2400.c b/drivers/net/wireless/rtl818x/rtl8180/sa2400.c
index b3ec40f6bd23..7614d9ccc729 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/sa2400.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/sa2400.c
@@ -2,7 +2,7 @@
 /*
  * Radio tuning for Philips SA2400 on RTL8180
  *
- * Copyright 2007 Andrea Merello <andreamrl@tiscali.it>
+ * Copyright 2007 Andrea Merello <andrea.merello@gmail.com>
  *
  * Code from the BSD driver and the rtl8181 project have been
  * very useful to understand certain things
diff --git a/drivers/net/wireless/rtl818x/rtl8180/sa2400.h b/drivers/net/wireless/rtl818x/rtl8180/sa2400.h
index a4aaa0d413f1..fb0093f35148 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/sa2400.h
+++ b/drivers/net/wireless/rtl818x/rtl8180/sa2400.h
@@ -4,7 +4,7 @@
 /*
  * Radio tuning for Philips SA2400 on RTL8180
  *
- * Copyright 2007 Andrea Merello <andreamrl@tiscali.it>
+ * Copyright 2007 Andrea Merello <andrea.merello@gmail.com>
  *
  * Code from the BSD driver and the rtl8181 project have been
  * very useful to understand certain things
diff --git a/drivers/net/wireless/rtl818x/rtl8187/dev.c b/drivers/net/wireless/rtl818x/rtl8187/dev.c
index f49220e234b0..841fb9dfc9da 100644
--- a/drivers/net/wireless/rtl818x/rtl8187/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187/dev.c
@@ -2,10 +2,10 @@
  * Linux device driver for RTL8187
  *
  * Copyright 2007 Michael Wu <flamingice@sourmilk.net>
- * Copyright 2007 Andrea Merello <andreamrl@tiscali.it>
+ * Copyright 2007 Andrea Merello <andrea.merello@gmail.com>
  *
  * Based on the r8187 driver, which is:
- * Copyright 2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ * Copyright 2005 Andrea Merello <andrea.merello@gmail.com>, et al.
  *
  * The driver was extended to the RTL8187B in 2008 by:
  *      Herton Ronaldo Krzesinski <herton@mandriva.com.br>
@@ -37,7 +37,7 @@
 #include "rfkill.h"
 
 MODULE_AUTHOR("Michael Wu <flamingice@sourmilk.net>");
-MODULE_AUTHOR("Andrea Merello <andreamrl@tiscali.it>");
+MODULE_AUTHOR("Andrea Merello <andrea.merello@gmail.com>");
 MODULE_AUTHOR("Herton Ronaldo Krzesinski <herton@mandriva.com.br>");
 MODULE_AUTHOR("Hin-Tak Leung <htl10@users.sourceforge.net>");
 MODULE_AUTHOR("Larry Finger <Larry.Finger@lwfinger.net>");
diff --git a/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h b/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h
index e19a20a8e955..56aee067f324 100644
--- a/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h
+++ b/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h
@@ -2,10 +2,10 @@
  * Definitions for RTL8187 hardware
  *
  * Copyright 2007 Michael Wu <flamingice@sourmilk.net>
- * Copyright 2007 Andrea Merello <andreamrl@tiscali.it>
+ * Copyright 2007 Andrea Merello <andrea.merello@gmail.com>
  *
  * Based on the r8187 driver, which is:
- * Copyright 2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ * Copyright 2005 Andrea Merello <andrea.merello@gmail.com>, et al.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
diff --git a/drivers/net/wireless/rtl818x/rtl8187/rtl8225.c b/drivers/net/wireless/rtl818x/rtl8187/rtl8225.c
index f0bf35fedbaf..a26193a04447 100644
--- a/drivers/net/wireless/rtl818x/rtl8187/rtl8225.c
+++ b/drivers/net/wireless/rtl818x/rtl8187/rtl8225.c
@@ -2,10 +2,10 @@
  * Radio tuning for RTL8225 on RTL8187
  *
  * Copyright 2007 Michael Wu <flamingice@sourmilk.net>
- * Copyright 2007 Andrea Merello <andreamrl@tiscali.it>
+ * Copyright 2007 Andrea Merello <andrea.merello@gmail.com>
  *
  * Based on the r8187 driver, which is:
- * Copyright 2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ * Copyright 2005 Andrea Merello <andrea.merello@gmail.com>, et al.
  *
  * Magic delays, register offsets, and phy value tables below are
  * taken from the original r8187 driver sources.  Thanks to Realtek
diff --git a/drivers/net/wireless/rtl818x/rtl8187/rtl8225.h b/drivers/net/wireless/rtl818x/rtl8187/rtl8225.h
index 20c5b6ead0f6..141afb09a5b4 100644
--- a/drivers/net/wireless/rtl818x/rtl8187/rtl8225.h
+++ b/drivers/net/wireless/rtl818x/rtl8187/rtl8225.h
@@ -2,10 +2,10 @@
  * Radio tuning definitions for RTL8225 on RTL8187
  *
  * Copyright 2007 Michael Wu <flamingice@sourmilk.net>
- * Copyright 2007 Andrea Merello <andreamrl@tiscali.it>
+ * Copyright 2007 Andrea Merello <andrea.merello@gmail.com>
  *
  * Based on the r8187 driver, which is:
- * Copyright 2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ * Copyright 2005 Andrea Merello <andrea.merello@gmail.com>, et al.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
diff --git a/drivers/net/wireless/rtl818x/rtl818x.h b/drivers/net/wireless/rtl818x/rtl818x.h
index 1615f63b02f6..ce23dfd42381 100644
--- a/drivers/net/wireless/rtl818x/rtl818x.h
+++ b/drivers/net/wireless/rtl818x/rtl818x.h
@@ -2,10 +2,10 @@
  * Definitions for RTL818x hardware
  *
  * Copyright 2007 Michael Wu <flamingice@sourmilk.net>
- * Copyright 2007 Andrea Merello <andreamrl@tiscali.it>
+ * Copyright 2007 Andrea Merello <andrea.merello@gmail.com>
  *
  * Based on the r8187 driver, which is:
- * Copyright 2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ * Copyright 2005 Andrea Merello <andrea.merello@gmail.com>, et al.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 7651f5acc14b..8bb4a9a01a18 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -1304,7 +1304,7 @@ void rtl_beacon_statistic(struct ieee80211_hw *hw, struct sk_buff *skb)
                 return;
 
         /* and only beacons from the associated BSSID, please */
-        if (compare_ether_addr(hdr->addr3, rtlpriv->mac80211.bssid))
+        if (!ether_addr_equal(hdr->addr3, rtlpriv->mac80211.bssid))
                 return;
 
         rtlpriv->link_info.bcn_rx_inperiod++;
diff --git a/drivers/net/wireless/rtlwifi/ps.c b/drivers/net/wireless/rtlwifi/ps.c
index 298b615964e8..0d81f766fd0f 100644
--- a/drivers/net/wireless/rtlwifi/ps.c
+++ b/drivers/net/wireless/rtlwifi/ps.c
@@ -688,7 +688,7 @@ static void rtl_p2p_noa_ie(struct ieee80211_hw *hw, void *data,
         find_p2p_ie = true;
         /*to find noa ie*/
         while (ie + 1 < end) {
-                noa_len = READEF2BYTE(&ie[1]);
+                noa_len = READEF2BYTE((__le16 *)&ie[1]);
                 if (ie + 3 + ie[1] > end)
                         return;
 
@@ -717,13 +717,13 @@ static void rtl_p2p_noa_ie(struct ieee80211_hw *hw, void *data,
                                                  READEF1BYTE(ie+index);
                                         index += 1;
                                         p2pinfo->noa_duration[i] =
-                                                 READEF4BYTE(ie+index);
+                                                 READEF4BYTE((__le32 *)ie+index);
                                         index += 4;
                                         p2pinfo->noa_interval[i] =
-                                                 READEF4BYTE(ie+index);
+                                                 READEF4BYTE((__le32 *)ie+index);
                                         index += 4;
                                         p2pinfo->noa_start_time[i] =
-                                                 READEF4BYTE(ie+index);
+                                                 READEF4BYTE((__le32 *)ie+index);
                                         index += 4;
                                 }
 
@@ -780,7 +780,7 @@ static void rtl_p2p_action_ie(struct ieee80211_hw *hw, void *data,
         RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "action frame find P2P IE.\n");
         /*to find noa ie*/
         while (ie + 1 < end) {
-                noa_len = READEF2BYTE(&ie[1]);
+                noa_len = READEF2BYTE((__le16 *)&ie[1]);
                 if (ie + 3 + ie[1] > end)
                         return;
 
@@ -809,13 +809,13 @@ static void rtl_p2p_action_ie(struct ieee80211_hw *hw, void *data,
                                                          READEF1BYTE(ie+index);
                                         index += 1;
                                         p2pinfo->noa_duration[i] =
-                                                         READEF4BYTE(ie+index);
+                                                         READEF4BYTE((__le32 *)ie+index);
                                         index += 4;
                                         p2pinfo->noa_interval[i] =
-                                                         READEF4BYTE(ie+index);
+                                                         READEF4BYTE((__le32 *)ie+index);
                                         index += 4;
                                         p2pinfo->noa_start_time[i] =
-                                                         READEF4BYTE(ie+index);
+                                                         READEF4BYTE((__le32 *)ie+index);
                                         index += 4;
                                 }
 
@@ -923,7 +923,7 @@ void rtl_p2p_info(struct ieee80211_hw *hw, void *data, unsigned int len)
                 return;
 
         /* and only beacons from the associated BSSID, please */
-        if (compare_ether_addr(hdr->addr3, rtlpriv->mac80211.bssid))
+        if (!ether_addr_equal(hdr->addr3, rtlpriv->mac80211.bssid))
                 return;
 
         /* check if this really is a beacon */
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
index a8871d66d56a..68685a898257 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
@@ -305,13 +305,14 @@ static void _rtl88ee_translate_rx_signal_stuff(struct ieee80211_hw *hw,
         psaddr = ieee80211_get_SA(hdr);
         memcpy(pstatus->psaddr, psaddr, ETH_ALEN);
 
-        addr = (!compare_ether_addr(mac->bssid, (ufc & IEEE80211_FCTL_TODS) ?
-                hdr->addr1 : (ufc & IEEE80211_FCTL_FROMDS) ?
-                hdr->addr2 : hdr->addr3));
+        addr = ether_addr_equal(mac->bssid,
+                                (ufc & IEEE80211_FCTL_TODS) ? hdr->addr1 :
+                                (ufc & IEEE80211_FCTL_FROMDS) ? hdr->addr2 :
+                                hdr->addr3);
         match_bssid = ((IEEE80211_FTYPE_CTL != type) && (!pstatus->hwerror) &&
                        (!pstatus->crc) && (!pstatus->icv)) && addr;
 
-        addr = (!compare_ether_addr(praddr, rtlefuse->dev_addr));
+        addr = ether_addr_equal(praddr, rtlefuse->dev_addr);
         packet_toself = match_bssid && addr;
 
         if (ieee80211_is_beacon(fc))
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c b/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
index c72758d8f4ed..bcd82a1020a5 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
@@ -255,16 +255,16 @@ static void _rtl8723ae_translate_rx_signal_stuff(struct ieee80211_hw *hw,
         type = WLAN_FC_GET_TYPE(fc);
         praddr = hdr->addr1;
 
-        packet_matchbssid = ((IEEE80211_FTYPE_CTL != type) &&
-                            (!compare_ether_addr(mac->bssid,
-                            (le16_to_cpu(fc) & IEEE80211_FCTL_TODS) ?
-                            hdr->addr1 : (le16_to_cpu(fc) &
-                            IEEE80211_FCTL_FROMDS) ?
-                            hdr->addr2 : hdr->addr3)) && (!pstatus->hwerror) &&
-                            (!pstatus->crc) && (!pstatus->icv));
-
-        packet_toself = packet_matchbssid &&
-            (!compare_ether_addr(praddr, rtlefuse->dev_addr));
+        packet_matchbssid =
+                ((IEEE80211_FTYPE_CTL != type) &&
+                 ether_addr_equal(mac->bssid,
+                                  (le16_to_cpu(fc) & IEEE80211_FCTL_TODS) ? hdr->addr1 :
+                                  (le16_to_cpu(fc) & IEEE80211_FCTL_FROMDS) ? hdr->addr2 :
+                                  hdr->addr3) &&
+                 (!pstatus->hwerror) && (!pstatus->crc) && (!pstatus->icv));
+
+        packet_toself = (packet_matchbssid &&
+                         ether_addr_equal(praddr, rtlefuse->dev_addr));
 
         if (ieee80211_is_beacon(fc))
                 packet_beacon = true;
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index d1b19c38a907..38995f90040d 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -5623,7 +5623,8 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
         wl->hw->wiphy->max_remain_on_channel_duration = 5000;
 
         wl->hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD |
-                                WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
+                                WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
+                                WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
 
         /* make sure all our channels fit in the scanned_ch bitmask */
         BUILD_BUG_ON(ARRAY_SIZE(wl1271_channels) +
diff --git a/drivers/net/wireless/ti/wlcore/testmode.c b/drivers/net/wireless/ti/wlcore/testmode.c
index f3442762d884..527590f2adfb 100644
--- a/drivers/net/wireless/ti/wlcore/testmode.c
+++ b/drivers/net/wireless/ti/wlcore/testmode.c
@@ -356,7 +356,8 @@ out:
         return ret;
 }
 
-int wl1271_tm_cmd(struct ieee80211_hw *hw, void *data, int len)
+int wl1271_tm_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                  void *data, int len)
 {
         struct wl1271 *wl = hw->priv;
         struct nlattr *tb[WL1271_TM_ATTR_MAX + 1];
diff --git a/drivers/net/wireless/ti/wlcore/testmode.h b/drivers/net/wireless/ti/wlcore/testmode.h
index 8071654259ea..61d8434d859a 100644
--- a/drivers/net/wireless/ti/wlcore/testmode.h
+++ b/drivers/net/wireless/ti/wlcore/testmode.h
@@ -26,6 +26,7 @@
 
 #include <net/mac80211.h>
 
-int wl1271_tm_cmd(struct ieee80211_hw *hw, void *data, int len);
+int wl1271_tm_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                  void *data, int len);
 
 #endif /* __WL1271_TESTMODE_H__ */
diff --git a/drivers/net/wireless/zd1201.c b/drivers/net/wireless/zd1201.c
index b8ba1f925e75..d39c4178c33a 100644
--- a/drivers/net/wireless/zd1201.c
+++ b/drivers/net/wireless/zd1201.c
@@ -75,8 +75,10 @@ static int zd1201_fw_upload(struct usb_device *dev, int apfw)
         len = fw_entry->size;
 
         buf = kmalloc(1024, GFP_ATOMIC);
-        if (!buf)
+        if (!buf) {
+                err = -ENOMEM;
                 goto exit;
+        }
         
         while (len > 0) {
                 int translen = (len > 1024) ? 1024 : len;
@@ -1764,8 +1766,10 @@ static int zd1201_probe(struct usb_interface *interface,
         zd->endp_out2 = 2;
         zd->rx_urb = usb_alloc_urb(0, GFP_KERNEL);
         zd->tx_urb = usb_alloc_urb(0, GFP_KERNEL);
-        if (!zd->rx_urb || !zd->tx_urb)
+        if (!zd->rx_urb || !zd->tx_urb) {
+                err = -ENOMEM;
                 goto err_zd;
+        }
 
         mdelay(100);
         err = zd1201_drvr_start(zd);
diff --git a/drivers/nfc/nfcsim.c b/drivers/nfc/nfcsim.c
index c5c30fb1d7bf..9a53f13c88df 100644
--- a/drivers/nfc/nfcsim.c
+++ b/drivers/nfc/nfcsim.c
@@ -60,7 +60,7 @@ struct nfcsim {
 static struct nfcsim *dev0;
 static struct nfcsim *dev1;
 
-struct workqueue_struct *wq;
+static struct workqueue_struct *wq;
 
 static void nfcsim_cleanup_dev(struct nfcsim *dev, u8 shutdown)
 {
@@ -481,7 +481,7 @@ static void nfcsim_free_device(struct nfcsim *dev)
         kfree(dev);
 }
 
-int __init nfcsim_init(void)
+static int __init nfcsim_init(void)
 {
         int rc;
 
@@ -522,7 +522,7 @@ exit:
         return rc;
 }
 
-void __exit nfcsim_exit(void)
+static void __exit nfcsim_exit(void)
 {
         nfcsim_cleanup_dev(dev0, 1);
         nfcsim_cleanup_dev(dev1, 1);
diff --git a/drivers/nfc/pn533.c b/drivers/nfc/pn533.c
index daf92ac209f8..5df730be88a3 100644
--- a/drivers/nfc/pn533.c
+++ b/drivers/nfc/pn533.c
@@ -83,12 +83,20 @@ MODULE_DEVICE_TABLE(usb, pn533_table);
 
 /* How much time we spend listening for initiators */
 #define PN533_LISTEN_TIME 2
+/* Delay between each poll frame (ms) */
+#define PN533_POLL_INTERVAL 10
 
-/* Standard pn533 frame definitions */
+/* Standard pn533 frame definitions (standard and extended)*/
 #define PN533_STD_FRAME_HEADER_LEN (sizeof(struct pn533_std_frame) \
                                         + 2) /* data[0] TFI, data[1] CC */
 #define PN533_STD_FRAME_TAIL_LEN 2 /* data[len] DCS, data[len + 1] postamble*/
 
+#define PN533_EXT_FRAME_HEADER_LEN (sizeof(struct pn533_ext_frame) \
+                                        + 2) /* data[0] TFI, data[1] CC */
+
+#define PN533_CMD_DATAEXCH_DATA_MAXLEN  262
+#define PN533_CMD_DATAFRAME_MAXLEN      240     /* max data length (send) */
+
 /*
  * Max extended frame payload len, excluding TFI and CC
  * which are already in PN533_FRAME_HEADER_LEN.
@@ -99,6 +107,10 @@ MODULE_DEVICE_TABLE(usb, pn533_table);
                                   Postamble (1) */
 #define PN533_STD_FRAME_CHECKSUM(f) (f->data[f->datalen])
 #define PN533_STD_FRAME_POSTAMBLE(f) (f->data[f->datalen + 1])
+/* Half start code (3), LEN (4) should be 0xffff for extended frame */
+#define PN533_STD_IS_EXTENDED(hdr) ((hdr)->datalen == 0xFF \
+                                        && (hdr)->datalen_checksum == 0xFF)
+#define PN533_EXT_FRAME_CHECKSUM(f) (f->data[be16_to_cpu(f->datalen)])
 
 /* start of frame */
 #define PN533_STD_FRAME_SOF 0x00FF
@@ -124,7 +136,7 @@ MODULE_DEVICE_TABLE(usb, pn533_table);
 #define PN533_ACR122_RDR_TO_PC_ESCAPE 0x83
 
 /* PN533 Commands */
-#define PN533_STD_FRAME_CMD(f) (f->data[1])
+#define PN533_FRAME_CMD(f) (f->data[1])
 
 #define PN533_CMD_GET_FIRMWARE_VERSION 0x02
 #define PN533_CMD_RF_CONFIGURATION 0x32
@@ -168,8 +180,9 @@ struct pn533_fw_version {
 #define PN533_CFGITEM_MAX_RETRIES 0x05
 #define PN533_CFGITEM_PASORI      0x82
 
-#define PN533_CFGITEM_RF_FIELD_ON  0x1
-#define PN533_CFGITEM_RF_FIELD_OFF 0x0
+#define PN533_CFGITEM_RF_FIELD_AUTO_RFCA 0x2
+#define PN533_CFGITEM_RF_FIELD_ON        0x1
+#define PN533_CFGITEM_RF_FIELD_OFF       0x0
 
 #define PN533_CONFIG_TIMING_102 0xb
 #define PN533_CONFIG_TIMING_204 0xc
@@ -257,7 +270,7 @@ static const struct pn533_poll_modulations poll_mod[] = {
                         .initiator_data.felica = {
                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
                                 .sc = PN533_FELICA_SENSF_SC_ALL,
-                                .rc = PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE,
+                                .rc = PN533_FELICA_SENSF_RC_SYSTEM_CODE,
                                 .tsn = 0x03,
                         },
                 },
@@ -270,7 +283,7 @@ static const struct pn533_poll_modulations poll_mod[] = {
                         .initiator_data.felica = {
                                 .opcode = PN533_FELICA_OPC_SENSF_REQ,
                                 .sc = PN533_FELICA_SENSF_SC_ALL,
-                                .rc = PN533_FELICA_SENSF_RC_NO_SYSTEM_CODE,
+                                .rc = PN533_FELICA_SENSF_RC_SYSTEM_CODE,
                                 .tsn = 0x03,
                         },
                  },
@@ -352,13 +365,16 @@ struct pn533 {
         struct urb *in_urb;
 
         struct sk_buff_head resp_q;
+        struct sk_buff_head fragment_skb;
 
         struct workqueue_struct *wq;
         struct work_struct cmd_work;
         struct work_struct cmd_complete_work;
-        struct work_struct poll_work;
-        struct work_struct mi_work;
+        struct delayed_work poll_work;
+        struct work_struct mi_rx_work;
+        struct work_struct mi_tx_work;
         struct work_struct tg_work;
+        struct work_struct rf_work;
 
         struct list_head cmd_queue;
         struct pn533_cmd *cmd;
@@ -366,6 +382,7 @@ struct pn533 {
         struct mutex cmd_lock;  /* protects cmd queue */
 
         void *cmd_complete_mi_arg;
+        void *cmd_complete_dep_arg;
 
         struct pn533_poll_modulations *poll_mod_active[PN533_POLL_MOD_MAX + 1];
         u8 poll_mod_count;
@@ -404,6 +421,15 @@ struct pn533_std_frame {
         u8 data[];
 } __packed;
 
+struct pn533_ext_frame {        /* Extended Information frame */
+        u8 preamble;
+        __be16 start_frame;
+        __be16 eif_flag;        /* fixed to 0xFFFF */
+        __be16 datalen;
+        u8 datalen_checksum;
+        u8 data[];
+} __packed;
+
 struct pn533_frame_ops {
         void (*tx_frame_init)(void *frame, u8 cmd_code);
         void (*tx_frame_finish)(void *frame);
@@ -411,7 +437,7 @@ struct pn533_frame_ops {
         int tx_header_len;
         int tx_tail_len;
 
-        bool (*rx_is_frame_valid)(void *frame);
+        bool (*rx_is_frame_valid)(void *frame, struct pn533 *dev);
         int (*rx_frame_size)(void *frame);
         int rx_header_len;
         int rx_tail_len;
@@ -486,7 +512,7 @@ static void pn533_acr122_tx_update_payload_len(void *_frame, int len)
         frame->datalen += len;
 }
 
-static bool pn533_acr122_is_rx_frame_valid(void *_frame)
+static bool pn533_acr122_is_rx_frame_valid(void *_frame, struct pn533 *dev)
 {
         struct pn533_acr122_rx_frame *frame = _frame;
 
@@ -511,7 +537,7 @@ static u8 pn533_acr122_get_cmd_code(void *frame)
 {
         struct pn533_acr122_rx_frame *f = frame;
 
-        return PN533_STD_FRAME_CMD(f);
+        return PN533_FRAME_CMD(f);
 }
 
 static struct pn533_frame_ops pn533_acr122_frame_ops = {
@@ -530,6 +556,12 @@ static struct pn533_frame_ops pn533_acr122_frame_ops = {
         .get_cmd_code = pn533_acr122_get_cmd_code,
 };
 
+/* The rule: value(high byte) + value(low byte) + checksum = 0 */
+static inline u8 pn533_ext_checksum(u16 value)
+{
+        return ~(u8)(((value & 0xFF00) >> 8) + (u8)(value & 0xFF)) + 1;
+}
+
 /* The rule: value + checksum = 0 */
 static inline u8 pn533_std_checksum(u8 value)
 {
@@ -555,7 +587,7 @@ static void pn533_std_tx_frame_init(void *_frame, u8 cmd_code)
         frame->preamble = 0;
         frame->start_frame = cpu_to_be16(PN533_STD_FRAME_SOF);
         PN533_STD_FRAME_IDENTIFIER(frame) = PN533_STD_FRAME_DIR_OUT;
-        PN533_STD_FRAME_CMD(frame) = cmd_code;
+        PN533_FRAME_CMD(frame) = cmd_code;
         frame->datalen = 2;
 }
 
@@ -578,21 +610,41 @@ static void pn533_std_tx_update_payload_len(void *_frame, int len)
         frame->datalen += len;
 }
 
-static bool pn533_std_rx_frame_is_valid(void *_frame)
+static bool pn533_std_rx_frame_is_valid(void *_frame, struct pn533 *dev)
 {
         u8 checksum;
-        struct pn533_std_frame *frame = _frame;
+        struct pn533_std_frame *stdf = _frame;
 
-        if (frame->start_frame != cpu_to_be16(PN533_STD_FRAME_SOF))
+        if (stdf->start_frame != cpu_to_be16(PN533_STD_FRAME_SOF))
                 return false;
 
-        checksum = pn533_std_checksum(frame->datalen);
-        if (checksum != frame->datalen_checksum)
-                return false;
+        if (likely(!PN533_STD_IS_EXTENDED(stdf))) {
+                /* Standard frame code */
+                dev->ops->rx_header_len = PN533_STD_FRAME_HEADER_LEN;
 
-        checksum = pn533_std_data_checksum(frame->data, frame->datalen);
-        if (checksum != PN533_STD_FRAME_CHECKSUM(frame))
-                return false;
+                checksum = pn533_std_checksum(stdf->datalen);
+                if (checksum != stdf->datalen_checksum)
+                        return false;
+
+                checksum = pn533_std_data_checksum(stdf->data, stdf->datalen);
+                if (checksum != PN533_STD_FRAME_CHECKSUM(stdf))
+                        return false;
+        } else {
+                /* Extended */
+                struct pn533_ext_frame *eif = _frame;
+
+                dev->ops->rx_header_len = PN533_EXT_FRAME_HEADER_LEN;
+
+                checksum = pn533_ext_checksum(be16_to_cpu(eif->datalen));
+                if (checksum != eif->datalen_checksum)
+                        return false;
+
+                /* check data checksum */
+                checksum = pn533_std_data_checksum(eif->data,
+                                                   be16_to_cpu(eif->datalen));
+                if (checksum != PN533_EXT_FRAME_CHECKSUM(eif))
+                        return false;
+        }
 
         return true;
 }
@@ -612,6 +664,14 @@ static inline int pn533_std_rx_frame_size(void *frame)
 {
         struct pn533_std_frame *f = frame;
 
+        /* check for Extended Information frame */
+        if (PN533_STD_IS_EXTENDED(f)) {
+                struct pn533_ext_frame *eif = frame;
+
+                return sizeof(struct pn533_ext_frame)
+                        + be16_to_cpu(eif->datalen) + PN533_STD_FRAME_TAIL_LEN;
+        }
+
         return sizeof(struct pn533_std_frame) + f->datalen +
                PN533_STD_FRAME_TAIL_LEN;
 }
@@ -619,8 +679,12 @@ static inline int pn533_std_rx_frame_size(void *frame)
 static u8 pn533_std_get_cmd_code(void *frame)
 {
         struct pn533_std_frame *f = frame;
+        struct pn533_ext_frame *eif = frame;
 
-        return PN533_STD_FRAME_CMD(f);
+        if (PN533_STD_IS_EXTENDED(f))
+                return PN533_FRAME_CMD(eif);
+        else
+                return PN533_FRAME_CMD(f);
 }
 
 static struct pn533_frame_ops pn533_std_frame_ops = {
@@ -675,7 +739,7 @@ static void pn533_recv_response(struct urb *urb)
         print_hex_dump_debug("PN533 RX: ", DUMP_PREFIX_NONE, 16, 1, in_frame,
                              dev->ops->rx_frame_size(in_frame), false);
 
-        if (!dev->ops->rx_is_frame_valid(in_frame)) {
+        if (!dev->ops->rx_is_frame_valid(in_frame, dev)) {
                 nfc_dev_err(&dev->interface->dev, "Received an invalid frame");
                 cmd->status = -EIO;
                 goto sched_wq;
@@ -1657,7 +1721,56 @@ static void pn533_listen_mode_timer(unsigned long data)
 
         pn533_poll_next_mod(dev);
 
-        queue_work(dev->wq, &dev->poll_work);
+        queue_delayed_work(dev->wq, &dev->poll_work,
+                           msecs_to_jiffies(PN533_POLL_INTERVAL));
+}
+
+static int pn533_rf_complete(struct pn533 *dev, void *arg,
+                             struct sk_buff *resp)
+{
+        int rc = 0;
+
+        nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
+
+        if (IS_ERR(resp)) {
+                rc = PTR_ERR(resp);
+
+                nfc_dev_err(&dev->interface->dev, "%s RF setting error %d",
+                            __func__, rc);
+
+                return rc;
+        }
+
+        queue_delayed_work(dev->wq, &dev->poll_work,
+                           msecs_to_jiffies(PN533_POLL_INTERVAL));
+
+        dev_kfree_skb(resp);
+        return rc;
+}
+
+static void pn533_wq_rf(struct work_struct *work)
+{
+        struct pn533 *dev = container_of(work, struct pn533, rf_work);
+        struct sk_buff *skb;
+        int rc;
+
+        nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
+
+        skb = pn533_alloc_skb(dev, 2);
+        if (!skb)
+                return;
+
+        *skb_put(skb, 1) = PN533_CFGITEM_RF_FIELD;
+        *skb_put(skb, 1) = PN533_CFGITEM_RF_FIELD_AUTO_RFCA;
+
+        rc = pn533_send_cmd_async(dev, PN533_CMD_RF_CONFIGURATION, skb,
+                                  pn533_rf_complete, NULL);
+        if (rc < 0) {
+                dev_kfree_skb(skb);
+                nfc_dev_err(&dev->interface->dev, "RF setting error %d", rc);
+        }
+
+        return;
 }
 
 static int pn533_poll_complete(struct pn533 *dev, void *arg,
@@ -1705,7 +1818,8 @@ static int pn533_poll_complete(struct pn533 *dev, void *arg,
         }
 
         pn533_poll_next_mod(dev);
-        queue_work(dev->wq, &dev->poll_work);
+        /* Not target found, turn radio off */
+        queue_work(dev->wq, &dev->rf_work);
 
 done:
         dev_kfree_skb(resp);
@@ -1770,7 +1884,7 @@ static int pn533_send_poll_frame(struct pn533 *dev)
 
 static void pn533_wq_poll(struct work_struct *work)
 {
-        struct pn533 *dev = container_of(work, struct pn533, poll_work);
+        struct pn533 *dev = container_of(work, struct pn533, poll_work.work);
         struct pn533_poll_modulations *cur_mod;
         int rc;
 
@@ -1799,6 +1913,7 @@ static int pn533_start_poll(struct nfc_dev *nfc_dev,
                             u32 im_protocols, u32 tm_protocols)
 {
         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
+        u8 rand_mod;
 
         nfc_dev_dbg(&dev->interface->dev,
                     "%s: im protocols 0x%x tm protocols 0x%x",
@@ -1822,11 +1937,15 @@ static int pn533_start_poll(struct nfc_dev *nfc_dev,
                         tm_protocols = 0;
         }
 
-        dev->poll_mod_curr = 0;
         pn533_poll_create_mod_list(dev, im_protocols, tm_protocols);
         dev->poll_protocols = im_protocols;
         dev->listen_protocols = tm_protocols;
 
+        /* Do not always start polling from the same modulation */
+        get_random_bytes(&rand_mod, sizeof(rand_mod));
+        rand_mod %= dev->poll_mod_count;
+        dev->poll_mod_curr = rand_mod;
+
         return pn533_send_poll_frame(dev);
 }
 
@@ -1845,6 +1964,7 @@ static void pn533_stop_poll(struct nfc_dev *nfc_dev)
         }
 
         pn533_abort_cmd(dev, GFP_KERNEL);
+        flush_delayed_work(&dev->poll_work);
         pn533_poll_reset_mod_list(dev);
 }
 
@@ -2037,28 +2157,15 @@ error:
         return rc;
 }
 
-static int pn533_mod_to_baud(struct pn533 *dev)
-{
-        switch (dev->poll_mod_curr) {
-        case PN533_POLL_MOD_106KBPS_A:
-                return 0;
-        case PN533_POLL_MOD_212KBPS_FELICA:
-                return 1;
-        case PN533_POLL_MOD_424KBPS_FELICA:
-                return 2;
-        default:
-                return -EINVAL;
-        }
-}
-
+static int pn533_rf_field(struct nfc_dev *nfc_dev, u8 rf);
 #define PASSIVE_DATA_LEN 5
 static int pn533_dep_link_up(struct nfc_dev *nfc_dev, struct nfc_target *target,
                              u8 comm_mode, u8 *gb, size_t gb_len)
 {
         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
         struct sk_buff *skb;
-        int rc, baud, skb_len;
-        u8 *next, *arg;
+        int rc, skb_len;
+        u8 *next, *arg, nfcid3[NFC_NFCID3_MAXSIZE];
 
         u8 passive_data[PASSIVE_DATA_LEN] = {0x00, 0xff, 0xff, 0x00, 0x3};
 
