270 files changed, 17069 insertions, 10641 deletions

diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 56000b33340b..dec901554ef7 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -249,15 +249,6 @@ Who:	Ravikiran Thirumalai <kiran@scalex86.org>
 
 ---------------------------
 
-What:   Code that is now under CONFIG_WIRELESS_EXT_SYSFS
-        (in net/core/net-sysfs.c)
-When:   3.5
-Why:    Over 1K .text/.data size reduction, data is available in other
-        ways (ioctls)
-Who:    Johannes Berg <johannes@sipsolutions.net>
-
----------------------------
-
 What:   sysfs ui for changing p4-clockmod parameters
 When:   September 2009
 Why:    See commits 129f8ae9b1b5be94517da76009ea956e89104ce8 and
@@ -449,6 +440,19 @@ Who:	Hans Verkuil <hans.verkuil@cisco.com>
 
 ----------------------------
 
+What:   CONFIG_CFG80211_WEXT
+When:   as soon as distributions ship new wireless tools, ie. wpa_supplicant 1.0
+        and NetworkManager/connman/etc. that are able to use nl80211
+Why:    Wireless extensions are deprecated, and userland tools are moving to
+        using nl80211. New drivers are no longer using wireless extensions,
+        and while there might still be old drivers, both new drivers and new
+        userland no longer needs them and they can't be used for an feature
+        developed in the past couple of years. As such, compatibility with
+        wireless extensions in new drivers will be removed.
+Who:    Johannes Berg <johannes@sipsolutions.net>
+
+----------------------------
+
 What:   g_file_storage driver
 When:   3.8
 Why:    This driver has been superseded by g_mass_storage.
diff --git a/MAINTAINERS b/MAINTAINERS
index 03660de94cf7..3075a2a29511 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -329,7 +329,7 @@ F:	drivers/hwmon/adm1029.c
 
 ADM8211 WIRELESS DRIVER
 L:      linux-wireless@vger.kernel.org
-W:      http://linuxwireless.org/
+W:      http://wireless.kernel.org/
 S:      Orphan
 F:      drivers/net/wireless/adm8211.*
 
@@ -1423,7 +1423,7 @@ B43 WIRELESS DRIVER
 M:      Stefano Brivio <stefano.brivio@polimi.it>
 L:      linux-wireless@vger.kernel.org
 L:      b43-dev@lists.infradead.org
-W:      http://linuxwireless.org/en/users/Drivers/b43
+W:      http://wireless.kernel.org/en/users/Drivers/b43
 S:      Maintained
 F:      drivers/net/wireless/b43/
 
@@ -1432,7 +1432,7 @@ M:	Larry Finger <Larry.Finger@lwfinger.net>
 M:      Stefano Brivio <stefano.brivio@polimi.it>
 L:      linux-wireless@vger.kernel.org
 L:      b43-dev@lists.infradead.org
-W:      http://linuxwireless.org/en/users/Drivers/b43
+W:      http://wireless.kernel.org/en/users/Drivers/b43
 S:      Maintained
 F:      drivers/net/wireless/b43legacy/
 
@@ -4342,7 +4342,7 @@ F:	arch/m68k/hp300/
 MAC80211
 M:      Johannes Berg <johannes@sipsolutions.net>
 L:      linux-wireless@vger.kernel.org
-W:      http://linuxwireless.org/
+W:      http://wireless.kernel.org/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211.git
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next.git
 S:      Maintained
@@ -4354,7 +4354,7 @@ MAC80211 PID RATE CONTROL
 M:      Stefano Brivio <stefano.brivio@polimi.it>
 M:      Mattias Nissler <mattias.nissler@gmx.de>
 L:      linux-wireless@vger.kernel.org
-W:      http://linuxwireless.org/en/developers/Documentation/mac80211/RateControl/PID
+W:      http://wireless.kernel.org/en/developers/Documentation/mac80211/RateControl/PID
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211.git
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next.git
 S:      Maintained
@@ -5032,7 +5032,7 @@ F:	fs/ocfs2/
 
 ORINOCO DRIVER
 L:      linux-wireless@vger.kernel.org
-W:      http://linuxwireless.org/en/users/Drivers/orinoco
+W:      http://wireless.kernel.org/en/users/Drivers/orinoco
 W:      http://www.nongnu.org/orinoco/
 S:      Orphan
 F:      drivers/net/wireless/orinoco/
@@ -5737,7 +5737,7 @@ F:	net/rose/
 RTL8180 WIRELESS DRIVER
 M:      "John W. Linville" <linville@tuxdriver.com>
 L:      linux-wireless@vger.kernel.org
-W:      http://linuxwireless.org/
+W:      http://wireless.kernel.org/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-testing.git
 S:      Maintained
 F:      drivers/net/wireless/rtl818x/rtl8180/
@@ -5747,7 +5747,7 @@ M:	Herton Ronaldo Krzesinski <herton@canonical.com>
 M:      Hin-Tak Leung <htl10@users.sourceforge.net>
 M:      Larry Finger <Larry.Finger@lwfinger.net>
 L:      linux-wireless@vger.kernel.org
-W:      http://linuxwireless.org/
+W:      http://wireless.kernel.org/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-testing.git
 S:      Maintained
 F:      drivers/net/wireless/rtl818x/rtl8187/
@@ -5756,7 +5756,7 @@ RTL8192CE WIRELESS DRIVER
 M:      Larry Finger <Larry.Finger@lwfinger.net>
 M:      Chaoming Li <chaoming_li@realsil.com.cn>
 L:      linux-wireless@vger.kernel.org
-W:      http://linuxwireless.org/
+W:      http://wireless.kernel.org/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-testing.git
 S:      Maintained
 F:      drivers/net/wireless/rtlwifi/
diff --git a/drivers/bluetooth/bluecard_cs.c b/drivers/bluetooth/bluecard_cs.c
index 1fcd92380356..585c88e01893 100644
--- a/drivers/bluetooth/bluecard_cs.c
+++ b/drivers/bluetooth/bluecard_cs.c
@@ -231,12 +231,12 @@ static void bluecard_write_wakeup(bluecard_info_t *info)
         }
 
         do {
-                register unsigned int iobase = info->p_dev->resource[0]->start;
-                register unsigned int offset;
-                register unsigned char command;
-                register unsigned long ready_bit;
+                unsigned int iobase = info->p_dev->resource[0]->start;
+                unsigned int offset;
+                unsigned char command;
+                unsigned long ready_bit;
                 register struct sk_buff *skb;
-                register int len;
+                int len;
 
                 clear_bit(XMIT_WAKEUP, &(info->tx_state));
 
diff --git a/drivers/bluetooth/bpa10x.c b/drivers/bluetooth/bpa10x.c
index 609861a53c28..29caaed2d715 100644
--- a/drivers/bluetooth/bpa10x.c
+++ b/drivers/bluetooth/bpa10x.c
@@ -470,7 +470,7 @@ static int bpa10x_probe(struct usb_interface *intf, const struct usb_device_id *
         hdev->flush    = bpa10x_flush;
         hdev->send     = bpa10x_send_frame;
 
-        set_bit(HCI_QUIRK_NO_RESET, &hdev->quirks);
+        set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
 
         err = hci_register_dev(hdev);
         if (err < 0) {
diff --git a/drivers/bluetooth/bt3c_cs.c b/drivers/bluetooth/bt3c_cs.c
index 308c8599ab55..b2b0fbbb43b5 100644
--- a/drivers/bluetooth/bt3c_cs.c
+++ b/drivers/bluetooth/bt3c_cs.c
@@ -186,9 +186,9 @@ static void bt3c_write_wakeup(bt3c_info_t *info)
                 return;
 
         do {
-                register unsigned int iobase = info->p_dev->resource[0]->start;
+                unsigned int iobase = info->p_dev->resource[0]->start;
                 register struct sk_buff *skb;
-                register int len;
+                int len;
 
                 if (!pcmcia_dev_present(info->p_dev))
                         break;
diff --git a/drivers/bluetooth/btmrvl_sdio.c b/drivers/bluetooth/btmrvl_sdio.c
index a853244e7fd7..2867499f7256 100644
--- a/drivers/bluetooth/btmrvl_sdio.c
+++ b/drivers/bluetooth/btmrvl_sdio.c
@@ -110,6 +110,9 @@ static const struct sdio_device_id btmrvl_sdio_ids[] = {
         /* Marvell SD8787 Bluetooth device */
         { SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL, 0x911A),
                         .driver_data = (unsigned long) &btmrvl_sdio_sd8787 },
+        /* Marvell SD8787 Bluetooth AMP device */
+        { SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL, 0x911B),
+                        .driver_data = (unsigned long) &btmrvl_sdio_sd8787 },
         /* Marvell SD8797 Bluetooth device */
         { SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL, 0x912A),
                         .driver_data = (unsigned long) &btmrvl_sdio_sd8797 },
diff --git a/drivers/bluetooth/btuart_cs.c b/drivers/bluetooth/btuart_cs.c
index c4fc2f3fc32c..65b8d996840c 100644
--- a/drivers/bluetooth/btuart_cs.c
+++ b/drivers/bluetooth/btuart_cs.c
@@ -140,9 +140,9 @@ static void btuart_write_wakeup(btuart_info_t *info)
         }
 
         do {
-                register unsigned int iobase = info->p_dev->resource[0]->start;
+                unsigned int iobase = info->p_dev->resource[0]->start;
                 register struct sk_buff *skb;
-                register int len;
+                int len;
 
                 clear_bit(XMIT_WAKEUP, &(info->tx_state));
 
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index c9463af8e564..a45e717f5f84 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -21,15 +21,7 @@
  *
  */
 
-#include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/init.h>
-#include <linux/slab.h>
-#include <linux/types.h>
-#include <linux/sched.h>
-#include <linux/errno.h>
-#include <linux/skbuff.h>
-
 #include <linux/usb.h>
 
 #include <net/bluetooth/bluetooth.h>
@@ -1026,7 +1018,7 @@ static int btusb_probe(struct usb_interface *intf,
         data->isoc = usb_ifnum_to_if(data->udev, 1);
 
         if (!reset)
-                set_bit(HCI_QUIRK_NO_RESET, &hdev->quirks);
+                set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
 
         if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
                 if (!disable_scofix)
@@ -1038,7 +1030,7 @@ static int btusb_probe(struct usb_interface *intf,
 
         if (id->driver_info & BTUSB_DIGIANSWER) {
                 data->cmdreq_type = USB_TYPE_VENDOR;
-                set_bit(HCI_QUIRK_NO_RESET, &hdev->quirks);
+                set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
         }
 
         if (id->driver_info & BTUSB_CSR) {
@@ -1046,7 +1038,7 @@ static int btusb_probe(struct usb_interface *intf,
 
                 /* Old firmware would otherwise execute USB reset */
                 if (le16_to_cpu(udev->descriptor.bcdDevice) < 0x117)
-                        set_bit(HCI_QUIRK_NO_RESET, &hdev->quirks);
+                        set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
         }
 
         if (id->driver_info & BTUSB_SNIFFER) {
diff --git a/drivers/bluetooth/dtl1_cs.c b/drivers/bluetooth/dtl1_cs.c
index 6e8d96189684..b1b37ccd3cd4 100644
--- a/drivers/bluetooth/dtl1_cs.c
+++ b/drivers/bluetooth/dtl1_cs.c
@@ -144,9 +144,9 @@ static void dtl1_write_wakeup(dtl1_info_t *info)
         }
 
         do {
-                register unsigned int iobase = info->p_dev->resource[0]->start;
+                unsigned int iobase = info->p_dev->resource[0]->start;
                 register struct sk_buff *skb;
-                register int len;
+                int len;
 
                 clear_bit(XMIT_WAKEUP, &(info->tx_state));
 
diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
index 661a8dc4d2f8..57e502e06080 100644
--- a/drivers/bluetooth/hci_bcsp.c
+++ b/drivers/bluetooth/hci_bcsp.c
@@ -552,7 +552,7 @@ static u16 bscp_get_crc(struct bcsp_struct *bcsp)
 static int bcsp_recv(struct hci_uart *hu, void *data, int count)
 {
         struct bcsp_struct *bcsp = hu->priv;
-        register unsigned char *ptr;
+        unsigned char *ptr;
 
         BT_DBG("hu %p count %d rx_state %d rx_count %ld", 
                 hu, count, bcsp->rx_state, bcsp->rx_count);
diff --git a/drivers/bluetooth/hci_h4.c b/drivers/bluetooth/hci_h4.c
index 748329468d26..c60623f206d4 100644
--- a/drivers/bluetooth/hci_h4.c
+++ b/drivers/bluetooth/hci_h4.c
@@ -126,7 +126,7 @@ static int h4_enqueue(struct hci_uart *hu, struct sk_buff *skb)
 
 static inline int h4_check_data_len(struct h4_struct *h4, int len)
 {
-        register int room = skb_tailroom(h4->rx_skb);
+        int room = skb_tailroom(h4->rx_skb);
 
         BT_DBG("len %d room %d", len, room);
 
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index e564579a6115..2f9b796e106e 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -394,7 +394,7 @@ static int hci_uart_register_dev(struct hci_uart *hu)
                 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
 
         if (!test_bit(HCI_UART_RESET_ON_INIT, &hu->hdev_flags))
-                set_bit(HCI_QUIRK_NO_RESET, &hdev->quirks);
+                set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
 
         if (test_bit(HCI_UART_CREATE_AMP, &hu->hdev_flags))
                 hdev->dev_type = HCI_AMP;
diff --git a/drivers/bluetooth/hci_ll.c b/drivers/bluetooth/hci_ll.c
index b874c0efde24..ff6d589c34a5 100644
--- a/drivers/bluetooth/hci_ll.c
+++ b/drivers/bluetooth/hci_ll.c
@@ -348,7 +348,7 @@ static int ll_enqueue(struct hci_uart *hu, struct sk_buff *skb)
 
 static inline int ll_check_data_len(struct ll_struct *ll, int len)
 {
-        register int room = skb_tailroom(ll->rx_skb);
+        int room = skb_tailroom(ll->rx_skb);
 
         BT_DBG("len %d room %d", len, room);
 
@@ -374,11 +374,11 @@ static inline int ll_check_data_len(struct ll_struct *ll, int len)
 static int ll_recv(struct hci_uart *hu, void *data, int count)
 {
         struct ll_struct *ll = hu->priv;
-        register char *ptr;
+        char *ptr;
         struct hci_event_hdr *eh;
         struct hci_acl_hdr   *ah;
         struct hci_sco_hdr   *sh;
-        register int len, type, dlen;
+        int len, type, dlen;
 
         BT_DBG("hu %p count %d rx_state %ld rx_count %ld", hu, count, ll->rx_state, ll->rx_count);
 
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index b869a358ce43..f27e9732951d 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -2585,35 +2585,6 @@ static int ath6kl_set_ies(struct ath6kl_vif *vif,
         return 0;
 }
 
-static int ath6kl_set_channel(struct wiphy *wiphy, struct net_device *dev,
-                              struct ieee80211_channel *chan,
-                              enum nl80211_channel_type channel_type)
-{
-        struct ath6kl_vif *vif;
-
-        /*
-         * 'dev' could be NULL if a channel change is required for the hardware
-         * device itself, instead of a particular VIF.
-         *
-         * FIXME: To be handled properly when monitor mode is supported.
-         */
-        if (!dev)
-                return -EBUSY;
-
-        vif = netdev_priv(dev);
-
-        if (!ath6kl_cfg80211_ready(vif))
-                return -EIO;
-
-        ath6kl_dbg(ATH6KL_DBG_WLAN_CFG, "%s: center_freq=%u hw_value=%u\n",
-                   __func__, chan->center_freq, chan->hw_value);
-        vif->next_chan = chan->center_freq;
-        vif->next_ch_type = channel_type;
-        vif->next_ch_band = chan->band;
-
-        return 0;
-}
-
 static int ath6kl_get_rsn_capab(struct cfg80211_beacon_data *beacon,
                                 u8 *rsn_capab)
 {
@@ -2791,7 +2762,7 @@ static int ath6kl_start_ap(struct wiphy *wiphy, struct net_device *dev,
         p.ssid_len = vif->ssid_len;
         memcpy(p.ssid, vif->ssid, vif->ssid_len);
         p.dot11_auth_mode = vif->dot11_auth_mode;
-        p.ch = cpu_to_le16(vif->next_chan);
+        p.ch = cpu_to_le16(info->channel->center_freq);
 
         /* Enable uAPSD support by default */
         res = ath6kl_wmi_ap_set_apsd(ar->wmi, vif->fw_vif_idx, true);
@@ -2815,8 +2786,8 @@ static int ath6kl_start_ap(struct wiphy *wiphy, struct net_device *dev,
                         return res;
         }
 
-        if (ath6kl_set_htcap(vif, vif->next_ch_band,
-                             vif->next_ch_type != NL80211_CHAN_NO_HT))
+        if (ath6kl_set_htcap(vif, info->channel->band,
+                             info->channel_type != NL80211_CHAN_NO_HT))
                 return -EIO;
 
         /*
@@ -3271,7 +3242,6 @@ static struct cfg80211_ops ath6kl_cfg80211_ops = {
         .suspend = __ath6kl_cfg80211_suspend,
         .resume = __ath6kl_cfg80211_resume,
 #endif
-        .set_channel = ath6kl_set_channel,
         .start_ap = ath6kl_start_ap,
         .change_beacon = ath6kl_change_beacon,
         .stop_ap = ath6kl_stop_ap,
diff --git a/drivers/net/wireless/ath/ath6kl/core.h b/drivers/net/wireless/ath/ath6kl/core.h
index 4d9c6f142698..8443b2a4133e 100644
--- a/drivers/net/wireless/ath/ath6kl/core.h
+++ b/drivers/net/wireless/ath/ath6kl/core.h
@@ -553,9 +553,6 @@ struct ath6kl_vif {
         u32 last_cancel_roc_id;
         u32 send_action_id;
         bool probe_req_report;
-        u16 next_chan;
-        enum nl80211_channel_type next_ch_type;
-        enum ieee80211_band next_ch_band;
         u16 assoc_bss_beacon_int;
         u16 listen_intvl_t;
         u16 bmiss_time_t;
diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c
index e5524470529c..b836f2795114 100644
--- a/drivers/net/wireless/ath/ath6kl/main.c
+++ b/drivers/net/wireless/ath/ath6kl/main.c
@@ -598,7 +598,6 @@ static int ath6kl_commit_ch_switch(struct ath6kl_vif *vif, u16 channel)
 
         struct ath6kl *ar = vif->ar;
 
-        vif->next_chan = channel;
         vif->profile.ch = cpu_to_le16(channel);
 
         switch (vif->nw_type) {
diff --git a/drivers/net/wireless/ath/ath9k/Makefile b/drivers/net/wireless/ath/ath9k/Makefile
index 3f0b84723789..9c41232b0cd0 100644
--- a/drivers/net/wireless/ath/ath9k/Makefile
+++ b/drivers/net/wireless/ath/ath9k/Makefile
@@ -3,7 +3,9 @@ ath9k-y +=	beacon.o \
                 init.o \
                 main.o \
                 recv.o \
-                xmit.o
+                xmit.o \
+                link.o \
+                antenna.o
 
 ath9k-$(CONFIG_ATH9K_BTCOEX_SUPPORT) += mci.o
 ath9k-$(CONFIG_ATH9K_RATE_CONTROL) += rc.o
diff --git a/drivers/net/wireless/ath/ath9k/ahb.c b/drivers/net/wireless/ath/ath9k/ahb.c
index 5e47ca6d16a8..4a4e8a2b9d2c 100644
--- a/drivers/net/wireless/ath/ath9k/ahb.c
+++ b/drivers/net/wireless/ath/ath9k/ahb.c
@@ -126,7 +126,7 @@ static int ath_ahb_probe(struct platform_device *pdev)
         sc->irq = irq;
 
         /* Will be cleared in ath9k_start() */
-        sc->sc_flags |= SC_OP_INVALID;
+        set_bit(SC_OP_INVALID, &sc->sc_flags);
 
         ret = request_irq(irq, ath_isr, IRQF_SHARED, "ath9k", sc);
         if (ret) {
diff --git a/drivers/net/wireless/ath/ath9k/antenna.c b/drivers/net/wireless/ath/ath9k/antenna.c
new file mode 100644
index 000000000000..bbcfeb3b2a60
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/antenna.c
@@ -0,0 +1,776 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "ath9k.h"
+
+static inline bool ath_is_alt_ant_ratio_better(int alt_ratio, int maxdelta,
+                                               int mindelta, int main_rssi_avg,
+                                               int alt_rssi_avg, int pkt_count)
+{
+        return (((alt_ratio >= ATH_ANT_DIV_COMB_ALT_ANT_RATIO2) &&
+                 (alt_rssi_avg > main_rssi_avg + maxdelta)) ||
+                (alt_rssi_avg > main_rssi_avg + mindelta)) && (pkt_count > 50);
+}
+
+static inline bool ath_ant_div_comb_alt_check(u8 div_group, int alt_ratio,
+                                              int curr_main_set, int curr_alt_set,
+                                              int alt_rssi_avg, int main_rssi_avg)
+{
+        bool result = false;
+        switch (div_group) {
+        case 0:
+                if (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO)
+                        result = true;
+                break;
+        case 1:
+        case 2:
+                if ((((curr_main_set == ATH_ANT_DIV_COMB_LNA2) &&
+                      (curr_alt_set == ATH_ANT_DIV_COMB_LNA1) &&
+                      (alt_rssi_avg >= (main_rssi_avg - 5))) ||
+                     ((curr_main_set == ATH_ANT_DIV_COMB_LNA1) &&
+                      (curr_alt_set == ATH_ANT_DIV_COMB_LNA2) &&
+                      (alt_rssi_avg >= (main_rssi_avg - 2)))) &&
+                    (alt_rssi_avg >= 4))
+                        result = true;
+                else
+                        result = false;
+                break;
+        }
+
+        return result;
+}
+
+static void ath_lnaconf_alt_good_scan(struct ath_ant_comb *antcomb,
+                                      struct ath_hw_antcomb_conf ant_conf,
+                                      int main_rssi_avg)
+{
+        antcomb->quick_scan_cnt = 0;
+
+        if (ant_conf.main_lna_conf == ATH_ANT_DIV_COMB_LNA2)
+                antcomb->rssi_lna2 = main_rssi_avg;
+        else if (ant_conf.main_lna_conf == ATH_ANT_DIV_COMB_LNA1)
+                antcomb->rssi_lna1 = main_rssi_avg;
+
+        switch ((ant_conf.main_lna_conf << 4) | ant_conf.alt_lna_conf) {
+        case 0x10: /* LNA2 A-B */
+                antcomb->main_conf = ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                antcomb->first_quick_scan_conf =
+                        ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                antcomb->second_quick_scan_conf = ATH_ANT_DIV_COMB_LNA1;
+                break;
+        case 0x20: /* LNA1 A-B */
+                antcomb->main_conf = ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                antcomb->first_quick_scan_conf =
+                        ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                antcomb->second_quick_scan_conf = ATH_ANT_DIV_COMB_LNA2;
+                break;
+        case 0x21: /* LNA1 LNA2 */
+                antcomb->main_conf = ATH_ANT_DIV_COMB_LNA2;
+                antcomb->first_quick_scan_conf =
+                        ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                antcomb->second_quick_scan_conf =
+                        ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                break;
+        case 0x12: /* LNA2 LNA1 */
+                antcomb->main_conf = ATH_ANT_DIV_COMB_LNA1;
+                antcomb->first_quick_scan_conf =
+                        ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                antcomb->second_quick_scan_conf =
+                        ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                break;
+        case 0x13: /* LNA2 A+B */
+                antcomb->main_conf = ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                antcomb->first_quick_scan_conf =
+                        ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                antcomb->second_quick_scan_conf = ATH_ANT_DIV_COMB_LNA1;
+                break;
+        case 0x23: /* LNA1 A+B */
+                antcomb->main_conf = ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                antcomb->first_quick_scan_conf =
+                        ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                antcomb->second_quick_scan_conf = ATH_ANT_DIV_COMB_LNA2;
+                break;
+        default:
+                break;
+        }
+}
+
+static void ath_select_ant_div_from_quick_scan(struct ath_ant_comb *antcomb,
+                                       struct ath_hw_antcomb_conf *div_ant_conf,
+                                       int main_rssi_avg, int alt_rssi_avg,
+                                       int alt_ratio)
+{
+        /* alt_good */
+        switch (antcomb->quick_scan_cnt) {
+        case 0:
+                /* set alt to main, and alt to first conf */
+                div_ant_conf->main_lna_conf = antcomb->main_conf;
+                div_ant_conf->alt_lna_conf = antcomb->first_quick_scan_conf;
+                break;
+        case 1:
+                /* set alt to main, and alt to first conf */
+                div_ant_conf->main_lna_conf = antcomb->main_conf;
+                div_ant_conf->alt_lna_conf = antcomb->second_quick_scan_conf;
+                antcomb->rssi_first = main_rssi_avg;
+                antcomb->rssi_second = alt_rssi_avg;
+
+                if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA1) {
+                        /* main is LNA1 */
+                        if (ath_is_alt_ant_ratio_better(alt_ratio,
+                                                ATH_ANT_DIV_COMB_LNA1_DELTA_HI,
+                                                ATH_ANT_DIV_COMB_LNA1_DELTA_LOW,
+                                                main_rssi_avg, alt_rssi_avg,
+                                                antcomb->total_pkt_count))
+                                antcomb->first_ratio = true;
+                        else
+                                antcomb->first_ratio = false;
+                } else if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA2) {
+                        if (ath_is_alt_ant_ratio_better(alt_ratio,
+                                                ATH_ANT_DIV_COMB_LNA1_DELTA_MID,
+                                                ATH_ANT_DIV_COMB_LNA1_DELTA_LOW,
+                                                main_rssi_avg, alt_rssi_avg,
+                                                antcomb->total_pkt_count))
+                                antcomb->first_ratio = true;
+                        else
+                                antcomb->first_ratio = false;
+                } else {
+                        if ((((alt_ratio >= ATH_ANT_DIV_COMB_ALT_ANT_RATIO2) &&
+                              (alt_rssi_avg > main_rssi_avg +
+                               ATH_ANT_DIV_COMB_LNA1_DELTA_HI)) ||
+                             (alt_rssi_avg > main_rssi_avg)) &&
+                            (antcomb->total_pkt_count > 50))
+                                antcomb->first_ratio = true;
+                        else
+                                antcomb->first_ratio = false;
+                }
+                break;
+        case 2:
+                antcomb->alt_good = false;
+                antcomb->scan_not_start = false;
+                antcomb->scan = false;
+                antcomb->rssi_first = main_rssi_avg;
+                antcomb->rssi_third = alt_rssi_avg;
+
+                if (antcomb->second_quick_scan_conf == ATH_ANT_DIV_COMB_LNA1)
+                        antcomb->rssi_lna1 = alt_rssi_avg;
+                else if (antcomb->second_quick_scan_conf ==
+                         ATH_ANT_DIV_COMB_LNA2)
+                        antcomb->rssi_lna2 = alt_rssi_avg;
+                else if (antcomb->second_quick_scan_conf ==
+                         ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2) {
+                        if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA2)
+                                antcomb->rssi_lna2 = main_rssi_avg;
+                        else if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA1)
+                                antcomb->rssi_lna1 = main_rssi_avg;
+                }
+
+                if (antcomb->rssi_lna2 > antcomb->rssi_lna1 +
+                    ATH_ANT_DIV_COMB_LNA1_LNA2_SWITCH_DELTA)
+                        div_ant_conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA2;
+                else
+                        div_ant_conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA1;
+
+                if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA1) {
+                        if (ath_is_alt_ant_ratio_better(alt_ratio,
+                                                ATH_ANT_DIV_COMB_LNA1_DELTA_HI,
+                                                ATH_ANT_DIV_COMB_LNA1_DELTA_LOW,
+                                                main_rssi_avg, alt_rssi_avg,
+                                                antcomb->total_pkt_count))
+                                antcomb->second_ratio = true;
+                        else
+                                antcomb->second_ratio = false;
+                } else if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA2) {
+                        if (ath_is_alt_ant_ratio_better(alt_ratio,
+                                                ATH_ANT_DIV_COMB_LNA1_DELTA_MID,
+                                                ATH_ANT_DIV_COMB_LNA1_DELTA_LOW,
+                                                main_rssi_avg, alt_rssi_avg,
+                                                antcomb->total_pkt_count))
+                                antcomb->second_ratio = true;
+                        else
+                                antcomb->second_ratio = false;
+                } else {
+                        if ((((alt_ratio >= ATH_ANT_DIV_COMB_ALT_ANT_RATIO2) &&
+                              (alt_rssi_avg > main_rssi_avg +
+                               ATH_ANT_DIV_COMB_LNA1_DELTA_HI)) ||
+                             (alt_rssi_avg > main_rssi_avg)) &&
+                            (antcomb->total_pkt_count > 50))
+                                antcomb->second_ratio = true;
+                        else
+                                antcomb->second_ratio = false;
+                }
+
+                /* set alt to the conf with maximun ratio */
+                if (antcomb->first_ratio && antcomb->second_ratio) {
+                        if (antcomb->rssi_second > antcomb->rssi_third) {
+                                /* first alt*/
+                                if ((antcomb->first_quick_scan_conf ==
+                                    ATH_ANT_DIV_COMB_LNA1) ||
+                                    (antcomb->first_quick_scan_conf ==
+                                    ATH_ANT_DIV_COMB_LNA2))
+                                        /* Set alt LNA1 or LNA2*/
+                                        if (div_ant_conf->main_lna_conf ==
+                                            ATH_ANT_DIV_COMB_LNA2)
+                                                div_ant_conf->alt_lna_conf =
+                                                        ATH_ANT_DIV_COMB_LNA1;
+                                        else
+                                                div_ant_conf->alt_lna_conf =
+                                                        ATH_ANT_DIV_COMB_LNA2;
+                                else
+                                        /* Set alt to A+B or A-B */
+                                        div_ant_conf->alt_lna_conf =
+                                                antcomb->first_quick_scan_conf;
+                        } else if ((antcomb->second_quick_scan_conf ==
+                                   ATH_ANT_DIV_COMB_LNA1) ||
+                                   (antcomb->second_quick_scan_conf ==
+                                   ATH_ANT_DIV_COMB_LNA2)) {
+                                /* Set alt LNA1 or LNA2 */
+                                if (div_ant_conf->main_lna_conf ==
+                                    ATH_ANT_DIV_COMB_LNA2)
+                                        div_ant_conf->alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                                else
+                                        div_ant_conf->alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                        } else {
+                                /* Set alt to A+B or A-B */
+                                div_ant_conf->alt_lna_conf =
+                                        antcomb->second_quick_scan_conf;
+                        }
+                } else if (antcomb->first_ratio) {
+                        /* first alt */
+                        if ((antcomb->first_quick_scan_conf ==
+                            ATH_ANT_DIV_COMB_LNA1) ||
+                            (antcomb->first_quick_scan_conf ==
+                            ATH_ANT_DIV_COMB_LNA2))
+                                        /* Set alt LNA1 or LNA2 */
+                                if (div_ant_conf->main_lna_conf ==
+                                    ATH_ANT_DIV_COMB_LNA2)
+                                        div_ant_conf->alt_lna_conf =
+                                                        ATH_ANT_DIV_COMB_LNA1;
+                                else
+                                        div_ant_conf->alt_lna_conf =
+                                                        ATH_ANT_DIV_COMB_LNA2;
+                        else
+                                /* Set alt to A+B or A-B */
+                                div_ant_conf->alt_lna_conf =
+                                                antcomb->first_quick_scan_conf;
+                } else if (antcomb->second_ratio) {
+                                /* second alt */
+                        if ((antcomb->second_quick_scan_conf ==
+                            ATH_ANT_DIV_COMB_LNA1) ||
+                            (antcomb->second_quick_scan_conf ==
+                            ATH_ANT_DIV_COMB_LNA2))
+                                /* Set alt LNA1 or LNA2 */
+                                if (div_ant_conf->main_lna_conf ==
+                                    ATH_ANT_DIV_COMB_LNA2)
+                                        div_ant_conf->alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                                else
+                                        div_ant_conf->alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                        else
+                                /* Set alt to A+B or A-B */
+                                div_ant_conf->alt_lna_conf =
+                                                antcomb->second_quick_scan_conf;
+                } else {
+                        /* main is largest */
+                        if ((antcomb->main_conf == ATH_ANT_DIV_COMB_LNA1) ||
+                            (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA2))
+                                /* Set alt LNA1 or LNA2 */
+                                if (div_ant_conf->main_lna_conf ==
+                                    ATH_ANT_DIV_COMB_LNA2)
+                                        div_ant_conf->alt_lna_conf =
+                                                        ATH_ANT_DIV_COMB_LNA1;
+                                else
+                                        div_ant_conf->alt_lna_conf =
+                                                        ATH_ANT_DIV_COMB_LNA2;
+                        else
+                                /* Set alt to A+B or A-B */
+                                div_ant_conf->alt_lna_conf = antcomb->main_conf;
+                }
+                break;
+        default:
+                break;
+        }
+}
+
+static void ath_ant_div_conf_fast_divbias(struct ath_hw_antcomb_conf *ant_conf,
+                                          struct ath_ant_comb *antcomb,
+                                          int alt_ratio)
+{
+        if (ant_conf->div_group == 0) {
+                /* Adjust the fast_div_bias based on main and alt lna conf */
+                switch ((ant_conf->main_lna_conf << 4) |
+                                ant_conf->alt_lna_conf) {
+                case 0x01: /* A-B LNA2 */
+                        ant_conf->fast_div_bias = 0x3b;
+                        break;
+                case 0x02: /* A-B LNA1 */
+                        ant_conf->fast_div_bias = 0x3d;
+                        break;
+                case 0x03: /* A-B A+B */
+                        ant_conf->fast_div_bias = 0x1;
+                        break;
+                case 0x10: /* LNA2 A-B */
+                        ant_conf->fast_div_bias = 0x7;
+                        break;
+                case 0x12: /* LNA2 LNA1 */
+                        ant_conf->fast_div_bias = 0x2;
+                        break;
+                case 0x13: /* LNA2 A+B */
+                        ant_conf->fast_div_bias = 0x7;
+                        break;
+                case 0x20: /* LNA1 A-B */
+                        ant_conf->fast_div_bias = 0x6;
+                        break;
+                case 0x21: /* LNA1 LNA2 */
+                        ant_conf->fast_div_bias = 0x0;
+                        break;
+                case 0x23: /* LNA1 A+B */
+                        ant_conf->fast_div_bias = 0x6;
+                        break;
+                case 0x30: /* A+B A-B */
+                        ant_conf->fast_div_bias = 0x1;
+                        break;
+                case 0x31: /* A+B LNA2 */
+                        ant_conf->fast_div_bias = 0x3b;
+                        break;
+                case 0x32: /* A+B LNA1 */
+                        ant_conf->fast_div_bias = 0x3d;
+                        break;
+                default:
+                        break;
+                }
+        } else if (ant_conf->div_group == 1) {
+                /* Adjust the fast_div_bias based on main and alt_lna_conf */
+                switch ((ant_conf->main_lna_conf << 4) |
+                        ant_conf->alt_lna_conf) {
+                case 0x01: /* A-B LNA2 */
+                        ant_conf->fast_div_bias = 0x1;
+                        ant_conf->main_gaintb = 0;
+                        ant_conf->alt_gaintb = 0;
+                        break;
+                case 0x02: /* A-B LNA1 */
+                        ant_conf->fast_div_bias = 0x1;
+                        ant_conf->main_gaintb = 0;
+                        ant_conf->alt_gaintb = 0;
+                        break;
+                case 0x03: /* A-B A+B */
+                        ant_conf->fast_div_bias = 0x1;
+                        ant_conf->main_gaintb = 0;
+                        ant_conf->alt_gaintb = 0;
+                        break;
+                case 0x10: /* LNA2 A-B */
+                        if (!(antcomb->scan) &&
+                            (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO))
+                                ant_conf->fast_div_bias = 0x3f;
+                        else
+                                ant_conf->fast_div_bias = 0x1;
+                        ant_conf->main_gaintb = 0;
+                        ant_conf->alt_gaintb = 0;
+                        break;
+                case 0x12: /* LNA2 LNA1 */
+                        ant_conf->fast_div_bias = 0x1;
+                        ant_conf->main_gaintb = 0;
+                        ant_conf->alt_gaintb = 0;
+                        break;
+                case 0x13: /* LNA2 A+B */
+                        if (!(antcomb->scan) &&
+                            (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO))
+                                ant_conf->fast_div_bias = 0x3f;
+                        else
+                                ant_conf->fast_div_bias = 0x1;
+                        ant_conf->main_gaintb = 0;
+                        ant_conf->alt_gaintb = 0;
+                        break;
+                case 0x20: /* LNA1 A-B */
+                        if (!(antcomb->scan) &&
+                            (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO))
+                                ant_conf->fast_div_bias = 0x3f;
+                        else
+                                ant_conf->fast_div_bias = 0x1;
+                        ant_conf->main_gaintb = 0;
+                        ant_conf->alt_gaintb = 0;
+                        break;
+                case 0x21: /* LNA1 LNA2 */
+                        ant_conf->fast_div_bias = 0x1;
+                        ant_conf->main_gaintb = 0;
+                        ant_conf->alt_gaintb = 0;
+                        break;
+                case 0x23: /* LNA1 A+B */
+                        if (!(antcomb->scan) &&
+                            (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO))
+                                ant_conf->fast_div_bias = 0x3f;
+                        else
+                                ant_conf->fast_div_bias = 0x1;
+                        ant_conf->main_gaintb = 0;
+                        ant_conf->alt_gaintb = 0;
+                        break;
+                case 0x30: /* A+B A-B */
+                        ant_conf->fast_div_bias = 0x1;
+                        ant_conf->main_gaintb = 0;
+                        ant_conf->alt_gaintb = 0;
+                        break;
+                case 0x31: /* A+B LNA2 */
+                        ant_conf->fast_div_bias = 0x1;
+                        ant_conf->main_gaintb = 0;
+                        ant_conf->alt_gaintb = 0;
+                        break;
+                case 0x32: /* A+B LNA1 */
+                        ant_conf->fast_div_bias = 0x1;
+                        ant_conf->main_gaintb = 0;
+                        ant_conf->alt_gaintb = 0;
+                        break;
+                default:
+                        break;
+                }
+        } else if (ant_conf->div_group == 2) {
+                /* Adjust the fast_div_bias based on main and alt_lna_conf */
+                switch ((ant_conf->main_lna_conf << 4) |
+                                ant_conf->alt_lna_conf) {
+                case 0x01: /* A-B LNA2 */
+                        ant_conf->fast_div_bias = 0x1;
+                        ant_conf->main_gaintb = 0;
+                        ant_conf->alt_gaintb = 0;
+                        break;
+                case 0x02: /* A-B LNA1 */
+                        ant_conf->fast_div_bias = 0x1;
+                        ant_conf->main_gaintb = 0;
+                        ant_conf->alt_gaintb = 0;
+                        break;
+                case 0x03: /* A-B A+B */
+                        ant_conf->fast_div_bias = 0x1;
+                        ant_conf->main_gaintb = 0;
+                        ant_conf->alt_gaintb = 0;
+                        break;
+                case 0x10: /* LNA2 A-B */
+                        if (!(antcomb->scan) &&
+                                (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO))
+                                ant_conf->fast_div_bias = 0x1;
+                        else
+                                ant_conf->fast_div_bias = 0x2;
+                        ant_conf->main_gaintb = 0;
+                        ant_conf->alt_gaintb = 0;
+                        break;
+                case 0x12: /* LNA2 LNA1 */
+                        ant_conf->fast_div_bias = 0x1;
+                        ant_conf->main_gaintb = 0;
+                        ant_conf->alt_gaintb = 0;
+                        break;
+                case 0x13: /* LNA2 A+B */
+                        if (!(antcomb->scan) &&
+                                (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO))
+                                ant_conf->fast_div_bias = 0x1;
+                        else
+                                ant_conf->fast_div_bias = 0x2;
+                        ant_conf->main_gaintb = 0;
+                        ant_conf->alt_gaintb = 0;
+                        break;
+                case 0x20: /* LNA1 A-B */
+                        if (!(antcomb->scan) &&
+                                (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO))
+                                ant_conf->fast_div_bias = 0x1;
+                        else
+                                ant_conf->fast_div_bias = 0x2;
+                        ant_conf->main_gaintb = 0;
+                        ant_conf->alt_gaintb = 0;
+                        break;
+                case 0x21: /* LNA1 LNA2 */
+                        ant_conf->fast_div_bias = 0x1;
+                        ant_conf->main_gaintb = 0;
+                        ant_conf->alt_gaintb = 0;
+                        break;
+                case 0x23: /* LNA1 A+B */
+                        if (!(antcomb->scan) &&
+                                (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO))
+                                ant_conf->fast_div_bias = 0x1;
+                        else
+                                ant_conf->fast_div_bias = 0x2;
+                        ant_conf->main_gaintb = 0;
+                        ant_conf->alt_gaintb = 0;
+                        break;
+                case 0x30: /* A+B A-B */
+                        ant_conf->fast_div_bias = 0x1;
+                        ant_conf->main_gaintb = 0;
+                        ant_conf->alt_gaintb = 0;
+                        break;
+                case 0x31: /* A+B LNA2 */
+                        ant_conf->fast_div_bias = 0x1;
+                        ant_conf->main_gaintb = 0;
+                        ant_conf->alt_gaintb = 0;
+                        break;
+                case 0x32: /* A+B LNA1 */
+                        ant_conf->fast_div_bias = 0x1;
+                        ant_conf->main_gaintb = 0;
+                        ant_conf->alt_gaintb = 0;
+                        break;
+                default:
+                        break;
+                }
+        }
+}
+
+void ath_ant_comb_scan(struct ath_softc *sc, struct ath_rx_status *rs)
+{
+        struct ath_hw_antcomb_conf div_ant_conf;
+        struct ath_ant_comb *antcomb = &sc->ant_comb;
+        int alt_ratio = 0, alt_rssi_avg = 0, main_rssi_avg = 0, curr_alt_set;
+        int curr_main_set;
+        int main_rssi = rs->rs_rssi_ctl0;
+        int alt_rssi = rs->rs_rssi_ctl1;
+        int rx_ant_conf,  main_ant_conf;
+        bool short_scan = false;
+
+        rx_ant_conf = (rs->rs_rssi_ctl2 >> ATH_ANT_RX_CURRENT_SHIFT) &
+                       ATH_ANT_RX_MASK;
+        main_ant_conf = (rs->rs_rssi_ctl2 >> ATH_ANT_RX_MAIN_SHIFT) &
+                         ATH_ANT_RX_MASK;
+
+        /* Record packet only when both main_rssi and  alt_rssi is positive */
+        if (main_rssi > 0 && alt_rssi > 0) {
+                antcomb->total_pkt_count++;
+                antcomb->main_total_rssi += main_rssi;
+                antcomb->alt_total_rssi  += alt_rssi;
+                if (main_ant_conf == rx_ant_conf)
+                        antcomb->main_recv_cnt++;
+                else
+                        antcomb->alt_recv_cnt++;
+        }
+
+        /* Short scan check */
+        if (antcomb->scan && antcomb->alt_good) {
+                if (time_after(jiffies, antcomb->scan_start_time +
+                    msecs_to_jiffies(ATH_ANT_DIV_COMB_SHORT_SCAN_INTR)))
+                        short_scan = true;
+                else
+                        if (antcomb->total_pkt_count ==
+                            ATH_ANT_DIV_COMB_SHORT_SCAN_PKTCOUNT) {
+                                alt_ratio = ((antcomb->alt_recv_cnt * 100) /
+                                            antcomb->total_pkt_count);
+                                if (alt_ratio < ATH_ANT_DIV_COMB_ALT_ANT_RATIO)
+                                        short_scan = true;
+                        }
+        }
+
+        if (((antcomb->total_pkt_count < ATH_ANT_DIV_COMB_MAX_PKTCOUNT) ||
+            rs->rs_moreaggr) && !short_scan)
+                return;
+
+        if (antcomb->total_pkt_count) {
+                alt_ratio = ((antcomb->alt_recv_cnt * 100) /
+                             antcomb->total_pkt_count);
+                main_rssi_avg = (antcomb->main_total_rssi /
+                                 antcomb->total_pkt_count);
+                alt_rssi_avg = (antcomb->alt_total_rssi /
+                                 antcomb->total_pkt_count);
+        }
+
+
+        ath9k_hw_antdiv_comb_conf_get(sc->sc_ah, &div_ant_conf);
+        curr_alt_set = div_ant_conf.alt_lna_conf;
+        curr_main_set = div_ant_conf.main_lna_conf;
+
+        antcomb->count++;
+
+        if (antcomb->count == ATH_ANT_DIV_COMB_MAX_COUNT) {
+                if (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO) {
+                        ath_lnaconf_alt_good_scan(antcomb, div_ant_conf,
+                                                  main_rssi_avg);
+                        antcomb->alt_good = true;
+                } else {
+                        antcomb->alt_good = false;
+                }
+
+                antcomb->count = 0;
+                antcomb->scan = true;
+                antcomb->scan_not_start = true;
+        }
+
+        if (!antcomb->scan) {
+                if (ath_ant_div_comb_alt_check(div_ant_conf.div_group,
+                                        alt_ratio, curr_main_set, curr_alt_set,
+                                        alt_rssi_avg, main_rssi_avg)) {
+                        if (curr_alt_set == ATH_ANT_DIV_COMB_LNA2) {
+                                /* Switch main and alt LNA */
+                                div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                                div_ant_conf.alt_lna_conf  =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                        } else if (curr_alt_set == ATH_ANT_DIV_COMB_LNA1) {
+                                div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                                div_ant_conf.alt_lna_conf  =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                        }
+
+                        goto div_comb_done;
+                } else if ((curr_alt_set != ATH_ANT_DIV_COMB_LNA1) &&
+                           (curr_alt_set != ATH_ANT_DIV_COMB_LNA2)) {
+                        /* Set alt to another LNA */
+                        if (curr_main_set == ATH_ANT_DIV_COMB_LNA2)
+                                div_ant_conf.alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                        else if (curr_main_set == ATH_ANT_DIV_COMB_LNA1)
+                                div_ant_conf.alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+
+                        goto div_comb_done;
+                }
+
+                if ((alt_rssi_avg < (main_rssi_avg +
+                                     div_ant_conf.lna1_lna2_delta)))
+                        goto div_comb_done;
+        }
+
+        if (!antcomb->scan_not_start) {
+                switch (curr_alt_set) {
+                case ATH_ANT_DIV_COMB_LNA2:
+                        antcomb->rssi_lna2 = alt_rssi_avg;
+                        antcomb->rssi_lna1 = main_rssi_avg;
+                        antcomb->scan = true;
+                        /* set to A+B */
+                        div_ant_conf.main_lna_conf =
+                                ATH_ANT_DIV_COMB_LNA1;
+                        div_ant_conf.alt_lna_conf  =
+                                ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                        break;
+                case ATH_ANT_DIV_COMB_LNA1:
+                        antcomb->rssi_lna1 = alt_rssi_avg;
+                        antcomb->rssi_lna2 = main_rssi_avg;
+                        antcomb->scan = true;
+                        /* set to A+B */
+                        div_ant_conf.main_lna_conf = ATH_ANT_DIV_COMB_LNA2;
+                        div_ant_conf.alt_lna_conf  =
+                                ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                        break;
+                case ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2:
+                        antcomb->rssi_add = alt_rssi_avg;
+                        antcomb->scan = true;
+                        /* set to A-B */
+                        div_ant_conf.alt_lna_conf =
+                                ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                        break;
+                case ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2:
+                        antcomb->rssi_sub = alt_rssi_avg;
+                        antcomb->scan = false;
+                        if (antcomb->rssi_lna2 >
+                            (antcomb->rssi_lna1 +
+                            ATH_ANT_DIV_COMB_LNA1_LNA2_SWITCH_DELTA)) {
+                                /* use LNA2 as main LNA */
+                                if ((antcomb->rssi_add > antcomb->rssi_lna1) &&
+                                    (antcomb->rssi_add > antcomb->rssi_sub)) {
+                                        /* set to A+B */
+                                        div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                                        div_ant_conf.alt_lna_conf  =
+                                                ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                                } else if (antcomb->rssi_sub >
+                                           antcomb->rssi_lna1) {
+                                        /* set to A-B */
+                                        div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                                        div_ant_conf.alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                                } else {
+                                        /* set to LNA1 */
+                                        div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                                        div_ant_conf.alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                                }
+                        } else {
+                                /* use LNA1 as main LNA */
+                                if ((antcomb->rssi_add > antcomb->rssi_lna2) &&
+                                    (antcomb->rssi_add > antcomb->rssi_sub)) {
+                                        /* set to A+B */
+                                        div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                                        div_ant_conf.alt_lna_conf  =
+                                                ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
+                                } else if (antcomb->rssi_sub >
+                                           antcomb->rssi_lna1) {
+                                        /* set to A-B */
+                                        div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                                        div_ant_conf.alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
+                                } else {
+                                        /* set to LNA2 */
+                                        div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                                        div_ant_conf.alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                                }
+                        }
+                        break;
+                default:
+                        break;
+                }
+        } else {
+                if (!antcomb->alt_good) {
+                        antcomb->scan_not_start = false;
+                        /* Set alt to another LNA */
+                        if (curr_main_set == ATH_ANT_DIV_COMB_LNA2) {
+                                div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                                div_ant_conf.alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                        } else if (curr_main_set == ATH_ANT_DIV_COMB_LNA1) {
+                                div_ant_conf.main_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA1;
+                                div_ant_conf.alt_lna_conf =
+                                                ATH_ANT_DIV_COMB_LNA2;
+                        }
+                        goto div_comb_done;
+                }
+        }
+
+        ath_select_ant_div_from_quick_scan(antcomb, &div_ant_conf,
+                                           main_rssi_avg, alt_rssi_avg,
+                                           alt_ratio);
+
+        antcomb->quick_scan_cnt++;
+
+div_comb_done:
+        ath_ant_div_conf_fast_divbias(&div_ant_conf, antcomb, alt_ratio);
+        ath9k_hw_antdiv_comb_conf_set(sc->sc_ah, &div_ant_conf);
+
+        antcomb->scan_start_time = jiffies;
+        antcomb->total_pkt_count = 0;
+        antcomb->main_total_rssi = 0;
+        antcomb->alt_total_rssi = 0;
+        antcomb->main_recv_cnt = 0;
+        antcomb->alt_recv_cnt = 0;
+}
+
+void ath_ant_comb_update(struct ath_softc *sc)
+{
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_hw_antcomb_conf div_ant_conf;
+        u8 lna_conf;
+
+        ath9k_hw_antdiv_comb_conf_get(ah, &div_ant_conf);
+
+        if (sc->ant_rx == 1)
+                lna_conf = ATH_ANT_DIV_COMB_LNA1;
+        else
+                lna_conf = ATH_ANT_DIV_COMB_LNA2;
+
+        div_ant_conf.main_lna_conf = lna_conf;
+        div_ant_conf.alt_lna_conf = lna_conf;
+
+        ath9k_hw_antdiv_comb_conf_set(ah, &div_ant_conf);
+}
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index 9fdd70fcaf5b..d7deb8c9f299 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -653,7 +653,6 @@ static void ar9003_hw_detect_outlier(int *mp_coeff, int nmeasurement,
 }
 
 static void ar9003_hw_tx_iqcal_load_avg_2_passes(struct ath_hw *ah,
-                                                 u8 num_chains,
                                                  struct coeff *coeff,
                                                  bool is_reusable)
 {
@@ -677,7 +676,9 @@ static void ar9003_hw_tx_iqcal_load_avg_2_passes(struct ath_hw *ah,
         }
 
         /* Load the average of 2 passes */
-        for (i = 0; i < num_chains; i++) {
+        for (i = 0; i < AR9300_MAX_CHAINS; i++) {
+                if (!(ah->txchainmask & (1 << i)))
+                        continue;
                 nmeasurement = REG_READ_FIELD(ah,
                                 AR_PHY_TX_IQCAL_STATUS_B0,
                                 AR_PHY_CALIBRATED_GAINS_0);
@@ -767,16 +768,13 @@ static void ar9003_hw_tx_iq_cal_post_proc(struct ath_hw *ah, bool is_reusable)
         };
         struct coeff coeff;
         s32 iq_res[6];
-        u8 num_chains = 0;
         int i, im, j;
         int nmeasurement;
 
         for (i = 0; i < AR9300_MAX_CHAINS; i++) {
-                if (ah->txchainmask & (1 << i))
-                        num_chains++;
-        }
+                if (!(ah->txchainmask & (1 << i)))
+                        continue;
 
-        for (i = 0; i < num_chains; i++) {
                 nmeasurement = REG_READ_FIELD(ah,
                                 AR_PHY_TX_IQCAL_STATUS_B0,
                                 AR_PHY_CALIBRATED_GAINS_0);
@@ -839,8 +837,7 @@ static void ar9003_hw_tx_iq_cal_post_proc(struct ath_hw *ah, bool is_reusable)
                                 coeff.phs_coeff[i][im] -= 128;
                 }
         }
-        ar9003_hw_tx_iqcal_load_avg_2_passes(ah, num_chains,
-                                             &coeff, is_reusable);
+        ar9003_hw_tx_iqcal_load_avg_2_passes(ah, &coeff, is_reusable);
 
         return;
 
@@ -901,7 +898,6 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
         bool is_reusable = true, status = true;
         bool run_rtt_cal = false, run_agc_cal;
         bool rtt = !!(ah->caps.hw_caps & ATH9K_HW_CAP_RTT);
-        bool mci = !!(ah->caps.hw_caps & ATH9K_HW_CAP_MCI);
         u32 agc_ctrl = 0, agc_supp_cals = AR_PHY_AGC_CONTROL_OFFSET_CAL |
                                           AR_PHY_AGC_CONTROL_FLTR_CAL   |
                                           AR_PHY_AGC_CONTROL_PKDET_CAL;
@@ -970,7 +966,7 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
         } else if (caldata && !caldata->done_txiqcal_once)
                 run_agc_cal = true;
 
-        if (mci && IS_CHAN_2GHZ(chan) && run_agc_cal)
+        if (ath9k_hw_mci_is_enabled(ah) && IS_CHAN_2GHZ(chan) && run_agc_cal)
                 ar9003_mci_init_cal_req(ah, &is_reusable);
 
         if (!(IS_CHAN_HALF_RATE(chan) || IS_CHAN_QUARTER_RATE(chan))) {
@@ -993,7 +989,7 @@ skip_tx_iqcal:
                                        0, AH_WAIT_TIMEOUT);
         }
 
-        if (mci && IS_CHAN_2GHZ(chan) && run_agc_cal)
+        if (ath9k_hw_mci_is_enabled(ah) && IS_CHAN_2GHZ(chan) && run_agc_cal)
                 ar9003_mci_init_cal_done(ah);
 
         if (rtt && !run_rtt_cal) {
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index dfb0441f406c..2cdf82bdb11d 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -3412,11 +3412,11 @@ static u32 ath9k_hw_ar9003_dump_eeprom(struct ath_hw *ah, bool dump_base_hdr,
         if (!dump_base_hdr) {
                 len += snprintf(buf + len, size - len,
                                 "%20s :\n", "2GHz modal Header");
-                len += ar9003_dump_modal_eeprom(buf, len, size,
+                len = ar9003_dump_modal_eeprom(buf, len, size,
                                                 &eep->modalHeader2G);
                 len += snprintf(buf + len, size - len,
                                 "%20s :\n", "5GHz modal Header");
-                len += ar9003_dump_modal_eeprom(buf, len, size,
+                len = ar9003_dump_modal_eeprom(buf, len, size,
                                                 &eep->modalHeader5G);
                 goto out;
         }
@@ -3613,6 +3613,7 @@ static void ar9003_hw_ant_ctrl_apply(struct ath_hw *ah, bool is2ghz)
                 value = ar9003_switch_com_spdt_get(ah, is2ghz);
                 REG_RMW_FIELD(ah, AR_PHY_GLB_CONTROL,
                                 AR_SWITCH_TABLE_COM_SPDT_ALL, value);
+                REG_SET_BIT(ah, AR_PHY_GLB_CONTROL, AR_BTCOEX_CTRL_SPDT_ENABLE);
         }
 
         value = ar9003_hw_ant_ctrl_common_2_get(ah, is2ghz);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.c b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
index d9e0824af093..78816b8b2173 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
@@ -181,11 +181,14 @@ static bool ar9003_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
         u32 mask2 = 0;
         struct ath9k_hw_capabilities *pCap = &ah->caps;
         struct ath_common *common = ath9k_hw_common(ah);
-        u32 sync_cause = 0, async_cause;
+        u32 sync_cause = 0, async_cause, async_mask = AR_INTR_MAC_IRQ;
+
+        if (ath9k_hw_mci_is_enabled(ah))
+                async_mask |= AR_INTR_ASYNC_MASK_MCI;
 
         async_cause = REG_READ(ah, AR_INTR_ASYNC_CAUSE);
 
-        if (async_cause & (AR_INTR_MAC_IRQ | AR_INTR_ASYNC_MASK_MCI)) {
+        if (async_cause & async_mask) {
                 if ((REG_READ(ah, AR_RTC_STATUS) & AR_RTC_STATUS_M)
                                 == AR_RTC_STATUS_ON)
                         isr = REG_READ(ah, AR_ISR);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mci.c b/drivers/net/wireless/ath/ath9k/ar9003_mci.c
index ffbb180f91e1..cc2853ade8f8 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_mci.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_mci.c
@@ -35,31 +35,30 @@ static int ar9003_mci_wait_for_interrupt(struct ath_hw *ah, u32 address,
         struct ath_common *common = ath9k_hw_common(ah);
 
         while (time_out) {
-                if (REG_READ(ah, address) & bit_position) {
-                        REG_WRITE(ah, address, bit_position);
-
-                        if (address == AR_MCI_INTERRUPT_RX_MSG_RAW) {
-                                if (bit_position &
-                                    AR_MCI_INTERRUPT_RX_MSG_REQ_WAKE)
-                                        ar9003_mci_reset_req_wakeup(ah);
-
-                                if (bit_position &
-                                    (AR_MCI_INTERRUPT_RX_MSG_SYS_SLEEPING |
-                                     AR_MCI_INTERRUPT_RX_MSG_SYS_WAKING))
-                                        REG_WRITE(ah, AR_MCI_INTERRUPT_RAW,
-                                        AR_MCI_INTERRUPT_REMOTE_SLEEP_UPDATE);
-
-                                REG_WRITE(ah, AR_MCI_INTERRUPT_RAW,
-                                          AR_MCI_INTERRUPT_RX_MSG);
-                        }
-                        break;
-                }
+                if (!(REG_READ(ah, address) & bit_position)) {
+                        udelay(10);
+                        time_out -= 10;
 
-                udelay(10);
-                time_out -= 10;
+                        if (time_out < 0)
+                                break;
+                        else
+                                continue;
+                }
+                REG_WRITE(ah, address, bit_position);
 
-                if (time_out < 0)
+                if (address != AR_MCI_INTERRUPT_RX_MSG_RAW)
                         break;
+
+                if (bit_position & AR_MCI_INTERRUPT_RX_MSG_REQ_WAKE)
+                        ar9003_mci_reset_req_wakeup(ah);
+
+                if (bit_position & (AR_MCI_INTERRUPT_RX_MSG_SYS_SLEEPING |
+                                    AR_MCI_INTERRUPT_RX_MSG_SYS_WAKING))
+                        REG_WRITE(ah, AR_MCI_INTERRUPT_RAW,
+                                  AR_MCI_INTERRUPT_REMOTE_SLEEP_UPDATE);
+
+                REG_WRITE(ah, AR_MCI_INTERRUPT_RAW, AR_MCI_INTERRUPT_RX_MSG);
+                break;
         }
 
         if (time_out <= 0) {
@@ -127,14 +126,13 @@ static void ar9003_mci_send_coex_version_query(struct ath_hw *ah,
         struct ath9k_hw_mci *mci = &ah->btcoex_hw.mci;
         u32 payload[4] = {0, 0, 0, 0};
 
-        if (!mci->bt_version_known &&
-            (mci->bt_state != MCI_BT_SLEEP)) {
-                MCI_GPM_SET_TYPE_OPCODE(payload,
-                                        MCI_GPM_COEX_AGENT,
-                                        MCI_GPM_COEX_VERSION_QUERY);
-                ar9003_mci_send_message(ah, MCI_GPM, 0, payload, 16,
-                                        wait_done, true);
-        }
+        if (mci->bt_version_known ||
+            (mci->bt_state == MCI_BT_SLEEP))
+                return;
+
+        MCI_GPM_SET_TYPE_OPCODE(payload, MCI_GPM_COEX_AGENT,
+                                MCI_GPM_COEX_VERSION_QUERY);
+        ar9003_mci_send_message(ah, MCI_GPM, 0, payload, 16, wait_done, true);
 }
 
 static void ar9003_mci_send_coex_version_response(struct ath_hw *ah,
@@ -158,15 +156,14 @@ static void ar9003_mci_send_coex_wlan_channels(struct ath_hw *ah,
         struct ath9k_hw_mci *mci = &ah->btcoex_hw.mci;
         u32 *payload = &mci->wlan_channels[0];
 
-        if ((mci->wlan_channels_update == true) &&
-            (mci->bt_state != MCI_BT_SLEEP)) {
-                MCI_GPM_SET_TYPE_OPCODE(payload,
-                                        MCI_GPM_COEX_AGENT,
-                                        MCI_GPM_COEX_WLAN_CHANNELS);
-                ar9003_mci_send_message(ah, MCI_GPM, 0, payload, 16,
-                                        wait_done, true);
-                MCI_GPM_SET_TYPE_OPCODE(payload, 0xff, 0xff);
-        }
+        if (!mci->wlan_channels_update ||
+            (mci->bt_state == MCI_BT_SLEEP))
+                return;
+
+        MCI_GPM_SET_TYPE_OPCODE(payload, MCI_GPM_COEX_AGENT,
+                                MCI_GPM_COEX_WLAN_CHANNELS);
+        ar9003_mci_send_message(ah, MCI_GPM, 0, payload, 16, wait_done, true);
+        MCI_GPM_SET_TYPE_OPCODE(payload, 0xff, 0xff);
 }
 
 static void ar9003_mci_send_coex_bt_status_query(struct ath_hw *ah,
@@ -174,29 +171,30 @@ static void ar9003_mci_send_coex_bt_status_query(struct ath_hw *ah,
 {
         struct ath9k_hw_mci *mci = &ah->btcoex_hw.mci;
         u32 payload[4] = {0, 0, 0, 0};
-        bool query_btinfo = !!(query_type & (MCI_GPM_COEX_QUERY_BT_ALL_INFO |
-                                             MCI_GPM_COEX_QUERY_BT_TOPOLOGY));
+        bool query_btinfo;
 
-        if (mci->bt_state != MCI_BT_SLEEP) {
+        if (mci->bt_state == MCI_BT_SLEEP)
+                return;
 
-                MCI_GPM_SET_TYPE_OPCODE(payload, MCI_GPM_COEX_AGENT,
-                                        MCI_GPM_COEX_STATUS_QUERY);
+        query_btinfo = !!(query_type & (MCI_GPM_COEX_QUERY_BT_ALL_INFO |
+                                        MCI_GPM_COEX_QUERY_BT_TOPOLOGY));
+        MCI_GPM_SET_TYPE_OPCODE(payload, MCI_GPM_COEX_AGENT,
+                                MCI_GPM_COEX_STATUS_QUERY);
 
-                *(((u8 *)payload) + MCI_GPM_COEX_B_BT_BITMAP) = query_type;
-
-                /*
-                 * If bt_status_query message is  not sent successfully,
-                 * then need_flush_btinfo should be set again.
-                 */
-                if (!ar9003_mci_send_message(ah, MCI_GPM, 0, payload, 16,
-                                             wait_done, true)) {
-                        if (query_btinfo)
-                                mci->need_flush_btinfo = true;
-                }
+        *(((u8 *)payload) + MCI_GPM_COEX_B_BT_BITMAP) = query_type;
 