@@ -2076,41 +2183,39 @@ static int pn533_dep_link_up(struct nfc_dev *nfc_dev, struct nfc_target *target,
                 return -EBUSY;
         }
 
-        baud = pn533_mod_to_baud(dev);
-        if (baud < 0) {
-                nfc_dev_err(&dev->interface->dev,
-                            "Invalid curr modulation %d", dev->poll_mod_curr);
-                return baud;
-        }
-
         skb_len = 3 + gb_len; /* ActPass + BR + Next */
-        if (comm_mode == NFC_COMM_PASSIVE)
-                skb_len += PASSIVE_DATA_LEN;
+        skb_len += PASSIVE_DATA_LEN;
 
-        if (target && target->nfcid2_len)
-                skb_len += NFC_NFCID3_MAXSIZE;
+        /* NFCID3 */
+        skb_len += NFC_NFCID3_MAXSIZE;
+        if (target && !target->nfcid2_len) {
+                nfcid3[0] = 0x1;
+                nfcid3[1] = 0xfe;
+                get_random_bytes(nfcid3 + 2, 6);
+        }
 
         skb = pn533_alloc_skb(dev, skb_len);
         if (!skb)
                 return -ENOMEM;
 
         *skb_put(skb, 1) = !comm_mode;  /* ActPass */
-        *skb_put(skb, 1) = baud;  /* Baud rate */
+        *skb_put(skb, 1) = 0x02;  /* 424 kbps */
 
         next = skb_put(skb, 1);  /* Next */
         *next = 0;
 
-        if (comm_mode == NFC_COMM_PASSIVE && baud > 0) {
-                memcpy(skb_put(skb, PASSIVE_DATA_LEN), passive_data,
-                       PASSIVE_DATA_LEN);
-                *next |= 1;
-        }
+        /* Copy passive data */
+        memcpy(skb_put(skb, PASSIVE_DATA_LEN), passive_data, PASSIVE_DATA_LEN);
+        *next |= 1;
 
-        if (target && target->nfcid2_len) {
+        /* Copy NFCID3 (which is NFCID2 from SENSF_RES) */
+        if (target && target->nfcid2_len)
                 memcpy(skb_put(skb, NFC_NFCID3_MAXSIZE), target->nfcid2,
                        target->nfcid2_len);
-                *next |= 2;
-        }
+        else
+                memcpy(skb_put(skb, NFC_NFCID3_MAXSIZE), nfcid3,
+                       NFC_NFCID3_MAXSIZE);
+        *next |= 2;
 
         if (gb != NULL && gb_len > 0) {
                 memcpy(skb_put(skb, gb_len), gb, gb_len);
@@ -2127,6 +2232,8 @@ static int pn533_dep_link_up(struct nfc_dev *nfc_dev, struct nfc_target *target,
 
         *arg = !comm_mode;
 
+        pn533_rf_field(dev->nfc_dev, 0);
+
         rc = pn533_send_cmd_async(dev, PN533_CMD_IN_JUMP_FOR_DEP, skb,
                                   pn533_in_dep_link_up_complete, arg);
 
@@ -2232,7 +2339,15 @@ static int pn533_data_exchange_complete(struct pn533 *dev, void *_arg,
 
         if (mi) {
                 dev->cmd_complete_mi_arg = arg;
-                queue_work(dev->wq, &dev->mi_work);
+                queue_work(dev->wq, &dev->mi_rx_work);
+                return -EINPROGRESS;
+        }
+
+        /* Prepare for the next round */
+        if (skb_queue_len(&dev->fragment_skb) > 0) {
+                dev->cmd_complete_dep_arg = arg;
+                queue_work(dev->wq, &dev->mi_tx_work);
+
                 return -EINPROGRESS;
         }
 
@@ -2253,6 +2368,50 @@ _error:
         return rc;
 }
 
+/* Split the Tx skb into small chunks */
+static int pn533_fill_fragment_skbs(struct pn533 *dev, struct sk_buff *skb)
+{
+        struct sk_buff *frag;
+        int  frag_size;
+
+        do {
+                /* Remaining size */
+                if (skb->len > PN533_CMD_DATAFRAME_MAXLEN)
+                        frag_size = PN533_CMD_DATAFRAME_MAXLEN;
+                else
+                        frag_size = skb->len;
+
+                /* Allocate and reserve */
+                frag = pn533_alloc_skb(dev, frag_size);
+                if (!frag) {
+                        skb_queue_purge(&dev->fragment_skb);
+                        break;
+                }
+
+                /* Reserve the TG/MI byte */
+                skb_reserve(frag, 1);
+
+                /* MI + TG */
+                if (frag_size  == PN533_CMD_DATAFRAME_MAXLEN)
+                        *skb_push(frag, sizeof(u8)) = (PN533_CMD_MI_MASK | 1);
+                else
+                        *skb_push(frag, sizeof(u8)) =  1; /* TG */
+
+                memcpy(skb_put(frag, frag_size), skb->data, frag_size);
+
+                /* Reduce the size of incoming buffer */
+                skb_pull(skb, frag_size);
+
+                /* Add this to skb_queue */
+                skb_queue_tail(&dev->fragment_skb, frag);
+
+        } while (skb->len > 0);
+
+        dev_kfree_skb(skb);
+
+        return skb_queue_len(&dev->fragment_skb);
+}
+
 static int pn533_transceive(struct nfc_dev *nfc_dev,
                             struct nfc_target *target, struct sk_buff *skb,
                             data_exchange_cb_t cb, void *cb_context)
@@ -2263,15 +2422,6 @@ static int pn533_transceive(struct nfc_dev *nfc_dev,
 
         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 
-        if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
-                /* TODO: Implement support to multi-part data exchange */
-                nfc_dev_err(&dev->interface->dev,
-                            "Data length greater than the max allowed: %d",
-                            PN533_CMD_DATAEXCH_DATA_MAXLEN);
-                rc = -ENOSYS;
-                goto error;
-        }
-
         if (!dev->tgt_active_prot) {
                 nfc_dev_err(&dev->interface->dev,
                             "Can't exchange data if there is no active target");
@@ -2299,7 +2449,20 @@ static int pn533_transceive(struct nfc_dev *nfc_dev,
                         break;
                 }
         default:
-                *skb_push(skb, sizeof(u8)) =  1; /*TG*/
+                /* jumbo frame ? */
+                if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
+                        rc = pn533_fill_fragment_skbs(dev, skb);
+                        if (rc <= 0)
+                                goto error;
+
+                        skb = skb_dequeue(&dev->fragment_skb);
+                        if (!skb) {
+                                rc = -EIO;
+                                goto error;
+                        }
+                } else {
+                        *skb_push(skb, sizeof(u8)) =  1; /* TG */
+                }
 
                 rc = pn533_send_data_async(dev, PN533_CMD_IN_DATA_EXCHANGE,
                                            skb, pn533_data_exchange_complete,
@@ -2370,7 +2533,7 @@ static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
 
 static void pn533_wq_mi_recv(struct work_struct *work)
 {
-        struct pn533 *dev = container_of(work, struct pn533, mi_work);
+        struct pn533 *dev = container_of(work, struct pn533, mi_rx_work);
 
         struct sk_buff *skb;
         int rc;
@@ -2418,6 +2581,61 @@ error:
         queue_work(dev->wq, &dev->cmd_work);
 }
 
+static void pn533_wq_mi_send(struct work_struct *work)
+{
+        struct pn533 *dev = container_of(work, struct pn533, mi_tx_work);
+        struct sk_buff *skb;
+        int rc;
+
+        nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
+
+        /* Grab the first skb in the queue */
+        skb = skb_dequeue(&dev->fragment_skb);
+
+        if (skb == NULL) {      /* No more data */
+                /* Reset the queue for future use */
+                skb_queue_head_init(&dev->fragment_skb);
+                goto error;
+        }
+
+        switch (dev->device_type) {
+        case PN533_DEVICE_PASORI:
+                if (dev->tgt_active_prot != NFC_PROTO_FELICA) {
+                        rc = -EIO;
+                        break;
+                }
+
+                rc = pn533_send_cmd_direct_async(dev, PN533_CMD_IN_COMM_THRU,
+                                                 skb,
+                                                 pn533_data_exchange_complete,
+                                                 dev->cmd_complete_dep_arg);
+
+                break;
+
+        default:
+                /* Still some fragments? */
+                rc = pn533_send_cmd_direct_async(dev,PN533_CMD_IN_DATA_EXCHANGE,
+                                                 skb,
+                                                 pn533_data_exchange_complete,
+                                                 dev->cmd_complete_dep_arg);
+
+                break;
+        }
+
+        if (rc == 0) /* success */
+                return;
+
+        nfc_dev_err(&dev->interface->dev,
+                    "Error %d when trying to perform data_exchange", rc);
+
+        dev_kfree_skb(skb);
+        kfree(dev->cmd_complete_dep_arg);
+
+error:
+        pn533_send_ack(dev, GFP_KERNEL);
+        queue_work(dev->wq, &dev->cmd_work);
+}
+
 static int pn533_set_configuration(struct pn533 *dev, u8 cfgitem, u8 *cfgdata,
                                                                 u8 cfgdata_len)
 {
@@ -2562,6 +2780,8 @@ static int pn533_rf_field(struct nfc_dev *nfc_dev, u8 rf)
         u8 rf_field = !!rf;
         int rc;
 
+        rf_field |= PN533_CFGITEM_RF_FIELD_AUTO_RFCA;
+
         rc = pn533_set_configuration(dev, PN533_CFGITEM_RF_FIELD,
                                      (u8 *)&rf_field, 1);
         if (rc) {
@@ -2605,17 +2825,6 @@ static int pn533_setup(struct pn533 *dev)
 
         switch (dev->device_type) {
         case PN533_DEVICE_STD:
-                max_retries.mx_rty_atr = PN533_CONFIG_MAX_RETRIES_ENDLESS;
-                max_retries.mx_rty_psl = 2;
-                max_retries.mx_rty_passive_act =
-                        PN533_CONFIG_MAX_RETRIES_NO_RETRY;
-
-                timing.rfu = PN533_CONFIG_TIMING_102;
-                timing.atr_res_timeout = PN533_CONFIG_TIMING_204;
-                timing.dep_timeout = PN533_CONFIG_TIMING_409;
-
-                break;
-
         case PN533_DEVICE_PASORI:
         case PN533_DEVICE_ACR122U:
                 max_retries.mx_rty_atr = 0x2;
@@ -2729,9 +2938,11 @@ static int pn533_probe(struct usb_interface *interface,
 
         INIT_WORK(&dev->cmd_work, pn533_wq_cmd);
         INIT_WORK(&dev->cmd_complete_work, pn533_wq_cmd_complete);
-        INIT_WORK(&dev->mi_work, pn533_wq_mi_recv);
+        INIT_WORK(&dev->mi_rx_work, pn533_wq_mi_recv);
+        INIT_WORK(&dev->mi_tx_work, pn533_wq_mi_send);
         INIT_WORK(&dev->tg_work, pn533_wq_tg_get_data);
-        INIT_WORK(&dev->poll_work, pn533_wq_poll);
+        INIT_DELAYED_WORK(&dev->poll_work, pn533_wq_poll);
+        INIT_WORK(&dev->rf_work, pn533_wq_rf);
         dev->wq = alloc_ordered_workqueue("pn533", 0);
         if (dev->wq == NULL)
                 goto error;
@@ -2741,6 +2952,7 @@ static int pn533_probe(struct usb_interface *interface,
         dev->listen_timer.function = pn533_listen_mode_timer;
 
         skb_queue_head_init(&dev->resp_q);
+        skb_queue_head_init(&dev->fragment_skb);
 
         INIT_LIST_HEAD(&dev->cmd_queue);
 
@@ -2842,6 +3054,7 @@ static void pn533_disconnect(struct usb_interface *interface)
         usb_kill_urb(dev->in_urb);
         usb_kill_urb(dev->out_urb);
 
+        flush_delayed_work(&dev->poll_work);
         destroy_workqueue(dev->wq);
 
         skb_queue_purge(&dev->resp_q);
diff --git a/drivers/nfc/pn544/i2c.c b/drivers/nfc/pn544/i2c.c
index 8cf64c19f022..01e27d4bdd0d 100644
--- a/drivers/nfc/pn544/i2c.c
+++ b/drivers/nfc/pn544/i2c.c
@@ -25,11 +25,14 @@
 #include <linux/miscdevice.h>
 #include <linux/interrupt.h>
 #include <linux/delay.h>
-
+#include <linux/nfc.h>
+#include <linux/firmware.h>
+#include <linux/unaligned/access_ok.h>
 #include <linux/platform_data/pn544.h>
 
 #include <net/nfc/hci.h>
 #include <net/nfc/llc.h>
+#include <net/nfc/nfc.h>
 
 #include "pn544.h"
 
@@ -55,6 +58,58 @@ MODULE_DEVICE_TABLE(i2c, pn544_hci_i2c_id_table);
 
 #define PN544_HCI_I2C_DRIVER_NAME "pn544_hci_i2c"
 
+#define PN544_FW_CMD_WRITE 0x08
+#define PN544_FW_CMD_CHECK 0x06
+
+struct pn544_i2c_fw_frame_write {
+        u8 cmd;
+        u16 be_length;
+        u8 be_dest_addr[3];
+        u16 be_datalen;
+        u8 data[];
+} __packed;
+
+struct pn544_i2c_fw_frame_check {
+        u8 cmd;
+        u16 be_length;
+        u8 be_start_addr[3];
+        u16 be_datalen;
+        u16 be_crc;
+} __packed;
+
+struct pn544_i2c_fw_frame_response {
+        u8 status;
+        u16 be_length;
+} __packed;
+
+struct pn544_i2c_fw_blob {
+        u32 be_size;
+        u32 be_destaddr;
+        u8 data[];
+};
+
+#define PN544_FW_CMD_RESULT_TIMEOUT 0x01
+#define PN544_FW_CMD_RESULT_BAD_CRC 0x02
+#define PN544_FW_CMD_RESULT_ACCESS_DENIED 0x08
+#define PN544_FW_CMD_RESULT_PROTOCOL_ERROR 0x0B
+#define PN544_FW_CMD_RESULT_INVALID_PARAMETER 0x11
+#define PN544_FW_CMD_RESULT_INVALID_LENGTH 0x18
+#define PN544_FW_CMD_RESULT_WRITE_FAILED 0x74
+
+#define MIN(X, Y) ((X) < (Y) ? (X) : (Y))
+
+#define PN544_FW_WRITE_BUFFER_MAX_LEN 0x9f7
+#define PN544_FW_I2C_MAX_PAYLOAD PN544_HCI_I2C_LLC_MAX_SIZE
+#define PN544_FW_I2C_WRITE_FRAME_HEADER_LEN 8
+#define PN544_FW_I2C_WRITE_DATA_MAX_LEN MIN((PN544_FW_I2C_MAX_PAYLOAD -\
+                                         PN544_FW_I2C_WRITE_FRAME_HEADER_LEN),\
+                                         PN544_FW_WRITE_BUFFER_MAX_LEN)
+
+#define FW_WORK_STATE_IDLE 1
+#define FW_WORK_STATE_START 2
+#define FW_WORK_STATE_WAIT_WRITE_ANSWER 3
+#define FW_WORK_STATE_WAIT_CHECK_ANSWER 4
+
 struct pn544_i2c_phy {
         struct i2c_client *i2c_dev;
         struct nfc_hci_dev *hdev;
@@ -64,7 +119,18 @@ struct pn544_i2c_phy {
         unsigned int gpio_fw;
         unsigned int en_polarity;
 
+        struct work_struct fw_work;
+        int fw_work_state;
+        char firmware_name[NFC_FIRMWARE_NAME_MAXSIZE + 1];
+        const struct firmware *fw;
+        u32 fw_blob_dest_addr;
+        size_t fw_blob_size;
+        const u8 *fw_blob_data;
+        size_t fw_written;
+        int fw_cmd_result;
+
         int powered;
+        int run_mode;
 
         int hard_fault;         /*
                                  * < 0 if hardware error occured (e.g. i2c err)
@@ -122,15 +188,22 @@ out:
         gpio_set_value(phy->gpio_en, !phy->en_polarity);
 }
 
+static void pn544_hci_i2c_enable_mode(struct pn544_i2c_phy *phy, int run_mode)
+{
+        gpio_set_value(phy->gpio_fw, run_mode == PN544_FW_MODE ? 1 : 0);
+        gpio_set_value(phy->gpio_en, phy->en_polarity);
+        usleep_range(10000, 15000);
+
+        phy->run_mode = run_mode;
+}
+
 static int pn544_hci_i2c_enable(void *phy_id)
 {
         struct pn544_i2c_phy *phy = phy_id;
 
         pr_info(DRIVER_DESC ": %s\n", __func__);
 
-        gpio_set_value(phy->gpio_fw, 0);
-        gpio_set_value(phy->gpio_en, phy->en_polarity);
-        usleep_range(10000, 15000);
+        pn544_hci_i2c_enable_mode(phy, PN544_HCI_MODE);
 
         phy->powered = 1;
 
@@ -305,6 +378,42 @@ flush:
         return r;
 }
 
+static int pn544_hci_i2c_fw_read_status(struct pn544_i2c_phy *phy)
+{
+        int r;
+        struct pn544_i2c_fw_frame_response response;
+        struct i2c_client *client = phy->i2c_dev;
+
+        r = i2c_master_recv(client, (char *) &response, sizeof(response));
+        if (r != sizeof(response)) {
+                dev_err(&client->dev, "cannot read fw status\n");
+                return -EIO;
+        }
+
+        usleep_range(3000, 6000);
+
+        switch (response.status) {
+        case 0:
+                return 0;
+        case PN544_FW_CMD_RESULT_TIMEOUT:
+                return -ETIMEDOUT;
+        case PN544_FW_CMD_RESULT_BAD_CRC:
+                return -ENODATA;
+        case PN544_FW_CMD_RESULT_ACCESS_DENIED:
+                return -EACCES;
+        case PN544_FW_CMD_RESULT_PROTOCOL_ERROR:
+                return -EPROTO;
+        case PN544_FW_CMD_RESULT_INVALID_PARAMETER:
+                return -EINVAL;
+        case PN544_FW_CMD_RESULT_INVALID_LENGTH:
+                return -EBADMSG;
+        case PN544_FW_CMD_RESULT_WRITE_FAILED:
+                return -EIO;
+        default:
+                return -EIO;
+        }
+}
+
 /*
  * Reads an shdlc frame from the chip. This is not as straightforward as it
  * seems. There are cases where we could loose the frame start synchronization.
@@ -339,19 +448,23 @@ static irqreturn_t pn544_hci_i2c_irq_thread_fn(int irq, void *phy_id)
         if (phy->hard_fault != 0)
                 return IRQ_HANDLED;
 
-        r = pn544_hci_i2c_read(phy, &skb);
-        if (r == -EREMOTEIO) {
-                phy->hard_fault = r;
+        if (phy->run_mode == PN544_FW_MODE) {
+                phy->fw_cmd_result = pn544_hci_i2c_fw_read_status(phy);
+                schedule_work(&phy->fw_work);
+        } else {
+                r = pn544_hci_i2c_read(phy, &skb);
+                if (r == -EREMOTEIO) {
+                        phy->hard_fault = r;
 
-                nfc_hci_recv_frame(phy->hdev, NULL);
+                        nfc_hci_recv_frame(phy->hdev, NULL);
 
-                return IRQ_HANDLED;
-        } else if ((r == -ENOMEM) || (r == -EBADMSG)) {
-                return IRQ_HANDLED;
-        }
-
-        nfc_hci_recv_frame(phy->hdev, skb);
+                        return IRQ_HANDLED;
+                } else if ((r == -ENOMEM) || (r == -EBADMSG)) {
+                        return IRQ_HANDLED;
+                }
 
+                nfc_hci_recv_frame(phy->hdev, skb);
+        }
         return IRQ_HANDLED;
 }
 
@@ -361,6 +474,215 @@ static struct nfc_phy_ops i2c_phy_ops = {
         .disable = pn544_hci_i2c_disable,
 };
 
+static int pn544_hci_i2c_fw_download(void *phy_id, const char *firmware_name)
+{
+        struct pn544_i2c_phy *phy = phy_id;
+
+        pr_info(DRIVER_DESC ": Starting Firmware Download (%s)\n",
+                firmware_name);
+
+        strcpy(phy->firmware_name, firmware_name);
+
+        phy->fw_work_state = FW_WORK_STATE_START;
+
+        schedule_work(&phy->fw_work);
+
+        return 0;
+}
+
+static void pn544_hci_i2c_fw_work_complete(struct pn544_i2c_phy *phy,
+                                           int result)
+{
+        pr_info(DRIVER_DESC ": Firmware Download Complete, result=%d\n", result);
+
+        pn544_hci_i2c_disable(phy);
+
+        phy->fw_work_state = FW_WORK_STATE_IDLE;
+
+        if (phy->fw) {
+                release_firmware(phy->fw);
+                phy->fw = NULL;
+        }
+
+        nfc_fw_download_done(phy->hdev->ndev, phy->firmware_name, (u32) -result);
+}
+
+static int pn544_hci_i2c_fw_write_cmd(struct i2c_client *client, u32 dest_addr,
+                                      const u8 *data, u16 datalen)
+{
+        u8 frame[PN544_FW_I2C_MAX_PAYLOAD];
+        struct pn544_i2c_fw_frame_write *framep;
+        u16 params_len;
+        int framelen;
+        int r;
+
+        if (datalen > PN544_FW_I2C_WRITE_DATA_MAX_LEN)
+                datalen = PN544_FW_I2C_WRITE_DATA_MAX_LEN;
+
+        framep = (struct pn544_i2c_fw_frame_write *) frame;
+
+        params_len = sizeof(framep->be_dest_addr) +
+                     sizeof(framep->be_datalen) + datalen;
+        framelen = params_len + sizeof(framep->cmd) +
+                             sizeof(framep->be_length);
+
+        framep->cmd = PN544_FW_CMD_WRITE;
+
+        put_unaligned_be16(params_len, &framep->be_length);
+
+        framep->be_dest_addr[0] = (dest_addr & 0xff0000) >> 16;
+        framep->be_dest_addr[1] = (dest_addr & 0xff00) >> 8;
+        framep->be_dest_addr[2] = dest_addr & 0xff;
+
+        put_unaligned_be16(datalen, &framep->be_datalen);
+
+        memcpy(framep->data, data, datalen);
+
+        r = i2c_master_send(client, frame, framelen);
+
+        if (r == framelen)
+                return datalen;
+        else if (r < 0)
+                return r;
+        else
+                return -EIO;
+}
+
+static int pn544_hci_i2c_fw_check_cmd(struct i2c_client *client, u32 start_addr,
+                                      const u8 *data, u16 datalen)
+{
+        struct pn544_i2c_fw_frame_check frame;
+        int r;
+        u16 crc;
+
+        /* calculate local crc for the data we want to check */
+        crc = crc_ccitt(0xffff, data, datalen);
+
+        frame.cmd = PN544_FW_CMD_CHECK;
+
+        put_unaligned_be16(sizeof(frame.be_start_addr) +
+                           sizeof(frame.be_datalen) + sizeof(frame.be_crc),
+                           &frame.be_length);
+
+        /* tell the chip the memory region to which our crc applies */
+        frame.be_start_addr[0] = (start_addr & 0xff0000) >> 16;
+        frame.be_start_addr[1] = (start_addr & 0xff00) >> 8;
+        frame.be_start_addr[2] = start_addr & 0xff;
+
+        put_unaligned_be16(datalen, &frame.be_datalen);
+
+        /*
+         * and give our local crc. Chip will calculate its own crc for the
+         * region and compare with ours.
+         */
+        put_unaligned_be16(crc, &frame.be_crc);
+
+        r = i2c_master_send(client, (const char *) &frame, sizeof(frame));
+
+        if (r == sizeof(frame))
+                return 0;
+        else if (r < 0)
+                return r;
+        else
+                return -EIO;
+}
+
+static int pn544_hci_i2c_fw_write_chunk(struct pn544_i2c_phy *phy)
+{
+        int r;
+
+        r = pn544_hci_i2c_fw_write_cmd(phy->i2c_dev,
+                                       phy->fw_blob_dest_addr + phy->fw_written,
+                                       phy->fw_blob_data + phy->fw_written,
+                                       phy->fw_blob_size - phy->fw_written);
+        if (r < 0)
+                return r;
+
+        phy->fw_written += r;
+        phy->fw_work_state = FW_WORK_STATE_WAIT_WRITE_ANSWER;
+
+        return 0;
+}
+
+static void pn544_hci_i2c_fw_work(struct work_struct *work)
+{
+        struct pn544_i2c_phy *phy = container_of(work, struct pn544_i2c_phy,
+                                                fw_work);
+        int r;
+        struct pn544_i2c_fw_blob *blob;
+
+        switch (phy->fw_work_state) {
+        case FW_WORK_STATE_START:
+                pn544_hci_i2c_enable_mode(phy, PN544_FW_MODE);
+
+                r = request_firmware(&phy->fw, phy->firmware_name,
+                                     &phy->i2c_dev->dev);
+                if (r < 0)
+                        goto exit_state_start;
+
+                blob = (struct pn544_i2c_fw_blob *) phy->fw->data;
+                phy->fw_blob_size = get_unaligned_be32(&blob->be_size);
+                phy->fw_blob_dest_addr = get_unaligned_be32(&blob->be_destaddr);
+                phy->fw_blob_data = blob->data;
+
+                phy->fw_written = 0;
+                r = pn544_hci_i2c_fw_write_chunk(phy);
+
+exit_state_start:
+                if (r < 0)
+                        pn544_hci_i2c_fw_work_complete(phy, r);
+                break;
+
+        case FW_WORK_STATE_WAIT_WRITE_ANSWER:
+                r = phy->fw_cmd_result;
+                if (r < 0)
+                        goto exit_state_wait_write_answer;
+
+                if (phy->fw_written == phy->fw_blob_size) {
+                        r = pn544_hci_i2c_fw_check_cmd(phy->i2c_dev,
+                                                       phy->fw_blob_dest_addr,
+                                                       phy->fw_blob_data,
+                                                       phy->fw_blob_size);
+                        if (r < 0)
+                                goto exit_state_wait_write_answer;
+                        phy->fw_work_state = FW_WORK_STATE_WAIT_CHECK_ANSWER;
+                        break;
+                }
+
+                r = pn544_hci_i2c_fw_write_chunk(phy);
+
+exit_state_wait_write_answer:
+                if (r < 0)
+                        pn544_hci_i2c_fw_work_complete(phy, r);
+                break;
+
+        case FW_WORK_STATE_WAIT_CHECK_ANSWER:
+                r = phy->fw_cmd_result;
+                if (r < 0)
+                        goto exit_state_wait_check_answer;
+
+                blob = (struct pn544_i2c_fw_blob *) (phy->fw_blob_data +
+                       phy->fw_blob_size);
+                phy->fw_blob_size = get_unaligned_be32(&blob->be_size);
+                if (phy->fw_blob_size != 0) {
+                        phy->fw_blob_dest_addr =
+                                        get_unaligned_be32(&blob->be_destaddr);
+                        phy->fw_blob_data = blob->data;
+
+                        phy->fw_written = 0;
+                        r = pn544_hci_i2c_fw_write_chunk(phy);
+                }
+
+exit_state_wait_check_answer:
+                if (r < 0 || phy->fw_blob_size == 0)
+                        pn544_hci_i2c_fw_work_complete(phy, r);
+                break;
+
+        default:
+                break;
+        }
+}
+
 static int pn544_hci_i2c_probe(struct i2c_client *client,
                                const struct i2c_device_id *id)
 {
@@ -384,6 +706,9 @@ static int pn544_hci_i2c_probe(struct i2c_client *client,
                 return -ENOMEM;
         }
 
+        INIT_WORK(&phy->fw_work, pn544_hci_i2c_fw_work);
+        phy->fw_work_state = FW_WORK_STATE_IDLE;
+
         phy->i2c_dev = client;
         i2c_set_clientdata(client, phy);
 
@@ -420,7 +745,8 @@ static int pn544_hci_i2c_probe(struct i2c_client *client,
 
         r = pn544_hci_probe(phy, &i2c_phy_ops, LLC_SHDLC_NAME,
                             PN544_I2C_FRAME_HEADROOM, PN544_I2C_FRAME_TAILROOM,
-                            PN544_HCI_I2C_LLC_MAX_PAYLOAD, &phy->hdev);
+                            PN544_HCI_I2C_LLC_MAX_PAYLOAD,
+                            pn544_hci_i2c_fw_download, &phy->hdev);
         if (r < 0)
                 goto err_hci;
 
@@ -443,6 +769,10 @@ static int pn544_hci_i2c_remove(struct i2c_client *client)
 
         dev_dbg(&client->dev, "%s\n", __func__);
 
+        cancel_work_sync(&phy->fw_work);
+        if (phy->fw_work_state != FW_WORK_STATE_IDLE)
+                pn544_hci_i2c_fw_work_complete(phy, -ENODEV);
+
         pn544_hci_remove(phy->hdev);
 
         if (phy->powered)
diff --git a/drivers/nfc/pn544/mei.c b/drivers/nfc/pn544/mei.c
index b5d3d18179eb..ee67de50c36f 100644
--- a/drivers/nfc/pn544/mei.c
+++ b/drivers/nfc/pn544/mei.c
@@ -45,7 +45,7 @@ static int pn544_mei_probe(struct mei_cl_device *device,
 
         r = pn544_hci_probe(phy, &mei_phy_ops, LLC_NOP_NAME,
                             MEI_NFC_HEADER_SIZE, 0, MEI_NFC_MAX_HCI_PAYLOAD,
-                            &phy->hdev);
+                            NULL, &phy->hdev);
         if (r < 0) {
                 nfc_mei_phy_free(phy);
 
diff --git a/drivers/nfc/pn544/pn544.c b/drivers/nfc/pn544/pn544.c
index 0d17da7675b7..078e62feba17 100644
--- a/drivers/nfc/pn544/pn544.c
+++ b/drivers/nfc/pn544/pn544.c
@@ -31,9 +31,6 @@
 /* Timing restrictions (ms) */
 #define PN544_HCI_RESETVEN_TIME         30
 
-#define HCI_MODE 0
-#define FW_MODE 1
-
 enum pn544_state {
         PN544_ST_COLD,
         PN544_ST_FW_READY,
@@ -130,6 +127,8 @@ struct pn544_hci_info {
         int async_cb_type;
         data_exchange_cb_t async_cb;
         void *async_cb_context;
+
+        fw_download_t fw_download;
 };
 
 static int pn544_hci_open(struct nfc_hci_dev *hdev)
@@ -782,6 +781,17 @@ exit:
         return r;
 }
 
+static int pn544_hci_fw_download(struct nfc_hci_dev *hdev,
+                                 const char *firmware_name)
+{
+        struct pn544_hci_info *info = nfc_hci_get_clientdata(hdev);
+
+        if (info->fw_download == NULL)
+                return -ENOTSUPP;
+
+        return info->fw_download(info->phy_id, firmware_name);
+}
+
 static struct nfc_hci_ops pn544_hci_ops = {
         .open = pn544_hci_open,
         .close = pn544_hci_close,
@@ -796,11 +806,12 @@ static struct nfc_hci_ops pn544_hci_ops = {
         .tm_send = pn544_hci_tm_send,
         .check_presence = pn544_hci_check_presence,
         .event_received = pn544_hci_event_received,
+        .fw_download = pn544_hci_fw_download,
 };
 
 int pn544_hci_probe(void *phy_id, struct nfc_phy_ops *phy_ops, char *llc_name,
                     int phy_headroom, int phy_tailroom, int phy_payload,
-                    struct nfc_hci_dev **hdev)
+                    fw_download_t fw_download, struct nfc_hci_dev **hdev)
 {
         struct pn544_hci_info *info;
         u32 protocols;
@@ -816,6 +827,7 @@ int pn544_hci_probe(void *phy_id, struct nfc_phy_ops *phy_ops, char *llc_name,
 
         info->phy_ops = phy_ops;
         info->phy_id = phy_id;
+        info->fw_download = fw_download;
         info->state = PN544_ST_COLD;
         mutex_init(&info->info_lock);
 
diff --git a/drivers/nfc/pn544/pn544.h b/drivers/nfc/pn544/pn544.h
index f47c6454914b..01020e585443 100644
--- a/drivers/nfc/pn544/pn544.h
+++ b/drivers/nfc/pn544/pn544.h
@@ -24,9 +24,14 @@
 
 #define DRIVER_DESC "HCI NFC driver for PN544"
 
+#define PN544_HCI_MODE 0
+#define PN544_FW_MODE 1
+
+typedef int (*fw_download_t)(void *context, const char *firmware_name);
+
 int pn544_hci_probe(void *phy_id, struct nfc_phy_ops *phy_ops, char *llc_name,
                     int phy_headroom, int phy_tailroom, int phy_payload,
-                    struct nfc_hci_dev **hdev);
+                    fw_download_t fw_download, struct nfc_hci_dev **hdev);
 void pn544_hci_remove(struct nfc_hci_dev *hdev);
 
 #endif /* __LOCAL_PN544_H_ */
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211.h b/drivers/staging/rtl8187se/ieee80211/ieee80211.h
index 8fc9f588b056..7f015499cfae 100644
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211.h
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211.h
@@ -14,7 +14,7 @@
  * Copyright (c) 2004, Intel Corporation
  *
  * Modified for Realtek's wi-fi cards by Andrea Merello
- * <andreamrl@tiscali.it>
+ * <andrea.merello@gmail.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_rx.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_rx.c
index d5df0d691fcc..10b22100dd3a 100644
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_rx.c
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_rx.c
@@ -14,7 +14,7 @@
  ******************************************************************************
 
   Few modifications for Realtek's Wi-Fi drivers by
-  Andrea Merello <andreamrl@tiscali.it>
+  Andrea Merello <andrea.merello@gmail.com>
 
   A special thanks goes to Realtek for their support !
 