+        /*
+         * If bt_status_query message is  not sent successfully,
+         * then need_flush_btinfo should be set again.
+         */
+        if (!ar9003_mci_send_message(ah, MCI_GPM, 0, payload, 16,
+                                wait_done, true)) {
                 if (query_btinfo)
-                        mci->query_bt = false;
+                        mci->need_flush_btinfo = true;
         }
+
+        if (query_btinfo)
+                mci->query_bt = false;
 }
 
 static void ar9003_mci_send_coex_halt_bt_gpm(struct ath_hw *ah, bool halt,
@@ -241,73 +239,73 @@ static void ar9003_mci_prep_interface(struct ath_hw *ah)
         ar9003_mci_remote_reset(ah, true);
         ar9003_mci_send_req_wake(ah, true);
 
-        if (ar9003_mci_wait_for_interrupt(ah, AR_MCI_INTERRUPT_RX_MSG_RAW,
-                                  AR_MCI_INTERRUPT_RX_MSG_SYS_WAKING, 500)) {
+        if (!ar9003_mci_wait_for_interrupt(ah, AR_MCI_INTERRUPT_RX_MSG_RAW,
+                                  AR_MCI_INTERRUPT_RX_MSG_SYS_WAKING, 500))
+                goto clear_redunt;
 
-                mci->bt_state = MCI_BT_AWAKE;
+        mci->bt_state = MCI_BT_AWAKE;
 
-                /*
-                 * we don't need to send more remote_reset at this moment.
-                 * If BT receive first remote_reset, then BT HW will
-                 * be cleaned up and will be able to receive req_wake
-                 * and BT HW will respond sys_waking.
-                 * In this case, WLAN will receive BT's HW sys_waking.
-                 * Otherwise, if BT SW missed initial remote_reset,
-                 * that remote_reset will still clean up BT MCI RX,
-                 * and the req_wake will wake BT up,
-                 * and BT SW will respond this req_wake with a remote_reset and
-                 * sys_waking. In this case, WLAN will receive BT's SW
-                 * sys_waking. In either case, BT's RX is cleaned up. So we
-                 * don't need to reply BT's remote_reset now, if any.
-                 * Similarly, if in any case, WLAN can receive BT's sys_waking,
-                 * that means WLAN's RX is also fine.
-                 */
-                ar9003_mci_send_sys_waking(ah, true);
-                udelay(10);
+        /*
+         * we don't need to send more remote_reset at this moment.
+         * If BT receive first remote_reset, then BT HW will
+         * be cleaned up and will be able to receive req_wake
+         * and BT HW will respond sys_waking.
+         * In this case, WLAN will receive BT's HW sys_waking.
+         * Otherwise, if BT SW missed initial remote_reset,
+         * that remote_reset will still clean up BT MCI RX,
+         * and the req_wake will wake BT up,
+         * and BT SW will respond this req_wake with a remote_reset and
+         * sys_waking. In this case, WLAN will receive BT's SW
+         * sys_waking. In either case, BT's RX is cleaned up. So we
+         * don't need to reply BT's remote_reset now, if any.
+         * Similarly, if in any case, WLAN can receive BT's sys_waking,
+         * that means WLAN's RX is also fine.
+         */
+        ar9003_mci_send_sys_waking(ah, true);
+        udelay(10);
 
-                /*
-                 * Set BT priority interrupt value to be 0xff to
-                 * avoid having too many BT PRIORITY interrupts.
-                 */
-                REG_WRITE(ah, AR_MCI_BT_PRI0, 0xFFFFFFFF);
-                REG_WRITE(ah, AR_MCI_BT_PRI1, 0xFFFFFFFF);
-                REG_WRITE(ah, AR_MCI_BT_PRI2, 0xFFFFFFFF);
-                REG_WRITE(ah, AR_MCI_BT_PRI3, 0xFFFFFFFF);
-                REG_WRITE(ah, AR_MCI_BT_PRI, 0X000000FF);
+        /*
+         * Set BT priority interrupt value to be 0xff to
+         * avoid having too many BT PRIORITY interrupts.
+         */
+        REG_WRITE(ah, AR_MCI_BT_PRI0, 0xFFFFFFFF);
+        REG_WRITE(ah, AR_MCI_BT_PRI1, 0xFFFFFFFF);
+        REG_WRITE(ah, AR_MCI_BT_PRI2, 0xFFFFFFFF);
+        REG_WRITE(ah, AR_MCI_BT_PRI3, 0xFFFFFFFF);
+        REG_WRITE(ah, AR_MCI_BT_PRI, 0X000000FF);
 
-                /*
-                 * A contention reset will be received after send out
-                 * sys_waking. Also BT priority interrupt bits will be set.
-                 * Clear those bits before the next step.
-                 */
+        /*
+         * A contention reset will be received after send out
+         * sys_waking. Also BT priority interrupt bits will be set.
+         * Clear those bits before the next step.
+         */
 
-                REG_WRITE(ah, AR_MCI_INTERRUPT_RX_MSG_RAW,
-                          AR_MCI_INTERRUPT_RX_MSG_CONT_RST);
-                REG_WRITE(ah, AR_MCI_INTERRUPT_RAW,
-                          AR_MCI_INTERRUPT_BT_PRI);
+        REG_WRITE(ah, AR_MCI_INTERRUPT_RX_MSG_RAW,
+                  AR_MCI_INTERRUPT_RX_MSG_CONT_RST);
+        REG_WRITE(ah, AR_MCI_INTERRUPT_RAW, AR_MCI_INTERRUPT_BT_PRI);
 
-                if (mci->is_2g) {
-                        ar9003_mci_send_lna_transfer(ah, true);
-                        udelay(5);
-                }
+        if (mci->is_2g) {
+                ar9003_mci_send_lna_transfer(ah, true);
+                udelay(5);
+        }
 
-                if ((mci->is_2g && !mci->update_2g5g)) {
-                        if (ar9003_mci_wait_for_interrupt(ah,
-                                          AR_MCI_INTERRUPT_RX_MSG_RAW,
-                                          AR_MCI_INTERRUPT_RX_MSG_LNA_INFO,
-                                          mci_timeout))
-                                ath_dbg(common, MCI,
-                                        "MCI WLAN has control over the LNA & BT obeys it\n");
-                        else
-                                ath_dbg(common, MCI,
-                                        "MCI BT didn't respond to LNA_TRANS\n");
-                }
+        if ((mci->is_2g && !mci->update_2g5g)) {
+                if (ar9003_mci_wait_for_interrupt(ah,
+                                        AR_MCI_INTERRUPT_RX_MSG_RAW,
+                                        AR_MCI_INTERRUPT_RX_MSG_LNA_INFO,
+                                        mci_timeout))
+                        ath_dbg(common, MCI,
+                                "MCI WLAN has control over the LNA & BT obeys it\n");
+                else
+                        ath_dbg(common, MCI,
+                                "MCI BT didn't respond to LNA_TRANS\n");
         }
 
+clear_redunt:
         /* Clear the extra redundant SYS_WAKING from BT */
         if ((mci->bt_state == MCI_BT_AWAKE) &&
-                (REG_READ_FIELD(ah, AR_MCI_INTERRUPT_RX_MSG_RAW,
-                                AR_MCI_INTERRUPT_RX_MSG_SYS_WAKING)) &&
+            (REG_READ_FIELD(ah, AR_MCI_INTERRUPT_RX_MSG_RAW,
+                            AR_MCI_INTERRUPT_RX_MSG_SYS_WAKING)) &&
             (REG_READ_FIELD(ah, AR_MCI_INTERRUPT_RX_MSG_RAW,
                             AR_MCI_INTERRUPT_RX_MSG_SYS_SLEEPING) == 0)) {
                 REG_WRITE(ah, AR_MCI_INTERRUPT_RX_MSG_RAW,
@@ -323,14 +321,13 @@ void ar9003_mci_set_full_sleep(struct ath_hw *ah)
 {
         struct ath9k_hw_mci *mci = &ah->btcoex_hw.mci;
 
-        if (ar9003_mci_state(ah, MCI_STATE_ENABLE, NULL) &&
+        if (ar9003_mci_state(ah, MCI_STATE_ENABLE) &&
             (mci->bt_state != MCI_BT_SLEEP) &&
             !mci->halted_bt_gpm) {
                 ar9003_mci_send_coex_halt_bt_gpm(ah, true, true);
         }
 
         mci->ready = false;
-        REG_WRITE(ah, AR_RTC_KEEP_AWAKE, 0x2);
 }
 
 static void ar9003_mci_disable_interrupt(struct ath_hw *ah)
@@ -487,7 +484,7 @@ static void ar9003_mci_sync_bt_state(struct ath_hw *ah)
         struct ath9k_hw_mci *mci = &ah->btcoex_hw.mci;
         u32 cur_bt_state;
 
-        cur_bt_state = ar9003_mci_state(ah, MCI_STATE_REMOTE_SLEEP, NULL);
+        cur_bt_state = ar9003_mci_state(ah, MCI_STATE_REMOTE_SLEEP);
 
         if (mci->bt_state != cur_bt_state)
                 mci->bt_state = cur_bt_state;
@@ -596,8 +593,7 @@ static u32 ar9003_mci_wait_for_gpm(struct ath_hw *ah, u8 gpm_type,
                 if (!time_out)
                         break;
 
-                offset = ar9003_mci_state(ah, MCI_STATE_NEXT_GPM_OFFSET,
-                                          &more_data);
+                offset = ar9003_mci_get_next_gpm_offset(ah, false, &more_data);
 
                 if (offset == MCI_GPM_INVALID)
                         continue;
@@ -615,9 +611,9 @@ static u32 ar9003_mci_wait_for_gpm(struct ath_hw *ah, u8 gpm_type,
                                 }
                                 break;
                         }
-                } else if ((recv_type == gpm_type) && (recv_opcode == gpm_opcode)) {
+                } else if ((recv_type == gpm_type) &&
+                           (recv_opcode == gpm_opcode))
                         break;
-                }
 
                 /*
                  * check if it's cal_grant
@@ -661,8 +657,7 @@ static u32 ar9003_mci_wait_for_gpm(struct ath_hw *ah, u8 gpm_type,
                 time_out = 0;
 
         while (more_data == MCI_GPM_MORE) {
-                offset = ar9003_mci_state(ah, MCI_STATE_NEXT_GPM_OFFSET,
-                                          &more_data);
+                offset = ar9003_mci_get_next_gpm_offset(ah, false, &more_data);
                 if (offset == MCI_GPM_INVALID)
                         break;
 
@@ -731,38 +726,38 @@ int ar9003_mci_end_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         if (!IS_CHAN_2GHZ(chan) || (mci_hw->bt_state != MCI_BT_SLEEP))
                 goto exit;
 
-        if (ar9003_mci_check_int(ah, AR_MCI_INTERRUPT_RX_MSG_REMOTE_RESET) ||
-            ar9003_mci_check_int(ah, AR_MCI_INTERRUPT_RX_MSG_REQ_WAKE)) {
+        if (!ar9003_mci_check_int(ah, AR_MCI_INTERRUPT_RX_MSG_REMOTE_RESET) &&
+            !ar9003_mci_check_int(ah, AR_MCI_INTERRUPT_RX_MSG_REQ_WAKE))
+                goto exit;
 
-                /*
-                 * BT is sleeping. Check if BT wakes up during
-                 * WLAN calibration. If BT wakes up during
-                 * WLAN calibration, need to go through all
-                 * message exchanges again and recal.
-                 */
-                REG_WRITE(ah, AR_MCI_INTERRUPT_RX_MSG_RAW,
-                          AR_MCI_INTERRUPT_RX_MSG_REMOTE_RESET |
-                          AR_MCI_INTERRUPT_RX_MSG_REQ_WAKE);
+        /*
+         * BT is sleeping. Check if BT wakes up during
+         * WLAN calibration. If BT wakes up during
+         * WLAN calibration, need to go through all
+         * message exchanges again and recal.
+         */
+        REG_WRITE(ah, AR_MCI_INTERRUPT_RX_MSG_RAW,
+                  (AR_MCI_INTERRUPT_RX_MSG_REMOTE_RESET |
+                   AR_MCI_INTERRUPT_RX_MSG_REQ_WAKE));
 
-                ar9003_mci_remote_reset(ah, true);
-                ar9003_mci_send_sys_waking(ah, true);
-                udelay(1);
+        ar9003_mci_remote_reset(ah, true);
+        ar9003_mci_send_sys_waking(ah, true);
+        udelay(1);
 
-                if (IS_CHAN_2GHZ(chan))
-                        ar9003_mci_send_lna_transfer(ah, true);
+        if (IS_CHAN_2GHZ(chan))
+                ar9003_mci_send_lna_transfer(ah, true);
 
-                mci_hw->bt_state = MCI_BT_AWAKE;
+        mci_hw->bt_state = MCI_BT_AWAKE;
 
-                if (caldata) {
-                        caldata->done_txiqcal_once = false;
-                        caldata->done_txclcal_once = false;
-                        caldata->rtt_done = false;
-                }
+        if (caldata) {
+                caldata->done_txiqcal_once = false;
+                caldata->done_txclcal_once = false;
+                caldata->rtt_done = false;
+        }
 
-                if (!ath9k_hw_init_cal(ah, chan))
-                        return -EIO;
+        if (!ath9k_hw_init_cal(ah, chan))
+                return -EIO;
 
-        }
 exit:
         ar9003_mci_enable_interrupt(ah);
         return 0;
@@ -798,29 +793,27 @@ static void ar9003_mci_osla_setup(struct ath_hw *ah, bool enable)
         struct ath9k_hw_mci *mci = &ah->btcoex_hw.mci;
         u32 thresh;
 
-        if (enable) {
-                REG_RMW_FIELD(ah, AR_MCI_SCHD_TABLE_2,
-                              AR_MCI_SCHD_TABLE_2_HW_BASED, 1);
-                REG_RMW_FIELD(ah, AR_MCI_SCHD_TABLE_2,
-                              AR_MCI_SCHD_TABLE_2_MEM_BASED, 1);
-
-                if (!(mci->config & ATH_MCI_CONFIG_DISABLE_AGGR_THRESH)) {
-                        thresh = MS(mci->config, ATH_MCI_CONFIG_AGGR_THRESH);
-                        REG_RMW_FIELD(ah, AR_BTCOEX_CTRL,
-                                      AR_BTCOEX_CTRL_AGGR_THRESH, thresh);
-                        REG_RMW_FIELD(ah, AR_BTCOEX_CTRL,
-                                      AR_BTCOEX_CTRL_TIME_TO_NEXT_BT_THRESH_EN, 1);
-                } else {
-                        REG_RMW_FIELD(ah, AR_BTCOEX_CTRL,
-                                      AR_BTCOEX_CTRL_TIME_TO_NEXT_BT_THRESH_EN, 0);
-                }
-
-                REG_RMW_FIELD(ah, AR_BTCOEX_CTRL,
-                              AR_BTCOEX_CTRL_ONE_STEP_LOOK_AHEAD_EN, 1);
-        } else {
+        if (!enable) {
                 REG_CLR_BIT(ah, AR_BTCOEX_CTRL,
                             AR_BTCOEX_CTRL_ONE_STEP_LOOK_AHEAD_EN);
+                return;
         }
+        REG_RMW_FIELD(ah, AR_MCI_SCHD_TABLE_2, AR_MCI_SCHD_TABLE_2_HW_BASED, 1);
+        REG_RMW_FIELD(ah, AR_MCI_SCHD_TABLE_2,
+                      AR_MCI_SCHD_TABLE_2_MEM_BASED, 1);
+
+        if (!(mci->config & ATH_MCI_CONFIG_DISABLE_AGGR_THRESH)) {
+                thresh = MS(mci->config, ATH_MCI_CONFIG_AGGR_THRESH);
+                REG_RMW_FIELD(ah, AR_BTCOEX_CTRL,
+                              AR_BTCOEX_CTRL_AGGR_THRESH, thresh);
+                REG_RMW_FIELD(ah, AR_BTCOEX_CTRL,
+                              AR_BTCOEX_CTRL_TIME_TO_NEXT_BT_THRESH_EN, 1);
+        } else
+                REG_RMW_FIELD(ah, AR_BTCOEX_CTRL,
+                              AR_BTCOEX_CTRL_TIME_TO_NEXT_BT_THRESH_EN, 0);
+
+        REG_RMW_FIELD(ah, AR_BTCOEX_CTRL,
+                      AR_BTCOEX_CTRL_ONE_STEP_LOOK_AHEAD_EN, 1);
 }
 
 void ar9003_mci_reset(struct ath_hw *ah, bool en_int, bool is_2g,
@@ -898,13 +891,16 @@ void ar9003_mci_reset(struct ath_hw *ah, bool en_int, bool is_2g,
                 udelay(100);
         }
 
+        /* Check pending GPM msg before MCI Reset Rx */
+        ar9003_mci_check_gpm_offset(ah);
+
         regval |= SM(1, AR_MCI_COMMAND2_RESET_RX);
         REG_WRITE(ah, AR_MCI_COMMAND2, regval);
         udelay(1);
         regval &= ~SM(1, AR_MCI_COMMAND2_RESET_RX);
         REG_WRITE(ah, AR_MCI_COMMAND2, regval);
 
-        ar9003_mci_state(ah, MCI_STATE_INIT_GPM_OFFSET, NULL);
+        ar9003_mci_get_next_gpm_offset(ah, true, NULL);
 
         REG_WRITE(ah, AR_MCI_MSG_ATTRIBUTES_TABLE,
                   (SM(0xe801, AR_MCI_MSG_ATTRIBUTES_TABLE_INVALID_HDR) |
@@ -943,26 +939,27 @@ static void ar9003_mci_send_2g5g_status(struct ath_hw *ah, bool wait_done)
         struct ath9k_hw_mci *mci = &ah->btcoex_hw.mci;
         u32 new_flags, to_set, to_clear;
 
-        if (mci->update_2g5g && (mci->bt_state != MCI_BT_SLEEP)) {
-                if (mci->is_2g) {
-                        new_flags = MCI_2G_FLAGS;
-                        to_clear = MCI_2G_FLAGS_CLEAR_MASK;
-                        to_set = MCI_2G_FLAGS_SET_MASK;
-                } else {
-                        new_flags = MCI_5G_FLAGS;
-                        to_clear = MCI_5G_FLAGS_CLEAR_MASK;
-                        to_set = MCI_5G_FLAGS_SET_MASK;
-                }
+        if (!mci->update_2g5g || (mci->bt_state == MCI_BT_SLEEP))
+                return;
+
+        if (mci->is_2g) {
+                new_flags = MCI_2G_FLAGS;
+                to_clear = MCI_2G_FLAGS_CLEAR_MASK;
+                to_set = MCI_2G_FLAGS_SET_MASK;
+        } else {
+                new_flags = MCI_5G_FLAGS;
+                to_clear = MCI_5G_FLAGS_CLEAR_MASK;
+                to_set = MCI_5G_FLAGS_SET_MASK;
+        }
 
-                if (to_clear)
-                        ar9003_mci_send_coex_bt_flags(ah, wait_done,
+        if (to_clear)
+                ar9003_mci_send_coex_bt_flags(ah, wait_done,
                                               MCI_GPM_COEX_BT_FLAGS_CLEAR,
                                               to_clear);
-                if (to_set)
-                        ar9003_mci_send_coex_bt_flags(ah, wait_done,
+        if (to_set)
+                ar9003_mci_send_coex_bt_flags(ah, wait_done,
                                               MCI_GPM_COEX_BT_FLAGS_SET,
                                               to_set);
-        }
 }
 
 static void ar9003_mci_queue_unsent_gpm(struct ath_hw *ah, u8 header,
@@ -1014,38 +1011,32 @@ static void ar9003_mci_queue_unsent_gpm(struct ath_hw *ah, u8 header,
         }
 }
 
-void ar9003_mci_2g5g_switch(struct ath_hw *ah, bool wait_done)
+void ar9003_mci_2g5g_switch(struct ath_hw *ah, bool force)
 {
         struct ath9k_hw_mci *mci = &ah->btcoex_hw.mci;
 
-        if (mci->update_2g5g) {
-                if (mci->is_2g) {
-                        ar9003_mci_send_2g5g_status(ah, true);
-                        ar9003_mci_send_lna_transfer(ah, true);
-                        udelay(5);
+        if (!mci->update_2g5g && !force)
+                return;
 
-                        REG_CLR_BIT(ah, AR_MCI_TX_CTRL,
-                                    AR_MCI_TX_CTRL_DISABLE_LNA_UPDATE);
-                        REG_CLR_BIT(ah, AR_PHY_GLB_CONTROL,
-                                    AR_BTCOEX_CTRL_BT_OWN_SPDT_CTRL);
+        if (mci->is_2g) {
+                ar9003_mci_send_2g5g_status(ah, true);
 
-                        if (!(mci->config & ATH_MCI_CONFIG_DISABLE_OSLA)) {
-                                REG_SET_BIT(ah, AR_BTCOEX_CTRL,
-                                            AR_BTCOEX_CTRL_ONE_STEP_LOOK_AHEAD_EN);
-                        }
-                } else {
-                        ar9003_mci_send_lna_take(ah, true);
-                        udelay(5);
+                REG_SET_BIT(ah, AR_MCI_TX_CTRL,
+                            AR_MCI_TX_CTRL_DISABLE_LNA_UPDATE);
+                REG_CLR_BIT(ah, AR_PHY_GLB_CONTROL,
+                            AR_BTCOEX_CTRL_BT_OWN_SPDT_CTRL);
 
-                        REG_SET_BIT(ah, AR_MCI_TX_CTRL,
-                                    AR_MCI_TX_CTRL_DISABLE_LNA_UPDATE);
-                        REG_SET_BIT(ah, AR_PHY_GLB_CONTROL,
-                                    AR_BTCOEX_CTRL_BT_OWN_SPDT_CTRL);
-                        REG_CLR_BIT(ah, AR_BTCOEX_CTRL,
-                                    AR_BTCOEX_CTRL_ONE_STEP_LOOK_AHEAD_EN);
+                if (!(mci->config & ATH_MCI_CONFIG_DISABLE_OSLA))
+                        ar9003_mci_osla_setup(ah, true);
+        } else {
+                REG_SET_BIT(ah, AR_MCI_TX_CTRL,
+                            AR_MCI_TX_CTRL_DISABLE_LNA_UPDATE);
+                REG_SET_BIT(ah, AR_PHY_GLB_CONTROL,
+                            AR_BTCOEX_CTRL_BT_OWN_SPDT_CTRL);
 
+                ar9003_mci_osla_setup(ah, false);
+                if (!force)
                         ar9003_mci_send_2g5g_status(ah, true);
-                }
         }
 }
 
@@ -1132,7 +1123,7 @@ void ar9003_mci_init_cal_req(struct ath_hw *ah, bool *is_reusable)
         if (ar9003_mci_wait_for_gpm(ah, MCI_GPM_BT_CAL_GRANT, 0, 50000)) {
                 ath_dbg(common, MCI, "MCI BT_CAL_GRANT received\n");
         } else {
-                is_reusable = false;
+                *is_reusable = false;
                 ath_dbg(common, MCI, "MCI BT_CAL_GRANT not received\n");
         }
 }
@@ -1173,11 +1164,10 @@ void ar9003_mci_cleanup(struct ath_hw *ah)
 }
 EXPORT_SYMBOL(ar9003_mci_cleanup);
 
-u32 ar9003_mci_state(struct ath_hw *ah, u32 state_type, u32 *p_data)
+u32 ar9003_mci_state(struct ath_hw *ah, u32 state_type)
 {
-        struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_hw_mci *mci = &ah->btcoex_hw.mci;
-        u32 value = 0, more_gpm = 0, gpm_ptr;
+        u32 value = 0;
         u8 query_type;
 
         switch (state_type) {
@@ -1190,81 +1180,6 @@ u32 ar9003_mci_state(struct ath_hw *ah, u32 state_type, u32 *p_data)
                 }
                 value &= AR_BTCOEX_CTRL_MCI_MODE_EN;
                 break;
-        case MCI_STATE_INIT_GPM_OFFSET:
-                value = MS(REG_READ(ah, AR_MCI_GPM_1), AR_MCI_GPM_WRITE_PTR);
-                mci->gpm_idx = value;
-                break;
-        case MCI_STATE_NEXT_GPM_OFFSET:
-        case MCI_STATE_LAST_GPM_OFFSET:
-                /*
-                * This could be useful to avoid new GPM message interrupt which
-                * may lead to spurious interrupt after power sleep, or multiple
-                * entry of ath_mci_intr().
-                * Adding empty GPM check by returning HAL_MCI_GPM_INVALID can
-                * alleviate this effect, but clearing GPM RX interrupt bit is
-                * safe, because whether this is called from hw or driver code
-                * there must be an interrupt bit set/triggered initially
-                */
-                REG_WRITE(ah, AR_MCI_INTERRUPT_RX_MSG_RAW,
-                          AR_MCI_INTERRUPT_RX_MSG_GPM);
-
-                gpm_ptr = MS(REG_READ(ah, AR_MCI_GPM_1), AR_MCI_GPM_WRITE_PTR);
-                value = gpm_ptr;
-
-                if (value == 0)
-                        value = mci->gpm_len - 1;
-                else if (value >= mci->gpm_len) {
-                        if (value != 0xFFFF)
-                                value = 0;
-                } else {
-                        value--;
-                }
-
-                if (value == 0xFFFF) {
-                        value = MCI_GPM_INVALID;
-                        more_gpm = MCI_GPM_NOMORE;
-                } else if (state_type == MCI_STATE_NEXT_GPM_OFFSET) {
-                        if (gpm_ptr == mci->gpm_idx) {
-                                value = MCI_GPM_INVALID;
-                                more_gpm = MCI_GPM_NOMORE;
-                        } else {
-                                for (;;) {
-                                        u32 temp_index;
-
-                                        /* skip reserved GPM if any */
-
-                                        if (value != mci->gpm_idx)
-                                                more_gpm = MCI_GPM_MORE;
-                                        else
-                                                more_gpm = MCI_GPM_NOMORE;
-
-                                        temp_index = mci->gpm_idx;
-                                        mci->gpm_idx++;
-
-                                        if (mci->gpm_idx >=
-                                            mci->gpm_len)
-                                                mci->gpm_idx = 0;
-
-                                        if (ar9003_mci_is_gpm_valid(ah,
-                                                                    temp_index)) {
-                                                value = temp_index;
-                                                break;
-                                        }
-
-                                        if (more_gpm == MCI_GPM_NOMORE) {
-                                                value = MCI_GPM_INVALID;
-                                                break;
-                                        }
-                                }
-                        }
-                        if (p_data)
-                                *p_data = more_gpm;
-                        }
-
-                        if (value != MCI_GPM_INVALID)
-                                value <<= 4;
-
-                        break;
         case MCI_STATE_LAST_SCHD_MSG_OFFSET:
                 value = MS(REG_READ(ah, AR_MCI_RX_STATUS),
                                     AR_MCI_RX_LAST_SCHD_MSG_INDEX);
@@ -1276,21 +1191,6 @@ u32 ar9003_mci_state(struct ath_hw *ah, u32 state_type, u32 *p_data)
                            AR_MCI_RX_REMOTE_SLEEP) ?
                         MCI_BT_SLEEP : MCI_BT_AWAKE;
                 break;
-        case MCI_STATE_CONT_RSSI_POWER:
-                value = MS(mci->cont_status, AR_MCI_CONT_RSSI_POWER);
-                break;
-        case MCI_STATE_CONT_PRIORITY:
-                value = MS(mci->cont_status, AR_MCI_CONT_RRIORITY);
-                break;
-        case MCI_STATE_CONT_TXRX:
-                value = MS(mci->cont_status, AR_MCI_CONT_TXRX);
-                break;
-        case MCI_STATE_BT:
-                value = mci->bt_state;
-                break;
-        case MCI_STATE_SET_BT_SLEEP:
-                mci->bt_state = MCI_BT_SLEEP;
-                break;
         case MCI_STATE_SET_BT_AWAKE:
                 mci->bt_state = MCI_BT_AWAKE;
                 ar9003_mci_send_coex_version_query(ah, true);
@@ -1299,7 +1199,7 @@ u32 ar9003_mci_state(struct ath_hw *ah, u32 state_type, u32 *p_data)
                 if (mci->unhalt_bt_gpm)
                         ar9003_mci_send_coex_halt_bt_gpm(ah, false, true);
 
-                ar9003_mci_2g5g_switch(ah, true);
+                ar9003_mci_2g5g_switch(ah, false);
                 break;
         case MCI_STATE_SET_BT_CAL_START:
                 mci->bt_state = MCI_BT_CAL_START;
@@ -1323,34 +1223,6 @@ u32 ar9003_mci_state(struct ath_hw *ah, u32 state_type, u32 *p_data)
         case MCI_STATE_SEND_WLAN_COEX_VERSION:
                 ar9003_mci_send_coex_version_response(ah, true);
                 break;
-        case MCI_STATE_SET_BT_COEX_VERSION:
-                if (!p_data)
-                        ath_dbg(common, MCI,
-                                "MCI Set BT Coex version with NULL data!!\n");
-                else {
-                        mci->bt_ver_major = (*p_data >> 8) & 0xff;
-                        mci->bt_ver_minor = (*p_data) & 0xff;
-                        mci->bt_version_known = true;
-                        ath_dbg(common, MCI, "MCI BT version set: %d.%d\n",
-                                mci->bt_ver_major, mci->bt_ver_minor);
-                }
-                break;
-        case MCI_STATE_SEND_WLAN_CHANNELS:
-                if (p_data) {
-                        if (((mci->wlan_channels[1] & 0xffff0000) ==
-                             (*(p_data + 1) & 0xffff0000)) &&
-                            (mci->wlan_channels[2] == *(p_data + 2)) &&
-                            (mci->wlan_channels[3] == *(p_data + 3)))
-                                break;
-
-                        mci->wlan_channels[0] = *p_data++;
-                        mci->wlan_channels[1] = *p_data++;
-                        mci->wlan_channels[2] = *p_data++;
-                        mci->wlan_channels[3] = *p_data++;
-                }
-                mci->wlan_channels_update = true;
-                ar9003_mci_send_coex_wlan_channels(ah, true);
-                break;
         case MCI_STATE_SEND_VERSION_QUERY:
                 ar9003_mci_send_coex_version_query(ah, true);
                 break;
@@ -1358,38 +1230,16 @@ u32 ar9003_mci_state(struct ath_hw *ah, u32 state_type, u32 *p_data)
                 query_type = MCI_GPM_COEX_QUERY_BT_TOPOLOGY;
                 ar9003_mci_send_coex_bt_status_query(ah, true, query_type);
                 break;
-        case MCI_STATE_NEED_FLUSH_BT_INFO:
-                        /*
-                         * btcoex_hw.mci.unhalt_bt_gpm means whether it's
-                         * needed to send UNHALT message. It's set whenever
-                         * there's a request to send HALT message.
-                         * mci_halted_bt_gpm means whether HALT message is sent
-                         * out successfully.
-                         *
-                         * Checking (mci_unhalt_bt_gpm == false) instead of
-                         * checking (ah->mci_halted_bt_gpm == false) will make
-                         * sure currently is in UNHALT-ed mode and BT can
-                         * respond to status query.
-                         */
-                        value = (!mci->unhalt_bt_gpm &&
-                                 mci->need_flush_btinfo) ? 1 : 0;
-                        if (p_data)
-                                mci->need_flush_btinfo =
-                                        (*p_data != 0) ? true : false;
-                        break;
         case MCI_STATE_RECOVER_RX:
                 ar9003_mci_prep_interface(ah);
                 mci->query_bt = true;
                 mci->need_flush_btinfo = true;
                 ar9003_mci_send_coex_wlan_channels(ah, true);
-                ar9003_mci_2g5g_switch(ah, true);
+                ar9003_mci_2g5g_switch(ah, false);
                 break;
         case MCI_STATE_NEED_FTP_STOMP:
                 value = !(mci->config & ATH_MCI_CONFIG_DISABLE_FTP_STOMP);
                 break;
-        case MCI_STATE_NEED_TUNING:
-                value = !(mci->config & ATH_MCI_CONFIG_DISABLE_TUNING);
-                break;
         default:
                 break;
         }
@@ -1397,3 +1247,170 @@ u32 ar9003_mci_state(struct ath_hw *ah, u32 state_type, u32 *p_data)
         return value;
 }
 EXPORT_SYMBOL(ar9003_mci_state);
+
+void ar9003_mci_bt_gain_ctrl(struct ath_hw *ah)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_hw_mci *mci = &ah->btcoex_hw.mci;
+
+        ath_dbg(common, MCI, "Give LNA and SPDT control to BT\n");
+
+        REG_SET_BIT(ah, AR_PHY_GLB_CONTROL, AR_BTCOEX_CTRL_BT_OWN_SPDT_CTRL);
+        mci->is_2g = false;
+        mci->update_2g5g = true;
+        ar9003_mci_send_2g5g_status(ah, true);
+
+        /* Force another 2g5g update at next scanning */
+        mci->update_2g5g = true;
+}
+
+void ar9003_mci_set_power_awake(struct ath_hw *ah)
+{
+        u32 btcoex_ctrl2, diag_sw;
+        int i;
+        u8 lna_ctrl, bt_sleep;
+
+        for (i = 0; i < AH_WAIT_TIMEOUT; i++) {
+                btcoex_ctrl2 = REG_READ(ah, AR_BTCOEX_CTRL2);
+                if (btcoex_ctrl2 != 0xdeadbeef)
+                        break;
+                udelay(AH_TIME_QUANTUM);
+        }
+        REG_WRITE(ah, AR_BTCOEX_CTRL2, (btcoex_ctrl2 | BIT(23)));
+
+        for (i = 0; i < AH_WAIT_TIMEOUT; i++) {
+                diag_sw = REG_READ(ah, AR_DIAG_SW);
+                if (diag_sw != 0xdeadbeef)
+                        break;
+                udelay(AH_TIME_QUANTUM);
+        }
+        REG_WRITE(ah, AR_DIAG_SW, (diag_sw | BIT(27) | BIT(19) | BIT(18)));
+        lna_ctrl = REG_READ(ah, AR_OBS_BUS_CTRL) & 0x3;
+        bt_sleep = REG_READ(ah, AR_MCI_RX_STATUS) & AR_MCI_RX_REMOTE_SLEEP;
+
+        REG_WRITE(ah, AR_BTCOEX_CTRL2, btcoex_ctrl2);
+        REG_WRITE(ah, AR_DIAG_SW, diag_sw);
+
+        if (bt_sleep && (lna_ctrl == 2)) {
+                REG_SET_BIT(ah, AR_BTCOEX_RC, 0x1);
+                REG_CLR_BIT(ah, AR_BTCOEX_RC, 0x1);
+                udelay(50);
+        }
+}
+
+void ar9003_mci_check_gpm_offset(struct ath_hw *ah)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_hw_mci *mci = &ah->btcoex_hw.mci;
+        u32 offset;
+
+        /*
+         * This should only be called before "MAC Warm Reset" or "MCI Reset Rx".
+         */
+        offset = MS(REG_READ(ah, AR_MCI_GPM_1), AR_MCI_GPM_WRITE_PTR);
+        if (mci->gpm_idx == offset)
+                return;
+        ath_dbg(common, MCI, "GPM cached write pointer mismatch %d %d\n",
+                mci->gpm_idx, offset);
+        mci->query_bt = true;
+        mci->need_flush_btinfo = true;
+        mci->gpm_idx = 0;
+}
+
+u32 ar9003_mci_get_next_gpm_offset(struct ath_hw *ah, bool first, u32 *more)
+{
+        struct ath9k_hw_mci *mci = &ah->btcoex_hw.mci;
+        u32 offset, more_gpm = 0, gpm_ptr;
+
+        if (first) {
+                gpm_ptr = MS(REG_READ(ah, AR_MCI_GPM_1), AR_MCI_GPM_WRITE_PTR);
+                mci->gpm_idx = gpm_ptr;
+                return gpm_ptr;
+        }
+
+        /*
+         * This could be useful to avoid new GPM message interrupt which
+         * may lead to spurious interrupt after power sleep, or multiple
+         * entry of ath_mci_intr().
+         * Adding empty GPM check by returning HAL_MCI_GPM_INVALID can
+         * alleviate this effect, but clearing GPM RX interrupt bit is
+         * safe, because whether this is called from hw or driver code
+         * there must be an interrupt bit set/triggered initially
+         */
+        REG_WRITE(ah, AR_MCI_INTERRUPT_RX_MSG_RAW,
+                        AR_MCI_INTERRUPT_RX_MSG_GPM);
+
+        gpm_ptr = MS(REG_READ(ah, AR_MCI_GPM_1), AR_MCI_GPM_WRITE_PTR);
+        offset = gpm_ptr;
+
+        if (!offset)
+                offset = mci->gpm_len - 1;
+        else if (offset >= mci->gpm_len) {
+                if (offset != 0xFFFF)
+                        offset = 0;
+        } else {
+                offset--;
+        }
+
+        if ((offset == 0xFFFF) || (gpm_ptr == mci->gpm_idx)) {
+                offset = MCI_GPM_INVALID;
+                more_gpm = MCI_GPM_NOMORE;
+                goto out;
+        }
+        for (;;) {
+                u32 temp_index;
+
+                /* skip reserved GPM if any */
+
+                if (offset != mci->gpm_idx)
+                        more_gpm = MCI_GPM_MORE;
+                else
+                        more_gpm = MCI_GPM_NOMORE;
+
+                temp_index = mci->gpm_idx;
+                mci->gpm_idx++;
+
+                if (mci->gpm_idx >= mci->gpm_len)
+                        mci->gpm_idx = 0;
+
+                if (ar9003_mci_is_gpm_valid(ah, temp_index)) {
+                        offset = temp_index;
+                        break;
+                }
+
+                if (more_gpm == MCI_GPM_NOMORE) {
+                        offset = MCI_GPM_INVALID;
+                        break;
+                }
+        }
+
+        if (offset != MCI_GPM_INVALID)
+                offset <<= 4;
+out:
+        if (more)
+                *more = more_gpm;
+
+        return offset;
+}
+EXPORT_SYMBOL(ar9003_mci_get_next_gpm_offset);
+
+void ar9003_mci_set_bt_version(struct ath_hw *ah, u8 major, u8 minor)
+{
+        struct ath9k_hw_mci *mci = &ah->btcoex_hw.mci;
+
+        mci->bt_ver_major = major;
+        mci->bt_ver_minor = minor;
+        mci->bt_version_known = true;
+        ath_dbg(ath9k_hw_common(ah), MCI, "MCI BT version set: %d.%d\n",
+                mci->bt_ver_major, mci->bt_ver_minor);
+}
+EXPORT_SYMBOL(ar9003_mci_set_bt_version);
+
+void ar9003_mci_send_wlan_channels(struct ath_hw *ah)
+{
+        struct ath9k_hw_mci *mci = &ah->btcoex_hw.mci;
+
+        mci->wlan_channels_update = true;
+        ar9003_mci_send_coex_wlan_channels(ah, true);
+}
+EXPORT_SYMBOL(ar9003_mci_send_wlan_channels);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mci.h b/drivers/net/wireless/ath/ath9k/ar9003_mci.h
index 4842f6c06b8c..d33b8e128855 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_mci.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_mci.h
@@ -189,30 +189,18 @@ enum mci_bt_state {
 /* Type of state query */
 enum mci_state_type {
         MCI_STATE_ENABLE,
-        MCI_STATE_INIT_GPM_OFFSET,
-        MCI_STATE_NEXT_GPM_OFFSET,
-        MCI_STATE_LAST_GPM_OFFSET,
-        MCI_STATE_BT,
-        MCI_STATE_SET_BT_SLEEP,
         MCI_STATE_SET_BT_AWAKE,
         MCI_STATE_SET_BT_CAL_START,
         MCI_STATE_SET_BT_CAL,
         MCI_STATE_LAST_SCHD_MSG_OFFSET,
         MCI_STATE_REMOTE_SLEEP,
-        MCI_STATE_CONT_RSSI_POWER,
-        MCI_STATE_CONT_PRIORITY,
-        MCI_STATE_CONT_TXRX,
         MCI_STATE_RESET_REQ_WAKE,
         MCI_STATE_SEND_WLAN_COEX_VERSION,
-        MCI_STATE_SET_BT_COEX_VERSION,
-        MCI_STATE_SEND_WLAN_CHANNELS,
         MCI_STATE_SEND_VERSION_QUERY,
         MCI_STATE_SEND_STATUS_QUERY,
-        MCI_STATE_NEED_FLUSH_BT_INFO,
         MCI_STATE_SET_CONCUR_TX_PRI,
         MCI_STATE_RECOVER_RX,
         MCI_STATE_NEED_FTP_STOMP,
-        MCI_STATE_NEED_TUNING,
         MCI_STATE_DEBUG,
         MCI_STATE_MAX
 };
@@ -260,28 +248,26 @@ enum mci_gpm_coex_opcode {
 bool ar9003_mci_send_message(struct ath_hw *ah, u8 header, u32 flag,
                              u32 *payload, u8 len, bool wait_done,
                              bool check_bt);
-u32 ar9003_mci_state(struct ath_hw *ah, u32 state_type, u32 *p_data);
+u32 ar9003_mci_state(struct ath_hw *ah, u32 state_type);
 void ar9003_mci_setup(struct ath_hw *ah, u32 gpm_addr, void *gpm_buf,
                       u16 len, u32 sched_addr);
 void ar9003_mci_cleanup(struct ath_hw *ah);
 void ar9003_mci_get_interrupt(struct ath_hw *ah, u32 *raw_intr,
                               u32 *rx_msg_intr);
-
+u32 ar9003_mci_get_next_gpm_offset(struct ath_hw *ah, bool first, u32 *more);
+void ar9003_mci_set_bt_version(struct ath_hw *ah, u8 major, u8 minor);
+void ar9003_mci_send_wlan_channels(struct ath_hw *ah);
 /*
  * These functions are used by ath9k_hw.
  */
 
 #ifdef CONFIG_ATH9K_BTCOEX_SUPPORT
 
-static inline bool ar9003_mci_is_ready(struct ath_hw *ah)
-{
-        return ah->btcoex_hw.mci.ready;
-}
 void ar9003_mci_stop_bt(struct ath_hw *ah, bool save_fullsleep);
 void ar9003_mci_init_cal_req(struct ath_hw *ah, bool *is_reusable);
 void ar9003_mci_init_cal_done(struct ath_hw *ah);
 void ar9003_mci_set_full_sleep(struct ath_hw *ah);
-void ar9003_mci_2g5g_switch(struct ath_hw *ah, bool wait_done);
+void ar9003_mci_2g5g_switch(struct ath_hw *ah, bool force);
 void ar9003_mci_check_bt(struct ath_hw *ah);
 bool ar9003_mci_start_reset(struct ath_hw *ah, struct ath9k_channel *chan);
 int ar9003_mci_end_reset(struct ath_hw *ah, struct ath9k_channel *chan,
@@ -289,13 +275,12 @@ int ar9003_mci_end_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 void ar9003_mci_reset(struct ath_hw *ah, bool en_int, bool is_2g,
                       bool is_full_sleep);
 void ar9003_mci_get_isr(struct ath_hw *ah, enum ath9k_int *masked);
+void ar9003_mci_bt_gain_ctrl(struct ath_hw *ah);
+void ar9003_mci_set_power_awake(struct ath_hw *ah);
+void ar9003_mci_check_gpm_offset(struct ath_hw *ah);
 
 #else
 
-static inline bool ar9003_mci_is_ready(struct ath_hw *ah)
-{
-        return false;
-}
 static inline void ar9003_mci_stop_bt(struct ath_hw *ah, bool save_fullsleep)
 {
 }
@@ -330,6 +315,15 @@ static inline void ar9003_mci_reset(struct ath_hw *ah, bool en_int, bool is_2g,
 static inline void ar9003_mci_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
 {
 }
+static inline void ar9003_mci_bt_gain_ctrl(struct ath_hw *ah)
+{
+}
+static inline void ar9003_mci_set_power_awake(struct ath_hw *ah)
+{
+}
+static inline void ar9003_mci_check_gpm_offset(struct ath_hw *ah)
+{
+}
 #endif /* CONFIG_ATH9K_BTCOEX_SUPPORT */
 
 #endif
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 11abb972be1f..d6baf69cdc14 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -676,6 +676,10 @@ static int ar9003_hw_process_ini(struct ath_hw *ah,
         if (chan->channel == 2484)
                 ar9003_hw_prog_ini(ah, &ah->ini_japan2484, 1);
 
+        if (AR_SREV_9462(ah))
+                REG_WRITE(ah, AR_GLB_SWREG_DISCONT_MODE,
+                          AR_GLB_SWREG_DISCONT_EN_BT_WLAN);
+
         ah->modes_index = modesIndex;
         ar9003_hw_override_ini(ah);
         ar9003_hw_set_channel_regs(ah, chan);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index 7268a48a92a1..ed662c3bae5b 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -820,18 +820,26 @@
 #define AR_PHY_CHAN_INFO_MEMORY_CAPTURE_MASK         0x0001
 #define AR_PHY_RX_DELAY_DELAY   0x00003FFF
 #define AR_PHY_CCK_TX_CTRL_JAPAN    0x00000010
-#define AR_PHY_SPECTRAL_SCAN_ENABLE         0x00000001
-#define AR_PHY_SPECTRAL_SCAN_ENABLE_S       0
-#define AR_PHY_SPECTRAL_SCAN_ACTIVE         0x00000002
-#define AR_PHY_SPECTRAL_SCAN_ACTIVE_S       1
-#define AR_PHY_SPECTRAL_SCAN_FFT_PERIOD     0x000000F0
-#define AR_PHY_SPECTRAL_SCAN_FFT_PERIOD_S   4
-#define AR_PHY_SPECTRAL_SCAN_PERIOD         0x0000FF00
-#define AR_PHY_SPECTRAL_SCAN_PERIOD_S       8
-#define AR_PHY_SPECTRAL_SCAN_COUNT          0x00FF0000
-#define AR_PHY_SPECTRAL_SCAN_COUNT_S        16
-#define AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT   0x01000000
-#define AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT_S 24
+
+#define AR_PHY_SPECTRAL_SCAN_ENABLE           0x00000001
+#define AR_PHY_SPECTRAL_SCAN_ENABLE_S         0
+#define AR_PHY_SPECTRAL_SCAN_ACTIVE           0x00000002
+#define AR_PHY_SPECTRAL_SCAN_ACTIVE_S         1
+#define AR_PHY_SPECTRAL_SCAN_FFT_PERIOD       0x000000F0
+#define AR_PHY_SPECTRAL_SCAN_FFT_PERIOD_S     4
+#define AR_PHY_SPECTRAL_SCAN_PERIOD           0x0000FF00
+#define AR_PHY_SPECTRAL_SCAN_PERIOD_S         8
+#define AR_PHY_SPECTRAL_SCAN_COUNT            0x0FFF0000
+#define AR_PHY_SPECTRAL_SCAN_COUNT_S          16
+#define AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT     0x10000000
+#define AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT_S   28
+#define AR_PHY_SPECTRAL_SCAN_PRIORITY         0x20000000
+#define AR_PHY_SPECTRAL_SCAN_PRIORITY_S       29
+#define AR_PHY_SPECTRAL_SCAN_USE_ERR5         0x40000000
+#define AR_PHY_SPECTRAL_SCAN_USE_ERR5_S       30
+#define AR_PHY_SPECTRAL_SCAN_COMPRESSED_RPT   0x80000000
+#define AR_PHY_SPECTRAL_SCAN_COMPRESSED_RPT_S 31
+
 #define AR_PHY_CHANNEL_STATUS_RX_CLEAR      0x00000004
 #define AR_PHY_RTT_CTRL_ENA_RADIO_RETENTION     0x00000001
 #define AR_PHY_RTT_CTRL_ENA_RADIO_RETENTION_S   0
diff --git a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
index 1d6658e139b5..8f406ff2c95e 100644
--- a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
@@ -52,7 +52,7 @@ static const u32 ar9462_2p0_baseband_postamble[][5] = {
         {0x00009e04, 0x001c2020, 0x001c2020, 0x001c2020, 0x001c2020},
         {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000e2, 0x6c4000d8},
         {0x00009e10, 0x92c88d2e, 0x7ec88d2e, 0x7ec84d2e, 0x7ec86d2e},
-        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3376605e, 0x33795d5e},
+        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3376605e, 0x32395d5e},
         {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
         {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
@@ -958,7 +958,7 @@ static const u32 ar9462_2p0_radio_core[][2] = {
         {0x0001604c, 0x2699e04f},
         {0x00016050, 0x6db6db6c},
         {0x00016058, 0x6c200000},
-        {0x00016080, 0x00040000},
+        {0x00016080, 0x000c0000},
         {0x00016084, 0x9a68048c},
         {0x00016088, 0x54214514},
         {0x0001608c, 0x1203040b},
@@ -981,7 +981,7 @@ static const u32 ar9462_2p0_radio_core[][2] = {
         {0x00016144, 0x02084080},
         {0x00016148, 0x000080c0},
         {0x00016280, 0x050a0001},
-        {0x00016284, 0x3d841400},
+        {0x00016284, 0x3d841418},
         {0x00016288, 0x00000000},
         {0x0001628c, 0xe3000000},
         {0x00016290, 0xa1005080},
@@ -1007,6 +1007,7 @@ static const u32 ar9462_2p0_radio_core[][2] = {
 
 static const u32 ar9462_2p0_soc_preamble[][2] = {
         /* Addr      allmodes  */
+        {0x000040a4 ,0x00a0c1c9},
         {0x00007020, 0x00000000},
         {0x00007034, 0x00000002},
         {0x00007038, 0x000004c2},
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index a277cf6f339d..a8c050085648 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -307,6 +307,7 @@ struct ath_rx {
         u8 defant;
         u8 rxotherant;
         u32 *rxlink;
+        u32 num_pkts;
         unsigned int rxfilter;
         spinlock_t rxbuflock;
         struct list_head rxbuf;
@@ -325,6 +326,9 @@ int ath_rx_init(struct ath_softc *sc, int nbufs);
 void ath_rx_cleanup(struct ath_softc *sc);
 int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp);
 struct ath_txq *ath_txq_setup(struct ath_softc *sc, int qtype, int subtype);
+void ath_txq_lock(struct ath_softc *sc, struct ath_txq *txq);
+void ath_txq_unlock(struct ath_softc *sc, struct ath_txq *txq);
+void ath_txq_unlock_complete(struct ath_softc *sc, struct ath_txq *txq);
 void ath_tx_cleanupq(struct ath_softc *sc, struct ath_txq *txq);
 bool ath_drain_all_txq(struct ath_softc *sc, bool retry_tx);
 void ath_draintxq(struct ath_softc *sc,
@@ -414,9 +418,9 @@ int ath_beaconq_config(struct ath_softc *sc);
 void ath_set_beacon(struct ath_softc *sc);
 void ath9k_set_beaconing_status(struct ath_softc *sc, bool status);
 
-/*******/
-/* ANI */
-/*******/
+/*******************/
+/* Link Monitoring */
+/*******************/
 
 #define ATH_STA_SHORT_CALINTERVAL 1000    /* 1 second */
 #define ATH_AP_SHORT_CALINTERVAL  100     /* 100 ms */
@@ -427,7 +431,9 @@ void ath9k_set_beaconing_status(struct ath_softc *sc, bool status);
 #define ATH_RESTART_CALINTERVAL   1200000 /* 20 minutes */
 
 #define ATH_PAPRD_TIMEOUT       100 /* msecs */
+#define ATH_PLL_WORK_INTERVAL   100
 
+void ath_tx_complete_poll_work(struct work_struct *work);
 void ath_reset_work(struct work_struct *work);
 void ath_hw_check(struct work_struct *work);
 void ath_hw_pll_work(struct work_struct *work);
@@ -436,22 +442,31 @@ void ath_start_rx_poll(struct ath_softc *sc, u8 nbeacon);
 void ath_paprd_calibrate(struct work_struct *work);
 void ath_ani_calibrate(unsigned long data);
 void ath_start_ani(struct ath_common *common);
+int ath_update_survey_stats(struct ath_softc *sc);
+void ath_update_survey_nf(struct ath_softc *sc, int channel);
 
 /**********/
 /* BTCOEX */
 /**********/
 
+enum bt_op_flags {
+        BT_OP_PRIORITY_DETECTED,
+        BT_OP_SCAN,
+};
+
 struct ath_btcoex {
         bool hw_timer_enabled;
         spinlock_t btcoex_lock;
         struct timer_list period_timer; /* Timer for BT period */
         u32 bt_priority_cnt;
         unsigned long bt_priority_time;
+        unsigned long op_flags;
         int bt_stomp_type; /* Types of BT stomping */
         u32 btcoex_no_stomp; /* in usec */
         u32 btcoex_period; /* in usec */
         u32 btscan_no_stomp; /* in usec */
         u32 duty_cycle;
+        u32 bt_wait_time;
         struct ath_gen_timer *no_stomp_timer; /* Timer for no BT stomping */
         struct ath_mci_profile mci;
 };
@@ -513,8 +528,10 @@ static inline void ath_deinit_leds(struct ath_softc *sc)
 }
 #endif
 
-
+/*******************************/
 /* Antenna diversity/combining */
+/*******************************/
+
 #define ATH_ANT_RX_CURRENT_SHIFT 4
 #define ATH_ANT_RX_MAIN_SHIFT 2
 #define ATH_ANT_RX_MASK 0x3
@@ -567,6 +584,9 @@ struct ath_ant_comb {
         unsigned long scan_start_time;
 };
 
+void ath_ant_comb_scan(struct ath_softc *sc, struct ath_rx_status *rs);
+void ath_ant_comb_update(struct ath_softc *sc);
+
 /********************/
 /* Main driver core */
 /********************/
@@ -584,15 +604,15 @@ struct ath_ant_comb {
 #define ATH_TXPOWER_MAX         100     /* .5 dBm units */
 #define ATH_RATE_DUMMY_MARKER   0
 
-#define SC_OP_INVALID                BIT(0)
-#define SC_OP_BEACONS                BIT(1)
-#define SC_OP_OFFCHANNEL             BIT(2)
-#define SC_OP_RXFLUSH                BIT(3)
-#define SC_OP_TSF_RESET              BIT(4)
-#define SC_OP_BT_PRIORITY_DETECTED   BIT(5)
-#define SC_OP_BT_SCAN                BIT(6)
-#define SC_OP_ANI_RUN                BIT(7)
-#define SC_OP_PRIM_STA_VIF           BIT(8)
+enum sc_op_flags {
+        SC_OP_INVALID,
+        SC_OP_BEACONS,
+        SC_OP_RXFLUSH,
+        SC_OP_TSF_RESET,
+        SC_OP_ANI_RUN,
+        SC_OP_PRIM_STA_VIF,
+        SC_OP_HW_RESET,
+};
 
 /* Powersave flags */
 #define PS_WAIT_FOR_BEACON        BIT(0)
@@ -638,9 +658,9 @@ struct ath_softc {
         struct completion paprd_complete;
 
         unsigned int hw_busy_count;
+        unsigned long sc_flags;
 
         u32 intrstatus;
-        u32 sc_flags; /* SC_OP_* */
         u16 ps_flags; /* PS_* */
         u16 curtxpow;
         bool ps_enabled;
@@ -678,6 +698,7 @@ struct ath_softc {
 #ifdef CONFIG_ATH9K_BTCOEX_SUPPORT
         struct ath_btcoex btcoex;
         struct ath_mci_coex mci_coex;
+        struct work_struct mci_work;
 #endif
 
         struct ath_descdma txsdma;
@@ -736,5 +757,4 @@ void ath9k_calculate_iter_data(struct ieee80211_hw *hw,
                                struct ieee80211_vif *vif,
                                struct ath9k_vif_iter_data *iter_data);
 
-
 #endif /* ATH9K_H */
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index 11bc55e3d697..40775da8941e 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -48,7 +48,10 @@ int ath_beaconq_config(struct ath_softc *sc)
                 txq = sc->tx.txq_map[WME_AC_BE];
                 ath9k_hw_get_txq_props(ah, txq->axq_qnum, &qi_be);
                 qi.tqi_aifs = qi_be.tqi_aifs;
-                qi.tqi_cwmin = 4*qi_be.tqi_cwmin;
+                if (ah->slottime == ATH9K_SLOT_TIME_20)
+                        qi.tqi_cwmin = 2*qi_be.tqi_cwmin;
+                else
+                        qi.tqi_cwmin = 4*qi_be.tqi_cwmin;
                 qi.tqi_cwmax = qi_be.tqi_cwmax;
         }
 
@@ -387,7 +390,7 @@ void ath_beacon_tasklet(unsigned long data)
                 } else if (sc->beacon.bmisscnt >= BSTUCK_THRESH) {
                         ath_dbg(common, BSTUCK, "beacon is officially stuck\n");
                         sc->beacon.bmisscnt = 0;
-                        sc->sc_flags |= SC_OP_TSF_RESET;
+                        set_bit(SC_OP_TSF_RESET, &sc->sc_flags);
                         ieee80211_queue_work(sc->hw, &sc->hw_reset_work);
                 }
 
@@ -477,16 +480,16 @@ static void ath9k_beacon_init(struct ath_softc *sc,
                               u32 next_beacon,
                               u32 beacon_period)
 {
-        if (sc->sc_flags & SC_OP_TSF_RESET) {
+        if (test_bit(SC_OP_TSF_RESET, &sc->sc_flags)) {
                 ath9k_ps_wakeup(sc);
                 ath9k_hw_reset_tsf(sc->sc_ah);
         }
 
         ath9k_hw_beaconinit(sc->sc_ah, next_beacon, beacon_period);
 
-        if (sc->sc_flags & SC_OP_TSF_RESET) {
+        if (test_bit(SC_OP_TSF_RESET, &sc->sc_flags)) {
                 ath9k_ps_restore(sc);
-                sc->sc_flags &= ~SC_OP_TSF_RESET;
+                clear_bit(SC_OP_TSF_RESET, &sc->sc_flags);
         }
 }
 
@@ -516,7 +519,7 @@ static void ath_beacon_config_ap(struct ath_softc *sc,
         /* Set the computed AP beacon timers */
 
         ath9k_hw_disable_interrupts(ah);
-        sc->sc_flags |= SC_OP_TSF_RESET;
+        set_bit(SC_OP_TSF_RESET, &sc->sc_flags);
         ath9k_beacon_init(sc, nexttbtt, intval);
         sc->beacon.bmisscnt = 0;
         ath9k_hw_set_interrupts(ah);
@@ -659,7 +662,7 @@ static void ath_beacon_config_adhoc(struct ath_softc *sc,
         u32 tsf, intval, nexttbtt;
 
         ath9k_reset_beacon_status(sc);
-        if (!(sc->sc_flags & SC_OP_BEACONS))
+        if (!test_bit(SC_OP_BEACONS, &sc->sc_flags))
                 ath9k_hw_settsf64(ah, sc->beacon.bc_tstamp);
 
         intval = TU_TO_USEC(conf->beacon_interval);
@@ -724,7 +727,7 @@ static bool ath9k_allow_beacon_config(struct ath_softc *sc,
          */
         if ((sc->sc_ah->opmode == NL80211_IFTYPE_STATION) &&
             (vif->type == NL80211_IFTYPE_STATION) &&
-            (sc->sc_flags & SC_OP_BEACONS) &&
+            test_bit(SC_OP_BEACONS, &sc->sc_flags) &&
             !avp->primary_sta_vif) {
                 ath_dbg(common, CONFIG,
                         "Beacon already configured for a station interface\n");
@@ -810,7 +813,7 @@ void ath_set_beacon(struct ath_softc *sc)
                 return;
         }
 
-        sc->sc_flags |= SC_OP_BEACONS;
+        set_bit(SC_OP_BEACONS, &sc->sc_flags);
 }
 
 void ath9k_set_beaconing_status(struct ath_softc *sc, bool status)
@@ -818,7 +821,7 @@ void ath9k_set_beaconing_status(struct ath_softc *sc, bool status)
         struct ath_hw *ah = sc->sc_ah;
 
         if (!ath_has_valid_bslot(sc)) {
-                sc->sc_flags &= ~SC_OP_BEACONS;
+                clear_bit(SC_OP_BEACONS, &sc->sc_flags);
                 return;
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/btcoex.c b/drivers/net/wireless/ath/ath9k/btcoex.c
index 1ca6da80d4ad..acd437384fe4 100644
--- a/drivers/net/wireless/ath/ath9k/btcoex.c
+++ b/drivers/net/wireless/ath/ath9k/btcoex.c
@@ -336,10 +336,16 @@ static void ar9003_btcoex_bt_stomp(struct ath_hw *ah,
                          enum ath_stomp_type stomp_type)
 {
         struct ath_btcoex_hw *btcoex = &ah->btcoex_hw;
-        const u32 *weight = AR_SREV_9462(ah) ? ar9003_wlan_weights[stomp_type] :
-                                               ar9462_wlan_weights[stomp_type];
+        const u32 *weight = ar9003_wlan_weights[stomp_type];
         int i;
 
+        if (AR_SREV_9462(ah)) {
+                if ((stomp_type == ATH_BTCOEX_STOMP_LOW) &&
+                    btcoex->mci.stomp_ftp)
+                        stomp_type = ATH_BTCOEX_STOMP_LOW_FTP;
+                weight = ar9462_wlan_weights[stomp_type];
+        }
+
         for (i = 0; i < AR9300_NUM_WLAN_WEIGHTS; i++) {
                 btcoex->bt_weight[i] = AR9300_BT_WGHT;
                 btcoex->wlan_weight[i] = weight[i];
diff --git a/drivers/net/wireless/ath/ath9k/btcoex.h b/drivers/net/wireless/ath/ath9k/btcoex.h
index 3a1e1cfabd5e..20092f98658f 100644
--- a/drivers/net/wireless/ath/ath9k/btcoex.h
+++ b/drivers/net/wireless/ath/ath9k/btcoex.h
@@ -36,6 +36,9 @@
 #define ATH_BT_CNT_THRESHOLD           3
 #define ATH_BT_CNT_SCAN_THRESHOLD      15
 
+#define ATH_BTCOEX_RX_WAIT_TIME       100
+#define ATH_BTCOEX_STOMP_FTP_THRESH   5
+
 #define AR9300_NUM_BT_WEIGHTS   4
 #define AR9300_NUM_WLAN_WEIGHTS 4
 /* Defines the BT AR_BT_COEX_WGHT used */
@@ -80,6 +83,7 @@ struct ath9k_hw_mci {
         u8 bt_ver_major;
         u8 bt_ver_minor;
         u8 bt_state;
+        u8 stomp_ftp;
 };
 
 struct ath_btcoex_hw {
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index fde700c4e490..2831258d9507 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -205,10 +205,10 @@ static ssize_t write_file_disable_ani(struct file *file,
         common->disable_ani = !!disable_ani;
 
         if (disable_ani) {
-                sc->sc_flags &= ~SC_OP_ANI_RUN;
+                clear_bit(SC_OP_ANI_RUN, &sc->sc_flags);
                 del_timer_sync(&common->ani.timer);
         } else {
-                sc->sc_flags |= SC_OP_ANI_RUN;
+                set_bit(SC_OP_ANI_RUN, &sc->sc_flags);
                 ath_start_ani(common);
         }
 
@@ -374,6 +374,8 @@ void ath_debug_stat_interrupt(struct ath_softc *sc, enum ath9k_int status)
                 sc->debug.stats.istats.dtim++;
         if (status & ATH9K_INT_TSFOOR)
                 sc->debug.stats.istats.tsfoor++;
+        if (status & ATH9K_INT_MCI)
+                sc->debug.stats.istats.mci++;
 }
 
 static ssize_t read_file_interrupt(struct file *file, char __user *user_buf,
@@ -418,6 +420,7 @@ static ssize_t read_file_interrupt(struct file *file, char __user *user_buf,
         PR_IS("DTIMSYNC", dtimsync);
         PR_IS("DTIM", dtim);
         PR_IS("TSFOOR", tsfoor);
+        PR_IS("MCI", mci);
         PR_IS("TOTAL", total);
 
         len += snprintf(buf + len, mxlen - len,
@@ -1318,7 +1321,7 @@ static int open_file_bb_mac_samps(struct inode *inode, struct file *file)
         u8 chainmask = (ah->rxchainmask << 3) | ah->rxchainmask;
         u8 nread;
 