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac.c
index 00f9af06aca5..b65db542e1ab 100644
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac.c
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac.c
@@ -1,5 +1,5 @@
 /* IEEE 802.11 SoftMAC layer
- * Copyright (c) 2005 Andrea Merello <andreamrl@tiscali.it>
+ * Copyright (c) 2005 Andrea Merello <andrea.merello@gmail.com>
  *
  * Mostly extracted from the rtl8180-sa2400 driver for the
  * in-kernel generic ieee802.11 stack.
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c
index d9add5305e29..e5282068e3de 100644
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c
@@ -1,5 +1,5 @@
 /* IEEE 802.11 SoftMAC layer
- * Copyright (c) 2005 Andrea Merello <andreamrl@tiscali.it>
+ * Copyright (c) 2005 Andrea Merello <andrea.merello@gmail.com>
  *
  * Mostly extracted from the rtl8180-sa2400 driver for the
  * in-kernel generic ieee802.11 stack.
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_tx.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_tx.c
index 89ed86ef0d15..b3466530cf94 100644
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_tx.c
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_tx.c
@@ -25,7 +25,7 @@
 ******************************************************************************
 
   Few modifications for Realtek's Wi-Fi drivers by
-  Andrea Merello <andreamrl@tiscali.it>
+  Andrea Merello <andrea.merello@gmail.com>
 
   A special thanks goes to Realtek for their support !
 
diff --git a/drivers/staging/rtl8187se/r8180.h b/drivers/staging/rtl8187se/r8180.h
index edacc8001640..d052f4a9a839 100644
--- a/drivers/staging/rtl8187se/r8180.h
+++ b/drivers/staging/rtl8187se/r8180.h
@@ -1,6 +1,6 @@
 /*
    This is part of rtl8180 OpenSource driver.
-   Copyright (C) Andrea Merello 2004-2005  <andreamrl@tiscali.it>
+   Copyright (C) Andrea Merello 2004-2005  <andrea.merello@gmail.com>
    Released under the terms of GPL (General Public Licence)
 
    Parts of this driver are based on the GPL part of the
diff --git a/drivers/staging/rtl8187se/r8180_93cx6.h b/drivers/staging/rtl8187se/r8180_93cx6.h
index 79e7391ac881..b52b5b0610ab 100644
--- a/drivers/staging/rtl8187se/r8180_93cx6.h
+++ b/drivers/staging/rtl8187se/r8180_93cx6.h
@@ -1,6 +1,6 @@
 /*
         This is part of rtl8180 OpenSource driver
-        Copyright (C) Andrea Merello 2004-2005  <andreamrl@tiscali.it>
+        Copyright (C) Andrea Merello 2004-2005  <andrea.merello@gmail.com>
         Released under the terms of GPL (General Public Licence)
 
         Parts of this driver are based on the GPL part of the official realtek driver
diff --git a/drivers/staging/rtl8187se/r8180_core.c b/drivers/staging/rtl8187se/r8180_core.c
index ca691550436a..fd2bfeadd54c 100644
--- a/drivers/staging/rtl8187se/r8180_core.c
+++ b/drivers/staging/rtl8187se/r8180_core.c
@@ -1,6 +1,6 @@
 /*
    This is part of rtl818x pci OpenSource driver - v 0.1
-   Copyright (C) Andrea Merello 2004-2005  <andreamrl@tiscali.it>
+   Copyright (C) Andrea Merello 2004-2005  <andrea.merello@gmail.com>
    Released under the terms of GPL (General Public License)
 
    Parts of this driver are based on the GPL part of the official
@@ -70,7 +70,7 @@ static int hwwep;
 
 MODULE_LICENSE("GPL");
 MODULE_DEVICE_TABLE(pci, rtl8180_pci_id_tbl);
-MODULE_AUTHOR("Andrea Merello <andreamrl@tiscali.it>");
+MODULE_AUTHOR("Andrea Merello <andrea.merello@gmail.com>");
 MODULE_DESCRIPTION("Linux driver for Realtek RTL8187SE WiFi cards");
 
 module_param_string(ifname, ifname, sizeof(ifname), S_IRUGO|S_IWUSR);
diff --git a/drivers/staging/rtl8187se/r8180_hw.h b/drivers/staging/rtl8187se/r8180_hw.h
index 533938123a97..92c05af557cf 100644
--- a/drivers/staging/rtl8187se/r8180_hw.h
+++ b/drivers/staging/rtl8187se/r8180_hw.h
@@ -1,6 +1,6 @@
 /*
         This is part of rtl8180 OpenSource driver.
-        Copyright (C) Andrea Merello 2004-2005  <andreamrl@tiscali.it>
+        Copyright (C) Andrea Merello 2004-2005  <andrea.merello@gmail.com>
         Released under the terms of GPL (General Public Licence)
 
         Parts of this driver are based on the GPL part of the
diff --git a/drivers/staging/rtl8187se/r8180_rtl8225.h b/drivers/staging/rtl8187se/r8180_rtl8225.h
index c6f2128e755c..c94ca0794a5d 100644
--- a/drivers/staging/rtl8187se/r8180_rtl8225.h
+++ b/drivers/staging/rtl8187se/r8180_rtl8225.h
@@ -1,7 +1,7 @@
 /*
         This is part of the rtl8180-sa2400 driver
         released under the GPL (See file COPYING for details).
-        Copyright (c) 2005 Andrea Merello <andreamrl@tiscali.it>
+        Copyright (c) 2005 Andrea Merello <andrea.merello@gmail.com>
 
         This files contains programming code for the rtl8225
         radio frontend.
diff --git a/drivers/staging/rtl8187se/r8180_rtl8225z2.c b/drivers/staging/rtl8187se/r8180_rtl8225z2.c
index c592f7936ddb..9ae96b7852f3 100644
--- a/drivers/staging/rtl8187se/r8180_rtl8225z2.c
+++ b/drivers/staging/rtl8187se/r8180_rtl8225z2.c
@@ -1,7 +1,7 @@
 /*
  * This is part of the rtl8180-sa2400 driver
  * released under the GPL (See file COPYING for details).
- * Copyright (c) 2005 Andrea Merello <andreamrl@tiscali.it>
+ * Copyright (c) 2005 Andrea Merello <andrea.merello@gmail.com>
  *
  * This files contains programming code for the rtl8225
  * radio frontend.
diff --git a/drivers/staging/rtl8187se/r8180_wx.c b/drivers/staging/rtl8187se/r8180_wx.c
index 156b75882290..dab787542c45 100644
--- a/drivers/staging/rtl8187se/r8180_wx.c
+++ b/drivers/staging/rtl8187se/r8180_wx.c
@@ -2,7 +2,7 @@
         This file contains wireless extension handlers.
 
         This is part of rtl8180 OpenSource driver.
-        Copyright (C) Andrea Merello 2004-2005  <andreamrl@tiscali.it>
+        Copyright (C) Andrea Merello 2004-2005  <andrea.merello@gmail.com>
         Released under the terms of GPL (General Public Licence)
 
         Parts of this driver are based on the GPL part
diff --git a/drivers/staging/rtl8187se/r8180_wx.h b/drivers/staging/rtl8187se/r8180_wx.h
index 408191403112..d471520ac772 100644
--- a/drivers/staging/rtl8187se/r8180_wx.h
+++ b/drivers/staging/rtl8187se/r8180_wx.h
@@ -1,6 +1,6 @@
 /*
         This is part of rtl8180 OpenSource driver - v 0.3
-        Copyright (C) Andrea Merello 2004  <andreamrl@tiscali.it>
+        Copyright (C) Andrea Merello 2004  <andrea.merello@gmail.com>
         Released under the terms of GPL (General Public Licence)
 
         Parts of this driver are based on the GPL part of the official realtek driver
diff --git a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
index 50c7bb773984..74fbd70d5838 100644
--- a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
+++ b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
@@ -2,7 +2,7 @@
  * Copyright(c) 2008 - 2010 Realtek Corporation. All rights reserved.
  *
  * Based on the r8180 driver, which is:
- * Copyright 2004-2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ * Copyright 2004-2005 Andrea Merello <andrea.merello@gmail.com>, et al.
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
  * published by the Free Software Foundation.
diff --git a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.h b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.h
index b9b3b52f9120..dbe0e1c87056 100644
--- a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.h
+++ b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.h
@@ -2,7 +2,7 @@
  * Copyright(c) 2008 - 2010 Realtek Corporation. All rights reserved.
  *
  * Based on the r8180 driver, which is:
- * Copyright 2004-2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ * Copyright 2004-2005 Andrea Merello <andrea.merello@gmail.com>, et al.
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
  * published by the Free Software Foundation.
diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_cam.c b/drivers/staging/rtl8192e/rtl8192e/rtl_cam.c
index baf3b6342e44..fa5603a562c3 100644
--- a/drivers/staging/rtl8192e/rtl8192e/rtl_cam.c
+++ b/drivers/staging/rtl8192e/rtl8192e/rtl_cam.c
@@ -2,7 +2,7 @@
  * Copyright(c) 2008 - 2010 Realtek Corporation. All rights reserved.
  *
  * Based on the r8180 driver, which is:
- * Copyright 2004-2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ * Copyright 2004-2005 Andrea Merello <andrea.merello@gmail.com>, et al.
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
  * published by the Free Software Foundation.
diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_cam.h b/drivers/staging/rtl8192e/rtl8192e/rtl_cam.h
index fa607f98b172..7d075d3cbe62 100644
--- a/drivers/staging/rtl8192e/rtl8192e/rtl_cam.h
+++ b/drivers/staging/rtl8192e/rtl8192e/rtl_cam.h
@@ -2,7 +2,7 @@
  * Copyright(c) 2008 - 2010 Realtek Corporation. All rights reserved.
  *
  * Based on the r8180 driver, which is:
- * Copyright 2004-2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ * Copyright 2004-2005 Andrea Merello <andrea.merello@gmail.com>, et al.
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
  * published by the Free Software Foundation.
diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
index 2b6c61c5d3d8..8d45c8dbfa83 100644
--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
+++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
@@ -2,7 +2,7 @@
  * Copyright(c) 2008 - 2010 Realtek Corporation. All rights reserved.
  *
  * Based on the r8180 driver, which is:
- * Copyright 2004-2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ * Copyright 2004-2005 Andrea Merello <andrea.merello@gmail.com>, et al.
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
  * published by the Free Software Foundation.
diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.h b/drivers/staging/rtl8192e/rtl8192e/rtl_core.h
index 87d4d349c890..9de1dc3e584b 100644
--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.h
+++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.h
@@ -2,7 +2,7 @@
  * Copyright(c) 2008 - 2010 Realtek Corporation. All rights reserved.
  *
  * Based on the r8180 driver, which is:
- * Copyright 2004-2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ * Copyright 2004-2005 Andrea Merello <andrea.merello@gmail.com>, et al.
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
  * published by the Free Software Foundation.
diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_eeprom.c b/drivers/staging/rtl8192e/rtl8192e/rtl_eeprom.c
index c1ccff4a8321..a6778e0853c7 100644
--- a/drivers/staging/rtl8192e/rtl8192e/rtl_eeprom.c
+++ b/drivers/staging/rtl8192e/rtl8192e/rtl_eeprom.c
@@ -2,7 +2,7 @@
  * Copyright(c) 2008 - 2010 Realtek Corporation. All rights reserved.
  *
  * Based on the r8180 driver, which is:
- * Copyright 2004-2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ * Copyright 2004-2005 Andrea Merello <andrea.merello@gmail.com>, et al.
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
  * published by the Free Software Foundation.
diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_eeprom.h b/drivers/staging/rtl8192e/rtl8192e/rtl_eeprom.h
index 9452e1683a72..adea2b4c7a44 100644
--- a/drivers/staging/rtl8192e/rtl8192e/rtl_eeprom.h
+++ b/drivers/staging/rtl8192e/rtl8192e/rtl_eeprom.h
@@ -2,7 +2,7 @@
  * Copyright(c) 2008 - 2010 Realtek Corporation. All rights reserved.
  *
  * Based on the r8180 driver, which is:
- * Copyright 2004-2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ * Copyright 2004-2005 Andrea Merello <andrea.merello@gmail.com>, et al.
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
  * published by the Free Software Foundation.
diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_ethtool.c b/drivers/staging/rtl8192e/rtl8192e/rtl_ethtool.c
index 0cfb3ecaadee..529ea54d1683 100644
--- a/drivers/staging/rtl8192e/rtl8192e/rtl_ethtool.c
+++ b/drivers/staging/rtl8192e/rtl8192e/rtl_ethtool.c
@@ -2,7 +2,7 @@
  * Copyright(c) 2008 - 2010 Realtek Corporation. All rights reserved.
  *
  * Based on the r8180 driver, which is:
- * Copyright 2004-2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ * Copyright 2004-2005 Andrea Merello <andrea.merello@gmail.com>, et al.
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
  * published by the Free Software Foundation.
diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_pci.c b/drivers/staging/rtl8192e/rtl8192e/rtl_pci.c
index 5abbee37cdca..2ad92eee50c2 100644
--- a/drivers/staging/rtl8192e/rtl8192e/rtl_pci.c
+++ b/drivers/staging/rtl8192e/rtl8192e/rtl_pci.c
@@ -2,7 +2,7 @@
  * Copyright(c) 2008 - 2010 Realtek Corporation. All rights reserved.
  *
  * Based on the r8180 driver, which is:
- * Copyright 2004-2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ * Copyright 2004-2005 Andrea Merello <andrea.merello@gmail.com>, et al.
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
  * published by the Free Software Foundation.
diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_pci.h b/drivers/staging/rtl8192e/rtl8192e/rtl_pci.h
index 28c7da677a80..356aec437963 100644
--- a/drivers/staging/rtl8192e/rtl8192e/rtl_pci.h
+++ b/drivers/staging/rtl8192e/rtl8192e/rtl_pci.h
@@ -2,7 +2,7 @@
  * Copyright(c) 2008 - 2010 Realtek Corporation. All rights reserved.
  *
  * Based on the r8180 driver, which is:
- * Copyright 2004-2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ * Copyright 2004-2005 Andrea Merello <andrea.merello@gmail.com>, et al.
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
  * published by the Free Software Foundation.
diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_ps.c b/drivers/staging/rtl8192e/rtl8192e/rtl_ps.c
index c9a7c563b682..a8c2ade4f435 100644
--- a/drivers/staging/rtl8192e/rtl8192e/rtl_ps.c
+++ b/drivers/staging/rtl8192e/rtl8192e/rtl_ps.c
@@ -2,7 +2,7 @@
  * Copyright(c) 2008 - 2010 Realtek Corporation. All rights reserved.
  *
  * Based on the r8180 driver, which is:
- * Copyright 2004-2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ * Copyright 2004-2005 Andrea Merello <andrea.merello@gmail.com>, et al.
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
  * published by the Free Software Foundation.
diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_ps.h b/drivers/staging/rtl8192e/rtl8192e/rtl_ps.h
index df79d6c4ca03..962f2e5b8bf8 100644
--- a/drivers/staging/rtl8192e/rtl8192e/rtl_ps.h
+++ b/drivers/staging/rtl8192e/rtl8192e/rtl_ps.h
@@ -2,7 +2,7 @@
  * Copyright(c) 2008 - 2010 Realtek Corporation. All rights reserved.
  *
  * Based on the r8180 driver, which is:
- * Copyright 2004-2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ * Copyright 2004-2005 Andrea Merello <andrea.merello@gmail.com>, et al.
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
  * published by the Free Software Foundation.
diff --git a/drivers/staging/rtl8192e/rtllib.h b/drivers/staging/rtl8192e/rtllib.h
index 3485ef1dfab1..05ef49f24cd9 100644
--- a/drivers/staging/rtl8192e/rtllib.h
+++ b/drivers/staging/rtl8192e/rtllib.h
@@ -14,7 +14,7 @@
  * Copyright (c) 2004, Intel Corporation
  *
  * Modified for Realtek's wi-fi cards by Andrea Merello
- * <andreamrl@tiscali.it>
+ * <andrea.merello@gmail.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
diff --git a/drivers/staging/rtl8192e/rtllib_debug.h b/drivers/staging/rtl8192e/rtllib_debug.h
index 2bfc1155f505..c59f67b26363 100644
--- a/drivers/staging/rtl8192e/rtllib_debug.h
+++ b/drivers/staging/rtl8192e/rtllib_debug.h
@@ -2,7 +2,7 @@
  * Copyright(c) 2008 - 2010 Realtek Corporation. All rights reserved.
  *
  * Based on the r8180 driver, which is:
- * Copyright 2004-2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ * Copyright 2004-2005 Andrea Merello <andrea.merello@gmail.com>, et al.
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
  * published by the Free Software Foundation.
diff --git a/drivers/staging/rtl8192e/rtllib_rx.c b/drivers/staging/rtl8192e/rtllib_rx.c
index e75364e3eb43..96aa3a2fb7e1 100644
--- a/drivers/staging/rtl8192e/rtllib_rx.c
+++ b/drivers/staging/rtl8192e/rtllib_rx.c
@@ -14,7 +14,7 @@
  ******************************************************************************
 
   Few modifications for Realtek's Wi-Fi drivers by
-  Andrea Merello <andreamrl@tiscali.it>
+  Andrea Merello <andrea.merello@gmail.com>
 
   A special thanks goes to Realtek for their support !
 
diff --git a/drivers/staging/rtl8192e/rtllib_softmac.c b/drivers/staging/rtl8192e/rtllib_softmac.c
index aefffac556a6..0cbf6f5593a3 100644
--- a/drivers/staging/rtl8192e/rtllib_softmac.c
+++ b/drivers/staging/rtl8192e/rtllib_softmac.c
@@ -1,5 +1,5 @@
 /* IEEE 802.11 SoftMAC layer
- * Copyright (c) 2005 Andrea Merello <andreamrl@tiscali.it>
+ * Copyright (c) 2005 Andrea Merello <andrea.merello@gmail.com>
  *
  * Mostly extracted from the rtl8180-sa2400 driver for the
  * in-kernel generic ieee802.11 stack.
diff --git a/drivers/staging/rtl8192e/rtllib_softmac_wx.c b/drivers/staging/rtl8192e/rtllib_softmac_wx.c
index 740cf85e9d5b..e6af8cfab12b 100644
--- a/drivers/staging/rtl8192e/rtllib_softmac_wx.c
+++ b/drivers/staging/rtl8192e/rtllib_softmac_wx.c
@@ -1,5 +1,5 @@
 /* IEEE 802.11 SoftMAC layer
- * Copyright (c) 2005 Andrea Merello <andreamrl@tiscali.it>
+ * Copyright (c) 2005 Andrea Merello <andrea.merello@gmail.com>
  *
  * Mostly extracted from the rtl8180-sa2400 driver for the
  * in-kernel generic ieee802.11 stack.
diff --git a/drivers/staging/rtl8192e/rtllib_tx.c b/drivers/staging/rtl8192e/rtllib_tx.c
index 759d7c7d78e5..1cc6a9d5e8a3 100644
--- a/drivers/staging/rtl8192e/rtllib_tx.c
+++ b/drivers/staging/rtl8192e/rtllib_tx.c
@@ -25,7 +25,7 @@
 ******************************************************************************
 
   Few modifications for Realtek's Wi-Fi drivers by
-  Andrea Merello <andreamrl@tiscali.it>
+  Andrea Merello <andrea.merello@gmail.com>
 
   A special thanks goes to Realtek for their support !
 
diff --git a/drivers/staging/rtl8192u/authors b/drivers/staging/rtl8192u/authors
index b08bbae39e72..0fab11228b48 100644
--- a/drivers/staging/rtl8192u/authors
+++ b/drivers/staging/rtl8192u/authors
@@ -1 +1 @@
-Andrea Merello <andreamrl@tiscali.it>
+Andrea Merello <andrea.merello@gmail.com>
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211.h b/drivers/staging/rtl8192u/ieee80211/ieee80211.h
index c9f3bb363be4..bc64f05a7e6a 100644
--- a/drivers/staging/rtl8192u/ieee80211/ieee80211.h
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211.h
@@ -14,7 +14,7 @@
  * Copyright (c) 2004, Intel Corporation
  *
  * Modified for Realtek's wi-fi cards by Andrea Merello
- * <andreamrl@tiscali.it>
+ * <andrea.merello@gmail.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
index a6b18409103b..59900bfa1c18 100644
--- a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
@@ -14,7 +14,7 @@
  ******************************************************************************
 
   Few modifications for Realtek's Wi-Fi drivers by
-  Andrea Merello <andreamrl@tiscali.it>
+  Andrea Merello <andrea.merello@gmail.com>
 
   A special thanks goes to Realtek for their support !
 
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
index 8a0075db9253..5fd696926ee3 100644
--- a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
@@ -1,5 +1,5 @@
 /* IEEE 802.11 SoftMAC layer
- * Copyright (c) 2005 Andrea Merello <andreamrl@tiscali.it>
+ * Copyright (c) 2005 Andrea Merello <andrea.merello@gmail.com>
  *
  * Mostly extracted from the rtl8180-sa2400 driver for the
  * in-kernel generic ieee802.11 stack.
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac_wx.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac_wx.c
index 60746b8b1eb0..7b7d929f1536 100644
--- a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac_wx.c
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac_wx.c
@@ -1,5 +1,5 @@
 /* IEEE 802.11 SoftMAC layer
- * Copyright (c) 2005 Andrea Merello <andreamrl@tiscali.it>
+ * Copyright (c) 2005 Andrea Merello <andrea.merello@gmail.com>
  *
  * Mostly extracted from the rtl8180-sa2400 driver for the
  * in-kernel generic ieee802.11 stack.
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_tx.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_tx.c
index 995504207fc6..a7bcc64ff226 100644
--- a/drivers/staging/rtl8192u/ieee80211/ieee80211_tx.c
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_tx.c
@@ -25,7 +25,7 @@
 ******************************************************************************
 
   Few modifications for Realtek's Wi-Fi drivers by
-  Andrea Merello <andreamrl@tiscali.it>
+  Andrea Merello <andrea.merello@gmail.com>
 
   A special thanks goes to Realtek for their support !
 
diff --git a/drivers/staging/rtl8192u/r8180_93cx6.c b/drivers/staging/rtl8192u/r8180_93cx6.c
index d2199986d132..c61729b727ef 100644
--- a/drivers/staging/rtl8192u/r8180_93cx6.c
+++ b/drivers/staging/rtl8192u/r8180_93cx6.c
@@ -3,7 +3,7 @@
    memory is addressed by 16 bits words.
 
    This is part of rtl8180 OpenSource driver.
-   Copyright (C) Andrea Merello 2004  <andreamrl@tiscali.it>
+   Copyright (C) Andrea Merello 2004  <andrea.merello@gmail.com>
    Released under the terms of GPL (General Public Licence)
 
    Parts of this driver are based on the GPL part of the
diff --git a/drivers/staging/rtl8192u/r8180_93cx6.h b/drivers/staging/rtl8192u/r8180_93cx6.h
index 5cea51e1142e..ee55dbffe32c 100644
--- a/drivers/staging/rtl8192u/r8180_93cx6.h
+++ b/drivers/staging/rtl8192u/r8180_93cx6.h
@@ -1,6 +1,6 @@
 /*
         This is part of rtl8187 OpenSource driver
-        Copyright (C) Andrea Merello 2004-2005  <andreamrl@tiscali.it>
+        Copyright (C) Andrea Merello 2004-2005  <andrea.merello@gmail.com>
         Released under the terms of GPL (General Public Licence)
 
         Parts of this driver are based on the GPL part of the official realtek driver
diff --git a/drivers/staging/rtl8192u/r8180_pm.c b/drivers/staging/rtl8192u/r8180_pm.c
index 0c58d0ed502a..999968d41720 100644
--- a/drivers/staging/rtl8192u/r8180_pm.c
+++ b/drivers/staging/rtl8192u/r8180_pm.c
@@ -5,7 +5,7 @@
    does not do anything useful.
 
    This is part of rtl8180 OpenSource driver.
-   Copyright (C) Andrea Merello 2004  <andreamrl@tiscali.it>
+   Copyright (C) Andrea Merello 2004  <andrea.merello@gmail.com>
    Released under the terms of GPL (General Public Licence)
 */
 
diff --git a/drivers/staging/rtl8192u/r8180_pm.h b/drivers/staging/rtl8192u/r8180_pm.h
index 52d6fba99deb..4be63da0b781 100644
--- a/drivers/staging/rtl8192u/r8180_pm.h
+++ b/drivers/staging/rtl8192u/r8180_pm.h
@@ -5,7 +5,7 @@
         does not do anything useful.
 
         This is part of rtl8180 OpenSource driver.
-        Copyright (C) Andrea Merello 2004  <andreamrl@tiscali.it>
+        Copyright (C) Andrea Merello 2004  <andrea.merello@gmail.com>
         Released under the terms of GPL (General Public Licence)
 
 */
diff --git a/drivers/staging/rtl8192u/r8190_rtl8256.h b/drivers/staging/rtl8192u/r8190_rtl8256.h
index b64dd662761a..592e7807fa42 100644
--- a/drivers/staging/rtl8192u/r8190_rtl8256.h
+++ b/drivers/staging/rtl8192u/r8190_rtl8256.h
@@ -1,7 +1,7 @@
 /*
   This is part of the rtl8180-sa2400 driver
   released under the GPL (See file COPYING for details).
-  Copyright (c) 2005 Andrea Merello <andreamrl@tiscali.it>
+  Copyright (c) 2005 Andrea Merello <andrea.merello@gmail.com>
 
   This files contains programming code for the rtl8256
   radio frontend.
diff --git a/drivers/staging/rtl8192u/r8192U.h b/drivers/staging/rtl8192u/r8192U.h
index 338e7bc237c3..b484ee128c13 100644
--- a/drivers/staging/rtl8192u/r8192U.h
+++ b/drivers/staging/rtl8192u/r8192U.h
@@ -1,6 +1,6 @@
 /*
  * This is part of rtl8187 OpenSource driver.
- * Copyright (C) Andrea Merello 2004-2005  <andreamrl@tiscali.it>
+ * Copyright (C) Andrea Merello 2004-2005  <andrea.merello@gmail.com>
  * Released under the terms of GPL (General Public Licence)
  *
  * Parts of this driver are based on the GPL part of the
diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
index 14c14c24ac50..cd0946db025c 100644
--- a/drivers/staging/rtl8192u/r8192U_core.c
+++ b/drivers/staging/rtl8192u/r8192U_core.c
@@ -3,7 +3,7 @@
  * Linux device driver for RTL8192U
  *
  * Based on the r8187 driver, which is:
- * Copyright 2004-2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ * Copyright 2004-2005 Andrea Merello <andrea.merello@gmail.com>, et al.
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
  * published by the Free Software Foundation.
diff --git a/drivers/staging/rtl8192u/r8192U_hw.h b/drivers/staging/rtl8192u/r8192U_hw.h
index 7e612aa56fa4..dd07a735b537 100644
--- a/drivers/staging/rtl8192u/r8192U_hw.h
+++ b/drivers/staging/rtl8192u/r8192U_hw.h
@@ -1,6 +1,6 @@
 /*
         This is part of rtl8187 OpenSource driver.
-        Copyright (C) Andrea Merello 2004-2005  <andreamrl@tiscali.it>
+        Copyright (C) Andrea Merello 2004-2005  <andrea.merello@gmail.com>
         Released under the terms of GPL (General Public Licence)
 
         Parts of this driver are based on the GPL part of the
diff --git a/drivers/staging/rtl8192u/r8192U_wx.c b/drivers/staging/rtl8192u/r8192U_wx.c
index 3e2576347d29..61f6620213e2 100644
--- a/drivers/staging/rtl8192u/r8192U_wx.c
+++ b/drivers/staging/rtl8192u/r8192U_wx.c
@@ -2,7 +2,7 @@
    This file contains wireless extension handlers.
 