-        if (sc->sc_flags & SC_OP_INVALID)
+        if (test_bit(SC_OP_INVALID, &sc->sc_flags))
                 return -EAGAIN;
 
         buf = vmalloc(size);
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index c34da09d9103..d0f851cea43a 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -86,6 +86,7 @@ struct ath_interrupt_stats {
         u32 dtim;
         u32 bb_watchdog;
         u32 tsfoor;
+        u32 mci;
 
         /* Sync-cause stats */
         u32 sync_cause_all;
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_4k.c b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
index 4322ac80c203..a850f44fa767 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_4k.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
@@ -135,7 +135,7 @@ static u32 ath9k_hw_4k_dump_eeprom(struct ath_hw *ah, bool dump_base_hdr,
         if (!dump_base_hdr) {
                 len += snprintf(buf + len, size - len,
                                 "%20s :\n", "2GHz modal Header");
-                len += ath9k_dump_4k_modal_eeprom(buf, len, size,
+                len = ath9k_dump_4k_modal_eeprom(buf, len, size,
                                                   &eep->modalHeader);
                 goto out;
         }
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
index aa614767adff..cd742fb944c2 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
@@ -132,7 +132,7 @@ static u32 ath9k_hw_ar9287_dump_eeprom(struct ath_hw *ah, bool dump_base_hdr,
         if (!dump_base_hdr) {
                 len += snprintf(buf + len, size - len,
                                 "%20s :\n", "2GHz modal Header");
-                len += ar9287_dump_modal_eeprom(buf, len, size,
+                len = ar9287_dump_modal_eeprom(buf, len, size,
                                                 &eep->modalHeader);
                 goto out;
         }
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
index b5fba8b18b8b..56290f318520 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
@@ -211,11 +211,11 @@ static u32 ath9k_hw_def_dump_eeprom(struct ath_hw *ah, bool dump_base_hdr,
         if (!dump_base_hdr) {
                 len += snprintf(buf + len, size - len,
                                 "%20s :\n", "2GHz modal Header");
-                len += ath9k_def_dump_modal_eeprom(buf, len, size,
+                len = ath9k_def_dump_modal_eeprom(buf, len, size,
                                                    &eep->modalHeader[0]);
                 len += snprintf(buf + len, size - len,
                                 "%20s :\n", "5GHz modal Header");
-                len += ath9k_def_dump_modal_eeprom(buf, len, size,
+                len = ath9k_def_dump_modal_eeprom(buf, len, size,
                                                    &eep->modalHeader[1]);
                 goto out;
         }
diff --git a/drivers/net/wireless/ath/ath9k/gpio.c b/drivers/net/wireless/ath/ath9k/gpio.c
index 281a9af0f1b6..26032cb59b8a 100644
--- a/drivers/net/wireless/ath/ath9k/gpio.c
+++ b/drivers/net/wireless/ath/ath9k/gpio.c
@@ -132,17 +132,18 @@ static void ath_detect_bt_priority(struct ath_softc *sc)
 
         if (time_after(jiffies, btcoex->bt_priority_time +
                         msecs_to_jiffies(ATH_BT_PRIORITY_TIME_THRESHOLD))) {
-                sc->sc_flags &= ~(SC_OP_BT_PRIORITY_DETECTED | SC_OP_BT_SCAN);
+                clear_bit(BT_OP_PRIORITY_DETECTED, &btcoex->op_flags);
+                clear_bit(BT_OP_SCAN, &btcoex->op_flags);
                 /* Detect if colocated bt started scanning */
                 if (btcoex->bt_priority_cnt >= ATH_BT_CNT_SCAN_THRESHOLD) {
                         ath_dbg(ath9k_hw_common(sc->sc_ah), BTCOEX,
                                 "BT scan detected\n");
-                        sc->sc_flags |= (SC_OP_BT_SCAN |
-                                         SC_OP_BT_PRIORITY_DETECTED);
+                        set_bit(BT_OP_PRIORITY_DETECTED, &btcoex->op_flags);
+                        set_bit(BT_OP_SCAN, &btcoex->op_flags);
                 } else if (btcoex->bt_priority_cnt >= ATH_BT_CNT_THRESHOLD) {
                         ath_dbg(ath9k_hw_common(sc->sc_ah), BTCOEX,
                                 "BT priority traffic detected\n");
-                        sc->sc_flags |= SC_OP_BT_PRIORITY_DETECTED;
+                        set_bit(BT_OP_PRIORITY_DETECTED, &btcoex->op_flags);
                 }
 
                 btcoex->bt_priority_cnt = 0;
@@ -190,13 +191,26 @@ static void ath_btcoex_period_timer(unsigned long data)
         struct ath_softc *sc = (struct ath_softc *) data;
         struct ath_hw *ah = sc->sc_ah;
         struct ath_btcoex *btcoex = &sc->btcoex;
+        struct ath_mci_profile *mci = &btcoex->mci;
         u32 timer_period;
         bool is_btscan;
 
         ath9k_ps_wakeup(sc);
         if (!(ah->caps.hw_caps & ATH9K_HW_CAP_MCI))
                 ath_detect_bt_priority(sc);
-        is_btscan = sc->sc_flags & SC_OP_BT_SCAN;
+        is_btscan = test_bit(BT_OP_SCAN, &btcoex->op_flags);
+
+        btcoex->bt_wait_time += btcoex->btcoex_period;
+        if (btcoex->bt_wait_time > ATH_BTCOEX_RX_WAIT_TIME) {
+                if (ar9003_mci_state(ah, MCI_STATE_NEED_FTP_STOMP) &&
+                    (mci->num_pan || mci->num_other_acl))
+                        ah->btcoex_hw.mci.stomp_ftp =
+                                (sc->rx.num_pkts < ATH_BTCOEX_STOMP_FTP_THRESH);
+                else
+                        ah->btcoex_hw.mci.stomp_ftp = false;
+                btcoex->bt_wait_time = 0;
+                sc->rx.num_pkts = 0;
+        }
 
         spin_lock_bh(&btcoex->btcoex_lock);
 
@@ -218,9 +232,8 @@ static void ath_btcoex_period_timer(unsigned long data)
         }
 
         ath9k_ps_restore(sc);
-        timer_period = btcoex->btcoex_period / 1000;
-        mod_timer(&btcoex->period_timer, jiffies +
-                                  msecs_to_jiffies(timer_period));
+        timer_period = btcoex->btcoex_period;
+        mod_timer(&btcoex->period_timer, jiffies + msecs_to_jiffies(timer_period));
 }
 
 /*
@@ -233,14 +246,14 @@ static void ath_btcoex_no_stomp_timer(void *arg)
         struct ath_hw *ah = sc->sc_ah;
         struct ath_btcoex *btcoex = &sc->btcoex;
         struct ath_common *common = ath9k_hw_common(ah);
-        bool is_btscan = sc->sc_flags & SC_OP_BT_SCAN;
 
         ath_dbg(common, BTCOEX, "no stomp timer running\n");
 
         ath9k_ps_wakeup(sc);
         spin_lock_bh(&btcoex->btcoex_lock);
 
-        if (btcoex->bt_stomp_type == ATH_BTCOEX_STOMP_LOW || is_btscan)
+        if (btcoex->bt_stomp_type == ATH_BTCOEX_STOMP_LOW ||
+            test_bit(BT_OP_SCAN, &btcoex->op_flags))
                 ath9k_hw_btcoex_bt_stomp(ah, ATH_BTCOEX_STOMP_NONE);
          else if (btcoex->bt_stomp_type == ATH_BTCOEX_STOMP_ALL)
                 ath9k_hw_btcoex_bt_stomp(ah, ATH_BTCOEX_STOMP_LOW);
@@ -254,10 +267,10 @@ static int ath_init_btcoex_timer(struct ath_softc *sc)
 {
         struct ath_btcoex *btcoex = &sc->btcoex;
 
-        btcoex->btcoex_period = ATH_BTCOEX_DEF_BT_PERIOD * 1000;
-        btcoex->btcoex_no_stomp = (100 - ATH_BTCOEX_DEF_DUTY_CYCLE) *
+        btcoex->btcoex_period = ATH_BTCOEX_DEF_BT_PERIOD;
+        btcoex->btcoex_no_stomp = (100 - ATH_BTCOEX_DEF_DUTY_CYCLE) * 1000 *
                 btcoex->btcoex_period / 100;
-        btcoex->btscan_no_stomp = (100 - ATH_BTCOEX_BTSCAN_DUTY_CYCLE) *
+        btcoex->btscan_no_stomp = (100 - ATH_BTCOEX_BTSCAN_DUTY_CYCLE) * 1000 *
                                    btcoex->btcoex_period / 100;
 
         setup_timer(&btcoex->period_timer, ath_btcoex_period_timer,
@@ -292,7 +305,7 @@ void ath9k_btcoex_timer_resume(struct ath_softc *sc)
 
         btcoex->bt_priority_cnt = 0;
         btcoex->bt_priority_time = jiffies;
-        sc->sc_flags &= ~(SC_OP_BT_PRIORITY_DETECTED | SC_OP_BT_SCAN);
+        btcoex->op_flags &= ~(BT_OP_PRIORITY_DETECTED | BT_OP_SCAN);
 
         mod_timer(&btcoex->period_timer, jiffies);
 }
@@ -316,12 +329,13 @@ void ath9k_btcoex_timer_pause(struct ath_softc *sc)
 
 u16 ath9k_btcoex_aggr_limit(struct ath_softc *sc, u32 max_4ms_framelen)
 {
+        struct ath_btcoex *btcoex = &sc->btcoex;
         struct ath_mci_profile *mci = &sc->btcoex.mci;
         u16 aggr_limit = 0;
 
         if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_MCI) && mci->aggr_limit)
                 aggr_limit = (max_4ms_framelen * mci->aggr_limit) >> 4;
-        else if (sc->sc_flags & SC_OP_BT_PRIORITY_DETECTED)
+        else if (test_bit(BT_OP_PRIORITY_DETECTED, &btcoex->op_flags))
                 aggr_limit = min((max_4ms_framelen * 3) / 8,
                                  (u32)ATH_AMPDU_LIMIT_MAX);
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 7db1890448f2..784baee5db84 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -390,14 +390,6 @@ static void ath9k_hw_disablepcie(struct ath_hw *ah)
         REG_WRITE(ah, AR_PCIE_SERDES2, 0x00000000);
 }
 
-static void ath9k_hw_aspm_init(struct ath_hw *ah)
-{
-        struct ath_common *common = ath9k_hw_common(ah);
-
-        if (common->bus_ops->aspm_init)
-                common->bus_ops->aspm_init(common);
-}
-
 /* This should work for all families including legacy */
 static bool ath9k_hw_chip_test(struct ath_hw *ah)
 {
@@ -693,9 +685,6 @@ static int __ath9k_hw_init(struct ath_hw *ah)
         if (r)
                 return r;
 
-        if (ah->is_pciexpress)
-                ath9k_hw_aspm_init(ah);
-
         r = ath9k_hw_init_macaddr(ah);
         if (r) {
                 ath_err(common, "Failed to initialize MAC address\n");
@@ -1359,6 +1348,9 @@ static bool ath9k_hw_set_reset(struct ath_hw *ah, int type)
                 }
         }
 
+        if (ath9k_hw_mci_is_enabled(ah))
+                ar9003_mci_check_gpm_offset(ah);
+
         REG_WRITE(ah, AR_RTC_RC, rst_flags);
 
         REGWRITE_BUFFER_FLUSH(ah);
@@ -1443,9 +1435,6 @@ static bool ath9k_hw_set_reset_reg(struct ath_hw *ah, u32 type)
                 break;
         }
 
-        if (ah->caps.hw_caps & ATH9K_HW_CAP_MCI)
-                REG_WRITE(ah, AR_RTC_KEEP_AWAKE, 0x2);
-
         return ret;
 }
 
@@ -1721,8 +1710,8 @@ static int ath9k_hw_do_fastcc(struct ath_hw *ah, struct ath9k_channel *chan)
         ath9k_hw_loadnf(ah, ah->curchan);
         ath9k_hw_start_nfcal(ah, true);
 
-        if ((ah->caps.hw_caps & ATH9K_HW_CAP_MCI) && ar9003_mci_is_ready(ah))
-                ar9003_mci_2g5g_switch(ah, true);
+        if (ath9k_hw_mci_is_enabled(ah))
+                ar9003_mci_2g5g_switch(ah, false);
 
         if (AR_SREV_9271(ah))
                 ar9002_hw_load_ani_reg(ah, chan);
@@ -1742,10 +1731,9 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         u64 tsf = 0;
         int i, r;
         bool start_mci_reset = false;
-        bool mci = !!(ah->caps.hw_caps & ATH9K_HW_CAP_MCI);
         bool save_fullsleep = ah->chip_fullsleep;
 
-        if (mci) {
+        if (ath9k_hw_mci_is_enabled(ah)) {
                 start_mci_reset = ar9003_mci_start_reset(ah, chan);
                 if (start_mci_reset)
                         return 0;
@@ -1774,7 +1762,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                         return r;
         }
 
-        if (mci)
+        if (ath9k_hw_mci_is_enabled(ah))
                 ar9003_mci_stop_bt(ah, save_fullsleep);
 
         saveDefAntenna = REG_READ(ah, AR_DEF_ANTENNA);
@@ -1832,7 +1820,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         if (r)
                 return r;
 
-        if (mci)
+        if (ath9k_hw_mci_is_enabled(ah))
                 ar9003_mci_reset(ah, false, IS_CHAN_2GHZ(chan), save_fullsleep);
 
         /*
@@ -1927,7 +1915,8 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 
         ath9k_hw_set_dma(ah);
 
-        REG_WRITE(ah, AR_OBS, 8);
+        if (!ath9k_hw_mci_is_enabled(ah))
+                REG_WRITE(ah, AR_OBS, 8);
 
         if (ah->config.rx_intr_mitigation) {
                 REG_RMW_FIELD(ah, AR_RIMT, AR_RIMT_LAST, 500);
@@ -1951,7 +1940,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         ath9k_hw_loadnf(ah, chan);
         ath9k_hw_start_nfcal(ah, true);
 
-        if (mci && ar9003_mci_end_reset(ah, chan, caldata))
+        if (ath9k_hw_mci_is_enabled(ah) && ar9003_mci_end_reset(ah, chan, caldata))
                 return -EIO;
 
         ENABLE_REGWRITE_BUFFER(ah);
@@ -1996,7 +1985,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         if (ath9k_hw_btcoex_is_enabled(ah))
                 ath9k_hw_btcoex_enable(ah);
 
-        if (mci)
+        if (ath9k_hw_mci_is_enabled(ah))
                 ar9003_mci_check_bt(ah);
 
         if (AR_SREV_9300_20_OR_LATER(ah)) {
@@ -2019,39 +2008,35 @@ EXPORT_SYMBOL(ath9k_hw_reset);
  * Notify Power Mgt is disabled in self-generated frames.
  * If requested, force chip to sleep.
  */
-static void ath9k_set_power_sleep(struct ath_hw *ah, int setChip)
+static void ath9k_set_power_sleep(struct ath_hw *ah)
 {
         REG_SET_BIT(ah, AR_STA_ID1, AR_STA_ID1_PWR_SAV);
-        if (setChip) {
-                if (AR_SREV_9462(ah)) {
-                        REG_WRITE(ah, AR_TIMER_MODE,
-                                  REG_READ(ah, AR_TIMER_MODE) & 0xFFFFFF00);
-                        REG_WRITE(ah, AR_NDP2_TIMER_MODE, REG_READ(ah,
-                                  AR_NDP2_TIMER_MODE) & 0xFFFFFF00);
-                        REG_WRITE(ah, AR_SLP32_INC,
-                                  REG_READ(ah, AR_SLP32_INC) & 0xFFF00000);
-                        /* xxx Required for WLAN only case ? */
-                        REG_WRITE(ah, AR_MCI_INTERRUPT_RX_MSG_EN, 0);
-                        udelay(100);
-                }
 
-                /*
-                 * Clear the RTC force wake bit to allow the
-                 * mac to go to sleep.
-                 */
-                REG_CLR_BIT(ah, AR_RTC_FORCE_WAKE, AR_RTC_FORCE_WAKE_EN);
+        if (AR_SREV_9462(ah)) {
+                REG_CLR_BIT(ah, AR_TIMER_MODE, 0xff);
+                REG_CLR_BIT(ah, AR_NDP2_TIMER_MODE, 0xff);
+                REG_CLR_BIT(ah, AR_SLP32_INC, 0xfffff);
+                /* xxx Required for WLAN only case ? */
+                REG_WRITE(ah, AR_MCI_INTERRUPT_RX_MSG_EN, 0);
+                udelay(100);
+        }
 
-                if (AR_SREV_9462(ah))
-                        udelay(100);
+        /*
+         * Clear the RTC force wake bit to allow the
+         * mac to go to sleep.
+         */
+        REG_CLR_BIT(ah, AR_RTC_FORCE_WAKE, AR_RTC_FORCE_WAKE_EN);
 
-                if (!AR_SREV_9100(ah) && !AR_SREV_9300_20_OR_LATER(ah))
-                        REG_WRITE(ah, AR_RC, AR_RC_AHB | AR_RC_HOSTIF);
+        if (ath9k_hw_mci_is_enabled(ah))
+                udelay(100);
 
-                /* Shutdown chip. Active low */
-                if (!AR_SREV_5416(ah) && !AR_SREV_9271(ah)) {
-                        REG_CLR_BIT(ah, AR_RTC_RESET, AR_RTC_RESET_EN);
-                        udelay(2);
-                }
+        if (!AR_SREV_9100(ah) && !AR_SREV_9300_20_OR_LATER(ah))
+                REG_WRITE(ah, AR_RC, AR_RC_AHB | AR_RC_HOSTIF);
+
+        /* Shutdown chip. Active low */
+        if (!AR_SREV_5416(ah) && !AR_SREV_9271(ah)) {
+                REG_CLR_BIT(ah, AR_RTC_RESET, AR_RTC_RESET_EN);
+                udelay(2);
         }
 
         /* Clear Bit 14 of AR_WA after putting chip into Full Sleep mode. */
@@ -2064,44 +2049,38 @@ static void ath9k_set_power_sleep(struct ath_hw *ah, int setChip)
  * frames. If request, set power mode of chip to
  * auto/normal.  Duration in units of 128us (1/8 TU).
  */
-static void ath9k_set_power_network_sleep(struct ath_hw *ah, int setChip)
+static void ath9k_set_power_network_sleep(struct ath_hw *ah)
 {
-        u32 val;
+        struct ath9k_hw_capabilities *pCap = &ah->caps;
 
         REG_SET_BIT(ah, AR_STA_ID1, AR_STA_ID1_PWR_SAV);
-        if (setChip) {
-                struct ath9k_hw_capabilities *pCap = &ah->caps;
 
-                if (!(pCap->hw_caps & ATH9K_HW_CAP_AUTOSLEEP)) {
-                        /* Set WakeOnInterrupt bit; clear ForceWake bit */
-                        REG_WRITE(ah, AR_RTC_FORCE_WAKE,
-                                  AR_RTC_FORCE_WAKE_ON_INT);
-                } else {
+        if (!(pCap->hw_caps & ATH9K_HW_CAP_AUTOSLEEP)) {
+                /* Set WakeOnInterrupt bit; clear ForceWake bit */
+                REG_WRITE(ah, AR_RTC_FORCE_WAKE,
+                          AR_RTC_FORCE_WAKE_ON_INT);
+        } else {
 
-                        /* When chip goes into network sleep, it could be waken
-                         * up by MCI_INT interrupt caused by BT's HW messages
-                         * (LNA_xxx, CONT_xxx) which chould be in a very fast
-                         * rate (~100us). This will cause chip to leave and
-                         * re-enter network sleep mode frequently, which in
-                         * consequence will have WLAN MCI HW to generate lots of
-                         * SYS_WAKING and SYS_SLEEPING messages which will make
-                         * BT CPU to busy to process.
-                         */
-                        if (AR_SREV_9462(ah)) {
-                                val = REG_READ(ah, AR_MCI_INTERRUPT_RX_MSG_EN) &
-                                        ~AR_MCI_INTERRUPT_RX_HW_MSG_MASK;
-                                REG_WRITE(ah, AR_MCI_INTERRUPT_RX_MSG_EN, val);
-                        }
-                        /*
-                         * Clear the RTC force wake bit to allow the
-                         * mac to go to sleep.
-                         */
-                        REG_CLR_BIT(ah, AR_RTC_FORCE_WAKE,
-                                    AR_RTC_FORCE_WAKE_EN);
-
-                        if (AR_SREV_9462(ah))
-                                udelay(30);
-                }
+                /* When chip goes into network sleep, it could be waken
+                 * up by MCI_INT interrupt caused by BT's HW messages
+                 * (LNA_xxx, CONT_xxx) which chould be in a very fast
+                 * rate (~100us). This will cause chip to leave and
+                 * re-enter network sleep mode frequently, which in
+                 * consequence will have WLAN MCI HW to generate lots of
+                 * SYS_WAKING and SYS_SLEEPING messages which will make
+                 * BT CPU to busy to process.
+                 */
+                if (ath9k_hw_mci_is_enabled(ah))
+                        REG_CLR_BIT(ah, AR_MCI_INTERRUPT_RX_MSG_EN,
+                                    AR_MCI_INTERRUPT_RX_HW_MSG_MASK);
+                /*
+                 * Clear the RTC force wake bit to allow the
+                 * mac to go to sleep.
+                 */
+                REG_CLR_BIT(ah, AR_RTC_FORCE_WAKE, AR_RTC_FORCE_WAKE_EN);
+
+                if (ath9k_hw_mci_is_enabled(ah))
+                        udelay(30);
         }
 
         /* Clear Bit 14 of AR_WA after putting chip into Net Sleep mode. */
@@ -2109,7 +2088,7 @@ static void ath9k_set_power_network_sleep(struct ath_hw *ah, int setChip)
                 REG_WRITE(ah, AR_WA, ah->WARegVal & ~AR_WA_D3_L1_DISABLE);
 }
 
-static bool ath9k_hw_set_power_awake(struct ath_hw *ah, int setChip)
+static bool ath9k_hw_set_power_awake(struct ath_hw *ah)
 {
         u32 val;
         int i;
@@ -2120,37 +2099,38 @@ static bool ath9k_hw_set_power_awake(struct ath_hw *ah, int setChip)
                 udelay(10);
         }
 
-        if (setChip) {
-                if ((REG_READ(ah, AR_RTC_STATUS) &
-                     AR_RTC_STATUS_M) == AR_RTC_STATUS_SHUTDOWN) {
-                        if (!ath9k_hw_set_reset_reg(ah, ATH9K_RESET_POWER_ON)) {
-                                return false;
-                        }
-                        if (!AR_SREV_9300_20_OR_LATER(ah))
-                                ath9k_hw_init_pll(ah, NULL);
+        if ((REG_READ(ah, AR_RTC_STATUS) &
+             AR_RTC_STATUS_M) == AR_RTC_STATUS_SHUTDOWN) {
+                if (!ath9k_hw_set_reset_reg(ah, ATH9K_RESET_POWER_ON)) {
+                        return false;
                 }
-                if (AR_SREV_9100(ah))
-                        REG_SET_BIT(ah, AR_RTC_RESET,
-                                    AR_RTC_RESET_EN);
+                if (!AR_SREV_9300_20_OR_LATER(ah))
+                        ath9k_hw_init_pll(ah, NULL);
+        }
+        if (AR_SREV_9100(ah))
+                REG_SET_BIT(ah, AR_RTC_RESET,
+                            AR_RTC_RESET_EN);
 
+        REG_SET_BIT(ah, AR_RTC_FORCE_WAKE,
+                    AR_RTC_FORCE_WAKE_EN);
+        udelay(50);
+
+        if (ath9k_hw_mci_is_enabled(ah))
+                ar9003_mci_set_power_awake(ah);
+
+        for (i = POWER_UP_TIME / 50; i > 0; i--) {
+                val = REG_READ(ah, AR_RTC_STATUS) & AR_RTC_STATUS_M;
+                if (val == AR_RTC_STATUS_ON)
+                        break;
+                udelay(50);
                 REG_SET_BIT(ah, AR_RTC_FORCE_WAKE,
                             AR_RTC_FORCE_WAKE_EN);
-                udelay(50);
-
-                for (i = POWER_UP_TIME / 50; i > 0; i--) {
-                        val = REG_READ(ah, AR_RTC_STATUS) & AR_RTC_STATUS_M;
-                        if (val == AR_RTC_STATUS_ON)
-                                break;
-                        udelay(50);
-                        REG_SET_BIT(ah, AR_RTC_FORCE_WAKE,
-                                    AR_RTC_FORCE_WAKE_EN);
-                }
-                if (i == 0) {
-                        ath_err(ath9k_hw_common(ah),
-                                "Failed to wakeup in %uus\n",
-                                POWER_UP_TIME / 20);
-                        return false;
-                }
+        }
+        if (i == 0) {
+                ath_err(ath9k_hw_common(ah),
+                        "Failed to wakeup in %uus\n",
+                        POWER_UP_TIME / 20);
+                return false;
         }
 
         REG_CLR_BIT(ah, AR_STA_ID1, AR_STA_ID1_PWR_SAV);
@@ -2161,7 +2141,7 @@ static bool ath9k_hw_set_power_awake(struct ath_hw *ah, int setChip)
 bool ath9k_hw_setpower(struct ath_hw *ah, enum ath9k_power_mode mode)
 {
         struct ath_common *common = ath9k_hw_common(ah);
-        int status = true, setChip = true;
+        int status = true;
         static const char *modes[] = {
                 "AWAKE",
                 "FULL-SLEEP",
@@ -2177,25 +2157,17 @@ bool ath9k_hw_setpower(struct ath_hw *ah, enum ath9k_power_mode mode)
 
         switch (mode) {
         case ATH9K_PM_AWAKE:
-                status = ath9k_hw_set_power_awake(ah, setChip);
-
-                if (ah->caps.hw_caps & ATH9K_HW_CAP_MCI)
-                        REG_WRITE(ah, AR_RTC_KEEP_AWAKE, 0x2);
-
+                status = ath9k_hw_set_power_awake(ah);
                 break;
         case ATH9K_PM_FULL_SLEEP:
-                if (ah->caps.hw_caps & ATH9K_HW_CAP_MCI)
+                if (ath9k_hw_mci_is_enabled(ah))
                         ar9003_mci_set_full_sleep(ah);
 
-                ath9k_set_power_sleep(ah, setChip);
+                ath9k_set_power_sleep(ah);
                 ah->chip_fullsleep = true;
                 break;
         case ATH9K_PM_NETWORK_SLEEP:
-
-                if (ah->caps.hw_caps & ATH9K_HW_CAP_MCI)
-                        REG_WRITE(ah, AR_RTC_KEEP_AWAKE, 0x2);
-
-                ath9k_set_power_network_sleep(ah, setChip);
+                ath9k_set_power_network_sleep(ah);
                 break;
         default:
                 ath_err(common, "Unknown power mode %u\n", mode);
@@ -2765,6 +2737,9 @@ EXPORT_SYMBOL(ath9k_hw_setrxfilter);
 
 bool ath9k_hw_phy_disable(struct ath_hw *ah)
 {
+        if (ath9k_hw_mci_is_enabled(ah))
+                ar9003_mci_bt_gain_ctrl(ah);
+
         if (!ath9k_hw_set_reset_reg(ah, ATH9K_RESET_WARM))
                 return false;
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index b620c557c2a6..03d590924c64 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -824,7 +824,6 @@ struct ath_hw {
         struct ar5416IniArray ini_japan2484;
         struct ar5416IniArray iniModes_9271_ANI_reg;
         struct ar5416IniArray ini_radio_post_sys2ant;
-        struct ar5416IniArray ini_BTCOEX_MAX_TXPWR;
 
         struct ar5416IniArray iniMac[ATH_INI_NUM_SPLIT];
         struct ar5416IniArray iniBB[ATH_INI_NUM_SPLIT];
@@ -1037,6 +1036,11 @@ static inline bool ath9k_hw_btcoex_is_enabled(struct ath_hw *ah)
 {
         return ah->btcoex_hw.enabled;
 }
+static inline bool ath9k_hw_mci_is_enabled(struct ath_hw *ah)
+{
+        return ah->btcoex_hw.enabled && (ah->caps.hw_caps & ATH9K_HW_CAP_MCI);
+
+}
 void ath9k_hw_btcoex_enable(struct ath_hw *ah);
 static inline enum ath_btcoex_scheme
 ath9k_hw_get_btcoex_scheme(struct ath_hw *ah)
@@ -1048,6 +1052,10 @@ static inline bool ath9k_hw_btcoex_is_enabled(struct ath_hw *ah)
 {
         return false;
 }
+static inline bool ath9k_hw_mci_is_enabled(struct ath_hw *ah)
+{
+        return false;
+}
 static inline void ath9k_hw_btcoex_enable(struct ath_hw *ah)
 {
 }
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index dee9e092449a..9dfce1a69c73 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -489,6 +489,7 @@ static void ath9k_init_misc(struct ath_softc *sc)
 
         setup_timer(&common->ani.timer, ath_ani_calibrate, (unsigned long)sc);
 
+        sc->last_rssi = ATH_RSSI_DUMMY_MARKER;
         sc->config.txpowlimit = ATH_TXPOWER_MAX;
         memcpy(common->bssidmask, ath_bcast_mac, ETH_ALEN);
         sc->beacon.slottime = ATH9K_SLOT_TIME_9;
@@ -560,6 +561,12 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
         tasklet_init(&sc->bcon_tasklet, ath_beacon_tasklet,
                      (unsigned long)sc);
 
+        INIT_WORK(&sc->hw_reset_work, ath_reset_work);
+        INIT_WORK(&sc->hw_check_work, ath_hw_check);
+        INIT_WORK(&sc->paprd_work, ath_paprd_calibrate);
+        INIT_DELAYED_WORK(&sc->hw_pll_work, ath_hw_pll_work);
+        setup_timer(&sc->rx_poll_timer, ath_rx_poll, (unsigned long)sc);
+
         /*
          * Cache line size is used to size and align various
          * structures used to communicate with the hardware.
@@ -590,6 +597,9 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
         ath9k_cmn_init_crypto(sc->sc_ah);
         ath9k_init_misc(sc);
 
+        if (common->bus_ops->aspm_init)
+                common->bus_ops->aspm_init(common);
+
         return 0;
 
 err_btcoex:
@@ -782,11 +792,6 @@ int ath9k_init_device(u16 devid, struct ath_softc *sc,
                 ARRAY_SIZE(ath9k_tpt_blink));
 #endif
 
-        INIT_WORK(&sc->hw_reset_work, ath_reset_work);
-        INIT_WORK(&sc->hw_check_work, ath_hw_check);
-        INIT_WORK(&sc->paprd_work, ath_paprd_calibrate);
-        INIT_DELAYED_WORK(&sc->hw_pll_work, ath_hw_pll_work);
-
         /* Register with mac80211 */
         error = ieee80211_register_hw(hw);
         if (error)
@@ -805,9 +810,6 @@ int ath9k_init_device(u16 devid, struct ath_softc *sc,
                         goto error_world;
         }
 
-        setup_timer(&sc->rx_poll_timer, ath_rx_poll, (unsigned long)sc);
-        sc->last_rssi = ATH_RSSI_DUMMY_MARKER;
-
         ath_init_leds(sc);
         ath_start_rfkill_poll(sc);
 
diff --git a/drivers/net/wireless/ath/ath9k/link.c b/drivers/net/wireless/ath/ath9k/link.c
new file mode 100644
index 000000000000..a105c9426251
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/link.c
@@ -0,0 +1,510 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "ath9k.h"
+
+/*
+ * TX polling - checks if the TX engine is stuck somewhere
+ * and issues a chip reset if so.
+ */
+void ath_tx_complete_poll_work(struct work_struct *work)
+{
+        struct ath_softc *sc = container_of(work, struct ath_softc,
+                                            tx_complete_work.work);
+        struct ath_txq *txq;
+        int i;
+        bool needreset = false;
+#ifdef CONFIG_ATH9K_DEBUGFS
+        sc->tx_complete_poll_work_seen++;
+#endif
+
+        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
+                if (ATH_TXQ_SETUP(sc, i)) {
+                        txq = &sc->tx.txq[i];
+                        ath_txq_lock(sc, txq);
+                        if (txq->axq_depth) {
+                                if (txq->axq_tx_inprogress) {
+                                        needreset = true;
+                                        ath_txq_unlock(sc, txq);
+                                        break;
+                                } else {
+                                        txq->axq_tx_inprogress = true;
+                                }
+                        }
+                        ath_txq_unlock_complete(sc, txq);
+                }
+
+        if (needreset) {
+                ath_dbg(ath9k_hw_common(sc->sc_ah), RESET,
+                        "tx hung, resetting the chip\n");
+                RESET_STAT_INC(sc, RESET_TYPE_TX_HANG);
+                ieee80211_queue_work(sc->hw, &sc->hw_reset_work);
+                return;
+        }
+
+        ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work,
+                                     msecs_to_jiffies(ATH_TX_COMPLETE_POLL_INT));
+}
+
+/*
+ * Checks if the BB/MAC is hung.
+ */
+void ath_hw_check(struct work_struct *work)
+{
+        struct ath_softc *sc = container_of(work, struct ath_softc, hw_check_work);
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        unsigned long flags;
+        int busy;
+        u8 is_alive, nbeacon = 1;
+
+        ath9k_ps_wakeup(sc);
+        is_alive = ath9k_hw_check_alive(sc->sc_ah);
+
+        if (is_alive && !AR_SREV_9300(sc->sc_ah))
+                goto out;
+        else if (!is_alive && AR_SREV_9300(sc->sc_ah)) {
+                ath_dbg(common, RESET,
+                        "DCU stuck is detected. Schedule chip reset\n");
+                RESET_STAT_INC(sc, RESET_TYPE_MAC_HANG);
+                goto sched_reset;
+        }
+
+        spin_lock_irqsave(&common->cc_lock, flags);
+        busy = ath_update_survey_stats(sc);
+        spin_unlock_irqrestore(&common->cc_lock, flags);
+
+        ath_dbg(common, RESET, "Possible baseband hang, busy=%d (try %d)\n",
+                busy, sc->hw_busy_count + 1);
+        if (busy >= 99) {
+                if (++sc->hw_busy_count >= 3) {
+                        RESET_STAT_INC(sc, RESET_TYPE_BB_HANG);
+                        goto sched_reset;
+                }
+        } else if (busy >= 0) {
+                sc->hw_busy_count = 0;
+                nbeacon = 3;
+        }
+
+        ath_start_rx_poll(sc, nbeacon);
+        goto out;
+
+sched_reset:
+        ieee80211_queue_work(sc->hw, &sc->hw_reset_work);
+out:
+        ath9k_ps_restore(sc);
+}
+
+/*
+ * PLL-WAR for AR9485/AR9340
+ */
+static bool ath_hw_pll_rx_hang_check(struct ath_softc *sc, u32 pll_sqsum)
+{
+        static int count;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+
+        if (pll_sqsum >= 0x40000) {
+                count++;
+                if (count == 3) {
+                        ath_dbg(common, RESET, "PLL WAR, resetting the chip\n");
+                        RESET_STAT_INC(sc, RESET_TYPE_PLL_HANG);
+                        ieee80211_queue_work(sc->hw, &sc->hw_reset_work);
+                        count = 0;
+                        return true;
+                }
+        } else {
+                count = 0;
+        }
+
+        return false;
+}
+
+void ath_hw_pll_work(struct work_struct *work)
+{
+        u32 pll_sqsum;
+        struct ath_softc *sc = container_of(work, struct ath_softc,
+                                            hw_pll_work.work);
+        /*
+         * ensure that the PLL WAR is executed only
+         * after the STA is associated (or) if the
+         * beaconing had started in interfaces that
+         * uses beacons.
+         */
+        if (!test_bit(SC_OP_BEACONS, &sc->sc_flags))
+                return;
+
+        ath9k_ps_wakeup(sc);
+        pll_sqsum = ar9003_get_pll_sqsum_dvc(sc->sc_ah);
+        ath9k_ps_restore(sc);
+        if (ath_hw_pll_rx_hang_check(sc, pll_sqsum))
+                return;
+
+        ieee80211_queue_delayed_work(sc->hw, &sc->hw_pll_work,
+                                     msecs_to_jiffies(ATH_PLL_WORK_INTERVAL));
+}
+
+/*
+ * RX Polling - monitors baseband hangs.
+ */
+void ath_start_rx_poll(struct ath_softc *sc, u8 nbeacon)
+{
+        if (!AR_SREV_9300(sc->sc_ah))
+                return;
+
+        if (!test_bit(SC_OP_PRIM_STA_VIF, &sc->sc_flags))
+                return;
+
+        mod_timer(&sc->rx_poll_timer, jiffies + msecs_to_jiffies
+                  (nbeacon * sc->cur_beacon_conf.beacon_interval));
+}
+
+void ath_rx_poll(unsigned long data)
+{
+        struct ath_softc *sc = (struct ath_softc *)data;
+
+        ieee80211_queue_work(sc->hw, &sc->hw_check_work);
+}
+
+/*
+ * PA Pre-distortion.
+ */
+static void ath_paprd_activate(struct ath_softc *sc)
+{
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath9k_hw_cal_data *caldata = ah->caldata;
+        int chain;
+
+        if (!caldata || !caldata->paprd_done)
+                return;
+
+        ath9k_ps_wakeup(sc);
+        ar9003_paprd_enable(ah, false);
+        for (chain = 0; chain < AR9300_MAX_CHAINS; chain++) {
+                if (!(ah->txchainmask & BIT(chain)))
+                        continue;
+
+                ar9003_paprd_populate_single_table(ah, caldata, chain);
+        }
+
+        ar9003_paprd_enable(ah, true);
+        ath9k_ps_restore(sc);
+}
+
+static bool ath_paprd_send_frame(struct ath_softc *sc, struct sk_buff *skb, int chain)
+{
+        struct ieee80211_hw *hw = sc->hw;
+        struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath_tx_control txctl;
+        int time_left;
+
+        memset(&txctl, 0, sizeof(txctl));
+        txctl.txq = sc->tx.txq_map[WME_AC_BE];
+
+        memset(tx_info, 0, sizeof(*tx_info));
+        tx_info->band = hw->conf.channel->band;
+        tx_info->flags |= IEEE80211_TX_CTL_NO_ACK;
+        tx_info->control.rates[0].idx = 0;
+        tx_info->control.rates[0].count = 1;
+        tx_info->control.rates[0].flags = IEEE80211_TX_RC_MCS;
+        tx_info->control.rates[1].idx = -1;
+
+        init_completion(&sc->paprd_complete);
+        txctl.paprd = BIT(chain);
+
+        if (ath_tx_start(hw, skb, &txctl) != 0) {
+                ath_dbg(common, CALIBRATE, "PAPRD TX failed\n");
+                dev_kfree_skb_any(skb);
+                return false;
+        }
+
+        time_left = wait_for_completion_timeout(&sc->paprd_complete,
+                        msecs_to_jiffies(ATH_PAPRD_TIMEOUT));
+
+        if (!time_left)
+                ath_dbg(common, CALIBRATE,
+                        "Timeout waiting for paprd training on TX chain %d\n",
+                        chain);
+
+        return !!time_left;
+}
+
+void ath_paprd_calibrate(struct work_struct *work)
+{
+        struct ath_softc *sc = container_of(work, struct ath_softc, paprd_work);
+        struct ieee80211_hw *hw = sc->hw;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ieee80211_hdr *hdr;
+        struct sk_buff *skb = NULL;
+        struct ath9k_hw_cal_data *caldata = ah->caldata;
+        struct ath_common *common = ath9k_hw_common(ah);
+        int ftype;
+        int chain_ok = 0;
+        int chain;
+        int len = 1800;
+
+        if (!caldata)
+                return;
+
+        ath9k_ps_wakeup(sc);
+
+        if (ar9003_paprd_init_table(ah) < 0)
+                goto fail_paprd;
+
+        skb = alloc_skb(len, GFP_KERNEL);
+        if (!skb)
+                goto fail_paprd;
+
+        skb_put(skb, len);
+        memset(skb->data, 0, len);
+        hdr = (struct ieee80211_hdr *)skb->data;
+        ftype = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC;
+        hdr->frame_control = cpu_to_le16(ftype);
+        hdr->duration_id = cpu_to_le16(10);
+        memcpy(hdr->addr1, hw->wiphy->perm_addr, ETH_ALEN);
+        memcpy(hdr->addr2, hw->wiphy->perm_addr, ETH_ALEN);
+        memcpy(hdr->addr3, hw->wiphy->perm_addr, ETH_ALEN);
+
+        for (chain = 0; chain < AR9300_MAX_CHAINS; chain++) {
+                if (!(ah->txchainmask & BIT(chain)))
+                        continue;
+
+                chain_ok = 0;
+
+                ath_dbg(common, CALIBRATE,
+                        "Sending PAPRD frame for thermal measurement on chain %d\n",
+                        chain);
+                if (!ath_paprd_send_frame(sc, skb, chain))
+                        goto fail_paprd;
+
+                ar9003_paprd_setup_gain_table(ah, chain);
+
+                ath_dbg(common, CALIBRATE,
+                        "Sending PAPRD training frame on chain %d\n", chain);
+                if (!ath_paprd_send_frame(sc, skb, chain))
+                        goto fail_paprd;
+
+                if (!ar9003_paprd_is_done(ah)) {
+                        ath_dbg(common, CALIBRATE,
+                                "PAPRD not yet done on chain %d\n", chain);
+                        break;
+                }
+
+                if (ar9003_paprd_create_curve(ah, caldata, chain)) {
+                        ath_dbg(common, CALIBRATE,
+                                "PAPRD create curve failed on chain %d\n",
+                                chain);
+                        break;
+                }
+
+                chain_ok = 1;
+        }
+        kfree_skb(skb);
+
+        if (chain_ok) {
+                caldata->paprd_done = true;
+                ath_paprd_activate(sc);
+        }
+
+fail_paprd:
+        ath9k_ps_restore(sc);
+}
+
+/*
+ *  ANI performs periodic noise floor calibration
+ *  that is used to adjust and optimize the chip performance.  This
+ *  takes environmental changes (location, temperature) into account.
+ *  When the task is complete, it reschedules itself depending on the
+ *  appropriate interval that was calculated.
+ */
+void ath_ani_calibrate(unsigned long data)
+{
+        struct ath_softc *sc = (struct ath_softc *)data;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        bool longcal = false;
+        bool shortcal = false;
+        bool aniflag = false;
+        unsigned int timestamp = jiffies_to_msecs(jiffies);
+        u32 cal_interval, short_cal_interval, long_cal_interval;
+        unsigned long flags;
+
+        if (ah->caldata && ah->caldata->nfcal_interference)
+                long_cal_interval = ATH_LONG_CALINTERVAL_INT;
+        else
+                long_cal_interval = ATH_LONG_CALINTERVAL;
+
+        short_cal_interval = (ah->opmode == NL80211_IFTYPE_AP) ?
+                ATH_AP_SHORT_CALINTERVAL : ATH_STA_SHORT_CALINTERVAL;
+
+        /* Only calibrate if awake */
+        if (sc->sc_ah->power_mode != ATH9K_PM_AWAKE)
+                goto set_timer;
+
+        ath9k_ps_wakeup(sc);
+
+        /* Long calibration runs independently of short calibration. */
+        if ((timestamp - common->ani.longcal_timer) >= long_cal_interval) {
+                longcal = true;
+                common->ani.longcal_timer = timestamp;
+        }
+
+        /* Short calibration applies only while caldone is false */
+        if (!common->ani.caldone) {
+                if ((timestamp - common->ani.shortcal_timer) >= short_cal_interval) {
+                        shortcal = true;
+                        common->ani.shortcal_timer = timestamp;
+                        common->ani.resetcal_timer = timestamp;
+                }
+        } else {
+                if ((timestamp - common->ani.resetcal_timer) >=
+                    ATH_RESTART_CALINTERVAL) {
+                        common->ani.caldone = ath9k_hw_reset_calvalid(ah);
+                        if (common->ani.caldone)
+                                common->ani.resetcal_timer = timestamp;
+                }
+        }
+
+        /* Verify whether we must check ANI */
+        if (sc->sc_ah->config.enable_ani
+            && (timestamp - common->ani.checkani_timer) >=
+            ah->config.ani_poll_interval) {
+                aniflag = true;
+                common->ani.checkani_timer = timestamp;
+        }
+
+        /* Call ANI routine if necessary */
+        if (aniflag) {
+                spin_lock_irqsave(&common->cc_lock, flags);
+                ath9k_hw_ani_monitor(ah, ah->curchan);
+                ath_update_survey_stats(sc);
+                spin_unlock_irqrestore(&common->cc_lock, flags);
+        }
+
+        /* Perform calibration if necessary */
+        if (longcal || shortcal) {
+                common->ani.caldone =
+                        ath9k_hw_calibrate(ah, ah->curchan,
+                                           ah->rxchainmask, longcal);
+        }
+
+        ath_dbg(common, ANI,
+                "Calibration @%lu finished: %s %s %s, caldone: %s\n",
+                jiffies,
+                longcal ? "long" : "", shortcal ? "short" : "",
+                aniflag ? "ani" : "", common->ani.caldone ? "true" : "false");
+
+        ath9k_ps_restore(sc);
+
+set_timer:
+        /*
+        * Set timer interval based on previous results.
+        * The interval must be the shortest necessary to satisfy ANI,
+        * short calibration and long calibration.
+        */
+        ath9k_debug_samp_bb_mac(sc);
+        cal_interval = ATH_LONG_CALINTERVAL;
+        if (sc->sc_ah->config.enable_ani)
+                cal_interval = min(cal_interval,
+                                   (u32)ah->config.ani_poll_interval);
+        if (!common->ani.caldone)
+                cal_interval = min(cal_interval, (u32)short_cal_interval);
+
+        mod_timer(&common->ani.timer, jiffies + msecs_to_jiffies(cal_interval));
+        if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_PAPRD) && ah->caldata) {
+                if (!ah->caldata->paprd_done)
+                        ieee80211_queue_work(sc->hw, &sc->paprd_work);
+                else if (!ah->paprd_table_write_done)
+                        ath_paprd_activate(sc);
+        }
+}
+
+void ath_start_ani(struct ath_common *common)
+{
+        struct ath_hw *ah = common->ah;
+        unsigned long timestamp = jiffies_to_msecs(jiffies);
+        struct ath_softc *sc = (struct ath_softc *) common->priv;
+
+        if (!test_bit(SC_OP_ANI_RUN, &sc->sc_flags))
+                return;
+
+        if (sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
+                return;
+
+        common->ani.longcal_timer = timestamp;
+        common->ani.shortcal_timer = timestamp;
+        common->ani.checkani_timer = timestamp;
+
+        mod_timer(&common->ani.timer,
+                  jiffies + msecs_to_jiffies((u32)ah->config.ani_poll_interval));
+}
+
+void ath_update_survey_nf(struct ath_softc *sc, int channel)
+{
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath9k_channel *chan = &ah->channels[channel];
+        struct survey_info *survey = &sc->survey[channel];
+
+        if (chan->noisefloor) {
+                survey->filled |= SURVEY_INFO_NOISE_DBM;
+                survey->noise = ath9k_hw_getchan_noise(ah, chan);
+        }
+}
+
+/*
+ * Updates the survey statistics and returns the busy time since last
+ * update in %, if the measurement duration was long enough for the
+ * result to be useful, -1 otherwise.
+ */
+int ath_update_survey_stats(struct ath_softc *sc)
+{
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        int pos = ah->curchan - &ah->channels[0];
+        struct survey_info *survey = &sc->survey[pos];
+        struct ath_cycle_counters *cc = &common->cc_survey;
+        unsigned int div = common->clockrate * 1000;
+        int ret = 0;
+
+        if (!ah->curchan)
+                return -1;
+
+        if (ah->power_mode == ATH9K_PM_AWAKE)
+                ath_hw_cycle_counters_update(common);
+
+        if (cc->cycles > 0) {
+                survey->filled |= SURVEY_INFO_CHANNEL_TIME |
+                        SURVEY_INFO_CHANNEL_TIME_BUSY |
+                        SURVEY_INFO_CHANNEL_TIME_RX |
+                        SURVEY_INFO_CHANNEL_TIME_TX;
+                survey->channel_time += cc->cycles / div;
+                survey->channel_time_busy += cc->rx_busy / div;
+                survey->channel_time_rx += cc->rx_frame / div;
+                survey->channel_time_tx += cc->tx_frame / div;
+        }
+
+        if (cc->cycles < div)
+                return -1;
+
+        if (cc->cycles > 0)
+                ret = cc->rx_busy * 100 / cc->cycles;
+
+        memset(cc, 0, sizeof(*cc));
+
+        ath_update_survey_nf(sc, pos);
+
+        return ret;
+}
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index dac1a2709e3c..52561b341d68 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -101,6 +101,7 @@ void ath9k_ps_wakeup(struct ath_softc *sc)
                 spin_lock(&common->cc_lock);
                 ath_hw_cycle_counters_update(common);
                 memset(&common->cc_survey, 0, sizeof(common->cc_survey));
+                memset(&common->cc_ani, 0, sizeof(common->cc_ani));
                 spin_unlock(&common->cc_lock);
         }
 
@@ -143,90 +144,15 @@ void ath9k_ps_restore(struct ath_softc *sc)
         spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
 }
 
-void ath_start_ani(struct ath_common *common)
-{
-        struct ath_hw *ah = common->ah;
-        unsigned long timestamp = jiffies_to_msecs(jiffies);
-        struct ath_softc *sc = (struct ath_softc *) common->priv;
-
-        if (!(sc->sc_flags & SC_OP_ANI_RUN))
-                return;
-
-        if (sc->sc_flags & SC_OP_OFFCHANNEL)
-                return;
-
-        common->ani.longcal_timer = timestamp;
-        common->ani.shortcal_timer = timestamp;
-        common->ani.checkani_timer = timestamp;
-
-        mod_timer(&common->ani.timer,
-                  jiffies +
-                        msecs_to_jiffies((u32)ah->config.ani_poll_interval));
-}
-
-static void ath_update_survey_nf(struct ath_softc *sc, int channel)
-{
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath9k_channel *chan = &ah->channels[channel];
-        struct survey_info *survey = &sc->survey[channel];
-
-        if (chan->noisefloor) {
-                survey->filled |= SURVEY_INFO_NOISE_DBM;
-                survey->noise = ath9k_hw_getchan_noise(ah, chan);
-        }
-}
-
-/*
- * Updates the survey statistics and returns the busy time since last
- * update in %, if the measurement duration was long enough for the
- * result to be useful, -1 otherwise.
- */
-static int ath_update_survey_stats(struct ath_softc *sc)
-{
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath_common *common = ath9k_hw_common(ah);
-        int pos = ah->curchan - &ah->channels[0];
-        struct survey_info *survey = &sc->survey[pos];
-        struct ath_cycle_counters *cc = &common->cc_survey;
-        unsigned int div = common->clockrate * 1000;
-        int ret = 0;
-
-        if (!ah->curchan)
-                return -1;
-
-        if (ah->power_mode == ATH9K_PM_AWAKE)
-                ath_hw_cycle_counters_update(common);
-
-        if (cc->cycles > 0) {
-                survey->filled |= SURVEY_INFO_CHANNEL_TIME |
-                        SURVEY_INFO_CHANNEL_TIME_BUSY |
-                        SURVEY_INFO_CHANNEL_TIME_RX |
-                        SURVEY_INFO_CHANNEL_TIME_TX;
-                survey->channel_time += cc->cycles / div;
-                survey->channel_time_busy += cc->rx_busy / div;
-                survey->channel_time_rx += cc->rx_frame / div;
-                survey->channel_time_tx += cc->tx_frame / div;
-        }
-
-        if (cc->cycles < div)
-                return -1;
-
-        if (cc->cycles > 0)
-                ret = cc->rx_busy * 100 / cc->cycles;
-
-        memset(cc, 0, sizeof(*cc));
-
-        ath_update_survey_nf(sc, pos);
-
-        return ret;
-}
-
 static void __ath_cancel_work(struct ath_softc *sc)
 {
         cancel_work_sync(&sc->paprd_work);
         cancel_work_sync(&sc->hw_check_work);
         cancel_delayed_work_sync(&sc->tx_complete_work);
         cancel_delayed_work_sync(&sc->hw_pll_work);
+#ifdef CONFIG_ATH9K_BTCOEX_SUPPORT
+        cancel_work_sync(&sc->mci_work);
+#endif
 }
 
 static void ath_cancel_work(struct ath_softc *sc)
@@ -235,6 +161,22 @@ static void ath_cancel_work(struct ath_softc *sc)
         cancel_work_sync(&sc->hw_reset_work);
 }
 
+static void ath_restart_work(struct ath_softc *sc)
+{
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+
+        ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
+
+        if (AR_SREV_9485(sc->sc_ah) || AR_SREV_9340(sc->sc_ah))
+                ieee80211_queue_delayed_work(sc->hw, &sc->hw_pll_work,
+                                     msecs_to_jiffies(ATH_PLL_WORK_INTERVAL));
+
+        ath_start_rx_poll(sc, 3);
+
+        if (!common->disable_ani)
+                ath_start_ani(common);
+}
+
 static bool ath_prepare_reset(struct ath_softc *sc, bool retry_tx, bool flush)
 {
         struct ath_hw *ah = sc->sc_ah;
@@ -271,6 +213,7 @@ static bool ath_complete_reset(struct ath_softc *sc, bool start)
 {
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
+        unsigned long flags;
 
         if (ath_startrecv(sc) != 0) {
                 ath_err(common, "Unable to restart recv logic\n");
@@ -279,36 +222,30 @@ static bool ath_complete_reset(struct ath_softc *sc, bool start)
 
         ath9k_cmn_update_txpow(ah, sc->curtxpow,
                                sc->config.txpowlimit, &sc->curtxpow);
+
+        clear_bit(SC_OP_HW_RESET, &sc->sc_flags);
         ath9k_hw_set_interrupts(ah);
         ath9k_hw_enable_interrupts(ah);
 
-        if (!(sc->sc_flags & (SC_OP_OFFCHANNEL)) && start) {
-                if (sc->sc_flags & SC_OP_BEACONS)
-                        ath_set_beacon(sc);
-
-                ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
-                ieee80211_queue_delayed_work(sc->hw, &sc->hw_pll_work, HZ/2);
-                ath_start_rx_poll(sc, 3);
-                if (!common->disable_ani)
-                        ath_start_ani(common);
-        }
-
-        if ((ah->caps.hw_caps & ATH9K_HW_CAP_ANT_DIV_COMB) && sc->ant_rx != 3) {
-                struct ath_hw_antcomb_conf div_ant_conf;
-                u8 lna_conf;
+        if (!(sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL) && start) {
+                if (!test_bit(SC_OP_BEACONS, &sc->sc_flags))
+                        goto work;
 
-                ath9k_hw_antdiv_comb_conf_get(ah, &div_ant_conf);
-
-                if (sc->ant_rx == 1)
-                        lna_conf = ATH_ANT_DIV_COMB_LNA1;
-                else
-                        lna_conf = ATH_ANT_DIV_COMB_LNA2;
-                div_ant_conf.main_lna_conf = lna_conf;
-                div_ant_conf.alt_lna_conf = lna_conf;
+                ath_set_beacon(sc);
 
-                ath9k_hw_antdiv_comb_conf_set(ah, &div_ant_conf);
+                if (ah->opmode == NL80211_IFTYPE_STATION &&
+                    test_bit(SC_OP_PRIM_STA_VIF, &sc->sc_flags)) {
+                        spin_lock_irqsave(&sc->sc_pm_lock, flags);
+                        sc->ps_flags |= PS_BEACON_SYNC | PS_WAIT_FOR_BEACON;
+                        spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
+                }
+        work:
+                ath_restart_work(sc);
         }
 
+        if ((ah->caps.hw_caps & ATH9K_HW_CAP_ANT_DIV_COMB) && sc->ant_rx != 3)
+                ath_ant_comb_update(sc);
+
         ieee80211_wake_queues(sc->hw);
 
         return true;
@@ -328,7 +265,7 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan,
 
         spin_lock_bh(&sc->sc_pcu_lock);
 
-        if (!(sc->sc_flags & SC_OP_OFFCHANNEL)) {
+        if (!(sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)) {
                 fastcc = false;
                 caldata = &sc->caldata;
         }
@@ -371,7 +308,7 @@ static int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
 {
         int r;
 
-        if (sc->sc_flags & SC_OP_INVALID)
+        if (test_bit(SC_OP_INVALID, &sc->sc_flags))
                 return -EIO;
 
         r = ath_reset_internal(sc, hchan, false);
@@ -379,258 +316,6 @@ static int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
         return r;
 }
 
-static void ath_paprd_activate(struct ath_softc *sc)
-{
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath9k_hw_cal_data *caldata = ah->caldata;
-        int chain;
-
-        if (!caldata || !caldata->paprd_done)
-                return;
-
-        ath9k_ps_wakeup(sc);
-        ar9003_paprd_enable(ah, false);
-        for (chain = 0; chain < AR9300_MAX_CHAINS; chain++) {
-                if (!(ah->txchainmask & BIT(chain)))
-                        continue;
-
-                ar9003_paprd_populate_single_table(ah, caldata, chain);
-        }
-
-        ar9003_paprd_enable(ah, true);
-        ath9k_ps_restore(sc);
-}
-
-static bool ath_paprd_send_frame(struct ath_softc *sc, struct sk_buff *skb, int chain)
-{
-        struct ieee80211_hw *hw = sc->hw;
-        struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath_common *common = ath9k_hw_common(ah);
-        struct ath_tx_control txctl;
-        int time_left;
-
-        memset(&txctl, 0, sizeof(txctl));
-        txctl.txq = sc->tx.txq_map[WME_AC_BE];
-
-        memset(tx_info, 0, sizeof(*tx_info));
-        tx_info->band = hw->conf.channel->band;
-        tx_info->flags |= IEEE80211_TX_CTL_NO_ACK;
-        tx_info->control.rates[0].idx = 0;
-        tx_info->control.rates[0].count = 1;
-        tx_info->control.rates[0].flags = IEEE80211_TX_RC_MCS;
-        tx_info->control.rates[1].idx = -1;
-
-        init_completion(&sc->paprd_complete);
-        txctl.paprd = BIT(chain);
-
-        if (ath_tx_start(hw, skb, &txctl) != 0) {
-                ath_dbg(common, CALIBRATE, "PAPRD TX failed\n");
-                dev_kfree_skb_any(skb);
-                return false;
-        }
-
-        time_left = wait_for_completion_timeout(&sc->paprd_complete,
-                        msecs_to_jiffies(ATH_PAPRD_TIMEOUT));
-
-        if (!time_left)
-                ath_dbg(common, CALIBRATE,
-                        "Timeout waiting for paprd training on TX chain %d\n",
-                        chain);
-
-        return !!time_left;
-}
-
-void ath_paprd_calibrate(struct work_struct *work)
-{
-        struct ath_softc *sc = container_of(work, struct ath_softc, paprd_work);
-        struct ieee80211_hw *hw = sc->hw;
-        struct ath_hw *ah = sc->sc_ah;
-        struct ieee80211_hdr *hdr;
-        struct sk_buff *skb = NULL;
-        struct ath9k_hw_cal_data *caldata = ah->caldata;
-        struct ath_common *common = ath9k_hw_common(ah);
-        int ftype;
-        int chain_ok = 0;
-        int chain;
-        int len = 1800;
-
-        if (!caldata)
-                return;
-
-        ath9k_ps_wakeup(sc);
-
-        if (ar9003_paprd_init_table(ah) < 0)
-                goto fail_paprd;
-
-        skb = alloc_skb(len, GFP_KERNEL);
-        if (!skb)
-                goto fail_paprd;
-
-        skb_put(skb, len);
-        memset(skb->data, 0, len);
-        hdr = (struct ieee80211_hdr *)skb->data;
-        ftype = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC;
-        hdr->frame_control = cpu_to_le16(ftype);
-        hdr->duration_id = cpu_to_le16(10);
-        memcpy(hdr->addr1, hw->wiphy->perm_addr, ETH_ALEN);
-        memcpy(hdr->addr2, hw->wiphy->perm_addr, ETH_ALEN);
-        memcpy(hdr->addr3, hw->wiphy->perm_addr, ETH_ALEN);
-
-        for (chain = 0; chain < AR9300_MAX_CHAINS; chain++) {
-                if (!(ah->txchainmask & BIT(chain)))
-                        continue;
-
-                chain_ok = 0;
-
-                ath_dbg(common, CALIBRATE,
-                        "Sending PAPRD frame for thermal measurement on chain %d\n",
-                        chain);
-                if (!ath_paprd_send_frame(sc, skb, chain))
-                        goto fail_paprd;
-
-                ar9003_paprd_setup_gain_table(ah, chain);
-
-                ath_dbg(common, CALIBRATE,
-                        "Sending PAPRD training frame on chain %d\n", chain);
-                if (!ath_paprd_send_frame(sc, skb, chain))
-                        goto fail_paprd;
-
-                if (!ar9003_paprd_is_done(ah)) {
-                        ath_dbg(common, CALIBRATE,
-                                "PAPRD not yet done on chain %d\n", chain);
-                        break;
-                }
-
-                if (ar9003_paprd_create_curve(ah, caldata, chain)) {
-                        ath_dbg(common, CALIBRATE,
-                                "PAPRD create curve failed on chain %d\n",
-                                                                   chain);
-                        break;
-                }
-
-                chain_ok = 1;
-        }
-        kfree_skb(skb);
-
-        if (chain_ok) {
-                caldata->paprd_done = true;
-                ath_paprd_activate(sc);
-        }
-
-fail_paprd:
-        ath9k_ps_restore(sc);
-}
-
-/*
- *  This routine performs the periodic noise floor calibration function
- *  that is used to adjust and optimize the chip performance.  This
- *  takes environmental changes (location, temperature) into account.
- *  When the task is complete, it reschedules itself depending on the
- *  appropriate interval that was calculated.
- */
-void ath_ani_calibrate(unsigned long data)
-{
-        struct ath_softc *sc = (struct ath_softc *)data;
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath_common *common = ath9k_hw_common(ah);
-        bool longcal = false;
-        bool shortcal = false;
-        bool aniflag = false;
-        unsigned int timestamp = jiffies_to_msecs(jiffies);
-        u32 cal_interval, short_cal_interval, long_cal_interval;
-        unsigned long flags;
-
-        if (ah->caldata && ah->caldata->nfcal_interference)
-                long_cal_interval = ATH_LONG_CALINTERVAL_INT;
-        else
-                long_cal_interval = ATH_LONG_CALINTERVAL;
-
-        short_cal_interval = (ah->opmode == NL80211_IFTYPE_AP) ?
-                ATH_AP_SHORT_CALINTERVAL : ATH_STA_SHORT_CALINTERVAL;
-
-        /* Only calibrate if awake */
-        if (sc->sc_ah->power_mode != ATH9K_PM_AWAKE)
-                goto set_timer;
-
-        ath9k_ps_wakeup(sc);
-
-        /* Long calibration runs independently of short calibration. */
-        if ((timestamp - common->ani.longcal_timer) >= long_cal_interval) {
-                longcal = true;
-                common->ani.longcal_timer = timestamp;
-        }
-
-        /* Short calibration applies only while caldone is false */
-        if (!common->ani.caldone) {
-                if ((timestamp - common->ani.shortcal_timer) >= short_cal_interval) {
-                        shortcal = true;
-                        common->ani.shortcal_timer = timestamp;
-                        common->ani.resetcal_timer = timestamp;
-                }
-        } else {
-                if ((timestamp - common->ani.resetcal_timer) >=
-                    ATH_RESTART_CALINTERVAL) {
-                        common->ani.caldone = ath9k_hw_reset_calvalid(ah);
-                        if (common->ani.caldone)
-                                common->ani.resetcal_timer = timestamp;
-                }
-        }
-
-        /* Verify whether we must check ANI */
-        if (sc->sc_ah->config.enable_ani
-            && (timestamp - common->ani.checkani_timer) >=
-            ah->config.ani_poll_interval) {
-                aniflag = true;
-                common->ani.checkani_timer = timestamp;
-        }
-
-        /* Call ANI routine if necessary */
-        if (aniflag) {
-                spin_lock_irqsave(&common->cc_lock, flags);
-                ath9k_hw_ani_monitor(ah, ah->curchan);
-                ath_update_survey_stats(sc);
-                spin_unlock_irqrestore(&common->cc_lock, flags);
-        }
-
-        /* Perform calibration if necessary */
-        if (longcal || shortcal) {
-                common->ani.caldone =
-                        ath9k_hw_calibrate(ah, ah->curchan,
-                                                ah->rxchainmask, longcal);
-        }
-
-        ath_dbg(common, ANI,
-                "Calibration @%lu finished: %s %s %s, caldone: %s\n",
-                jiffies,
-                longcal ? "long" : "", shortcal ? "short" : "",
-                aniflag ? "ani" : "", common->ani.caldone ? "true" : "false");
-
-        ath9k_ps_restore(sc);
-
-set_timer:
-        /*
-        * Set timer interval based on previous results.
-        * The interval must be the shortest necessary to satisfy ANI,
-        * short calibration and long calibration.
-        */
-        ath9k_debug_samp_bb_mac(sc);
-        cal_interval = ATH_LONG_CALINTERVAL;
-        if (sc->sc_ah->config.enable_ani)
-                cal_interval = min(cal_interval,
-                                   (u32)ah->config.ani_poll_interval);
-        if (!common->ani.caldone)
-                cal_interval = min(cal_interval, (u32)short_cal_interval);
-
-        mod_timer(&common->ani.timer, jiffies + msecs_to_jiffies(cal_interval));
-        if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_PAPRD) && ah->caldata) {
-                if (!ah->caldata->paprd_done)
-                        ieee80211_queue_work(sc->hw, &sc->paprd_work);
-                else if (!ah->paprd_table_write_done)
-                        ath_paprd_activate(sc);
-        }
-}
-
 static void ath_node_attach(struct ath_softc *sc, struct ieee80211_sta *sta,
                             struct ieee80211_vif *vif)
 {
@@ -668,13 +353,12 @@ static void ath_node_detach(struct ath_softc *sc, struct ieee80211_sta *sta)
                 ath_tx_node_cleanup(sc, an);
 }
 