    This is part of rtl8180 OpenSource driver.
-   Copyright (C) Andrea Merello 2004-2005  <andreamrl@tiscali.it>
+   Copyright (C) Andrea Merello 2004-2005  <andrea.merello@gmail.com>
    Released under the terms of GPL (General Public Licence)
 
    Parts of this driver are based on the GPL part
diff --git a/drivers/staging/rtl8192u/r8192U_wx.h b/drivers/staging/rtl8192u/r8192U_wx.h
index 9f6b10505426..ae7a617740a3 100644
--- a/drivers/staging/rtl8192u/r8192U_wx.h
+++ b/drivers/staging/rtl8192u/r8192U_wx.h
@@ -1,6 +1,6 @@
 /*
         This is part of rtl8180 OpenSource driver - v 0.3
-        Copyright (C) Andrea Merello 2004  <andreamrl@tiscali.it>
+        Copyright (C) Andrea Merello 2004  <andrea.merello@gmail.com>
         Released under the terms of GPL (General Public Licence)
 
         Parts of this driver are based on the GPL part of the official realtek driver
diff --git a/drivers/staging/vt6655/hostap.c b/drivers/staging/vt6655/hostap.c
index 57a08c5771f2..8acff44a9e75 100644
--- a/drivers/staging/vt6655/hostap.c
+++ b/drivers/staging/vt6655/hostap.c
@@ -86,7 +86,7 @@ static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
 
         apdev_priv = netdev_priv(pDevice->apdev);
         *apdev_priv = *pDevice;
-        memcpy(pDevice->apdev->dev_addr, dev->dev_addr, ETH_ALEN);
+        eth_hw_addr_inherit(pDevice->apdev, dev);
 
         pDevice->apdev->netdev_ops = &apdev_netdev_ops;
 
diff --git a/drivers/staging/vt6655/ioctl.c b/drivers/staging/vt6655/ioctl.c
index 46e0e41e7e60..b5cd2e44e53d 100644
--- a/drivers/staging/vt6655/ioctl.c
+++ b/drivers/staging/vt6655/ioctl.c
@@ -460,7 +460,7 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq)
                 }
                 if (sValue.dwValue == 1) {
                         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "up wpadev\n");
-                        memcpy(pDevice->wpadev->dev_addr, pDevice->dev->dev_addr, ETH_ALEN);
+                        eth_hw_addr_inherit(pDevice->wpadev, pDevice->dev);
                         pDevice->bWPADEVUp = true;
                 } else {
                         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "close wpadev\n");
diff --git a/drivers/staging/vt6655/wpactl.c b/drivers/staging/vt6655/wpactl.c
index 869f62c678e6..e8d9ecd2913a 100644
--- a/drivers/staging/vt6655/wpactl.c
+++ b/drivers/staging/vt6655/wpactl.c
@@ -96,7 +96,7 @@ static int wpa_init_wpadev(PSDevice pDevice)
 
         wpadev_priv = netdev_priv(pDevice->wpadev);
         *wpadev_priv = *pDevice;
-        memcpy(pDevice->wpadev->dev_addr, dev->dev_addr, ETH_ALEN);
+        eth_hw_addr_inherit(pDevice->wpadev, dev);
         pDevice->wpadev->base_addr = dev->base_addr;
         pDevice->wpadev->irq = dev->irq;
         pDevice->wpadev->mem_start = dev->mem_start;
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 969a85960e9f..831eb4fd197d 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -276,12 +276,12 @@ static void copy_iovec_hdr(const struct iovec *from, struct iovec *to,
  * of used idx. Once lower device DMA done contiguously, we will signal KVM
  * guest used idx.
  */
-static int vhost_zerocopy_signal_used(struct vhost_net *net,
-                                      struct vhost_virtqueue *vq)
+static void vhost_zerocopy_signal_used(struct vhost_net *net,
+                                       struct vhost_virtqueue *vq)
 {
         struct vhost_net_virtqueue *nvq =
                 container_of(vq, struct vhost_net_virtqueue, vq);
-        int i;
+        int i, add;
         int j = 0;
 
         for (i = nvq->done_idx; i != nvq->upend_idx; i = (i + 1) % UIO_MAXIOV) {
@@ -289,15 +289,17 @@ static int vhost_zerocopy_signal_used(struct vhost_net *net,
                         vhost_net_tx_err(net);
                 if (VHOST_DMA_IS_DONE(vq->heads[i].len)) {
                         vq->heads[i].len = VHOST_DMA_CLEAR_LEN;
-                        vhost_add_used_and_signal(vq->dev, vq,
-                                                  vq->heads[i].id, 0);
                         ++j;
                 } else
                         break;
         }
-        if (j)
-                nvq->done_idx = i;
-        return j;
+        while (j) {
+                add = min(UIO_MAXIOV - nvq->done_idx, j);
+                vhost_add_used_and_signal_n(vq->dev, vq,
+                                            &vq->heads[nvq->done_idx], add);
+                nvq->done_idx = (nvq->done_idx + add) % UIO_MAXIOV;
+                j -= add;
+        }
 }
 
 static void vhost_zerocopy_callback(struct ubuf_info *ubuf, bool success)
@@ -306,6 +308,11 @@ static void vhost_zerocopy_callback(struct ubuf_info *ubuf, bool success)
         struct vhost_virtqueue *vq = ubufs->vq;
         int cnt = atomic_read(&ubufs->kref.refcount);
 
+        /* set len to mark this desc buffers done DMA */
+        vq->heads[ubuf->desc].len = success ?
+                VHOST_DMA_DONE_LEN : VHOST_DMA_FAILED_LEN;
+        vhost_net_ubuf_put(ubufs);
+
         /*
          * Trigger polling thread if guest stopped submitting new buffers:
          * in this case, the refcount after decrement will eventually reach 1
@@ -316,10 +323,6 @@ static void vhost_zerocopy_callback(struct ubuf_info *ubuf, bool success)
          */
         if (cnt <= 2 || !(cnt % 16))
                 vhost_poll_queue(&vq->poll);
-        /* set len to mark this desc buffers done DMA */
-        vq->heads[ubuf->desc].len = success ?
-                VHOST_DMA_DONE_LEN : VHOST_DMA_FAILED_LEN;
-        vhost_net_ubuf_put(ubufs);
 }
 
 /* Expects to be always run from workqueue - which acts as
@@ -360,6 +363,13 @@ static void handle_tx(struct vhost_net *net)
                 if (zcopy)
                         vhost_zerocopy_signal_used(net, vq);
 
+                /* If more outstanding DMAs, queue the work.
+                 * Handle upend_idx wrap around
+                 */
+                if (unlikely((nvq->upend_idx + vq->num - VHOST_MAX_PEND)
+                              % UIO_MAXIOV == nvq->done_idx))
+                        break;
+
                 head = vhost_get_vq_desc(&net->dev, vq, vq->iov,
                                          ARRAY_SIZE(vq->iov),
                                          &out, &in,
@@ -369,17 +379,6 @@ static void handle_tx(struct vhost_net *net)
                         break;
                 /* Nothing new?  Wait for eventfd to tell us they refilled. */
                 if (head == vq->num) {
-                        int num_pends;
-
-                        /* If more outstanding DMAs, queue the work.
-                         * Handle upend_idx wrap around
-                         */
-                        num_pends = likely(nvq->upend_idx >= nvq->done_idx) ?
-                                    (nvq->upend_idx - nvq->done_idx) :
-                                    (nvq->upend_idx + UIO_MAXIOV -
-                                     nvq->done_idx);
-                        if (unlikely(num_pends > VHOST_MAX_PEND))
-                                break;
                         if (unlikely(vhost_enable_notify(&net->dev, vq))) {
                                 vhost_disable_notify(&net->dev, vq);
                                 continue;
@@ -402,43 +401,36 @@ static void handle_tx(struct vhost_net *net)
                                iov_length(nvq->hdr, s), hdr_size);
                         break;
                 }
-                zcopy_used = zcopy && (len >= VHOST_GOODCOPY_LEN ||
-                                       nvq->upend_idx != nvq->done_idx);
+
+                zcopy_used = zcopy && len >= VHOST_GOODCOPY_LEN
+                                   && (nvq->upend_idx + 1) % UIO_MAXIOV !=
+                                      nvq->done_idx
+                                   && vhost_net_tx_select_zcopy(net);
 
                 /* use msg_control to pass vhost zerocopy ubuf info to skb */
                 if (zcopy_used) {
+                        struct ubuf_info *ubuf;
+                        ubuf = nvq->ubuf_info + nvq->upend_idx;
+
                         vq->heads[nvq->upend_idx].id = head;
-                        if (!vhost_net_tx_select_zcopy(net) ||
-                            len < VHOST_GOODCOPY_LEN) {
-                                /* copy don't need to wait for DMA done */
-                                vq->heads[nvq->upend_idx].len =
-                                                        VHOST_DMA_DONE_LEN;
-                                msg.msg_control = NULL;
-                                msg.msg_controllen = 0;
-                                ubufs = NULL;
-                        } else {
-                                struct ubuf_info *ubuf;
-                                ubuf = nvq->ubuf_info + nvq->upend_idx;
-
-                                vq->heads[nvq->upend_idx].len =
-                                        VHOST_DMA_IN_PROGRESS;
-                                ubuf->callback = vhost_zerocopy_callback;
-                                ubuf->ctx = nvq->ubufs;
-                                ubuf->desc = nvq->upend_idx;
-                                msg.msg_control = ubuf;
-                                msg.msg_controllen = sizeof(ubuf);
-                                ubufs = nvq->ubufs;
-                                kref_get(&ubufs->kref);
-                        }
+                        vq->heads[nvq->upend_idx].len = VHOST_DMA_IN_PROGRESS;
+                        ubuf->callback = vhost_zerocopy_callback;
+                        ubuf->ctx = nvq->ubufs;
+                        ubuf->desc = nvq->upend_idx;
+                        msg.msg_control = ubuf;
+                        msg.msg_controllen = sizeof(ubuf);
+                        ubufs = nvq->ubufs;
+                        kref_get(&ubufs->kref);
                         nvq->upend_idx = (nvq->upend_idx + 1) % UIO_MAXIOV;
-                } else
+                } else {
                         msg.msg_control = NULL;
+                        ubufs = NULL;
+                }
                 /* TODO: Check specific error and bomb out unless ENOBUFS? */
                 err = sock->ops->sendmsg(NULL, sock, &msg, len);
                 if (unlikely(err < 0)) {
                         if (zcopy_used) {
-                                if (ubufs)
-                                        vhost_net_ubuf_put(ubufs);
+                                vhost_net_ubuf_put(ubufs);
                                 nvq->upend_idx = ((unsigned)nvq->upend_idx - 1)
                                         % UIO_MAXIOV;
                         }
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 448efe01f18a..9a9502a4aa50 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1332,48 +1332,9 @@ EXPORT_SYMBOL_GPL(vhost_discard_vq_desc);
  * want to notify the guest, using eventfd. */
 int vhost_add_used(struct vhost_virtqueue *vq, unsigned int head, int len)
 {
-        struct vring_used_elem __user *used;
+        struct vring_used_elem heads = { head, len };
 
-        /* The virtqueue contains a ring of used buffers.  Get a pointer to the
-         * next entry in that used ring. */
-        used = &vq->used->ring[vq->last_used_idx % vq->num];
-        if (__put_user(head, &used->id)) {
-                vq_err(vq, "Failed to write used id");
-                return -EFAULT;
-        }
-        if (__put_user(len, &used->len)) {
-                vq_err(vq, "Failed to write used len");
-                return -EFAULT;
-        }
-        /* Make sure buffer is written before we update index. */
-        smp_wmb();
-        if (__put_user(vq->last_used_idx + 1, &vq->used->idx)) {
-                vq_err(vq, "Failed to increment used idx");
-                return -EFAULT;
-        }
-        if (unlikely(vq->log_used)) {
-                /* Make sure data is seen before log. */
-                smp_wmb();
-                /* Log used ring entry write. */
-                log_write(vq->log_base,
-                          vq->log_addr +
-                           ((void __user *)used - (void __user *)vq->used),
-                          sizeof *used);
-                /* Log used index update. */
-                log_write(vq->log_base,
-                          vq->log_addr + offsetof(struct vring_used, idx),
-                          sizeof vq->used->idx);
-                if (vq->log_ctx)
-                        eventfd_signal(vq->log_ctx, 1);
-        }
-        vq->last_used_idx++;
-        /* If the driver never bothers to signal in a very long while,
-         * used index might wrap around. If that happens, invalidate
-         * signalled_used index we stored. TODO: make sure driver
-         * signals at least once in 2^16 and remove this. */
-        if (unlikely(vq->last_used_idx == vq->signalled_used))
-                vq->signalled_used_valid = false;
-        return 0;
+        return vhost_add_used_n(vq, &heads, 1);
 }
 EXPORT_SYMBOL_GPL(vhost_add_used);
 
@@ -1387,7 +1348,16 @@ static int __vhost_add_used_n(struct vhost_virtqueue *vq,
 
         start = vq->last_used_idx % vq->num;
         used = vq->used->ring + start;
-        if (__copy_to_user(used, heads, count * sizeof *used)) {
+        if (count == 1) {
+                if (__put_user(heads[0].id, &used->id)) {
+                        vq_err(vq, "Failed to write used id");
+                        return -EFAULT;
+                }
+                if (__put_user(heads[0].len, &used->len)) {
+                        vq_err(vq, "Failed to write used len");
+                        return -EFAULT;
+                }
+        } else if (__copy_to_user(used, heads, count * sizeof *used)) {
                 vq_err(vq, "Failed to write used");
                 return -EFAULT;
         }
diff --git a/include/linux/bcma/bcma_driver_pci.h b/include/linux/bcma/bcma_driver_pci.h
index 424760f01b9d..d66033f418c9 100644
--- a/include/linux/bcma/bcma_driver_pci.h
+++ b/include/linux/bcma/bcma_driver_pci.h
@@ -181,10 +181,31 @@ struct pci_dev;
 
 #define BCMA_CORE_PCI_CFG_DEVCTRL               0xd8
 
+#define BCMA_CORE_PCI_
+
+/* MDIO devices (SERDES modules) */
+#define BCMA_CORE_PCI_MDIO_IEEE0                0x000
+#define BCMA_CORE_PCI_MDIO_IEEE1                0x001
+#define BCMA_CORE_PCI_MDIO_BLK0                 0x800
+#define BCMA_CORE_PCI_MDIO_BLK1                 0x801
+#define  BCMA_CORE_PCI_MDIO_BLK1_MGMT0          0x16
+#define  BCMA_CORE_PCI_MDIO_BLK1_MGMT1          0x17
+#define  BCMA_CORE_PCI_MDIO_BLK1_MGMT2          0x18
+#define  BCMA_CORE_PCI_MDIO_BLK1_MGMT3          0x19
+#define  BCMA_CORE_PCI_MDIO_BLK1_MGMT4          0x1A
+#define BCMA_CORE_PCI_MDIO_BLK2                 0x802
+#define BCMA_CORE_PCI_MDIO_BLK3                 0x803
+#define BCMA_CORE_PCI_MDIO_BLK4                 0x804
+#define BCMA_CORE_PCI_MDIO_TXPLL                0x808   /* TXPLL register block idx */
+#define BCMA_CORE_PCI_MDIO_TXCTRL0              0x820
+#define BCMA_CORE_PCI_MDIO_SERDESID             0x831
+#define BCMA_CORE_PCI_MDIO_RXCTRL0              0x840
+
 /* PCIE Root Capability Register bits (Host mode only) */
 #define BCMA_CORE_PCI_RC_CRS_VISIBILITY         0x0001
 
 struct bcma_drv_pci;
+struct bcma_bus;
 
 #ifdef CONFIG_BCMA_DRIVER_PCI_HOSTMODE
 struct bcma_drv_pci_host {
@@ -219,7 +240,8 @@ struct bcma_drv_pci {
 extern void bcma_core_pci_init(struct bcma_drv_pci *pc);
 extern int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc,
                                  struct bcma_device *core, bool enable);
-extern void bcma_core_pci_extend_L1timer(struct bcma_drv_pci *pc, bool extend);
+extern void bcma_core_pci_up(struct bcma_bus *bus);
+extern void bcma_core_pci_down(struct bcma_bus *bus);
 
 extern int bcma_core_pci_pcibios_map_irq(const struct pci_dev *dev);
 extern int bcma_core_pci_plat_dev_init(struct pci_dev *dev);
diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
index c623861964e4..d8b512496e50 100644
--- a/include/linux/etherdevice.h
+++ b/include/linux/etherdevice.h
@@ -199,6 +199,21 @@ static inline void eth_hw_addr_random(struct net_device *dev)
 }
 
 /**
+ * eth_hw_addr_inherit - Copy dev_addr from another net_device
+ * @dst: pointer to net_device to copy dev_addr to
+ * @src: pointer to net_device to copy dev_addr from
+ *
+ * Copy the Ethernet address from one net_device to another along with
+ * the address attributes (addr_assign_type).
+ */
+static inline void eth_hw_addr_inherit(struct net_device *dst,
+                                       struct net_device *src)
+{
+        dst->addr_assign_type = src->addr_assign_type;
+        memcpy(dst->dev_addr, src->dev_addr, ETH_ALEN);
+}
+
+/**
  * compare_ether_addr - Compare two Ethernet addresses
  * @addr1: Pointer to a six-byte array containing the Ethernet address
  * @addr2: Pointer other six-byte array containing the Ethernet address
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 8def09e55f0c..a5b598a79bec 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -2289,4 +2289,8 @@ static inline bool ieee80211_check_tim(const struct ieee80211_tim_ie *tim,
         return !!(tim->virtual_map[index] & mask);
 }
 
+/* convert time units */
+#define TU_TO_JIFFIES(x)        (usecs_to_jiffies((x) * 1024))
+#define TU_TO_EXP_TIME(x)       (jiffies + TU_TO_JIFFIES(x))
+
 #endif /* LINUX_IEEE80211_H */
diff --git a/include/linux/platform_data/brcmfmac-sdio.h b/include/linux/platform_data/brcmfmac-sdio.h
index b7174998c24a..e75dcbf2b230 100644
--- a/include/linux/platform_data/brcmfmac-sdio.h
+++ b/include/linux/platform_data/brcmfmac-sdio.h
@@ -94,6 +94,10 @@ void __init brcmfmac_init_pdata(void)
  * Set this to true if the SDIO host controller has higher align requirement
  * than 32 bytes for each scatterlist item.
  *
+ * sd_head_align: alignment requirement for start of data buffer
+ *
+ * sd_sgentry_align: length alignment requirement for each sg entry
+ *
  * power_on: This function is called by the brcmfmac when the module gets
  * loaded. This can be particularly useful for low power devices. The platform
  * spcific routine may for example decide to power up the complete device.
@@ -121,6 +125,8 @@ struct brcmfmac_sdio_platform_data {
         unsigned int oob_irq_nr;
         unsigned long oob_irq_flags;
         bool broken_sg_support;
+        unsigned short sd_head_align;
+        unsigned short sd_sgentry_align;
         void (*power_on)(void);
         void (*power_off)(void);
         void (*reset)(void);
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 5ac96f31d546..2ddb48d9312c 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1905,8 +1905,8 @@ static inline struct sk_buff *netdev_alloc_skb_ip_align(struct net_device *dev,
         return __netdev_alloc_skb_ip_align(dev, length, GFP_ATOMIC);
 }
 
-/*
- *      __skb_alloc_page - allocate pages for ps-rx on a skb and preserve pfmemalloc data
+/**
+ *      __skb_alloc_pages - allocate pages for ps-rx on a skb and preserve pfmemalloc data
  *      @gfp_mask: alloc_pages_node mask. Set __GFP_NOMEMALLOC if not for network packet RX
  *      @skb: skb to set pfmemalloc on if __GFP_MEMALLOC is used
  *      @order: size of the allocation
@@ -2392,7 +2392,7 @@ extern void	       skb_split(struct sk_buff *skb,
                                  struct sk_buff *skb1, const u32 len);
 extern int             skb_shift(struct sk_buff *tgt, struct sk_buff *skb,
                                  int shiftlen);
-extern void            skb_scrub_packet(struct sk_buff *skb);
+extern void            skb_scrub_packet(struct sk_buff *skb, bool xnet);
 
 extern struct sk_buff *skb_segment(struct sk_buff *skb,
                                    netdev_features_t features);
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 10eb9b389014..10d43d8c7037 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -107,6 +107,14 @@ struct bt_power {
  */
 #define BT_CHANNEL_POLICY_AMP_PREFERRED         2
 
+#define BT_VOICE                11
+struct bt_voice {
+        __u16 setting;
+};
+
+#define BT_VOICE_TRANSPARENT                    0x0003
+#define BT_VOICE_CVSD_16BIT                     0x0060
+
 __printf(1, 2)
 int bt_info(const char *fmt, ...);
 __printf(1, 2)
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 3c592cf473da..aaeaf0938ec0 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -238,6 +238,7 @@ enum {
 #define LMP_CVSD        0x01
 #define LMP_PSCHEME     0x02
 #define LMP_PCONTROL    0x04
+#define LMP_TRANSPARENT 0x08
 
 #define LMP_RSSI_INQ    0x40
 #define LMP_ESCO        0x80
@@ -296,6 +297,12 @@ enum {
 #define HCI_AT_GENERAL_BONDING          0x04
 #define HCI_AT_GENERAL_BONDING_MITM     0x05
 
+/* I/O capabilities */
+#define HCI_IO_DISPLAY_ONLY     0x00
+#define HCI_IO_DISPLAY_YESNO    0x01
+#define HCI_IO_KEYBOARD_ONLY    0x02
+#define HCI_IO_NO_INPUT_OUTPUT  0x03
+
 /* Link Key types */
 #define HCI_LK_COMBINATION              0x00
 #define HCI_LK_LOCAL_UNIT               0x01
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index f77885ea78c2..3ede820d328f 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -320,6 +320,7 @@ struct hci_conn {
         __u32           passkey_notify;
         __u8            passkey_entered;
         __u16           disc_timeout;
+        __u16           setting;
         unsigned long   flags;
 
         __u8            remote_cap;
@@ -569,7 +570,7 @@ static inline struct hci_conn *hci_conn_hash_lookup_state(struct hci_dev *hdev,
 }
 
 void hci_disconnect(struct hci_conn *conn, __u8 reason);
-void hci_setup_sync(struct hci_conn *conn, __u16 handle);
+bool hci_setup_sync(struct hci_conn *conn, __u16 handle);
 void hci_sco_setup(struct hci_conn *conn, __u8 status);
 
 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst);
@@ -584,6 +585,8 @@ struct hci_chan *hci_chan_lookup_handle(struct hci_dev *hdev, __u16 handle);
 
 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
                              __u8 dst_type, __u8 sec_level, __u8 auth_type);
+struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
+                                 __u16 setting);
 int hci_conn_check_link_mode(struct hci_conn *conn);
 int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level);
 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type);
@@ -797,6 +800,7 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
 #define lmp_lsto_capable(dev)      ((dev)->features[0][7] & LMP_LSTO)
 #define lmp_inq_tx_pwr_capable(dev) ((dev)->features[0][7] & LMP_INQ_TX_PWR)
 #define lmp_ext_feat_capable(dev)  ((dev)->features[0][7] & LMP_EXTFEATURES)
+#define lmp_transp_capable(dev)    ((dev)->features[0][2] & LMP_TRANSPARENT)
 
 /* ----- Extended LMP capabilities ----- */
 #define lmp_host_ssp_capable(dev)  ((dev)->features[1][0] & LMP_HOST_SSP)
@@ -1213,4 +1217,8 @@ void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
 
 u8 bdaddr_to_le(u8 bdaddr_type);
 
+#define SCO_AIRMODE_MASK       0x0003
+#define SCO_AIRMODE_CVSD       0x0000
+#define SCO_AIRMODE_TRANSP     0x0003
+
 #endif /* __HCI_CORE_H */
diff --git a/include/net/bluetooth/sco.h b/include/net/bluetooth/sco.h
index 1e35c43657c8..e252a31ee6b6 100644
--- a/include/net/bluetooth/sco.h
+++ b/include/net/bluetooth/sco.h
@@ -73,6 +73,7 @@ struct sco_conn {
 struct sco_pinfo {
         struct bt_sock  bt;
         __u32           flags;
+        __u16           setting;
         struct sco_conn *conn;
 };
 
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 635e396b25b2..cb710913d5c8 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -2081,7 +2081,7 @@ struct cfg80211_update_ft_ies_params {
  * @mgmt_tx_cancel_wait: Cancel the wait time from transmitting a management
  *      frame on another channel
  *
- * @testmode_cmd: run a test mode command
+ * @testmode_cmd: run a test mode command; @wdev may be %NULL
  * @testmode_dump: Implement a test mode dump. The cb->args[2] and up may be
  *      used by the function, but 0 and 1 must not be touched. Additionally,
  *      return error codes other than -ENOBUFS and -ENOENT will terminate the
@@ -2290,7 +2290,8 @@ struct cfg80211_ops {
         void    (*rfkill_poll)(struct wiphy *wiphy);
 
 #ifdef CONFIG_NL80211_TESTMODE
-        int     (*testmode_cmd)(struct wiphy *wiphy, void *data, int len);
+        int     (*testmode_cmd)(struct wiphy *wiphy, struct wireless_dev *wdev,
+                                void *data, int len);
         int     (*testmode_dump)(struct wiphy *wiphy, struct sk_buff *skb,
                                  struct netlink_callback *cb,
                                  void *data, int len);
@@ -4055,6 +4056,7 @@ void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
  * @sig_dbm: signal strength in mBm, or 0 if unknown
  * @buf: Management frame (header + body)
  * @len: length of the frame data
+ * @flags: flags, as defined in enum nl80211_rxmgmt_flags
  * @gfp: context flags
  *
  * This function is called whenever an Action frame is received for a station
@@ -4066,7 +4068,7 @@ void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
  * driver is responsible for rejecting the frame.
  */
 bool cfg80211_rx_mgmt(struct wireless_dev *wdev, int freq, int sig_dbm,
-                      const u8 *buf, size_t len, gfp_t gfp);
+                      const u8 *buf, size_t len, u32 flags, gfp_t gfp);
 
 /**
  * cfg80211_mgmt_tx_status - notification of TX status for management frame
diff --git a/include/net/dst.h b/include/net/dst.h
index 1f8fd109e225..3bc4865f8267 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -311,11 +311,13 @@ static inline void skb_dst_force(struct sk_buff *skb)
  *      __skb_tunnel_rx - prepare skb for rx reinsert
  *      @skb: buffer
  *      @dev: tunnel device
+ *      @net: netns for packet i/o
  *
  *      After decapsulation, packet is going to re-enter (netif_rx()) our stack,
  *      so make some cleanups. (no accounting done)
  */
-static inline void __skb_tunnel_rx(struct sk_buff *skb, struct net_device *dev)
+static inline void __skb_tunnel_rx(struct sk_buff *skb, struct net_device *dev,
+                                   struct net *net)
 {
         skb->dev = dev;
 
@@ -327,8 +329,7 @@ static inline void __skb_tunnel_rx(struct sk_buff *skb, struct net_device *dev)
         if (!skb->l4_rxhash)
                 skb->rxhash = 0;
         skb_set_queue_mapping(skb, 0);
-        skb_dst_drop(skb);
-        nf_reset(skb);
+        skb_scrub_packet(skb, !net_eq(net, dev_net(dev)));
 }
 
 /**
@@ -340,12 +341,13 @@ static inline void __skb_tunnel_rx(struct sk_buff *skb, struct net_device *dev)
  *      so make some cleanups, and perform accounting.
  *      Note: this accounting is not SMP safe.
  */
-static inline void skb_tunnel_rx(struct sk_buff *skb, struct net_device *dev)
+static inline void skb_tunnel_rx(struct sk_buff *skb, struct net_device *dev,
+                                 struct net *net)
 {
         /* TODO : stats should be SMP safe */
         dev->stats.rx_packets++;
         dev->stats.rx_bytes += skb->len;
-        __skb_tunnel_rx(skb, dev);
+        __skb_tunnel_rx(skb, dev, net);
 }
 
 /* Children define the path of the packet through the
diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h
index 2265b0bf97e5..6d1549c4893c 100644
--- a/include/net/ip6_tunnel.h
+++ b/include/net/ip6_tunnel.h
@@ -75,7 +75,6 @@ static inline void ip6tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         struct net_device_stats *stats = &dev->stats;
         int pkt_len, err;
 
-        nf_reset(skb);
         pkt_len = skb->len;
         err = ip6_local_out(skb);
 
diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
index 0ce316bb3c65..a0a4a100f5c9 100644
--- a/include/net/ip_tunnels.h
+++ b/include/net/ip_tunnels.h
@@ -146,10 +146,9 @@ static inline u8 ip_tunnel_ecn_encap(u8 tos, const struct iphdr *iph,
 }
 
 int iptunnel_pull_header(struct sk_buff *skb, int hdr_len, __be16 inner_proto);
-int iptunnel_xmit(struct net *net, struct rtable *rt,
-                  struct sk_buff *skb,
+int iptunnel_xmit(struct rtable *rt, struct sk_buff *skb,
                   __be32 src, __be32 dst, __u8 proto,
-                  __u8 tos, __u8 ttl, __be16 df);
+                  __u8 tos, __u8 ttl, __be16 df, bool xnet);
 
 static inline void iptunnel_xmit_stats(int err,
                                        struct net_device_stats *err_stats,
diff --git a/include/net/llc_if.h b/include/net/llc_if.h
index b595a004d31b..f0cb909b60eb 100644
--- a/include/net/llc_if.h
+++ b/include/net/llc_if.h
@@ -62,36 +62,6 @@
 #define LLC_STATUS_CONFLICT     7 /* disconnect conn */
 #define LLC_STATUS_RESET_DONE   8 /*  */
 
-/**
- *      llc_mac_null - determines if a address is a null mac address
- *      @mac: Mac address to test if null.
- *
- *      Determines if a given address is a null mac address.  Returns 0 if the
- *      address is not a null mac, 1 if the address is a null mac.
- */
-static inline int llc_mac_null(const u8 *mac)
-{
-        return is_zero_ether_addr(mac);
-}
-
-static inline int llc_mac_multicast(const u8 *mac)
-{
-        return is_multicast_ether_addr(mac);
-}
-/**
- *      llc_mac_match - determines if two mac addresses are the same
- *      @mac1: First mac address to compare.
- *      @mac2: Second mac address to compare.
- *
- *      Determines if two given mac address are the same.  Returns 0 if there
- *      is not a complete match up to len, 1 if a complete match up to len is
- *      found.
- */
-static inline int llc_mac_match(const u8 *mac1, const u8 *mac2)
-{
-        return !compare_ether_addr(mac1, mac2);
-}
-
 extern int llc_establish_connection(struct sock *sk, u8 *lmac,
                                     u8 *dmac, u8 dsap);
 extern int llc_build_and_send_pkt(struct sock *sk, struct sk_buff *skb);
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index ab94dbc331a0..cc6035f1a2f1 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -375,7 +375,7 @@ struct ieee80211_bss_conf {
 };
 
 /**
- * enum mac80211_tx_control_flags - flags to describe transmission information/status
+ * enum mac80211_tx_info_flags - flags to describe transmission information/status
  *
  * These flags are used with the @flags member of &ieee80211_tx_info.
  *
@@ -471,7 +471,7 @@ struct ieee80211_bss_conf {
  * Note: If you have to add new flags to the enumeration, then don't
  *       forget to update %IEEE80211_TX_TEMPORARY_FLAGS when necessary.
  */
-enum mac80211_tx_control_flags {
+enum mac80211_tx_info_flags {
         IEEE80211_TX_CTL_REQ_TX_STATUS          = BIT(0),
         IEEE80211_TX_CTL_ASSIGN_SEQ             = BIT(1),
         IEEE80211_TX_CTL_NO_ACK                 = BIT(2),
@@ -507,6 +507,18 @@ enum mac80211_tx_control_flags {
 
 #define IEEE80211_TX_CTL_STBC_SHIFT             23
 
+/**
+ * enum mac80211_tx_control_flags - flags to describe transmit control
+ *
+ * @IEEE80211_TX_CTRL_PORT_CTRL_PROTO: this frame is a port control
+ *      protocol frame (e.g. EAP)
+ *
+ * These flags are used in tx_info->control.flags.
+ */
+enum mac80211_tx_control_flags {
+        IEEE80211_TX_CTRL_PORT_CTRL_PROTO       = BIT(0),
+};
+
 /*
  * This definition is used as a mask to clear all temporary flags, which are
  * set by the tx handlers for each transmission attempt by the mac80211 stack.
@@ -680,7 +692,8 @@ struct ieee80211_tx_info {
                         /* NB: vif can be NULL for injected frames */
                         struct ieee80211_vif *vif;
                         struct ieee80211_key_conf *hw_key;
-                        /* 8 bytes free */
+                        u32 flags;
+                        /* 4 bytes free */
                 } control;
                 struct {
                         struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES];
@@ -1508,6 +1521,7 @@ enum ieee80211_hw_flags {
         IEEE80211_HW_SUPPORTS_RC_TABLE                  = 1<<24,
         IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF              = 1<<25,
         IEEE80211_HW_TIMING_BEACON_ONLY                 = 1<<26,
+        IEEE80211_HW_SUPPORTS_HT_CCK_RATES              = 1<<27,
 };
 
 /**
@@ -2503,8 +2517,8 @@ enum ieee80211_roc_type {
  *      in IEEE 802.11-2007 section 17.3.8.6 and modify ACK timeout
  *      accordingly. This callback is not required and may sleep.
  *
- * @testmode_cmd: Implement a cfg80211 test mode command.
- *      The callback can sleep.
+ * @testmode_cmd: Implement a cfg80211 test mode command. The passed @vif may
+ *      be %NULL. The callback can sleep.
  * @testmode_dump: Implement a cfg80211 test mode dump. The callback can sleep.
  *
  * @flush: Flush all pending frames from the hardware queue, making sure
@@ -2765,7 +2779,8 @@ struct ieee80211_ops {
         void (*rfkill_poll)(struct ieee80211_hw *hw);
         void (*set_coverage_class)(struct ieee80211_hw *hw, u8 coverage_class);
 #ifdef CONFIG_NL80211_TESTMODE
-        int (*testmode_cmd)(struct ieee80211_hw *hw, void *data, int len);
+        int (*testmode_cmd)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                            void *data, int len);
         int (*testmode_dump)(struct ieee80211_hw *hw, struct sk_buff *skb,
                              struct netlink_callback *cb,
                              void *data, int len);
@@ -3674,6 +3689,89 @@ void ieee80211_get_key_rx_seq(struct ieee80211_key_conf *keyconf,
                               int tid, struct ieee80211_key_seq *seq);
 
 /**
+ * ieee80211_set_key_tx_seq - set key TX sequence counter
+ *
+ * @keyconf: the parameter passed with the set key
+ * @seq: new sequence data
+ *
+ * This function allows a driver to set the current TX IV/PNs for the
+ * given key. This is useful when resuming from WoWLAN sleep and the
+ * device may have transmitted frames using the PTK, e.g. replies to
+ * ARP requests.
+ *
+ * Note that this function may only be called when no TX processing
+ * can be done concurrently.
+ */
+void ieee80211_set_key_tx_seq(struct ieee80211_key_conf *keyconf,
+                              struct ieee80211_key_seq *seq);
+
+/**
+ * ieee80211_set_key_rx_seq - set key RX sequence counter
+ *
+ * @keyconf: the parameter passed with the set key
+ * @tid: The TID, or -1 for the management frame value (CCMP only);
+ *      the value on TID 0 is also used for non-QoS frames. For
+ *      CMAC, only TID 0 is valid.
+ * @seq: new sequence data
+ *
+ * This function allows a driver to set the current RX IV/PNs for the
+ * given key. This is useful when resuming from WoWLAN sleep and GTK
+ * rekey may have been done while suspended. It should not be called
+ * if IV checking is done by the device and not by mac80211.
+ *
+ * Note that this function may only be called when no RX processing
+ * can be done concurrently.
+ */
+void ieee80211_set_key_rx_seq(struct ieee80211_key_conf *keyconf,
+                              int tid, struct ieee80211_key_seq *seq);
+
+/**
+ * ieee80211_remove_key - remove the given key
+ * @keyconf: the parameter passed with the set key
+ *
+ * Remove the given key. If the key was uploaded to the hardware at the
+ * time this function is called, it is not deleted in the hardware but
+ * instead assumed to have been removed already.
+ *
+ * Note that due to locking considerations this function can (currently)
+ * only be called during key iteration (ieee80211_iter_keys().)
+ */
+void ieee80211_remove_key(struct ieee80211_key_conf *keyconf);
+
+/**
+ * ieee80211_gtk_rekey_add - add a GTK key from rekeying during WoWLAN
+ * @vif: the virtual interface to add the key on
+ * @keyconf: new key data
+ *
+ * When GTK rekeying was done while the system was suspended, (a) new
+ * key(s) will be available. These will be needed by mac80211 for proper
+ * RX processing, so this function allows setting them.
+ *
+ * The function returns the newly allocated key structure, which will
+ * have similar contents to the passed key configuration but point to
+ * mac80211-owned memory. In case of errors, the function returns an
+ * ERR_PTR(), use IS_ERR() etc.
+ *
+ * Note that this function assumes the key isn't added to hardware
+ * acceleration, so no TX will be done with the key. Since it's a GTK
+ * on managed (station) networks, this is true anyway. If the driver
+ * calls this function from the resume callback and subsequently uses
+ * the return code 1 to reconfigure the device, this key will be part
+ * of the reconfiguration.
+ *
+ * Note that the driver should also call ieee80211_set_key_rx_seq()
+ * for the new key for each TID to set up sequence counters properly.
+ *
+ * IMPORTANT: If this replaces a key that is present in the hardware,
+ * then it will attempt to remove it during this call. In many cases
+ * this isn't what you want, so call ieee80211_remove_key() first for
+ * the key that's being replaced.
+ */
+struct ieee80211_key_conf *
+ieee80211_gtk_rekey_add(struct ieee80211_vif *vif,
+                        struct ieee80211_key_conf *keyconf);
+
+/**
  * ieee80211_gtk_rekey_notify - notify userspace supplicant of rekeying
  * @vif: virtual interface the rekeying was done on
  * @bssid: The BSSID of the AP, for checking association
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index 5f286b726bb6..f68ee68e4e3e 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -224,6 +224,9 @@ int nfc_set_remote_general_bytes(struct nfc_dev *dev,
                                  u8 *gt, u8 gt_len);
 u8 *nfc_get_local_general_bytes(struct nfc_dev *dev, size_t *gb_len);
 
+int nfc_fw_download_done(struct nfc_dev *dev, const char *firmware_name,
+                         u32 result);
+
 int nfc_targets_found(struct nfc_dev *dev,
                       struct nfc_target *targets, int ntargets);
 int nfc_target_lost(struct nfc_dev *dev, u32 target_idx);
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 6a6a88db462d..b1aa324c5e65 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -371,8 +371,8 @@ extern void tcp_delack_timer_handler(struct sock *sk);
 extern int tcp_ioctl(struct sock *sk, int cmd, unsigned long arg);
 extern int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                                  const struct tcphdr *th, unsigned int len);
-extern int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
-                               const struct tcphdr *th, unsigned int len);
+extern void tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
+                                const struct tcphdr *th, unsigned int len);
 extern void tcp_rcv_space_adjust(struct sock *sk);
 extern void tcp_cleanup_rbuf(struct sock *sk, int copied);
 extern int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp);
diff --git a/include/net/vxlan.h b/include/net/vxlan.h
index d2b88cafa7a2..e09c40b68027 100644
--- a/include/net/vxlan.h
+++ b/include/net/vxlan.h
@@ -29,7 +29,7 @@ struct vxlan_sock *vxlan_sock_add(struct net *net, __be16 port,
 
 void vxlan_sock_release(struct vxlan_sock *vs);
 
-int vxlan_xmit_skb(struct net *net, struct vxlan_sock *vs,
+int vxlan_xmit_skb(struct vxlan_sock *vs,
                    struct rtable *rt, struct sk_buff *skb,
                    __be32 src, __be32 dst, __u8 tos, __u8 ttl, __be16 df,
                    __be16 src_port, __be16 dst_port, __be32 vni);
diff --git a/include/uapi/linux/can/gw.h b/include/uapi/linux/can/gw.h
index ae07bec74f4b..4e27c82b564a 100644
--- a/include/uapi/linux/can/gw.h
+++ b/include/uapi/linux/can/gw.h
@@ -45,6 +45,7 @@ enum {
         CGW_DST_IF,     /* ifindex of destination network interface */
         CGW_FILTER,     /* specify struct can_filter on source CAN device */
         CGW_DELETED,    /* number of deleted CAN frames (see max_hops param) */
+        CGW_LIM_HOPS,   /* limit the number of hops of this specific rule */
         __CGW_MAX
 };
 
@@ -116,13 +117,19 @@ enum {
  * Sets a CAN receive filter for the gateway job specified by the
  * struct can_filter described in include/linux/can.h
  *
- * CGW_MOD_XXX (length 17 bytes):
+ * CGW_MOD_(AND|OR|XOR|SET) (length 17 bytes):
  * Specifies a modification that's done to a received CAN frame before it is
  * send out to the destination interface.
  *
  * <struct can_frame> data used as operator
  * <u8> affected CAN frame elements
  *
+ * CGW_LIM_HOPS (length 1 byte):
+ * Limit the number of hops of this specific rule. Usually the received CAN
+ * frame can be processed as much as 'max_hops' times (which is given at module
+ * load time of the can-gw module). This value is used to reduce the number of
+ * possible hops for this gateway rule to a value smaller then max_hops.
+ *
  * CGW_CS_XOR (length 4 bytes):
  * Set a simple XOR checksum starting with an initial value into
  * data[result-idx] using data[start-idx] .. data[end-idx]
diff --git a/include/uapi/linux/nfc.h b/include/uapi/linux/nfc.h
index 8137dd8d2adf..29bed72a4ac4 100644
--- a/include/uapi/linux/nfc.h
+++ b/include/uapi/linux/nfc.h
@@ -71,6 +71,20 @@
  * @NFC_CMD_DISABLE_SE: Disable the physical link to a specific secure element.
  * @NFC_CMD_FW_DOWNLOAD: Request to Load/flash firmware, or event to inform
  *      that some firmware was loaded
+ * @NFC_EVENT_SE_ADDED: Event emitted when a new secure element is discovered.
+ *      This typically will be sent whenever a new NFC controller with either
+ *      an embedded SE or an UICC one connected to it through SWP.
+ * @NFC_EVENT_SE_REMOVED: Event emitted when a secure element is removed from
+ *      the system, as a consequence of e.g. an NFC controller being unplugged.
+ * @NFC_EVENT_SE_CONNECTIVITY: This event is emitted whenever a secure element
+ *      is requesting connectivity access. For example a UICC SE may need to
+ *      talk with a sleeping modem and will notify this need by sending this
+ *      event. It is then up to userspace to decide if it will wake the modem
+ *      up or not.
+ * @NFC_EVENT_SE_TRANSACTION: This event is sent when an application running on
+ *      a specific SE notifies us about the end of a transaction. The parameter
+ *      for this event is the application ID (AID).
+ * @NFC_CMD_GET_SE: Dump all discovered secure elements from an NFC controller.
  */
 enum nfc_commands {
         NFC_CMD_UNSPEC,
@@ -97,6 +111,9 @@ enum nfc_commands {
         NFC_CMD_FW_DOWNLOAD,
         NFC_EVENT_SE_ADDED,
         NFC_EVENT_SE_REMOVED,
+        NFC_EVENT_SE_CONNECTIVITY,
+        NFC_EVENT_SE_TRANSACTION,
+        NFC_CMD_GET_SE,
 /* private: internal use only */
         __NFC_CMD_AFTER_LAST
 };
@@ -129,6 +146,7 @@ enum nfc_commands {
  * @NFC_ATTR_FIRMWARE_NAME: Free format firmware version
  * @NFC_ATTR_SE_INDEX: Secure element index
  * @NFC_ATTR_SE_TYPE: Secure element type (UICC or EMBEDDED)
+ * @NFC_ATTR_FIRMWARE_DOWNLOAD_STATUS: Firmware download operation status
  */
 enum nfc_attrs {
         NFC_ATTR_UNSPEC,
@@ -154,6 +172,8 @@ enum nfc_attrs {
         NFC_ATTR_FIRMWARE_NAME,
         NFC_ATTR_SE_INDEX,
         NFC_ATTR_SE_TYPE,
+        NFC_ATTR_SE_AID,
+        NFC_ATTR_FIRMWARE_DOWNLOAD_STATUS,
 /* private: internal use only */
         __NFC_ATTR_AFTER_LAST
 };
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 1f42bc3dcb9c..fde2c021b26d 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -1493,6 +1493,9 @@ enum nl80211_commands {
  * @NL80211_ATTR_CSA_C_OFF_PRESP: Offset of the channel switch counter
  *      field in the probe response (%NL80211_ATTR_PROBE_RESP).
  *
+ * @NL80211_ATTR_RXMGMT_FLAGS: flags for nl80211_send_mgmt(), u32.
+ *      As specified in the &enum nl80211_rxmgmt_flags.
+ *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -1801,6 +1804,8 @@ enum nl80211_attrs {
         NL80211_ATTR_CSA_C_OFF_BEACON,
         NL80211_ATTR_CSA_C_OFF_PRESP,
 
+        NL80211_ATTR_RXMGMT_FLAGS,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -3901,4 +3906,15 @@ enum nl80211_crit_proto_id {
 /* maximum duration for critical protocol measures */
 #define NL80211_CRIT_PROTO_MAX_DURATION         5000 /* msec */
 
+/**
+ * enum nl80211_rxmgmt_flags - flags for received management frame.
+ *
+ * Used by cfg80211_rx_mgmt()
+ *
+ * @NL80211_RXMGMT_FLAG_ANSWERED: frame was answered by device/driver.
+ */
+enum nl80211_rxmgmt_flags {
+        NL80211_RXMGMT_FLAG_ANSWERED = 1 << 0,
+};
+
 #endif /* __LINUX_NL80211_H */
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 9ab8a7ed99c0..09bf1c38805b 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -582,7 +582,7 @@ static int vlan_dev_init(struct net_device *dev)
         dev->dev_id = real_dev->dev_id;
 
         if (is_zero_ether_addr(dev->dev_addr))
-                memcpy(dev->dev_addr, real_dev->dev_addr, dev->addr_len);
+                eth_hw_addr_inherit(dev, real_dev);
         if (is_zero_ether_addr(dev->broadcast))
                 memcpy(dev->broadcast, real_dev->broadcast, dev->addr_len);
 
diff --git a/net/batman-adv/main.h b/net/batman-adv/main.h
index 5d00f23b4621..24675523930f 100644
--- a/net/batman-adv/main.h
+++ b/net/batman-adv/main.h
@@ -254,7 +254,7 @@ static inline void batadv_dbg(int type __always_unused,
 
 /* returns 1 if they are the same ethernet addr
  *
- * note: can't use compare_ether_addr() as it requires aligned memory
+ * note: can't use ether_addr_equal() as it requires aligned memory
  */
 static inline int batadv_compare_eth(const void *data1, const void *data2)
 {
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 6c7f36379722..f0817121ec5e 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -31,6 +31,24 @@
 #include <net/bluetooth/a2mp.h>
 #include <net/bluetooth/smp.h>
 
+struct sco_param {
+        u16 pkt_type;
+        u16 max_latency;
+};
+
+static const struct sco_param sco_param_cvsd[] = {
+        { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a }, /* S3 */
+        { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007 }, /* S2 */
+        { EDR_ESCO_MASK | ESCO_EV3,   0x0007 }, /* S1 */
+        { EDR_ESCO_MASK | ESCO_HV3,   0xffff }, /* D1 */
+        { EDR_ESCO_MASK | ESCO_HV1,   0xffff }, /* D0 */
+};
+
+static const struct sco_param sco_param_wideband[] = {
+        { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d }, /* T2 */
+        { EDR_ESCO_MASK | ESCO_EV3,   0x0008 }, /* T1 */
+};
+
 static void hci_le_create_connection(struct hci_conn *conn)
 {
         struct hci_dev *hdev = conn->hdev;
@@ -172,10 +190,11 @@ static void hci_add_sco(struct hci_conn *conn, __u16 handle)
         hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
 }
 
-void hci_setup_sync(struct hci_conn *conn, __u16 handle)
+bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 {
         struct hci_dev *hdev = conn->hdev;
         struct hci_cp_setup_sync_conn cp;
+        const struct sco_param *param;
 
         BT_DBG("hcon %p", conn);
 
@@ -185,15 +204,35 @@ void hci_setup_sync(struct hci_conn *conn, __u16 handle)
         conn->attempt++;
 
         cp.handle   = cpu_to_le16(handle);
-        cp.pkt_type = cpu_to_le16(conn->pkt_type);
 
         cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
         cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
-        cp.max_latency    = __constant_cpu_to_le16(0xffff);
-        cp.voice_setting  = cpu_to_le16(hdev->voice_setting);
-        cp.retrans_effort = 0xff;
+        cp.voice_setting  = cpu_to_le16(conn->setting);
+
+        switch (conn->setting & SCO_AIRMODE_MASK) {
+        case SCO_AIRMODE_TRANSP:
+                if (conn->attempt > ARRAY_SIZE(sco_param_wideband))
+                        return false;
+                cp.retrans_effort = 0x02;
+                param = &sco_param_wideband[conn->attempt - 1];
+                break;
+        case SCO_AIRMODE_CVSD:
+                if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
+                        return false;
+                cp.retrans_effort = 0x01;
+                param = &sco_param_cvsd[conn->attempt - 1];
+                break;
+        default:
+                return false;
+        }
 
-        hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
+        cp.pkt_type = __cpu_to_le16(param->pkt_type);
+        cp.max_latency = __cpu_to_le16(param->max_latency);
+
+        if (hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp) < 0)
+                return false;
+
+        return true;
 }
 
 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
@@ -560,13 +599,13 @@ static struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
         return acl;
 }
 
-static struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type,
-                                bdaddr_t *dst, u8 sec_level, u8 auth_type)
+struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
+                                 __u16 setting)
 {
         struct hci_conn *acl;
         struct hci_conn *sco;
 
-        acl = hci_connect_acl(hdev, dst, sec_level, auth_type);
+        acl = hci_connect_acl(hdev, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
         if (IS_ERR(acl))
                 return acl;
 
@@ -584,6 +623,8 @@ static struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type,
 
         hci_conn_hold(sco);
 
+        sco->setting = setting;
+
         if (acl->state == BT_CONNECTED &&
             (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
@@ -612,9 +653,6 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
                 return hci_connect_le(hdev, dst, dst_type, sec_level, auth_type);
         case ACL_LINK:
                 return hci_connect_acl(hdev, dst, sec_level, auth_type);
-        case SCO_LINK:
-        case ESCO_LINK:
-                return hci_connect_sco(hdev, type, dst, sec_level, auth_type);
         }
 
         return ERR_PTR(-EINVAL);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index cc27297da5a9..634debab4d54 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -454,6 +454,18 @@ static void hci_setup_event_mask(struct hci_request *req)
                 events[4] |= 0x04; /* Read Remote Extended Features Complete */
                 events[5] |= 0x08; /* Synchronous Connection Complete */
                 events[5] |= 0x10; /* Synchronous Connection Changed */
+        } else {
+                /* Use a different default for LE-only devices */
+                memset(events, 0, sizeof(events));
+                events[0] |= 0x10; /* Disconnection Complete */
+                events[0] |= 0x80; /* Encryption Change */
+                events[1] |= 0x08; /* Read Remote Version Information Complete */
+                events[1] |= 0x20; /* Command Complete */
+                events[1] |= 0x40; /* Command Status */
+                events[1] |= 0x80; /* Hardware Error */
+                events[2] |= 0x04; /* Number of Completed Packets */
+                events[3] |= 0x02; /* Data Buffer Overflow */
+                events[5] |= 0x80; /* Encryption Key Refresh Complete */
         }
 
         if (lmp_inq_rssi_capable(hdev))
@@ -608,7 +620,7 @@ static void hci_init3_req(struct hci_request *req, unsigned long opt)
          * as supported send it. If not supported assume that the controller
          * does not have actual support for stored link keys which makes this
          * command redundant anyway.
-         */
+         */
         if (hdev->commands[6] & 0x80) {
                 struct hci_cp_delete_stored_link_key cp;
 
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 0437200d92f4..94aab73f89d4 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -2904,15 +2904,16 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
                 hci_conn_add_sysfs(conn);
                 break;
 
+        case 0x0d:      /* Connection Rejected due to Limited Resources */
         case 0x11:      /* Unsupported Feature or Parameter Value */
         case 0x1c:      /* SCO interval rejected */
         case 0x1a:      /* Unsupported Remote Feature */
         case 0x1f:      /* Unspecified error */
-                if (conn->out && conn->attempt < 2) {
+                if (conn->out) {
                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
                                         (hdev->esco_type & EDR_ESCO_MASK);
-                        hci_setup_sync(conn, conn->link->handle);
-                        goto unlock;
+                        if (hci_setup_sync(conn, conn->link->handle))
+                                goto unlock;
                 }
                 /* fall through */
 
@@ -3024,17 +3025,20 @@ unlock:
 static u8 hci_get_auth_req(struct hci_conn *conn)
 {
         /* If remote requests dedicated bonding follow that lead */
-        if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) {
+        if (conn->remote_auth == HCI_AT_DEDICATED_BONDING ||
+            conn->remote_auth == HCI_AT_DEDICATED_BONDING_MITM) {
                 /* If both remote and local IO capabilities allow MITM
                  * protection then require it, otherwise don't */
-                if (conn->remote_cap == 0x03 || conn->io_capability == 0x03)
-                        return 0x02;
+                if (conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT ||
+                    conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)
+                        return HCI_AT_DEDICATED_BONDING;
                 else
-                        return 0x03;
+                        return HCI_AT_DEDICATED_BONDING_MITM;
         }
 
         /* If remote requests no-bonding follow that lead */
-        if (conn->remote_auth == 0x00 || conn->remote_auth == 0x01)
+        if (conn->remote_auth == HCI_AT_NO_BONDING ||
+            conn->remote_auth == HCI_AT_NO_BONDING_MITM)
                 return conn->remote_auth | (conn->auth_type & 0x01);
 
         return conn->auth_type;
@@ -3066,7 +3070,7 @@ static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 /* Change the IO capability from KeyboardDisplay
                  * to DisplayYesNo as it is not supported by BT spec. */
                 cp.capability = (conn->io_capability == 0x04) ?
-                                                0x01 : conn->io_capability;
+                                HCI_IO_DISPLAY_YESNO : conn->io_capability;
                 conn->auth_type = hci_get_auth_req(conn);
                 cp.authentication = conn->auth_type;
 
@@ -3140,7 +3144,8 @@ static void hci_user_confirm_request_evt(struct hci_dev *hdev,
          * request. The only exception is when we're dedicated bonding
          * initiators (connect_cfm_cb set) since then we always have the MITM
          * bit set. */
-        if (!conn->connect_cfm_cb && loc_mitm && conn->remote_cap == 0x03) {
+        if (!conn->connect_cfm_cb && loc_mitm &&
+            conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
                 BT_DBG("Rejecting request: remote device can't provide MITM");
                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
                              sizeof(ev->bdaddr), &ev->bdaddr);
@@ -3148,8 +3153,8 @@ static void hci_user_confirm_request_evt(struct hci_dev *hdev,
         }
 
         /* If no side requires MITM protection; auto-accept */
-        if ((!loc_mitm || conn->remote_cap == 0x03) &&
-            (!rem_mitm || conn->io_capability == 0x03)) {
+        if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
+            (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
 
                 /* If we're not the initiators request authorization to
                  * proceed from user space (mgmt_user_confirm with
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 0c699cdc3696..13863de433a4 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -238,6 +238,31 @@ static int hidp_send_report(struct hidp_session *session, struct hid_report *rep
         return hidp_send_intr_message(session, hdr, buf, rsize);
 }
 
+static int hidp_hidinput_event(struct input_dev *dev, unsigned int type,
+                               unsigned int code, int value)
+{
+        struct hid_device *hid = input_get_drvdata(dev);
+        struct hidp_session *session = hid->driver_data;
+        struct hid_field *field;
+        int offset;
+
+        BT_DBG("session %p type %d code %d value %d",
+               session, type, code, value);
+
+        if (type != EV_LED)
+                return -1;
+
+        offset = hidinput_find_field(hid, type, code, &field);
+        if (offset == -1) {
+                hid_warn(dev, "event field not found\n");
+                return -1;
+        }
+
+        hid_set_field(field, offset, value);
+
+        return hidp_send_report(session, field->report);
+}
+
 static int hidp_get_raw_report(struct hid_device *hid,
                 unsigned char report_number,
                 unsigned char *data, size_t count,
@@ -678,20 +703,6 @@ static int hidp_parse(struct hid_device *hid)
 
 static int hidp_start(struct hid_device *hid)
 {
-        struct hidp_session *session = hid->driver_data;
-        struct hid_report *report;
-
-        if (hid->quirks & HID_QUIRK_NO_INIT_REPORTS)
-                return 0;
-
-        list_for_each_entry(report, &hid->report_enum[HID_INPUT_REPORT].
-                        report_list, list)
-                hidp_send_report(session, report);
-
-        list_for_each_entry(report, &hid->report_enum[HID_FEATURE_REPORT].
-                        report_list, list)
-                hidp_send_report(session, report);
-
         return 0;
 }
 
@@ -711,6 +722,7 @@ static struct hid_ll_driver hidp_hid_driver = {
         .stop = hidp_stop,
         .open  = hidp_open,
         .close = hidp_close,
+        .hidinput_input_event = hidp_hidinput_event,
 };
 
 /* This function sets up the hid device. It does not add it
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 8c3499bec893..b3bb7bca8e60 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1415,8 +1415,9 @@ static void l2cap_conn_ready(struct l2cap_conn *conn)
                         sk->sk_state_change(sk);
                         release_sock(sk);
 
-                } else if (chan->state == BT_CONNECT)
+                } else if (chan->state == BT_CONNECT) {
                         l2cap_do_start(chan);
+                }
 
                 l2cap_chan_unlock(chan);
         }
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index b6e44ad6cca6..6d126faf145f 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -58,7 +58,6 @@ struct rfcomm_dev {
         uint                    modem_status;
 
         struct rfcomm_dlc       *dlc;
-        wait_queue_head_t       wait;
 
         struct device           *tty_dev;
 
@@ -76,13 +75,6 @@ static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig);
 
 /* ---- Device functions ---- */
 
-/*
- * The reason this isn't actually a race, as you no doubt have a little voice
- * screaming at you in your head, is that the refcount should never actually
- * reach zero unless the device has already been taken off the list, in
- * rfcomm_dev_del(). And if that's not true, we'll hit the BUG() in
- * rfcomm_dev_destruct() anyway.
- */
 static void rfcomm_dev_destruct(struct tty_port *port)
 {
         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
@@ -90,10 +82,9 @@ static void rfcomm_dev_destruct(struct tty_port *port)
 
         BT_DBG("dev %p dlc %p", dev, dlc);
 
-        /* Refcount should only hit zero when called from rfcomm_dev_del()
-           which will have taken us off the list. Everything else are
-           refcounting bugs. */
-        BUG_ON(!list_empty(&dev->list));
+        spin_lock(&rfcomm_dev_lock);
+        list_del(&dev->list);
+        spin_unlock(&rfcomm_dev_lock);
 
         rfcomm_dlc_lock(dlc);
         /* Detach DLC if it's owned by this dev */
@@ -112,8 +103,39 @@ static void rfcomm_dev_destruct(struct tty_port *port)
         module_put(THIS_MODULE);
 }
 
+/* device-specific initialization: open the dlc */
+static int rfcomm_dev_activate(struct tty_port *port, struct tty_struct *tty)
+{
+        struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
+
+        return rfcomm_dlc_open(dev->dlc, &dev->src, &dev->dst, dev->channel);
+}
+
+/* we block the open until the dlc->state becomes BT_CONNECTED */
+static int rfcomm_dev_carrier_raised(struct tty_port *port)
+{
+        struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
+
+        return (dev->dlc->state == BT_CONNECTED);
+}
+
+/* device-specific cleanup: close the dlc */
+static void rfcomm_dev_shutdown(struct tty_port *port)
+{
+        struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
+
+        if (dev->tty_dev->parent)
+                device_move(dev->tty_dev, NULL, DPM_ORDER_DEV_LAST);
+
+        /* close the dlc */
+        rfcomm_dlc_close(dev->dlc, 0);
+}
+
 static const struct tty_port_operations rfcomm_port_ops = {
         .destruct = rfcomm_dev_destruct,
+        .activate = rfcomm_dev_activate,
+        .shutdown = rfcomm_dev_shutdown,
+        .carrier_raised = rfcomm_dev_carrier_raised,
 };
 
 static struct rfcomm_dev *__rfcomm_dev_get(int id)
@@ -236,7 +258,6 @@ static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
 
         tty_port_init(&dev->port);
         dev->port.ops = &rfcomm_port_ops;
-        init_waitqueue_head(&dev->wait);
 
         skb_queue_head_init(&dev->pending);
 
@@ -282,7 +303,9 @@ out:
                         dev->id, NULL);
         if (IS_ERR(dev->tty_dev)) {
                 err = PTR_ERR(dev->tty_dev);
+                spin_lock(&rfcomm_dev_lock);
                 list_del(&dev->list);
+                spin_unlock(&rfcomm_dev_lock);
                 goto free;
         }
 
@@ -301,27 +324,6 @@ free:
         return err;
 }
 
-static void rfcomm_dev_del(struct rfcomm_dev *dev)
-{
-        unsigned long flags;
-        BT_DBG("dev %p", dev);
-
-        BUG_ON(test_and_set_bit(RFCOMM_TTY_RELEASED, &dev->flags));
-
-        spin_lock_irqsave(&dev->port.lock, flags);
-        if (dev->port.count > 0) {
-                spin_unlock_irqrestore(&dev->port.lock, flags);
-                return;
-        }
-        spin_unlock_irqrestore(&dev->port.lock, flags);
-
-        spin_lock(&rfcomm_dev_lock);
-        list_del_init(&dev->list);
-        spin_unlock(&rfcomm_dev_lock);
-
-        tty_port_put(&dev->port);
-}
-
 /* ---- Send buffer ---- */
 static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
 {
@@ -333,10 +335,9 @@ static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
 static void rfcomm_wfree(struct sk_buff *skb)
 {
         struct rfcomm_dev *dev = (void *) skb->sk;
-        struct tty_struct *tty = dev->port.tty;
         atomic_sub(skb->truesize, &dev->wmem_alloc);
-        if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags) && tty)
-                tty_wakeup(tty);
+        if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags))
+                tty_port_tty_wakeup(&dev->port);
         tty_port_put(&dev->port);
 }
 
@@ -410,6 +411,7 @@ static int rfcomm_release_dev(void __user *arg)
 {
         struct rfcomm_dev_req req;
         struct rfcomm_dev *dev;
+        struct tty_struct *tty;
 
         if (copy_from_user(&req, arg, sizeof(req)))
                 return -EFAULT;
@@ -429,11 +431,15 @@ static int rfcomm_release_dev(void __user *arg)
                 rfcomm_dlc_close(dev->dlc, 0);
 
         /* Shut down TTY synchronously before freeing rfcomm_dev */
-        if (dev->port.tty)
-                tty_vhangup(dev->port.tty);
+        tty = tty_port_tty_get(&dev->port);
+        if (tty) {
+                tty_vhangup(tty);
+                tty_kref_put(tty);
+        }
+
+        if (!test_and_set_bit(RFCOMM_TTY_RELEASED, &dev->flags))
+                tty_port_put(&dev->port);
 
-        if (!test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))
-                rfcomm_dev_del(dev);
         tty_port_put(&dev->port);
         return 0;
 }
@@ -563,16 +569,21 @@ static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
 {
         struct rfcomm_dev *dev = dlc->owner;
+        struct tty_struct *tty;
         if (!dev)
                 return;
 
         BT_DBG("dlc %p dev %p err %d", dlc, dev, err);
 
         dev->err = err;
-        wake_up_interruptible(&dev->wait);
+        if (dlc->state == BT_CONNECTED) {
+                device_move(dev->tty_dev, rfcomm_get_device(dev),
+                            DPM_ORDER_DEV_AFTER_PARENT);
 
-        if (dlc->state == BT_CLOSED) {
-                if (!dev->port.tty) {
+                wake_up_interruptible(&dev->port.open_wait);
+        } else if (dlc->state == BT_CLOSED) {
+                tty = tty_port_tty_get(&dev->port);
+                if (!tty) {
                         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
                                 /* Drop DLC lock here to avoid deadlock
                                  * 1. rfcomm_dev_get will take rfcomm_dev_lock
@@ -580,6 +591,9 @@ static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
                                  *    rfcomm_dev_lock -> dlc lock
                                  * 2. tty_port_put will deadlock if it's
                                  *    the last reference
+                                 *
+                                 * FIXME: when we release the lock anything
+                                 * could happen to dev, even its destruction
                                  */
                                 rfcomm_dlc_unlock(dlc);
                                 if (rfcomm_dev_get(dev->id) == NULL) {
@@ -587,12 +601,17 @@ static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
                                         return;
                                 }
 
-                                rfcomm_dev_del(dev);
+                                if (!test_and_set_bit(RFCOMM_TTY_RELEASED,
+                                                      &dev->flags))
+                                        tty_port_put(&dev->port);
+
                                 tty_port_put(&dev->port);
                                 rfcomm_dlc_lock(dlc);
                         }
-                } else
-                        tty_hangup(dev->port.tty);
+                } else {
+                        tty_hangup(tty);
+                        tty_kref_put(tty);
+                }
         }
 }
 
@@ -604,10 +623,8 @@ static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
 
         BT_DBG("dlc %p dev %p v24_sig 0x%02x", dlc, dev, v24_sig);
 
-        if ((dev->modem_status & TIOCM_CD) && !(v24_sig & RFCOMM_V24_DV)) {
-                if (dev->port.tty && !C_CLOCAL(dev->port.tty))
-                        tty_hangup(dev->port.tty);
-        }
+        if ((dev->modem_status & TIOCM_CD) && !(v24_sig & RFCOMM_V24_DV))
+                tty_port_tty_hangup(&dev->port, true);
 
         dev->modem_status =
                 ((v24_sig & RFCOMM_V24_RTC) ? (TIOCM_DSR | TIOCM_DTR) : 0) |
@@ -638,124 +655,92 @@ static void rfcomm_tty_copy_pending(struct rfcomm_dev *dev)
                 tty_flip_buffer_push(&dev->port);
 }
 
-static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
+/* do the reverse of install, clearing the tty fields and releasing the
+ * reference to tty_port
+ */
+static void rfcomm_tty_cleanup(struct tty_struct *tty)
 {
-        DECLARE_WAITQUEUE(wait, current);
-        struct rfcomm_dev *dev;
-        struct rfcomm_dlc *dlc;
-        unsigned long flags;
-        int err, id;
+        struct rfcomm_dev *dev = tty->driver_data;
 
-        id = tty->index;
+        clear_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 
-        BT_DBG("tty %p id %d", tty, id);
+        rfcomm_dlc_lock(dev->dlc);
+        tty->driver_data = NULL;
+        rfcomm_dlc_unlock(dev->dlc);
 
-        /* We don't leak this refcount. For reasons which are not entirely
-           clear, the TTY layer will call our ->close() method even if the
-           open fails. We decrease the refcount there, and decreasing it
-           here too would cause breakage. */
-        dev = rfcomm_dev_get(id);
-        if (!dev)
-                return -ENODEV;
+        /*
+         * purge the dlc->tx_queue to avoid circular dependencies
+         * between dev and dlc
+         */
+        skb_queue_purge(&dev->dlc->tx_queue);
 
-        BT_DBG("dev %p dst %pMR channel %d opened %d", dev, &dev->dst,
-               dev->channel, dev->port.count);
+        tty_port_put(&dev->port);
+}
 
-        spin_lock_irqsave(&dev->port.lock, flags);
-        if (++dev->port.count > 1) {
-                spin_unlock_irqrestore(&dev->port.lock, flags);
-                return 0;
-        }
-        spin_unlock_irqrestore(&dev->port.lock, flags);
+/* we acquire the tty_port reference since it's here the tty is first used
+ * by setting the termios. We also populate the driver_data field and install
+ * the tty port
+ */
+static int rfcomm_tty_install(struct tty_driver *driver, struct tty_struct *tty)
+{
+        struct rfcomm_dev *dev;
+        struct rfcomm_dlc *dlc;
+        int err;
+
+        dev = rfcomm_dev_get(tty->index);
+        if (!dev)
+                return -ENODEV;
 
         dlc = dev->dlc;
 
         /* Attach TTY and open DLC */
-
         rfcomm_dlc_lock(dlc);
         tty->driver_data = dev;
-        dev->port.tty = tty;
         rfcomm_dlc_unlock(dlc);
         set_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 
-        err = rfcomm_dlc_open(dlc, &dev->src, &dev->dst, dev->channel);
-        if (err < 0)
-                return err;
-
-        /* Wait for DLC to connect */
-        add_wait_queue(&dev->wait, &wait);
-        while (1) {
-                set_current_state(TASK_INTERRUPTIBLE);
+        /* install the tty_port */
+        err = tty_port_install(&dev->port, driver, tty);
+        if (err)
+                rfcomm_tty_cleanup(tty);
 
-                if (dlc->state == BT_CLOSED) {
-                        err = -dev->err;
-                        break;
-                }
+        return err;
+}
 
-                if (dlc->state == BT_CONNECTED)
-                        break;
+static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
+{
+        struct rfcomm_dev *dev = tty->driver_data;
+        int err;
 
-                if (signal_pending(current)) {
-                        err = -EINTR;
-                        break;
-                }
+        BT_DBG("tty %p id %d", tty, tty->index);
 
-                tty_unlock(tty);
-                schedule();
-                tty_lock(tty);
-        }
-        set_current_state(TASK_RUNNING);
-        remove_wait_queue(&dev->wait, &wait);
+        BT_DBG("dev %p dst %pMR channel %d opened %d", dev, &dev->dst,
+               dev->channel, dev->port.count);
 
-        if (err == 0)
-                device_move(dev->tty_dev, rfcomm_get_device(dev),
-                            DPM_ORDER_DEV_AFTER_PARENT);
+        err = tty_port_open(&dev->port, tty, filp);
+        if (err)
+                return err;
 
+        /*
+         * FIXME: rfcomm should use proper flow control for
+         * received data. This hack will be unnecessary and can
+         * be removed when that's implemented
+         */
         rfcomm_tty_copy_pending(dev);
 
         rfcomm_dlc_unthrottle(dev->dlc);
 
-        return err;
+        return 0;
 }
 
 static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
 {
         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-        unsigned long flags;
-
-        if (!dev)
-                return;
 
         BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc,
                                                 dev->port.count);
 