-
 void ath9k_tasklet(unsigned long data)
 {
         struct ath_softc *sc = (struct ath_softc *)data;
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
-
+        unsigned long flags;
         u32 status = sc->intrstatus;
         u32 rxmask;
 
@@ -693,10 +377,12 @@ void ath9k_tasklet(unsigned long data)
 
                 RESET_STAT_INC(sc, type);
 #endif
+                set_bit(SC_OP_HW_RESET, &sc->sc_flags);
                 ieee80211_queue_work(sc->hw, &sc->hw_reset_work);
                 goto out;
         }
 
+        spin_lock_irqsave(&sc->sc_pm_lock, flags);
         if ((status & ATH9K_INT_TSFOOR) && sc->ps_enabled) {
                 /*
                  * TSF sync does not look correct; remain awake to sync with
@@ -705,6 +391,7 @@ void ath9k_tasklet(unsigned long data)
                 ath_dbg(common, PS, "TSFOOR - Sync with next Beacon\n");
                 sc->ps_flags |= PS_WAIT_FOR_BEACON | PS_BEACON_SYNC;
         }
+        spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
 
         if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
                 rxmask = (ATH9K_INT_RXHP | ATH9K_INT_RXLP | ATH9K_INT_RXEOL |
@@ -766,15 +453,17 @@ irqreturn_t ath_isr(int irq, void *dev)
          * touch anything. Note this can happen early
          * on if the IRQ is shared.
          */
-        if (sc->sc_flags & SC_OP_INVALID)
+        if (test_bit(SC_OP_INVALID, &sc->sc_flags))
                 return IRQ_NONE;
 
-
         /* shared irq, not for us */
 
         if (!ath9k_hw_intrpend(ah))
                 return IRQ_NONE;
 
+        if(test_bit(SC_OP_HW_RESET, &sc->sc_flags))
+                return IRQ_HANDLED;
+
         /*
          * Figure out the reason(s) for the interrupt.  Note
          * that the hal returns a pseudo-ISR that may include
@@ -852,8 +541,10 @@ irqreturn_t ath_isr(int irq, void *dev)
                         /* Clear RxAbort bit so that we can
                          * receive frames */
                         ath9k_setpower(sc, ATH9K_PM_AWAKE);
+                        spin_lock(&sc->sc_pm_lock);
                         ath9k_hw_setrxabort(sc->sc_ah, 0);
                         sc->ps_flags |= PS_WAIT_FOR_BEACON;
+                        spin_unlock(&sc->sc_pm_lock);
                 }
 
 chip_reset:
@@ -902,96 +593,6 @@ void ath_reset_work(struct work_struct *work)
         ath_reset(sc, true);
 }
 
-void ath_hw_check(struct work_struct *work)
-{
-        struct ath_softc *sc = container_of(work, struct ath_softc, hw_check_work);
-        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        unsigned long flags;
-        int busy;
-        u8 is_alive, nbeacon = 1;
-
-        ath9k_ps_wakeup(sc);
-        is_alive = ath9k_hw_check_alive(sc->sc_ah);
-
-        if (is_alive && !AR_SREV_9300(sc->sc_ah))
-                goto out;
-        else if (!is_alive && AR_SREV_9300(sc->sc_ah)) {
-                ath_dbg(common, RESET,
-                        "DCU stuck is detected. Schedule chip reset\n");
-                RESET_STAT_INC(sc, RESET_TYPE_MAC_HANG);
-                goto sched_reset;
-        }
-
-        spin_lock_irqsave(&common->cc_lock, flags);
-        busy = ath_update_survey_stats(sc);
-        spin_unlock_irqrestore(&common->cc_lock, flags);
-
-        ath_dbg(common, RESET, "Possible baseband hang, busy=%d (try %d)\n",
-                busy, sc->hw_busy_count + 1);
-        if (busy >= 99) {
-                if (++sc->hw_busy_count >= 3) {
-                        RESET_STAT_INC(sc, RESET_TYPE_BB_HANG);
-                        goto sched_reset;
-                }
-        } else if (busy >= 0) {
-                sc->hw_busy_count = 0;
-                nbeacon = 3;
-        }
-
-        ath_start_rx_poll(sc, nbeacon);
-        goto out;
-
-sched_reset:
-        ieee80211_queue_work(sc->hw, &sc->hw_reset_work);
-out:
-        ath9k_ps_restore(sc);
-}
-
-static void ath_hw_pll_rx_hang_check(struct ath_softc *sc, u32 pll_sqsum)
-{
-        static int count;
-        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-
-        if (pll_sqsum >= 0x40000) {
-                count++;
-                if (count == 3) {
-                        /* Rx is hung for more than 500ms. Reset it */
-                        ath_dbg(common, RESET, "Possible RX hang, resetting\n");
-                        RESET_STAT_INC(sc, RESET_TYPE_PLL_HANG);
-                        ieee80211_queue_work(sc->hw, &sc->hw_reset_work);
-                        count = 0;
-                }
-        } else
-                count = 0;
-}
-
-void ath_hw_pll_work(struct work_struct *work)
-{
-        struct ath_softc *sc = container_of(work, struct ath_softc,
-                                            hw_pll_work.work);
-        u32 pll_sqsum;
-
-        /*
-         * ensure that the PLL WAR is executed only
-         * after the STA is associated (or) if the
-         * beaconing had started in interfaces that
-         * uses beacons.
-         */
-        if (!(sc->sc_flags & SC_OP_BEACONS))
-                return;
-
-        if (AR_SREV_9485(sc->sc_ah)) {
-
-                ath9k_ps_wakeup(sc);
-                pll_sqsum = ar9003_get_pll_sqsum_dvc(sc->sc_ah);
-                ath9k_ps_restore(sc);
-
-                ath_hw_pll_rx_hang_check(sc, pll_sqsum);
-
-                ieee80211_queue_delayed_work(sc->hw, &sc->hw_pll_work, HZ/5);
-        }
-}
-
 /**********************/
 /* mac80211 callbacks */
 /**********************/
@@ -1054,10 +655,9 @@ static int ath9k_start(struct ieee80211_hw *hw)
         if (ah->caps.hw_caps & ATH9K_HW_CAP_HT)
                 ah->imask |= ATH9K_INT_CST;
 
-        if (ah->caps.hw_caps & ATH9K_HW_CAP_MCI)
-                ah->imask |= ATH9K_INT_MCI;
+        ath_mci_enable(sc);
 
-        sc->sc_flags &= ~SC_OP_INVALID;
+        clear_bit(SC_OP_INVALID, &sc->sc_flags);
         sc->sc_ah->is_monitoring = false;
 
         if (!ath_complete_reset(sc, false)) {
@@ -1099,6 +699,7 @@ static void ath9k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_tx_control txctl;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        unsigned long flags;
 
         if (sc->ps_enabled) {
                 /*
@@ -1121,6 +722,7 @@ static void ath9k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                  * completed and if needed, also for RX of buffered frames.
                  */
                 ath9k_ps_wakeup(sc);
+                spin_lock_irqsave(&sc->sc_pm_lock, flags);
                 if (!(sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_AUTOSLEEP))
                         ath9k_hw_setrxabort(sc->sc_ah, 0);
                 if (ieee80211_is_pspoll(hdr->frame_control)) {
@@ -1136,6 +738,7 @@ static void ath9k_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                  * the ps_flags bit is cleared. We are just dropping
                  * the ps_usecount here.
                  */
+                spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
                 ath9k_ps_restore(sc);
         }
 
@@ -1176,7 +779,7 @@ static void ath9k_stop(struct ieee80211_hw *hw)
         ath_cancel_work(sc);
         del_timer_sync(&sc->rx_poll_timer);
 
-        if (sc->sc_flags & SC_OP_INVALID) {
+        if (test_bit(SC_OP_INVALID, &sc->sc_flags)) {
                 ath_dbg(common, ANY, "Device not present\n");
                 mutex_unlock(&sc->mutex);
                 return;
@@ -1233,7 +836,7 @@ static void ath9k_stop(struct ieee80211_hw *hw)
 
         ath9k_ps_restore(sc);
 
-        sc->sc_flags |= SC_OP_INVALID;
+        set_bit(SC_OP_INVALID, &sc->sc_flags);
         sc->ps_idle = prev_idle;
 
         mutex_unlock(&sc->mutex);
@@ -1337,11 +940,11 @@ static void ath9k_calculate_summary_state(struct ieee80211_hw *hw,
         /* Set op-mode & TSF */
         if (iter_data.naps > 0) {
                 ath9k_hw_set_tsfadjust(ah, 1);
-                sc->sc_flags |= SC_OP_TSF_RESET;
+                set_bit(SC_OP_TSF_RESET, &sc->sc_flags);
                 ah->opmode = NL80211_IFTYPE_AP;
         } else {
                 ath9k_hw_set_tsfadjust(ah, 0);
-                sc->sc_flags &= ~SC_OP_TSF_RESET;
+                clear_bit(SC_OP_TSF_RESET, &sc->sc_flags);
 
                 if (iter_data.nmeshes)
                         ah->opmode = NL80211_IFTYPE_MESH_POINT;
@@ -1372,12 +975,12 @@ static void ath9k_calculate_summary_state(struct ieee80211_hw *hw,
                 sc->sc_ah->stats.avgbrssi = ATH_RSSI_DUMMY_MARKER;
 
                 if (!common->disable_ani) {
-                        sc->sc_flags |= SC_OP_ANI_RUN;
+                        set_bit(SC_OP_ANI_RUN, &sc->sc_flags);
                         ath_start_ani(common);
                 }
 
         } else {
-                sc->sc_flags &= ~SC_OP_ANI_RUN;
+                clear_bit(SC_OP_ANI_RUN, &sc->sc_flags);
                 del_timer_sync(&common->ani.timer);
         }
 }
@@ -1398,25 +1001,6 @@ static void ath9k_do_vif_add_setup(struct ieee80211_hw *hw,
         }
 }
 
-void ath_start_rx_poll(struct ath_softc *sc, u8 nbeacon)
-{
-        if (!AR_SREV_9300(sc->sc_ah))
-                return;
-
-        if (!(sc->sc_flags & SC_OP_PRIM_STA_VIF))
-                return;
-
-        mod_timer(&sc->rx_poll_timer, jiffies + msecs_to_jiffies
-                        (nbeacon * sc->cur_beacon_conf.beacon_interval));
-}
-
-void ath_rx_poll(unsigned long data)
-{
-        struct ath_softc *sc = (struct ath_softc *)data;
-
-        ieee80211_queue_work(sc->hw, &sc->hw_check_work);
-}
-
 static int ath9k_add_interface(struct ieee80211_hw *hw,
                                struct ieee80211_vif *vif)
 {
@@ -1618,11 +1202,6 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                 if (ah->curchan)
                         old_pos = ah->curchan - &ah->channels[0];
 
-                if (hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)
-                        sc->sc_flags |= SC_OP_OFFCHANNEL;
-                else
-                        sc->sc_flags &= ~SC_OP_OFFCHANNEL;
-
                 ath_dbg(common, CONFIG, "Set channel: %d MHz type: %d\n",
                         curchan->center_freq, conf->channel_type);
 
@@ -1664,6 +1243,7 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                 if (ath_set_channel(sc, hw, &sc->sc_ah->channels[pos]) < 0) {
                         ath_err(common, "Unable to set channel\n");
                         mutex_unlock(&sc->mutex);
+                        ath9k_ps_restore(sc);
                         return -EINVAL;
                 }
 
@@ -1902,16 +1482,16 @@ static void ath9k_bss_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
         struct ath_vif *avp = (void *)vif->drv_priv;
-
+        unsigned long flags;
         /*
          * Skip iteration if primary station vif's bss info
          * was not changed
          */
-        if (sc->sc_flags & SC_OP_PRIM_STA_VIF)
+        if (test_bit(SC_OP_PRIM_STA_VIF, &sc->sc_flags))
                 return;
 
         if (bss_conf->assoc) {
-                sc->sc_flags |= SC_OP_PRIM_STA_VIF;
+                set_bit(SC_OP_PRIM_STA_VIF, &sc->sc_flags);
                 avp->primary_sta_vif = true;
                 memcpy(common->curbssid, bss_conf->bssid, ETH_ALEN);
                 common->curaid = bss_conf->aid;
@@ -1924,7 +1504,10 @@ static void ath9k_bss_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
                  * on the receipt of the first Beacon frame (i.e.,
                  * after time sync with the AP).
                  */
+                spin_lock_irqsave(&sc->sc_pm_lock, flags);
                 sc->ps_flags |= PS_BEACON_SYNC | PS_WAIT_FOR_BEACON;
+                spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
+
                 /* Reset rssi stats */
                 sc->last_rssi = ATH_RSSI_DUMMY_MARKER;
                 sc->sc_ah->stats.avgbrssi = ATH_RSSI_DUMMY_MARKER;
@@ -1932,7 +1515,7 @@ static void ath9k_bss_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
                 ath_start_rx_poll(sc, 3);
 
                 if (!common->disable_ani) {
-                        sc->sc_flags |= SC_OP_ANI_RUN;
+                        set_bit(SC_OP_ANI_RUN, &sc->sc_flags);
                         ath_start_ani(common);
                 }
 
@@ -1952,7 +1535,8 @@ static void ath9k_config_bss(struct ath_softc *sc, struct ieee80211_vif *vif)
         if (avp->primary_sta_vif && !bss_conf->assoc) {
                 ath_dbg(common, CONFIG, "Bss Info DISASSOC %d, bssid %pM\n",
                         common->curaid, common->curbssid);
-                sc->sc_flags &= ~(SC_OP_PRIM_STA_VIF | SC_OP_BEACONS);
+                clear_bit(SC_OP_PRIM_STA_VIF, &sc->sc_flags);
+                clear_bit(SC_OP_BEACONS, &sc->sc_flags);
                 avp->primary_sta_vif = false;
                 memset(common->curbssid, 0, ETH_ALEN);
                 common->curaid = 0;
@@ -1965,10 +1549,9 @@ static void ath9k_config_bss(struct ath_softc *sc, struct ieee80211_vif *vif)
          * None of station vifs are associated.
          * Clear bssid & aid
          */
-        if (!(sc->sc_flags & SC_OP_PRIM_STA_VIF)) {
+        if (!test_bit(SC_OP_PRIM_STA_VIF, &sc->sc_flags)) {
                 ath9k_hw_write_associd(sc->sc_ah);
-                /* Stop ANI */
-                sc->sc_flags &= ~SC_OP_ANI_RUN;
+                clear_bit(SC_OP_ANI_RUN, &sc->sc_flags);
                 del_timer_sync(&common->ani.timer);
                 del_timer_sync(&sc->rx_poll_timer);
                 memset(&sc->caldata, 0, sizeof(sc->caldata));
@@ -2006,12 +1589,12 @@ static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
                         sc->sc_ah->stats.avgbrssi = ATH_RSSI_DUMMY_MARKER;
 
                         if (!common->disable_ani) {
-                                sc->sc_flags |= SC_OP_ANI_RUN;
+                                set_bit(SC_OP_ANI_RUN, &sc->sc_flags);
                                 ath_start_ani(common);
                         }
 
                 } else {
-                        sc->sc_flags &= ~SC_OP_ANI_RUN;
+                        clear_bit(SC_OP_ANI_RUN, &sc->sc_flags);
                         del_timer_sync(&common->ani.timer);
                         del_timer_sync(&sc->rx_poll_timer);
                 }
@@ -2023,7 +1606,7 @@ static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
          */
         if ((changed & BSS_CHANGED_BEACON_INT) &&
             (vif->type == NL80211_IFTYPE_AP))
-                sc->sc_flags |= SC_OP_TSF_RESET;
+                set_bit(SC_OP_TSF_RESET, &sc->sc_flags);
 
         /* Configure beaconing (AP, IBSS, MESH) */
         if (ath9k_uses_beacons(vif->type) &&
@@ -2215,7 +1798,7 @@ static void ath9k_flush(struct ieee80211_hw *hw, bool drop)
                 return;
         }
 
-        if (sc->sc_flags & SC_OP_INVALID) {
+        if (test_bit(SC_OP_INVALID, &sc->sc_flags)) {
                 ath_dbg(common, ANY, "Device not present\n");
                 mutex_unlock(&sc->mutex);
                 return;
@@ -2380,6 +1963,134 @@ static int ath9k_get_antenna(struct ieee80211_hw *hw, u32 *tx_ant, u32 *rx_ant)
         return 0;
 }
 
+#ifdef CONFIG_ATH9K_DEBUGFS
+
+/* Ethtool support for get-stats */
+
+#define AMKSTR(nm) #nm "_BE", #nm "_BK", #nm "_VI", #nm "_VO"
+static const char ath9k_gstrings_stats[][ETH_GSTRING_LEN] = {
+        "tx_pkts_nic",
+        "tx_bytes_nic",
+        "rx_pkts_nic",
+        "rx_bytes_nic",
+        AMKSTR(d_tx_pkts),
+        AMKSTR(d_tx_bytes),
+        AMKSTR(d_tx_mpdus_queued),
+        AMKSTR(d_tx_mpdus_completed),
+        AMKSTR(d_tx_mpdu_xretries),
+        AMKSTR(d_tx_aggregates),
+        AMKSTR(d_tx_ampdus_queued_hw),
+        AMKSTR(d_tx_ampdus_queued_sw),
+        AMKSTR(d_tx_ampdus_completed),
+        AMKSTR(d_tx_ampdu_retries),
+        AMKSTR(d_tx_ampdu_xretries),
+        AMKSTR(d_tx_fifo_underrun),
+        AMKSTR(d_tx_op_exceeded),
+        AMKSTR(d_tx_timer_expiry),
+        AMKSTR(d_tx_desc_cfg_err),
+        AMKSTR(d_tx_data_underrun),
+        AMKSTR(d_tx_delim_underrun),
+
+        "d_rx_decrypt_crc_err",
+        "d_rx_phy_err",
+        "d_rx_mic_err",
+        "d_rx_pre_delim_crc_err",
+        "d_rx_post_delim_crc_err",
+        "d_rx_decrypt_busy_err",
+
+        "d_rx_phyerr_radar",
+        "d_rx_phyerr_ofdm_timing",
+        "d_rx_phyerr_cck_timing",
+
+};
+#define ATH9K_SSTATS_LEN ARRAY_SIZE(ath9k_gstrings_stats)
+
+static void ath9k_get_et_strings(struct ieee80211_hw *hw,
+                                 struct ieee80211_vif *vif,
+                                 u32 sset, u8 *data)
+{
+        if (sset == ETH_SS_STATS)
+                memcpy(data, *ath9k_gstrings_stats,
+                       sizeof(ath9k_gstrings_stats));
+}
+
+static int ath9k_get_et_sset_count(struct ieee80211_hw *hw,
+                                   struct ieee80211_vif *vif, int sset)
+{
+        if (sset == ETH_SS_STATS)
+                return ATH9K_SSTATS_LEN;
+        return 0;
+}
+
+#define PR_QNUM(_n) (sc->tx.txq_map[_n]->axq_qnum)
+#define AWDATA(elem)                                                    \
+        do {                                                            \
+                data[i++] = sc->debug.stats.txstats[PR_QNUM(WME_AC_BE)].elem; \
+                data[i++] = sc->debug.stats.txstats[PR_QNUM(WME_AC_BK)].elem; \
+                data[i++] = sc->debug.stats.txstats[PR_QNUM(WME_AC_VI)].elem; \
+                data[i++] = sc->debug.stats.txstats[PR_QNUM(WME_AC_VO)].elem; \
+        } while (0)
+
+#define AWDATA_RX(elem)                                         \
+        do {                                                    \
+                data[i++] = sc->debug.stats.rxstats.elem;       \
+        } while (0)
+
+static void ath9k_get_et_stats(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               struct ethtool_stats *stats, u64 *data)
+{
+        struct ath_softc *sc = hw->priv;
+        int i = 0;
+
+        data[i++] = (sc->debug.stats.txstats[PR_QNUM(WME_AC_BE)].tx_pkts_all +
+                     sc->debug.stats.txstats[PR_QNUM(WME_AC_BK)].tx_pkts_all +
+                     sc->debug.stats.txstats[PR_QNUM(WME_AC_VI)].tx_pkts_all +
+                     sc->debug.stats.txstats[PR_QNUM(WME_AC_VO)].tx_pkts_all);
+        data[i++] = (sc->debug.stats.txstats[PR_QNUM(WME_AC_BE)].tx_bytes_all +
+                     sc->debug.stats.txstats[PR_QNUM(WME_AC_BK)].tx_bytes_all +
+                     sc->debug.stats.txstats[PR_QNUM(WME_AC_VI)].tx_bytes_all +
+                     sc->debug.stats.txstats[PR_QNUM(WME_AC_VO)].tx_bytes_all);
+        AWDATA_RX(rx_pkts_all);
+        AWDATA_RX(rx_bytes_all);
+
+        AWDATA(tx_pkts_all);
+        AWDATA(tx_bytes_all);
+        AWDATA(queued);
+        AWDATA(completed);
+        AWDATA(xretries);
+        AWDATA(a_aggr);
+        AWDATA(a_queued_hw);
+        AWDATA(a_queued_sw);
+        AWDATA(a_completed);
+        AWDATA(a_retries);
+        AWDATA(a_xretries);
+        AWDATA(fifo_underrun);
+        AWDATA(xtxop);
+        AWDATA(timer_exp);
+        AWDATA(desc_cfg_err);
+        AWDATA(data_underrun);
+        AWDATA(delim_underrun);
+
+        AWDATA_RX(decrypt_crc_err);
+        AWDATA_RX(phy_err);
+        AWDATA_RX(mic_err);
+        AWDATA_RX(pre_delim_crc_err);
+        AWDATA_RX(post_delim_crc_err);
+        AWDATA_RX(decrypt_busy_err);
+
+        AWDATA_RX(phy_err_stats[ATH9K_PHYERR_RADAR]);
+        AWDATA_RX(phy_err_stats[ATH9K_PHYERR_OFDM_TIMING]);
+        AWDATA_RX(phy_err_stats[ATH9K_PHYERR_CCK_TIMING]);
+
+        WARN_ON(i != ATH9K_SSTATS_LEN);
+}
+
+/* End of ethtool get-stats functions */
+
+#endif
+
+
 struct ieee80211_ops ath9k_ops = {
         .tx                 = ath9k_tx,
         .start              = ath9k_start,
@@ -2408,4 +2119,10 @@ struct ieee80211_ops ath9k_ops = {
         .get_stats          = ath9k_get_stats,
         .set_antenna        = ath9k_set_antenna,
         .get_antenna        = ath9k_get_antenna,
+
+#ifdef CONFIG_ATH9K_DEBUGFS
+        .get_et_sset_count  = ath9k_get_et_sset_count,
+        .get_et_stats  = ath9k_get_et_stats,
+        .get_et_strings  = ath9k_get_et_strings,
+#endif
 };
diff --git a/drivers/net/wireless/ath/ath9k/mci.c b/drivers/net/wireless/ath/ath9k/mci.c
index 29fe52d69973..7d34a504d617 100644
--- a/drivers/net/wireless/ath/ath9k/mci.c
+++ b/drivers/net/wireless/ath/ath9k/mci.c
@@ -20,7 +20,7 @@
 #include "ath9k.h"
 #include "mci.h"
 
-static const u8 ath_mci_duty_cycle[] = { 0, 50, 60, 70, 80, 85, 90, 95, 98 };
+static const u8 ath_mci_duty_cycle[] = { 55, 50, 60, 70, 80, 85, 90, 95, 98 };
 
 static struct ath_mci_profile_info*
 ath_mci_find_profile(struct ath_mci_profile *mci,
@@ -28,11 +28,14 @@ ath_mci_find_profile(struct ath_mci_profile *mci,
 {
         struct ath_mci_profile_info *entry;
 
+        if (list_empty(&mci->info))
+                return NULL;
+
         list_for_each_entry(entry, &mci->info, list) {
                 if (entry->conn_handle == info->conn_handle)
-                        break;
+                        return entry;
         }
-        return entry;
+        return NULL;
 }
 
 static bool ath_mci_add_profile(struct ath_common *common,
@@ -49,31 +52,21 @@ static bool ath_mci_add_profile(struct ath_common *common,
             (info->type != MCI_GPM_COEX_PROFILE_VOICE))
                 return false;
 
-        entry = ath_mci_find_profile(mci, info);
+        entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
+        if (!entry)
+                return false;
 
-        if (entry) {
-                memcpy(entry, info, 10);
-        } else {
-                entry = kzalloc(sizeof(*entry), GFP_KERNEL);
-                if (!entry)
-                        return false;
-
-                memcpy(entry, info, 10);
-                INC_PROF(mci, info);
-                list_add_tail(&info->list, &mci->info);
-        }
+        memcpy(entry, info, 10);
+        INC_PROF(mci, info);
+        list_add_tail(&entry->list, &mci->info);
 
         return true;
 }
 
 static void ath_mci_del_profile(struct ath_common *common,
                                 struct ath_mci_profile *mci,
-                                struct ath_mci_profile_info *info)
+                                struct ath_mci_profile_info *entry)
 {
-        struct ath_mci_profile_info *entry;
-
-        entry = ath_mci_find_profile(mci, info);
-
         if (!entry)
                 return;
 
@@ -86,12 +79,16 @@ void ath_mci_flush_profile(struct ath_mci_profile *mci)
 {
         struct ath_mci_profile_info *info, *tinfo;
 
+        mci->aggr_limit = 0;
+
+        if (list_empty(&mci->info))
+                return;
+
         list_for_each_entry_safe(info, tinfo, &mci->info, list) {
                 list_del(&info->list);
                 DEC_PROF(mci, info);
                 kfree(info);
         }
-        mci->aggr_limit = 0;
 }
 
 static void ath_mci_adjust_aggr_limit(struct ath_btcoex *btcoex)
@@ -116,42 +113,60 @@ static void ath_mci_update_scheme(struct ath_softc *sc)
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_btcoex *btcoex = &sc->btcoex;
         struct ath_mci_profile *mci = &btcoex->mci;
+        struct ath9k_hw_mci *mci_hw = &sc->sc_ah->btcoex_hw.mci;
         struct ath_mci_profile_info *info;
         u32 num_profile = NUM_PROF(mci);
 
+        if (mci_hw->config & ATH_MCI_CONFIG_DISABLE_TUNING)
+                goto skip_tuning;
+
+        btcoex->duty_cycle = ath_mci_duty_cycle[num_profile];
+
         if (num_profile == 1) {
                 info = list_first_entry(&mci->info,
                                         struct ath_mci_profile_info,
                                         list);
-                if (mci->num_sco && info->T == 12) {
-                        mci->aggr_limit = 8;
+                if (mci->num_sco) {
+                        if (info->T == 12)
+                                mci->aggr_limit = 8;
+                        else if (info->T == 6) {
+                                mci->aggr_limit = 6;
+                                btcoex->duty_cycle = 30;
+                        }
                         ath_dbg(common, MCI,
-                                "Single SCO, aggregation limit 2 ms\n");
-                } else if ((info->type == MCI_GPM_COEX_PROFILE_BNEP) &&
-                           !info->master) {
-                        btcoex->btcoex_period = 60;
+                                "Single SCO, aggregation limit %d 1/4 ms\n",
+                                mci->aggr_limit);
+                } else if (mci->num_pan || mci->num_other_acl) {
+                        /*
+                         * For single PAN/FTP profile, allocate 35% for BT
+                         * to improve WLAN throughput.
+                         */
+                        btcoex->duty_cycle = 35;
+                        btcoex->btcoex_period = 53;
                         ath_dbg(common, MCI,
-                                "Single slave PAN/FTP, bt period 60 ms\n");
-                } else if ((info->type == MCI_GPM_COEX_PROFILE_HID) &&
-                         (info->T > 0 && info->T < 50) &&
-                         (info->A > 1 || info->W > 1)) {
+                                "Single PAN/FTP bt period %d ms dutycycle %d\n",
+                                btcoex->duty_cycle, btcoex->btcoex_period);
+                } else if (mci->num_hid) {
                         btcoex->duty_cycle = 30;
-                        mci->aggr_limit = 8;
+                        mci->aggr_limit = 6;
                         ath_dbg(common, MCI,
                                 "Multiple attempt/timeout single HID "
-                                "aggregation limit 2 ms dutycycle 30%%\n");
+                                "aggregation limit 1.5 ms dutycycle 30%%\n");
                 }
-        } else if ((num_profile == 2) && (mci->num_hid == 2)) {
-                btcoex->duty_cycle = 30;
-                mci->aggr_limit = 8;
-                ath_dbg(common, MCI,
-                        "Two HIDs aggregation limit 2 ms dutycycle 30%%\n");
-        } else if (num_profile > 3) {
+        } else if (num_profile == 2) {
+                if (mci->num_hid == 2)
+                        btcoex->duty_cycle = 30;
                 mci->aggr_limit = 6;
                 ath_dbg(common, MCI,
-                        "Three or more profiles aggregation limit 1.5 ms\n");
+                        "Two BT profiles aggr limit 1.5 ms dutycycle %d%%\n",
+                        btcoex->duty_cycle);
+        } else if (num_profile >= 3) {
+                mci->aggr_limit = 4;
+                ath_dbg(common, MCI,
+                        "Three or more profiles aggregation limit 1 ms\n");
         }
 
+skip_tuning:
         if (IS_CHAN_2GHZ(sc->sc_ah->curchan)) {
                 if (IS_CHAN_HT(sc->sc_ah->curchan))
                         ath_mci_adjust_aggr_limit(btcoex);
@@ -165,12 +180,11 @@ static void ath_mci_update_scheme(struct ath_softc *sc)
         if (IS_CHAN_5GHZ(sc->sc_ah->curchan))
                 return;
 
-        btcoex->duty_cycle += (mci->num_bdr ? ATH_MCI_MAX_DUTY_CYCLE : 0);
+        btcoex->duty_cycle += (mci->num_bdr ? ATH_MCI_BDR_DUTY_CYCLE : 0);
         if (btcoex->duty_cycle > ATH_MCI_MAX_DUTY_CYCLE)
                 btcoex->duty_cycle = ATH_MCI_MAX_DUTY_CYCLE;
 
-        btcoex->btcoex_period *= 1000;
-        btcoex->btcoex_no_stomp =  btcoex->btcoex_period *
+        btcoex->btcoex_no_stomp =  btcoex->btcoex_period * 1000 *
                 (100 - btcoex->duty_cycle) / 100;
 
         ath9k_hw_btcoex_enable(sc->sc_ah);
@@ -181,20 +195,16 @@ static void ath_mci_cal_msg(struct ath_softc *sc, u8 opcode, u8 *rx_payload)
 {
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_hw_mci *mci_hw = &ah->btcoex_hw.mci;
         u32 payload[4] = {0, 0, 0, 0};
 
         switch (opcode) {
         case MCI_GPM_BT_CAL_REQ:
-                if (ar9003_mci_state(ah, MCI_STATE_BT, NULL) == MCI_BT_AWAKE) {
-                        ar9003_mci_state(ah, MCI_STATE_SET_BT_CAL_START, NULL);
+                if (mci_hw->bt_state == MCI_BT_AWAKE) {
+                        ar9003_mci_state(ah, MCI_STATE_SET_BT_CAL_START);
                         ieee80211_queue_work(sc->hw, &sc->hw_reset_work);
-                } else {
-                        ath_dbg(common, MCI, "MCI State mismatch: %d\n",
-                                ar9003_mci_state(ah, MCI_STATE_BT, NULL));
                 }
-                break;
-        case MCI_GPM_BT_CAL_DONE:
-                ar9003_mci_state(ah, MCI_STATE_BT, NULL);
+                ath_dbg(common, MCI, "MCI State : %d\n", mci_hw->bt_state);
                 break;
         case MCI_GPM_BT_CAL_GRANT:
                 MCI_GPM_SET_CAL_TYPE(payload, MCI_GPM_WLAN_CAL_DONE);
@@ -207,32 +217,42 @@ static void ath_mci_cal_msg(struct ath_softc *sc, u8 opcode, u8 *rx_payload)
         }
 }
 
+static void ath9k_mci_work(struct work_struct *work)
+{
+        struct ath_softc *sc = container_of(work, struct ath_softc, mci_work);
+
+        ath_mci_update_scheme(sc);
+}
+
 static void ath_mci_process_profile(struct ath_softc *sc,
                                     struct ath_mci_profile_info *info)
 {
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_btcoex *btcoex = &sc->btcoex;
         struct ath_mci_profile *mci = &btcoex->mci;
+        struct ath_mci_profile_info *entry = NULL;
+
+        entry = ath_mci_find_profile(mci, info);
+        if (entry)
+                memcpy(entry, info, 10);
 
         if (info->start) {
-                if (!ath_mci_add_profile(common, mci, info))
+                if (!entry && !ath_mci_add_profile(common, mci, info))
                         return;
         } else
-                ath_mci_del_profile(common, mci, info);
+                ath_mci_del_profile(common, mci, entry);
 
         btcoex->btcoex_period = ATH_MCI_DEF_BT_PERIOD;
         mci->aggr_limit = mci->num_sco ? 6 : 0;
 
-        if (NUM_PROF(mci)) {
+        btcoex->duty_cycle = ath_mci_duty_cycle[NUM_PROF(mci)];
+        if (NUM_PROF(mci))
                 btcoex->bt_stomp_type = ATH_BTCOEX_STOMP_LOW;
-                btcoex->duty_cycle = ath_mci_duty_cycle[NUM_PROF(mci)];
-        } else {
+        else
                 btcoex->bt_stomp_type = mci->num_mgmt ? ATH_BTCOEX_STOMP_ALL :
                                                         ATH_BTCOEX_STOMP_LOW;
-                btcoex->duty_cycle = ATH_BTCOEX_DEF_DUTY_CYCLE;
-        }
 
-        ath_mci_update_scheme(sc);
+        ieee80211_queue_work(sc->hw, &sc->mci_work);
 }
 
 static void ath_mci_process_status(struct ath_softc *sc,
@@ -247,8 +267,6 @@ static void ath_mci_process_status(struct ath_softc *sc,
         if (status->is_link)
                 return;
 
-        memset(&info, 0, sizeof(struct ath_mci_profile_info));
-
         info.conn_handle = status->conn_handle;
         if (ath_mci_find_profile(mci, &info))
                 return;
@@ -268,7 +286,7 @@ static void ath_mci_process_status(struct ath_softc *sc,
         } while (++i < ATH_MCI_MAX_PROFILE);
 
         if (old_num_mgmt != mci->num_mgmt)
-                ath_mci_update_scheme(sc);
+                ieee80211_queue_work(sc->hw, &sc->mci_work);
 }
 
 static void ath_mci_msg(struct ath_softc *sc, u8 opcode, u8 *rx_payload)
@@ -277,25 +295,20 @@ static void ath_mci_msg(struct ath_softc *sc, u8 opcode, u8 *rx_payload)
         struct ath_mci_profile_info profile_info;
         struct ath_mci_profile_status profile_status;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        u32 version;
-        u8 major;
-        u8 minor;
+        u8 major, minor;
         u32 seq_num;
 
         switch (opcode) {
         case MCI_GPM_COEX_VERSION_QUERY:
-                version = ar9003_mci_state(ah, MCI_STATE_SEND_WLAN_COEX_VERSION,
-                                           NULL);
+                ar9003_mci_state(ah, MCI_STATE_SEND_WLAN_COEX_VERSION);
                 break;
         case MCI_GPM_COEX_VERSION_RESPONSE:
                 major = *(rx_payload + MCI_GPM_COEX_B_MAJOR_VERSION);
                 minor = *(rx_payload + MCI_GPM_COEX_B_MINOR_VERSION);
-                version = (major << 8) + minor;
-                version = ar9003_mci_state(ah, MCI_STATE_SET_BT_COEX_VERSION,
-                                           &version);
+                ar9003_mci_set_bt_version(ah, major, minor);
                 break;
         case MCI_GPM_COEX_STATUS_QUERY:
-                ar9003_mci_state(ah, MCI_STATE_SEND_WLAN_CHANNELS, NULL);
+                ar9003_mci_send_wlan_channels(ah);
                 break;
         case MCI_GPM_COEX_BT_PROFILE_INFO:
                 memcpy(&profile_info,
@@ -362,6 +375,7 @@ int ath_mci_setup(struct ath_softc *sc)
                          mci->gpm_buf.bf_addr, (mci->gpm_buf.bf_len >> 4),
                          mci->sched_buf.bf_paddr);
 
+        INIT_WORK(&sc->mci_work, ath9k_mci_work);
         ath_dbg(common, MCI, "MCI Initialized\n");
 
         return 0;
@@ -389,6 +403,7 @@ void ath_mci_intr(struct ath_softc *sc)
         struct ath_mci_coex *mci = &sc->mci_coex;
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_hw_mci *mci_hw = &ah->btcoex_hw.mci;
         u32 mci_int, mci_int_rxmsg;
         u32 offset, subtype, opcode;
         u32 *pgpm;
@@ -397,8 +412,8 @@ void ath_mci_intr(struct ath_softc *sc)
 
         ar9003_mci_get_interrupt(sc->sc_ah, &mci_int, &mci_int_rxmsg);
 
-        if (ar9003_mci_state(ah, MCI_STATE_ENABLE, NULL) == 0) {
-                ar9003_mci_state(ah, MCI_STATE_INIT_GPM_OFFSET, NULL);
+        if (ar9003_mci_state(ah, MCI_STATE_ENABLE) == 0) {
+                ar9003_mci_get_next_gpm_offset(ah, true, NULL);
                 return;
         }
 
@@ -417,46 +432,41 @@ void ath_mci_intr(struct ath_softc *sc)
                                         NULL, 0, true, false);
 
                 mci_int_rxmsg &= ~AR_MCI_INTERRUPT_RX_MSG_REQ_WAKE;
-                ar9003_mci_state(ah, MCI_STATE_RESET_REQ_WAKE, NULL);
+                ar9003_mci_state(ah, MCI_STATE_RESET_REQ_WAKE);
 
                 /*
                  * always do this for recovery and 2G/5G toggling and LNA_TRANS
                  */
-                ar9003_mci_state(ah, MCI_STATE_SET_BT_AWAKE, NULL);
+                ar9003_mci_state(ah, MCI_STATE_SET_BT_AWAKE);
         }
 
         if (mci_int_rxmsg & AR_MCI_INTERRUPT_RX_MSG_SYS_WAKING) {
                 mci_int_rxmsg &= ~AR_MCI_INTERRUPT_RX_MSG_SYS_WAKING;
 
-                if (ar9003_mci_state(ah, MCI_STATE_BT, NULL) == MCI_BT_SLEEP) {
-                        if (ar9003_mci_state(ah, MCI_STATE_REMOTE_SLEEP, NULL) !=
-                            MCI_BT_SLEEP)
-                                ar9003_mci_state(ah, MCI_STATE_SET_BT_AWAKE,
-                                                 NULL);
-                }
+                if ((mci_hw->bt_state == MCI_BT_SLEEP) &&
+                    (ar9003_mci_state(ah, MCI_STATE_REMOTE_SLEEP) !=
+                     MCI_BT_SLEEP))
+                        ar9003_mci_state(ah, MCI_STATE_SET_BT_AWAKE);
         }
 
         if (mci_int_rxmsg & AR_MCI_INTERRUPT_RX_MSG_SYS_SLEEPING) {
                 mci_int_rxmsg &= ~AR_MCI_INTERRUPT_RX_MSG_SYS_SLEEPING;
 
-                if (ar9003_mci_state(ah, MCI_STATE_BT, NULL) == MCI_BT_AWAKE) {
-                        if (ar9003_mci_state(ah, MCI_STATE_REMOTE_SLEEP, NULL) !=
-                            MCI_BT_AWAKE)
-                                ar9003_mci_state(ah, MCI_STATE_SET_BT_SLEEP,
-                                                 NULL);
-                }
+                if ((mci_hw->bt_state == MCI_BT_AWAKE) &&
+                    (ar9003_mci_state(ah, MCI_STATE_REMOTE_SLEEP) !=
+                     MCI_BT_AWAKE))
+                        mci_hw->bt_state = MCI_BT_SLEEP;
         }
 
         if ((mci_int & AR_MCI_INTERRUPT_RX_INVALID_HDR) ||
             (mci_int & AR_MCI_INTERRUPT_CONT_INFO_TIMEOUT)) {
-                ar9003_mci_state(ah, MCI_STATE_RECOVER_RX, NULL);
+                ar9003_mci_state(ah, MCI_STATE_RECOVER_RX);
                 skip_gpm = true;
         }
 
         if (mci_int_rxmsg & AR_MCI_INTERRUPT_RX_MSG_SCHD_INFO) {
                 mci_int_rxmsg &= ~AR_MCI_INTERRUPT_RX_MSG_SCHD_INFO;
-                offset = ar9003_mci_state(ah, MCI_STATE_LAST_SCHD_MSG_OFFSET,
-                                          NULL);
+                offset = ar9003_mci_state(ah, MCI_STATE_LAST_SCHD_MSG_OFFSET);
         }
 
         if (mci_int_rxmsg & AR_MCI_INTERRUPT_RX_MSG_GPM) {
@@ -465,8 +475,8 @@ void ath_mci_intr(struct ath_softc *sc)
                 while (more_data == MCI_GPM_MORE) {
 
                         pgpm = mci->gpm_buf.bf_addr;
-                        offset = ar9003_mci_state(ah, MCI_STATE_NEXT_GPM_OFFSET,
-                                                  &more_data);
+                        offset = ar9003_mci_get_next_gpm_offset(ah, false,
+                                                                &more_data);
 
                         if (offset == MCI_GPM_INVALID)
                                 break;
@@ -507,23 +517,17 @@ void ath_mci_intr(struct ath_softc *sc)
                         mci_int_rxmsg &= ~AR_MCI_INTERRUPT_RX_MSG_LNA_INFO;
 
                 if (mci_int_rxmsg & AR_MCI_INTERRUPT_RX_MSG_CONT_INFO) {
-                        int value_dbm = ar9003_mci_state(ah,
-                                                 MCI_STATE_CONT_RSSI_POWER, NULL);
+                        int value_dbm = MS(mci_hw->cont_status,
+                                           AR_MCI_CONT_RSSI_POWER);
 
                         mci_int_rxmsg &= ~AR_MCI_INTERRUPT_RX_MSG_CONT_INFO;
 
-                        if (ar9003_mci_state(ah, MCI_STATE_CONT_TXRX, NULL))
-                                ath_dbg(common, MCI,
-                                        "MCI CONT_INFO: (tx) pri = %d, pwr = %d dBm\n",
-                                        ar9003_mci_state(ah,
-                                                 MCI_STATE_CONT_PRIORITY, NULL),
-                                        value_dbm);
-                        else
-                                ath_dbg(common, MCI,
-                                        "MCI CONT_INFO: (rx) pri = %d,pwr = %d dBm\n",
-                                        ar9003_mci_state(ah,
-                                                 MCI_STATE_CONT_PRIORITY, NULL),
-                                        value_dbm);
+                        ath_dbg(common, MCI,
+                                "MCI CONT_INFO: (%s) pri = %d pwr = %d dBm\n",
+                                MS(mci_hw->cont_status, AR_MCI_CONT_TXRX) ?
+                                "tx" : "rx",
+                                MS(mci_hw->cont_status, AR_MCI_CONT_PRIORITY),
+                                value_dbm);
                 }
 
                 if (mci_int_rxmsg & AR_MCI_INTERRUPT_RX_MSG_CONT_NACK)
@@ -538,3 +542,14 @@ void ath_mci_intr(struct ath_softc *sc)
                 mci_int &= ~(AR_MCI_INTERRUPT_RX_INVALID_HDR |
                              AR_MCI_INTERRUPT_CONT_INFO_TIMEOUT);
 }
+
+void ath_mci_enable(struct ath_softc *sc)
+{
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+
+        if (!common->btcoex_enabled)
+                return;
+
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_MCI)
+                sc->sc_ah->imask |= ATH9K_INT_MCI;
+}
diff --git a/drivers/net/wireless/ath/ath9k/mci.h b/drivers/net/wireless/ath/ath9k/mci.h
index c841444f53c2..fc14eea034eb 100644
--- a/drivers/net/wireless/ath/ath9k/mci.h
+++ b/drivers/net/wireless/ath/ath9k/mci.h
@@ -130,4 +130,13 @@ void ath_mci_flush_profile(struct ath_mci_profile *mci);
 int ath_mci_setup(struct ath_softc *sc);
 void ath_mci_cleanup(struct ath_softc *sc);
 void ath_mci_intr(struct ath_softc *sc);
-#endif
+
+#ifdef CONFIG_ATH9K_BTCOEX_SUPPORT
+void ath_mci_enable(struct ath_softc *sc);
+#else
+static inline void ath_mci_enable(struct ath_softc *sc)
+{
+}
+#endif /* CONFIG_ATH9K_BTCOEX_SUPPORT */
+
+#endif /* MCI_H*/
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index a856b51255f4..aa0e83ac51f4 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -115,6 +115,9 @@ static void ath_pci_aspm_init(struct ath_common *common)
         int pos;
         u8 aspm;
 
+        if (!ah->is_pciexpress)
+                return;
+
         pos = pci_pcie_cap(pdev);
         if (!pos)
                 return;
@@ -138,6 +141,7 @@ static void ath_pci_aspm_init(struct ath_common *common)
                 aspm &= ~(PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1);
                 pci_write_config_byte(parent, pos + PCI_EXP_LNKCTL, aspm);
 
+                ath_info(common, "Disabling ASPM since BTCOEX is enabled\n");
                 return;
         }
 
@@ -147,6 +151,7 @@ static void ath_pci_aspm_init(struct ath_common *common)
                 ah->aspm_enabled = true;
                 /* Initialize PCIe PM and SERDES registers. */
                 ath9k_hw_configpcipowersave(ah, false);
+                ath_info(common, "ASPM enabled: 0x%x\n", aspm);
         }
 }
 
@@ -246,7 +251,7 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         sc->mem = mem;
 
         /* Will be cleared in ath9k_start() */
-        sc->sc_flags |= SC_OP_INVALID;
+        set_bit(SC_OP_INVALID, &sc->sc_flags);
 
         ret = request_irq(pdev->irq, ath_isr, IRQF_SHARED, "ath9k", sc);
         if (ret) {
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index 92a6c0a87f89..e034add9cd5a 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -770,7 +770,7 @@ static void ath_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
         struct ieee80211_tx_rate *rates = tx_info->control.rates;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         __le16 fc = hdr->frame_control;
-        u8 try_per_rate, i = 0, rix, high_rix;
+        u8 try_per_rate, i = 0, rix;
         int is_probe = 0;
 
         if (rate_control_send_low(sta, priv_sta, txrc))
@@ -791,7 +791,6 @@ static void ath_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
         rate_table = ath_rc_priv->rate_table;
         rix = ath_rc_get_highest_rix(sc, ath_rc_priv, rate_table,
                                      &is_probe, false);
-        high_rix = rix;
 
         /*
          * If we're in HT mode and both us and our peer supports LDPC.
@@ -839,16 +838,16 @@ static void ath_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
         try_per_rate = 8;
 
         /*
-         * Use a legacy rate as last retry to ensure that the frame
-         * is tried in both MCS and legacy rates.
+         * If the last rate in the rate series is MCS and has
+         * more than 80% of per thresh, then use a legacy rate
+         * as last retry to ensure that the frame is tried in both
+         * MCS and legacy rate.
          */
-        if ((rates[2].flags & IEEE80211_TX_RC_MCS) &&
-            (!(tx_info->flags & IEEE80211_TX_CTL_AMPDU) ||
-            (ath_rc_priv->per[high_rix] > 45)))
+        ath_rc_get_lower_rix(rate_table, ath_rc_priv, rix, &rix);
+        if (WLAN_RC_PHY_HT(rate_table->info[rix].phy) &&
+            (ath_rc_priv->per[rix] > 45))
                 rix = ath_rc_get_highest_rix(sc, ath_rc_priv, rate_table,
                                 &is_probe, true);
-        else
-                ath_rc_get_lower_rix(rate_table, ath_rc_priv, rix, &rix);
 
         /* All other rates in the series have RTS enabled */
         ath_rc_rate_set_series(rate_table, &rates[i], txrc,
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index e1fcc68124dc..fbdcc80437fe 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -20,43 +20,6 @@
 
 #define SKB_CB_ATHBUF(__skb)    (*((struct ath_buf **)__skb->cb))
 
-static inline bool ath_is_alt_ant_ratio_better(int alt_ratio, int maxdelta,
-                                               int mindelta, int main_rssi_avg,
-                                               int alt_rssi_avg, int pkt_count)
-{
-        return (((alt_ratio >= ATH_ANT_DIV_COMB_ALT_ANT_RATIO2) &&
-                (alt_rssi_avg > main_rssi_avg + maxdelta)) ||
-                (alt_rssi_avg > main_rssi_avg + mindelta)) && (pkt_count > 50);
-}
-
-static inline bool ath_ant_div_comb_alt_check(u8 div_group, int alt_ratio,
-                                        int curr_main_set, int curr_alt_set,
-                                        int alt_rssi_avg, int main_rssi_avg)
-{
-        bool result = false;
-        switch (div_group) {
-        case 0:
-                if (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO)
-                        result = true;
-                break;
-        case 1:
-        case 2:
-                if ((((curr_main_set == ATH_ANT_DIV_COMB_LNA2) &&
-                        (curr_alt_set == ATH_ANT_DIV_COMB_LNA1) &&
-                                (alt_rssi_avg >= (main_rssi_avg - 5))) ||
-                        ((curr_main_set == ATH_ANT_DIV_COMB_LNA1) &&
-                        (curr_alt_set == ATH_ANT_DIV_COMB_LNA2) &&
-                                (alt_rssi_avg >= (main_rssi_avg - 2)))) &&
-                                                        (alt_rssi_avg >= 4))
-                        result = true;
-                else
-                        result = false;
-                break;
-        }
-
-        return result;
-}
-
 static inline bool ath9k_check_auto_sleep(struct ath_softc *sc)
 {
         return sc->ps_enabled &&
@@ -303,7 +266,7 @@ static void ath_edma_start_recv(struct ath_softc *sc)
 
         ath_opmode_init(sc);
 
-        ath9k_hw_startpcureceive(sc->sc_ah, (sc->sc_flags & SC_OP_OFFCHANNEL));
+        ath9k_hw_startpcureceive(sc->sc_ah, !!(sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL));
 
         spin_unlock_bh(&sc->rx.rxbuflock);
 }
@@ -322,8 +285,8 @@ int ath_rx_init(struct ath_softc *sc, int nbufs)
         int error = 0;
 
         spin_lock_init(&sc->sc_pcu_lock);
-        sc->sc_flags &= ~SC_OP_RXFLUSH;
         spin_lock_init(&sc->rx.rxbuflock);
+        clear_bit(SC_OP_RXFLUSH, &sc->sc_flags);
 
         common->rx_bufsize = IEEE80211_MAX_MPDU_LEN / 2 +
                              sc->sc_ah->caps.rx_status_len;
@@ -500,7 +463,7 @@ int ath_startrecv(struct ath_softc *sc)
 
 start_recv:
         ath_opmode_init(sc);
-        ath9k_hw_startpcureceive(ah, (sc->sc_flags & SC_OP_OFFCHANNEL));
+        ath9k_hw_startpcureceive(ah, !!(sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL));
 
         spin_unlock_bh(&sc->rx.rxbuflock);
 
@@ -535,11 +498,11 @@ bool ath_stoprecv(struct ath_softc *sc)
 
 void ath_flushrecv(struct ath_softc *sc)
 {
-        sc->sc_flags |= SC_OP_RXFLUSH;
+        set_bit(SC_OP_RXFLUSH, &sc->sc_flags);
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
                 ath_rx_tasklet(sc, 1, true);
         ath_rx_tasklet(sc, 1, false);
-        sc->sc_flags &= ~SC_OP_RXFLUSH;
+        clear_bit(SC_OP_RXFLUSH, &sc->sc_flags);
 }
 
 static bool ath_beacon_dtim_pending_cab(struct sk_buff *skb)
@@ -624,13 +587,13 @@ static void ath_rx_ps(struct ath_softc *sc, struct sk_buff *skb, bool mybeacon)
 
         /* Process Beacon and CAB receive in PS state */
         if (((sc->ps_flags & PS_WAIT_FOR_BEACON) || ath9k_check_auto_sleep(sc))
-            && mybeacon)
+            && mybeacon) {
                 ath_rx_ps_beacon(sc, skb);
-        else if ((sc->ps_flags & PS_WAIT_FOR_CAB) &&
-                 (ieee80211_is_data(hdr->frame_control) ||
-                  ieee80211_is_action(hdr->frame_control)) &&
-                 is_multicast_ether_addr(hdr->addr1) &&
-                 !ieee80211_has_moredata(hdr->frame_control)) {
+        } else if ((sc->ps_flags & PS_WAIT_FOR_CAB) &&
+                   (ieee80211_is_data(hdr->frame_control) ||
+                    ieee80211_is_action(hdr->frame_control)) &&
+                   is_multicast_ether_addr(hdr->addr1) &&
+                   !ieee80211_has_moredata(hdr->frame_control)) {
                 /*
                  * No more broadcast/multicast frames to be received at this
                  * point.
@@ -1067,709 +1030,6 @@ static void ath9k_rx_skb_postprocess(struct ath_common *common,
                 rxs->flag &= ~RX_FLAG_DECRYPTED;
 }
 