-        spin_lock_irqsave(&dev->port.lock, flags);
-        if (!--dev->port.count) {
-                spin_unlock_irqrestore(&dev->port.lock, flags);
-                if (dev->tty_dev->parent)
-                        device_move(dev->tty_dev, NULL, DPM_ORDER_DEV_LAST);
-
-                /* Close DLC and dettach TTY */
-                rfcomm_dlc_close(dev->dlc, 0);
-
-                clear_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
-
-                rfcomm_dlc_lock(dev->dlc);
-                tty->driver_data = NULL;
-                dev->port.tty = NULL;
-                rfcomm_dlc_unlock(dev->dlc);
-
-                if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags)) {
-                        spin_lock(&rfcomm_dev_lock);
-                        list_del_init(&dev->list);
-                        spin_unlock(&rfcomm_dev_lock);
-
-                        tty_port_put(&dev->port);
-                }
-        } else
-                spin_unlock_irqrestore(&dev->port.lock, flags);
-
-        tty_port_put(&dev->port);
+        tty_port_close(&dev->port, tty, filp);
 }
 
 static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, int count)
@@ -1055,17 +1040,11 @@ static void rfcomm_tty_hangup(struct tty_struct *tty)
 
         BT_DBG("tty %p dev %p", tty, dev);
 
-        if (!dev)
-                return;
-
-        rfcomm_tty_flush_buffer(tty);
+        tty_port_hangup(&dev->port);
 
-        if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
-                if (rfcomm_dev_get(dev->id) == NULL)
-                        return;
-                rfcomm_dev_del(dev);
+        if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags) &&
+            !test_and_set_bit(RFCOMM_TTY_RELEASED, &dev->flags))
                 tty_port_put(&dev->port);
-        }
 }
 
 static int rfcomm_tty_tiocmget(struct tty_struct *tty)
@@ -1128,6 +1107,8 @@ static const struct tty_operations rfcomm_ops = {
         .wait_until_sent        = rfcomm_tty_wait_until_sent,
         .tiocmget               = rfcomm_tty_tiocmget,
         .tiocmset               = rfcomm_tty_tiocmset,
+        .install                = rfcomm_tty_install,
+        .cleanup                = rfcomm_tty_cleanup,
 };
 
 int __init rfcomm_init_ttys(void)
@@ -1146,7 +1127,7 @@ int __init rfcomm_init_ttys(void)
         rfcomm_tty_driver->subtype      = SERIAL_TYPE_NORMAL;
         rfcomm_tty_driver->flags        = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
         rfcomm_tty_driver->init_termios = tty_std_termios;
-        rfcomm_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL | CLOCAL;
+        rfcomm_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL;
         rfcomm_tty_driver->init_termios.c_lflag &= ~ICANON;
         tty_set_operations(rfcomm_tty_driver, &rfcomm_ops);
 
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index e7bd4eea575c..96bd388d93a4 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -176,8 +176,13 @@ static int sco_connect(struct sock *sk)
         else
                 type = SCO_LINK;
 
-        hcon = hci_connect(hdev, type, dst, BDADDR_BREDR, BT_SECURITY_LOW,
-                           HCI_AT_NO_BONDING);
+        if (sco_pi(sk)->setting == BT_VOICE_TRANSPARENT &&
+            (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev))) {
+                err = -EOPNOTSUPP;
+                goto done;
+        }
+
+        hcon = hci_connect_sco(hdev, type, dst, sco_pi(sk)->setting);
         if (IS_ERR(hcon)) {
                 err = PTR_ERR(hcon);
                 goto done;
@@ -417,6 +422,8 @@ static struct sock *sco_sock_alloc(struct net *net, struct socket *sock, int pro
         sk->sk_protocol = proto;
         sk->sk_state    = BT_OPEN;
 
+        sco_pi(sk)->setting = BT_VOICE_CVSD_16BIT;
+
         setup_timer(&sk->sk_timer, sco_sock_timeout, (unsigned long)sk);
 
         bt_sock_link(&sco_sk_list, sk);
@@ -652,7 +659,7 @@ static int sco_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
         return err;
 }
 
-static void sco_conn_defer_accept(struct hci_conn *conn, int mask)
+static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting)
 {
         struct hci_dev *hdev = conn->hdev;
 
@@ -664,11 +671,7 @@ static void sco_conn_defer_accept(struct hci_conn *conn, int mask)
                 struct hci_cp_accept_conn_req cp;
 
                 bacpy(&cp.bdaddr, &conn->dst);
-
-                if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
-                        cp.role = 0x00; /* Become master */
-                else
-                        cp.role = 0x01; /* Remain slave */
+                cp.role = 0x00; /* Ignored */
 
                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
         } else {
@@ -679,9 +682,21 @@ static void sco_conn_defer_accept(struct hci_conn *conn, int mask)
 
                 cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
                 cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
-                cp.max_latency    = __constant_cpu_to_le16(0xffff);
-                cp.content_format = cpu_to_le16(hdev->voice_setting);
-                cp.retrans_effort = 0xff;
+                cp.content_format = cpu_to_le16(setting);
+
+                switch (setting & SCO_AIRMODE_MASK) {
+                case SCO_AIRMODE_TRANSP:
+                        if (conn->pkt_type & ESCO_2EV3)
+                                cp.max_latency = __constant_cpu_to_le16(0x0008);
+                        else
+                                cp.max_latency = __constant_cpu_to_le16(0x000D);
+                        cp.retrans_effort = 0x02;
+                        break;
+                case SCO_AIRMODE_CVSD:
+                        cp.max_latency = __constant_cpu_to_le16(0xffff);
+                        cp.retrans_effort = 0xff;
+                        break;
+                }
 
                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
                              sizeof(cp), &cp);
@@ -698,7 +713,7 @@ static int sco_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         if (sk->sk_state == BT_CONNECT2 &&
             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
-                sco_conn_defer_accept(pi->conn->hcon, 0);
+                sco_conn_defer_accept(pi->conn->hcon, pi->setting);
                 sk->sk_state = BT_CONFIG;
                 msg->msg_namelen = 0;
 
@@ -714,7 +729,8 @@ static int sco_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 static int sco_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
 {
         struct sock *sk = sock->sk;
-        int err = 0;
+        int len, err = 0;
+        struct bt_voice voice;
         u32 opt;
 
         BT_DBG("sk %p", sk);
@@ -740,6 +756,31 @@ static int sco_sock_setsockopt(struct socket *sock, int level, int optname, char
                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
                 break;
 
+        case BT_VOICE:
+                if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND &&
+                    sk->sk_state != BT_CONNECT2) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                voice.setting = sco_pi(sk)->setting;
+
+                len = min_t(unsigned int, sizeof(voice), optlen);
+                if (copy_from_user((char *) &voice, optval, len)) {
+                        err = -EFAULT;
+                        break;
+                }
+
+                /* Explicitly check for these values */
+                if (voice.setting != BT_VOICE_TRANSPARENT &&
+                    voice.setting != BT_VOICE_CVSD_16BIT) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                sco_pi(sk)->setting = voice.setting;
+                break;
+
         default:
                 err = -ENOPROTOOPT;
                 break;
@@ -765,7 +806,9 @@ static int sco_sock_getsockopt_old(struct socket *sock, int optname, char __user
 
         switch (optname) {
         case SCO_OPTIONS:
-                if (sk->sk_state != BT_CONNECTED) {
+                if (sk->sk_state != BT_CONNECTED &&
+                    !(sk->sk_state == BT_CONNECT2 &&
+                      test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
                         err = -ENOTCONN;
                         break;
                 }
@@ -781,7 +824,9 @@ static int sco_sock_getsockopt_old(struct socket *sock, int optname, char __user
                 break;
 
         case SCO_CONNINFO:
-                if (sk->sk_state != BT_CONNECTED) {
+                if (sk->sk_state != BT_CONNECTED &&
+                    !(sk->sk_state == BT_CONNECT2 &&
+                      test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
                         err = -ENOTCONN;
                         break;
                 }
@@ -809,6 +854,7 @@ static int sco_sock_getsockopt(struct socket *sock, int level, int optname, char
 {
         struct sock *sk = sock->sk;
         int len, err = 0;
+        struct bt_voice voice;
 
         BT_DBG("sk %p", sk);
 
@@ -834,6 +880,15 @@ static int sco_sock_getsockopt(struct socket *sock, int level, int optname, char
 
                 break;
 
+        case BT_VOICE:
+                voice.setting = sco_pi(sk)->setting;
+
+                len = min_t(unsigned int, len, sizeof(voice));
+                if (copy_to_user(optval, (char *)&voice, len))
+                        err = -EFAULT;
+
+                break;
+
         default:
                 err = -ENOPROTOOPT;
                 break;
diff --git a/net/can/gw.c b/net/can/gw.c
index 2f291f961a17..3f9b0f3a2818 100644
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -146,6 +146,7 @@ struct cgw_job {
                 /* tbc */
         };
         u8 gwtype;
+        u8 limit_hops;
         u16 flags;
 };
 
@@ -402,6 +403,11 @@ static void can_can_gw_rcv(struct sk_buff *skb, void *data)
 
         /* put the incremented hop counter in the cloned skb */
         cgw_hops(nskb) = cgw_hops(skb) + 1;
+
+        /* first processing of this CAN frame -> adjust to private hop limit */
+        if (gwj->limit_hops && cgw_hops(nskb) == 1)
+                cgw_hops(nskb) = max_hops - gwj->limit_hops + 1;
+
         nskb->dev = gwj->dst.dev;
 
         /* pointer to modifiable CAN frame */
@@ -509,6 +515,11 @@ static int cgw_put_job(struct sk_buff *skb, struct cgw_job *gwj, int type,
 
         /* check non default settings of attributes */
 
+        if (gwj->limit_hops) {
+                if (nla_put_u8(skb, CGW_LIM_HOPS, gwj->limit_hops) < 0)
+                        goto cancel;
+        }
+
         if (gwj->mod.modtype.and) {
                 memcpy(&mb.cf, &gwj->mod.modframe.and, sizeof(mb.cf));
                 mb.modtype = gwj->mod.modtype.and;
@@ -606,11 +617,12 @@ static const struct nla_policy cgw_policy[CGW_MAX+1] = {
         [CGW_SRC_IF]    = { .type = NLA_U32 },
         [CGW_DST_IF]    = { .type = NLA_U32 },
         [CGW_FILTER]    = { .len = sizeof(struct can_filter) },
+        [CGW_LIM_HOPS]  = { .type = NLA_U8 },
 };
 
 /* check for common and gwtype specific attributes */
 static int cgw_parse_attr(struct nlmsghdr *nlh, struct cf_mod *mod,
-                          u8 gwtype, void *gwtypeattr)
+                          u8 gwtype, void *gwtypeattr, u8 *limhops)
 {
         struct nlattr *tb[CGW_MAX+1];
         struct cgw_frame_mod mb;
@@ -625,6 +637,13 @@ static int cgw_parse_attr(struct nlmsghdr *nlh, struct cf_mod *mod,
         if (err < 0)
                 return err;
 
+        if (tb[CGW_LIM_HOPS]) {
+                *limhops = nla_get_u8(tb[CGW_LIM_HOPS]);
+
+                if (*limhops < 1 || *limhops > max_hops)
+                        return -EINVAL;
+        }
+
         /* check for AND/OR/XOR/SET modifications */
 
         if (tb[CGW_MOD_AND]) {
@@ -782,6 +801,7 @@ static int cgw_create_job(struct sk_buff *skb,  struct nlmsghdr *nlh)
 {
         struct rtcanmsg *r;
         struct cgw_job *gwj;
+        u8 limhops = 0;
         int err = 0;
 
         if (!capable(CAP_NET_ADMIN))
@@ -808,7 +828,8 @@ static int cgw_create_job(struct sk_buff *skb,  struct nlmsghdr *nlh)
         gwj->flags = r->flags;
         gwj->gwtype = r->gwtype;
 
-        err = cgw_parse_attr(nlh, &gwj->mod, CGW_TYPE_CAN_CAN, &gwj->ccgw);
+        err = cgw_parse_attr(nlh, &gwj->mod, CGW_TYPE_CAN_CAN, &gwj->ccgw,
+                             &limhops);
         if (err < 0)
                 goto out;
 
@@ -836,6 +857,8 @@ static int cgw_create_job(struct sk_buff *skb,  struct nlmsghdr *nlh)
         if (gwj->dst.dev->type != ARPHRD_CAN || gwj->dst.dev->header_ops)
                 goto put_src_dst_out;
 
+        gwj->limit_hops = limhops;
+
         ASSERT_RTNL();
 
         err = cgw_register_filter(gwj);
@@ -867,13 +890,14 @@ static void cgw_remove_all_jobs(void)
         }
 }
 
-static int cgw_remove_job(struct sk_buff *skb,  struct nlmsghdr *nlh)
+static int cgw_remove_job(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
         struct cgw_job *gwj = NULL;
         struct hlist_node *nx;
         struct rtcanmsg *r;
         struct cf_mod mod;
         struct can_can_gw ccgw;
+        u8 limhops = 0;
         int err = 0;
 
         if (!capable(CAP_NET_ADMIN))
@@ -890,7 +914,7 @@ static int cgw_remove_job(struct sk_buff *skb,  struct nlmsghdr *nlh)
         if (r->gwtype != CGW_TYPE_CAN_CAN)
                 return -EINVAL;
 
-        err = cgw_parse_attr(nlh, &mod, CGW_TYPE_CAN_CAN, &ccgw);
+        err = cgw_parse_attr(nlh, &mod, CGW_TYPE_CAN_CAN, &ccgw, &limhops);
         if (err < 0)
                 return err;
 
@@ -910,6 +934,9 @@ static int cgw_remove_job(struct sk_buff *skb,  struct nlmsghdr *nlh)
                 if (gwj->flags != r->flags)
                         continue;
 
+                if (gwj->limit_hops != limhops)
+                        continue;
+
                 if (memcmp(&gwj->mod, &mod, sizeof(mod)))
                         continue;
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 6fbb0c90849b..5c713f2239cc 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1697,7 +1697,7 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
          * call skb_scrub_packet() after it to clear pkt_type _after_ calling
          * eth_type_trans().
          */
-        skb_scrub_packet(skb);
+        skb_scrub_packet(skb, true);
 
         return netif_rx(skb);
 }
@@ -4679,8 +4679,8 @@ static int __netdev_upper_dev_link(struct net_device *dev,
          * versa, and don't forget the devices itself. All of these
          * links are non-neighbours.
          */
-        list_for_each_entry(i, &upper_dev->upper_dev_list, list) {
-                list_for_each_entry(j, &dev->lower_dev_list, list) {
+        list_for_each_entry(i, &dev->lower_dev_list, list) {
+                list_for_each_entry(j, &upper_dev->upper_dev_list, list) {
                         ret = __netdev_adjacent_dev_link(i->dev, j->dev);
                         if (ret)
                                 goto rollback_mesh;
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 60533db8b72d..6072610a8672 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2759,13 +2759,11 @@ errout:
                 rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
 }
 
-#ifdef CONFIG_ARPD
 void neigh_app_ns(struct neighbour *n)
 {
         __neigh_notify(n, RTM_GETNEIGH, NLM_F_REQUEST);
 }
 EXPORT_SYMBOL(neigh_app_ns);
-#endif /* CONFIG_ARPD */
 
 #ifdef CONFIG_SYSCTL
 static int zero;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 2c3d0f53d198..d81cff119f73 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3500,17 +3500,22 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
 EXPORT_SYMBOL(skb_try_coalesce);
 
 /**
- * skb_scrub_packet - scrub an skb before sending it to another netns
+ * skb_scrub_packet - scrub an skb
  *
  * @skb: buffer to clean
- *
- * skb_scrub_packet can be used to clean an skb before injecting it in
- * another namespace. We have to clear all information in the skb that
- * could impact namespace isolation.
+ * @xnet: packet is crossing netns
+ *
+ * skb_scrub_packet can be used after encapsulating or decapsulting a packet
+ * into/from a tunnel. Some information have to be cleared during these
+ * operations.
+ * skb_scrub_packet can also be used to clean a skb before injecting it in
+ * another namespace (@xnet == true). We have to clear all information in the
+ * skb that could impact namespace isolation.
  */
-void skb_scrub_packet(struct sk_buff *skb)
+void skb_scrub_packet(struct sk_buff *skb, bool xnet)
 {
-        skb_orphan(skb);
+        if (xnet)
+                skb_orphan(skb);
         skb->tstamp.tv64 = 0;
         skb->pkt_type = PACKET_HOST;
         skb->skb_iif = 0;
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 6ebd8fbd9285..29d684ebca6a 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -347,7 +347,7 @@ dsa_slave_create(struct dsa_switch *ds, struct device *parent,
 
         slave_dev->features = master->vlan_features;
         SET_ETHTOOL_OPS(slave_dev, &dsa_slave_ethtool_ops);
-        memcpy(slave_dev->dev_addr, master->dev_addr, ETH_ALEN);
+        eth_hw_addr_inherit(slave_dev, master);
         slave_dev->tx_queue_len = 0;
 
         switch (ds->dst->tag_protocol) {
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 37cf1a6ea3ad..05c57f0fcabe 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -259,22 +259,6 @@ config IP_PIMSM_V2
           gated-5). This routing protocol is not used widely, so say N unless
           you want to play with it.
 
-config ARPD
-        bool "IP: ARP daemon support"
-        ---help---
-          The kernel maintains an internal cache which maps IP addresses to
-          hardware addresses on the local network, so that Ethernet
-          frames are sent to the proper address on the physical networking
-          layer. Normally, kernel uses the ARP protocol to resolve these
-          mappings.
-
-          Saying Y here adds support to have an user space daemon to do this
-          resolution instead. This is useful for implementing an alternate
-          address resolution protocol (e.g. NHRP on mGRE tunnels) and also for
-          testing purposes.
-
-          If unsure, say N.
-
 config SYN_COOKIES
         bool "IP: TCP syncookie support"
         ---help---
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 4429b013f269..7808093cede6 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -368,9 +368,7 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
         } else {
                 probes -= neigh->parms->app_probes;
                 if (probes < 0) {
-#ifdef CONFIG_ARPD
                         neigh_app_ns(neigh);
-#endif
                         return;
                 }
         }
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 830de3f4e293..ac9fabe0300f 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -461,8 +461,7 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
                 skb->dev = tunnel->dev;
         }
 
-        if (!net_eq(tunnel->net, dev_net(tunnel->dev)))
-                skb_scrub_packet(skb);
+        skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(tunnel->dev)));
 
         gro_cells_receive(&tunnel->gro_cells, skb);
         return 0;
@@ -614,9 +613,6 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
                 goto tx_error;
         }
 
-        if (!net_eq(tunnel->net, dev_net(dev)))
-                skb_scrub_packet(skb);
-
         if (tunnel->err_count > 0) {
                 if (time_before(jiffies,
                                 tunnel->err_time + IPTUNNEL_ERR_TIMEO)) {
@@ -654,9 +650,9 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
                 }
         }
 
-        err = iptunnel_xmit(tunnel->net, rt, skb,
-                            fl4.saddr, fl4.daddr, protocol,
-                            ip_tunnel_ecn_encap(tos, inner_iph, skb), ttl, df);
+        err = iptunnel_xmit(rt, skb, fl4.saddr, fl4.daddr, protocol,
+                            ip_tunnel_ecn_encap(tos, inner_iph, skb), ttl, df,
+                            !net_eq(tunnel->net, dev_net(dev)));
         iptunnel_xmit_stats(err, &dev->stats, dev->tstats);
 
         return;
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index 850525b34899..d6c856b17fd4 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -46,19 +46,17 @@
 #include <net/netns/generic.h>
 #include <net/rtnetlink.h>
 
-int iptunnel_xmit(struct net *net, struct rtable *rt,
-                  struct sk_buff *skb,
+int iptunnel_xmit(struct rtable *rt, struct sk_buff *skb,
                   __be32 src, __be32 dst, __u8 proto,
-                  __u8 tos, __u8 ttl, __be16 df)
+                  __u8 tos, __u8 ttl, __be16 df, bool xnet)
 {
         int pkt_len = skb->len;
         struct iphdr *iph;
         int err;
 
-        nf_reset(skb);
-        secpath_reset(skb);
+        skb_scrub_packet(skb, xnet);
+
         skb->rxhash = 0;
-        skb_dst_drop(skb);
         skb_dst_set(skb, &rt->dst);
         memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
 
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index bacc0bcf48ce..9ae54b09254f 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -2067,9 +2067,8 @@ static int __pim_rcv(struct mr_table *mrt, struct sk_buff *skb,
         skb_reset_network_header(skb);
         skb->protocol = htons(ETH_P_IP);
         skb->ip_summed = CHECKSUM_NONE;
-        skb->pkt_type = PACKET_HOST;
 
-        skb_tunnel_rx(skb, reg_dev);
+        skb_tunnel_rx(skb, reg_dev, dev_net(reg_dev));
 
         netif_rx(skb);
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 1a84fffe6993..93d7e9de4143 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5049,8 +5049,8 @@ discard:
  *      the rest is checked inline. Fast processing is turned on in
  *      tcp_data_queue when everything is OK.
  */
-int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
-                        const struct tcphdr *th, unsigned int len)
+void tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
+                         const struct tcphdr *th, unsigned int len)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
@@ -5127,7 +5127,7 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                                 tcp_ack(sk, skb, 0);
                                 __kfree_skb(skb);
                                 tcp_data_snd_check(sk);
-                                return 0;
+                                return;
                         } else { /* Header too small */
                                 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
                                 goto discard;
@@ -5220,7 +5220,7 @@ no_ack:
                         if (eaten)
                                 kfree_skb_partial(skb, fragstolen);
                         sk->sk_data_ready(sk, 0);
-                        return 0;
+                        return;
                 }
         }
 
@@ -5236,7 +5236,7 @@ slow_path:
          */
 
         if (!tcp_validate_incoming(sk, skb, th, 1))
-                return 0;
+                return;
 
 step5:
         if (tcp_ack(sk, skb, FLAG_SLOWPATH | FLAG_UPDATE_TS_RECENT) < 0)
@@ -5252,7 +5252,7 @@ step5:
 
         tcp_data_snd_check(sk);
         tcp_ack_snd_check(sk);
-        return 0;
+        return;
 
 csum_error:
         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_CSUMERRORS);
@@ -5260,7 +5260,6 @@ csum_error:
 
 discard:
         __kfree_skb(skb);
-        return 0;
 }
 EXPORT_SYMBOL(tcp_rcv_established);
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 09d45d718973..b14266bb91eb 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1799,10 +1799,7 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
                                 sk->sk_rx_dst = NULL;
                         }
                 }
-                if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len)) {
-                        rsk = sk;
-                        goto reset;
-                }
+                tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len);
                 return 0;
         }
 
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 622a4377b397..611beab38a00 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -122,8 +122,8 @@ static inline int tcp_probe_avail(void)
  * Hook inserted to be called before each receive packet.
  * Note: arguments must match tcp_rcv_established()!
  */
-static int jtcp_rcv_established(struct sock *sk, struct sk_buff *skb,
-                                const struct tcphdr *th, unsigned int len)
+static void jtcp_rcv_established(struct sock *sk, struct sk_buff *skb,
+                                 const struct tcphdr *th, unsigned int len)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
         const struct inet_sock *inet = inet_sk(sk);
@@ -172,7 +172,6 @@ static int jtcp_rcv_established(struct sock *sk, struct sk_buff *skb,
         }
 
         jprobe_return();
-        return 0;
 }
 
 static struct jprobe tcp_jprobe = {
@@ -218,7 +217,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
                 return -EINVAL;
 
         while (cnt < len) {
-                char tbuf[164];
+                char tbuf[256];
                 int width;
 
                 /* Wait for data in buffer */
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index f2d0a42f8057..db992a373011 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -509,8 +509,6 @@ static int ip6gre_rcv(struct sk_buff *skb)
                         goto drop;
                 }
 
-                secpath_reset(skb);
-
                 skb->protocol = gre_proto;
                 /* WCCP version 1 and 2 protocol decoding.
                  * - Change protocol to IP
@@ -525,7 +523,6 @@ static int ip6gre_rcv(struct sk_buff *skb)
                 skb->mac_header = skb->network_header;
                 __pskb_pull(skb, offset);
                 skb_postpull_rcsum(skb, skb_transport_header(skb), offset);
-                skb->pkt_type = PACKET_HOST;
 
                 if (((flags&GRE_CSUM) && csum) ||
                     (!(flags&GRE_CSUM) && tunnel->parms.i_flags&GRE_CSUM)) {
@@ -557,7 +554,7 @@ static int ip6gre_rcv(struct sk_buff *skb)
                         skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
                 }
 
-                __skb_tunnel_rx(skb, tunnel->dev);
+                __skb_tunnel_rx(skb, tunnel->dev, tunnel->net);
 
                 skb_reset_network_header(skb);
 
@@ -694,6 +691,8 @@ static netdev_tx_t ip6gre_xmit2(struct sk_buff *skb,
                         tunnel->err_count = 0;
         }
 
+        skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(dev)));
+
         max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen + dst->header_len;
 
         if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
@@ -710,8 +709,6 @@ static netdev_tx_t ip6gre_xmit2(struct sk_buff *skb,
                 skb = new_skb;
         }
 
-        skb_dst_drop(skb);
-
         if (fl6->flowi6_mark) {
                 skb_dst_set(skb, dst);
                 ndst = NULL;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index d6e00a39274c..55999d923f26 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -802,14 +802,12 @@ static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
                         rcu_read_unlock();
                         goto discard;
                 }
-                secpath_reset(skb);
                 skb->mac_header = skb->network_header;
                 skb_reset_network_header(skb);
                 skb->protocol = htons(protocol);
-                skb->pkt_type = PACKET_HOST;
                 memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
 
-                __skb_tunnel_rx(skb, t->dev);
+                __skb_tunnel_rx(skb, t->dev, t->net);
 
                 err = dscp_ecn_decapsulate(t, ipv6h, skb);
                 if (unlikely(err)) {
@@ -829,9 +827,6 @@ static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
                 tstats->rx_packets++;
                 tstats->rx_bytes += skb->len;
 
-                if (!net_eq(t->net, dev_net(t->dev)))
-                        skb_scrub_packet(skb);
-
                 netif_rx(skb);
 
                 rcu_read_unlock();
@@ -1001,8 +996,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
                 goto tx_err_dst_release;
         }
 
-        if (!net_eq(t->net, dev_net(dev)))
-                skb_scrub_packet(skb);
+        skb_scrub_packet(skb, !net_eq(t->net, dev_net(dev)));
 
         /*
          * Okay, now see if we can stuff it in the buffer as-is.
@@ -1021,7 +1015,6 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
                 consume_skb(skb);
                 skb = new_skb;
         }
-        skb_dst_drop(skb);
         if (fl6->flowi6_mark) {
                 skb_dst_set(skb, dst);
                 ndst = NULL;
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index a60a84ef04f7..f365310bfcca 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -672,9 +672,8 @@ static int pim6_rcv(struct sk_buff *skb)
         skb_reset_network_header(skb);
         skb->protocol = htons(ETH_P_IPV6);
         skb->ip_summed = CHECKSUM_NONE;
-        skb->pkt_type = PACKET_HOST;
 
-        skb_tunnel_rx(skb, reg_dev);
+        skb_tunnel_rx(skb, reg_dev, dev_net(reg_dev));
 
         netif_rx(skb);
 
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 14bd2f9d9dbb..22210650596f 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -662,9 +662,7 @@ static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
                 }
                 ndisc_send_ns(dev, neigh, target, target, saddr);
         } else if ((probes -= neigh->parms->app_probes) < 0) {
-#ifdef CONFIG_ARPD
                 neigh_app_ns(neigh);
-#endif
         } else {
                 addrconf_addr_solict_mult(target, &mcaddr);
                 ndisc_send_ns(dev, NULL, target, &mcaddr, saddr);
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index f18f842ac893..19abcc9d6a1a 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -581,12 +581,10 @@ static int ipip6_rcv(struct sk_buff *skb)
                     tunnel->parms.iph.protocol != 0)
                         goto out;
 
-                secpath_reset(skb);
                 skb->mac_header = skb->network_header;
                 skb_reset_network_header(skb);
                 IPCB(skb)->flags = 0;
                 skb->protocol = htons(ETH_P_IPV6);
-                skb->pkt_type = PACKET_HOST;
 
                 if (tunnel->dev->priv_flags & IFF_ISATAP) {
                         if (!isatap_chksrc(skb, iph, tunnel)) {
@@ -603,7 +601,7 @@ static int ipip6_rcv(struct sk_buff *skb)
                         }
                 }
 
-                __skb_tunnel_rx(skb, tunnel->dev);
+                __skb_tunnel_rx(skb, tunnel->dev, tunnel->net);
 
                 err = IP_ECN_decapsulate(iph, skb);
                 if (unlikely(err)) {
@@ -621,8 +619,6 @@ static int ipip6_rcv(struct sk_buff *skb)
                 tstats->rx_packets++;
                 tstats->rx_bytes += skb->len;
 
-                if (!net_eq(tunnel->net, dev_net(tunnel->dev)))
-                        skb_scrub_packet(skb);
                 netif_rx(skb);
 
                 return 0;
@@ -860,9 +856,6 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                         tunnel->err_count = 0;
         }
 
-        if (!net_eq(tunnel->net, dev_net(dev)))
-                skb_scrub_packet(skb);
-
         /*
          * Okay, now see if we can stuff it in the buffer as-is.
          */
@@ -888,8 +881,8 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                 ttl = iph6->hop_limit;
         tos = INET_ECN_encapsulate(tos, ipv6_get_dsfield(iph6));
 
-        err = iptunnel_xmit(dev_net(dev), rt, skb, fl4.saddr, fl4.daddr,
-                            IPPROTO_IPV6, tos, ttl, df);
+        err = iptunnel_xmit(rt, skb, fl4.saddr, fl4.daddr, IPPROTO_IPV6, tos,
+                            ttl, df, !net_eq(tunnel->net, dev_net(dev)));
         iptunnel_xmit_stats(err, &dev->stats, dev->tstats);
         return NETDEV_TX_OK;
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 5bcfadf09e95..9acdcedf9a14 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1360,8 +1360,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                         }
                 }
 
-                if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
-                        goto reset;
+                tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len);
                 if (opt_skb)
                         goto ipv6_pktoptions;
                 return 0;
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 48aaa89253e0..6cba486353e8 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -321,12 +321,12 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
                 if (llc->dev) {
                         if (!addr->sllc_arphrd)
                                 addr->sllc_arphrd = llc->dev->type;
-                        if (llc_mac_null(addr->sllc_mac))
+                        if (is_zero_ether_addr(addr->sllc_mac))
                                 memcpy(addr->sllc_mac, llc->dev->dev_addr,
                                        IFHWADDRLEN);
                         if (addr->sllc_arphrd != llc->dev->type ||
-                            !llc_mac_match(addr->sllc_mac,
-                                           llc->dev->dev_addr)) {
+                            !ether_addr_equal(addr->sllc_mac,
+                                              llc->dev->dev_addr)) {
                                 rc = -EINVAL;
                                 llc->dev = NULL;
                         }
diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
index 0d0d416dfab6..cd8724177965 100644
--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -478,8 +478,8 @@ static inline bool llc_estab_match(const struct llc_sap *sap,
 
         return llc->laddr.lsap == laddr->lsap &&
                 llc->daddr.lsap == daddr->lsap &&
-                llc_mac_match(llc->laddr.mac, laddr->mac) &&
-                llc_mac_match(llc->daddr.mac, daddr->mac);
+                ether_addr_equal(llc->laddr.mac, laddr->mac) &&
+                ether_addr_equal(llc->daddr.mac, daddr->mac);
 }
 
 /**
@@ -550,7 +550,7 @@ static inline bool llc_listener_match(const struct llc_sap *sap,
 
         return sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_LISTEN &&
                 llc->laddr.lsap == laddr->lsap &&
-                llc_mac_match(llc->laddr.mac, laddr->mac);
+                ether_addr_equal(llc->laddr.mac, laddr->mac);
 }
 
 static struct sock *__llc_lookup_listener(struct llc_sap *sap,
diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
index 78be45cda5c1..e5850699098e 100644
--- a/net/llc/llc_sap.c
+++ b/net/llc/llc_sap.c
@@ -302,7 +302,7 @@ static inline bool llc_dgram_match(const struct llc_sap *sap,
 
      return sk->sk_type == SOCK_DGRAM &&
           llc->laddr.lsap == laddr->lsap &&
-          llc_mac_match(llc->laddr.mac, laddr->mac);
+          ether_addr_equal(llc->laddr.mac, laddr->mac);
 }
 
 /**
@@ -425,7 +425,7 @@ void llc_sap_handler(struct llc_sap *sap, struct sk_buff *skb)
         llc_pdu_decode_da(skb, laddr.mac);
         llc_pdu_decode_dsap(skb, &laddr.lsap);
 
-        if (llc_mac_multicast(laddr.mac)) {
+        if (is_multicast_ether_addr(laddr.mac)) {
                 llc_sap_mcast(sap, &laddr, skb);
                 kfree_skb(skb);
         } else {
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 31fc2247bc37..2e7855a1b10d 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2302,14 +2302,25 @@ static void ieee80211_rfkill_poll(struct wiphy *wiphy)
 }
 
 #ifdef CONFIG_NL80211_TESTMODE
-static int ieee80211_testmode_cmd(struct wiphy *wiphy, void *data, int len)
+static int ieee80211_testmode_cmd(struct wiphy *wiphy,
+                                  struct wireless_dev *wdev,
+                                  void *data, int len)
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_vif *vif = NULL;
 
         if (!local->ops->testmode_cmd)
                 return -EOPNOTSUPP;
 
-        return local->ops->testmode_cmd(&local->hw, data, len);
+        if (wdev) {
+                struct ieee80211_sub_if_data *sdata;
+
+                sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
+                if (sdata->flags & IEEE80211_SDATA_IN_DRIVER)
+                        vif = &sdata->vif;
+        }
+
+        return local->ops->testmode_cmd(&local->hw, vif, data, len);
 }
 
 static int ieee80211_testmode_dump(struct wiphy *wiphy,
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index e08387cdc8fd..a12afe77bb26 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -34,13 +34,12 @@
 
 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
 
-
-static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
-                                      const u8 *bssid, const int beacon_int,
-                                      struct ieee80211_channel *chan,
-                                      const u32 basic_rates,
-                                      const u16 capability, u64 tsf,
-                                      bool creator)
+static struct beacon_data *
+ieee80211_ibss_build_presp(struct ieee80211_sub_if_data *sdata,
+                           const int beacon_int, const u32 basic_rates,
+                           const u16 capability, u64 tsf,
+                           struct cfg80211_chan_def *chandef,
+                           bool *have_higher_than_11mbit)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
         struct ieee80211_local *local = sdata->local;
@@ -48,70 +47,11 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_mgmt *mgmt;
         u8 *pos;
         struct ieee80211_supported_band *sband;
-        struct cfg80211_bss *bss;
-        u32 bss_change, rate_flags, rates = 0, rates_added = 0;
-        struct cfg80211_chan_def chandef;
-        enum nl80211_bss_scan_width scan_width;
-        bool have_higher_than_11mbit = false;
+        u32 rate_flags, rates = 0, rates_added = 0;
         struct beacon_data *presp;
         int frame_len;
         int shift;
 
-        sdata_assert_lock(sdata);
-
-        /* Reset own TSF to allow time synchronization work. */
-        drv_reset_tsf(local, sdata);
-
-        if (!ether_addr_equal(ifibss->bssid, bssid))
-                sta_info_flush(sdata);
-
-        /* if merging, indicate to driver that we leave the old IBSS */
-        if (sdata->vif.bss_conf.ibss_joined) {
-                sdata->vif.bss_conf.ibss_joined = false;
-                sdata->vif.bss_conf.ibss_creator = false;
-                sdata->vif.bss_conf.enable_beacon = false;
-                netif_carrier_off(sdata->dev);
-                ieee80211_bss_info_change_notify(sdata,
-                                                 BSS_CHANGED_IBSS |
-                                                 BSS_CHANGED_BEACON_ENABLED);
-        }
-
-        presp = rcu_dereference_protected(ifibss->presp,
-                                          lockdep_is_held(&sdata->wdev.mtx));
-        rcu_assign_pointer(ifibss->presp, NULL);
-        if (presp)
-                kfree_rcu(presp, rcu_head);
-
-        sdata->drop_unencrypted = capability & WLAN_CAPABILITY_PRIVACY ? 1 : 0;
-
-        chandef = ifibss->chandef;
-        if (!cfg80211_reg_can_beacon(local->hw.wiphy, &chandef)) {
-                if (chandef.width == NL80211_CHAN_WIDTH_5 ||
-                    chandef.width == NL80211_CHAN_WIDTH_10 ||
-                    chandef.width == NL80211_CHAN_WIDTH_20_NOHT ||
-                    chandef.width == NL80211_CHAN_WIDTH_20) {
-                        sdata_info(sdata,
-                                   "Failed to join IBSS, beacons forbidden\n");
-                        return;
-                }
-                chandef.width = NL80211_CHAN_WIDTH_20;
-                chandef.center_freq1 = chan->center_freq;
-        }
-
-        ieee80211_vif_release_channel(sdata);
-        if (ieee80211_vif_use_channel(sdata, &chandef,
-                                      ifibss->fixed_channel ?
-                                        IEEE80211_CHANCTX_SHARED :
-                                        IEEE80211_CHANCTX_EXCLUSIVE)) {
-                sdata_info(sdata, "Failed to join IBSS, no channel context\n");
-                return;
-        }
-
-        memcpy(ifibss->bssid, bssid, ETH_ALEN);
-
-        sband = local->hw.wiphy->bands[chan->band];
-        shift = ieee80211_vif_get_shift(&sdata->vif);
-
         /* Build IBSS probe response */
         frame_len = sizeof(struct ieee80211_hdr_3addr) +
                     12 /* struct ieee80211_mgmt.u.beacon */ +
@@ -125,7 +65,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                     ifibss->ie_len;
         presp = kzalloc(sizeof(*presp) + frame_len, GFP_KERNEL);
         if (!presp)
-                return;
+                return NULL;
 
         presp->head = (void *)(presp + 1);
 
@@ -146,12 +86,19 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         memcpy(pos, ifibss->ssid, ifibss->ssid_len);
         pos += ifibss->ssid_len;
 
-        rate_flags = ieee80211_chandef_rate_flags(&chandef);
+        sband = local->hw.wiphy->bands[chandef->chan->band];
+        rate_flags = ieee80211_chandef_rate_flags(chandef);
+        shift = ieee80211_chandef_get_shift(chandef);
+        rates_n = 0;
+        if (have_higher_than_11mbit)
+                *have_higher_than_11mbit = false;
+
         for (i = 0; i < sband->n_bitrates; i++) {
                 if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
                         continue;
-                if (sband->bitrates[i].bitrate > 110)
-                        have_higher_than_11mbit = true;
+                if (sband->bitrates[i].bitrate > 110 &&
+                    have_higher_than_11mbit)
+                        *have_higher_than_11mbit = true;
 
                 rates |= BIT(i);
                 rates_n++;
@@ -178,7 +125,8 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         if (sband->band == IEEE80211_BAND_2GHZ) {
                 *pos++ = WLAN_EID_DS_PARAMS;
                 *pos++ = 1;
-                *pos++ = ieee80211_frequency_to_channel(chan->center_freq);
+                *pos++ = ieee80211_frequency_to_channel(
+                                chandef->chan->center_freq);
         }
 
         *pos++ = WLAN_EID_IBSS_PARAMS;
@@ -210,9 +158,9 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         }
 
         /* add HT capability and information IEs */
-        if (chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
-            chandef.width != NL80211_CHAN_WIDTH_5 &&
-            chandef.width != NL80211_CHAN_WIDTH_10 &&
+        if (chandef->width != NL80211_CHAN_WIDTH_20_NOHT &&
+            chandef->width != NL80211_CHAN_WIDTH_5 &&
+            chandef->width != NL80211_CHAN_WIDTH_10 &&
             sband->ht_cap.ht_supported) {
                 struct ieee80211_sta_ht_cap ht_cap;
 
@@ -226,7 +174,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                  * keep them at 0
                  */
                 pos = ieee80211_ie_build_ht_oper(pos, &sband->ht_cap,
-                                                 &chandef, 0);
+                                                 chandef, 0);
         }
 
         if (local->hw.queues >= IEEE80211_NUM_ACS) {
@@ -243,9 +191,97 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 
         presp->head_len = pos - presp->head;
         if (WARN_ON(presp->head_len > frame_len))
+                goto error;
+
+        return presp;
+error:
+        kfree(presp);
+        return NULL;
+}
+
+static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
+                                      const u8 *bssid, const int beacon_int,
+                                      struct cfg80211_chan_def *req_chandef,
+                                      const u32 basic_rates,
+                                      const u16 capability, u64 tsf,
+                                      bool creator)
+{
+        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_mgmt *mgmt;
+        struct cfg80211_bss *bss;
+        u32 bss_change;
+        struct cfg80211_chan_def chandef;
+        struct ieee80211_channel *chan;
+        struct beacon_data *presp;
+        enum nl80211_bss_scan_width scan_width;
+        bool have_higher_than_11mbit;
+
+        sdata_assert_lock(sdata);
+
+        /* Reset own TSF to allow time synchronization work. */
+        drv_reset_tsf(local, sdata);
+
+        if (!ether_addr_equal(ifibss->bssid, bssid))
+                sta_info_flush(sdata);
+
+        /* if merging, indicate to driver that we leave the old IBSS */
+        if (sdata->vif.bss_conf.ibss_joined) {
+                sdata->vif.bss_conf.ibss_joined = false;
+                sdata->vif.bss_conf.ibss_creator = false;
+                sdata->vif.bss_conf.enable_beacon = false;
+                netif_carrier_off(sdata->dev);
+                ieee80211_bss_info_change_notify(sdata,
+                                                 BSS_CHANGED_IBSS |
+                                                 BSS_CHANGED_BEACON_ENABLED);
+        }
+
+        presp = rcu_dereference_protected(ifibss->presp,
+                                          lockdep_is_held(&sdata->wdev.mtx));
+        rcu_assign_pointer(ifibss->presp, NULL);
+        if (presp)
+                kfree_rcu(presp, rcu_head);
+
+        sdata->drop_unencrypted = capability & WLAN_CAPABILITY_PRIVACY ? 1 : 0;
+
+        /* make a copy of the chandef, it could be modified below. */
+        chandef = *req_chandef;
+        chan = chandef.chan;
+        if (!cfg80211_reg_can_beacon(local->hw.wiphy, &chandef)) {
+                if (chandef.width == NL80211_CHAN_WIDTH_5 ||
+                    chandef.width == NL80211_CHAN_WIDTH_10 ||
+                    chandef.width == NL80211_CHAN_WIDTH_20_NOHT ||
+                    chandef.width == NL80211_CHAN_WIDTH_20) {
+                        sdata_info(sdata,
+                                   "Failed to join IBSS, beacons forbidden\n");
+                        return;
+                }
+                chandef.width = NL80211_CHAN_WIDTH_20;
+                chandef.center_freq1 = chan->center_freq;
+        }
+
+        ieee80211_vif_release_channel(sdata);
+        if (ieee80211_vif_use_channel(sdata, &chandef,
+                                      ifibss->fixed_channel ?
+                                        IEEE80211_CHANCTX_SHARED :
+                                        IEEE80211_CHANCTX_EXCLUSIVE)) {
+                sdata_info(sdata, "Failed to join IBSS, no channel context\n");
+                return;
+        }
+
+        memcpy(ifibss->bssid, bssid, ETH_ALEN);
+
+        sband = local->hw.wiphy->bands[chan->band];
+
+        presp = ieee80211_ibss_build_presp(sdata, beacon_int, basic_rates,
+                                           capability, tsf, &chandef,
+                                           &have_higher_than_11mbit);
+        if (!presp)
                 return;
 
         rcu_assign_pointer(ifibss->presp, presp);
+        mgmt = (void *)presp->head;
 
         sdata->vif.bss_conf.enable_beacon = true;
         sdata->vif.bss_conf.beacon_int = beacon_int;
@@ -306,10 +342,12 @@ static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         struct cfg80211_bss *cbss =
                 container_of((void *)bss, struct cfg80211_bss, priv);
         struct ieee80211_supported_band *sband;
+        struct cfg80211_chan_def chandef;
         u32 basic_rates;
         int i, j;
         u16 beacon_int = cbss->beacon_interval;
         const struct cfg80211_bss_ies *ies;
+        enum nl80211_channel_type chan_type;
         u64 tsf;
         u32 rate_flags;
         int shift;
@@ -319,6 +357,26 @@ static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         if (beacon_int < 10)
                 beacon_int = 10;
 
+        switch (sdata->u.ibss.chandef.width) {
+        case NL80211_CHAN_WIDTH_20_NOHT:
+        case NL80211_CHAN_WIDTH_20:
+        case NL80211_CHAN_WIDTH_40:
+                chan_type = cfg80211_get_chandef_type(&sdata->u.ibss.chandef);
+                cfg80211_chandef_create(&chandef, cbss->channel, chan_type);
+                break;
+        case NL80211_CHAN_WIDTH_5:
+        case NL80211_CHAN_WIDTH_10:
+                cfg80211_chandef_create(&chandef, cbss->channel,
+                                        NL80211_CHAN_WIDTH_20_NOHT);
+                chandef.width = sdata->u.ibss.chandef.width;
+                break;
+        default:
+                /* fall back to 20 MHz for unsupported modes */
+                cfg80211_chandef_create(&chandef, cbss->channel,
+                                        NL80211_CHAN_WIDTH_20_NOHT);
+                break;
+        }
+
         sband = sdata->local->hw.wiphy->bands[cbss->channel->band];
         rate_flags = ieee80211_chandef_rate_flags(&sdata->u.ibss.chandef);
         shift = ieee80211_vif_get_shift(&sdata->vif);
@@ -352,7 +410,7 @@ static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 
         __ieee80211_sta_join_ibss(sdata, cbss->bssid,
                                   beacon_int,
-                                  cbss->channel,
+                                  &chandef,
                                   basic_rates,
                                   cbss->capability,
                                   tsf, false);
@@ -834,7 +892,7 @@ static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
                 sdata->drop_unencrypted = 0;
 
         __ieee80211_sta_join_ibss(sdata, bssid, sdata->vif.bss_conf.beacon_int,
-                                  ifibss->chandef.chan, ifibss->basic_rates,
+                                  &ifibss->chandef, ifibss->basic_rates,
                                   capability, 0, true);
 }
 
@@ -891,6 +949,17 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                 return;
         }
 
+        /* if a fixed bssid and a fixed freq have been provided create the IBSS
+         * directly and do not waste time scanning
+         */
+        if (ifibss->fixed_bssid && ifibss->fixed_channel) {
+                sdata_info(sdata, "Created IBSS using preconfigured BSSID %pM\n",
+                           bssid);
+                ieee80211_sta_create_ibss(sdata);
+                return;
+        }
+
+
         ibss_dbg(sdata, "sta_find_ibss: did not try to join ibss\n");
 
         /* Selected IBSS not found in current scan results - try to scan */
@@ -1260,6 +1329,7 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
         clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
                                                 BSS_CHANGED_IBSS);
+        ieee80211_vif_release_channel(sdata);
         synchronize_rcu();
         kfree(presp);
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index e94c84050e9c..b6186517ec56 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -53,9 +53,6 @@ struct ieee80211_local;
  * increased memory use (about 2 kB of RAM per entry). */
 #define IEEE80211_FRAGMENT_MAX 4
 
-#define TU_TO_JIFFIES(x)        (usecs_to_jiffies((x) * 1024))
-#define TU_TO_EXP_TIME(x)       (jiffies + TU_TO_JIFFIES(x))
-
 /* power level hasn't been configured (or set to automatic) */
 #define IEEE80211_UNSET_POWER_LEVEL     INT_MIN
 
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 7ca534bf4cea..fcecd633514e 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -308,12 +308,13 @@ static int ieee80211_check_concurrent_iface(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
-static int ieee80211_check_queues(struct ieee80211_sub_if_data *sdata)
+static int ieee80211_check_queues(struct ieee80211_sub_if_data *sdata,
+                                  enum nl80211_iftype iftype)
 {
         int n_queues = sdata->local->hw.queues;
         int i;
 
-        if (sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE) {
+        if (iftype != NL80211_IFTYPE_P2P_DEVICE) {
                 for (i = 0; i < IEEE80211_NUM_ACS; i++) {
                         if (WARN_ON_ONCE(sdata->vif.hw_queue[i] ==
                                          IEEE80211_INVAL_HW_QUEUE))
@@ -324,8 +325,9 @@ static int ieee80211_check_queues(struct ieee80211_sub_if_data *sdata)
                 }
         }
 
-        if ((sdata->vif.type != NL80211_IFTYPE_AP &&
-             sdata->vif.type != NL80211_IFTYPE_MESH_POINT) ||
+        if ((iftype != NL80211_IFTYPE_AP &&
+             iftype != NL80211_IFTYPE_P2P_GO &&
+             iftype != NL80211_IFTYPE_MESH_POINT) ||
             !(sdata->local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)) {
                 sdata->vif.cab_queue = IEEE80211_INVAL_HW_QUEUE;
                 return 0;
@@ -408,7 +410,7 @@ int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
                 return ret;
         }
 
-        ret = ieee80211_check_queues(sdata);
+        ret = ieee80211_check_queues(sdata, NL80211_IFTYPE_MONITOR);
         if (ret) {
                 kfree(sdata);
                 return ret;
@@ -592,7 +594,8 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
                         res = drv_add_interface(local, sdata);
                         if (res)
                                 goto err_stop;
-                        res = ieee80211_check_queues(sdata);
+                        res = ieee80211_check_queues(sdata,
+                                ieee80211_vif_type_p2p(&sdata->vif));
                         if (res)
                                 goto err_del_interface;
                 }
@@ -1389,14 +1392,14 @@ static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,
 
         ret = drv_change_interface(local, sdata, internal_type, p2p);
         if (ret)
-                type = sdata->vif.type;
+                type = ieee80211_vif_type_p2p(&sdata->vif);
 
         /*
          * Ignore return value here, there's not much we can do since
          * the driver changed the interface type internally already.
          * The warnings will hopefully make driver authors fix it :-)
          */
-        ieee80211_check_queues(sdata);
+        ieee80211_check_queues(sdata, type);
 
         ieee80211_setup_sdata(sdata, type);
 
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index e39cc91d0cf1..620677e897bd 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -93,6 +93,9 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
 
         might_sleep();
 
+        if (key->flags & KEY_FLAG_TAINTED)
+                return -EINVAL;
+
         if (!key->local->ops->set_key)
                 goto out_unsupported;
 
@@ -455,6 +458,7 @@ int ieee80211_key_link(struct ieee80211_key *key,
                        struct ieee80211_sub_if_data *sdata,
                        struct sta_info *sta)
 {
+        struct ieee80211_local *local = sdata->local;
         struct ieee80211_key *old_key;
         int idx, ret;
         bool pairwise;
@@ -484,10 +488,13 @@ int ieee80211_key_link(struct ieee80211_key *key,
 
         ieee80211_debugfs_key_add(key);
 
-        ret = ieee80211_key_enable_hw_accel(key);
-
-        if (ret)
-                ieee80211_key_free(key, true);
+        if (!local->wowlan) {
+                ret = ieee80211_key_enable_hw_accel(key);
+                if (ret)
+                        ieee80211_key_free(key, true);
+        } else {
+                ret = 0;
+        }
 
         mutex_unlock(&sdata->local->key_mtx);
 
@@ -540,7 +547,7 @@ void ieee80211_iter_keys(struct ieee80211_hw *hw,
                          void *iter_data)
 {
         struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_key *key;
+        struct ieee80211_key *key, *tmp;
         struct ieee80211_sub_if_data *sdata;
 
         ASSERT_RTNL();
@@ -548,13 +555,14 @@ void ieee80211_iter_keys(struct ieee80211_hw *hw,
         mutex_lock(&local->key_mtx);
         if (vif) {
                 sdata = vif_to_sdata(vif);
-                list_for_each_entry(key, &sdata->key_list, list)
+                list_for_each_entry_safe(key, tmp, &sdata->key_list, list)
                         iter(hw, &sdata->vif,
                              key->sta ? &key->sta->sta : NULL,
                              &key->conf, iter_data);
         } else {
                 list_for_each_entry(sdata, &local->interfaces, list)
-                        list_for_each_entry(key, &sdata->key_list, list)
+                        list_for_each_entry_safe(key, tmp,
+                                                 &sdata->key_list, list)
                                 iter(hw, &sdata->vif,
                                      key->sta ? &key->sta->sta : NULL,
                                      &key->conf, iter_data);
@@ -751,3 +759,135 @@ void ieee80211_get_key_rx_seq(struct ieee80211_key_conf *keyconf,
         }
 }
 EXPORT_SYMBOL(ieee80211_get_key_rx_seq);
+
+void ieee80211_set_key_tx_seq(struct ieee80211_key_conf *keyconf,
+                              struct ieee80211_key_seq *seq)
+{
+        struct ieee80211_key *key;
+        u64 pn64;
+
+        key = container_of(keyconf, struct ieee80211_key, conf);
+
+        switch (key->conf.cipher) {
+        case WLAN_CIPHER_SUITE_TKIP:
+                key->u.tkip.tx.iv32 = seq->tkip.iv32;
+                key->u.tkip.tx.iv16 = seq->tkip.iv16;
+                break;
+        case WLAN_CIPHER_SUITE_CCMP:
+                pn64 = (u64)seq->ccmp.pn[5] |
+                       ((u64)seq->ccmp.pn[4] << 8) |
+                       ((u64)seq->ccmp.pn[3] << 16) |
+                       ((u64)seq->ccmp.pn[2] << 24) |
+                       ((u64)seq->ccmp.pn[1] << 32) |
+                       ((u64)seq->ccmp.pn[0] << 40);
+                atomic64_set(&key->u.ccmp.tx_pn, pn64);
+                break;
+        case WLAN_CIPHER_SUITE_AES_CMAC:
+                pn64 = (u64)seq->aes_cmac.pn[5] |
+                       ((u64)seq->aes_cmac.pn[4] << 8) |
+                       ((u64)seq->aes_cmac.pn[3] << 16) |
+                       ((u64)seq->aes_cmac.pn[2] << 24) |
+                       ((u64)seq->aes_cmac.pn[1] << 32) |
+                       ((u64)seq->aes_cmac.pn[0] << 40);
+                atomic64_set(&key->u.aes_cmac.tx_pn, pn64);
+                break;
+        default:
+                WARN_ON(1);
+                break;
+        }
+}
+EXPORT_SYMBOL_GPL(ieee80211_set_key_tx_seq);
+
+void ieee80211_set_key_rx_seq(struct ieee80211_key_conf *keyconf,
+                              int tid, struct ieee80211_key_seq *seq)
+{
+        struct ieee80211_key *key;
+        u8 *pn;
+
+        key = container_of(keyconf, struct ieee80211_key, conf);
+
+        switch (key->conf.cipher) {
+        case WLAN_CIPHER_SUITE_TKIP:
+                if (WARN_ON(tid < 0 || tid >= IEEE80211_NUM_TIDS))
+                        return;
+                key->u.tkip.rx[tid].iv32 = seq->tkip.iv32;
+                key->u.tkip.rx[tid].iv16 = seq->tkip.iv16;
+                break;
+        case WLAN_CIPHER_SUITE_CCMP:
+                if (WARN_ON(tid < -1 || tid >= IEEE80211_NUM_TIDS))
+                        return;
+                if (tid < 0)
+                        pn = key->u.ccmp.rx_pn[IEEE80211_NUM_TIDS];
+                else
+                        pn = key->u.ccmp.rx_pn[tid];
+                memcpy(pn, seq->ccmp.pn, IEEE80211_CCMP_PN_LEN);
+                break;
+        case WLAN_CIPHER_SUITE_AES_CMAC:
+                if (WARN_ON(tid != 0))
+                        return;
+                pn = key->u.aes_cmac.rx_pn;
+                memcpy(pn, seq->aes_cmac.pn, IEEE80211_CMAC_PN_LEN);
+                break;
+        default:
+                WARN_ON(1);
+                break;
+        }
+}
+EXPORT_SYMBOL_GPL(ieee80211_set_key_rx_seq);
+
+void ieee80211_remove_key(struct ieee80211_key_conf *keyconf)
+{
+        struct ieee80211_key *key;
+
+        key = container_of(keyconf, struct ieee80211_key, conf);
+
+        assert_key_lock(key->local);
+
+        /*
+         * if key was uploaded, we assume the driver will/has remove(d)
+         * it, so adjust bookkeeping accordingly
+         */
+        if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
+                key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
+
+                if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
+                      (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
+                      (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
+                        increment_tailroom_need_count(key->sdata);
+        }
+
+        ieee80211_key_free(key, false);
+}
+EXPORT_SYMBOL_GPL(ieee80211_remove_key);
+
+struct ieee80211_key_conf *
+ieee80211_gtk_rekey_add(struct ieee80211_vif *vif,
+                        struct ieee80211_key_conf *keyconf)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_key *key;
+        int err;
+
+        if (WARN_ON(!local->wowlan))
+                return ERR_PTR(-EINVAL);
+
+        if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
+                return ERR_PTR(-EINVAL);
+
+        key = ieee80211_key_alloc(keyconf->cipher, keyconf->keyidx,
+                                  keyconf->keylen, keyconf->key,
+                                  0, NULL);
+        if (IS_ERR(key))
+                return ERR_PTR(PTR_ERR(key));
+
+        if (sdata->u.mgd.mfp != IEEE80211_MFP_DISABLED)
+                key->conf.flags |= IEEE80211_KEY_FLAG_RX_MGMT;
+
+        err = ieee80211_key_link(key, sdata, NULL);
+        if (err)
+                return ERR_PTR(err);
+
+        return &key->conf;
+}
+EXPORT_SYMBOL_GPL(ieee80211_gtk_rekey_add);
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 25eb35b01938..21d5d44444d0 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -892,9 +892,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         if (!local->ops->remain_on_channel)
                 local->hw.wiphy->max_remain_on_channel_duration = 5000;
 
-        if (local->ops->sched_scan_start)
-                local->hw.wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
-
         /* mac80211 based drivers don't support internal TDLS setup */
         if (local->hw.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS)
                 local->hw.wiphy->flags |= WIPHY_FLAG_TDLS_EXTERNAL_SETUP;
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 885a5f6e2c21..707ac61d63e5 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -832,6 +832,9 @@ ieee80211_mesh_rx_probe_req(struct ieee80211_sub_if_data *sdata,
 
         ieee802_11_parse_elems(pos, len - baselen, false, &elems);
 
+        if (!elems.mesh_id)
+                return;
+
         /* 802.11-2012 10.1.4.3.2 */
         if ((!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
              !is_broadcast_ether_addr(mgmt->da)) ||
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 21bccd849b3f..86e4ad56b573 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1113,6 +1113,15 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         case -1:
                 cfg80211_chandef_create(&new_chandef, new_chan,
                                         NL80211_CHAN_NO_HT);
+                /* keep width for 5/10 MHz channels */
+                switch (sdata->vif.bss_conf.chandef.width) {
+                case NL80211_CHAN_WIDTH_5:
+                case NL80211_CHAN_WIDTH_10:
+                        new_chandef.width = sdata->vif.bss_conf.chandef.width;
+                        break;
+                default:
+                        break;
+                }
                 break;
         }
 
@@ -2852,14 +2861,6 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 ieee80211_rx_bss_put(local, bss);
                 sdata->vif.bss_conf.beacon_rate = bss->beacon_rate;
         }
-
-        if (!sdata->u.mgd.associated ||
-            !ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid))
-                return;
-
-        ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
-                                         elems, true);
-
 }
 
 
@@ -3148,6 +3149,9 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
 
+        ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
+                                         &elems, true);
+
         if (ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
                                      elems.wmm_param_len))
                 changed |= BSS_CHANGED_QOS;
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index ba63ac851c2b..e126605cec66 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -210,7 +210,7 @@ static bool rc_no_data_or_no_ack_use_min(struct ieee80211_tx_rate_control *txrc)
                 !ieee80211_is_data(fc);
 }
 
-static void rc_send_low_broadcast(s8 *idx, u32 basic_rates,
+static void rc_send_low_basicrate(s8 *idx, u32 basic_rates,
                                   struct ieee80211_supported_band *sband)
 {
         u8 i;
@@ -263,28 +263,37 @@ static void __rate_control_send_low(struct ieee80211_hw *hw,
 }
 
 
-bool rate_control_send_low(struct ieee80211_sta *sta,
+bool rate_control_send_low(struct ieee80211_sta *pubsta,
                            void *priv_sta,
                            struct ieee80211_tx_rate_control *txrc)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(txrc->skb);
         struct ieee80211_supported_band *sband = txrc->sband;
+        struct sta_info *sta;
         int mcast_rate;
+        bool use_basicrate = false;
 
-        if (!sta || !priv_sta || rc_no_data_or_no_ack_use_min(txrc)) {
-                __rate_control_send_low(txrc->hw, sband, sta, info);
+        if (!pubsta || !priv_sta || rc_no_data_or_no_ack_use_min(txrc)) {
+                __rate_control_send_low(txrc->hw, sband, pubsta, info);
 
-                if (!sta && txrc->bss) {
+                if (!pubsta && txrc->bss) {
                         mcast_rate = txrc->bss_conf->mcast_rate[sband->band];
                         if (mcast_rate > 0) {
                                 info->control.rates[0].idx = mcast_rate - 1;
                                 return true;
                         }
+                        use_basicrate = true;
+                } else if (pubsta) {
+                        sta = container_of(pubsta, struct sta_info, sta);
+                        if (ieee80211_vif_is_mesh(&sta->sdata->vif))
+                                use_basicrate = true;
+                }
 
-                        rc_send_low_broadcast(&info->control.rates[0].idx,
+                if (use_basicrate)
+                        rc_send_low_basicrate(&info->control.rates[0].idx,
                                               txrc->bss_conf->basic_rates,
                                               sband);
-                }
+
                 return true;
         }
         return false;
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 61569425b723..7c323f27ba23 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -776,7 +776,7 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
 
         /* Don't use EAPOL frames for sampling on non-mrr hw */
         if (mp->hw->max_rates == 1 &&
-            txrc->skb->protocol == cpu_to_be16(ETH_P_PAE))
+            (info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO))
                 sample_idx = -1;
         else
                 sample_idx = minstrel_get_sample_rate(mp, mi);
@@ -828,6 +828,9 @@ minstrel_ht_update_cck(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
         if (sband->band != IEEE80211_BAND_2GHZ)
                 return;
 
+        if (!(mp->hw->flags & IEEE80211_HW_SUPPORTS_HT_CCK_RATES))
+                return;
+
         mi->cck_supported = 0;
         mi->cck_supported_short = 0;
         for (i = 0; i < 4; i++) {
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 6b85f95b9ba1..54395d7583ba 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1055,207 +1055,6 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
 
 
 static ieee80211_rx_result debug_noinline
-ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
-{
-        struct sk_buff *skb = rx->skb;
-        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-        int keyidx;
-        int hdrlen;
-        ieee80211_rx_result result = RX_DROP_UNUSABLE;
-        struct ieee80211_key *sta_ptk = NULL;
-        int mmie_keyidx = -1;
-        __le16 fc;
-
-        /*
-         * Key selection 101
-         *
-         * There are four types of keys:
-         *  - GTK (group keys)
-         *  - IGTK (group keys for management frames)
-         *  - PTK (pairwise keys)
-         *  - STK (station-to-station pairwise keys)
-         *
-         * When selecting a key, we have to distinguish between multicast
-         * (including broadcast) and unicast frames, the latter can only
-         * use PTKs and STKs while the former always use GTKs and IGTKs.
-         * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
-         * unicast frames can also use key indices like GTKs. Hence, if we
-         * don't have a PTK/STK we check the key index for a WEP key.
-         *
-         * Note that in a regular BSS, multicast frames are sent by the
-         * AP only, associated stations unicast the frame to the AP first
-         * which then multicasts it on their behalf.
-         *
-         * There is also a slight problem in IBSS mode: GTKs are negotiated
-         * with each station, that is something we don't currently handle.
-         * The spec seems to expect that one negotiates the same key with
-         * every station but there's no such requirement; VLANs could be
-         * possible.
-         */
-
-        /*
-         * No point in finding a key and decrypting if the frame is neither
-         * addressed to us nor a multicast frame.
-         */
-        if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
-                return RX_CONTINUE;
-
-        /* start without a key */
-        rx->key = NULL;
-
-        if (rx->sta)
-                sta_ptk = rcu_dereference(rx->sta->ptk);
-
-        fc = hdr->frame_control;
-
-        if (!ieee80211_has_protected(fc))
-                mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
-
-        if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
-                rx->key = sta_ptk;
-                if ((status->flag & RX_FLAG_DECRYPTED) &&
-                    (status->flag & RX_FLAG_IV_STRIPPED))
-                        return RX_CONTINUE;
-                /* Skip decryption if the frame is not protected. */
-                if (!ieee80211_has_protected(fc))
-                        return RX_CONTINUE;
-        } else if (mmie_keyidx >= 0) {
-                /* Broadcast/multicast robust management frame / BIP */
-                if ((status->flag & RX_FLAG_DECRYPTED) &&
-                    (status->flag & RX_FLAG_IV_STRIPPED))
-                        return RX_CONTINUE;
-
-                if (mmie_keyidx < NUM_DEFAULT_KEYS ||
-                    mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
-                        return RX_DROP_MONITOR; /* unexpected BIP keyidx */
-                if (rx->sta)
-                        rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
-                if (!rx->key)
-                        rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
-        } else if (!ieee80211_has_protected(fc)) {
-                /*
-                 * The frame was not protected, so skip decryption. However, we
-                 * need to set rx->key if there is a key that could have been
-                 * used so that the frame may be dropped if encryption would
-                 * have been expected.
-                 */
-                struct ieee80211_key *key = NULL;
-                struct ieee80211_sub_if_data *sdata = rx->sdata;
-                int i;
-
-                if (ieee80211_is_mgmt(fc) &&
-                    is_multicast_ether_addr(hdr->addr1) &&
-                    (key = rcu_dereference(rx->sdata->default_mgmt_key)))
-                        rx->key = key;
-                else {
-                        if (rx->sta) {
-                                for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
-                                        key = rcu_dereference(rx->sta->gtk[i]);
-                                        if (key)
-                                                break;
-                                }
-                        }
-                        if (!key) {
-                                for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
-                                        key = rcu_dereference(sdata->keys[i]);
-                                        if (key)
-                                                break;
-                                }
-                        }
-                        if (key)
-                                rx->key = key;
-                }
-                return RX_CONTINUE;
-        } else {
-                u8 keyid;
-                /*
-                 * The device doesn't give us the IV so we won't be
-                 * able to look up the key. That's ok though, we
-                 * don't need to decrypt the frame, we just won't
-                 * be able to keep statistics accurate.
-                 * Except for key threshold notifications, should
-                 * we somehow allow the driver to tell us which key
-                 * the hardware used if this flag is set?
-                 */
-                if ((status->flag & RX_FLAG_DECRYPTED) &&
-                    (status->flag & RX_FLAG_IV_STRIPPED))
-                        return RX_CONTINUE;
-
-                hdrlen = ieee80211_hdrlen(fc);
-
-                if (rx->skb->len < 8 + hdrlen)
-                        return RX_DROP_UNUSABLE; /* TODO: count this? */
-
-                /*
-                 * no need to call ieee80211_wep_get_keyidx,
-                 * it verifies a bunch of things we've done already
-                 */
-                skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
-                keyidx = keyid >> 6;
-
-                /* check per-station GTK first, if multicast packet */
-                if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
-                        rx->key = rcu_dereference(rx->sta->gtk[keyidx]);
-
-                /* if not found, try default key */
-                if (!rx->key) {
-                        rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
-
-                        /*
-                         * RSNA-protected unicast frames should always be
-                         * sent with pairwise or station-to-station keys,
-                         * but for WEP we allow using a key index as well.
-                         */
-                        if (rx->key &&
-                            rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
-                            rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
-                            !is_multicast_ether_addr(hdr->addr1))
-                                rx->key = NULL;
-                }
-        }
-
-        if (rx->key) {
-                if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
-                        return RX_DROP_MONITOR;
-
-                rx->key->tx_rx_count++;
-                /* TODO: add threshold stuff again */
-        } else {
-                return RX_DROP_MONITOR;
-        }
-
-        switch (rx->key->conf.cipher) {
-        case WLAN_CIPHER_SUITE_WEP40:
-        case WLAN_CIPHER_SUITE_WEP104:
-                result = ieee80211_crypto_wep_decrypt(rx);
-                break;
-        case WLAN_CIPHER_SUITE_TKIP:
-                result = ieee80211_crypto_tkip_decrypt(rx);
-                break;
-        case WLAN_CIPHER_SUITE_CCMP:
-                result = ieee80211_crypto_ccmp_decrypt(rx);
-                break;
-        case WLAN_CIPHER_SUITE_AES_CMAC:
-                result = ieee80211_crypto_aes_cmac_decrypt(rx);
-                break;
-        default:
-                /*
-                 * We can reach here only with HW-only algorithms
-                 * but why didn't it decrypt the frame?!
-                 */
-                return RX_DROP_UNUSABLE;
-        }
-
-        /* the hdr variable is invalid after the decrypt handlers */
-
-        /* either the frame has been decrypted or will be dropped */
-        status->flag |= RX_FLAG_DECRYPTED;
-
-        return result;
-}
-
-static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_local *local;
@@ -1556,6 +1355,207 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
         return RX_CONTINUE;
 } /* ieee80211_rx_h_sta_process */
 