-static void ath_lnaconf_alt_good_scan(struct ath_ant_comb *antcomb,
-                                      struct ath_hw_antcomb_conf ant_conf,
-                                      int main_rssi_avg)
-{
-        antcomb->quick_scan_cnt = 0;
-
-        if (ant_conf.main_lna_conf == ATH_ANT_DIV_COMB_LNA2)
-                antcomb->rssi_lna2 = main_rssi_avg;
-        else if (ant_conf.main_lna_conf == ATH_ANT_DIV_COMB_LNA1)
-                antcomb->rssi_lna1 = main_rssi_avg;
-
-        switch ((ant_conf.main_lna_conf << 4) | ant_conf.alt_lna_conf) {
-        case 0x10: /* LNA2 A-B */
-                antcomb->main_conf = ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
-                antcomb->first_quick_scan_conf =
-                        ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
-                antcomb->second_quick_scan_conf = ATH_ANT_DIV_COMB_LNA1;
-                break;
-        case 0x20: /* LNA1 A-B */
-                antcomb->main_conf = ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
-                antcomb->first_quick_scan_conf =
-                        ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
-                antcomb->second_quick_scan_conf = ATH_ANT_DIV_COMB_LNA2;
-                break;
-        case 0x21: /* LNA1 LNA2 */
-                antcomb->main_conf = ATH_ANT_DIV_COMB_LNA2;
-                antcomb->first_quick_scan_conf =
-                        ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
-                antcomb->second_quick_scan_conf =
-                        ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
-                break;
-        case 0x12: /* LNA2 LNA1 */
-                antcomb->main_conf = ATH_ANT_DIV_COMB_LNA1;
-                antcomb->first_quick_scan_conf =
-                        ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
-                antcomb->second_quick_scan_conf =
-                        ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
-                break;
-        case 0x13: /* LNA2 A+B */
-                antcomb->main_conf = ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
-                antcomb->first_quick_scan_conf =
-                        ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
-                antcomb->second_quick_scan_conf = ATH_ANT_DIV_COMB_LNA1;
-                break;
-        case 0x23: /* LNA1 A+B */
-                antcomb->main_conf = ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
-                antcomb->first_quick_scan_conf =
-                        ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
-                antcomb->second_quick_scan_conf = ATH_ANT_DIV_COMB_LNA2;
-                break;
-        default:
-                break;
-        }
-}
-
-static void ath_select_ant_div_from_quick_scan(struct ath_ant_comb *antcomb,
-                                struct ath_hw_antcomb_conf *div_ant_conf,
-                                int main_rssi_avg, int alt_rssi_avg,
-                                int alt_ratio)
-{
-        /* alt_good */
-        switch (antcomb->quick_scan_cnt) {
-        case 0:
-                /* set alt to main, and alt to first conf */
-                div_ant_conf->main_lna_conf = antcomb->main_conf;
-                div_ant_conf->alt_lna_conf = antcomb->first_quick_scan_conf;
-                break;
-        case 1:
-                /* set alt to main, and alt to first conf */
-                div_ant_conf->main_lna_conf = antcomb->main_conf;
-                div_ant_conf->alt_lna_conf = antcomb->second_quick_scan_conf;
-                antcomb->rssi_first = main_rssi_avg;
-                antcomb->rssi_second = alt_rssi_avg;
-
-                if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA1) {
-                        /* main is LNA1 */
-                        if (ath_is_alt_ant_ratio_better(alt_ratio,
-                                                ATH_ANT_DIV_COMB_LNA1_DELTA_HI,
-                                                ATH_ANT_DIV_COMB_LNA1_DELTA_LOW,
-                                                main_rssi_avg, alt_rssi_avg,
-                                                antcomb->total_pkt_count))
-                                antcomb->first_ratio = true;
-                        else
-                                antcomb->first_ratio = false;
-                } else if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA2) {
-                        if (ath_is_alt_ant_ratio_better(alt_ratio,
-                                                ATH_ANT_DIV_COMB_LNA1_DELTA_MID,
-                                                ATH_ANT_DIV_COMB_LNA1_DELTA_LOW,
-                                                main_rssi_avg, alt_rssi_avg,
-                                                antcomb->total_pkt_count))
-                                antcomb->first_ratio = true;
-                        else
-                                antcomb->first_ratio = false;
-                } else {
-                        if ((((alt_ratio >= ATH_ANT_DIV_COMB_ALT_ANT_RATIO2) &&
-                            (alt_rssi_avg > main_rssi_avg +
-                            ATH_ANT_DIV_COMB_LNA1_DELTA_HI)) ||
-                            (alt_rssi_avg > main_rssi_avg)) &&
-                            (antcomb->total_pkt_count > 50))
-                                antcomb->first_ratio = true;
-                        else
-                                antcomb->first_ratio = false;
-                }
-                break;
-        case 2:
-                antcomb->alt_good = false;
-                antcomb->scan_not_start = false;
-                antcomb->scan = false;
-                antcomb->rssi_first = main_rssi_avg;
-                antcomb->rssi_third = alt_rssi_avg;
-
-                if (antcomb->second_quick_scan_conf == ATH_ANT_DIV_COMB_LNA1)
-                        antcomb->rssi_lna1 = alt_rssi_avg;
-                else if (antcomb->second_quick_scan_conf ==
-                         ATH_ANT_DIV_COMB_LNA2)
-                        antcomb->rssi_lna2 = alt_rssi_avg;
-                else if (antcomb->second_quick_scan_conf ==
-                         ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2) {
-                        if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA2)
-                                antcomb->rssi_lna2 = main_rssi_avg;
-                        else if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA1)
-                                antcomb->rssi_lna1 = main_rssi_avg;
-                }
-
-                if (antcomb->rssi_lna2 > antcomb->rssi_lna1 +
-                    ATH_ANT_DIV_COMB_LNA1_LNA2_SWITCH_DELTA)
-                        div_ant_conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA2;
-                else
-                        div_ant_conf->main_lna_conf = ATH_ANT_DIV_COMB_LNA1;
-
-                if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA1) {
-                        if (ath_is_alt_ant_ratio_better(alt_ratio,
-                                                ATH_ANT_DIV_COMB_LNA1_DELTA_HI,
-                                                ATH_ANT_DIV_COMB_LNA1_DELTA_LOW,
-                                                main_rssi_avg, alt_rssi_avg,
-                                                antcomb->total_pkt_count))
-                                antcomb->second_ratio = true;
-                        else
-                                antcomb->second_ratio = false;
-                } else if (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA2) {
-                        if (ath_is_alt_ant_ratio_better(alt_ratio,
-                                                ATH_ANT_DIV_COMB_LNA1_DELTA_MID,
-                                                ATH_ANT_DIV_COMB_LNA1_DELTA_LOW,
-                                                main_rssi_avg, alt_rssi_avg,
-                                                antcomb->total_pkt_count))
-                                antcomb->second_ratio = true;
-                        else
-                                antcomb->second_ratio = false;
-                } else {
-                        if ((((alt_ratio >= ATH_ANT_DIV_COMB_ALT_ANT_RATIO2) &&
-                            (alt_rssi_avg > main_rssi_avg +
-                            ATH_ANT_DIV_COMB_LNA1_DELTA_HI)) ||
-                            (alt_rssi_avg > main_rssi_avg)) &&
-                            (antcomb->total_pkt_count > 50))
-                                antcomb->second_ratio = true;
-                        else
-                                antcomb->second_ratio = false;
-                }
-
-                /* set alt to the conf with maximun ratio */
-                if (antcomb->first_ratio && antcomb->second_ratio) {
-                        if (antcomb->rssi_second > antcomb->rssi_third) {
-                                /* first alt*/
-                                if ((antcomb->first_quick_scan_conf ==
-                                    ATH_ANT_DIV_COMB_LNA1) ||
-                                    (antcomb->first_quick_scan_conf ==
-                                    ATH_ANT_DIV_COMB_LNA2))
-                                        /* Set alt LNA1 or LNA2*/
-                                        if (div_ant_conf->main_lna_conf ==
-                                            ATH_ANT_DIV_COMB_LNA2)
-                                                div_ant_conf->alt_lna_conf =
-                                                        ATH_ANT_DIV_COMB_LNA1;
-                                        else
-                                                div_ant_conf->alt_lna_conf =
-                                                        ATH_ANT_DIV_COMB_LNA2;
-                                else
-                                        /* Set alt to A+B or A-B */
-                                        div_ant_conf->alt_lna_conf =
-                                                antcomb->first_quick_scan_conf;
-                        } else if ((antcomb->second_quick_scan_conf ==
-                                   ATH_ANT_DIV_COMB_LNA1) ||
-                                   (antcomb->second_quick_scan_conf ==
-                                   ATH_ANT_DIV_COMB_LNA2)) {
-                                /* Set alt LNA1 or LNA2 */
-                                if (div_ant_conf->main_lna_conf ==
-                                    ATH_ANT_DIV_COMB_LNA2)
-                                        div_ant_conf->alt_lna_conf =
-                                                ATH_ANT_DIV_COMB_LNA1;
-                                else
-                                        div_ant_conf->alt_lna_conf =
-                                                ATH_ANT_DIV_COMB_LNA2;
-                        } else {
-                                /* Set alt to A+B or A-B */
-                                div_ant_conf->alt_lna_conf =
-                                        antcomb->second_quick_scan_conf;
-                        }
-                } else if (antcomb->first_ratio) {
-                        /* first alt */
-                        if ((antcomb->first_quick_scan_conf ==
-                            ATH_ANT_DIV_COMB_LNA1) ||
-                            (antcomb->first_quick_scan_conf ==
-                            ATH_ANT_DIV_COMB_LNA2))
-                                        /* Set alt LNA1 or LNA2 */
-                                if (div_ant_conf->main_lna_conf ==
-                                    ATH_ANT_DIV_COMB_LNA2)
-                                        div_ant_conf->alt_lna_conf =
-                                                        ATH_ANT_DIV_COMB_LNA1;
-                                else
-                                        div_ant_conf->alt_lna_conf =
-                                                        ATH_ANT_DIV_COMB_LNA2;
-                        else
-                                /* Set alt to A+B or A-B */
-                                div_ant_conf->alt_lna_conf =
-                                                antcomb->first_quick_scan_conf;
-                } else if (antcomb->second_ratio) {
-                                /* second alt */
-                        if ((antcomb->second_quick_scan_conf ==
-                            ATH_ANT_DIV_COMB_LNA1) ||
-                            (antcomb->second_quick_scan_conf ==
-                            ATH_ANT_DIV_COMB_LNA2))
-                                /* Set alt LNA1 or LNA2 */
-                                if (div_ant_conf->main_lna_conf ==
-                                    ATH_ANT_DIV_COMB_LNA2)
-                                        div_ant_conf->alt_lna_conf =
-                                                ATH_ANT_DIV_COMB_LNA1;
-                                else
-                                        div_ant_conf->alt_lna_conf =
-                                                ATH_ANT_DIV_COMB_LNA2;
-                        else
-                                /* Set alt to A+B or A-B */
-                                div_ant_conf->alt_lna_conf =
-                                                antcomb->second_quick_scan_conf;
-                } else {
-                        /* main is largest */
-                        if ((antcomb->main_conf == ATH_ANT_DIV_COMB_LNA1) ||
-                            (antcomb->main_conf == ATH_ANT_DIV_COMB_LNA2))
-                                /* Set alt LNA1 or LNA2 */
-                                if (div_ant_conf->main_lna_conf ==
-                                    ATH_ANT_DIV_COMB_LNA2)
-                                        div_ant_conf->alt_lna_conf =
-                                                        ATH_ANT_DIV_COMB_LNA1;
-                                else
-                                        div_ant_conf->alt_lna_conf =
-                                                        ATH_ANT_DIV_COMB_LNA2;
-                        else
-                                /* Set alt to A+B or A-B */
-                                div_ant_conf->alt_lna_conf = antcomb->main_conf;
-                }
-                break;
-        default:
-                break;
-        }
-}
-
-static void ath_ant_div_conf_fast_divbias(struct ath_hw_antcomb_conf *ant_conf,
-                struct ath_ant_comb *antcomb, int alt_ratio)
-{
-        if (ant_conf->div_group == 0) {
-                /* Adjust the fast_div_bias based on main and alt lna conf */
-                switch ((ant_conf->main_lna_conf << 4) |
-                                ant_conf->alt_lna_conf) {
-                case 0x01: /* A-B LNA2 */
-                        ant_conf->fast_div_bias = 0x3b;
-                        break;
-                case 0x02: /* A-B LNA1 */
-                        ant_conf->fast_div_bias = 0x3d;
-                        break;
-                case 0x03: /* A-B A+B */
-                        ant_conf->fast_div_bias = 0x1;
-                        break;
-                case 0x10: /* LNA2 A-B */
-                        ant_conf->fast_div_bias = 0x7;
-                        break;
-                case 0x12: /* LNA2 LNA1 */
-                        ant_conf->fast_div_bias = 0x2;
-                        break;
-                case 0x13: /* LNA2 A+B */
-                        ant_conf->fast_div_bias = 0x7;
-                        break;
-                case 0x20: /* LNA1 A-B */
-                        ant_conf->fast_div_bias = 0x6;
-                        break;
-                case 0x21: /* LNA1 LNA2 */
-                        ant_conf->fast_div_bias = 0x0;
-                        break;
-                case 0x23: /* LNA1 A+B */
-                        ant_conf->fast_div_bias = 0x6;
-                        break;
-                case 0x30: /* A+B A-B */
-                        ant_conf->fast_div_bias = 0x1;
-                        break;
-                case 0x31: /* A+B LNA2 */
-                        ant_conf->fast_div_bias = 0x3b;
-                        break;
-                case 0x32: /* A+B LNA1 */
-                        ant_conf->fast_div_bias = 0x3d;
-                        break;
-                default:
-                        break;
-                }
-        } else if (ant_conf->div_group == 1) {
-                /* Adjust the fast_div_bias based on main and alt_lna_conf */
-                switch ((ant_conf->main_lna_conf << 4) |
-                        ant_conf->alt_lna_conf) {
-                case 0x01: /* A-B LNA2 */
-                        ant_conf->fast_div_bias = 0x1;
-                        ant_conf->main_gaintb = 0;
-                        ant_conf->alt_gaintb = 0;
-                        break;
-                case 0x02: /* A-B LNA1 */
-                        ant_conf->fast_div_bias = 0x1;
-                        ant_conf->main_gaintb = 0;
-                        ant_conf->alt_gaintb = 0;
-                        break;
-                case 0x03: /* A-B A+B */
-                        ant_conf->fast_div_bias = 0x1;
-                        ant_conf->main_gaintb = 0;
-                        ant_conf->alt_gaintb = 0;
-                        break;
-                case 0x10: /* LNA2 A-B */
-                        if (!(antcomb->scan) &&
-                            (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO))
-                                ant_conf->fast_div_bias = 0x3f;
-                        else
-                                ant_conf->fast_div_bias = 0x1;
-                        ant_conf->main_gaintb = 0;
-                        ant_conf->alt_gaintb = 0;
-                        break;
-                case 0x12: /* LNA2 LNA1 */
-                        ant_conf->fast_div_bias = 0x1;
-                        ant_conf->main_gaintb = 0;
-                        ant_conf->alt_gaintb = 0;
-                        break;
-                case 0x13: /* LNA2 A+B */
-                        if (!(antcomb->scan) &&
-                            (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO))
-                                ant_conf->fast_div_bias = 0x3f;
-                        else
-                                ant_conf->fast_div_bias = 0x1;
-                        ant_conf->main_gaintb = 0;
-                        ant_conf->alt_gaintb = 0;
-                        break;
-                case 0x20: /* LNA1 A-B */
-                        if (!(antcomb->scan) &&
-                            (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO))
-                                ant_conf->fast_div_bias = 0x3f;
-                        else
-                                ant_conf->fast_div_bias = 0x1;
-                        ant_conf->main_gaintb = 0;
-                        ant_conf->alt_gaintb = 0;
-                        break;
-                case 0x21: /* LNA1 LNA2 */
-                        ant_conf->fast_div_bias = 0x1;
-                        ant_conf->main_gaintb = 0;
-                        ant_conf->alt_gaintb = 0;
-                        break;
-                case 0x23: /* LNA1 A+B */
-                        if (!(antcomb->scan) &&
-                            (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO))
-                                ant_conf->fast_div_bias = 0x3f;
-                        else
-                                ant_conf->fast_div_bias = 0x1;
-                        ant_conf->main_gaintb = 0;
-                        ant_conf->alt_gaintb = 0;
-                        break;
-                case 0x30: /* A+B A-B */
-                        ant_conf->fast_div_bias = 0x1;
-                        ant_conf->main_gaintb = 0;
-                        ant_conf->alt_gaintb = 0;
-                        break;
-                case 0x31: /* A+B LNA2 */
-                        ant_conf->fast_div_bias = 0x1;
-                        ant_conf->main_gaintb = 0;
-                        ant_conf->alt_gaintb = 0;
-                        break;
-                case 0x32: /* A+B LNA1 */
-                        ant_conf->fast_div_bias = 0x1;
-                        ant_conf->main_gaintb = 0;
-                        ant_conf->alt_gaintb = 0;
-                        break;
-                default:
-                        break;
-                }
-        } else if (ant_conf->div_group == 2) {
-                /* Adjust the fast_div_bias based on main and alt_lna_conf */
-                switch ((ant_conf->main_lna_conf << 4) |
-                                ant_conf->alt_lna_conf) {
-                case 0x01: /* A-B LNA2 */
-                        ant_conf->fast_div_bias = 0x1;
-                        ant_conf->main_gaintb = 0;
-                        ant_conf->alt_gaintb = 0;
-                        break;
-                case 0x02: /* A-B LNA1 */
-                        ant_conf->fast_div_bias = 0x1;
-                        ant_conf->main_gaintb = 0;
-                        ant_conf->alt_gaintb = 0;
-                        break;
-                case 0x03: /* A-B A+B */
-                        ant_conf->fast_div_bias = 0x1;
-                        ant_conf->main_gaintb = 0;
-                        ant_conf->alt_gaintb = 0;
-                        break;
-                case 0x10: /* LNA2 A-B */
-                        if (!(antcomb->scan) &&
-                                (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO))
-                                ant_conf->fast_div_bias = 0x1;
-                        else
-                                ant_conf->fast_div_bias = 0x2;
-                        ant_conf->main_gaintb = 0;
-                        ant_conf->alt_gaintb = 0;
-                        break;
-                case 0x12: /* LNA2 LNA1 */
-                        ant_conf->fast_div_bias = 0x1;
-                        ant_conf->main_gaintb = 0;
-                        ant_conf->alt_gaintb = 0;
-                        break;
-                case 0x13: /* LNA2 A+B */
-                        if (!(antcomb->scan) &&
-                                (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO))
-                                ant_conf->fast_div_bias = 0x1;
-                        else
-                                ant_conf->fast_div_bias = 0x2;
-                        ant_conf->main_gaintb = 0;
-                        ant_conf->alt_gaintb = 0;
-                        break;
-                case 0x20: /* LNA1 A-B */
-                        if (!(antcomb->scan) &&
-                                (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO))
-                                ant_conf->fast_div_bias = 0x1;
-                        else
-                                ant_conf->fast_div_bias = 0x2;
-                        ant_conf->main_gaintb = 0;
-                        ant_conf->alt_gaintb = 0;
-                        break;
-                case 0x21: /* LNA1 LNA2 */
-                        ant_conf->fast_div_bias = 0x1;
-                        ant_conf->main_gaintb = 0;
-                        ant_conf->alt_gaintb = 0;
-                        break;
-                case 0x23: /* LNA1 A+B */
-                        if (!(antcomb->scan) &&
-                                (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO))
-                                ant_conf->fast_div_bias = 0x1;
-                        else
-                                ant_conf->fast_div_bias = 0x2;
-                        ant_conf->main_gaintb = 0;
-                        ant_conf->alt_gaintb = 0;
-                        break;
-                case 0x30: /* A+B A-B */
-                        ant_conf->fast_div_bias = 0x1;
-                        ant_conf->main_gaintb = 0;
-                        ant_conf->alt_gaintb = 0;
-                        break;
-                case 0x31: /* A+B LNA2 */
-                        ant_conf->fast_div_bias = 0x1;
-                        ant_conf->main_gaintb = 0;
-                        ant_conf->alt_gaintb = 0;
-                        break;
-                case 0x32: /* A+B LNA1 */
-                        ant_conf->fast_div_bias = 0x1;
-                        ant_conf->main_gaintb = 0;
-                        ant_conf->alt_gaintb = 0;
-                        break;
-                default:
-                        break;
-                }
-        }
-}
-
-/* Antenna diversity and combining */
-static void ath_ant_comb_scan(struct ath_softc *sc, struct ath_rx_status *rs)
-{
-        struct ath_hw_antcomb_conf div_ant_conf;
-        struct ath_ant_comb *antcomb = &sc->ant_comb;
-        int alt_ratio = 0, alt_rssi_avg = 0, main_rssi_avg = 0, curr_alt_set;
-        int curr_main_set;
-        int main_rssi = rs->rs_rssi_ctl0;
-        int alt_rssi = rs->rs_rssi_ctl1;
-        int rx_ant_conf,  main_ant_conf;
-        bool short_scan = false;
-
-        rx_ant_conf = (rs->rs_rssi_ctl2 >> ATH_ANT_RX_CURRENT_SHIFT) &
-                       ATH_ANT_RX_MASK;
-        main_ant_conf = (rs->rs_rssi_ctl2 >> ATH_ANT_RX_MAIN_SHIFT) &
-                         ATH_ANT_RX_MASK;
-
-        /* Record packet only when both main_rssi and  alt_rssi is positive */
-        if (main_rssi > 0 && alt_rssi > 0) {
-                antcomb->total_pkt_count++;
-                antcomb->main_total_rssi += main_rssi;
-                antcomb->alt_total_rssi  += alt_rssi;
-                if (main_ant_conf == rx_ant_conf)
-                        antcomb->main_recv_cnt++;
-                else
-                        antcomb->alt_recv_cnt++;
-        }
-
-        /* Short scan check */
-        if (antcomb->scan && antcomb->alt_good) {
-                if (time_after(jiffies, antcomb->scan_start_time +
-                    msecs_to_jiffies(ATH_ANT_DIV_COMB_SHORT_SCAN_INTR)))
-                        short_scan = true;
-                else
-                        if (antcomb->total_pkt_count ==
-                            ATH_ANT_DIV_COMB_SHORT_SCAN_PKTCOUNT) {
-                                alt_ratio = ((antcomb->alt_recv_cnt * 100) /
-                                            antcomb->total_pkt_count);
-                                if (alt_ratio < ATH_ANT_DIV_COMB_ALT_ANT_RATIO)
-                                        short_scan = true;
-                        }
-        }
-
-        if (((antcomb->total_pkt_count < ATH_ANT_DIV_COMB_MAX_PKTCOUNT) ||
-            rs->rs_moreaggr) && !short_scan)
-                return;
-
-        if (antcomb->total_pkt_count) {
-                alt_ratio = ((antcomb->alt_recv_cnt * 100) /
-                             antcomb->total_pkt_count);
-                main_rssi_avg = (antcomb->main_total_rssi /
-                                 antcomb->total_pkt_count);
-                alt_rssi_avg = (antcomb->alt_total_rssi /
-                                 antcomb->total_pkt_count);
-        }
-
-
-        ath9k_hw_antdiv_comb_conf_get(sc->sc_ah, &div_ant_conf);
-        curr_alt_set = div_ant_conf.alt_lna_conf;
-        curr_main_set = div_ant_conf.main_lna_conf;
-
-        antcomb->count++;
-
-        if (antcomb->count == ATH_ANT_DIV_COMB_MAX_COUNT) {
-                if (alt_ratio > ATH_ANT_DIV_COMB_ALT_ANT_RATIO) {
-                        ath_lnaconf_alt_good_scan(antcomb, div_ant_conf,
-                                                  main_rssi_avg);
-                        antcomb->alt_good = true;
-                } else {
-                        antcomb->alt_good = false;
-                }
-
-                antcomb->count = 0;
-                antcomb->scan = true;
-                antcomb->scan_not_start = true;
-        }
-
-        if (!antcomb->scan) {
-                if (ath_ant_div_comb_alt_check(div_ant_conf.div_group,
-                                        alt_ratio, curr_main_set, curr_alt_set,
-                                        alt_rssi_avg, main_rssi_avg)) {
-                        if (curr_alt_set == ATH_ANT_DIV_COMB_LNA2) {
-                                /* Switch main and alt LNA */
-                                div_ant_conf.main_lna_conf =
-                                                ATH_ANT_DIV_COMB_LNA2;
-                                div_ant_conf.alt_lna_conf  =
-                                                ATH_ANT_DIV_COMB_LNA1;
-                        } else if (curr_alt_set == ATH_ANT_DIV_COMB_LNA1) {
-                                div_ant_conf.main_lna_conf =
-                                                ATH_ANT_DIV_COMB_LNA1;
-                                div_ant_conf.alt_lna_conf  =
-                                                ATH_ANT_DIV_COMB_LNA2;
-                        }
-
-                        goto div_comb_done;
-                } else if ((curr_alt_set != ATH_ANT_DIV_COMB_LNA1) &&
-                           (curr_alt_set != ATH_ANT_DIV_COMB_LNA2)) {
-                        /* Set alt to another LNA */
-                        if (curr_main_set == ATH_ANT_DIV_COMB_LNA2)
-                                div_ant_conf.alt_lna_conf =
-                                                ATH_ANT_DIV_COMB_LNA1;
-                        else if (curr_main_set == ATH_ANT_DIV_COMB_LNA1)
-                                div_ant_conf.alt_lna_conf =
-                                                ATH_ANT_DIV_COMB_LNA2;
-
-                        goto div_comb_done;
-                }
-
-                if ((alt_rssi_avg < (main_rssi_avg +
-                                                div_ant_conf.lna1_lna2_delta)))
-                        goto div_comb_done;
-        }
-
-        if (!antcomb->scan_not_start) {
-                switch (curr_alt_set) {
-                case ATH_ANT_DIV_COMB_LNA2:
-                        antcomb->rssi_lna2 = alt_rssi_avg;
-                        antcomb->rssi_lna1 = main_rssi_avg;
-                        antcomb->scan = true;
-                        /* set to A+B */
-                        div_ant_conf.main_lna_conf =
-                                ATH_ANT_DIV_COMB_LNA1;
-                        div_ant_conf.alt_lna_conf  =
-                                ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
-                        break;
-                case ATH_ANT_DIV_COMB_LNA1:
-                        antcomb->rssi_lna1 = alt_rssi_avg;
-                        antcomb->rssi_lna2 = main_rssi_avg;
-                        antcomb->scan = true;
-                        /* set to A+B */
-                        div_ant_conf.main_lna_conf = ATH_ANT_DIV_COMB_LNA2;
-                        div_ant_conf.alt_lna_conf  =
-                                ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
-                        break;
-                case ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2:
-                        antcomb->rssi_add = alt_rssi_avg;
-                        antcomb->scan = true;
-                        /* set to A-B */
-                        div_ant_conf.alt_lna_conf =
-                                ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
-                        break;
-                case ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2:
-                        antcomb->rssi_sub = alt_rssi_avg;
-                        antcomb->scan = false;
-                        if (antcomb->rssi_lna2 >
-                            (antcomb->rssi_lna1 +
-                            ATH_ANT_DIV_COMB_LNA1_LNA2_SWITCH_DELTA)) {
-                                /* use LNA2 as main LNA */
-                                if ((antcomb->rssi_add > antcomb->rssi_lna1) &&
-                                    (antcomb->rssi_add > antcomb->rssi_sub)) {
-                                        /* set to A+B */
-                                        div_ant_conf.main_lna_conf =
-                                                ATH_ANT_DIV_COMB_LNA2;
-                                        div_ant_conf.alt_lna_conf  =
-                                                ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
-                                } else if (antcomb->rssi_sub >
-                                           antcomb->rssi_lna1) {
-                                        /* set to A-B */
-                                        div_ant_conf.main_lna_conf =
-                                                ATH_ANT_DIV_COMB_LNA2;
-                                        div_ant_conf.alt_lna_conf =
-                                                ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
-                                } else {
-                                        /* set to LNA1 */
-                                        div_ant_conf.main_lna_conf =
-                                                ATH_ANT_DIV_COMB_LNA2;
-                                        div_ant_conf.alt_lna_conf =
-                                                ATH_ANT_DIV_COMB_LNA1;
-                                }
-                        } else {
-                                /* use LNA1 as main LNA */
-                                if ((antcomb->rssi_add > antcomb->rssi_lna2) &&
-                                    (antcomb->rssi_add > antcomb->rssi_sub)) {
-                                        /* set to A+B */
-                                        div_ant_conf.main_lna_conf =
-                                                ATH_ANT_DIV_COMB_LNA1;
-                                        div_ant_conf.alt_lna_conf  =
-                                                ATH_ANT_DIV_COMB_LNA1_PLUS_LNA2;
-                                } else if (antcomb->rssi_sub >
-                                           antcomb->rssi_lna1) {
-                                        /* set to A-B */
-                                        div_ant_conf.main_lna_conf =
-                                                ATH_ANT_DIV_COMB_LNA1;
-                                        div_ant_conf.alt_lna_conf =
-                                                ATH_ANT_DIV_COMB_LNA1_MINUS_LNA2;
-                                } else {
-                                        /* set to LNA2 */
-                                        div_ant_conf.main_lna_conf =
-                                                ATH_ANT_DIV_COMB_LNA1;
-                                        div_ant_conf.alt_lna_conf =
-                                                ATH_ANT_DIV_COMB_LNA2;
-                                }
-                        }
-                        break;
-                default:
-                        break;
-                }
-        } else {
-                if (!antcomb->alt_good) {
-                        antcomb->scan_not_start = false;
-                        /* Set alt to another LNA */
-                        if (curr_main_set == ATH_ANT_DIV_COMB_LNA2) {
-                                div_ant_conf.main_lna_conf =
-                                                ATH_ANT_DIV_COMB_LNA2;
-                                div_ant_conf.alt_lna_conf =
-                                                ATH_ANT_DIV_COMB_LNA1;
-                        } else if (curr_main_set == ATH_ANT_DIV_COMB_LNA1) {
-                                div_ant_conf.main_lna_conf =
-                                                ATH_ANT_DIV_COMB_LNA1;
-                                div_ant_conf.alt_lna_conf =
-                                                ATH_ANT_DIV_COMB_LNA2;
-                        }
-                        goto div_comb_done;
-                }
-        }
-
-        ath_select_ant_div_from_quick_scan(antcomb, &div_ant_conf,
-                                           main_rssi_avg, alt_rssi_avg,
-                                           alt_ratio);
-
-        antcomb->quick_scan_cnt++;
-
-div_comb_done:
-        ath_ant_div_conf_fast_divbias(&div_ant_conf, antcomb, alt_ratio);
-        ath9k_hw_antdiv_comb_conf_set(sc->sc_ah, &div_ant_conf);
-
-        antcomb->scan_start_time = jiffies;
-        antcomb->total_pkt_count = 0;
-        antcomb->main_total_rssi = 0;
-        antcomb->alt_total_rssi = 0;
-        antcomb->main_recv_cnt = 0;
-        antcomb->alt_recv_cnt = 0;
-}
-
 int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
 {
         struct ath_buf *bf;
@@ -1803,7 +1063,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
 
         do {
                 /* If handling rx interrupt and flush is in progress => exit */
-                if ((sc->sc_flags & SC_OP_RXFLUSH) && (flush == 0))
+                if (test_bit(SC_OP_RXFLUSH, &sc->sc_flags) && (flush == 0))
                         break;
 
                 memset(&rs, 0, sizeof(rs));
@@ -1841,13 +1101,14 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                 else
                         rs.is_mybeacon = false;
 
+                sc->rx.num_pkts++;
                 ath_debug_stat_rx(sc, &rs);
 
                 /*
                  * If we're asked to flush receive queue, directly
                  * chain it back at the queue without processing it.
                  */
-                if (sc->sc_flags & SC_OP_RXFLUSH) {
+                if (test_bit(SC_OP_RXFLUSH, &sc->sc_flags)) {
                         RX_STAT_INC(rx_drop_rxflush);
                         goto requeue_drop_frag;
                 }
@@ -1968,7 +1229,6 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                         skb_trim(skb, skb->len - 8);
 
                 spin_lock_irqsave(&sc->sc_pm_lock, flags);
-
                 if ((sc->ps_flags & (PS_WAIT_FOR_BEACON |
                                      PS_WAIT_FOR_CAB |
                                      PS_WAIT_FOR_PSPOLL_DATA)) ||
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index 458f81b4a7cb..75acefbd4937 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -2098,8 +2098,8 @@ enum {
 #define AR_MCI_CONT_STATUS                      0x1848
 #define AR_MCI_CONT_RSSI_POWER                  0x000000FF
 #define AR_MCI_CONT_RSSI_POWER_S                0
-#define AR_MCI_CONT_RRIORITY                    0x0000FF00
-#define AR_MCI_CONT_RRIORITY_S                  8
+#define AR_MCI_CONT_PRIORITY                    0x0000FF00
+#define AR_MCI_CONT_PRIORITY_S                  8
 #define AR_MCI_CONT_TXRX                        0x00010000
 #define AR_MCI_CONT_TXRX_S                      16
 
@@ -2211,5 +2211,7 @@ enum {
 #define AR_BTCOEX_CTRL3_CONT_INFO_TIMEOUT       0x00000fff
 #define AR_BTCOEX_CTRL3_CONT_INFO_TIMEOUT_S     0
 
+#define AR_GLB_SWREG_DISCONT_MODE         0x2002c
+#define AR_GLB_SWREG_DISCONT_EN_BT_WLAN   0x3
 
 #endif
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index d59dd01d6cde..f777ddcd1172 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -105,19 +105,19 @@ static int ath_max_4ms_framelen[4][32] = {
 /* Aggregation logic */
 /*********************/
 
-static void ath_txq_lock(struct ath_softc *sc, struct ath_txq *txq)
+void ath_txq_lock(struct ath_softc *sc, struct ath_txq *txq)
         __acquires(&txq->axq_lock)
 {
         spin_lock_bh(&txq->axq_lock);
 }
 
-static void ath_txq_unlock(struct ath_softc *sc, struct ath_txq *txq)
+void ath_txq_unlock(struct ath_softc *sc, struct ath_txq *txq)
         __releases(&txq->axq_lock)
 {
         spin_unlock_bh(&txq->axq_lock);
 }
 
-static void ath_txq_unlock_complete(struct ath_softc *sc, struct ath_txq *txq)
+void ath_txq_unlock_complete(struct ath_softc *sc, struct ath_txq *txq)
         __releases(&txq->axq_lock)
 {
         struct sk_buff_head q;
@@ -1536,7 +1536,7 @@ bool ath_drain_all_txq(struct ath_softc *sc, bool retry_tx)
         int i;
         u32 npend = 0;
 
-        if (sc->sc_flags & SC_OP_INVALID)
+        if (test_bit(SC_OP_INVALID, &sc->sc_flags))
                 return true;
 
         ath9k_hw_abort_tx_dma(ah);
@@ -1994,6 +1994,7 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ieee80211_hdr * hdr = (struct ieee80211_hdr *)skb->data;
         int q, padpos, padsize;
+        unsigned long flags;
 
         ath_dbg(common, XMIT, "TX complete: skb: %p\n", skb);
 
@@ -2012,6 +2013,7 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
                 skb_pull(skb, padsize);
         }
 
+        spin_lock_irqsave(&sc->sc_pm_lock, flags);
         if ((sc->ps_flags & PS_WAIT_FOR_TX_ACK) && !txq->axq_depth) {
                 sc->ps_flags &= ~PS_WAIT_FOR_TX_ACK;
                 ath_dbg(common, PS,
@@ -2021,6 +2023,7 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
                                         PS_WAIT_FOR_PSPOLL_DATA |
                                         PS_WAIT_FOR_TX_ACK));
         }
+        spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
 
         q = skb_get_queue_mapping(skb);
         if (txq == sc->tx.txq_map[q]) {
@@ -2231,46 +2234,6 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
         ath_txq_unlock_complete(sc, txq);
 }
 
-static void ath_tx_complete_poll_work(struct work_struct *work)
-{
-        struct ath_softc *sc = container_of(work, struct ath_softc,
-                        tx_complete_work.work);
-        struct ath_txq *txq;
-        int i;
-        bool needreset = false;
-#ifdef CONFIG_ATH9K_DEBUGFS
-        sc->tx_complete_poll_work_seen++;
-#endif
-
-        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
-                if (ATH_TXQ_SETUP(sc, i)) {
-                        txq = &sc->tx.txq[i];
-                        ath_txq_lock(sc, txq);
-                        if (txq->axq_depth) {
-                                if (txq->axq_tx_inprogress) {
-                                        needreset = true;
-                                        ath_txq_unlock(sc, txq);
-                                        break;
-                                } else {
-                                        txq->axq_tx_inprogress = true;
-                                }
-                        }
-                        ath_txq_unlock_complete(sc, txq);
-                }
-
-        if (needreset) {
-                ath_dbg(ath9k_hw_common(sc->sc_ah), RESET,
-                        "tx hung, resetting the chip\n");
-                RESET_STAT_INC(sc, RESET_TYPE_TX_HANG);
-                ieee80211_queue_work(sc->hw, &sc->hw_reset_work);
-        }
-
-        ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work,
-                        msecs_to_jiffies(ATH_TX_COMPLETE_POLL_INT));
-}
-
-
-
 void ath_tx_tasklet(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index cd9c9bc186d9..8b06ca56125e 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -1508,7 +1508,7 @@ static void b43legacy_release_firmware(struct b43legacy_wldev *dev)
 
 static void b43legacy_print_fw_helptext(struct b43legacy_wl *wl)
 {
-        b43legacyerr(wl, "You must go to http://linuxwireless.org/en/users/"
+        b43legacyerr(wl, "You must go to http://wireless.kernel.org/en/users/"
                      "Drivers/b43#devicefirmware "
                      "and download the correct firmware (version 3).\n");
 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/Makefile b/drivers/net/wireless/brcm80211/brcmfmac/Makefile
index abb48032753b..9d5170b6df50 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/Makefile
+++ b/drivers/net/wireless/brcm80211/brcmfmac/Makefile
@@ -34,3 +34,5 @@ brcmfmac-$(CONFIG_BRCMFMAC_SDIO) += \
                 sdio_chip.o
 brcmfmac-$(CONFIG_BRCMFMAC_USB) += \
                 usb.o
+brcmfmac-$(CONFIG_BRCMDBG) += \
+                dhd_dbg.o
\ No newline at end of file
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
index 9f637014486e..a11fe54f5950 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
@@ -613,6 +613,9 @@ struct brcmf_pub {
         struct work_struct multicast_work;
         u8 macvalue[ETH_ALEN];
         atomic_t pend_8021x_cnt;
+#ifdef DEBUG
+        struct dentry *dbgfs_dir;
+#endif
 };
 
 struct brcmf_if_event {
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.c
new file mode 100644
index 000000000000..7f89540b56da
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.c
@@ -0,0 +1,126 @@
+/*
+ * Copyright (c) 2012 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#include <linux/debugfs.h>
+#include <linux/if_ether.h>
+#include <linux/if.h>
+#include <linux/ieee80211.h>
+#include <linux/module.h>
+
+#include <defs.h>
+#include <brcmu_wifi.h>
+#include <brcmu_utils.h>
+#include "dhd.h"
+#include "dhd_bus.h"
+#include "dhd_dbg.h"
+
+static struct dentry *root_folder;
+
+void brcmf_debugfs_init(void)
+{
+        root_folder = debugfs_create_dir(KBUILD_MODNAME, NULL);
+        if (IS_ERR(root_folder))
+                root_folder = NULL;
+}
+
+void brcmf_debugfs_exit(void)
+{
+        if (!root_folder)
+                return;
+
+        debugfs_remove_recursive(root_folder);
+        root_folder = NULL;
+}
+
+int brcmf_debugfs_attach(struct brcmf_pub *drvr)
+{
+        if (!root_folder)
+                return -ENODEV;
+
+        drvr->dbgfs_dir = debugfs_create_dir(dev_name(drvr->dev), root_folder);
+        return PTR_RET(drvr->dbgfs_dir);
+}
+
+void brcmf_debugfs_detach(struct brcmf_pub *drvr)
+{
+        if (!IS_ERR_OR_NULL(drvr->dbgfs_dir))
+                debugfs_remove_recursive(drvr->dbgfs_dir);
+}
+
+struct dentry *brcmf_debugfs_get_devdir(struct brcmf_pub *drvr)
+{
+        return drvr->dbgfs_dir;
+}
+
+static
+ssize_t brcmf_debugfs_sdio_counter_read(struct file *f, char __user *data,
+                                        size_t count, loff_t *ppos)
+{
+        struct brcmf_sdio_count *sdcnt = f->private_data;
+        char buf[750];
+        int res;
+
+        /* only allow read from start */
+        if (*ppos > 0)
+                return 0;
+
+        res = scnprintf(buf, sizeof(buf),
+                        "intrcount:    %u\nlastintrs:    %u\n"
+                        "pollcnt:      %u\nregfails:     %u\n"
+                        "tx_sderrs:    %u\nfcqueued:     %u\n"
+                        "rxrtx:        %u\nrx_toolong:   %u\n"
+                        "rxc_errors:   %u\nrx_hdrfail:   %u\n"
+                        "rx_badhdr:    %u\nrx_badseq:    %u\n"
+                        "fc_rcvd:      %u\nfc_xoff:      %u\n"
+                        "fc_xon:       %u\nrxglomfail:   %u\n"
+                        "rxglomframes: %u\nrxglompkts:   %u\n"
+                        "f2rxhdrs:     %u\nf2rxdata:     %u\n"
+                        "f2txdata:     %u\nf1regdata:    %u\n"
+                        "tickcnt:      %u\ntx_ctlerrs:   %lu\n"
+                        "tx_ctlpkts:   %lu\nrx_ctlerrs:   %lu\n"
+                        "rx_ctlpkts:   %lu\nrx_readahead: %lu\n",
+                        sdcnt->intrcount, sdcnt->lastintrs,
+                        sdcnt->pollcnt, sdcnt->regfails,
+                        sdcnt->tx_sderrs, sdcnt->fcqueued,
+                        sdcnt->rxrtx, sdcnt->rx_toolong,
+                        sdcnt->rxc_errors, sdcnt->rx_hdrfail,
+                        sdcnt->rx_badhdr, sdcnt->rx_badseq,
+                        sdcnt->fc_rcvd, sdcnt->fc_xoff,
+                        sdcnt->fc_xon, sdcnt->rxglomfail,
+                        sdcnt->rxglomframes, sdcnt->rxglompkts,
+                        sdcnt->f2rxhdrs, sdcnt->f2rxdata,
+                        sdcnt->f2txdata, sdcnt->f1regdata,
+                        sdcnt->tickcnt, sdcnt->tx_ctlerrs,
+                        sdcnt->tx_ctlpkts, sdcnt->rx_ctlerrs,
+                        sdcnt->rx_ctlpkts, sdcnt->rx_readahead_cnt);
+
+        return simple_read_from_buffer(data, count, ppos, buf, res);
+}
+
+static const struct file_operations brcmf_debugfs_sdio_counter_ops = {
+        .owner = THIS_MODULE,
+        .open = simple_open,
+        .read = brcmf_debugfs_sdio_counter_read
+};
+
+void brcmf_debugfs_create_sdio_count(struct brcmf_pub *drvr,
+                                     struct brcmf_sdio_count *sdcnt)
+{
+        struct dentry *dentry = drvr->dbgfs_dir;
+
+        if (!IS_ERR_OR_NULL(dentry))
+                debugfs_create_file("counters", S_IRUGO, dentry,
+                                    sdcnt, &brcmf_debugfs_sdio_counter_ops);
+}
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h
index a2c4576cf9ff..b784920532d3 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h
@@ -76,4 +76,63 @@ do {									\
 
 extern int brcmf_msg_level;
 
+/*
+ * hold counter variables used in brcmfmac sdio driver.
+ */
+struct brcmf_sdio_count {
+        uint intrcount;         /* Count of device interrupt callbacks */
+        uint lastintrs;         /* Count as of last watchdog timer */
+        uint pollcnt;           /* Count of active polls */
+        uint regfails;          /* Count of R_REG failures */
+        uint tx_sderrs;         /* Count of tx attempts with sd errors */
+        uint fcqueued;          /* Tx packets that got queued */
+        uint rxrtx;             /* Count of rtx requests (NAK to dongle) */
+        uint rx_toolong;        /* Receive frames too long to receive */
+        uint rxc_errors;        /* SDIO errors when reading control frames */
+        uint rx_hdrfail;        /* SDIO errors on header reads */
+        uint rx_badhdr;         /* Bad received headers (roosync?) */
+        uint rx_badseq;         /* Mismatched rx sequence number */
+        uint fc_rcvd;           /* Number of flow-control events received */
+        uint fc_xoff;           /* Number which turned on flow-control */
+        uint fc_xon;            /* Number which turned off flow-control */
+        uint rxglomfail;        /* Failed deglom attempts */
+        uint rxglomframes;      /* Number of glom frames (superframes) */
+        uint rxglompkts;        /* Number of packets from glom frames */
+        uint f2rxhdrs;          /* Number of header reads */
+        uint f2rxdata;          /* Number of frame data reads */
+        uint f2txdata;          /* Number of f2 frame writes */
+        uint f1regdata;         /* Number of f1 register accesses */
+        uint tickcnt;           /* Number of watchdog been schedule */
+        ulong tx_ctlerrs;       /* Err of sending ctrl frames */
+        ulong tx_ctlpkts;       /* Ctrl frames sent to dongle */
+        ulong rx_ctlerrs;       /* Err of processing rx ctrl frames */
+        ulong rx_ctlpkts;       /* Ctrl frames processed from dongle */
+        ulong rx_readahead_cnt; /* packets where header read-ahead was used */
+};
+
+struct brcmf_pub;
+#ifdef DEBUG
+void brcmf_debugfs_init(void);
+void brcmf_debugfs_exit(void);
+int brcmf_debugfs_attach(struct brcmf_pub *drvr);
+void brcmf_debugfs_detach(struct brcmf_pub *drvr);
+struct dentry *brcmf_debugfs_get_devdir(struct brcmf_pub *drvr);
+void brcmf_debugfs_create_sdio_count(struct brcmf_pub *drvr,
+                                     struct brcmf_sdio_count *sdcnt);
+#else
+static inline void brcmf_debugfs_init(void)
+{
+}
+static inline void brcmf_debugfs_exit(void)
+{
+}
+static inline int brcmf_debugfs_attach(struct brcmf_pub *drvr)
+{
+        return 0;
+}
+static inline void brcmf_debugfs_detach(struct brcmf_pub *drvr)
+{
+}
+#endif
+
 #endif                          /* _BRCMF_DBG_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index 8933f9b31a9a..01cf6c03390b 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -1007,6 +1007,9 @@ int brcmf_attach(uint bus_hdrlen, struct device *dev)
         drvr->bus_if->drvr = drvr;
         drvr->dev = dev;
 
+        /* create device debugfs folder */
+        brcmf_debugfs_attach(drvr);
+
         /* Attach and link in the protocol */
         ret = brcmf_proto_attach(drvr);
         if (ret != 0) {
@@ -1123,6 +1126,7 @@ void brcmf_detach(struct device *dev)
                 brcmf_proto_detach(drvr);
         }
 
+        brcmf_debugfs_detach(drvr);
         bus_if->drvr = NULL;
         kfree(drvr);
 }
@@ -1192,6 +1196,8 @@ exit:
 
 static void brcmf_driver_init(struct work_struct *work)
 {
+        brcmf_debugfs_init();
+
 #ifdef CONFIG_BRCMFMAC_SDIO
         brcmf_sdio_init();
 #endif
@@ -1219,6 +1225,7 @@ static void __exit brcmfmac_module_exit(void)
 #ifdef CONFIG_BRCMFMAC_USB
         brcmf_usb_exit();
 #endif
+        brcmf_debugfs_exit();
 }
 
 module_init(brcmfmac_module_init);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index 1dbf2be478c8..a07fb01bc36b 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -502,12 +502,9 @@ struct brcmf_sdio {
         bool intr;              /* Use interrupts */
         bool poll;              /* Use polling */
         bool ipend;             /* Device interrupt is pending */
-        uint intrcount;         /* Count of device interrupt callbacks */
-        uint lastintrs;         /* Count as of last watchdog timer */
         uint spurious;          /* Count of spurious interrupts */
         uint pollrate;          /* Ticks between device polls */
         uint polltick;          /* Tick counter */
-        uint pollcnt;           /* Count of active polls */
 
 #ifdef DEBUG
         uint console_interval;
@@ -515,8 +512,6 @@ struct brcmf_sdio {
         uint console_addr;      /* Console address from shared struct */
 #endif                          /* DEBUG */
 
-        uint regfails;          /* Count of R_REG failures */
-
         uint clkstate;          /* State of sd and backplane clock(s) */
         bool activity;          /* Activity flag for clock down */
         s32 idletime;           /* Control for activity timeout */
@@ -531,33 +526,6 @@ struct brcmf_sdio {
 /* Field to decide if rx of control frames happen in rxbuf or lb-pool */
         bool usebufpool;
 
-        /* Some additional counters */
-        uint tx_sderrs;         /* Count of tx attempts with sd errors */
-        uint fcqueued;          /* Tx packets that got queued */
-        uint rxrtx;             /* Count of rtx requests (NAK to dongle) */
-        uint rx_toolong;        /* Receive frames too long to receive */
-        uint rxc_errors;        /* SDIO errors when reading control frames */
-        uint rx_hdrfail;        /* SDIO errors on header reads */
-        uint rx_badhdr;         /* Bad received headers (roosync?) */
-        uint rx_badseq;         /* Mismatched rx sequence number */
-        uint fc_rcvd;           /* Number of flow-control events received */
-        uint fc_xoff;           /* Number which turned on flow-control */
-        uint fc_xon;            /* Number which turned off flow-control */
-        uint rxglomfail;        /* Failed deglom attempts */
-        uint rxglomframes;      /* Number of glom frames (superframes) */
-        uint rxglompkts;        /* Number of packets from glom frames */
-        uint f2rxhdrs;          /* Number of header reads */
-        uint f2rxdata;          /* Number of frame data reads */
-        uint f2txdata;          /* Number of f2 frame writes */
-        uint f1regdata;         /* Number of f1 register accesses */
-        uint tickcnt;           /* Number of watchdog been schedule */
-        unsigned long tx_ctlerrs;       /* Err of sending ctrl frames */
-        unsigned long tx_ctlpkts;       /* Ctrl frames sent to dongle */
-        unsigned long rx_ctlerrs;       /* Err of processing rx ctrl frames */
-        unsigned long rx_ctlpkts;       /* Ctrl frames processed from dongle */
-        unsigned long rx_readahead_cnt; /* Number of packets where header
-                                         * read-ahead was used. */
-
         u8 *ctrl_frame_buf;
         u32 ctrl_frame_len;
         bool ctrl_frame_stat;
@@ -583,6 +551,7 @@ struct brcmf_sdio {
         u32 fw_ptr;
 
         bool txoff;             /* Transmit flow-controlled */
+        struct brcmf_sdio_count sdcnt;
 };
 
 /* clkstate */
@@ -945,7 +914,7 @@ static u32 brcmf_sdbrcm_hostmail(struct brcmf_sdio *bus)
         if (ret == 0)
                 w_sdreg32(bus, SMB_INT_ACK,
                           offsetof(struct sdpcmd_regs, tosbmailbox));
-        bus->f1regdata += 2;
+        bus->sdcnt.f1regdata += 2;
 
         /* Dongle recomposed rx frames, accept them again */
         if (hmb_data & HMB_DATA_NAKHANDLED) {
@@ -984,12 +953,12 @@ static u32 brcmf_sdbrcm_hostmail(struct brcmf_sdio *bus)
                                                         HMB_DATA_FCDATA_SHIFT;
 
                 if (fcbits & ~bus->flowcontrol)
-                        bus->fc_xoff++;
+                        bus->sdcnt.fc_xoff++;
 
                 if (bus->flowcontrol & ~fcbits)
-                        bus->fc_xon++;
+                        bus->sdcnt.fc_xon++;
 
-                bus->fc_rcvd++;
+                bus->sdcnt.fc_rcvd++;
                 bus->flowcontrol = fcbits;
         }
 
@@ -1021,7 +990,7 @@ static void brcmf_sdbrcm_rxfail(struct brcmf_sdio *bus, bool abort, bool rtx)
 
         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
                          SFC_RF_TERM, &err);
-        bus->f1regdata++;
+        bus->sdcnt.f1regdata++;
 
         /* Wait until the packet has been flushed (device/FIFO stable) */
         for (lastrbc = retries = 0xffff; retries > 0; retries--) {
@@ -1029,7 +998,7 @@ static void brcmf_sdbrcm_rxfail(struct brcmf_sdio *bus, bool abort, bool rtx)
                                       SBSDIO_FUNC1_RFRAMEBCHI, &err);
                 lo = brcmf_sdio_regrb(bus->sdiodev,
                                       SBSDIO_FUNC1_RFRAMEBCLO, &err);
-                bus->f1regdata += 2;
+                bus->sdcnt.f1regdata += 2;
 
                 if ((hi == 0) && (lo == 0))
                         break;
@@ -1047,11 +1016,11 @@ static void brcmf_sdbrcm_rxfail(struct brcmf_sdio *bus, bool abort, bool rtx)
                 brcmf_dbg(INFO, "flush took %d iterations\n", 0xffff - retries);
 
         if (rtx) {
-                bus->rxrtx++;
+                bus->sdcnt.rxrtx++;
                 err = w_sdreg32(bus, SMB_NAK,
                                 offsetof(struct sdpcmd_regs, tosbmailbox));
 
-                bus->f1regdata++;
+                bus->sdcnt.f1regdata++;
                 if (err == 0)
                         bus->rxskip = true;
         }
@@ -1243,7 +1212,7 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                                   dlen);
                         errcode = -1;
                 }
-                bus->f2rxdata++;
+                bus->sdcnt.f2rxdata++;
 
                 /* On failure, kill the superframe, allow a couple retries */
                 if (errcode < 0) {
@@ -1256,7 +1225,7 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                         } else {
                                 bus->glomerr = 0;
                                 brcmf_sdbrcm_rxfail(bus, true, false);
-                                bus->rxglomfail++;
+                                bus->sdcnt.rxglomfail++;
                                 brcmf_sdbrcm_free_glom(bus);
                         }
                         return 0;
@@ -1312,7 +1281,7 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                 if (rxseq != seq) {
                         brcmf_dbg(INFO, "(superframe) rx_seq %d, expected %d\n",
                                   seq, rxseq);
-                        bus->rx_badseq++;
+                        bus->sdcnt.rx_badseq++;
                         rxseq = seq;
                 }
 
@@ -1376,7 +1345,7 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                         } else {
                                 bus->glomerr = 0;
                                 brcmf_sdbrcm_rxfail(bus, true, false);
-                                bus->rxglomfail++;
+                                bus->sdcnt.rxglomfail++;
                                 brcmf_sdbrcm_free_glom(bus);
                         }
                         bus->nextlen = 0;
@@ -1402,7 +1371,7 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                         if (rxseq != seq) {
                                 brcmf_dbg(GLOM, "rx_seq %d, expected %d\n",
                                           seq, rxseq);
-                                bus->rx_badseq++;
+                                bus->sdcnt.rx_badseq++;
                                 rxseq = seq;
                         }
                         rxseq++;
@@ -1441,8 +1410,8 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                         down(&bus->sdsem);
                 }
 
-                bus->rxglomframes++;
-                bus->rxglompkts += bus->glom.qlen;
+                bus->sdcnt.rxglomframes++;
+                bus->sdcnt.rxglompkts += bus->glom.qlen;
         }
         return num;
 }
@@ -1526,7 +1495,7 @@ brcmf_sdbrcm_read_control(struct brcmf_sdio *bus, u8 *hdr, uint len, uint doff)
                 brcmf_dbg(ERROR, "%d-byte ctl frame (%d-byte ctl data) exceeds %d-byte limit\n",
                           len, len - doff, bus->sdiodev->bus_if->maxctl);
                 bus->sdiodev->bus_if->dstats.rx_errors++;
-                bus->rx_toolong++;
+                bus->sdcnt.rx_toolong++;
                 brcmf_sdbrcm_rxfail(bus, false, false);
                 goto done;
         }
@@ -1536,13 +1505,13 @@ brcmf_sdbrcm_read_control(struct brcmf_sdio *bus, u8 *hdr, uint len, uint doff)
                                 bus->sdiodev->sbwad,
                                 SDIO_FUNC_2,
                                 F2SYNC, (bus->rxctl + BRCMF_FIRSTREAD), rdlen);
-        bus->f2rxdata++;
+        bus->sdcnt.f2rxdata++;
 
         /* Control frame failures need retransmission */
         if (sdret < 0) {
                 brcmf_dbg(ERROR, "read %d control bytes failed: %d\n",
                           rdlen, sdret);
-                bus->rxc_errors++;
+                bus->sdcnt.rxc_errors++;
                 brcmf_sdbrcm_rxfail(bus, true, true);
                 goto done;
         }
@@ -1589,7 +1558,7 @@ brcmf_alloc_pkt_and_read(struct brcmf_sdio *bus, u16 rdlen,
         /* Read the entire frame */
         sdret = brcmf_sdcard_recv_pkt(bus->sdiodev, bus->sdiodev->sbwad,
                                       SDIO_FUNC_2, F2SYNC, *pkt);
-        bus->f2rxdata++;
+        bus->sdcnt.f2rxdata++;
 
         if (sdret < 0) {
                 brcmf_dbg(ERROR, "(nextlen): read %d bytes failed: %d\n",
@@ -1630,7 +1599,7 @@ brcmf_check_rxbuf(struct brcmf_sdio *bus, struct sk_buff *pkt, u8 *rxbuf,
         if ((u16)~(*len ^ check)) {
                 brcmf_dbg(ERROR, "(nextlen): HW hdr error: nextlen/len/check 0x%04x/0x%04x/0x%04x\n",
                           nextlen, *len, check);
-                bus->rx_badhdr++;
+                bus->sdcnt.rx_badhdr++;
                 brcmf_sdbrcm_rxfail(bus, false, false);
                 goto fail;
         }
@@ -1746,7 +1715,7 @@ brcmf_sdbrcm_readframes(struct brcmf_sdio *bus, uint maxframes, bool *finished)
                                 bus->nextlen = 0;
                         }
 
-                        bus->rx_readahead_cnt++;
+                        bus->sdcnt.rx_readahead_cnt++;
 
                         /* Handle Flow Control */
                         fcbits = SDPCM_FCMASK_VALUE(
@@ -1754,12 +1723,12 @@ brcmf_sdbrcm_readframes(struct brcmf_sdio *bus, uint maxframes, bool *finished)
 
                         if (bus->flowcontrol != fcbits) {
                                 if (~bus->flowcontrol & fcbits)
-                                        bus->fc_xoff++;
+                                        bus->sdcnt.fc_xoff++;
 
                                 if (bus->flowcontrol & ~fcbits)
-                                        bus->fc_xon++;
+                                        bus->sdcnt.fc_xon++;
 
-                                bus->fc_rcvd++;
+                                bus->sdcnt.fc_rcvd++;
                                 bus->flowcontrol = fcbits;
                         }
 
@@ -1767,7 +1736,7 @@ brcmf_sdbrcm_readframes(struct brcmf_sdio *bus, uint maxframes, bool *finished)
                         if (rxseq != seq) {
                                 brcmf_dbg(INFO, "(nextlen): rx_seq %d, expected %d\n",
                                           seq, rxseq);
-                                bus->rx_badseq++;
+                                bus->sdcnt.rx_badseq++;
                                 rxseq = seq;
                         }
 
@@ -1814,11 +1783,11 @@ brcmf_sdbrcm_readframes(struct brcmf_sdio *bus, uint maxframes, bool *finished)
                 sdret = brcmf_sdcard_recv_buf(bus->sdiodev, bus->sdiodev->sbwad,
                                               SDIO_FUNC_2, F2SYNC, bus->rxhdr,
                                               BRCMF_FIRSTREAD);
-                bus->f2rxhdrs++;
+                bus->sdcnt.f2rxhdrs++;
 
                 if (sdret < 0) {
                         brcmf_dbg(ERROR, "RXHEADER FAILED: %d\n", sdret);
-                        bus->rx_hdrfail++;
+                        bus->sdcnt.rx_hdrfail++;
                         brcmf_sdbrcm_rxfail(bus, true, true);
                         continue;
                 }
@@ -1840,7 +1809,7 @@ brcmf_sdbrcm_readframes(struct brcmf_sdio *bus, uint maxframes, bool *finished)
                 if ((u16) ~(len ^ check)) {
                         brcmf_dbg(ERROR, "HW hdr err: len/check 0x%04x/0x%04x\n",
                                   len, check);
-                        bus->rx_badhdr++;
+                        bus->sdcnt.rx_badhdr++;
                         brcmf_sdbrcm_rxfail(bus, false, false);
                         continue;
                 }
@@ -1861,7 +1830,7 @@ brcmf_sdbrcm_readframes(struct brcmf_sdio *bus, uint maxframes, bool *finished)
                 if ((doff < SDPCM_HDRLEN) || (doff > len)) {
                         brcmf_dbg(ERROR, "Bad data offset %d: HW len %d, min %d seq %d\n",
                                   doff, len, SDPCM_HDRLEN, seq);
-                        bus->rx_badhdr++;
+                        bus->sdcnt.rx_badhdr++;
                         brcmf_sdbrcm_rxfail(bus, false, false);
                         continue;
                 }
@@ -1880,19 +1849,19 @@ brcmf_sdbrcm_readframes(struct brcmf_sdio *bus, uint maxframes, bool *finished)
 
                 if (bus->flowcontrol != fcbits) {
                         if (~bus->flowcontrol & fcbits)
-                                bus->fc_xoff++;
+                                bus->sdcnt.fc_xoff++;
 
                         if (bus->flowcontrol & ~fcbits)
-                                bus->fc_xon++;
+                                bus->sdcnt.fc_xon++;
 
-                        bus->fc_rcvd++;
+                        bus->sdcnt.fc_rcvd++;
                         bus->flowcontrol = fcbits;
                 }
 
                 /* Check and update sequence number */
                 if (rxseq != seq) {
                         brcmf_dbg(INFO, "rx_seq %d, expected %d\n", seq, rxseq);
-                        bus->rx_badseq++;
+                        bus->sdcnt.rx_badseq++;
                         rxseq = seq;
                 }
 
@@ -1937,7 +1906,7 @@ brcmf_sdbrcm_readframes(struct brcmf_sdio *bus, uint maxframes, bool *finished)
                         brcmf_dbg(ERROR, "too long: len %d rdlen %d\n",
                                   len, rdlen);
                         bus->sdiodev->bus_if->dstats.rx_errors++;
-                        bus->rx_toolong++;
+                        bus->sdcnt.rx_toolong++;
                         brcmf_sdbrcm_rxfail(bus, false, false);
                         continue;
                 }
@@ -1960,7 +1929,7 @@ brcmf_sdbrcm_readframes(struct brcmf_sdio *bus, uint maxframes, bool *finished)
                 /* Read the remaining frame data */
                 sdret = brcmf_sdcard_recv_pkt(bus->sdiodev, bus->sdiodev->sbwad,
                                               SDIO_FUNC_2, F2SYNC, pkt);
-                bus->f2rxdata++;
+                bus->sdcnt.f2rxdata++;
 
                 if (sdret < 0) {
                         brcmf_dbg(ERROR, "read %d %s bytes failed: %d\n", rdlen,
@@ -2147,18 +2116,18 @@ static int brcmf_sdbrcm_txpkt(struct brcmf_sdio *bus, struct sk_buff *pkt,
 
         ret = brcmf_sdcard_send_pkt(bus->sdiodev, bus->sdiodev->sbwad,
                                     SDIO_FUNC_2, F2SYNC, pkt);
-        bus->f2txdata++;
+        bus->sdcnt.f2txdata++;
 
         if (ret < 0) {
                 /* On failure, abort the command and terminate the frame */
                 brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
                           ret);
-                bus->tx_sderrs++;
+                bus->sdcnt.tx_sderrs++;
 
                 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
                                  SFC_WF_TERM, NULL);
-                bus->f1regdata++;
+                bus->sdcnt.f1regdata++;
 
                 for (i = 0; i < 3; i++) {
                         u8 hi, lo;
@@ -2166,7 +2135,7 @@ static int brcmf_sdbrcm_txpkt(struct brcmf_sdio *bus, struct sk_buff *pkt,
                                               SBSDIO_FUNC1_WFRAMEBCHI, NULL);
                         lo = brcmf_sdio_regrb(bus->sdiodev,
                                               SBSDIO_FUNC1_WFRAMEBCLO, NULL);
-                        bus->f1regdata += 2;
+                        bus->sdcnt.f1regdata += 2;
                         if ((hi == 0) && (lo == 0))
                                 break;
                 }
@@ -2224,7 +2193,7 @@ static uint brcmf_sdbrcm_sendfromq(struct brcmf_sdio *bus, uint maxframes)
                         ret = r_sdreg32(bus, &intstatus,
                                         offsetof(struct sdpcmd_regs,
                                                  intstatus));
-                        bus->f2txdata++;
+                        bus->sdcnt.f2txdata++;
                         if (ret != 0)
                                 break;
                         if (intstatus & bus->hostintmask)
@@ -2417,7 +2386,7 @@ static bool brcmf_sdbrcm_dpc(struct brcmf_sdio *bus)
                 bus->ipend = false;
                 err = r_sdreg32(bus, &newstatus,
                                 offsetof(struct sdpcmd_regs, intstatus));
-                bus->f1regdata++;
+                bus->sdcnt.f1regdata++;
                 if (err != 0)
                         newstatus = 0;
                 newstatus &= bus->hostintmask;
@@ -2426,7 +2395,7 @@ static bool brcmf_sdbrcm_dpc(struct brcmf_sdio *bus)
                         err = w_sdreg32(bus, newstatus,
                                         offsetof(struct sdpcmd_regs,
                                                  intstatus));
-                        bus->f1regdata++;
+                        bus->sdcnt.f1regdata++;
                 }
         }
 
@@ -2445,7 +2414,7 @@ static bool brcmf_sdbrcm_dpc(struct brcmf_sdio *bus)
 
                 err = r_sdreg32(bus, &newstatus,
                                 offsetof(struct sdpcmd_regs, intstatus));
-                bus->f1regdata += 2;
+                bus->sdcnt.f1regdata += 2;
                 bus->fcstate =
                     !!(newstatus & (I_HMB_FC_STATE | I_HMB_FC_CHANGE));
                 intstatus |= (newstatus & bus->hostintmask);
@@ -2510,13 +2479,13 @@ clkwait:
                                 terminate the frame */
                         brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
                                   ret);
-                        bus->tx_sderrs++;
+                        bus->sdcnt.tx_sderrs++;
 
                         brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
 
                         brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
                                          SFC_WF_TERM, &err);
-                        bus->f1regdata++;
+                        bus->sdcnt.f1regdata++;
 
                         for (i = 0; i < 3; i++) {
                                 u8 hi, lo;
@@ -2526,7 +2495,7 @@ clkwait:
                                 lo = brcmf_sdio_regrb(bus->sdiodev,
                                                       SBSDIO_FUNC1_WFRAMEBCLO,
                                                       &err);
-                                bus->f1regdata += 2;
+                                bus->sdcnt.f1regdata += 2;
                                 if ((hi == 0) && (lo == 0))
                                         break;
                         }
@@ -2657,7 +2626,7 @@ static int brcmf_sdbrcm_bus_txdata(struct device *dev, struct sk_buff *pkt)
         /* Check for existing queue, current flow-control,
                          pending event, or pending clock */
         brcmf_dbg(TRACE, "deferring pktq len %d\n", pktq_len(&bus->txq));
-        bus->fcqueued++;
+        bus->sdcnt.fcqueued++;
 
         /* Priority based enq */
         spin_lock_bh(&bus->txqlock);
@@ -2845,13 +2814,13 @@ static int brcmf_tx_frame(struct brcmf_sdio *bus, u8 *frame, u16 len)
                 /* On failure, abort the command and terminate the frame */
                 brcmf_dbg(INFO, "sdio error %d, abort command and terminate frame\n",
                           ret);
-                bus->tx_sderrs++;
+                bus->sdcnt.tx_sderrs++;
 
                 brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
 
                 brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
                                  SFC_WF_TERM, NULL);
-                bus->f1regdata++;
+                bus->sdcnt.f1regdata++;
 
                 for (i = 0; i < 3; i++) {
                         u8 hi, lo;
@@ -2859,7 +2828,7 @@ static int brcmf_tx_frame(struct brcmf_sdio *bus, u8 *frame, u16 len)
                                               SBSDIO_FUNC1_WFRAMEBCHI, NULL);
                         lo = brcmf_sdio_regrb(bus->sdiodev,
                                               SBSDIO_FUNC1_WFRAMEBCLO, NULL);
-                        bus->f1regdata += 2;
+                        bus->sdcnt.f1regdata += 2;
                         if (hi == 0 && lo == 0)
                                 break;
                 }
@@ -2976,13 +2945,26 @@ brcmf_sdbrcm_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
         up(&bus->sdsem);
 
         if (ret)
-                bus->tx_ctlerrs++;
+                bus->sdcnt.tx_ctlerrs++;
         else
-                bus->tx_ctlpkts++;
+                bus->sdcnt.tx_ctlpkts++;
 
         return ret ? -EIO : 0;
 }
 
+#ifdef DEBUG
+static void brcmf_sdio_debugfs_create(struct brcmf_sdio *bus)
+{
+        struct brcmf_pub *drvr = bus->sdiodev->bus_if->drvr;
+
+        brcmf_debugfs_create_sdio_count(drvr, &bus->sdcnt);
+}
+#else
+static void brcmf_sdio_debugfs_create(struct brcmf_sdio *bus)
+{
+}
+#endif /* DEBUG */
+
 static int
 brcmf_sdbrcm_bus_rxctl(struct device *dev, unsigned char *msg, uint msglen)
 {
@@ -3017,9 +2999,9 @@ brcmf_sdbrcm_bus_rxctl(struct device *dev, unsigned char *msg, uint msglen)
         }
 
         if (rxlen)
-                bus->rx_ctlpkts++;
+                bus->sdcnt.rx_ctlpkts++;
         else
-                bus->rx_ctlerrs++;
+                bus->sdcnt.rx_ctlerrs++;
 
         return rxlen ? (int)rxlen : -ETIMEDOUT;
 }
@@ -3419,7 +3401,7 @@ static int brcmf_sdbrcm_bus_init(struct device *dev)
                 return 0;
 
         /* Start the watchdog timer */
-        bus->tickcnt = 0;
+        bus->sdcnt.tickcnt = 0;
         brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
 
         down(&bus->sdsem);
@@ -3512,7 +3494,7 @@ void brcmf_sdbrcm_isr(void *arg)
                 return;
         }
         /* Count the interrupt call */
-        bus->intrcount++;
+        bus->sdcnt.intrcount++;
         bus->ipend = true;
 
         /* Shouldn't get this interrupt if we're sleeping? */
@@ -3554,7 +3536,8 @@ static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_sdio *bus)
                 bus->polltick = 0;
 
                 /* Check device if no interrupts */
-                if (!bus->intr || (bus->intrcount == bus->lastintrs)) {
+                if (!bus->intr ||
+                    (bus->sdcnt.intrcount == bus->sdcnt.lastintrs)) {
 
                         if (!bus->dpc_sched) {
                                 u8 devpend;
@@ -3569,7 +3552,7 @@ static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_sdio *bus)
                         /* If there is something, make like the ISR and
                                  schedule the DPC */
                         if (intstatus) {
-                                bus->pollcnt++;
+                                bus->sdcnt.pollcnt++;
                                 bus->ipend = true;
 
                                 bus->dpc_sched = true;
@@ -3581,7 +3564,7 @@ static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_sdio *bus)
                 }
 
                 /* Update interrupt tracking */
-                bus->lastintrs = bus->intrcount;
+                bus->sdcnt.lastintrs = bus->sdcnt.intrcount;
         }
 #ifdef DEBUG
         /* Poll for console output periodically */
@@ -3793,7 +3776,7 @@ brcmf_sdbrcm_watchdog_thread(void *data)
                 if (!wait_for_completion_interruptible(&bus->watchdog_wait)) {
                         brcmf_sdbrcm_bus_watchdog(bus);
                         /* Count the tick for reference */
-                        bus->tickcnt++;
+                        bus->sdcnt.tickcnt++;
                 } else
                         break;
         }
@@ -3834,7 +3817,6 @@ static void brcmf_sdbrcm_release_dongle(struct brcmf_sdio *bus)
 static void brcmf_sdbrcm_release(struct brcmf_sdio *bus)
 {
         brcmf_dbg(TRACE, "Enter\n");
-
         if (bus) {
                 /* De-register interrupt handler */
                 brcmf_sdio_intr_unregister(bus->sdiodev);
@@ -3938,6 +3920,7 @@ void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev)
                 goto fail;
         }
 
+        brcmf_sdio_debugfs_create(bus);
         brcmf_dbg(INFO, "completed!!\n");
 
         /* if firmware path present try to download and bring up bus */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/aiutils.c b/drivers/net/wireless/brcm80211/brcmsmac/aiutils.c
index 6d8b7213643a..3c6f9b1e8d05 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/aiutils.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/aiutils.c
@@ -631,9 +631,8 @@ uint ai_cc_reg(struct si_pub *sih, uint regoff, u32 mask, u32 val)
         cc = sii->icbus->drv_cc.core;
 
         /* mask and set */
-        if (mask || val) {
+        if (mask || val)
                 bcma_maskset32(cc, regoff, ~mask, val);
-        }
 
         /* readback */
         w = bcma_read32(cc, regoff);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/aiutils.h b/drivers/net/wireless/brcm80211/brcmsmac/aiutils.h
index d9f04a683bdb..d6fa9829af9a 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/aiutils.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/aiutils.h
@@ -193,7 +193,7 @@ extern void ai_detach(struct si_pub *sih);
 extern uint ai_cc_reg(struct si_pub *sih, uint regoff, u32 mask, u32 val);
 extern void ai_clkctl_init(struct si_pub *sih);
 extern u16 ai_clkctl_fast_pwrup_delay(struct si_pub *sih);
-extern bool ai_clkctl_cc(struct si_pub *sih, uint mode);
+extern bool ai_clkctl_cc(struct si_pub *sih, enum bcma_clkmode mode);
 extern bool ai_deviceremoved(struct si_pub *sih);
 
 extern void ai_pci_down(struct si_pub *sih);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
index 95b5902bc4b3..01b190a25d94 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
@@ -735,10 +735,8 @@ brcms_c_sendampdu(struct ampdu_info *ampdu, struct brcms_txq_info *qi,
                  * a candidate for aggregation
                  */
                 p = pktq_ppeek(&qi->q, prec);
-                /* tx_info must be checked with current p */
-                tx_info = IEEE80211_SKB_CB(p);
-
                 if (p) {
+                        tx_info = IEEE80211_SKB_CB(p);
                         if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) &&
                             ((u8) (p->priority) == tid)) {
                                 plen = p->len + AMPDU_MAX_MPDU_OVERHEAD;
@@ -759,6 +757,7 @@ brcms_c_sendampdu(struct ampdu_info *ampdu, struct brcms_txq_info *qi,
                                         p = NULL;
                                         continue;
                                 }
+                                /* next packet fit for aggregation so dequeue */
                                 p = brcmu_pktq_pdeq(&qi->q, prec);
                         } else {
                                 p = NULL;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index 50f92a0b7c41..341e06a0d6ec 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -721,14 +721,6 @@ static const struct ieee80211_ops brcms_ops = {
         .flush = brcms_ops_flush,
 };
 
-/*
- * is called in brcms_bcma_probe() context, therefore no locking required.
- */
-static int brcms_set_hint(struct brcms_info *wl, char *abbrev)
-{
-        return regulatory_hint(wl->pub->ieee_hw->wiphy, abbrev);
-}
-
 void brcms_dpc(unsigned long data)
 {
         struct brcms_info *wl;
@@ -1068,9 +1060,9 @@ static struct brcms_info *brcms_attach(struct bcma_device *pdev)
                 wiphy_err(wl->wiphy, "%s: ieee80211_register_hw failed, status"
                           "%d\n", __func__, err);
 
-        if (wl->pub->srom_ccode[0] && brcms_set_hint(wl, wl->pub->srom_ccode))
-                wiphy_err(wl->wiphy, "%s: regulatory_hint failed, status %d\n",
-                          __func__, err);
+        if (wl->pub->srom_ccode[0] &&
+            regulatory_hint(wl->wiphy, wl->pub->srom_ccode))
+                wiphy_err(wl->wiphy, "%s: regulatory hint failed\n", __func__);
 
         n_adapters_found++;
         return wl;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c
index 13b261517cce..366718146418 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c
@@ -14358,7 +14358,7 @@ void wlc_phy_nphy_tkip_rifs_war(struct brcms_phy *pi, u8 rifs)
 
         wlc_phy_write_txmacreg_nphy(pi, holdoff, delay);
 
-        if (pi && pi->sh && (pi->sh->_rifs_phy != rifs))
+        if (pi->sh && (pi->sh->_rifs_phy != rifs))
                 pi->sh->_rifs_phy = rifs;
 }
 
diff --git a/drivers/net/wireless/brcm80211/brcmutil/utils.c b/drivers/net/wireless/brcm80211/brcmutil/utils.c
index b45ab34cdfdc..3e6405e06ac0 100644
--- a/drivers/net/wireless/brcm80211/brcmutil/utils.c
+++ b/drivers/net/wireless/brcm80211/brcmutil/utils.c
@@ -43,6 +43,8 @@ EXPORT_SYMBOL(brcmu_pkt_buf_get_skb);
 /* Free the driver packet. Free the tag if present */
 void brcmu_pkt_buf_free_skb(struct sk_buff *skb)
 {
+        if (!skb)
+                return;
         WARN_ON(skb->next);
         if (skb->destructor)
                 /* cannot kfree_skb() on hard IRQ (net/core/skbuff.c) if
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 0036737fe8e3..254b89223276 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -2701,6 +2701,20 @@ static void eeprom_parse_mac(struct ipw_priv *priv, u8 * mac)
         memcpy(mac, &priv->eeprom[EEPROM_MAC_ADDRESS], 6);
 }
 
+static void ipw_read_eeprom(struct ipw_priv *priv)
+{
+        int i;
+        __le16 *eeprom = (__le16 *) priv->eeprom;
+
+        IPW_DEBUG_TRACE(">>\n");
+
+        /* read entire contents of eeprom into private buffer */
+        for (i = 0; i < 128; i++)
+                eeprom[i] = cpu_to_le16(eeprom_read_u16(priv, (u8) i));
+
+        IPW_DEBUG_TRACE("<<\n");
+}
+
 /*
  * Either the device driver (i.e. the host) or the firmware can
  * load eeprom data into the designated region in SRAM.  If neither
@@ -2712,14 +2726,9 @@ static void eeprom_parse_mac(struct ipw_priv *priv, u8 * mac)
 static void ipw_eeprom_init_sram(struct ipw_priv *priv)
 {
         int i;
-        __le16 *eeprom = (__le16 *) priv->eeprom;
 
         IPW_DEBUG_TRACE(">>\n");
 
-        /* read entire contents of eeprom into private buffer */
-        for (i = 0; i < 128; i++)
-                eeprom[i] = cpu_to_le16(eeprom_read_u16(priv, (u8) i));
-
         /*
            If the data looks correct, then copy it to our private
            copy.  Otherwise let the firmware know to perform the operation
@@ -3643,8 +3652,10 @@ static int ipw_load(struct ipw_priv *priv)
         /* ack fw init done interrupt */
         ipw_write32(priv, IPW_INTA_RW, IPW_INTA_BIT_FW_INITIALIZATION_DONE);
 
-        /* read eeprom data and initialize the eeprom region of sram */
+        /* read eeprom data */
         priv->eeprom_delay = 1;
+        ipw_read_eeprom(priv);
+        /* initialize the eeprom region of sram */
         ipw_eeprom_init_sram(priv);
 
         /* enable interrupts */
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index 509301a5e7e2..d24eaf89ffb5 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -5724,7 +5724,8 @@ il4965_mac_setup_register(struct il_priv *il, u32 max_probe_length)
             BIT(NL80211_IFTYPE_STATION) | BIT(NL80211_IFTYPE_ADHOC);
 
         hw->wiphy->flags |=
-            WIPHY_FLAG_CUSTOM_REGULATORY | WIPHY_FLAG_DISABLE_BEACON_HINTS;
+            WIPHY_FLAG_CUSTOM_REGULATORY | WIPHY_FLAG_DISABLE_BEACON_HINTS |
+            WIPHY_FLAG_IBSS_RSN;
 
         /*
          * For now, disable PS by default because it affects
@@ -5873,6 +5874,16 @@ il4965_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 return -EOPNOTSUPP;
         }
 
+        /*
+         * To support IBSS RSN, don't program group keys in IBSS, the
+         * hardware will then not attempt to decrypt the frames.
+         */
+        if (vif->type == NL80211_IFTYPE_ADHOC &&
+            !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
+                D_MAC80211("leave - ad-hoc group key\n");
+                return -EOPNOTSUPP;
+        }
+
         sta_id = il_sta_id_or_broadcast(il, sta);
         if (sta_id == IL_INVALID_STATION)
                 return -EINVAL;
diff --git a/drivers/net/wireless/iwlwifi/Kconfig b/drivers/net/wireless/iwlwifi/Kconfig
index 2463c0626438..727fbb5db9da 100644
--- a/drivers/net/wireless/iwlwifi/Kconfig
+++ b/drivers/net/wireless/iwlwifi/Kconfig
@@ -6,6 +6,7 @@ config IWLWIFI
         select LEDS_CLASS
         select LEDS_TRIGGERS
         select MAC80211_LEDS
+        select IWLDVM
         ---help---
           Select to build the driver supporting the:
 
@@ -41,6 +42,10 @@ config IWLWIFI
           say M here and read <file:Documentation/kbuild/modules.txt>.  The
           module will be called iwlwifi.
 
+config IWLDVM
+        tristate "Intel Wireless WiFi"
+        depends on IWLWIFI
+
 menu "Debugging Options"
         depends on IWLWIFI
 
diff --git a/drivers/net/wireless/iwlwifi/Makefile b/drivers/net/wireless/iwlwifi/Makefile
index d615eacbf050..170ec330d2a9 100644
--- a/drivers/net/wireless/iwlwifi/Makefile
+++ b/drivers/net/wireless/iwlwifi/Makefile
@@ -1,27 +1,19 @@
-# WIFI
+# common
 obj-$(CONFIG_IWLWIFI)   += iwlwifi.o
-iwlwifi-objs            := iwl-agn.o iwl-agn-rs.o iwl-mac80211.o
-iwlwifi-objs            += iwl-ucode.o iwl-agn-tx.o iwl-debug.o
-iwlwifi-objs            += iwl-agn-lib.o iwl-agn-calib.o iwl-io.o
-iwlwifi-objs            += iwl-agn-tt.o iwl-agn-sta.o iwl-agn-rx.o
-
-iwlwifi-objs            += iwl-eeprom.o iwl-power.o
-iwlwifi-objs            += iwl-scan.o iwl-led.o
-iwlwifi-objs            += iwl-agn-rxon.o iwl-agn-devices.o
-iwlwifi-objs            += iwl-5000.o
-iwlwifi-objs            += iwl-6000.o
-iwlwifi-objs            += iwl-1000.o
-iwlwifi-objs            += iwl-2000.o
-iwlwifi-objs            += iwl-pci.o
+iwlwifi-objs            += iwl-io.o
 iwlwifi-objs            += iwl-drv.o
+iwlwifi-objs            += iwl-debug.o
 iwlwifi-objs            += iwl-notif-wait.o
-iwlwifi-objs            += iwl-trans-pcie.o iwl-trans-pcie-rx.o iwl-trans-pcie-tx.o
-
+iwlwifi-objs            += iwl-eeprom-read.o iwl-eeprom-parse.o
+iwlwifi-objs            += pcie/drv.o pcie/rx.o pcie/tx.o pcie/trans.o
+iwlwifi-objs            += pcie/1000.o pcie/2000.o pcie/5000.o pcie/6000.o
 
-iwlwifi-$(CONFIG_IWLWIFI_DEBUGFS) += iwl-debugfs.o
 iwlwifi-$(CONFIG_IWLWIFI_DEVICE_TRACING) += iwl-devtrace.o
-iwlwifi-$(CONFIG_IWLWIFI_DEVICE_TESTMODE) += iwl-testmode.o
+iwlwifi-$(CONFIG_IWLWIFI_DEVICE_TESTMODE) += iwl-test.o
 
-CFLAGS_iwl-devtrace.o := -I$(src)
+ccflags-y += -D__CHECK_ENDIAN__ -I$(src)
 
-ccflags-y += -D__CHECK_ENDIAN__
+
+obj-$(CONFIG_IWLDVM)    += dvm/
+
+CFLAGS_iwl-devtrace.o := -I$(src)
diff --git a/drivers/net/wireless/iwlwifi/dvm/Makefile b/drivers/net/wireless/iwlwifi/dvm/Makefile
new file mode 100644
index 000000000000..5ff76b204141
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/dvm/Makefile
@@ -0,0 +1,13 @@
+# DVM
+obj-$(CONFIG_IWLDVM)    += iwldvm.o
+iwldvm-objs             += main.o rs.o mac80211.o ucode.o tx.o
+iwldvm-objs             += lib.o calib.o tt.o sta.o rx.o
+
+iwldvm-objs             += power.o
+iwldvm-objs             += scan.o led.o
+iwldvm-objs             += rxon.o devices.o
+
+iwldvm-$(CONFIG_IWLWIFI_DEBUGFS) += debugfs.o
+iwldvm-$(CONFIG_IWLWIFI_DEVICE_TESTMODE) += testmode.o
+
+ccflags-y += -D__CHECK_ENDIAN__ -I$(src)/../
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.h b/drivers/net/wireless/iwlwifi/dvm/agn.h
index 79c0fe06f4db..6d102413dd94 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.h
+++ b/drivers/net/wireless/iwlwifi/dvm/agn.h
@@ -63,9 +63,10 @@
 #ifndef __iwl_agn_h__
 #define __iwl_agn_h__
 
-#include "iwl-dev.h"
 #include "iwl-config.h"
 
+#include "dev.h"
+
 /* The first 11 queues (0-10) are used otherwise */
 #define IWLAGN_FIRST_AMPDU_QUEUE        11
 
@@ -91,7 +92,6 @@ extern struct iwl_lib_ops iwl6030_lib;
 #define STATUS_CT_KILL          1
 #define STATUS_ALIVE            2
 #define STATUS_READY            3
-#define STATUS_GEO_CONFIGURED   4
 #define STATUS_EXIT_PENDING     5
 #define STATUS_STATISTICS       6
 #define STATUS_SCANNING         7
@@ -101,6 +101,7 @@ extern struct iwl_lib_ops iwl6030_lib;
 #define STATUS_CHANNEL_SWITCH_PENDING 11
 #define STATUS_SCAN_COMPLETE    12
 #define STATUS_POWER_PMI        13
+#define STATUS_SCAN_ROC_EXPIRED 14
 
 struct iwl_ucode_capabilities;
 
@@ -255,6 +256,10 @@ int __must_check iwl_scan_initiate(struct iwl_priv *priv,
                                    enum iwl_scan_type scan_type,
                                    enum ieee80211_band band);
 
+void iwl_scan_roc_expired(struct iwl_priv *priv);
+void iwl_scan_offchannel_skb(struct iwl_priv *priv);
+void iwl_scan_offchannel_skb_status(struct iwl_priv *priv);
+
 /* For faster active scanning, scan will move to the next channel if fewer than
  * PLCP_QUIET_THRESH packets are heard on this channel within
  * ACTIVE_QUIET_TIME after sending probe request.  This shortens the dwell
@@ -390,8 +395,10 @@ static inline __le32 iwl_hw_set_rate_n_flags(u8 rate, u32 flags)
 }
 
 extern int iwl_alive_start(struct iwl_priv *priv);
-/* svtool */
+
+/* testmode support */
 #ifdef CONFIG_IWLWIFI_DEVICE_TESTMODE
+
 extern int iwlagn_mac_testmode_cmd(struct ieee80211_hw *hw, void *data,
                                    int len);
 extern int iwlagn_mac_testmode_dump(struct ieee80211_hw *hw,
@@ -399,13 +406,16 @@ extern int iwlagn_mac_testmode_dump(struct ieee80211_hw *hw,
                                     struct netlink_callback *cb,
                                     void *data, int len);
 extern void iwl_testmode_init(struct iwl_priv *priv);
-extern void iwl_testmode_cleanup(struct iwl_priv *priv);
+extern void iwl_testmode_free(struct iwl_priv *priv);
+
 #else
+
 static inline
 int iwlagn_mac_testmode_cmd(struct ieee80211_hw *hw, void *data, int len)
 {
         return -ENOSYS;
 }
+
 static inline
 int iwlagn_mac_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
                       struct netlink_callback *cb,
@@ -413,12 +423,12 @@ int iwlagn_mac_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
 {
         return -ENOSYS;
 }
-static inline
-void iwl_testmode_init(struct iwl_priv *priv)
+
+static inline void iwl_testmode_init(struct iwl_priv *priv)
 {
 }
-static inline
-void iwl_testmode_cleanup(struct iwl_priv *priv)
+
+static inline void iwl_testmode_free(struct iwl_priv *priv)
 {
 }
 #endif
@@ -437,10 +447,8 @@ static inline void iwl_print_rx_config_cmd(struct iwl_priv *priv,
 
 static inline int iwl_is_ready(struct iwl_priv *priv)
 {
-        /* The adapter is 'ready' if READY and GEO_CONFIGURED bits are
-         * set but EXIT_PENDING is not */
+        /* The adapter is 'ready' if READY EXIT_PENDING is not set */
         return test_bit(STATUS_READY, &priv->status) &&
-               test_bit(STATUS_GEO_CONFIGURED, &priv->status) &&
                !test_bit(STATUS_EXIT_PENDING, &priv->status);
 }
 
@@ -518,85 +526,4 @@ static inline const char *iwl_dvm_get_cmd_string(u8 cmd)
                 return s;
         return "UNKNOWN";
 }
-
-/* API method exported for mvm hybrid state */
-void iwl_setup_deferred_work(struct iwl_priv *priv);
-int iwl_send_wimax_coex(struct iwl_priv *priv);
-int iwl_send_bt_env(struct iwl_priv *priv, u8 action, u8 type);
-void iwl_option_config(struct iwl_priv *priv);
-void iwl_set_hw_params(struct iwl_priv *priv);
-void iwl_init_context(struct iwl_priv *priv, u32 ucode_flags);
-int iwl_init_drv(struct iwl_priv *priv);
-void iwl_uninit_drv(struct iwl_priv *priv);
-void iwl_send_bt_config(struct iwl_priv *priv);
-void iwl_rf_kill_ct_config(struct iwl_priv *priv);
-int iwl_setup_interface(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
-void iwl_teardown_interface(struct iwl_priv *priv,
-                            struct ieee80211_vif *vif,
-                            bool mode_change);
-int iwl_full_rxon_required(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
-void iwlagn_update_qos(struct iwl_priv *priv, struct iwl_rxon_context *ctx);
-void iwlagn_check_needed_chains(struct iwl_priv *priv,
-                                struct iwl_rxon_context *ctx,
-                                struct ieee80211_bss_conf *bss_conf);
-void iwlagn_chain_noise_reset(struct iwl_priv *priv);
-int iwlagn_update_beacon(struct iwl_priv *priv,
-                         struct ieee80211_vif *vif);
-void iwl_tt_handler(struct iwl_priv *priv);
-void iwl_op_mode_dvm_stop(struct iwl_op_mode *op_mode);
-void iwl_stop_sw_queue(struct iwl_op_mode *op_mode, int queue);
-void iwl_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state);
-void iwl_free_skb(struct iwl_op_mode *op_mode, struct sk_buff *skb);
-void iwl_nic_error(struct iwl_op_mode *op_mode);
-void iwl_cmd_queue_full(struct iwl_op_mode *op_mode);
-void iwl_nic_config(struct iwl_op_mode *op_mode);
-int iwlagn_mac_set_tim(struct ieee80211_hw *hw,
-                       struct ieee80211_sta *sta, bool set);
-void iwlagn_mac_rssi_callback(struct ieee80211_hw *hw,
-                              enum ieee80211_rssi_event rssi_event);
-int iwlagn_mac_cancel_remain_on_channel(struct ieee80211_hw *hw);
-int iwlagn_mac_tx_last_beacon(struct ieee80211_hw *hw);
-void iwlagn_mac_flush(struct ieee80211_hw *hw, bool drop);
-void iwl_wake_sw_queue(struct iwl_op_mode *op_mode, int queue);
-void iwlagn_mac_channel_switch(struct ieee80211_hw *hw,
-                               struct ieee80211_channel_switch *ch_switch);
-int iwlagn_mac_sta_state(struct ieee80211_hw *hw,
-                         struct ieee80211_vif *vif,
-                         struct ieee80211_sta *sta,
-                         enum ieee80211_sta_state old_state,
-                         enum ieee80211_sta_state new_state);
-int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
-                            struct ieee80211_vif *vif,
-                            enum ieee80211_ampdu_mlme_action action,
-                            struct ieee80211_sta *sta, u16 tid, u16 *ssn,
-                            u8 buf_size);
-int iwlagn_mac_hw_scan(struct ieee80211_hw *hw,
-                       struct ieee80211_vif *vif,
-                       struct cfg80211_scan_request *req);
-void iwlagn_mac_sta_notify(struct ieee80211_hw *hw,
-                           struct ieee80211_vif *vif,
-                           enum sta_notify_cmd cmd,
-                           struct ieee80211_sta *sta);
-void iwlagn_configure_filter(struct ieee80211_hw *hw,
-                             unsigned int changed_flags,
-                             unsigned int *total_flags,
-                             u64 multicast);
-int iwlagn_mac_conf_tx(struct ieee80211_hw *hw,
-                       struct ieee80211_vif *vif, u16 queue,
-                       const struct ieee80211_tx_queue_params *params);
-void iwlagn_mac_set_rekey_data(struct ieee80211_hw *hw,
-                               struct ieee80211_vif *vif,
-                               struct cfg80211_gtk_rekey_data *data);
-void iwlagn_mac_update_tkip_key(struct ieee80211_hw *hw,
-                                struct ieee80211_vif *vif,
-                                struct ieee80211_key_conf *keyconf,
-                                struct ieee80211_sta *sta,
-                                u32 iv32, u16 *phase1key);
-int iwlagn_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
-                       struct ieee80211_vif *vif,
-                       struct ieee80211_sta *sta,
-                       struct ieee80211_key_conf *key);
-void iwlagn_mac_stop(struct ieee80211_hw *hw);
-void iwlagn_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb);
-int iwlagn_mac_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan);
 #endif /* __iwl_agn_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-calib.c b/drivers/net/wireless/iwlwifi/dvm/calib.c
index 95f27f1a423b..f2dd671d7dc8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-calib.c
+++ b/drivers/net/wireless/iwlwifi/dvm/calib.c
@@ -63,10 +63,11 @@
 #include <linux/slab.h>
 #include <net/mac80211.h>
 
-#include "iwl-dev.h"
-#include "iwl-agn-calib.h"
 #include "iwl-trans.h"
-#include "iwl-agn.h"
+
+#include "dev.h"
+#include "calib.h"
+#include "agn.h"
 
 /*****************************************************************************
  * INIT calibrations framework
@@ -832,14 +833,14 @@ static void iwl_find_disconn_antenna(struct iwl_priv *priv, u32* average_sig,
          * To be safe, simply mask out any chains that we know
          * are not on the device.
          */
-        active_chains &= priv->hw_params.valid_rx_ant;
+        active_chains &= priv->eeprom_data->valid_rx_ant;
 
         num_tx_chains = 0;
         for (i = 0; i < NUM_RX_CHAINS; i++) {
                 /* loops on all the bits of
                  * priv->hw_setting.valid_tx_ant */
                 u8 ant_msk = (1 << i);
-                if (!(priv->hw_params.valid_tx_ant & ant_msk))
+                if (!(priv->eeprom_data->valid_tx_ant & ant_msk))
                         continue;
 
                 num_tx_chains++;
@@ -853,7 +854,7 @@ static void iwl_find_disconn_antenna(struct iwl_priv *priv, u32* average_sig,
                          * connect the first valid tx chain
                          */
                         first_chain =
-                                find_first_chain(priv->hw_params.valid_tx_ant);
+                                find_first_chain(priv->eeprom_data->valid_tx_ant);
                         data->disconn_array[first_chain] = 0;
                         active_chains |= BIT(first_chain);
                         IWL_DEBUG_CALIB(priv,
@@ -863,13 +864,13 @@ static void iwl_find_disconn_antenna(struct iwl_priv *priv, u32* average_sig,
                 }
         }
 
-        if (active_chains != priv->hw_params.valid_rx_ant &&
+        if (active_chains != priv->eeprom_data->valid_rx_ant &&
             active_chains != priv->chain_noise_data.active_chains)
                 IWL_DEBUG_CALIB(priv,
                                 "Detected that not all antennas are connected! "
                                 "Connected: %#x, valid: %#x.\n",
                                 active_chains,
-                                priv->hw_params.valid_rx_ant);
+                                priv->eeprom_data->valid_rx_ant);
 
         /* Save for use within RXON, TX, SCAN commands, etc. */
         data->active_chains = active_chains;
@@ -1054,7 +1055,7 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv)
             priv->cfg->bt_params->advanced_bt_coexist) {
                 /* Disable disconnected antenna algorithm for advanced
                    bt coex, assuming valid antennas are connected */
-                data->active_chains = priv->hw_params.valid_rx_ant;
+                data->active_chains = priv->eeprom_data->valid_rx_ant;
                 for (i = 0; i < NUM_RX_CHAINS; i++)
                         if (!(data->active_chains & (1<<i)))
                                 data->disconn_array[i] = 1;
@@ -1083,8 +1084,9 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv)
         IWL_DEBUG_CALIB(priv, "min_average_noise = %d, antenna %d\n",
                         min_average_noise, min_average_noise_antenna_i);
 
-        iwlagn_gain_computation(priv, average_noise,
-                                find_first_chain(priv->hw_params.valid_rx_ant));
+        iwlagn_gain_computation(
+                priv, average_noise,
+                find_first_chain(priv->eeprom_data->valid_rx_ant));
 
         /* Some power changes may have been made during the calibration.
          * Update and commit the RXON
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-calib.h b/drivers/net/wireless/iwlwifi/dvm/calib.h
index dbe13787f272..2349f393cc42 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-calib.h
+++ b/drivers/net/wireless/iwlwifi/dvm/calib.h
@@ -62,8 +62,8 @@
 #ifndef __iwl_calib_h__
 #define __iwl_calib_h__
 
-#include "iwl-dev.h"
-#include "iwl-commands.h"
+#include "dev.h"
+#include "commands.h"
 
 void iwl_chain_noise_calibration(struct iwl_priv *priv);
 void iwl_sensitivity_calibration(struct iwl_priv *priv);
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/dvm/commands.h
index 9af6a239b384..64811cd91635 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/dvm/commands.h
@@ -61,9 +61,9 @@
  *
  *****************************************************************************/
 /*
- * Please use this file (iwl-commands.h) only for uCode API definitions.
+ * Please use this file (commands.h) only for uCode API definitions.
  * Please use iwl-xxxx-hw.h for hardware-related definitions.
- * Please use iwl-dev.h for driver implementation definitions.
+ * Please use dev.h for driver implementation definitions.
  */
 
 #ifndef __iwl_commands_h__
@@ -197,9 +197,6 @@ enum {
  *
  *****************************************************************************/
 
-/* iwl_cmd_header flags value */
-#define IWL_CMD_FAILED_MSK 0x40
-
 /**
  * iwlagn rate_n_flags bit fields
  *
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
index e7c157e5ebeb..8a2d9e643b14 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
@@ -30,16 +30,12 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/debugfs.h>
-
 #include <linux/ieee80211.h>
 #include <net/mac80211.h>
-
-
-#include "iwl-dev.h"
 #include "iwl-debug.h"
 #include "iwl-io.h"
-#include "iwl-agn.h"
-#include "iwl-modparams.h"
+#include "dev.h"
+#include "agn.h"
 
 /* create and remove of files */
 #define DEBUGFS_ADD_FILE(name, parent, mode) do {                       \
@@ -307,13 +303,13 @@ static ssize_t iwl_dbgfs_nvm_read(struct file *file,
         const u8 *ptr;
         char *buf;
         u16 eeprom_ver;
-        size_t eeprom_len = priv->cfg->base_params->eeprom_size;
+        size_t eeprom_len = priv->eeprom_blob_size;
         buf_size = 4 * eeprom_len + 256;
 
         if (eeprom_len % 16)
                 return -ENODATA;
 
-        ptr = priv->eeprom;
+        ptr = priv->eeprom_blob;
         if (!ptr)
                 return -ENOMEM;
 
@@ -322,11 +318,9 @@ static ssize_t iwl_dbgfs_nvm_read(struct file *file,
         if (!buf)
                 return -ENOMEM;
 
-        eeprom_ver = iwl_eeprom_query16(priv, EEPROM_VERSION);
-        pos += scnprintf(buf + pos, buf_size - pos, "NVM Type: %s, "
-                        "version: 0x%x\n",
-                        (priv->nvm_device_type == NVM_DEVICE_TYPE_OTP)
-                         ? "OTP" : "EEPROM", eeprom_ver);
+        eeprom_ver = priv->eeprom_data->eeprom_version;
+        pos += scnprintf(buf + pos, buf_size - pos,
+                         "NVM version: 0x%x\n", eeprom_ver);
         for (ofs = 0 ; ofs < eeprom_len ; ofs += 16) {
                 pos += scnprintf(buf + pos, buf_size - pos, "0x%.4x ", ofs);
                 hex_dump_to_buffer(ptr + ofs, 16 , 16, 2, buf + pos,
@@ -351,9 +345,6 @@ static ssize_t iwl_dbgfs_channels_read(struct file *file, char __user *user_buf,
         char *buf;
         ssize_t ret;
 
-        if (!test_bit(STATUS_GEO_CONFIGURED, &priv->status))
-                return -EAGAIN;
-
         buf = kzalloc(bufsz, GFP_KERNEL);
         if (!buf)
                 return -ENOMEM;
@@ -426,8 +417,6 @@ static ssize_t iwl_dbgfs_status_read(struct file *file,
                 test_bit(STATUS_ALIVE, &priv->status));
         pos += scnprintf(buf + pos, bufsz - pos, "STATUS_READY:\t\t %d\n",
                 test_bit(STATUS_READY, &priv->status));
-        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_GEO_CONFIGURED:\t %d\n",
-                test_bit(STATUS_GEO_CONFIGURED, &priv->status));
         pos += scnprintf(buf + pos, bufsz - pos, "STATUS_EXIT_PENDING:\t %d\n",
                 test_bit(STATUS_EXIT_PENDING, &priv->status));
         pos += scnprintf(buf + pos, bufsz - pos, "STATUS_STATISTICS:\t %d\n",
@@ -1341,17 +1330,17 @@ static ssize_t iwl_dbgfs_ucode_tx_stats_read(struct file *file,
         if (tx->tx_power.ant_a || tx->tx_power.ant_b || tx->tx_power.ant_c) {
                 pos += scnprintf(buf + pos, bufsz - pos,
                         "tx power: (1/2 dB step)\n");
-                if ((priv->hw_params.valid_tx_ant & ANT_A) &&
+                if ((priv->eeprom_data->valid_tx_ant & ANT_A) &&
                     tx->tx_power.ant_a)
                         pos += scnprintf(buf + pos, bufsz - pos,
                                         fmt_hex, "antenna A:",
                                         tx->tx_power.ant_a);
-                if ((priv->hw_params.valid_tx_ant & ANT_B) &&
+                if ((priv->eeprom_data->valid_tx_ant & ANT_B) &&
                     tx->tx_power.ant_b)
                         pos += scnprintf(buf + pos, bufsz - pos,
                                         fmt_hex, "antenna B:",
                                         tx->tx_power.ant_b);
-                if ((priv->hw_params.valid_tx_ant & ANT_C) &&
+                if ((priv->eeprom_data->valid_tx_ant & ANT_C) &&
                     tx->tx_power.ant_c)
                         pos += scnprintf(buf + pos, bufsz - pos,
                                         fmt_hex, "antenna C:",
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/dvm/dev.h
index 70062379d0ec..4620b657948a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/dvm/dev.h
@@ -24,8 +24,8 @@
  *
  *****************************************************************************/
 /*
- * Please use this file (iwl-dev.h) for driver implementation definitions.
- * Please use iwl-commands.h for uCode API definitions.
+ * Please use this file (dev.h) for driver implementation definitions.
+ * Please use commands.h for uCode API definitions.
  */
 
 #ifndef __iwl_dev_h__
@@ -39,17 +39,20 @@
 #include <linux/mutex.h>
 
 #include "iwl-fw.h"
-#include "iwl-eeprom.h"
+#include "iwl-eeprom-parse.h"
 #include "iwl-csr.h"
 #include "iwl-debug.h"
 #include "iwl-agn-hw.h"
-#include "iwl-led.h"
-#include "iwl-power.h"
-#include "iwl-agn-rs.h"
-#include "iwl-agn-tt.h"
-#include "iwl-trans.h"
 #include "iwl-op-mode.h"
 #include "iwl-notif-wait.h"
+#include "iwl-trans.h"
+
+#include "led.h"
+#include "power.h"
+#include "rs.h"
+#include "tt.h"
+
+#include "iwl-test.h"
 
 /* CT-KILL constants */
 #define CT_KILL_THRESHOLD_LEGACY   110 /* in Celsius */
@@ -88,33 +91,6 @@
 #define IWL_NUM_SCAN_RATES         (2)
 
 /*
- * One for each channel, holds all channel setup data
- * Some of the fields (e.g. eeprom and flags/max_power_avg) are redundant
- *     with one another!
- */
-struct iwl_channel_info {
-        struct iwl_eeprom_channel eeprom;       /* EEPROM regulatory limit */
-        struct iwl_eeprom_channel ht40_eeprom;  /* EEPROM regulatory limit for
-                                                 * HT40 channel */
-
-        u8 channel;       /* channel number */
-        u8 flags;         /* flags copied from EEPROM */
-        s8 max_power_avg; /* (dBm) regul. eeprom, normal Tx, any rate */
-        s8 curr_txpow;    /* (dBm) regulatory/spectrum/user (not h/w) limit */
-        s8 min_power;     /* always 0 */
-        s8 scan_power;    /* (dBm) regul. eeprom, direct scans, any rate */
-
-        u8 group_index;   /* 0-4, maps channel to group1/2/3/4/5 */
-        u8 band_index;    /* 0-4, maps channel to band1/2/3/4/5 */
-        enum ieee80211_band band;
-
-        /* HT40 channel info */
-        s8 ht40_max_power_avg;  /* (dBm) regul. eeprom, normal Tx, any rate */
-        u8 ht40_flags;          /* flags copied from EEPROM */
-        u8 ht40_extension_channel; /* HT_IE_EXT_CHANNEL_* */
-};
-
-/*
  * Minimum number of queues. MAX_NUM is defined in hw specific files.
  * Set the minimum to accommodate
  *  - 4 standard TX queues
@@ -153,29 +129,6 @@ union iwl_ht_rate_supp {
         };
 };
 
-#define CFG_HT_RX_AMPDU_FACTOR_8K   (0x0)
-#define CFG_HT_RX_AMPDU_FACTOR_16K  (0x1)
-#define CFG_HT_RX_AMPDU_FACTOR_32K  (0x2)
-#define CFG_HT_RX_AMPDU_FACTOR_64K  (0x3)
-#define CFG_HT_RX_AMPDU_FACTOR_DEF  CFG_HT_RX_AMPDU_FACTOR_64K
-#define CFG_HT_RX_AMPDU_FACTOR_MAX  CFG_HT_RX_AMPDU_FACTOR_64K
-#define CFG_HT_RX_AMPDU_FACTOR_MIN  CFG_HT_RX_AMPDU_FACTOR_8K
-
-/*
- * Maximal MPDU density for TX aggregation
- * 4 - 2us density
- * 5 - 4us density
- * 6 - 8us density
- * 7 - 16us density
- */
-#define CFG_HT_MPDU_DENSITY_2USEC   (0x4)
-#define CFG_HT_MPDU_DENSITY_4USEC   (0x5)
-#define CFG_HT_MPDU_DENSITY_8USEC   (0x6)
-#define CFG_HT_MPDU_DENSITY_16USEC  (0x7)
-#define CFG_HT_MPDU_DENSITY_DEF CFG_HT_MPDU_DENSITY_4USEC
-#define CFG_HT_MPDU_DENSITY_MAX CFG_HT_MPDU_DENSITY_16USEC
-#define CFG_HT_MPDU_DENSITY_MIN     (0x1)
-
 struct iwl_ht_config {
         bool single_chain_sufficient;
         enum ieee80211_smps_mode smps; /* current smps mode */
@@ -445,23 +398,6 @@ enum {
         MEASUREMENT_ACTIVE = (1 << 1),
 };
 
-enum iwl_nvm_type {
-        NVM_DEVICE_TYPE_EEPROM = 0,
-        NVM_DEVICE_TYPE_OTP,
-};
-
-/*
- * Two types of OTP memory access modes
- *   IWL_OTP_ACCESS_ABSOLUTE - absolute address mode,
- *                              based on physical memory addressing
- *   IWL_OTP_ACCESS_RELATIVE - relative address mode,
- *                             based on logical memory addressing
- */
-enum iwl_access_mode {
-        IWL_OTP_ACCESS_ABSOLUTE,
-        IWL_OTP_ACCESS_RELATIVE,
-};
-
 /* reply_tx_statistics (for _agn devices) */
 struct reply_tx_error_statistics {
         u32 pp_delay;
@@ -632,9 +568,6 @@ enum iwl_scan_type {
  *
  * @tx_chains_num: Number of TX chains
  * @rx_chains_num: Number of RX chains
- * @valid_tx_ant: usable antennas for TX
- * @valid_rx_ant: usable antennas for RX
- * @ht40_channel: is 40MHz width possible: BIT(IEEE80211_BAND_XXX)
  * @sku: sku read from EEPROM
  * @ct_kill_threshold: temperature threshold - in hw dependent unit
  * @ct_kill_exit_threshold: when to reeable the device - in hw dependent unit
@@ -645,9 +578,6 @@ enum iwl_scan_type {
 struct iwl_hw_params {
         u8  tx_chains_num;
         u8  rx_chains_num;
-        u8  valid_tx_ant;
-        u8  valid_rx_ant;
-        u8  ht40_channel;
         bool use_rts_for_aggregation;
         u16 sku;
         u32 ct_kill_threshold;
@@ -664,31 +594,10 @@ struct iwl_lib_ops {
         /* device specific configuration */
         void (*nic_config)(struct iwl_priv *priv);
 
-        /* eeprom operations (as defined in iwl-eeprom.h) */
-        struct iwl_eeprom_ops eeprom_ops;
-
         /* temperature */
         void (*temperature)(struct iwl_priv *priv);
 };
 
-#ifdef CONFIG_IWLWIFI_DEVICE_TESTMODE
-struct iwl_testmode_trace {
-        u32 buff_size;
-        u32 total_size;
-        u32 num_chunks;
-        u8 *cpu_addr;
-        u8 *trace_addr;
-        dma_addr_t dma_addr;
-        bool trace_enabled;
-};
-struct iwl_testmode_mem {
-        u32 buff_size;
-        u32 num_chunks;
-        u8 *buff_addr;
-        bool read_in_progress;
-};
-#endif
-
 struct iwl_wipan_noa_data {
         struct rcu_head rcu_head;
         u32 length;
@@ -735,8 +644,6 @@ struct iwl_priv {
 
         /* ieee device used by generic ieee processing code */
         struct ieee80211_hw *hw;
-        struct ieee80211_channel *ieee_channels;
-        struct ieee80211_rate *ieee_rates;
 
         struct list_head calib_results;
 
@@ -747,16 +654,12 @@ struct iwl_priv {
         enum ieee80211_band band;
         u8 valid_contexts;
 
-        void (*pre_rx_handler)(struct iwl_priv *priv,
-                               struct iwl_rx_cmd_buffer *rxb);
         int (*rx_handlers[REPLY_MAX])(struct iwl_priv *priv,
                                        struct iwl_rx_cmd_buffer *rxb,
                                        struct iwl_device_cmd *cmd);
 
         struct iwl_notif_wait_data notif_wait;
 
-        struct ieee80211_supported_band bands[IEEE80211_NUM_BANDS];
-
         /* spectrum measurement report caching */
         struct iwl_spectrum_notification measure_report;
         u8 measurement_status;
@@ -787,11 +690,6 @@ struct iwl_priv {
         bool ucode_loaded;
         bool init_ucode_run;            /* Don't run init uCode again */
 
-        /* we allocate array of iwl_channel_info for NIC's valid channels.
-         *    Access via channel # using indirect index array */
-        struct iwl_channel_info *channel_info;  /* channel info array */
-        u8 channel_count;       /* # of channels */
-
         u8 plcp_delta_threshold;
 
         /* thermal calibration */
@@ -846,6 +744,7 @@ struct iwl_priv {
         struct iwl_station_entry stations[IWLAGN_STATION_COUNT];
         unsigned long ucode_key_table;
         struct iwl_tid_data tid_data[IWLAGN_STATION_COUNT][IWL_MAX_TID_COUNT];
+        atomic_t num_aux_in_flight;
 
         u8 mac80211_registered;
 
@@ -950,10 +849,8 @@ struct iwl_priv {
 
         struct delayed_work scan_check;
 
-        /* TX Power */
+        /* TX Power settings */
         s8 tx_power_user_lmt;
-        s8 tx_power_device_lmt;
-        s8 tx_power_lmt_in_half_dbm; /* max tx power in half-dBm format */
         s8 tx_power_next;
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
@@ -964,9 +861,10 @@ struct iwl_priv {
         void *wowlan_sram;
 #endif /* CONFIG_IWLWIFI_DEBUGFS */
 
-        /* eeprom -- this is in the card's little endian byte order */
-        u8 *eeprom;
-        enum iwl_nvm_type nvm_device_type;
+        struct iwl_eeprom_data *eeprom_data;
+        /* eeprom blob for debugfs/testmode */
+        u8 *eeprom_blob;
+        size_t eeprom_blob_size;
 
         struct work_struct txpower_work;
         u32 calib_disabled;
@@ -979,9 +877,9 @@ struct iwl_priv {
         struct led_classdev led;
         unsigned long blink_on, blink_off;
         bool led_registered;
+
 #ifdef CONFIG_IWLWIFI_DEVICE_TESTMODE
-        struct iwl_testmode_trace testmode_trace;
-        struct iwl_testmode_mem testmode_mem;
+        struct iwl_test tst;
         u32 tm_fixed_rate;
 #endif
 
@@ -1001,8 +899,6 @@ struct iwl_priv {
         enum iwl_ucode_type cur_ucode;
 }; /*iwl_priv */
 
-extern struct kmem_cache *iwl_tx_cmd_pool;
-
 static inline struct iwl_rxon_context *
 iwl_rxon_ctx_from_vif(struct ieee80211_vif *vif)
 {
@@ -1036,36 +932,4 @@ static inline int iwl_is_any_associated(struct iwl_priv *priv)
         return false;
 }
 
-static inline int is_channel_valid(const struct iwl_channel_info *ch_info)
-{
-        if (ch_info == NULL)
-                return 0;
-        return (ch_info->flags & EEPROM_CHANNEL_VALID) ? 1 : 0;
-}
-
-static inline int is_channel_radar(const struct iwl_channel_info *ch_info)
-{
-        return (ch_info->flags & EEPROM_CHANNEL_RADAR) ? 1 : 0;
-}
-
-static inline u8 is_channel_a_band(const struct iwl_channel_info *ch_info)
-{
-        return ch_info->band == IEEE80211_BAND_5GHZ;
-}
-
-static inline u8 is_channel_bg_band(const struct iwl_channel_info *ch_info)
-{
-        return ch_info->band == IEEE80211_BAND_2GHZ;
-}
-
-static inline int is_channel_passive(const struct iwl_channel_info *ch)
-{
-        return (!(ch->flags & EEPROM_CHANNEL_ACTIVE)) ? 1 : 0;
-}
-
-static inline int is_channel_ibss(const struct iwl_channel_info *ch)
-{
-        return ((ch->flags & EEPROM_CHANNEL_IBSS)) ? 1 : 0;
-}
-
 #endif                          /* __iwl_dev_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-devices.c b/drivers/net/wireless/iwlwifi/dvm/devices.c
index 48533b3a0f9a..0521a6be09d2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-devices.c
+++ b/drivers/net/wireless/iwlwifi/dvm/devices.c
@@ -27,11 +27,14 @@
 /*
  * DVM device-specific data & functions
  */
-#include "iwl-agn.h"
-#include "iwl-dev.h"
-#include "iwl-commands.h"
 #include "iwl-io.h"
 #include "iwl-prph.h"
+#include "iwl-eeprom-parse.h"
+
+#include "agn.h"
+#include "dev.h"
+#include "commands.h"
+
 
 /*
  * 1000 series
@@ -58,11 +61,6 @@ static void iwl1000_set_ct_threshold(struct iwl_priv *priv)
 /* NIC configuration for 1000 series */
 static void iwl1000_nic_config(struct iwl_priv *priv)
 {
-        /* set CSR_HW_CONFIG_REG for uCode use */
-        iwl_set_bit(priv->trans, CSR_HW_IF_CONFIG_REG,
-                    CSR_HW_IF_CONFIG_REG_BIT_RADIO_SI |
-                    CSR_HW_IF_CONFIG_REG_BIT_MAC_SI);
-
         /* Setting digital SVR for 1000 card to 1.32V */
         /* locking is acquired in iwl_set_bits_mask_prph() function */
         iwl_set_bits_mask_prph(priv->trans, APMG_DIGITAL_SVR_REG,
@@ -170,16 +168,6 @@ static const struct iwl_sensitivity_ranges iwl1000_sensitivity = {
 
 static void iwl1000_hw_set_hw_params(struct iwl_priv *priv)
 {
-        priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ);
-
-        priv->hw_params.tx_chains_num =
-                num_of_ant(priv->hw_params.valid_tx_ant);
-        if (priv->cfg->rx_with_siso_diversity)
-                priv->hw_params.rx_chains_num = 1;
-        else
-                priv->hw_params.rx_chains_num =
-                        num_of_ant(priv->hw_params.valid_rx_ant);
-
         iwl1000_set_ct_threshold(priv);
 
         /* Set initial sensitivity parameters */
@@ -189,17 +177,6 @@ static void iwl1000_hw_set_hw_params(struct iwl_priv *priv)
 struct iwl_lib_ops iwl1000_lib = {
         .set_hw_params = iwl1000_hw_set_hw_params,
         .nic_config = iwl1000_nic_config,
-        .eeprom_ops = {
-                .regulatory_bands = {
-                        EEPROM_REG_BAND_1_CHANNELS,
-                        EEPROM_REG_BAND_2_CHANNELS,
-                        EEPROM_REG_BAND_3_CHANNELS,
-                        EEPROM_REG_BAND_4_CHANNELS,
-                        EEPROM_REG_BAND_5_CHANNELS,
-                        EEPROM_REG_BAND_24_HT40_CHANNELS,
-                        EEPROM_REGULATORY_BAND_NO_HT40,
-                },
-        },
         .temperature = iwlagn_temperature,
 };
 
@@ -219,8 +196,6 @@ static void iwl2000_set_ct_threshold(struct iwl_priv *priv)
 /* NIC configuration for 2000 series */
 static void iwl2000_nic_config(struct iwl_priv *priv)
 {
-        iwl_rf_config(priv);
-
         iwl_set_bit(priv->trans, CSR_GP_DRIVER_REG,
                     CSR_GP_DRIVER_REG_BIT_RADIO_IQ_INVER);
 }
@@ -251,16 +226,6 @@ static const struct iwl_sensitivity_ranges iwl2000_sensitivity = {
 
 static void iwl2000_hw_set_hw_params(struct iwl_priv *priv)
 {
-        priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ);
-
-        priv->hw_params.tx_chains_num =
-                num_of_ant(priv->hw_params.valid_tx_ant);
-        if (priv->cfg->rx_with_siso_diversity)
-                priv->hw_params.rx_chains_num = 1;
-        else
-                priv->hw_params.rx_chains_num =
-                        num_of_ant(priv->hw_params.valid_rx_ant);
-
         iwl2000_set_ct_threshold(priv);
 
         /* Set initial sensitivity parameters */
@@ -270,36 +235,12 @@ static void iwl2000_hw_set_hw_params(struct iwl_priv *priv)
 struct iwl_lib_ops iwl2000_lib = {
         .set_hw_params = iwl2000_hw_set_hw_params,
         .nic_config = iwl2000_nic_config,
-        .eeprom_ops = {
-                .regulatory_bands = {
-                        EEPROM_REG_BAND_1_CHANNELS,
-                        EEPROM_REG_BAND_2_CHANNELS,
-                        EEPROM_REG_BAND_3_CHANNELS,
-                        EEPROM_REG_BAND_4_CHANNELS,
-                        EEPROM_REG_BAND_5_CHANNELS,
-                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
-                        EEPROM_REGULATORY_BAND_NO_HT40,
-                },
-                .enhanced_txpower = true,
-        },
         .temperature = iwlagn_temperature,
 };
 
 struct iwl_lib_ops iwl2030_lib = {
         .set_hw_params = iwl2000_hw_set_hw_params,
         .nic_config = iwl2000_nic_config,
-        .eeprom_ops = {
-                .regulatory_bands = {
-                        EEPROM_REG_BAND_1_CHANNELS,
-                        EEPROM_REG_BAND_2_CHANNELS,
-                        EEPROM_REG_BAND_3_CHANNELS,
-                        EEPROM_REG_BAND_4_CHANNELS,
-                        EEPROM_REG_BAND_5_CHANNELS,
-                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
-                        EEPROM_REGULATORY_BAND_NO_HT40,
-                },
-                .enhanced_txpower = true,
-        },
         .temperature = iwlagn_temperature,
 };
 
@@ -311,8 +252,6 @@ struct iwl_lib_ops iwl2030_lib = {
 /* NIC configuration for 5000 series */
 static void iwl5000_nic_config(struct iwl_priv *priv)
 {
-        iwl_rf_config(priv);
-
         /* W/A : NIC is stuck in a reset state after Early PCIe power off
          * (PCIe power is lost before PERST# is asserted),
          * causing ME FW to lose ownership and not being able to obtain it back.
@@ -376,11 +315,9 @@ static struct iwl_sensitivity_ranges iwl5150_sensitivity = {
 static s32 iwl_temp_calib_to_offset(struct iwl_priv *priv)
 {
         u16 temperature, voltage;
-        __le16 *temp_calib = (__le16 *)iwl_eeprom_query_addr(priv,
-                                EEPROM_KELVIN_TEMPERATURE);
 
-        temperature = le16_to_cpu(temp_calib[0]);
-        voltage = le16_to_cpu(temp_calib[1]);
+        temperature = le16_to_cpu(priv->eeprom_data->kelvin_temperature);
+        voltage = le16_to_cpu(priv->eeprom_data->kelvin_voltage);
 
         /* offset = temp - volt / coeff */
         return (s32)(temperature -
@@ -404,14 +341,6 @@ static void iwl5000_set_ct_threshold(struct iwl_priv *priv)
 
 static void iwl5000_hw_set_hw_params(struct iwl_priv *priv)
 {
-        priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ) |
-                                        BIT(IEEE80211_BAND_5GHZ);
-
-        priv->hw_params.tx_chains_num =
-                num_of_ant(priv->hw_params.valid_tx_ant);
-        priv->hw_params.rx_chains_num =
-                num_of_ant(priv->hw_params.valid_rx_ant);
-
         iwl5000_set_ct_threshold(priv);
 
         /* Set initial sensitivity parameters */
@@ -420,14 +349,6 @@ static void iwl5000_hw_set_hw_params(struct iwl_priv *priv)
 
 static void iwl5150_hw_set_hw_params(struct iwl_priv *priv)
 {
-        priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ) |
-                                        BIT(IEEE80211_BAND_5GHZ);
-
-        priv->hw_params.tx_chains_num =
-                num_of_ant(priv->hw_params.valid_tx_ant);
-        priv->hw_params.rx_chains_num =
-                num_of_ant(priv->hw_params.valid_rx_ant);
-
         iwl5150_set_ct_threshold(priv);
 
         /* Set initial sensitivity parameters */
@@ -455,7 +376,6 @@ static int iwl5000_hw_channel_switch(struct iwl_priv *priv,
          */
         struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
         struct iwl5000_channel_switch_cmd cmd;
-        const struct iwl_channel_info *ch_info;
         u32 switch_time_in_usec, ucode_switch_time;
         u16 ch;
         u32 tsf_low;
@@ -505,14 +425,7 @@ static int iwl5000_hw_channel_switch(struct iwl_priv *priv,
         }
         IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n",
                       cmd.switch_time);
-        ch_info = iwl_get_channel_info(priv, priv->band, ch);
-        if (ch_info)
-                cmd.expect_beacon = is_channel_radar(ch_info);
-        else {
-                IWL_ERR(priv, "invalid channel switch from %u to %u\n",
-                        ctx->active.channel, ch);
-                return -EFAULT;
-        }
+        cmd.expect_beacon = ch_switch->channel->flags & IEEE80211_CHAN_RADAR;
 
         return iwl_dvm_send_cmd(priv, &hcmd);
 }
@@ -521,17 +434,6 @@ struct iwl_lib_ops iwl5000_lib = {
         .set_hw_params = iwl5000_hw_set_hw_params,
         .set_channel_switch = iwl5000_hw_channel_switch,
         .nic_config = iwl5000_nic_config,
-        .eeprom_ops = {
-                .regulatory_bands = {
-                        EEPROM_REG_BAND_1_CHANNELS,
-                        EEPROM_REG_BAND_2_CHANNELS,
-                        EEPROM_REG_BAND_3_CHANNELS,
-                        EEPROM_REG_BAND_4_CHANNELS,
-                        EEPROM_REG_BAND_5_CHANNELS,
-                        EEPROM_REG_BAND_24_HT40_CHANNELS,
-                        EEPROM_REG_BAND_52_HT40_CHANNELS
-                },
-        },
         .temperature = iwlagn_temperature,
 };
 
@@ -539,17 +441,6 @@ struct iwl_lib_ops iwl5150_lib = {
         .set_hw_params = iwl5150_hw_set_hw_params,
         .set_channel_switch = iwl5000_hw_channel_switch,
         .nic_config = iwl5000_nic_config,
-        .eeprom_ops = {
-                .regulatory_bands = {
-                        EEPROM_REG_BAND_1_CHANNELS,
-                        EEPROM_REG_BAND_2_CHANNELS,
-                        EEPROM_REG_BAND_3_CHANNELS,
-                        EEPROM_REG_BAND_4_CHANNELS,
-                        EEPROM_REG_BAND_5_CHANNELS,
-                        EEPROM_REG_BAND_24_HT40_CHANNELS,
-                        EEPROM_REG_BAND_52_HT40_CHANNELS
-                },
-        },
         .temperature = iwl5150_temperature,
 };
 
@@ -570,8 +461,6 @@ static void iwl6000_set_ct_threshold(struct iwl_priv *priv)
 /* NIC configuration for 6000 series */
 static void iwl6000_nic_config(struct iwl_priv *priv)
 {
-        iwl_rf_config(priv);
-
         switch (priv->cfg->device_family) {
         case IWL_DEVICE_FAMILY_6005:
         case IWL_DEVICE_FAMILY_6030:
@@ -584,13 +473,13 @@ static void iwl6000_nic_config(struct iwl_priv *priv)
                 break;
         case IWL_DEVICE_FAMILY_6050:
                 /* Indicate calibration version to uCode. */
-                if (iwl_eeprom_calib_version(priv) >= 6)
+                if (priv->eeprom_data->calib_version >= 6)
                         iwl_set_bit(priv->trans, CSR_GP_DRIVER_REG,
                                         CSR_GP_DRIVER_REG_BIT_CALIB_VERSION6);
                 break;
         case IWL_DEVICE_FAMILY_6150:
                 /* Indicate calibration version to uCode. */
-                if (iwl_eeprom_calib_version(priv) >= 6)
+                if (priv->eeprom_data->calib_version >= 6)
                         iwl_set_bit(priv->trans, CSR_GP_DRIVER_REG,
                                         CSR_GP_DRIVER_REG_BIT_CALIB_VERSION6);
                 iwl_set_bit(priv->trans, CSR_GP_DRIVER_REG,
@@ -627,17 +516,6 @@ static const struct iwl_sensitivity_ranges iwl6000_sensitivity = {
 
 static void iwl6000_hw_set_hw_params(struct iwl_priv *priv)
 {
-        priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ) |
-                                        BIT(IEEE80211_BAND_5GHZ);
-
-        priv->hw_params.tx_chains_num =
-                num_of_ant(priv->hw_params.valid_tx_ant);
-        if (priv->cfg->rx_with_siso_diversity)
-                priv->hw_params.rx_chains_num = 1;
-        else
-                priv->hw_params.rx_chains_num =
-                        num_of_ant(priv->hw_params.valid_rx_ant);
-
         iwl6000_set_ct_threshold(priv);
 
         /* Set initial sensitivity parameters */
@@ -654,7 +532,6 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv,
          */
         struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
         struct iwl6000_channel_switch_cmd cmd;
-        const struct iwl_channel_info *ch_info;
         u32 switch_time_in_usec, ucode_switch_time;
         u16 ch;
         u32 tsf_low;
@@ -704,14 +581,7 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv,
         }
         IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n",
                       cmd.switch_time);
-        ch_info = iwl_get_channel_info(priv, priv->band, ch);
-        if (ch_info)
-                cmd.expect_beacon = is_channel_radar(ch_info);
-        else {
-                IWL_ERR(priv, "invalid channel switch from %u to %u\n",
-                        ctx->active.channel, ch);
-                return -EFAULT;
-        }
+        cmd.expect_beacon = ch_switch->channel->flags & IEEE80211_CHAN_RADAR;
 
         return iwl_dvm_send_cmd(priv, &hcmd);
 }
@@ -720,18 +590,6 @@ struct iwl_lib_ops iwl6000_lib = {
         .set_hw_params = iwl6000_hw_set_hw_params,
         .set_channel_switch = iwl6000_hw_channel_switch,
         .nic_config = iwl6000_nic_config,
-        .eeprom_ops = {
-                .regulatory_bands = {
-                        EEPROM_REG_BAND_1_CHANNELS,
-                        EEPROM_REG_BAND_2_CHANNELS,
-                        EEPROM_REG_BAND_3_CHANNELS,
-                        EEPROM_REG_BAND_4_CHANNELS,
-                        EEPROM_REG_BAND_5_CHANNELS,
-                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
-                        EEPROM_REG_BAND_52_HT40_CHANNELS
-                },
-                .enhanced_txpower = true,
-        },
         .temperature = iwlagn_temperature,
 };
 
@@ -739,17 +597,5 @@ struct iwl_lib_ops iwl6030_lib = {
         .set_hw_params = iwl6000_hw_set_hw_params,
         .set_channel_switch = iwl6000_hw_channel_switch,
         .nic_config = iwl6000_nic_config,
-        .eeprom_ops = {
-                .regulatory_bands = {
-                        EEPROM_REG_BAND_1_CHANNELS,
-                        EEPROM_REG_BAND_2_CHANNELS,
-                        EEPROM_REG_BAND_3_CHANNELS,
-                        EEPROM_REG_BAND_4_CHANNELS,
-                        EEPROM_REG_BAND_5_CHANNELS,
-                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
-                        EEPROM_REG_BAND_52_HT40_CHANNELS
-                },
-                .enhanced_txpower = true,
-        },
         .temperature = iwlagn_temperature,
 };
diff --git a/drivers/net/wireless/iwlwifi/iwl-led.c b/drivers/net/wireless/iwlwifi/dvm/led.c
index 47000419f916..bf479f709091 100644
--- a/drivers/net/wireless/iwlwifi/iwl-led.c
+++ b/drivers/net/wireless/iwlwifi/dvm/led.c
@@ -34,12 +34,11 @@
 #include <net/mac80211.h>
 #include <linux/etherdevice.h>
 #include <asm/unaligned.h>
-
-#include "iwl-dev.h"
-#include "iwl-agn.h"
 #include "iwl-io.h"
 #include "iwl-trans.h"
 #include "iwl-modparams.h"
+#include "dev.h"
+#include "agn.h"
 
 /* Throughput           OFF time(ms)    ON time (ms)
  *      >300                    25              25
diff --git a/drivers/net/wireless/iwlwifi/iwl-led.h b/drivers/net/wireless/iwlwifi/dvm/led.h
index b02a853103d3..b02a853103d3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-led.h
+++ b/drivers/net/wireless/iwlwifi/dvm/led.h
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/dvm/lib.c
index e55ec6c8a920..76f259283c3a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+++ b/drivers/net/wireless/iwlwifi/dvm/lib.c
@@ -33,13 +33,14 @@
 #include <linux/sched.h>
 #include <net/mac80211.h>
 
-#include "iwl-dev.h"
 #include "iwl-io.h"
 #include "iwl-agn-hw.h"
-#include "iwl-agn.h"
 #include "iwl-trans.h"
 #include "iwl-modparams.h"
 
+#include "dev.h"
+#include "agn.h"
+
 int iwlagn_hw_valid_rtc_data_addr(u32 addr)
 {
         return (addr >= IWLAGN_RTC_DATA_LOWER_BOUND) &&
@@ -58,8 +59,7 @@ int iwlagn_send_tx_power(struct iwl_priv *priv)
         /* half dBm need to multiply */
         tx_power_cmd.global_lmt = (s8)(2 * priv->tx_power_user_lmt);
 
-        if (priv->tx_power_lmt_in_half_dbm &&
-            priv->tx_power_lmt_in_half_dbm < tx_power_cmd.global_lmt) {
+        if (tx_power_cmd.global_lmt > priv->eeprom_data->max_tx_pwr_half_dbm) {
                 /*
                  * For the newer devices which using enhanced/extend tx power
                  * table in EEPROM, the format is in half dBm. driver need to
@@ -71,7 +71,8 @@ int iwlagn_send_tx_power(struct iwl_priv *priv)
                  * "tx_power_user_lmt" is higher than EEPROM value (in
                  * half-dBm format), lower the tx power based on EEPROM
                  */
-                tx_power_cmd.global_lmt = priv->tx_power_lmt_in_half_dbm;
+                tx_power_cmd.global_lmt =
+                        priv->eeprom_data->max_tx_pwr_half_dbm;
         }
         tx_power_cmd.flags = IWLAGN_TX_POWER_NO_CLOSED;
         tx_power_cmd.srv_chan_lmt = IWLAGN_TX_POWER_AUTO;
@@ -617,6 +618,11 @@ static bool iwlagn_fill_txpower_mode(struct iwl_priv *priv,
         struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
         int ave_rssi;
 