+static ieee80211_rx_result debug_noinline
+ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
+{
+        struct sk_buff *skb = rx->skb;
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        int keyidx;
+        int hdrlen;
+        ieee80211_rx_result result = RX_DROP_UNUSABLE;
+        struct ieee80211_key *sta_ptk = NULL;
+        int mmie_keyidx = -1;
+        __le16 fc;
+
+        /*
+         * Key selection 101
+         *
+         * There are four types of keys:
+         *  - GTK (group keys)
+         *  - IGTK (group keys for management frames)
+         *  - PTK (pairwise keys)
+         *  - STK (station-to-station pairwise keys)
+         *
+         * When selecting a key, we have to distinguish between multicast
+         * (including broadcast) and unicast frames, the latter can only
+         * use PTKs and STKs while the former always use GTKs and IGTKs.
+         * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
+         * unicast frames can also use key indices like GTKs. Hence, if we
+         * don't have a PTK/STK we check the key index for a WEP key.
+         *
+         * Note that in a regular BSS, multicast frames are sent by the
+         * AP only, associated stations unicast the frame to the AP first
+         * which then multicasts it on their behalf.
+         *
+         * There is also a slight problem in IBSS mode: GTKs are negotiated
+         * with each station, that is something we don't currently handle.
+         * The spec seems to expect that one negotiates the same key with
+         * every station but there's no such requirement; VLANs could be
+         * possible.
+         */
+
+        /*
+         * No point in finding a key and decrypting if the frame is neither
+         * addressed to us nor a multicast frame.
+         */
+        if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
+                return RX_CONTINUE;
+
+        /* start without a key */
+        rx->key = NULL;
+
+        if (rx->sta)
+                sta_ptk = rcu_dereference(rx->sta->ptk);
+
+        fc = hdr->frame_control;
+
+        if (!ieee80211_has_protected(fc))
+                mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
+
+        if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
+                rx->key = sta_ptk;
+                if ((status->flag & RX_FLAG_DECRYPTED) &&
+                    (status->flag & RX_FLAG_IV_STRIPPED))
+                        return RX_CONTINUE;
+                /* Skip decryption if the frame is not protected. */
+                if (!ieee80211_has_protected(fc))
+                        return RX_CONTINUE;
+        } else if (mmie_keyidx >= 0) {
+                /* Broadcast/multicast robust management frame / BIP */
+                if ((status->flag & RX_FLAG_DECRYPTED) &&
+                    (status->flag & RX_FLAG_IV_STRIPPED))
+                        return RX_CONTINUE;
+
+                if (mmie_keyidx < NUM_DEFAULT_KEYS ||
+                    mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
+                        return RX_DROP_MONITOR; /* unexpected BIP keyidx */
+                if (rx->sta)
+                        rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
+                if (!rx->key)
+                        rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
+        } else if (!ieee80211_has_protected(fc)) {
+                /*
+                 * The frame was not protected, so skip decryption. However, we
+                 * need to set rx->key if there is a key that could have been
+                 * used so that the frame may be dropped if encryption would
+                 * have been expected.
+                 */
+                struct ieee80211_key *key = NULL;
+                struct ieee80211_sub_if_data *sdata = rx->sdata;
+                int i;
+
+                if (ieee80211_is_mgmt(fc) &&
+                    is_multicast_ether_addr(hdr->addr1) &&
+                    (key = rcu_dereference(rx->sdata->default_mgmt_key)))
+                        rx->key = key;
+                else {
+                        if (rx->sta) {
+                                for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
+                                        key = rcu_dereference(rx->sta->gtk[i]);
+                                        if (key)
+                                                break;
+                                }
+                        }
+                        if (!key) {
+                                for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
+                                        key = rcu_dereference(sdata->keys[i]);
+                                        if (key)
+                                                break;
+                                }
+                        }
+                        if (key)
+                                rx->key = key;
+                }
+                return RX_CONTINUE;
+        } else {
+                u8 keyid;
+                /*
+                 * The device doesn't give us the IV so we won't be
+                 * able to look up the key. That's ok though, we
+                 * don't need to decrypt the frame, we just won't
+                 * be able to keep statistics accurate.
+                 * Except for key threshold notifications, should
+                 * we somehow allow the driver to tell us which key
+                 * the hardware used if this flag is set?
+                 */
+                if ((status->flag & RX_FLAG_DECRYPTED) &&
+                    (status->flag & RX_FLAG_IV_STRIPPED))
+                        return RX_CONTINUE;
+
+                hdrlen = ieee80211_hdrlen(fc);
+
+                if (rx->skb->len < 8 + hdrlen)
+                        return RX_DROP_UNUSABLE; /* TODO: count this? */
+
+                /*
+                 * no need to call ieee80211_wep_get_keyidx,
+                 * it verifies a bunch of things we've done already
+                 */
+                skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
+                keyidx = keyid >> 6;
+
+                /* check per-station GTK first, if multicast packet */
+                if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
+                        rx->key = rcu_dereference(rx->sta->gtk[keyidx]);
+
+                /* if not found, try default key */
+                if (!rx->key) {
+                        rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
+
+                        /*
+                         * RSNA-protected unicast frames should always be
+                         * sent with pairwise or station-to-station keys,
+                         * but for WEP we allow using a key index as well.
+                         */
+                        if (rx->key &&
+                            rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
+                            rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
+                            !is_multicast_ether_addr(hdr->addr1))
+                                rx->key = NULL;
+                }
+        }
+
+        if (rx->key) {
+                if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
+                        return RX_DROP_MONITOR;
+
+                rx->key->tx_rx_count++;
+                /* TODO: add threshold stuff again */
+        } else {
+                return RX_DROP_MONITOR;
+        }
+
+        switch (rx->key->conf.cipher) {
+        case WLAN_CIPHER_SUITE_WEP40:
+        case WLAN_CIPHER_SUITE_WEP104:
+                result = ieee80211_crypto_wep_decrypt(rx);
+                break;
+        case WLAN_CIPHER_SUITE_TKIP:
+                result = ieee80211_crypto_tkip_decrypt(rx);
+                break;
+        case WLAN_CIPHER_SUITE_CCMP:
+                result = ieee80211_crypto_ccmp_decrypt(rx);
+                break;
+        case WLAN_CIPHER_SUITE_AES_CMAC:
+                result = ieee80211_crypto_aes_cmac_decrypt(rx);
+                break;
+        default:
+                /*
+                 * We can reach here only with HW-only algorithms
+                 * but why didn't it decrypt the frame?!
+                 */
+                return RX_DROP_UNUSABLE;
+        }
+
+        /* the hdr variable is invalid after the decrypt handlers */
+
+        /* either the frame has been decrypted or will be dropped */
+        status->flag |= RX_FLAG_DECRYPTED;
+
+        return result;
+}
+
 static inline struct ieee80211_fragment_entry *
 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
                          unsigned int frag, unsigned int seq, int rx_queue,
@@ -2684,8 +2684,7 @@ ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
                 sig = status->signal;
 
         if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig,
-                             rx->skb->data, rx->skb->len,
-                             GFP_ATOMIC)) {
+                             rx->skb->data, rx->skb->len, 0, GFP_ATOMIC)) {
                 if (rx->sta)
                         rx->sta->rx_packets++;
                 dev_kfree_skb(rx->skb);
@@ -2939,10 +2938,10 @@ static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
                  */
                 rx->skb = skb;
 
-                CALL_RXH(ieee80211_rx_h_decrypt)
                 CALL_RXH(ieee80211_rx_h_check_more_data)
                 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll)
                 CALL_RXH(ieee80211_rx_h_sta_process)
+                CALL_RXH(ieee80211_rx_h_decrypt)
                 CALL_RXH(ieee80211_rx_h_defragment)
                 CALL_RXH(ieee80211_rx_h_michael_mic_verify)
                 /* must be after MMIC verify so header is counted in MPDU mic */
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 0e42322aa6b1..3456c0486b48 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -539,9 +539,11 @@ ieee80211_tx_h_check_control_port_protocol(struct ieee80211_tx_data *tx)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
 
-        if (unlikely(tx->sdata->control_port_protocol == tx->skb->protocol &&
-                     tx->sdata->control_port_no_encrypt))
-                info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        if (unlikely(tx->sdata->control_port_protocol == tx->skb->protocol)) {
+                if (tx->sdata->control_port_no_encrypt)
+                        info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+                info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
+        }
 
         return TX_CONTINUE;
 }
@@ -779,9 +781,11 @@ ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
         /*
          * Anything but QoS data that has a sequence number field
          * (is long enough) gets a sequence number from the global
-         * counter.
+         * counter.  QoS data frames with a multicast destination
+         * also use the global counter (802.11-2012 9.3.2.10).
          */
-        if (!ieee80211_is_data_qos(hdr->frame_control)) {
+        if (!ieee80211_is_data_qos(hdr->frame_control) ||
+            is_multicast_ether_addr(hdr->addr1)) {
                 /* driver should assign sequence number */
                 info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
                 /* for pure STA mode without beacons, we can do it */
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index d23c5a705a68..e1b34a18b243 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1453,8 +1453,8 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 local->resuming = true;
 
         if (local->wowlan) {
-                local->wowlan = false;
                 res = drv_resume(local);
+                local->wowlan = false;
                 if (res < 0) {
                         local->resuming = false;
                         return res;
diff --git a/net/nfc/core.c b/net/nfc/core.c
index 1d074dd1650f..e92923cf3e03 100644
--- a/net/nfc/core.c
+++ b/net/nfc/core.c
@@ -77,11 +77,19 @@ error:
         return rc;
 }
 
-int nfc_fw_download_done(struct nfc_dev *dev, const char *firmware_name)
+/**
+ * nfc_fw_download_done - inform that a firmware download was completed
+ *
+ * @dev: The nfc device to which firmware was downloaded
+ * @firmware_name: The firmware filename
+ * @result: The positive value of a standard errno value
+ */
+int nfc_fw_download_done(struct nfc_dev *dev, const char *firmware_name,
+                         u32 result)
 {
         dev->fw_download_in_progress = false;
 
-        return nfc_genl_fw_download_done(dev, firmware_name);
+        return nfc_genl_fw_download_done(dev, firmware_name, result);
 }
 EXPORT_SYMBOL(nfc_fw_download_done);
 
@@ -129,7 +137,7 @@ int nfc_dev_up(struct nfc_dev *dev)
         /* We have to enable the device before discovering SEs */
         if (dev->ops->discover_se) {
                 rc = dev->ops->discover_se(dev);
-                if (!rc)
+                if (rc)
                         pr_warn("SE discovery failed\n");
         }
 
@@ -575,12 +583,14 @@ int nfc_enable_se(struct nfc_dev *dev, u32 se_idx)
                 goto error;
         }
 
-        if (se->type == NFC_SE_ENABLED) {
+        if (se->state == NFC_SE_ENABLED) {
                 rc = -EALREADY;
                 goto error;
         }
 
         rc = dev->ops->enable_se(dev, se_idx);
+        if (rc >= 0)
+                se->state = NFC_SE_ENABLED;
 
 error:
         device_unlock(&dev->dev);
@@ -618,12 +628,14 @@ int nfc_disable_se(struct nfc_dev *dev, u32 se_idx)
                 goto error;
         }
 
-        if (se->type == NFC_SE_DISABLED) {
+        if (se->state == NFC_SE_DISABLED) {
                 rc = -EALREADY;
                 goto error;
         }
 
         rc = dev->ops->disable_se(dev, se_idx);
+        if (rc >= 0)
+                se->state = NFC_SE_DISABLED;
 
 error:
         device_unlock(&dev->dev);
diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c
index fe66908401f5..d07ca4c5cf8c 100644
--- a/net/nfc/hci/core.c
+++ b/net/nfc/hci/core.c
@@ -717,7 +717,7 @@ static int hci_disable_se(struct nfc_dev *nfc_dev, u32 se_idx)
         struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
 
         if (hdev->ops->disable_se)
-                return hdev->ops->enable_se(hdev, se_idx);
+                return hdev->ops->disable_se(hdev, se_idx);
 
         return 0;
 }
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index f16fd59d4160..68063b2025da 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -1114,7 +1114,8 @@ static int nfc_genl_fw_download(struct sk_buff *skb, struct genl_info *info)
         return rc;
 }
 
-int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name)
+int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name,
+                              u32 result)
 {
         struct sk_buff *msg;
         void *hdr;
@@ -1129,6 +1130,7 @@ int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name)
                 goto free_msg;
 
         if (nla_put_string(msg, NFC_ATTR_FIRMWARE_NAME, firmware_name) ||
+            nla_put_u32(msg, NFC_ATTR_FIRMWARE_DOWNLOAD_STATUS, result) ||
             nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx))
                 goto nla_put_failure;
 
@@ -1191,6 +1193,91 @@ static int nfc_genl_disable_se(struct sk_buff *skb, struct genl_info *info)
         return rc;
 }
 
+static int nfc_genl_send_se(struct sk_buff *msg, struct nfc_dev *dev,
+                                u32 portid, u32 seq,
+                                struct netlink_callback *cb,
+                                int flags)
+{
+        void *hdr;
+        struct nfc_se *se, *n;
+
+        list_for_each_entry_safe(se, n, &dev->secure_elements, list) {
+                hdr = genlmsg_put(msg, portid, seq, &nfc_genl_family, flags,
+                                  NFC_CMD_GET_SE);
+                if (!hdr)
+                        goto nla_put_failure;
+
+                if (cb)
+                        genl_dump_check_consistent(cb, hdr, &nfc_genl_family);
+
+                if (nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx) ||
+                    nla_put_u32(msg, NFC_ATTR_SE_INDEX, se->idx) ||
+                    nla_put_u8(msg, NFC_ATTR_SE_TYPE, se->type))
+                        goto nla_put_failure;
+
+                if (genlmsg_end(msg, hdr) < 0)
+                        goto nla_put_failure;
+        }
+
+        return 0;
+
+nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        return -EMSGSIZE;
+}
+
+static int nfc_genl_dump_ses(struct sk_buff *skb,
+                                 struct netlink_callback *cb)
+{
+        struct class_dev_iter *iter = (struct class_dev_iter *) cb->args[0];
+        struct nfc_dev *dev = (struct nfc_dev *) cb->args[1];
+        bool first_call = false;
+
+        if (!iter) {
+                first_call = true;
+                iter = kmalloc(sizeof(struct class_dev_iter), GFP_KERNEL);
+                if (!iter)
+                        return -ENOMEM;
+                cb->args[0] = (long) iter;
+        }
+
+        mutex_lock(&nfc_devlist_mutex);
+
+        cb->seq = nfc_devlist_generation;
+
+        if (first_call) {
+                nfc_device_iter_init(iter);
+                dev = nfc_device_iter_next(iter);
+        }
+
+        while (dev) {
+                int rc;
+
+                rc = nfc_genl_send_se(skb, dev, NETLINK_CB(cb->skb).portid,
+                                          cb->nlh->nlmsg_seq, cb, NLM_F_MULTI);
+                if (rc < 0)
+                        break;
+
+                dev = nfc_device_iter_next(iter);
+        }
+
+        mutex_unlock(&nfc_devlist_mutex);
+
+        cb->args[1] = (long) dev;
+
+        return skb->len;
+}
+
+static int nfc_genl_dump_ses_done(struct netlink_callback *cb)
+{
+        struct class_dev_iter *iter = (struct class_dev_iter *) cb->args[0];
+
+        nfc_device_iter_exit(iter);
+        kfree(iter);
+
+        return 0;
+}
+
 static struct genl_ops nfc_genl_ops[] = {
         {
                 .cmd = NFC_CMD_GET_DEVICE,
@@ -1265,6 +1352,12 @@ static struct genl_ops nfc_genl_ops[] = {
                 .doit = nfc_genl_disable_se,
                 .policy = nfc_genl_policy,
         },
+        {
+                .cmd = NFC_CMD_GET_SE,
+                .dumpit = nfc_genl_dump_ses,
+                .done = nfc_genl_dump_ses_done,
+                .policy = nfc_genl_policy,
+        },
 };
 
 
diff --git a/net/nfc/nfc.h b/net/nfc/nfc.h
index 820a7850c36a..aaf606fc1faa 100644
--- a/net/nfc/nfc.h
+++ b/net/nfc/nfc.h
@@ -124,9 +124,8 @@ static inline void nfc_device_iter_exit(struct class_dev_iter *iter)
 }
 
 int nfc_fw_download(struct nfc_dev *dev, const char *firmware_name);
-int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name);
-
-int nfc_fw_download_done(struct nfc_dev *dev, const char *firmware_name);
+int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name,
+                              u32 result);
 
 int nfc_dev_up(struct nfc_dev *dev);
 
diff --git a/net/openvswitch/vport-gre.c b/net/openvswitch/vport-gre.c
index 21d5073e148e..c99dea543d64 100644
--- a/net/openvswitch/vport-gre.c
+++ b/net/openvswitch/vport-gre.c
@@ -176,10 +176,10 @@ static int gre_tnl_send(struct vport *vport, struct sk_buff *skb)
 
         skb->local_df = 1;
 
-        return iptunnel_xmit(net, rt, skb, fl.saddr,
+        return iptunnel_xmit(rt, skb, fl.saddr,
                              OVS_CB(skb)->tun_key->ipv4_dst, IPPROTO_GRE,
                              OVS_CB(skb)->tun_key->ipv4_tos,
-                             OVS_CB(skb)->tun_key->ipv4_ttl, df);
+                             OVS_CB(skb)->tun_key->ipv4_ttl, df, false);
 err_free_rt:
         ip_rt_put(rt);
 error:
diff --git a/net/openvswitch/vport-vxlan.c b/net/openvswitch/vport-vxlan.c
index a0060245b4e1..a481c03e2861 100644
--- a/net/openvswitch/vport-vxlan.c
+++ b/net/openvswitch/vport-vxlan.c
@@ -176,7 +176,7 @@ static int vxlan_tnl_send(struct vport *vport, struct sk_buff *skb)
         inet_get_local_port_range(&port_min, &port_max);
         src_port = vxlan_src_port(port_min, port_max, skb);
 
-        err = vxlan_xmit_skb(net, vxlan_port->vs, rt, skb,
+        err = vxlan_xmit_skb(vxlan_port->vs, rt, skb,
                              fl.saddr, OVS_CB(skb)->tun_key->ipv4_dst,
                              OVS_CB(skb)->tun_key->ipv4_tos,
                              OVS_CB(skb)->tun_key->ipv4_ttl, df,
diff --git a/net/rfkill/rfkill-regulator.c b/net/rfkill/rfkill-regulator.c
index d11ac79246e4..cf5b145902e5 100644
--- a/net/rfkill/rfkill-regulator.c
+++ b/net/rfkill/rfkill-regulator.c
@@ -30,6 +30,7 @@ struct rfkill_regulator_data {
 static int rfkill_regulator_set_block(void *data, bool blocked)
 {
         struct rfkill_regulator_data *rfkill_data = data;
+        int ret = 0;
 
         pr_debug("%s: blocked: %d\n", __func__, blocked);
 
@@ -40,15 +41,16 @@ static int rfkill_regulator_set_block(void *data, bool blocked)
                 }
         } else {
                 if (!rfkill_data->reg_enabled) {
-                        regulator_enable(rfkill_data->vcc);
-                        rfkill_data->reg_enabled = true;
+                        ret = regulator_enable(rfkill_data->vcc);
+                        if (!ret)
+                                rfkill_data->reg_enabled = true;
                 }
         }
 
         pr_debug("%s: regulator_is_enabled after set_block: %d\n", __func__,
                 regulator_is_enabled(rfkill_data->vcc));
 
-        return 0;
+        return ret;
 }
 
 static struct rfkill_ops rfkill_regulator_ops = {
diff --git a/net/sctp/probe.c b/net/sctp/probe.c
index cd72ae57aff1..53c452efb40b 100644
--- a/net/sctp/probe.c
+++ b/net/sctp/probe.c
@@ -46,6 +46,10 @@ static int port __read_mostly = 0;
 MODULE_PARM_DESC(port, "Port to match (0=all)");
 module_param(port, int, 0);
 
+static unsigned int fwmark __read_mostly = 0;
+MODULE_PARM_DESC(fwmark, "skb mark to match (0=no mark)");
+module_param(fwmark, uint, 0);
+
 static int bufsize __read_mostly = 64 * 1024;
 MODULE_PARM_DESC(bufsize, "Log buffer size (default 64k)");
 module_param(bufsize, int, 0);
@@ -129,15 +133,19 @@ static sctp_disposition_t jsctp_sf_eat_sack(struct net *net,
                                             void *arg,
                                             sctp_cmd_seq_t *commands)
 {
+        struct sctp_chunk *chunk = arg;
+        struct sk_buff *skb = chunk->skb;
         struct sctp_transport *sp;
         static __u32 lcwnd = 0;
         struct timespec now;
 
         sp = asoc->peer.primary_path;
 
-        if ((full || sp->cwnd != lcwnd) &&
-            (!port || asoc->peer.port == port ||
-             ep->base.bind_addr.port == port)) {
+        if (((port == 0 && fwmark == 0) ||
+             asoc->peer.port == port ||
+             ep->base.bind_addr.port == port ||
+             (fwmark > 0 && skb->mark == fwmark)) &&
+            (full || sp->cwnd != lcwnd)) {
                 lcwnd = sp->cwnd;
 
                 getnstimeofday(&now);
@@ -198,8 +206,8 @@ static __init int sctpprobe_init(void)
         if (ret)
                 goto remove_proc;
 
-        pr_info("probe registered (port=%d)\n", port);
-
+        pr_info("probe registered (port=%d/fwmark=%u) bufsize=%u\n",
+                port, fwmark, bufsize);
         return 0;
 
 remove_proc:
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index bfac5e186f57..8d49c1ce3dea 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -621,7 +621,7 @@ int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
 }
 
 bool cfg80211_rx_mgmt(struct wireless_dev *wdev, int freq, int sig_mbm,
-                      const u8 *buf, size_t len, gfp_t gfp)
+                      const u8 *buf, size_t len, u32 flags, gfp_t gfp)
 {
         struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
@@ -664,7 +664,7 @@ bool cfg80211_rx_mgmt(struct wireless_dev *wdev, int freq, int sig_mbm,
                 /* Indicate the received Action frame to user space */
                 if (nl80211_send_mgmt(rdev, wdev, reg->nlportid,
                                       freq, sig_mbm,
-                                      buf, len, gfp))
+                                      buf, len, flags, gfp))
                         continue;
 
                 result = true;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 170c0abd2a01..af8d84a4a5b2 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -6593,19 +6593,30 @@ static struct genl_multicast_group nl80211_testmode_mcgrp = {
 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct wireless_dev *wdev =
+                __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
         int err;
 
+        if (!rdev->ops->testmode_cmd)
+                return -EOPNOTSUPP;
+
+        if (IS_ERR(wdev)) {
+                err = PTR_ERR(wdev);
+                if (err != -EINVAL)
+                        return err;
+                wdev = NULL;
+        } else if (wdev->wiphy != &rdev->wiphy) {
+                return -EINVAL;
+        }
+
         if (!info->attrs[NL80211_ATTR_TESTDATA])
                 return -EINVAL;
 
-        err = -EOPNOTSUPP;
-        if (rdev->ops->testmode_cmd) {
-                rdev->testmode_info = info;
-                err = rdev_testmode_cmd(rdev,
+        rdev->testmode_info = info;
+        err = rdev_testmode_cmd(rdev, wdev,
                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
-                rdev->testmode_info = NULL;
-        }
+        rdev->testmode_info = NULL;
 
         return err;
 }
@@ -7567,14 +7578,12 @@ static int nl80211_set_cqm_txe(struct genl_info *info,
                                u32 rate, u32 pkts, u32 intvl)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
-        struct wireless_dev *wdev;
         struct net_device *dev = info->user_ptr[1];
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
 
         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
                 return -EINVAL;
 
-        wdev = dev->ieee80211_ptr;
-
         if (!rdev->ops->set_cqm_txe_config)
                 return -EOPNOTSUPP;
 
@@ -7589,13 +7598,15 @@ static int nl80211_set_cqm_rssi(struct genl_info *info,
                                 s32 threshold, u32 hysteresis)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
-        struct wireless_dev *wdev;
         struct net_device *dev = info->user_ptr[1];
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
 
         if (threshold > 0)
                 return -EINVAL;
 
-        wdev = dev->ieee80211_ptr;
+        /* disabling - hysteresis should also be zero then */
+        if (threshold == 0)
+                hysteresis = 0;
 
         if (!rdev->ops->set_cqm_rssi_config)
                 return -EOPNOTSUPP;
@@ -7614,36 +7625,33 @@ static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
         int err;
 
         cqm = info->attrs[NL80211_ATTR_CQM];
-        if (!cqm) {
-                err = -EINVAL;
-                goto out;
-        }
+        if (!cqm)
+                return -EINVAL;
 
         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
                                nl80211_attr_cqm_policy);
         if (err)
-                goto out;
+                return err;
 
         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
-                s32 threshold;
-                u32 hysteresis;
-                threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
-                hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
-                err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
-        } else if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
-                   attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
-                   attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
-                u32 rate, pkts, intvl;
-                rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
-                pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
-                intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
-                err = nl80211_set_cqm_txe(info, rate, pkts, intvl);
-        } else
-                err = -EINVAL;
+                s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
+                u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
 
-out:
-        return err;
+                return nl80211_set_cqm_rssi(info, threshold, hysteresis);
+        }
+
+        if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
+            attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
+            attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
+                u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
+                u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
+                u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
+
+                return nl80211_set_cqm_txe(info, rate, pkts, intvl);
+        }
+
+        return -EINVAL;
 }
 
 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
@@ -10442,7 +10450,7 @@ EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
                       struct wireless_dev *wdev, u32 nlportid,
                       int freq, int sig_dbm,
-                      const u8 *buf, size_t len, gfp_t gfp)
+                      const u8 *buf, size_t len, u32 flags, gfp_t gfp)
 {
         struct net_device *netdev = wdev->netdev;
         struct sk_buff *msg;
@@ -10465,7 +10473,9 @@ int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
             (sig_dbm &&
              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
-            nla_put(msg, NL80211_ATTR_FRAME, len, buf))
+            nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
+            (flags &&
+             nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
                 goto nla_put_failure;
 
         genlmsg_end(msg, hdr);
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index 44341bf53cfc..2c0f2b3c07cb 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -66,7 +66,7 @@ void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
                       struct wireless_dev *wdev, u32 nlpid,
                       int freq, int sig_dbm,
-                      const u8 *buf, size_t len, gfp_t gfp);
+                      const u8 *buf, size_t len, u32 flags, gfp_t gfp);
 
 void
 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
index de870d4d0bcc..37ce9fdfe934 100644
--- a/net/wireless/rdev-ops.h
+++ b/net/wireless/rdev-ops.h
@@ -516,11 +516,12 @@ static inline void rdev_rfkill_poll(struct cfg80211_registered_device *rdev)
 
 #ifdef CONFIG_NL80211_TESTMODE
 static inline int rdev_testmode_cmd(struct cfg80211_registered_device *rdev,
+                                    struct wireless_dev *wdev,
                                     void *data, int len)
 {
         int ret;
-        trace_rdev_testmode_cmd(&rdev->wiphy);
-        ret = rdev->ops->testmode_cmd(&rdev->wiphy, data, len);
+        trace_rdev_testmode_cmd(&rdev->wiphy, wdev);
+        ret = rdev->ops->testmode_cmd(&rdev->wiphy, wdev, data, len);
         trace_rdev_return_int(&rdev->wiphy, ret);
         return ret;
 }
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index ad1e4068ce06..eeb71480f1af 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -465,10 +465,6 @@ static int cmp_bss(struct cfg80211_bss *a,
                 }
         }
 
-        /*
-         * we can't use compare_ether_addr here since we need a < > operator.
-         * The binary return value of compare_ether_addr isn't enough
-         */
         r = memcmp(a->bssid, b->bssid, sizeof(a->bssid));
         if (r)
                 return r;
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index f0ebdcd394ef..ba5f0d6614d5 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -1293,15 +1293,17 @@ TRACE_EVENT(rdev_return_int_int,
 
 #ifdef CONFIG_NL80211_TESTMODE
 TRACE_EVENT(rdev_testmode_cmd,
-        TP_PROTO(struct wiphy *wiphy),
-        TP_ARGS(wiphy),
+        TP_PROTO(struct wiphy *wiphy, struct wireless_dev *wdev),
+        TP_ARGS(wiphy, wdev),
         TP_STRUCT__entry(
                 WIPHY_ENTRY
+                WDEV_ENTRY
         ),
         TP_fast_assign(
                 WIPHY_ASSIGN;
+                WDEV_ASSIGN;
         ),
-        TP_printk(WIPHY_PR_FMT, WIPHY_PR_ARG)
+        TP_printk(WIPHY_PR_FMT WDEV_PR_FMT, WIPHY_PR_ARG, WDEV_PR_ARG)
 );
 
 TRACE_EVENT(rdev_testmode_dump,
diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
index 66c638730c7a..b8253250d723 100644
--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -156,6 +156,8 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                         case X25_FAC_CALLING_AE:
                                 if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1)
                                         return -1;
+                                if (p[2] > X25_MAX_AE_LEN)
+                                        return -1;
                                 dte_facs->calling_len = p[2];
                                 memcpy(dte_facs->calling_ae, &p[3], p[1] - 1);
                                 *vc_fac_mask |= X25_MASK_CALLING_AE;
@@ -163,6 +165,8 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                         case X25_FAC_CALLED_AE:
                                 if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1)
                                         return -1;
+                                if (p[2] > X25_MAX_AE_LEN)
+                                        return -1;
                                 dte_facs->called_len = p[2];
                                 memcpy(dte_facs->called_ae, &p[3], p[1] - 1);
                                 *vc_fac_mask |= X25_MASK_CALLED_AE;