+        if (!ctx->vif || (ctx->vif->type != NL80211_IFTYPE_STATION)) {
+                IWL_DEBUG_INFO(priv, "BSS ctx not active or not in sta mode\n");
+                return false;
+        }
+
         ave_rssi = ieee80211_ave_rssi(ctx->vif);
         if (!ave_rssi) {
                 /* no rssi data, no changes to reduce tx power */
@@ -818,7 +824,7 @@ void iwlagn_set_rxon_chain(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
         if (priv->chain_noise_data.active_chains)
                 active_chains = priv->chain_noise_data.active_chains;
         else
-                active_chains = priv->hw_params.valid_rx_ant;
+                active_chains = priv->eeprom_data->valid_rx_ant;
 
         if (priv->cfg->bt_params &&
             priv->cfg->bt_params->advanced_bt_coexist &&
@@ -1259,7 +1265,7 @@ int iwl_dvm_send_cmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
          * the mutex, this ensures we don't try to send two
          * (or more) synchronous commands at a time.
          */
-        if (cmd->flags & CMD_SYNC)
+        if (!(cmd->flags & CMD_ASYNC))
                 lockdep_assert_held(&priv->mutex);
 
         if (priv->ucode_owner == IWL_OWNERSHIP_TM &&
diff --git a/drivers/net/wireless/iwlwifi/iwl-mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index 3ee23134c02b..9d2374862314 100644
--- a/drivers/net/wireless/iwlwifi/iwl-mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -38,19 +38,20 @@
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
 
+#include <net/ieee80211_radiotap.h>
 #include <net/mac80211.h>
 
 #include <asm/div64.h>
 
-#include "iwl-eeprom.h"
-#include "iwl-dev.h"
 #include "iwl-io.h"
-#include "iwl-agn-calib.h"
-#include "iwl-agn.h"
 #include "iwl-trans.h"
 #include "iwl-op-mode.h"
 #include "iwl-modparams.h"
 
+#include "dev.h"
+#include "calib.h"
+#include "agn.h"
+
 /*****************************************************************************
  *
  * mac80211 entry point functions
@@ -154,6 +155,7 @@ int iwlagn_mac_setup_register(struct iwl_priv *priv,
                     IEEE80211_HW_SCAN_WHILE_IDLE;
 
         hw->offchannel_tx_hw_queue = IWL_AUX_QUEUE;
+        hw->radiotap_mcs_details |= IEEE80211_RADIOTAP_MCS_HAVE_FMT;
 
         /*
          * Including the following line will crash some AP's.  This
@@ -237,12 +239,12 @@ int iwlagn_mac_setup_register(struct iwl_priv *priv,
 
         hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
 
-        if (priv->bands[IEEE80211_BAND_2GHZ].n_channels)
+        if (priv->eeprom_data->bands[IEEE80211_BAND_2GHZ].n_channels)
                 priv->hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
-                        &priv->bands[IEEE80211_BAND_2GHZ];
-        if (priv->bands[IEEE80211_BAND_5GHZ].n_channels)
+                        &priv->eeprom_data->bands[IEEE80211_BAND_2GHZ];
+        if (priv->eeprom_data->bands[IEEE80211_BAND_5GHZ].n_channels)
                 priv->hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
-                        &priv->bands[IEEE80211_BAND_5GHZ];
+                        &priv->eeprom_data->bands[IEEE80211_BAND_5GHZ];
 
         hw->wiphy->hw_version = priv->trans->hw_id;
 
@@ -341,7 +343,7 @@ static int iwlagn_mac_start(struct ieee80211_hw *hw)
         return 0;
 }
 
-void iwlagn_mac_stop(struct ieee80211_hw *hw)
+static void iwlagn_mac_stop(struct ieee80211_hw *hw)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
 
@@ -369,9 +371,9 @@ void iwlagn_mac_stop(struct ieee80211_hw *hw)
         IWL_DEBUG_MAC80211(priv, "leave\n");
 }
 
-void iwlagn_mac_set_rekey_data(struct ieee80211_hw *hw,
-                               struct ieee80211_vif *vif,
-                               struct cfg80211_gtk_rekey_data *data)
+static void iwlagn_mac_set_rekey_data(struct ieee80211_hw *hw,
+                                      struct ieee80211_vif *vif,
+                                      struct cfg80211_gtk_rekey_data *data)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
 
@@ -397,7 +399,8 @@ void iwlagn_mac_set_rekey_data(struct ieee80211_hw *hw,
 
 #ifdef CONFIG_PM_SLEEP
 
-int iwlagn_mac_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
+static int iwlagn_mac_suspend(struct ieee80211_hw *hw,
+                              struct cfg80211_wowlan *wowlan)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
         struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
@@ -420,8 +423,6 @@ int iwlagn_mac_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
         if (ret)
                 goto error;
 
-        device_set_wakeup_enable(priv->trans->dev, true);
-
         iwl_trans_wowlan_suspend(priv->trans);
 
         goto out;
@@ -475,7 +476,7 @@ static int iwlagn_mac_resume(struct ieee80211_hw *hw)
                         }
 
                         if (priv->wowlan_sram)
-                                _iwl_read_targ_mem_words(
+                                _iwl_read_targ_mem_dwords(
                                       priv->trans, 0x800000,
                                       priv->wowlan_sram,
                                       img->sec[IWL_UCODE_SECTION_DATA].len / 4);
@@ -488,8 +489,6 @@ static int iwlagn_mac_resume(struct ieee80211_hw *hw)
 
         priv->wowlan = false;
 
-        device_set_wakeup_enable(priv->trans->dev, false);
-
         iwlagn_prepare_restart(priv);
 
         memset((void *)&ctx->active, 0, sizeof(ctx->active));
@@ -504,9 +503,15 @@ static int iwlagn_mac_resume(struct ieee80211_hw *hw)
         return 1;
 }
 
+static void iwlagn_mac_set_wakeup(struct ieee80211_hw *hw, bool enabled)
+{
+        struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
+
+        device_set_wakeup_enable(priv->trans->dev, enabled);
+}
 #endif
 
-void iwlagn_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+static void iwlagn_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
 
@@ -517,21 +522,21 @@ void iwlagn_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 dev_kfree_skb_any(skb);
 }
 
-void iwlagn_mac_update_tkip_key(struct ieee80211_hw *hw,
-                                struct ieee80211_vif *vif,
-                                struct ieee80211_key_conf *keyconf,
-                                struct ieee80211_sta *sta,
-                                u32 iv32, u16 *phase1key)
+static void iwlagn_mac_update_tkip_key(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif,
+                                       struct ieee80211_key_conf *keyconf,
+                                       struct ieee80211_sta *sta,
+                                       u32 iv32, u16 *phase1key)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
 
         iwl_update_tkip_key(priv, vif, keyconf, sta, iv32, phase1key);
 }
 
-int iwlagn_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
-                       struct ieee80211_vif *vif,
-                       struct ieee80211_sta *sta,
-                       struct ieee80211_key_conf *key)
+static int iwlagn_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+                              struct ieee80211_vif *vif,
+                              struct ieee80211_sta *sta,
+                              struct ieee80211_key_conf *key)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
         struct iwl_vif_priv *vif_priv = (void *)vif->drv_priv;
@@ -631,11 +636,11 @@ int iwlagn_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         return ret;
 }
 
-int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
-                            struct ieee80211_vif *vif,
-                            enum ieee80211_ampdu_mlme_action action,
-                            struct ieee80211_sta *sta, u16 tid, u16 *ssn,
-                            u8 buf_size)
+static int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
+                                   struct ieee80211_vif *vif,
+                                   enum ieee80211_ampdu_mlme_action action,
+                                   struct ieee80211_sta *sta, u16 tid, u16 *ssn,
+                                   u8 buf_size)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
         int ret = -EINVAL;
@@ -662,7 +667,7 @@ int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw,
                 ret = iwl_sta_rx_agg_stop(priv, sta, tid);
                 break;
         case IEEE80211_AMPDU_TX_START:
-                if (!priv->trans->ops->tx_agg_setup)
+                if (!priv->trans->ops->txq_enable)
                         break;
                 if (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_TXAGG)
                         break;
@@ -757,11 +762,11 @@ static int iwlagn_mac_sta_remove(struct ieee80211_hw *hw,
         return ret;
 }
 
-int iwlagn_mac_sta_state(struct ieee80211_hw *hw,
-                         struct ieee80211_vif *vif,
-                         struct ieee80211_sta *sta,
-                         enum ieee80211_sta_state old_state,
-                         enum ieee80211_sta_state new_state)
+static int iwlagn_mac_sta_state(struct ieee80211_hw *hw,
+                                struct ieee80211_vif *vif,
+                                struct ieee80211_sta *sta,
+                                enum ieee80211_sta_state old_state,
+                                enum ieee80211_sta_state new_state)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
         struct iwl_vif_priv *vif_priv = (void *)vif->drv_priv;
@@ -840,11 +845,10 @@ int iwlagn_mac_sta_state(struct ieee80211_hw *hw,
         return ret;
 }
 
-void iwlagn_mac_channel_switch(struct ieee80211_hw *hw,
-                               struct ieee80211_channel_switch *ch_switch)
+static void iwlagn_mac_channel_switch(struct ieee80211_hw *hw,
+                                      struct ieee80211_channel_switch *ch_switch)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
-        const struct iwl_channel_info *ch_info;
         struct ieee80211_conf *conf = &hw->conf;
         struct ieee80211_channel *channel = ch_switch->channel;
         struct iwl_ht_config *ht_conf = &priv->current_ht_config;
@@ -881,12 +885,6 @@ void iwlagn_mac_channel_switch(struct ieee80211_hw *hw,
         if (le16_to_cpu(ctx->active.channel) == ch)
                 goto out;
 
-        ch_info = iwl_get_channel_info(priv, channel->band, ch);
-        if (!is_channel_valid(ch_info)) {
-                IWL_DEBUG_MAC80211(priv, "invalid channel\n");
-                goto out;
-        }
-
         priv->current_ht_config.smps = conf->smps_mode;
 
         /* Configure HT40 channels */
@@ -935,10 +933,10 @@ void iwl_chswitch_done(struct iwl_priv *priv, bool is_success)
                 ieee80211_chswitch_done(ctx->vif, is_success);
 }
 
-void iwlagn_configure_filter(struct ieee80211_hw *hw,
-                             unsigned int changed_flags,
-                             unsigned int *total_flags,
-                             u64 multicast)
+static void iwlagn_configure_filter(struct ieee80211_hw *hw,
+                                    unsigned int changed_flags,
+                                    unsigned int *total_flags,
+                                    u64 multicast)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
         __le32 filter_or = 0, filter_nand = 0;
@@ -985,7 +983,7 @@ void iwlagn_configure_filter(struct ieee80211_hw *hw,
                         FIF_BCN_PRBRESP_PROMISC | FIF_CONTROL;
 }
 
-void iwlagn_mac_flush(struct ieee80211_hw *hw, bool drop)
+static void iwlagn_mac_flush(struct ieee80211_hw *hw, bool drop)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
 
@@ -1112,7 +1110,7 @@ static int iwlagn_mac_remain_on_channel(struct ieee80211_hw *hw,
         return err;
 }
 
-int iwlagn_mac_cancel_remain_on_channel(struct ieee80211_hw *hw)
+static int iwlagn_mac_cancel_remain_on_channel(struct ieee80211_hw *hw)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
 
@@ -1129,8 +1127,8 @@ int iwlagn_mac_cancel_remain_on_channel(struct ieee80211_hw *hw)
         return 0;
 }
 
-void iwlagn_mac_rssi_callback(struct ieee80211_hw *hw,
-                              enum ieee80211_rssi_event rssi_event)
+static void iwlagn_mac_rssi_callback(struct ieee80211_hw *hw,
+                                     enum ieee80211_rssi_event rssi_event)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
 
@@ -1154,8 +1152,8 @@ void iwlagn_mac_rssi_callback(struct ieee80211_hw *hw,
         IWL_DEBUG_MAC80211(priv, "leave\n");
 }
 
-int iwlagn_mac_set_tim(struct ieee80211_hw *hw,
-                       struct ieee80211_sta *sta, bool set)
+static int iwlagn_mac_set_tim(struct ieee80211_hw *hw,
+                              struct ieee80211_sta *sta, bool set)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
 
@@ -1164,9 +1162,9 @@ int iwlagn_mac_set_tim(struct ieee80211_hw *hw,
         return 0;
 }
 
-int iwlagn_mac_conf_tx(struct ieee80211_hw *hw,
-                       struct ieee80211_vif *vif, u16 queue,
-                       const struct ieee80211_tx_queue_params *params)
+static int iwlagn_mac_conf_tx(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif, u16 queue,
+                              const struct ieee80211_tx_queue_params *params)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
         struct iwl_vif_priv *vif_priv = (void *)vif->drv_priv;
@@ -1208,7 +1206,7 @@ int iwlagn_mac_conf_tx(struct ieee80211_hw *hw,
         return 0;
 }
 
-int iwlagn_mac_tx_last_beacon(struct ieee80211_hw *hw)
+static int iwlagn_mac_tx_last_beacon(struct ieee80211_hw *hw)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
 
@@ -1224,7 +1222,8 @@ static int iwl_set_mode(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
         return iwlagn_commit_rxon(priv, ctx);
 }
 
-int iwl_setup_interface(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
+static int iwl_setup_interface(struct iwl_priv *priv,
+                               struct iwl_rxon_context *ctx)
 {
         struct ieee80211_vif *vif = ctx->vif;
         int err, ac;
@@ -1344,9 +1343,9 @@ static int iwlagn_mac_add_interface(struct ieee80211_hw *hw,
         return err;
 }
 
-void iwl_teardown_interface(struct iwl_priv *priv,
-                            struct ieee80211_vif *vif,
-                            bool mode_change)
+static void iwl_teardown_interface(struct iwl_priv *priv,
+                                   struct ieee80211_vif *vif,
+                                   bool mode_change)
 {
         struct iwl_rxon_context *ctx = iwl_rxon_ctx_from_vif(vif);
 
@@ -1487,9 +1486,9 @@ static int iwlagn_mac_change_interface(struct ieee80211_hw *hw,
         return err;
 }
 
-int iwlagn_mac_hw_scan(struct ieee80211_hw *hw,
-                       struct ieee80211_vif *vif,
-                       struct cfg80211_scan_request *req)
+static int iwlagn_mac_hw_scan(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif,
+                              struct cfg80211_scan_request *req)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
         int ret;
@@ -1544,10 +1543,10 @@ static void iwl_sta_modify_ps_wake(struct iwl_priv *priv, int sta_id)
         iwl_send_add_sta(priv, &cmd, CMD_ASYNC);
 }
 
-void iwlagn_mac_sta_notify(struct ieee80211_hw *hw,
-                           struct ieee80211_vif *vif,
-                           enum sta_notify_cmd cmd,
-                           struct ieee80211_sta *sta)
+static void iwlagn_mac_sta_notify(struct ieee80211_hw *hw,
+                                  struct ieee80211_vif *vif,
+                                  enum sta_notify_cmd cmd,
+                                  struct ieee80211_sta *sta)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
         struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
@@ -1584,6 +1583,7 @@ struct ieee80211_ops iwlagn_hw_ops = {
 #ifdef CONFIG_PM_SLEEP
         .suspend = iwlagn_mac_suspend,
         .resume = iwlagn_mac_resume,
+        .set_wakeup = iwlagn_mac_set_wakeup,
 #endif
         .add_interface = iwlagn_mac_add_interface,
         .remove_interface = iwlagn_mac_remove_interface,
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/dvm/main.c
index ec36e2b020b6..e620af3d592d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/dvm/main.c
@@ -44,16 +44,18 @@
 
 #include <asm/div64.h>
 
-#include "iwl-eeprom.h"
-#include "iwl-dev.h"
+#include "iwl-eeprom-read.h"
+#include "iwl-eeprom-parse.h"
 #include "iwl-io.h"
-#include "iwl-agn-calib.h"
-#include "iwl-agn.h"
 #include "iwl-trans.h"
 #include "iwl-op-mode.h"
 #include "iwl-drv.h"
 #include "iwl-modparams.h"
 
+#include "dev.h"
+#include "calib.h"
+#include "agn.h"
+
 /******************************************************************************
  *
  * module boiler plate
@@ -78,7 +80,8 @@ MODULE_DESCRIPTION(DRV_DESCRIPTION);
 MODULE_VERSION(DRV_VERSION);
 MODULE_AUTHOR(DRV_COPYRIGHT " " DRV_AUTHOR);
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("iwlagn");
+
+static const struct iwl_op_mode_ops iwl_dvm_ops;
 
 void iwl_update_chain_flags(struct iwl_priv *priv)
 {
@@ -180,7 +183,7 @@ int iwlagn_send_beacon_cmd(struct iwl_priv *priv)
                 rate = info->control.rates[0].idx;
 
         priv->mgmt_tx_ant = iwl_toggle_tx_ant(priv, priv->mgmt_tx_ant,
-                                              priv->hw_params.valid_tx_ant);
+                                              priv->eeprom_data->valid_tx_ant);
         rate_flags = iwl_ant_idx_to_flags(priv->mgmt_tx_ant);
 
         /* In mac80211, rates for 5 GHz start at 0 */
@@ -403,7 +406,7 @@ static void iwl_continuous_event_trace(struct iwl_priv *priv)
 
         base = priv->device_pointers.log_event_table;
         if (iwlagn_hw_valid_rtc_data_addr(base)) {
-                iwl_read_targ_mem_words(priv->trans, base, &read, sizeof(read));
+                iwl_read_targ_mem_bytes(priv->trans, base, &read, sizeof(read));
                 capacity = read.capacity;
                 mode = read.mode;
                 num_wraps = read.wrap_counter;
@@ -578,7 +581,7 @@ static const u8 iwlagn_pan_ac_to_queue[] = {
         7, 6, 5, 4,
 };
 
-void iwl_init_context(struct iwl_priv *priv, u32 ucode_flags)
+static void iwl_init_context(struct iwl_priv *priv, u32 ucode_flags)
 {
         int i;
 
@@ -645,7 +648,7 @@ void iwl_init_context(struct iwl_priv *priv, u32 ucode_flags)
         BUILD_BUG_ON(NUM_IWL_RXON_CTX != 2);
 }
 
-void iwl_rf_kill_ct_config(struct iwl_priv *priv)
+static void iwl_rf_kill_ct_config(struct iwl_priv *priv)
 {
         struct iwl_ct_kill_config cmd;
         struct iwl_ct_kill_throttling_config adv_cmd;
@@ -726,7 +729,7 @@ static int iwlagn_send_tx_ant_config(struct iwl_priv *priv, u8 valid_tx_ant)
         }
 }
 
-void iwl_send_bt_config(struct iwl_priv *priv)
+static void iwl_send_bt_config(struct iwl_priv *priv)
 {
         struct iwl_bt_cmd bt_cmd = {
                 .lead_time = BT_LEAD_TIME_DEF,
@@ -814,7 +817,7 @@ int iwl_alive_start(struct iwl_priv *priv)
         ieee80211_wake_queues(priv->hw);
 
         /* Configure Tx antenna selection based on H/W config */
-        iwlagn_send_tx_ant_config(priv, priv->hw_params.valid_tx_ant);
+        iwlagn_send_tx_ant_config(priv, priv->eeprom_data->valid_tx_ant);
 
         if (iwl_is_associated_ctx(ctx) && !priv->wowlan) {
                 struct iwl_rxon_cmd *active_rxon =
@@ -932,11 +935,12 @@ void iwl_down(struct iwl_priv *priv)
         priv->ucode_loaded = false;
         iwl_trans_stop_device(priv->trans);
 
+        /* Set num_aux_in_flight must be done after the transport is stopped */
+        atomic_set(&priv->num_aux_in_flight, 0);
+
         /* Clear out all status bits but a few that are stable across reset */
         priv->status &= test_bit(STATUS_RF_KILL_HW, &priv->status) <<
                                 STATUS_RF_KILL_HW |
-                        test_bit(STATUS_GEO_CONFIGURED, &priv->status) <<
-                                STATUS_GEO_CONFIGURED |
                         test_bit(STATUS_FW_ERROR, &priv->status) <<
                                 STATUS_FW_ERROR |
                         test_bit(STATUS_EXIT_PENDING, &priv->status) <<
@@ -1078,7 +1082,7 @@ static void iwlagn_disable_roc_work(struct work_struct *work)
  *
  *****************************************************************************/
 
-void iwl_setup_deferred_work(struct iwl_priv *priv)
+static void iwl_setup_deferred_work(struct iwl_priv *priv)
 {
         priv->workqueue = create_singlethread_workqueue(DRV_NAME);
 
@@ -1123,224 +1127,14 @@ void iwl_cancel_deferred_work(struct iwl_priv *priv)
         del_timer_sync(&priv->ucode_trace);
 }
 
-static void iwl_init_hw_rates(struct ieee80211_rate *rates)
-{
-        int i;
-
-        for (i = 0; i < IWL_RATE_COUNT_LEGACY; i++) {
-                rates[i].bitrate = iwl_rates[i].ieee * 5;
-                rates[i].hw_value = i; /* Rate scaling will work on indexes */
-                rates[i].hw_value_short = i;
-                rates[i].flags = 0;
-                if ((i >= IWL_FIRST_CCK_RATE) && (i <= IWL_LAST_CCK_RATE)) {
-                        /*
-                         * If CCK != 1M then set short preamble rate flag.
-                         */
-                        rates[i].flags |=
-                                (iwl_rates[i].plcp == IWL_RATE_1M_PLCP) ?
-                                        0 : IEEE80211_RATE_SHORT_PREAMBLE;
-                }
-        }
-}
-
-#define MAX_BIT_RATE_40_MHZ 150 /* Mbps */
-#define MAX_BIT_RATE_20_MHZ 72 /* Mbps */
-static void iwl_init_ht_hw_capab(const struct iwl_priv *priv,
-                              struct ieee80211_sta_ht_cap *ht_info,
-                              enum ieee80211_band band)
-{
-        u16 max_bit_rate = 0;
-        u8 rx_chains_num = priv->hw_params.rx_chains_num;
-        u8 tx_chains_num = priv->hw_params.tx_chains_num;
-
-        ht_info->cap = 0;
-        memset(&ht_info->mcs, 0, sizeof(ht_info->mcs));
-
-        ht_info->ht_supported = true;
-
-        if (priv->cfg->ht_params &&
-            priv->cfg->ht_params->ht_greenfield_support)
-                ht_info->cap |= IEEE80211_HT_CAP_GRN_FLD;
-        ht_info->cap |= IEEE80211_HT_CAP_SGI_20;
-        max_bit_rate = MAX_BIT_RATE_20_MHZ;
-        if (priv->hw_params.ht40_channel & BIT(band)) {
-                ht_info->cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-                ht_info->cap |= IEEE80211_HT_CAP_SGI_40;
-                ht_info->mcs.rx_mask[4] = 0x01;
-                max_bit_rate = MAX_BIT_RATE_40_MHZ;
-        }
-
-        if (iwlwifi_mod_params.amsdu_size_8K)
-                ht_info->cap |= IEEE80211_HT_CAP_MAX_AMSDU;
-
-        ht_info->ampdu_factor = CFG_HT_RX_AMPDU_FACTOR_DEF;
-        ht_info->ampdu_density = CFG_HT_MPDU_DENSITY_DEF;
-
-        ht_info->mcs.rx_mask[0] = 0xFF;
-        if (rx_chains_num >= 2)
-                ht_info->mcs.rx_mask[1] = 0xFF;
-        if (rx_chains_num >= 3)
-                ht_info->mcs.rx_mask[2] = 0xFF;
-
-        /* Highest supported Rx data rate */
-        max_bit_rate *= rx_chains_num;
-        WARN_ON(max_bit_rate & ~IEEE80211_HT_MCS_RX_HIGHEST_MASK);
-        ht_info->mcs.rx_highest = cpu_to_le16(max_bit_rate);
-
-        /* Tx MCS capabilities */
-        ht_info->mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
-        if (tx_chains_num != rx_chains_num) {
-                ht_info->mcs.tx_params |= IEEE80211_HT_MCS_TX_RX_DIFF;
-                ht_info->mcs.tx_params |= ((tx_chains_num - 1) <<
-                                IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT);
-        }
-}
-
-/**
- * iwl_init_geos - Initialize mac80211's geo/channel info based from eeprom
- */
-static int iwl_init_geos(struct iwl_priv *priv)
-{
-        struct iwl_channel_info *ch;
-        struct ieee80211_supported_band *sband;
-        struct ieee80211_channel *channels;
-        struct ieee80211_channel *geo_ch;
-        struct ieee80211_rate *rates;
-        int i = 0;
-        s8 max_tx_power = IWLAGN_TX_POWER_TARGET_POWER_MIN;
-
-        if (priv->bands[IEEE80211_BAND_2GHZ].n_bitrates ||
-            priv->bands[IEEE80211_BAND_5GHZ].n_bitrates) {
-                IWL_DEBUG_INFO(priv, "Geography modes already initialized.\n");
-                set_bit(STATUS_GEO_CONFIGURED, &priv->status);
-                return 0;
-        }
-
-        channels = kcalloc(priv->channel_count,
-                           sizeof(struct ieee80211_channel), GFP_KERNEL);
-        if (!channels)
-                return -ENOMEM;
-
-        rates = kcalloc(IWL_RATE_COUNT_LEGACY, sizeof(struct ieee80211_rate),
-                        GFP_KERNEL);
-        if (!rates) {
-                kfree(channels);
-                return -ENOMEM;
-        }
-
-        /* 5.2GHz channels start after the 2.4GHz channels */
-        sband = &priv->bands[IEEE80211_BAND_5GHZ];
-        sband->channels = &channels[ARRAY_SIZE(iwl_eeprom_band_1)];
-        /* just OFDM */
-        sband->bitrates = &rates[IWL_FIRST_OFDM_RATE];
-        sband->n_bitrates = IWL_RATE_COUNT_LEGACY - IWL_FIRST_OFDM_RATE;
-
-        if (priv->hw_params.sku & EEPROM_SKU_CAP_11N_ENABLE)
-                iwl_init_ht_hw_capab(priv, &sband->ht_cap,
-                                         IEEE80211_BAND_5GHZ);
-
-        sband = &priv->bands[IEEE80211_BAND_2GHZ];
-        sband->channels = channels;
-        /* OFDM & CCK */
-        sband->bitrates = rates;
-        sband->n_bitrates = IWL_RATE_COUNT_LEGACY;
-
-        if (priv->hw_params.sku & EEPROM_SKU_CAP_11N_ENABLE)
-                iwl_init_ht_hw_capab(priv, &sband->ht_cap,
-                                         IEEE80211_BAND_2GHZ);
-
-        priv->ieee_channels = channels;
-        priv->ieee_rates = rates;
-
-        for (i = 0;  i < priv->channel_count; i++) {
-                ch = &priv->channel_info[i];
-
-                /* FIXME: might be removed if scan is OK */
-                if (!is_channel_valid(ch))
-                        continue;
-
-                sband =  &priv->bands[ch->band];
-
-                geo_ch = &sband->channels[sband->n_channels++];
-
-                geo_ch->center_freq =
-                        ieee80211_channel_to_frequency(ch->channel, ch->band);
-                geo_ch->max_power = ch->max_power_avg;
-                geo_ch->max_antenna_gain = 0xff;
-                geo_ch->hw_value = ch->channel;
-
-                if (is_channel_valid(ch)) {
-                        if (!(ch->flags & EEPROM_CHANNEL_IBSS))
-                                geo_ch->flags |= IEEE80211_CHAN_NO_IBSS;
-
-                        if (!(ch->flags & EEPROM_CHANNEL_ACTIVE))
-                                geo_ch->flags |= IEEE80211_CHAN_PASSIVE_SCAN;
-
-                        if (ch->flags & EEPROM_CHANNEL_RADAR)
-                                geo_ch->flags |= IEEE80211_CHAN_RADAR;
-
-                        geo_ch->flags |= ch->ht40_extension_channel;
-
-                        if (ch->max_power_avg > max_tx_power)
-                                max_tx_power = ch->max_power_avg;
-                } else {
-                        geo_ch->flags |= IEEE80211_CHAN_DISABLED;
-                }
-
-                IWL_DEBUG_INFO(priv, "Channel %d Freq=%d[%sGHz] %s flag=0x%X\n",
-                                ch->channel, geo_ch->center_freq,
-                                is_channel_a_band(ch) ?  "5.2" : "2.4",
-                                geo_ch->flags & IEEE80211_CHAN_DISABLED ?
-                                "restricted" : "valid",
-                                 geo_ch->flags);
-        }
-
-        priv->tx_power_device_lmt = max_tx_power;
-        priv->tx_power_user_lmt = max_tx_power;
-        priv->tx_power_next = max_tx_power;
-
-        if ((priv->bands[IEEE80211_BAND_5GHZ].n_channels == 0) &&
-             priv->hw_params.sku & EEPROM_SKU_CAP_BAND_52GHZ) {
-                IWL_INFO(priv, "Incorrectly detected BG card as ABG. "
-                        "Please send your %s to maintainer.\n",
-                        priv->trans->hw_id_str);
-                priv->hw_params.sku &= ~EEPROM_SKU_CAP_BAND_52GHZ;
-        }
-
-        if (iwlwifi_mod_params.disable_5ghz)
-                priv->bands[IEEE80211_BAND_5GHZ].n_channels = 0;
-
-        IWL_INFO(priv, "Tunable channels: %d 802.11bg, %d 802.11a channels\n",
-                   priv->bands[IEEE80211_BAND_2GHZ].n_channels,
-                   priv->bands[IEEE80211_BAND_5GHZ].n_channels);
-
-        set_bit(STATUS_GEO_CONFIGURED, &priv->status);
-
-        return 0;
-}
-
-/*
- * iwl_free_geos - undo allocations in iwl_init_geos
- */
-static void iwl_free_geos(struct iwl_priv *priv)
+static int iwl_init_drv(struct iwl_priv *priv)
 {
-        kfree(priv->ieee_channels);
-        kfree(priv->ieee_rates);
-        clear_bit(STATUS_GEO_CONFIGURED, &priv->status);
-}
-
-int iwl_init_drv(struct iwl_priv *priv)
-{
-        int ret;
-
         spin_lock_init(&priv->sta_lock);
 
         mutex_init(&priv->mutex);
 
         INIT_LIST_HEAD(&priv->calib_results);
 
-        priv->ieee_channels = NULL;
-        priv->ieee_rates = NULL;
         priv->band = IEEE80211_BAND_2GHZ;
 
         priv->plcp_delta_threshold =
@@ -1371,31 +1165,11 @@ int iwl_init_drv(struct iwl_priv *priv)
                 priv->dynamic_frag_thresh = BT_FRAG_THRESHOLD_DEF;
         }
 
-        ret = iwl_init_channel_map(priv);
-        if (ret) {
-                IWL_ERR(priv, "initializing regulatory failed: %d\n", ret);
-                goto err;
-        }
-
-        ret = iwl_init_geos(priv);
-        if (ret) {
-                IWL_ERR(priv, "initializing geos failed: %d\n", ret);
-                goto err_free_channel_map;
-        }
-        iwl_init_hw_rates(priv->ieee_rates);
-
         return 0;
-
-err_free_channel_map:
-        iwl_free_channel_map(priv);
-err:
-        return ret;
 }
 
-void iwl_uninit_drv(struct iwl_priv *priv)
+static void iwl_uninit_drv(struct iwl_priv *priv)
 {
-        iwl_free_geos(priv);
-        iwl_free_channel_map(priv);
         kfree(priv->scan_cmd);
         kfree(priv->beacon_cmd);
         kfree(rcu_dereference_raw(priv->noa_data));
@@ -1405,7 +1179,7 @@ void iwl_uninit_drv(struct iwl_priv *priv)
 #endif
 }
 
-void iwl_set_hw_params(struct iwl_priv *priv)
+static void iwl_set_hw_params(struct iwl_priv *priv)
 {
         if (priv->cfg->ht_params)
                 priv->hw_params.use_rts_for_aggregation =
@@ -1421,7 +1195,7 @@ void iwl_set_hw_params(struct iwl_priv *priv)
 
 
 /* show what optional capabilities we have */
-void iwl_option_config(struct iwl_priv *priv)
+static void iwl_option_config(struct iwl_priv *priv)
 {
 #ifdef CONFIG_IWLWIFI_DEBUG
         IWL_INFO(priv, "CONFIG_IWLWIFI_DEBUG enabled\n");
@@ -1454,6 +1228,42 @@ void iwl_option_config(struct iwl_priv *priv)
 #endif
 }
 
+static int iwl_eeprom_init_hw_params(struct iwl_priv *priv)
+{
+        u16 radio_cfg;
+
+        priv->hw_params.sku = priv->eeprom_data->sku;
+
+        if (priv->hw_params.sku & EEPROM_SKU_CAP_11N_ENABLE &&
+            !priv->cfg->ht_params) {
+                IWL_ERR(priv, "Invalid 11n configuration\n");
+                return -EINVAL;
+        }
+
+        if (!priv->hw_params.sku) {
+                IWL_ERR(priv, "Invalid device sku\n");
+                return -EINVAL;
+        }
+
+        IWL_INFO(priv, "Device SKU: 0x%X\n", priv->hw_params.sku);
+
+        radio_cfg = priv->eeprom_data->radio_cfg;
+
+        priv->hw_params.tx_chains_num =
+                num_of_ant(priv->eeprom_data->valid_tx_ant);
+        if (priv->cfg->rx_with_siso_diversity)
+                priv->hw_params.rx_chains_num = 1;
+        else
+                priv->hw_params.rx_chains_num =
+                        num_of_ant(priv->eeprom_data->valid_rx_ant);
+
+        IWL_INFO(priv, "Valid Tx ant: 0x%X, Valid Rx ant: 0x%X\n",
+                 priv->eeprom_data->valid_tx_ant,
+                 priv->eeprom_data->valid_rx_ant);
+
+        return 0;
+}
+
 static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
                                                  const struct iwl_cfg *cfg,
                                                  const struct iwl_fw *fw)
@@ -1539,7 +1349,7 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
                 trans_cfg.queue_watchdog_timeout =
                         priv->cfg->base_params->wd_timeout;
         else
-                trans_cfg.queue_watchdog_timeout = IWL_WATCHHDOG_DISABLED;
+                trans_cfg.queue_watchdog_timeout = IWL_WATCHDOG_DISABLED;
         trans_cfg.command_names = iwl_dvm_cmd_strings;
 
         ucode_flags = fw->ucode_capa.flags;
@@ -1599,25 +1409,33 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
                 goto out_free_hw;
 
         /* Read the EEPROM */
-        if (iwl_eeprom_init(priv, priv->trans->hw_rev)) {
+        if (iwl_read_eeprom(priv->trans, &priv->eeprom_blob,
+                            &priv->eeprom_blob_size)) {
                 IWL_ERR(priv, "Unable to init EEPROM\n");
                 goto out_free_hw;
         }
+
         /* Reset chip to save power until we load uCode during "up". */
         iwl_trans_stop_hw(priv->trans, false);
 
-        if (iwl_eeprom_check_version(priv))
+        priv->eeprom_data = iwl_parse_eeprom_data(priv->trans->dev, priv->cfg,
+                                                  priv->eeprom_blob,
+                                                  priv->eeprom_blob_size);
+        if (!priv->eeprom_data)
+                goto out_free_eeprom_blob;
+
+        if (iwl_eeprom_check_version(priv->eeprom_data, priv->trans))
                 goto out_free_eeprom;
 
         if (iwl_eeprom_init_hw_params(priv))
                 goto out_free_eeprom;
 
         /* extract MAC Address */
-        iwl_eeprom_get_mac(priv, priv->addresses[0].addr);
+        memcpy(priv->addresses[0].addr, priv->eeprom_data->hw_addr, ETH_ALEN);
         IWL_DEBUG_INFO(priv, "MAC address: %pM\n", priv->addresses[0].addr);
         priv->hw->wiphy->addresses = priv->addresses;
         priv->hw->wiphy->n_addresses = 1;
-        num_mac = iwl_eeprom_query16(priv, EEPROM_NUM_MAC_ADDRESS);
+        num_mac = priv->eeprom_data->n_hw_addrs;
         if (num_mac > 1) {
                 memcpy(priv->addresses[1].addr, priv->addresses[0].addr,
                        ETH_ALEN);
@@ -1711,8 +1529,10 @@ out_destroy_workqueue:
         destroy_workqueue(priv->workqueue);
         priv->workqueue = NULL;
         iwl_uninit_drv(priv);
+out_free_eeprom_blob:
+        kfree(priv->eeprom_blob);
 out_free_eeprom:
-        iwl_eeprom_free(priv);
+        iwl_free_eeprom_data(priv->eeprom_data);
 out_free_hw:
         ieee80211_free_hw(priv->hw);
 out:
@@ -1720,7 +1540,7 @@ out:
         return op_mode;
 }
 
-void iwl_op_mode_dvm_stop(struct iwl_op_mode *op_mode)
+static void iwl_op_mode_dvm_stop(struct iwl_op_mode *op_mode)
 {
         struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
 
@@ -1728,7 +1548,7 @@ void iwl_op_mode_dvm_stop(struct iwl_op_mode *op_mode)
 
         iwl_dbgfs_unregister(priv);
 
-        iwl_testmode_cleanup(priv);
+        iwl_testmode_free(priv);
         iwlagn_mac_unregister(priv);
 
         iwl_tt_exit(priv);
@@ -1737,7 +1557,8 @@ void iwl_op_mode_dvm_stop(struct iwl_op_mode *op_mode)
         priv->ucode_loaded = false;
         iwl_trans_stop_device(priv->trans);
 
-        iwl_eeprom_free(priv);
+        kfree(priv->eeprom_blob);
+        iwl_free_eeprom_data(priv->eeprom_data);
 
         /*netif_stop_queue(dev); */
         flush_workqueue(priv->workqueue);
@@ -1850,7 +1671,7 @@ static void iwl_dump_nic_error_log(struct iwl_priv *priv)
         }
 
         /*TODO: Update dbgfs with ISR error stats obtained below */
-        iwl_read_targ_mem_words(trans, base, &table, sizeof(table));
+        iwl_read_targ_mem_bytes(trans, base, &table, sizeof(table));
 
         if (ERROR_START_OFFSET <= table.valid * ERROR_ELEM_SIZE) {
                 IWL_ERR(trans, "Start IWL Error Log Dump:\n");
@@ -2185,7 +2006,7 @@ static void iwlagn_fw_error(struct iwl_priv *priv, bool ondemand)
         }
 }
 
-void iwl_nic_error(struct iwl_op_mode *op_mode)
+static void iwl_nic_error(struct iwl_op_mode *op_mode)
 {
         struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
 
@@ -2198,7 +2019,7 @@ void iwl_nic_error(struct iwl_op_mode *op_mode)
         iwlagn_fw_error(priv, false);
 }
 
-void iwl_cmd_queue_full(struct iwl_op_mode *op_mode)
+static void iwl_cmd_queue_full(struct iwl_op_mode *op_mode)
 {
         struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
 
@@ -2208,9 +2029,49 @@ void iwl_cmd_queue_full(struct iwl_op_mode *op_mode)
         }
 }
 
-void iwl_nic_config(struct iwl_op_mode *op_mode)
+#define EEPROM_RF_CONFIG_TYPE_MAX      0x3
+
+static void iwl_nic_config(struct iwl_op_mode *op_mode)
 {
         struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
+        u16 radio_cfg = priv->eeprom_data->radio_cfg;
+
+        /* SKU Control */
+        iwl_set_bits_mask(priv->trans, CSR_HW_IF_CONFIG_REG,
+                          CSR_HW_IF_CONFIG_REG_MSK_MAC_DASH |
+                          CSR_HW_IF_CONFIG_REG_MSK_MAC_STEP,
+                          (CSR_HW_REV_STEP(priv->trans->hw_rev) <<
+                                CSR_HW_IF_CONFIG_REG_POS_MAC_STEP) |
+                          (CSR_HW_REV_DASH(priv->trans->hw_rev) <<
+                                CSR_HW_IF_CONFIG_REG_POS_MAC_DASH));
+
+        /* write radio config values to register */
+        if (EEPROM_RF_CFG_TYPE_MSK(radio_cfg) <= EEPROM_RF_CONFIG_TYPE_MAX) {
+                u32 reg_val =
+                        EEPROM_RF_CFG_TYPE_MSK(radio_cfg) <<
+                                CSR_HW_IF_CONFIG_REG_POS_PHY_TYPE |
+                        EEPROM_RF_CFG_STEP_MSK(radio_cfg) <<
+                                CSR_HW_IF_CONFIG_REG_POS_PHY_STEP |
+                        EEPROM_RF_CFG_DASH_MSK(radio_cfg) <<
+                                CSR_HW_IF_CONFIG_REG_POS_PHY_DASH;
+
+                iwl_set_bits_mask(priv->trans, CSR_HW_IF_CONFIG_REG,
+                                  CSR_HW_IF_CONFIG_REG_MSK_PHY_TYPE |
+                                  CSR_HW_IF_CONFIG_REG_MSK_PHY_STEP |
+                                  CSR_HW_IF_CONFIG_REG_MSK_PHY_DASH, reg_val);
+
+                IWL_INFO(priv, "Radio type=0x%x-0x%x-0x%x\n",
+                         EEPROM_RF_CFG_TYPE_MSK(radio_cfg),
+                         EEPROM_RF_CFG_STEP_MSK(radio_cfg),
+                         EEPROM_RF_CFG_DASH_MSK(radio_cfg));
+        } else {
+                WARN_ON(1);
+        }
+
+        /* set CSR_HW_CONFIG_REG for uCode use */
+        iwl_set_bit(priv->trans, CSR_HW_IF_CONFIG_REG,
+                    CSR_HW_IF_CONFIG_REG_BIT_RADIO_SI |
+                    CSR_HW_IF_CONFIG_REG_BIT_MAC_SI);
 
         priv->lib->nic_config(priv);
 }
@@ -2223,7 +2084,7 @@ static void iwl_wimax_active(struct iwl_op_mode *op_mode)
         IWL_ERR(priv, "RF is used by WiMAX\n");
 }
 
-void iwl_stop_sw_queue(struct iwl_op_mode *op_mode, int queue)
+static void iwl_stop_sw_queue(struct iwl_op_mode *op_mode, int queue)
 {
         struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
         int mq = priv->queue_to_mac80211[queue];
@@ -2242,7 +2103,7 @@ void iwl_stop_sw_queue(struct iwl_op_mode *op_mode, int queue)
         ieee80211_stop_queue(priv->hw, mq);
 }
 
-void iwl_wake_sw_queue(struct iwl_op_mode *op_mode, int queue)
+static void iwl_wake_sw_queue(struct iwl_op_mode *op_mode, int queue)
 {
         struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
         int mq = priv->queue_to_mac80211[queue];
@@ -2282,16 +2143,17 @@ void iwlagn_lift_passive_no_rx(struct iwl_priv *priv)
         priv->passive_no_rx = false;
 }
 
-void iwl_free_skb(struct iwl_op_mode *op_mode, struct sk_buff *skb)
+static void iwl_free_skb(struct iwl_op_mode *op_mode, struct sk_buff *skb)
 {
+        struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
         struct ieee80211_tx_info *info;
 
         info = IEEE80211_SKB_CB(skb);
-        kmem_cache_free(iwl_tx_cmd_pool, (info->driver_data[1]));
+        iwl_trans_free_tx_cmd(priv->trans, info->driver_data[1]);
         dev_kfree_skb_any(skb);
 }
 
-void iwl_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
+static void iwl_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
 {
         struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
 
@@ -2303,7 +2165,7 @@ void iwl_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
         wiphy_rfkill_set_hw_state(priv->hw->wiphy, state);
 }
 
-const struct iwl_op_mode_ops iwl_dvm_ops = {
+static const struct iwl_op_mode_ops iwl_dvm_ops = {
         .start = iwl_op_mode_dvm_start,
         .stop = iwl_op_mode_dvm_stop,
         .rx = iwl_rx_dispatch,
@@ -2322,9 +2184,6 @@ const struct iwl_op_mode_ops iwl_dvm_ops = {
  * driver and module entry point
  *
  *****************************************************************************/
-
-struct kmem_cache *iwl_tx_cmd_pool;
-
 static int __init iwl_init(void)
 {
 
@@ -2332,36 +2191,25 @@ static int __init iwl_init(void)
         pr_info(DRV_DESCRIPTION ", " DRV_VERSION "\n");
         pr_info(DRV_COPYRIGHT "\n");
 
-        iwl_tx_cmd_pool = kmem_cache_create("iwl_dev_cmd",
-                                            sizeof(struct iwl_device_cmd),
-                                            sizeof(void *), 0, NULL);
-        if (!iwl_tx_cmd_pool)
-                return -ENOMEM;
-
         ret = iwlagn_rate_control_register();
         if (ret) {
                 pr_err("Unable to register rate control algorithm: %d\n", ret);
-                goto error_rc_register;
+                return ret;
         }
 
-        ret = iwl_pci_register_driver();
-        if (ret)
-                goto error_pci_register;
-        return ret;
+        ret = iwl_opmode_register("iwldvm", &iwl_dvm_ops);
+        if (ret) {
+                pr_err("Unable to register op_mode: %d\n", ret);
+                iwlagn_rate_control_unregister();
+        }
 
-error_pci_register:
-        iwlagn_rate_control_unregister();
-error_rc_register:
-        kmem_cache_destroy(iwl_tx_cmd_pool);
         return ret;
 }
+module_init(iwl_init);
 
 static void __exit iwl_exit(void)
 {
-        iwl_pci_unregister_driver();
+        iwl_opmode_deregister("iwldvm");
         iwlagn_rate_control_unregister();
-        kmem_cache_destroy(iwl_tx_cmd_pool);
 }
-
 module_exit(iwl_exit);
-module_init(iwl_init);
diff --git a/drivers/net/wireless/iwlwifi/iwl-power.c b/drivers/net/wireless/iwlwifi/dvm/power.c
index 544ddf17f5bd..518cf3715809 100644
--- a/drivers/net/wireless/iwlwifi/iwl-power.c
+++ b/drivers/net/wireless/iwlwifi/dvm/power.c
@@ -31,18 +31,15 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/init.h>
-
 #include <net/mac80211.h>
-
-#include "iwl-eeprom.h"
-#include "iwl-dev.h"
-#include "iwl-agn.h"
 #include "iwl-io.h"
-#include "iwl-commands.h"
 #include "iwl-debug.h"
-#include "iwl-power.h"
 #include "iwl-trans.h"
 #include "iwl-modparams.h"
+#include "dev.h"
+#include "agn.h"
+#include "commands.h"
+#include "power.h"
 
 /*
  * Setting power level allows the card to go to sleep when not busy.
diff --git a/drivers/net/wireless/iwlwifi/iwl-power.h b/drivers/net/wireless/iwlwifi/dvm/power.h
index 21afc92efacb..a2cee7f04848 100644
--- a/drivers/net/wireless/iwlwifi/iwl-power.h
+++ b/drivers/net/wireless/iwlwifi/dvm/power.h
@@ -28,7 +28,7 @@
 #ifndef __iwl_power_setting_h__
 #define __iwl_power_setting_h__
 
-#include "iwl-commands.h"
+#include "commands.h"
 
 struct iwl_power_mgr {
         struct iwl_powertable_cmd sleep_cmd;
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/dvm/rs.c
index 8cebd7c363fc..6fddd2785e6e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rs.c
@@ -35,10 +35,8 @@
 
 #include <linux/workqueue.h>
 
-#include "iwl-dev.h"
-#include "iwl-agn.h"
-#include "iwl-op-mode.h"
-#include "iwl-modparams.h"
+#include "dev.h"
+#include "agn.h"
 
 #define RS_NAME "iwl-agn-rs"
 
@@ -819,7 +817,7 @@ static u32 rs_get_lower_rate(struct iwl_lq_sta *lq_sta,
 
                 if (num_of_ant(tbl->ant_type) > 1)
                         tbl->ant_type =
-                            first_antenna(priv->hw_params.valid_tx_ant);
+                            first_antenna(priv->eeprom_data->valid_tx_ant);
 
                 tbl->is_ht40 = 0;
                 tbl->is_SGI = 0;
@@ -1447,7 +1445,7 @@ static int rs_move_legacy_other(struct iwl_priv *priv,
         u32 sz = (sizeof(struct iwl_scale_tbl_info) -
                   (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
         u8 start_action;
-        u8 valid_tx_ant = priv->hw_params.valid_tx_ant;
+        u8 valid_tx_ant = priv->eeprom_data->valid_tx_ant;
         u8 tx_chains_num = priv->hw_params.tx_chains_num;
         int ret = 0;
         u8 update_search_tbl_counter = 0;
@@ -1465,7 +1463,7 @@ static int rs_move_legacy_other(struct iwl_priv *priv,
         case IWL_BT_COEX_TRAFFIC_LOAD_CONTINUOUS:
                 /* avoid antenna B and MIMO */
                 valid_tx_ant =
-                        first_antenna(priv->hw_params.valid_tx_ant);
+                        first_antenna(priv->eeprom_data->valid_tx_ant);
                 if (tbl->action >= IWL_LEGACY_SWITCH_ANTENNA2 &&
                     tbl->action != IWL_LEGACY_SWITCH_SISO)
                         tbl->action = IWL_LEGACY_SWITCH_SISO;
@@ -1489,7 +1487,7 @@ static int rs_move_legacy_other(struct iwl_priv *priv,
                 else if (tbl->action >= IWL_LEGACY_SWITCH_ANTENNA2)
                         tbl->action = IWL_LEGACY_SWITCH_SISO;
                 valid_tx_ant =
-                        first_antenna(priv->hw_params.valid_tx_ant);
+                        first_antenna(priv->eeprom_data->valid_tx_ant);
         }
 
         start_action = tbl->action;
@@ -1623,7 +1621,7 @@ static int rs_move_siso_to_other(struct iwl_priv *priv,
         u32 sz = (sizeof(struct iwl_scale_tbl_info) -
                   (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
         u8 start_action;
-        u8 valid_tx_ant = priv->hw_params.valid_tx_ant;
+        u8 valid_tx_ant = priv->eeprom_data->valid_tx_ant;
         u8 tx_chains_num = priv->hw_params.tx_chains_num;
         u8 update_search_tbl_counter = 0;
         int ret;
@@ -1641,7 +1639,7 @@ static int rs_move_siso_to_other(struct iwl_priv *priv,
         case IWL_BT_COEX_TRAFFIC_LOAD_CONTINUOUS:
                 /* avoid antenna B and MIMO */
                 valid_tx_ant =
-                        first_antenna(priv->hw_params.valid_tx_ant);
+                        first_antenna(priv->eeprom_data->valid_tx_ant);
                 if (tbl->action != IWL_SISO_SWITCH_ANTENNA1)
                         tbl->action = IWL_SISO_SWITCH_ANTENNA1;
                 break;
@@ -1659,7 +1657,7 @@ static int rs_move_siso_to_other(struct iwl_priv *priv,
         /* configure as 1x1 if bt full concurrency */
         if (priv->bt_full_concurrent) {
                 valid_tx_ant =
-                        first_antenna(priv->hw_params.valid_tx_ant);
+                        first_antenna(priv->eeprom_data->valid_tx_ant);
                 if (tbl->action >= IWL_LEGACY_SWITCH_ANTENNA2)
                         tbl->action = IWL_SISO_SWITCH_ANTENNA1;
         }
@@ -1795,7 +1793,7 @@ static int rs_move_mimo2_to_other(struct iwl_priv *priv,
         u32 sz = (sizeof(struct iwl_scale_tbl_info) -
                   (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
         u8 start_action;
-        u8 valid_tx_ant = priv->hw_params.valid_tx_ant;
+        u8 valid_tx_ant = priv->eeprom_data->valid_tx_ant;
         u8 tx_chains_num = priv->hw_params.tx_chains_num;
         u8 update_search_tbl_counter = 0;
         int ret;
@@ -1965,7 +1963,7 @@ static int rs_move_mimo3_to_other(struct iwl_priv *priv,
         u32 sz = (sizeof(struct iwl_scale_tbl_info) -
                   (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
         u8 start_action;
-        u8 valid_tx_ant = priv->hw_params.valid_tx_ant;
+        u8 valid_tx_ant = priv->eeprom_data->valid_tx_ant;
         u8 tx_chains_num = priv->hw_params.tx_chains_num;
         int ret;
         u8 update_search_tbl_counter = 0;
@@ -2699,7 +2697,7 @@ static void rs_initialize_lq(struct iwl_priv *priv,
 
         i = lq_sta->last_txrate_idx;
 
-        valid_tx_ant = priv->hw_params.valid_tx_ant;
+        valid_tx_ant = priv->eeprom_data->valid_tx_ant;
 
         if (!lq_sta->search_better_tbl)
                 active_tbl = lq_sta->active_tbl;
@@ -2893,15 +2891,15 @@ void iwl_rs_rate_init(struct iwl_priv *priv, struct ieee80211_sta *sta, u8 sta_i
 
         /* These values will be overridden later */
         lq_sta->lq.general_params.single_stream_ant_msk =
-                first_antenna(priv->hw_params.valid_tx_ant);
+                first_antenna(priv->eeprom_data->valid_tx_ant);
         lq_sta->lq.general_params.dual_stream_ant_msk =
-                priv->hw_params.valid_tx_ant &
-                ~first_antenna(priv->hw_params.valid_tx_ant);
+                priv->eeprom_data->valid_tx_ant &
+                ~first_antenna(priv->eeprom_data->valid_tx_ant);
         if (!lq_sta->lq.general_params.dual_stream_ant_msk) {
                 lq_sta->lq.general_params.dual_stream_ant_msk = ANT_AB;
-        } else if (num_of_ant(priv->hw_params.valid_tx_ant) == 2) {
+        } else if (num_of_ant(priv->eeprom_data->valid_tx_ant) == 2) {
                 lq_sta->lq.general_params.dual_stream_ant_msk =
-                        priv->hw_params.valid_tx_ant;
+                        priv->eeprom_data->valid_tx_ant;
         }
 
         /* as default allow aggregation for all tids */
@@ -2947,7 +2945,7 @@ static void rs_fill_link_cmd(struct iwl_priv *priv,
         if (priv && priv->bt_full_concurrent) {
                 /* 1x1 only */
                 tbl_type.ant_type =
-                        first_antenna(priv->hw_params.valid_tx_ant);
+                        first_antenna(priv->eeprom_data->valid_tx_ant);
         }
 
         /* How many times should we repeat the initial rate? */
@@ -2979,7 +2977,7 @@ static void rs_fill_link_cmd(struct iwl_priv *priv,
                 if (priv->bt_full_concurrent)
                         valid_tx_ant = ANT_A;
                 else
-                        valid_tx_ant = priv->hw_params.valid_tx_ant;
+                        valid_tx_ant = priv->eeprom_data->valid_tx_ant;
         }
 
         /* Fill rest of rate table */
@@ -3013,7 +3011,7 @@ static void rs_fill_link_cmd(struct iwl_priv *priv,
                 if (priv && priv->bt_full_concurrent) {
                         /* 1x1 only */
                         tbl_type.ant_type =
-                            first_antenna(priv->hw_params.valid_tx_ant);
+                            first_antenna(priv->eeprom_data->valid_tx_ant);
                 }
 
                 /* Indicate to uCode which entries might be MIMO.
@@ -3100,7 +3098,7 @@ static void rs_dbgfs_set_mcs(struct iwl_lq_sta *lq_sta,
         u8 ant_sel_tx;
 
         priv = lq_sta->drv;
-        valid_tx_ant = priv->hw_params.valid_tx_ant;
+        valid_tx_ant = priv->eeprom_data->valid_tx_ant;
         if (lq_sta->dbg_fixed_rate) {
                 ant_sel_tx =
                   ((lq_sta->dbg_fixed_rate & RATE_MCS_ANT_ABC_MSK)
@@ -3171,9 +3169,9 @@ static ssize_t rs_sta_dbgfs_scale_table_read(struct file *file,
         desc += sprintf(buff+desc, "fixed rate 0x%X\n",
                         lq_sta->dbg_fixed_rate);
         desc += sprintf(buff+desc, "valid_tx_ant %s%s%s\n",
-            (priv->hw_params.valid_tx_ant & ANT_A) ? "ANT_A," : "",
-            (priv->hw_params.valid_tx_ant & ANT_B) ? "ANT_B," : "",
-            (priv->hw_params.valid_tx_ant & ANT_C) ? "ANT_C" : "");
+            (priv->eeprom_data->valid_tx_ant & ANT_A) ? "ANT_A," : "",
+            (priv->eeprom_data->valid_tx_ant & ANT_B) ? "ANT_B," : "",
+            (priv->eeprom_data->valid_tx_ant & ANT_C) ? "ANT_C" : "");
         desc += sprintf(buff+desc, "lq type %s\n",
            (is_legacy(tbl->lq_type)) ? "legacy" : "HT");
         if (is_Ht(tbl->lq_type)) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.h b/drivers/net/wireless/iwlwifi/dvm/rs.h
index 82d02e1ae89f..ad3aea8f626a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
+++ b/drivers/net/wireless/iwlwifi/dvm/rs.h
@@ -29,9 +29,10 @@
 
 #include <net/mac80211.h>
 
-#include "iwl-commands.h"
 #include "iwl-config.h"
 
+#include "commands.h"
+
 struct iwl_rate_info {
         u8 plcp;        /* uCode API:  IWL_RATE_6M_PLCP, etc. */
         u8 plcp_siso;   /* uCode API:  IWL_RATE_SISO_6M_PLCP, etc. */
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rx.c b/drivers/net/wireless/iwlwifi/dvm/rx.c
index 403de96f9747..c1f7a18e08dd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rx.c
@@ -32,12 +32,10 @@
 #include <linux/sched.h>
 #include <net/mac80211.h>
 #include <asm/unaligned.h>
-#include "iwl-eeprom.h"
-#include "iwl-dev.h"
 #include "iwl-io.h"
-#include "iwl-agn-calib.h"
-#include "iwl-agn.h"
-#include "iwl-modparams.h"
+#include "dev.h"
+#include "calib.h"
+#include "agn.h"
 
 #define IWL_CMD_ENTRY(x) [x] = #x
 
@@ -1012,6 +1010,8 @@ static int iwlagn_rx_reply_rx(struct iwl_priv *priv,
                 rx_status.flag |= RX_FLAG_40MHZ;
         if (rate_n_flags & RATE_MCS_SGI_MSK)
                 rx_status.flag |= RX_FLAG_SHORT_GI;
+        if (rate_n_flags & RATE_MCS_GF_MSK)
+                rx_status.flag |= RX_FLAG_HT_GF;
 
         iwlagn_pass_packet_to_mac80211(priv, header, len, ampdu_status,
                                     rxb, &rx_status);
@@ -1124,8 +1124,6 @@ int iwl_rx_dispatch(struct iwl_op_mode *op_mode, struct iwl_rx_cmd_buffer *rxb,
 {
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
-        void (*pre_rx_handler)(struct iwl_priv *,
-                               struct iwl_rx_cmd_buffer *);
         int err = 0;
 
         /*
@@ -1135,19 +1133,19 @@ int iwl_rx_dispatch(struct iwl_op_mode *op_mode, struct iwl_rx_cmd_buffer *rxb,
          */
         iwl_notification_wait_notify(&priv->notif_wait, pkt);
 
-        /* RX data may be forwarded to userspace (using pre_rx_handler) in one
-         * of two cases: the first, that the user owns the uCode through
-         * testmode - in such case the pre_rx_handler is set and no further
-         * processing takes place. The other case is when the user want to
-         * monitor the rx w/o affecting the regular flow - the pre_rx_handler
-         * will be set but the ownership flag != IWL_OWNERSHIP_TM and the flow
+#ifdef CONFIG_IWLWIFI_DEVICE_TESTMODE
+        /*
+         * RX data may be forwarded to userspace in one
+         * of two cases: the user owns the fw through testmode or when
+         * the user requested to monitor the rx w/o affecting the regular flow.
+         * In these cases the iwl_test object will handle forwarding the rx
+         * data to user space.
+         * Note that if the ownership flag != IWL_OWNERSHIP_TM the flow
          * continues.
-         * We need to use ACCESS_ONCE to prevent a case where the handler
-         * changes between the check and the call.
          */
-        pre_rx_handler = ACCESS_ONCE(priv->pre_rx_handler);
-        if (pre_rx_handler)
-                pre_rx_handler(priv, rxb);
+        iwl_test_rx(&priv->tst, rxb);
+#endif
+
         if (priv->ucode_owner != IWL_OWNERSHIP_TM) {
                 /* Based on type of command response or notification,
                  *   handle those that need handling via function in
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c b/drivers/net/wireless/iwlwifi/dvm/rxon.c
index 0a3aa7c83003..6ee940f497f9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rxon.c
@@ -25,11 +25,11 @@
  *****************************************************************************/
 
 #include <linux/etherdevice.h>
-#include "iwl-dev.h"
-#include "iwl-agn.h"
-#include "iwl-agn-calib.h"
 #include "iwl-trans.h"
 #include "iwl-modparams.h"
+#include "dev.h"
+#include "agn.h"
+#include "calib.h"
 
 /*
  * initialize rxon structure with default values from eeprom
@@ -37,8 +37,6 @@
 void iwl_connection_init_rx_config(struct iwl_priv *priv,
                                    struct iwl_rxon_context *ctx)
 {
-        const struct iwl_channel_info *ch_info;
-
         memset(&ctx->staging, 0, sizeof(ctx->staging));
 
         if (!ctx->vif) {
@@ -80,14 +78,8 @@ void iwl_connection_init_rx_config(struct iwl_priv *priv,
                 ctx->staging.flags |= RXON_FLG_SHORT_PREAMBLE_MSK;
 #endif
 
-        ch_info = iwl_get_channel_info(priv, priv->band,
-                                       le16_to_cpu(ctx->active.channel));
-
-        if (!ch_info)
-                ch_info = &priv->channel_info[0];
-
-        ctx->staging.channel = cpu_to_le16(ch_info->channel);
-        priv->band = ch_info->band;
+        ctx->staging.channel = cpu_to_le16(priv->hw->conf.channel->hw_value);
+        priv->band = priv->hw->conf.channel->band;
 
         iwl_set_flags_for_band(priv, ctx, priv->band, ctx->vif);
 
@@ -175,7 +167,8 @@ static int iwlagn_disconn_pan(struct iwl_priv *priv,
         return ret;
 }
 
-void iwlagn_update_qos(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
+static void iwlagn_update_qos(struct iwl_priv *priv,
+                              struct iwl_rxon_context *ctx)
 {
         int ret;
 
@@ -202,8 +195,8 @@ void iwlagn_update_qos(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
                 IWL_DEBUG_QUIET_RFKILL(priv, "Failed to update QoS\n");
 }
 
-int iwlagn_update_beacon(struct iwl_priv *priv,
-                         struct ieee80211_vif *vif)
+static int iwlagn_update_beacon(struct iwl_priv *priv,
+                                struct ieee80211_vif *vif)
 {
         lockdep_assert_held(&priv->mutex);
 
@@ -215,7 +208,7 @@ int iwlagn_update_beacon(struct iwl_priv *priv,
 }
 
 static int iwlagn_send_rxon_assoc(struct iwl_priv *priv,
-                           struct iwl_rxon_context *ctx)
+                                  struct iwl_rxon_context *ctx)
 {
         int ret = 0;
         struct iwl_rxon_assoc_cmd rxon_assoc;
@@ -427,10 +420,10 @@ static int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force)
                 return -EINVAL;
         }
 
-        if (tx_power > priv->tx_power_device_lmt) {
+        if (tx_power > DIV_ROUND_UP(priv->eeprom_data->max_tx_pwr_half_dbm, 2)) {
                 IWL_WARN(priv,
                         "Requested user TXPOWER %d above upper limit %d.\n",
-                         tx_power, priv->tx_power_device_lmt);
+                         tx_power, priv->eeprom_data->max_tx_pwr_half_dbm);
                 return -EINVAL;
         }
 
@@ -863,8 +856,8 @@ static int iwl_check_rxon_cmd(struct iwl_priv *priv,
  * or is clearing the RXON_FILTER_ASSOC_MSK, then return 1 to indicate that
  * a new tune (full RXON command, rather than RXON_ASSOC cmd) is required.
  */
-int iwl_full_rxon_required(struct iwl_priv *priv,
-                           struct iwl_rxon_context *ctx)
+static int iwl_full_rxon_required(struct iwl_priv *priv,
+                                  struct iwl_rxon_context *ctx)
 {
         const struct iwl_rxon_cmd *staging = &ctx->staging;
         const struct iwl_rxon_cmd *active = &ctx->active;
@@ -1189,7 +1182,6 @@ int iwlagn_mac_config(struct ieee80211_hw *hw, u32 changed)
         struct iwl_rxon_context *ctx;
         struct ieee80211_conf *conf = &hw->conf;
         struct ieee80211_channel *channel = conf->channel;
-        const struct iwl_channel_info *ch_info;
         int ret = 0;
 
         IWL_DEBUG_MAC80211(priv, "enter: changed %#x\n", changed);
@@ -1223,14 +1215,6 @@ int iwlagn_mac_config(struct ieee80211_hw *hw, u32 changed)
         }
 
         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
-                ch_info = iwl_get_channel_info(priv, channel->band,
-                                               channel->hw_value);
-                if (!is_channel_valid(ch_info)) {
-                        IWL_DEBUG_MAC80211(priv, "leave - invalid channel\n");
-                        ret = -EINVAL;
-                        goto out;
-                }
-
                 for_each_context(priv, ctx) {
                         /* Configure HT40 channels */
                         if (ctx->ht.enabled != conf_is_ht(conf))
@@ -1294,9 +1278,9 @@ int iwlagn_mac_config(struct ieee80211_hw *hw, u32 changed)
         return ret;
 }
 
-void iwlagn_check_needed_chains(struct iwl_priv *priv,
-                                struct iwl_rxon_context *ctx,
-                                struct ieee80211_bss_conf *bss_conf)
+static void iwlagn_check_needed_chains(struct iwl_priv *priv,
+                                       struct iwl_rxon_context *ctx,
+                                       struct ieee80211_bss_conf *bss_conf)
 {
         struct ieee80211_vif *vif = ctx->vif;
         struct iwl_rxon_context *tmp;
@@ -1388,7 +1372,7 @@ void iwlagn_check_needed_chains(struct iwl_priv *priv,
         ht_conf->single_chain_sufficient = !need_multiple;
 }
 
-void iwlagn_chain_noise_reset(struct iwl_priv *priv)
+static void iwlagn_chain_noise_reset(struct iwl_priv *priv)
 {
         struct iwl_chain_noise_data *data = &priv->chain_noise_data;
         int ret;
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/dvm/scan.c
index 031d8e21f82f..2f271c96ed39 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/dvm/scan.c
@@ -30,11 +30,8 @@
 #include <linux/etherdevice.h>
 #include <net/mac80211.h>
 
-#include "iwl-eeprom.h"
-#include "iwl-dev.h"
-#include "iwl-io.h"
-#include "iwl-agn.h"
-#include "iwl-trans.h"
+#include "dev.h"
+#include "agn.h"
 
 /* For active scan, listen ACTIVE_DWELL_TIME (msec) on each channel after
  * sending probe req.  This should be set long enough to hear probe responses
@@ -67,7 +64,6 @@ static int iwl_send_scan_abort(struct iwl_priv *priv)
          * to receive scan abort command or it does not perform
          * hardware scan currently */
         if (!test_bit(STATUS_READY, &priv->status) ||
-            !test_bit(STATUS_GEO_CONFIGURED, &priv->status) ||
             !test_bit(STATUS_SCAN_HW, &priv->status) ||
             test_bit(STATUS_FW_ERROR, &priv->status))
                 return -EIO;
@@ -101,11 +97,8 @@ static void iwl_complete_scan(struct iwl_priv *priv, bool aborted)
                 ieee80211_scan_completed(priv->hw, aborted);
         }
 
-        if (priv->scan_type == IWL_SCAN_ROC) {
-                ieee80211_remain_on_channel_expired(priv->hw);
-                priv->hw_roc_channel = NULL;
-                schedule_delayed_work(&priv->hw_roc_disable_work, 10 * HZ);
-        }
+        if (priv->scan_type == IWL_SCAN_ROC)
+                iwl_scan_roc_expired(priv);
 
         priv->scan_type = IWL_SCAN_NORMAL;
         priv->scan_vif = NULL;
@@ -134,11 +127,8 @@ static void iwl_process_scan_complete(struct iwl_priv *priv)
                 goto out_settings;
         }
 
-        if (priv->scan_type == IWL_SCAN_ROC) {
-                ieee80211_remain_on_channel_expired(priv->hw);
-                priv->hw_roc_channel = NULL;
-                schedule_delayed_work(&priv->hw_roc_disable_work, 10 * HZ);
-        }
+        if (priv->scan_type == IWL_SCAN_ROC)
+                iwl_scan_roc_expired(priv);
 
         if (priv->scan_type != IWL_SCAN_NORMAL && !aborted) {
                 int err;
@@ -453,27 +443,17 @@ static u16 iwl_get_passive_dwell_time(struct iwl_priv *priv,
 
 /* Return valid, unused, channel for a passive scan to reset the RF */
 static u8 iwl_get_single_channel_number(struct iwl_priv *priv,
-                                 enum ieee80211_band band)
+                                        enum ieee80211_band band)
 {
-        const struct iwl_channel_info *ch_info;
-        int i;
-        u8 channel = 0;
-        u8 min, max;
+        struct ieee80211_supported_band *sband = priv->hw->wiphy->bands[band];
         struct iwl_rxon_context *ctx;
+        int i;
 
-        if (band == IEEE80211_BAND_5GHZ) {
-                min = 14;
-                max = priv->channel_count;
-        } else {
-                min = 0;
-                max = 14;
-        }
-
-        for (i = min; i < max; i++) {
+        for (i = 0; i < sband->n_channels; i++) {
                 bool busy = false;
 
                 for_each_context(priv, ctx) {
-                        busy = priv->channel_info[i].channel ==
+                        busy = sband->channels[i].hw_value ==
                                 le16_to_cpu(ctx->staging.channel);
                         if (busy)
                                 break;
@@ -482,13 +462,11 @@ static u8 iwl_get_single_channel_number(struct iwl_priv *priv,
                 if (busy)
                         continue;
 
-                channel = priv->channel_info[i].channel;
-                ch_info = iwl_get_channel_info(priv, band, channel);
-                if (is_channel_valid(ch_info))
-                        break;
+                if (!(sband->channels[i].flags & IEEE80211_CHAN_DISABLED))
+                        return sband->channels[i].hw_value;
         }
 
-        return channel;
+        return 0;
 }
 
 static int iwl_get_single_channel_for_scan(struct iwl_priv *priv,
@@ -540,7 +518,6 @@ static int iwl_get_channels_for_scan(struct iwl_priv *priv,
 {
         struct ieee80211_channel *chan;
         const struct ieee80211_supported_band *sband;
-        const struct iwl_channel_info *ch_info;
         u16 passive_dwell = 0;
         u16 active_dwell = 0;
         int added, i;
@@ -565,16 +542,7 @@ static int iwl_get_channels_for_scan(struct iwl_priv *priv,
                 channel = chan->hw_value;
                 scan_ch->channel = cpu_to_le16(channel);
 
-                ch_info = iwl_get_channel_info(priv, band, channel);
-                if (!is_channel_valid(ch_info)) {
-                        IWL_DEBUG_SCAN(priv,
-                                       "Channel %d is INVALID for this band.\n",
-                                       channel);
-                        continue;
-                }
-
-                if (!is_active || is_channel_passive(ch_info) ||
-                    (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN))
+                if (!is_active || (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN))
                         scan_ch->type = SCAN_CHANNEL_TYPE_PASSIVE;
                 else
                         scan_ch->type = SCAN_CHANNEL_TYPE_ACTIVE;
@@ -678,12 +646,12 @@ static int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         u16 rx_chain = 0;
         enum ieee80211_band band;
         u8 n_probes = 0;
-        u8 rx_ant = priv->hw_params.valid_rx_ant;
+        u8 rx_ant = priv->eeprom_data->valid_rx_ant;
         u8 rate;
         bool is_active = false;
         int  chan_mod;
         u8 active_chains;
-        u8 scan_tx_antennas = priv->hw_params.valid_tx_ant;
+        u8 scan_tx_antennas = priv->eeprom_data->valid_tx_ant;
         int ret;
         int scan_cmd_size = sizeof(struct iwl_scan_cmd) +
                             MAX_SCAN_CHANNEL * sizeof(struct iwl_scan_channel) +
@@ -893,7 +861,7 @@ static int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
 
         /* MIMO is not used here, but value is required */
         rx_chain |=
-                priv->hw_params.valid_rx_ant << RXON_RX_CHAIN_VALID_POS;
+                priv->eeprom_data->valid_rx_ant << RXON_RX_CHAIN_VALID_POS;
         rx_chain |= rx_ant << RXON_RX_CHAIN_FORCE_MIMO_SEL_POS;
         rx_chain |= rx_ant << RXON_RX_CHAIN_FORCE_SEL_POS;
         rx_chain |= 0x1 << RXON_RX_CHAIN_DRIVER_FORCE_POS;
@@ -994,8 +962,10 @@ static int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         set_bit(STATUS_SCAN_HW, &priv->status);
 
         ret = iwlagn_set_pan_params(priv);
-        if (ret)
+        if (ret) {
+                clear_bit(STATUS_SCAN_HW, &priv->status);
                 return ret;
+        }
 
         ret = iwl_dvm_send_cmd(priv, &cmd);
         if (ret) {
@@ -1008,7 +978,7 @@ static int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
 
 void iwl_init_scan_params(struct iwl_priv *priv)
 {
-        u8 ant_idx = fls(priv->hw_params.valid_tx_ant) - 1;
+        u8 ant_idx = fls(priv->eeprom_data->valid_tx_ant) - 1;
         if (!priv->scan_tx_ant[IEEE80211_BAND_5GHZ])
                 priv->scan_tx_ant[IEEE80211_BAND_5GHZ] = ant_idx;
         if (!priv->scan_tx_ant[IEEE80211_BAND_2GHZ])
@@ -1158,3 +1128,40 @@ void iwl_cancel_scan_deferred_work(struct iwl_priv *priv)
                 mutex_unlock(&priv->mutex);
         }
 }
+
+void iwl_scan_roc_expired(struct iwl_priv *priv)
+{
+        /*
+         * The status bit should be set here, to prevent a race
+         * where the atomic_read returns 1, but before the execution continues
+         * iwl_scan_offchannel_skb_status() checks if the status bit is set
+         */
+        set_bit(STATUS_SCAN_ROC_EXPIRED, &priv->status);
+
+        if (atomic_read(&priv->num_aux_in_flight) == 0) {
+                ieee80211_remain_on_channel_expired(priv->hw);
+                priv->hw_roc_channel = NULL;
+                schedule_delayed_work(&priv->hw_roc_disable_work,
+                                      10 * HZ);
+
+                clear_bit(STATUS_SCAN_ROC_EXPIRED, &priv->status);
+        } else {
+                IWL_DEBUG_SCAN(priv, "ROC done with %d frames in aux\n",
+                               atomic_read(&priv->num_aux_in_flight));
+        }
+}
+
+void iwl_scan_offchannel_skb(struct iwl_priv *priv)
+{
+        WARN_ON(!priv->hw_roc_start_notified);
+        atomic_inc(&priv->num_aux_in_flight);
+}
+
+void iwl_scan_offchannel_skb_status(struct iwl_priv *priv)
+{
+        if (atomic_dec_return(&priv->num_aux_in_flight) == 0 &&
+            test_bit(STATUS_SCAN_ROC_EXPIRED, &priv->status)) {
+                IWL_DEBUG_SCAN(priv, "0 aux frames. Calling ROC expired\n");
+                iwl_scan_roc_expired(priv);
+        }
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c b/drivers/net/wireless/iwlwifi/dvm/sta.c
index eb6a8eaf42fc..b29b798f7550 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
+++ b/drivers/net/wireless/iwlwifi/dvm/sta.c
@@ -28,10 +28,9 @@
  *****************************************************************************/
 #include <linux/etherdevice.h>
 #include <net/mac80211.h>
-
-#include "iwl-dev.h"
-#include "iwl-agn.h"
 #include "iwl-trans.h"
+#include "dev.h"
+#include "agn.h"
 
 const u8 iwl_bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
 
@@ -171,26 +170,6 @@ int iwl_send_add_sta(struct iwl_priv *priv,
         return cmd.handler_status;
 }
 
-static bool iwl_is_channel_extension(struct iwl_priv *priv,
-                                     enum ieee80211_band band,
-                                     u16 channel, u8 extension_chan_offset)
-{
-        const struct iwl_channel_info *ch_info;
-
-        ch_info = iwl_get_channel_info(priv, band, channel);
-        if (!is_channel_valid(ch_info))
-                return false;
-
-        if (extension_chan_offset == IEEE80211_HT_PARAM_CHA_SEC_ABOVE)
-                return !(ch_info->ht40_extension_channel &
-                                        IEEE80211_CHAN_NO_HT40PLUS);
-        else if (extension_chan_offset == IEEE80211_HT_PARAM_CHA_SEC_BELOW)
-                return !(ch_info->ht40_extension_channel &
-                                        IEEE80211_CHAN_NO_HT40MINUS);
-
-        return false;
-}
-
 bool iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
                             struct iwl_rxon_context *ctx,
                             struct ieee80211_sta_ht_cap *ht_cap)
@@ -198,21 +177,25 @@ bool iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
         if (!ctx->ht.enabled || !ctx->ht.is_40mhz)
                 return false;
 
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        if (priv->disable_ht40)
+                return false;
+#endif
+
         /*
-         * We do not check for IEEE80211_HT_CAP_SUP_WIDTH_20_40
-         * the bit will not set if it is pure 40MHz case
+         * Remainder of this function checks ht_cap, but if it's
+         * NULL then we can do HT40 (special case for RXON)
          */
-        if (ht_cap && !ht_cap->ht_supported)
+        if (!ht_cap)
+                return true;
+
+        if (!ht_cap->ht_supported)
                 return false;
 
-#ifdef CONFIG_IWLWIFI_DEBUGFS
-        if (priv->disable_ht40)
+        if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40))
                 return false;
-#endif
 
-        return iwl_is_channel_extension(priv, priv->band,
-                        le16_to_cpu(ctx->staging.channel),
-                        ctx->ht.extension_chan_offset);
+        return true;
 }
 
 static void iwl_sta_calc_ht_flags(struct iwl_priv *priv,
@@ -236,6 +219,7 @@ static void iwl_sta_calc_ht_flags(struct iwl_priv *priv,
         mimo_ps_mode = (sta_ht_inf->cap & IEEE80211_HT_CAP_SM_PS) >> 2;
 
         IWL_DEBUG_INFO(priv, "STA %pM SM PS mode: %s\n",
+                        sta->addr,
                         (mimo_ps_mode == WLAN_HT_CAP_SM_PS_STATIC) ?
                         "static" :
                         (mimo_ps_mode == WLAN_HT_CAP_SM_PS_DYNAMIC) ?
@@ -649,23 +633,23 @@ static void iwl_sta_fill_lq(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
         if (r >= IWL_FIRST_CCK_RATE && r <= IWL_LAST_CCK_RATE)
                 rate_flags |= RATE_MCS_CCK_MSK;
 
-        rate_flags |= first_antenna(priv->hw_params.valid_tx_ant) <<
+        rate_flags |= first_antenna(priv->eeprom_data->valid_tx_ant) <<
                                 RATE_MCS_ANT_POS;
         rate_n_flags = iwl_hw_set_rate_n_flags(iwl_rates[r].plcp, rate_flags);
         for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++)
                 link_cmd->rs_table[i].rate_n_flags = rate_n_flags;
 
         link_cmd->general_params.single_stream_ant_msk =
-                        first_antenna(priv->hw_params.valid_tx_ant);
+                        first_antenna(priv->eeprom_data->valid_tx_ant);
 
         link_cmd->general_params.dual_stream_ant_msk =
-                priv->hw_params.valid_tx_ant &
-                ~first_antenna(priv->hw_params.valid_tx_ant);
+                priv->eeprom_data->valid_tx_ant &
+                ~first_antenna(priv->eeprom_data->valid_tx_ant);
         if (!link_cmd->general_params.dual_stream_ant_msk) {
                 link_cmd->general_params.dual_stream_ant_msk = ANT_AB;
-        } else if (num_of_ant(priv->hw_params.valid_tx_ant) == 2) {
+        } else if (num_of_ant(priv->eeprom_data->valid_tx_ant) == 2) {
                 link_cmd->general_params.dual_stream_ant_msk =
-                        priv->hw_params.valid_tx_ant;
+                        priv->eeprom_data->valid_tx_ant;
         }
 
         link_cmd->agg_params.agg_dis_start_th =
diff --git a/drivers/net/wireless/iwlwifi/dvm/testmode.c b/drivers/net/wireless/iwlwifi/dvm/testmode.c
new file mode 100644
index 000000000000..57b918ce3b5f
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/dvm/testmode.c
@@ -0,0 +1,471 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2010 - 2012 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2010 - 2012 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/dma-mapping.h>
+#include <net/net_namespace.h>
+#include <linux/netdevice.h>
+#include <net/cfg80211.h>
+#include <net/mac80211.h>
+#include <net/netlink.h>
+
+#include "iwl-debug.h"
+#include "iwl-trans.h"
+#include "dev.h"
+#include "agn.h"
+#include "iwl-test.h"
+#include "iwl-testmode.h"
+
+static int iwl_testmode_send_cmd(struct iwl_op_mode *op_mode,
+                                 struct iwl_host_cmd *cmd)
+{
+        struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
+        return iwl_dvm_send_cmd(priv, cmd);
+}
+
+static bool iwl_testmode_valid_hw_addr(u32 addr)
+{
+        if (iwlagn_hw_valid_rtc_data_addr(addr))
+                return true;
+
+        if (IWLAGN_RTC_INST_LOWER_BOUND <= addr &&
+            addr < IWLAGN_RTC_INST_UPPER_BOUND)
+                return true;
+
+        return false;
+}
+
+static u32 iwl_testmode_get_fw_ver(struct iwl_op_mode *op_mode)
+{
+        struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
+        return priv->fw->ucode_ver;
+}
+
+static struct sk_buff*
+iwl_testmode_alloc_reply(struct iwl_op_mode *op_mode, int len)
+{
+        struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
+        return cfg80211_testmode_alloc_reply_skb(priv->hw->wiphy, len);
+}
+
+static int iwl_testmode_reply(struct iwl_op_mode *op_mode, struct sk_buff *skb)
+{
+        return cfg80211_testmode_reply(skb);
+}
+
+static struct sk_buff *iwl_testmode_alloc_event(struct iwl_op_mode *op_mode,
+                                                int len)
+{
+        struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);
+        return cfg80211_testmode_alloc_event_skb(priv->hw->wiphy, len,
+                                                 GFP_ATOMIC);
+}
+
+static void iwl_testmode_event(struct iwl_op_mode *op_mode, struct sk_buff *skb)
+{
+        return cfg80211_testmode_event(skb, GFP_ATOMIC);
+}
+
+static struct iwl_test_ops tst_ops = {
+        .send_cmd = iwl_testmode_send_cmd,
+        .valid_hw_addr = iwl_testmode_valid_hw_addr,
+        .get_fw_ver = iwl_testmode_get_fw_ver,
+        .alloc_reply = iwl_testmode_alloc_reply,
+        .reply = iwl_testmode_reply,
+        .alloc_event = iwl_testmode_alloc_event,
+        .event = iwl_testmode_event,
+};
+
+void iwl_testmode_init(struct iwl_priv *priv)
+{
+        iwl_test_init(&priv->tst, priv->trans, &tst_ops);
+}
+
+void iwl_testmode_free(struct iwl_priv *priv)
+{
+        iwl_test_free(&priv->tst);
+}
+
+static int iwl_testmode_cfg_init_calib(struct iwl_priv *priv)
+{
+        struct iwl_notification_wait calib_wait;
+        static const u8 calib_complete[] = {
+                CALIBRATION_COMPLETE_NOTIFICATION
+        };
+        int ret;
+
+        iwl_init_notification_wait(&priv->notif_wait, &calib_wait,
+                                   calib_complete, ARRAY_SIZE(calib_complete),
+                                   NULL, NULL);
+        ret = iwl_init_alive_start(priv);
+        if (ret) {
+                IWL_ERR(priv, "Fail init calibration: %d\n", ret);
+                goto cfg_init_calib_error;
+        }
+
+        ret = iwl_wait_notification(&priv->notif_wait, &calib_wait, 2 * HZ);
+        if (ret)
+                IWL_ERR(priv, "Error detecting"
+                        " CALIBRATION_COMPLETE_NOTIFICATION: %d\n", ret);
+        return ret;
+
+cfg_init_calib_error:
+        iwl_remove_notification(&priv->notif_wait, &calib_wait);
+        return ret;
+}
+
+/*
+ * This function handles the user application commands for driver.
+ *
+ * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
+ * handlers respectively.
+ *
+ * If it's an unknown commdn ID, -ENOSYS is replied; otherwise, the returned
+ * value of the actual command execution is replied to the user application.
+ *
+ * If there's any message responding to the user space, IWL_TM_ATTR_SYNC_RSP
+ * is used for carry the message while IWL_TM_ATTR_COMMAND must set to
+ * IWL_TM_CMD_DEV2APP_SYNC_RSP.
+ *
+ * @hw: ieee80211_hw object that represents the device
+ * @tb: gnl message fields from the user space
+ */
+static int iwl_testmode_driver(struct ieee80211_hw *hw, struct nlattr **tb)
+{
+        struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
+        struct iwl_trans *trans = priv->trans;
+        struct sk_buff *skb;
+        unsigned char *rsp_data_ptr = NULL;
+        int status = 0, rsp_data_len = 0;
+        u32 inst_size = 0, data_size = 0;
+        const struct fw_img *img;
+
+        switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
+        case IWL_TM_CMD_APP2DEV_GET_DEVICENAME:
+                rsp_data_ptr = (unsigned char *)priv->cfg->name;
+                rsp_data_len = strlen(priv->cfg->name);
+                skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
+                                                        rsp_data_len + 20);
+                if (!skb) {
+                        IWL_ERR(priv, "Memory allocation fail\n");
+                        return -ENOMEM;
+                }
+                if (nla_put_u32(skb, IWL_TM_ATTR_COMMAND,
+                                IWL_TM_CMD_DEV2APP_SYNC_RSP) ||
+                    nla_put(skb, IWL_TM_ATTR_SYNC_RSP,
+                            rsp_data_len, rsp_data_ptr))
+                        goto nla_put_failure;
+                status = cfg80211_testmode_reply(skb);
+                if (status < 0)
+                        IWL_ERR(priv, "Error sending msg : %d\n", status);
+                break;
+
+        case IWL_TM_CMD_APP2DEV_LOAD_INIT_FW:
+                status = iwl_load_ucode_wait_alive(priv, IWL_UCODE_INIT);
+                if (status)
+                        IWL_ERR(priv, "Error loading init ucode: %d\n", status);
+                break;
+
+        case IWL_TM_CMD_APP2DEV_CFG_INIT_CALIB:
+                iwl_testmode_cfg_init_calib(priv);
+                priv->ucode_loaded = false;
+                iwl_trans_stop_device(trans);
+                break;
+
+        case IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW:
+                status = iwl_load_ucode_wait_alive(priv, IWL_UCODE_REGULAR);
+                if (status) {
+                        IWL_ERR(priv,
+                                "Error loading runtime ucode: %d\n", status);
+                        break;
+                }
+                status = iwl_alive_start(priv);
+                if (status)
+                        IWL_ERR(priv,
+                                "Error starting the device: %d\n", status);
+                break;
+
+        case IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW:
+                iwl_scan_cancel_timeout(priv, 200);
+                priv->ucode_loaded = false;
+                iwl_trans_stop_device(trans);
+                status = iwl_load_ucode_wait_alive(priv, IWL_UCODE_WOWLAN);
+                if (status) {
+                        IWL_ERR(priv,
+                                "Error loading WOWLAN ucode: %d\n", status);
+                        break;
+                }
+                status = iwl_alive_start(priv);
+                if (status)
+                        IWL_ERR(priv,
+                                "Error starting the device: %d\n", status);
+                break;
+
+        case IWL_TM_CMD_APP2DEV_GET_EEPROM:
+                if (priv->eeprom_blob) {
+                        skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
+                                priv->eeprom_blob_size + 20);
+                        if (!skb) {
+                                IWL_ERR(priv, "Memory allocation fail\n");
+                                return -ENOMEM;
+                        }
+                        if (nla_put_u32(skb, IWL_TM_ATTR_COMMAND,
+                                        IWL_TM_CMD_DEV2APP_EEPROM_RSP) ||
+                            nla_put(skb, IWL_TM_ATTR_EEPROM,
+                                    priv->eeprom_blob_size,
+                                    priv->eeprom_blob))
+                                goto nla_put_failure;
+                        status = cfg80211_testmode_reply(skb);
+                        if (status < 0)
+                                IWL_ERR(priv, "Error sending msg : %d\n",
+                                        status);
+                } else
+                        return -ENODATA;
+                break;
+
+        case IWL_TM_CMD_APP2DEV_FIXRATE_REQ:
+                if (!tb[IWL_TM_ATTR_FIXRATE]) {
+                        IWL_ERR(priv, "Missing fixrate setting\n");
+                        return -ENOMSG;
+                }
+                priv->tm_fixed_rate = nla_get_u32(tb[IWL_TM_ATTR_FIXRATE]);
+                break;
+
+        case IWL_TM_CMD_APP2DEV_GET_FW_INFO:
+                skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20 + 8);
+                if (!skb) {
+                        IWL_ERR(priv, "Memory allocation fail\n");
+                        return -ENOMEM;
+                }
+                if (!priv->ucode_loaded) {
+                        IWL_ERR(priv, "No uCode has not been loaded\n");
+                        return -EINVAL;
+                } else {
+                        img = &priv->fw->img[priv->cur_ucode];
+                        inst_size = img->sec[IWL_UCODE_SECTION_INST].len;
+                        data_size = img->sec[IWL_UCODE_SECTION_DATA].len;
+                }
+                if (nla_put_u32(skb, IWL_TM_ATTR_FW_TYPE, priv->cur_ucode) ||
+                    nla_put_u32(skb, IWL_TM_ATTR_FW_INST_SIZE, inst_size) ||
+                    nla_put_u32(skb, IWL_TM_ATTR_FW_DATA_SIZE, data_size))
+                        goto nla_put_failure;
+                status = cfg80211_testmode_reply(skb);
+                if (status < 0)
+                        IWL_ERR(priv, "Error sending msg : %d\n", status);
+                break;
+
+        default:
+                IWL_ERR(priv, "Unknown testmode driver command ID\n");
+                return -ENOSYS;
+        }
+        return status;
+
+nla_put_failure:
+        kfree_skb(skb);
+        return -EMSGSIZE;
+}
+
+/*
+ * This function handles the user application switch ucode ownership.
+ *
+ * It retrieves the mandatory fields IWL_TM_ATTR_UCODE_OWNER and
+ * decide who the current owner of the uCode
+ *
+ * If the current owner is OWNERSHIP_TM, then the only host command
+ * can deliver to uCode is from testmode, all the other host commands
+ * will dropped.
+ *
+ * default driver is the owner of uCode in normal operational mode
+ *
+ * @hw: ieee80211_hw object that represents the device
+ * @tb: gnl message fields from the user space
+ */
+static int iwl_testmode_ownership(struct ieee80211_hw *hw, struct nlattr **tb)
+{
+        struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
+        u8 owner;
+
+        if (!tb[IWL_TM_ATTR_UCODE_OWNER]) {
+                IWL_ERR(priv, "Missing ucode owner\n");
+                return -ENOMSG;
+        }
+
+        owner = nla_get_u8(tb[IWL_TM_ATTR_UCODE_OWNER]);
+        if (owner == IWL_OWNERSHIP_DRIVER) {
+                priv->ucode_owner = owner;
+                iwl_test_enable_notifications(&priv->tst, false);
+        } else if (owner == IWL_OWNERSHIP_TM) {
+                priv->ucode_owner = owner;
+                iwl_test_enable_notifications(&priv->tst, true);
+        } else {
+                IWL_ERR(priv, "Invalid owner\n");
+                return -EINVAL;
+        }
+        return 0;
+}
+
+/* The testmode gnl message handler that takes the gnl message from the
+ * user space and parses it per the policy iwl_testmode_gnl_msg_policy, then
+ * invoke the corresponding handlers.
+ *
+ * This function is invoked when there is user space application sending
+ * gnl message through the testmode tunnel NL80211_CMD_TESTMODE regulated
+ * by nl80211.
+ *
+ * It retrieves the mandatory field, IWL_TM_ATTR_COMMAND, before
+ * dispatching it to the corresponding handler.
+ *
+ * If IWL_TM_ATTR_COMMAND is missing, -ENOMSG is replied to user application;
+ * -ENOSYS is replied to the user application if the command is unknown;
+ * Otherwise, the command is dispatched to the respective handler.
+ *
+ * @hw: ieee80211_hw object that represents the device
+ * @data: pointer to user space message
+ * @len: length in byte of @data
+ */
+int iwlagn_mac_testmode_cmd(struct ieee80211_hw *hw, void *data, int len)
+{
+        struct nlattr *tb[IWL_TM_ATTR_MAX];
+        struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
+        int result;
+
+        result = iwl_test_parse(&priv->tst, tb, data, len);
+        if (result)
+                return result;
+
+        /* in case multiple accesses to the device happens */
+        mutex_lock(&priv->mutex);
+        switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
+        case IWL_TM_CMD_APP2DEV_UCODE:
+        case IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32:
+        case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32:
+        case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8:
+        case IWL_TM_CMD_APP2DEV_BEGIN_TRACE:
+        case IWL_TM_CMD_APP2DEV_END_TRACE:
+        case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_READ:
+        case IWL_TM_CMD_APP2DEV_NOTIFICATIONS:
+        case IWL_TM_CMD_APP2DEV_GET_FW_VERSION:
+        case IWL_TM_CMD_APP2DEV_GET_DEVICE_ID:
+        case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_WRITE:
+                result = iwl_test_handle_cmd(&priv->tst, tb);
+                break;
+
+        case IWL_TM_CMD_APP2DEV_GET_DEVICENAME:
+        case IWL_TM_CMD_APP2DEV_LOAD_INIT_FW:
+        case IWL_TM_CMD_APP2DEV_CFG_INIT_CALIB:
+        case IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW:
+        case IWL_TM_CMD_APP2DEV_GET_EEPROM:
+        case IWL_TM_CMD_APP2DEV_FIXRATE_REQ:
+        case IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW:
+        case IWL_TM_CMD_APP2DEV_GET_FW_INFO:
+                IWL_DEBUG_INFO(priv, "testmode cmd to driver\n");
+                result = iwl_testmode_driver(hw, tb);
+                break;
+
+        case IWL_TM_CMD_APP2DEV_OWNERSHIP:
+                IWL_DEBUG_INFO(priv, "testmode change uCode ownership\n");
+                result = iwl_testmode_ownership(hw, tb);
+                break;
+
+        default:
+                IWL_ERR(priv, "Unknown testmode command\n");
+                result = -ENOSYS;
+                break;
+        }
+        mutex_unlock(&priv->mutex);
+
+        if (result)
+                IWL_ERR(priv, "Test cmd failed result=%d\n", result);
+        return result;
+}
+
+int iwlagn_mac_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
+                      struct netlink_callback *cb,
+                      void *data, int len)
+{
+        struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
+        int result;
+        u32 cmd;
+
+        if (cb->args[3]) {
+                /* offset by 1 since commands start at 0 */
+                cmd = cb->args[3] - 1;
+        } else {
+                struct nlattr *tb[IWL_TM_ATTR_MAX];
+
+                result = iwl_test_parse(&priv->tst, tb, data, len);
+                if (result)
+                        return result;
+
+                cmd = nla_get_u32(tb[IWL_TM_ATTR_COMMAND]);
+                cb->args[3] = cmd + 1;
+        }
+
+        /* in case multiple accesses to the device happens */
+        mutex_lock(&priv->mutex);
+        result = iwl_test_dump(&priv->tst, cmd, skb, cb);
+        mutex_unlock(&priv->mutex);
+        return result;
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tt.c b/drivers/net/wireless/iwlwifi/dvm/tt.c
index a5cfe0aceedb..eb864433e59d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-tt.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tt.c
@@ -31,17 +31,14 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/init.h>
-
 #include <net/mac80211.h>
-
-#include "iwl-agn.h"
-#include "iwl-eeprom.h"
-#include "iwl-dev.h"
 #include "iwl-io.h"
-#include "iwl-commands.h"
-#include "iwl-debug.h"
-#include "iwl-agn-tt.h"
 #include "iwl-modparams.h"
+#include "iwl-debug.h"
+#include "agn.h"
+#include "dev.h"
+#include "commands.h"
+#include "tt.h"
 
 /* default Thermal Throttling transaction table
  * Current state   |         Throttling Down               |  Throttling Up
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tt.h b/drivers/net/wireless/iwlwifi/dvm/tt.h
index 86bbf47501c1..44c7c8f30a2d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-tt.h
+++ b/drivers/net/wireless/iwlwifi/dvm/tt.h
@@ -28,7 +28,7 @@
 #ifndef __iwl_tt_setting_h__
 #define __iwl_tt_setting_h__
 
-#include "iwl-commands.h"
+#include "commands.h"
 
 #define IWL_ABSOLUTE_ZERO               0
 #define IWL_ABSOLUTE_MAX                0xFFFFFFFF
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index 3366e2e2f00f..5971a23aa47d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -32,12 +32,11 @@
 #include <linux/init.h>
 #include <linux/sched.h>
 #include <linux/ieee80211.h>
-
-#include "iwl-dev.h"
 #include "iwl-io.h"
-#include "iwl-agn-hw.h"
-#include "iwl-agn.h"
 #include "iwl-trans.h"
+#include "iwl-agn-hw.h"
+#include "dev.h"
+#include "agn.h"
 
 static const u8 tid_to_ac[] = {
         IEEE80211_AC_BE,
@@ -187,7 +186,8 @@ static void iwlagn_tx_cmd_build_rate(struct iwl_priv *priv,
         rate_idx = info->control.rates[0].idx;
         if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS ||
                         (rate_idx < 0) || (rate_idx > IWL_RATE_COUNT_LEGACY))
-                rate_idx = rate_lowest_index(&priv->bands[info->band],
+                rate_idx = rate_lowest_index(
+                                &priv->eeprom_data->bands[info->band],
                                 info->control.sta);
         /* For 5 GHZ band, remap mac80211 rate indices into driver indices */
         if (info->band == IEEE80211_BAND_5GHZ)
@@ -207,10 +207,11 @@ static void iwlagn_tx_cmd_build_rate(struct iwl_priv *priv,
              priv->bt_full_concurrent) {
                 /* operated as 1x1 in full concurrency mode */
                 priv->mgmt_tx_ant = iwl_toggle_tx_ant(priv, priv->mgmt_tx_ant,
-                                first_antenna(priv->hw_params.valid_tx_ant));
+                                first_antenna(priv->eeprom_data->valid_tx_ant));
         } else
-                priv->mgmt_tx_ant = iwl_toggle_tx_ant(priv, priv->mgmt_tx_ant,
-                                                priv->hw_params.valid_tx_ant);
+                priv->mgmt_tx_ant = iwl_toggle_tx_ant(
+                                        priv, priv->mgmt_tx_ant,
+                                        priv->eeprom_data->valid_tx_ant);
         rate_flags |= iwl_ant_idx_to_flags(priv->mgmt_tx_ant);
 
         /* Set the rate in the TX cmd */
@@ -296,7 +297,7 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct iwl_station_priv *sta_priv = NULL;
         struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
-        struct iwl_device_cmd *dev_cmd = NULL;
+        struct iwl_device_cmd *dev_cmd;
         struct iwl_tx_cmd *tx_cmd;
         __le16 fc;
         u8 hdr_len;
@@ -378,7 +379,7 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         if (info->flags & IEEE80211_TX_CTL_AMPDU)
                 is_agg = true;
 
-        dev_cmd = kmem_cache_alloc(iwl_tx_cmd_pool, GFP_ATOMIC);
+        dev_cmd = iwl_trans_alloc_tx_cmd(priv->trans);
 
         if (unlikely(!dev_cmd))
                 goto drop_unlock_priv;
@@ -402,6 +403,7 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
         info->driver_data[0] = ctx;
         info->driver_data[1] = dev_cmd;
+        /* From now on, we cannot access info->control */
 
         spin_lock(&priv->sta_lock);
 
@@ -486,11 +488,14 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         if (sta_priv && sta_priv->client && !is_agg)
                 atomic_inc(&sta_priv->pending_frames);
 
+        if (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN)
+                iwl_scan_offchannel_skb(priv);
+
         return 0;
 
 drop_unlock_sta:
         if (dev_cmd)
-                kmem_cache_free(iwl_tx_cmd_pool, dev_cmd);
+                iwl_trans_free_tx_cmd(priv->trans, dev_cmd);
         spin_unlock(&priv->sta_lock);
 drop_unlock_priv:
         return -1;
@@ -597,7 +602,7 @@ turn_off:
                  * time, or we hadn't time to drain the AC queues.
                  */
                 if (agg_state == IWL_AGG_ON)
-                        iwl_trans_tx_agg_disable(priv->trans, txq_id);
+                        iwl_trans_txq_disable(priv->trans, txq_id);
                 else
                         IWL_DEBUG_TX_QUEUES(priv, "Don't disable tx agg: %d\n",
                                             agg_state);
@@ -686,9 +691,8 @@ int iwlagn_tx_agg_oper(struct iwl_priv *priv, struct ieee80211_vif *vif,
 
         fifo = ctx->ac_to_fifo[tid_to_ac[tid]];
 
-        iwl_trans_tx_agg_setup(priv->trans, q, fifo,
-                               sta_priv->sta_id, tid,
-                               buf_size, ssn);
+        iwl_trans_txq_enable(priv->trans, q, fifo, sta_priv->sta_id, tid,
+                             buf_size, ssn);
 
         /*
          * If the limit is 0, then it wasn't initialised yet,
@@ -753,8 +757,8 @@ static void iwlagn_check_ratid_empty(struct iwl_priv *priv, int sta_id, u8 tid)
                         IWL_DEBUG_TX_QUEUES(priv,
                                 "Can continue DELBA flow ssn = next_recl ="
                                 " %d", tid_data->next_reclaimed);
-                        iwl_trans_tx_agg_disable(priv->trans,
-                                                 tid_data->agg.txq_id);
+                        iwl_trans_txq_disable(priv->trans,
+                                              tid_data->agg.txq_id);
                         iwlagn_dealloc_agg_txq(priv, tid_data->agg.txq_id);
                         tid_data->agg.state = IWL_AGG_OFF;
                         ieee80211_stop_tx_ba_cb_irqsafe(vif, addr, tid);
@@ -1136,6 +1140,7 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
         struct sk_buff *skb;
         struct iwl_rxon_context *ctx;
         bool is_agg = (txq_id >= IWLAGN_FIRST_AMPDU_QUEUE);
+        bool is_offchannel_skb;
 
         tid = (tx_resp->ra_tid & IWLAGN_TX_RES_TID_MSK) >>
                 IWLAGN_TX_RES_TID_POS;
@@ -1149,6 +1154,8 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
 
         __skb_queue_head_init(&skbs);
 
+        is_offchannel_skb = false;
+
         if (tx_resp->frame_count == 1) {
                 u16 next_reclaimed = le16_to_cpu(tx_resp->seq_ctl);
                 next_reclaimed = SEQ_TO_SN(next_reclaimed + 0x10);
@@ -1176,7 +1183,8 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
                 }
 
                 /*we can free until ssn % q.n_bd not inclusive */
-                WARN_ON(iwl_reclaim(priv, sta_id, tid, txq_id, ssn, &skbs));
+                WARN_ON_ONCE(iwl_reclaim(priv, sta_id, tid,
+                                         txq_id, ssn, &skbs));
                 iwlagn_check_ratid_empty(priv, sta_id, tid);
                 freed = 0;
 
@@ -1189,8 +1197,8 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
 
                         info = IEEE80211_SKB_CB(skb);
                         ctx = info->driver_data[0];
-                        kmem_cache_free(iwl_tx_cmd_pool,
-                                        (info->driver_data[1]));
+                        iwl_trans_free_tx_cmd(priv->trans,
+                                              info->driver_data[1]);
 
                         memset(&info->status, 0, sizeof(info->status));
 
@@ -1225,10 +1233,19 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
                         if (!is_agg)
                                 iwlagn_non_agg_tx_status(priv, ctx, hdr->addr1);
 
+                        is_offchannel_skb =
+                                (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN);
                         freed++;
                 }
 
                 WARN_ON(!is_agg && freed != 1);
+
+                /*
+                 * An offchannel frame can be send only on the AUX queue, where
+                 * there is no aggregation (and reordering) so it only is single
+                 * skb is expected to be processed.
+                 */
+                WARN_ON(is_offchannel_skb && freed != 1);
         }
 
         iwl_check_abort_status(priv, tx_resp->frame_count, status);
@@ -1239,6 +1256,9 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
                 ieee80211_tx_status(priv->hw, skb);
         }
 
+        if (is_offchannel_skb)
+                iwl_scan_offchannel_skb_status(priv);
+
         return 0;
 }
 
@@ -1341,7 +1361,7 @@ int iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
                         WARN_ON_ONCE(1);
 
                 info = IEEE80211_SKB_CB(skb);
-                kmem_cache_free(iwl_tx_cmd_pool, (info->driver_data[1]));
+                iwl_trans_free_tx_cmd(priv->trans, info->driver_data[1]);
 
                 if (freed == 1) {
                         /* this is the first skb we deliver in this batch */
diff --git a/drivers/net/wireless/iwlwifi/iwl-ucode.c b/drivers/net/wireless/iwlwifi/dvm/ucode.c
index bc40dc68b0f4..b3a314ba48c7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-ucode.c
+++ b/drivers/net/wireless/iwlwifi/dvm/ucode.c
@@ -30,15 +30,16 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 
-#include "iwl-dev.h"
 #include "iwl-io.h"
 #include "iwl-agn-hw.h"
-#include "iwl-agn.h"
-#include "iwl-agn-calib.h"
 #include "iwl-trans.h"
 #include "iwl-fh.h"
 #include "iwl-op-mode.h"
 
+#include "dev.h"
+#include "agn.h"
+#include "calib.h"
+
 /******************************************************************************
  *
  * uCode download functions
@@ -60,8 +61,7 @@ iwl_get_ucode_image(struct iwl_priv *priv, enum iwl_ucode_type ucode_type)
 static int iwl_set_Xtal_calib(struct iwl_priv *priv)
 {
         struct iwl_calib_xtal_freq_cmd cmd;
-        __le16 *xtal_calib =
-                (__le16 *)iwl_eeprom_query_addr(priv, EEPROM_XTAL);
+        __le16 *xtal_calib = priv->eeprom_data->xtal_calib;
 
         iwl_set_calib_hdr(&cmd.hdr, IWL_PHY_CALIBRATE_CRYSTAL_FRQ_CMD);
         cmd.cap_pin1 = le16_to_cpu(xtal_calib[0]);
@@ -72,12 +72,10 @@ static int iwl_set_Xtal_calib(struct iwl_priv *priv)
 static int iwl_set_temperature_offset_calib(struct iwl_priv *priv)
 {
         struct iwl_calib_temperature_offset_cmd cmd;
-        __le16 *offset_calib =
-                (__le16 *)iwl_eeprom_query_addr(priv, EEPROM_RAW_TEMPERATURE);
 
         memset(&cmd, 0, sizeof(cmd));
         iwl_set_calib_hdr(&cmd.hdr, IWL_PHY_CALIBRATE_TEMP_OFFSET_CMD);
-        memcpy(&cmd.radio_sensor_offset, offset_calib, sizeof(*offset_calib));
+        cmd.radio_sensor_offset = priv->eeprom_data->raw_temperature;
         if (!(cmd.radio_sensor_offset))
                 cmd.radio_sensor_offset = DEFAULT_RADIO_SENSOR_OFFSET;
 
@@ -89,27 +87,17 @@ static int iwl_set_temperature_offset_calib(struct iwl_priv *priv)
 static int iwl_set_temperature_offset_calib_v2(struct iwl_priv *priv)
 {
         struct iwl_calib_temperature_offset_v2_cmd cmd;
-        __le16 *offset_calib_high = (__le16 *)iwl_eeprom_query_addr(priv,
-                                     EEPROM_KELVIN_TEMPERATURE);
-        __le16 *offset_calib_low =
-                (__le16 *)iwl_eeprom_query_addr(priv, EEPROM_RAW_TEMPERATURE);
-        struct iwl_eeprom_calib_hdr *hdr;
 
         memset(&cmd, 0, sizeof(cmd));
         iwl_set_calib_hdr(&cmd.hdr, IWL_PHY_CALIBRATE_TEMP_OFFSET_CMD);
-        hdr = (struct iwl_eeprom_calib_hdr *)iwl_eeprom_query_addr(priv,
-                                                        EEPROM_CALIB_ALL);
-        memcpy(&cmd.radio_sensor_offset_high, offset_calib_high,
-                sizeof(*offset_calib_high));
-        memcpy(&cmd.radio_sensor_offset_low, offset_calib_low,
-                sizeof(*offset_calib_low));
-        if (!(cmd.radio_sensor_offset_low)) {
+        cmd.radio_sensor_offset_high = priv->eeprom_data->kelvin_temperature;
+        cmd.radio_sensor_offset_low = priv->eeprom_data->raw_temperature;
+        if (!cmd.radio_sensor_offset_low) {
                 IWL_DEBUG_CALIB(priv, "no info in EEPROM, use default\n");
                 cmd.radio_sensor_offset_low = DEFAULT_RADIO_SENSOR_OFFSET;
                 cmd.radio_sensor_offset_high = DEFAULT_RADIO_SENSOR_OFFSET;
         }
-        memcpy(&cmd.burntVoltageRef, &hdr->voltage,
-                sizeof(hdr->voltage));
+        cmd.burntVoltageRef = priv->eeprom_data->calib_voltage;
 
         IWL_DEBUG_CALIB(priv, "Radio sensor offset high: %d\n",
                         le16_to_cpu(cmd.radio_sensor_offset_high));
@@ -177,7 +165,7 @@ int iwl_init_alive_start(struct iwl_priv *priv)
         return 0;
 }
 
-int iwl_send_wimax_coex(struct iwl_priv *priv)
+static int iwl_send_wimax_coex(struct iwl_priv *priv)
 {
         struct iwl_wimax_coex_cmd coex_cmd;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h
index 67b28aa7f9be..10e47938b635 100644
--- a/drivers/net/wireless/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/iwlwifi/iwl-config.h
@@ -113,7 +113,7 @@ enum iwl_led_mode {
 #define IWL_MAX_PLCP_ERR_THRESHOLD_DISABLE      0
 
 /* TX queue watchdog timeouts in mSecs */
-#define IWL_WATCHHDOG_DISABLED  0
+#define IWL_WATCHDOG_DISABLED   0
 #define IWL_DEF_WD_TIMEOUT      2000
 #define IWL_LONG_WD_TIMEOUT     10000
 #define IWL_MAX_WD_TIMEOUT      120000
@@ -143,7 +143,7 @@ enum iwl_led_mode {
  * @chain_noise_scale: default chain noise scale used for gain computation
  * @wd_timeout: TX queues watchdog timeout
  * @max_event_log_size: size of event log buffer size for ucode event logging
- * @shadow_reg_enable: HW shadhow register bit
+ * @shadow_reg_enable: HW shadow register support
  * @hd_v2: v2 of enhanced sensitivity value, used for 2000 series and up
  * @no_idle_support: do not support idle mode
  */
@@ -182,13 +182,34 @@ struct iwl_bt_params {
         bool bt_sco_disable;
         bool bt_session_2;
 };
+
 /*
  * @use_rts_for_aggregation: use rts/cts protection for HT traffic
+ * @ht40_bands: bitmap of bands (using %IEEE80211_BAND_*) that support HT40
  */
 struct iwl_ht_params {
+        enum ieee80211_smps_mode smps_mode;
         const bool ht_greenfield_support; /* if used set to true */
         bool use_rts_for_aggregation;
-        enum ieee80211_smps_mode smps_mode;
+        u8 ht40_bands;
+};
+
+/*
+ * information on how to parse the EEPROM
+ */
+#define EEPROM_REG_BAND_1_CHANNELS              0x08
+#define EEPROM_REG_BAND_2_CHANNELS              0x26
+#define EEPROM_REG_BAND_3_CHANNELS              0x42
+#define EEPROM_REG_BAND_4_CHANNELS              0x5C
+#define EEPROM_REG_BAND_5_CHANNELS              0x74
+#define EEPROM_REG_BAND_24_HT40_CHANNELS        0x82
+#define EEPROM_REG_BAND_52_HT40_CHANNELS        0x92
+#define EEPROM_6000_REG_BAND_24_HT40_CHANNELS   0x80
+#define EEPROM_REGULATORY_BAND_NO_HT40          0
+
+struct iwl_eeprom_params {
+        const u8 regulatory_bands[7];
+        bool enhanced_txpower;
 };
 
 /**
@@ -243,6 +264,7 @@ struct iwl_cfg {
         /* params likely to change within a device family */
         const struct iwl_ht_params *ht_params;
         const struct iwl_bt_params *bt_params;
+        const struct iwl_eeprom_params *eeprom_params;
         const bool need_temp_offset_calib; /* if used set to true */
         const bool no_xtal_calib;
         enum iwl_led_mode led_mode;
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index 59750543fce7..34a5287dfc2f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -97,13 +97,10 @@
 /*
  * Hardware revision info
  * Bit fields:
- * 31-8:  Reserved
- *  7-4:  Type of device:  see CSR_HW_REV_TYPE_xxx definitions
+ * 31-16:  Reserved
+ *  15-4:  Type of device:  see CSR_HW_REV_TYPE_xxx definitions
  *  3-2:  Revision step:  0 = A, 1 = B, 2 = C, 3 = D
  *  1-0:  "Dash" (-) value, as in A-1, etc.
- *
- * NOTE:  Revision step affects calculation of CCK txpower for 4965.
- * NOTE:  See also CSR_HW_REV_WA_REG (work-around for bug in 4965).
  */
 #define CSR_HW_REV              (CSR_BASE+0x028)
 
@@ -155,9 +152,21 @@
 #define CSR_DBG_LINK_PWR_MGMT_REG       (CSR_BASE+0x250)
 
 /* Bits for CSR_HW_IF_CONFIG_REG */
-#define CSR_HW_IF_CONFIG_REG_MSK_BOARD_VER      (0x00000C00)
-#define CSR_HW_IF_CONFIG_REG_BIT_MAC_SI         (0x00000100)
+#define CSR_HW_IF_CONFIG_REG_MSK_MAC_DASH       (0x00000003)
+#define CSR_HW_IF_CONFIG_REG_MSK_MAC_STEP       (0x0000000C)
+#define CSR_HW_IF_CONFIG_REG_MSK_BOARD_VER      (0x000000C0)
+#define CSR_HW_IF_CONFIG_REG_BIT_MAC_SI         (0x00000100)
 #define CSR_HW_IF_CONFIG_REG_BIT_RADIO_SI       (0x00000200)
+#define CSR_HW_IF_CONFIG_REG_MSK_PHY_TYPE       (0x00000C00)
+#define CSR_HW_IF_CONFIG_REG_MSK_PHY_DASH       (0x00003000)
+#define CSR_HW_IF_CONFIG_REG_MSK_PHY_STEP       (0x0000C000)
+
+#define CSR_HW_IF_CONFIG_REG_POS_MAC_DASH       (0)
+#define CSR_HW_IF_CONFIG_REG_POS_MAC_STEP       (2)
+#define CSR_HW_IF_CONFIG_REG_POS_BOARD_VER      (6)
+#define CSR_HW_IF_CONFIG_REG_POS_PHY_TYPE       (10)
+#define CSR_HW_IF_CONFIG_REG_POS_PHY_DASH       (12)
+#define CSR_HW_IF_CONFIG_REG_POS_PHY_STEP       (14)
 
 #define CSR_HW_IF_CONFIG_REG_BIT_HAP_WAKE_L1A   (0x00080000)
 #define CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM (0x00200000)
@@ -270,7 +279,10 @@
 
 
 /* HW REV */
-#define CSR_HW_REV_TYPE_MSK            (0x00001F0)
+#define CSR_HW_REV_DASH(_val)          (((_val) & 0x0000003) >> 0)
+#define CSR_HW_REV_STEP(_val)          (((_val) & 0x000000C) >> 2)
+
+#define CSR_HW_REV_TYPE_MSK            (0x000FFF0)
 #define CSR_HW_REV_TYPE_5300           (0x0000020)
 #define CSR_HW_REV_TYPE_5350           (0x0000030)
 #define CSR_HW_REV_TYPE_5100           (0x0000050)
diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.c b/drivers/net/wireless/iwlwifi/iwl-debug.c
index 2d1b42847b9b..0f8fcd1d4fe2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debug.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debug.c
@@ -62,6 +62,7 @@
  *****************************************************************************/
 
 #include <linux/interrupt.h>
+#include <linux/export.h>
 #include "iwl-debug.h"
 #include "iwl-devtrace.h"
 
@@ -81,8 +82,11 @@ void __iwl_ ##fn(struct device *dev, const char *fmt, ...)	\
 }
 
 __iwl_fn(warn)
+EXPORT_SYMBOL_GPL(__iwl_warn);
 __iwl_fn(info)
+EXPORT_SYMBOL_GPL(__iwl_info);
 __iwl_fn(crit)
+EXPORT_SYMBOL_GPL(__iwl_crit);
 
 void __iwl_err(struct device *dev, bool rfkill_prefix, bool trace_only,
                 const char *fmt, ...)
@@ -103,6 +107,7 @@ void __iwl_err(struct device *dev, bool rfkill_prefix, bool trace_only,
         trace_iwlwifi_err(&vaf);
         va_end(args);
 }
+EXPORT_SYMBOL_GPL(__iwl_err);
 
 #if defined(CONFIG_IWLWIFI_DEBUG) || defined(CONFIG_IWLWIFI_DEVICE_TRACING)
 void __iwl_dbg(struct device *dev,
@@ -125,4 +130,5 @@ void __iwl_dbg(struct device *dev,
         trace_iwlwifi_dbg(level, in_interrupt(), function, &vaf);
         va_end(args);
 }
+EXPORT_SYMBOL_GPL(__iwl_dbg);
 #endif
diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.h b/drivers/net/wireless/iwlwifi/iwl-debug.h
index 8376b842bdba..42b20b0e83bc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debug.h
+++ b/drivers/net/wireless/iwlwifi/iwl-debug.h
@@ -38,13 +38,14 @@ static inline bool iwl_have_debug_level(u32 level)
 }
 
 void __iwl_err(struct device *dev, bool rfkill_prefix, bool only_trace,
-                const char *fmt, ...);
-void __iwl_warn(struct device *dev, const char *fmt, ...);
-void __iwl_info(struct device *dev, const char *fmt, ...);
-void __iwl_crit(struct device *dev, const char *fmt, ...);
+                const char *fmt, ...) __printf(4, 5);
+void __iwl_warn(struct device *dev, const char *fmt, ...) __printf(2, 3);
+void __iwl_info(struct device *dev, const char *fmt, ...) __printf(2, 3);
+void __iwl_crit(struct device *dev, const char *fmt, ...) __printf(2, 3);
 
 /* No matter what is m (priv, bus, trans), this will work */
 #define IWL_ERR(m, f, a...) __iwl_err((m)->dev, false, false, f, ## a)
+#define IWL_ERR_DEV(d, f, a...) __iwl_err((d), false, false, f, ## a)
 #define IWL_WARN(m, f, a...) __iwl_warn((m)->dev, f, ## a)
 #define IWL_INFO(m, f, a...) __iwl_info((m)->dev, f, ## a)
 #define IWL_CRIT(m, f, a...) __iwl_crit((m)->dev, f, ## a)
@@ -52,9 +53,9 @@ void __iwl_crit(struct device *dev, const char *fmt, ...);
 #if defined(CONFIG_IWLWIFI_DEBUG) || defined(CONFIG_IWLWIFI_DEVICE_TRACING)
 void __iwl_dbg(struct device *dev,
                u32 level, bool limit, const char *function,
-               const char *fmt, ...);
+               const char *fmt, ...) __printf(5, 6);
 #else
-static inline void
+__printf(5, 6) static inline void
 __iwl_dbg(struct device *dev,
           u32 level, bool limit, const char *function,
           const char *fmt, ...)
@@ -69,6 +70,8 @@ do {									\
 
 #define IWL_DEBUG(m, level, fmt, args...)                               \
         __iwl_dbg((m)->dev, level, false, __func__, fmt, ##args)
+#define IWL_DEBUG_DEV(dev, level, fmt, args...)                         \
+        __iwl_dbg((dev), level, false, __func__, fmt, ##args)
 #define IWL_DEBUG_LIMIT(m, level, fmt, args...)                         \
         __iwl_dbg((m)->dev, level, true, __func__, fmt, ##args)
 
@@ -153,7 +156,7 @@ do {                                            			\
 #define IWL_DEBUG_LED(p, f, a...)       IWL_DEBUG(p, IWL_DL_LED, f, ## a)
 #define IWL_DEBUG_WEP(p, f, a...)       IWL_DEBUG(p, IWL_DL_WEP, f, ## a)
 #define IWL_DEBUG_HC(p, f, a...)        IWL_DEBUG(p, IWL_DL_HCMD, f, ## a)
-#define IWL_DEBUG_EEPROM(p, f, a...)    IWL_DEBUG(p, IWL_DL_EEPROM, f, ## a)
+#define IWL_DEBUG_EEPROM(d, f, a...)    IWL_DEBUG_DEV(d, IWL_DL_EEPROM, f, ## a)
 #define IWL_DEBUG_CALIB(p, f, a...)     IWL_DEBUG(p, IWL_DL_CALIB, f, ## a)
 #define IWL_DEBUG_FW(p, f, a...)        IWL_DEBUG(p, IWL_DL_FW, f, ## a)
 #define IWL_DEBUG_RF_KILL(p, f, a...)   IWL_DEBUG(p, IWL_DL_RF_KILL, f, ## a)
diff --git a/drivers/net/wireless/iwlwifi/iwl-devtrace.c b/drivers/net/wireless/iwlwifi/iwl-devtrace.c
index 91f45e71e0a2..70191ddbd8f6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-devtrace.c
+++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.c
@@ -42,4 +42,9 @@ EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ucode_event);
 EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ucode_error);
 EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ucode_cont_event);
 EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ucode_wrap_event);
+EXPORT_TRACEPOINT_SYMBOL(iwlwifi_info);
+EXPORT_TRACEPOINT_SYMBOL(iwlwifi_warn);
+EXPORT_TRACEPOINT_SYMBOL(iwlwifi_crit);
+EXPORT_TRACEPOINT_SYMBOL(iwlwifi_err);
+EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dbg);
 #endif
diff --git a/drivers/net/wireless/iwlwifi/iwl-devtrace.h b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
index 06203d6a1d86..65364793021f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-devtrace.h
+++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
@@ -28,6 +28,7 @@
 #define __IWLWIFI_DEVICE_TRACE
 
 #include <linux/tracepoint.h>
+#include <linux/device.h>
 
 
 #if !defined(CONFIG_IWLWIFI_DEVICE_TRACING) || defined(__CHECKER__)
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index fac67a526a30..095547b37a27 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -77,8 +77,33 @@
 /* private includes */
 #include "iwl-fw-file.h"
 
+/******************************************************************************
+ *
+ * module boiler plate
+ *
+ ******************************************************************************/
+
+/*
+ * module name, copyright, version, etc.
+ */
+#define DRV_DESCRIPTION "Intel(R) Wireless WiFi driver for Linux"
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+#define VD "d"
+#else
+#define VD
+#endif
+
+#define DRV_VERSION     IWLWIFI_VERSION VD
+
+MODULE_DESCRIPTION(DRV_DESCRIPTION);
+MODULE_VERSION(DRV_VERSION);
+MODULE_AUTHOR(DRV_COPYRIGHT " " DRV_AUTHOR);
+MODULE_LICENSE("GPL");
+
 /**
  * struct iwl_drv - drv common data
+ * @list: list of drv structures using this opmode
  * @fw: the iwl_fw structure
  * @op_mode: the running op_mode
  * @trans: transport layer
@@ -89,6 +114,7 @@
  * @request_firmware_complete: the firmware has been obtained from user space
  */
 struct iwl_drv {
+        struct list_head list;
         struct iwl_fw fw;
 
         struct iwl_op_mode *op_mode;
@@ -102,7 +128,19 @@ struct iwl_drv {
         struct completion request_firmware_complete;
 };
 
-
+#define DVM_OP_MODE     0
+#define MVM_OP_MODE     1
+
+/* Protects the table contents, i.e. the ops pointer & drv list */
+static struct mutex iwlwifi_opmode_table_mtx;
+static struct iwlwifi_opmode_table {
+        const char *name;                       /* name: iwldvm, iwlmvm, etc */
+        const struct iwl_op_mode_ops *ops;      /* pointer to op_mode ops */
+        struct list_head drv;           /* list of devices using this op_mode */
+} iwlwifi_opmode_table[] = {            /* ops set when driver is initialized */
+        { .name = "iwldvm", .ops = NULL },
+        { .name = "iwlmvm", .ops = NULL },
+};
 
 /*
  * struct fw_sec: Just for the image parsing proccess.
@@ -721,7 +759,6 @@ static int validate_sec_sizes(struct iwl_drv *drv,
         return 0;
 }
 
-
 /**
  * iwl_ucode_callback - callback when firmware was loaded
  *
@@ -733,6 +770,7 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
         struct iwl_drv *drv = context;
         struct iwl_fw *fw = &drv->fw;
         struct iwl_ucode_header *ucode;
+        struct iwlwifi_opmode_table *op;
         int err;
         struct iwl_firmware_pieces pieces;
         const unsigned int api_max = drv->cfg->ucode_api_max;
@@ -740,6 +778,7 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
         const unsigned int api_min = drv->cfg->ucode_api_min;
         u32 api_ver;
         int i;
+        bool load_module = false;
 
         fw->ucode_capa.max_probe_length = 200;
         fw->ucode_capa.standard_phy_calibration_size =
@@ -862,10 +901,22 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
         /* We have our copies now, allow OS release its copies */
         release_firmware(ucode_raw);
 
-        drv->op_mode = iwl_dvm_ops.start(drv->trans, drv->cfg, &drv->fw);
+        mutex_lock(&iwlwifi_opmode_table_mtx);
+        op = &iwlwifi_opmode_table[DVM_OP_MODE];
 
-        if (!drv->op_mode)
-                goto out_unbind;
+        /* add this device to the list of devices using this op_mode */
+        list_add_tail(&drv->list, &op->drv);
+
+        if (op->ops) {
+                const struct iwl_op_mode_ops *ops = op->ops;
+                drv->op_mode = ops->start(drv->trans, drv->cfg, &drv->fw);
+
+                if (!drv->op_mode)
+                        goto out_unbind;
+        } else {
+                load_module = true;
+        }
+        mutex_unlock(&iwlwifi_opmode_table_mtx);
 
         /*
          * Complete the firmware request last so that
@@ -873,6 +924,14 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
          * are doing the start() above.
          */
         complete(&drv->request_firmware_complete);
+
+        /*
+         * Load the module last so we don't block anything
+         * else from proceeding if the module fails to load
+         * or hangs loading.
+         */
+        if (load_module)
+                request_module("%s", op->name);
         return;
 
  try_again:
@@ -906,6 +965,7 @@ struct iwl_drv *iwl_drv_start(struct iwl_trans *trans,
         drv->cfg = cfg;
 
         init_completion(&drv->request_firmware_complete);
+        INIT_LIST_HEAD(&drv->list);
 
         ret = iwl_request_firmware(drv, true);
 
@@ -928,6 +988,16 @@ void iwl_drv_stop(struct iwl_drv *drv)
 
         iwl_dealloc_ucode(drv);
 
+        mutex_lock(&iwlwifi_opmode_table_mtx);
+        /*
+         * List is empty (this item wasn't added)
+         * when firmware loading failed -- in that
+         * case we can't remove it from any list.
+         */
+        if (!list_empty(&drv->list))
+                list_del(&drv->list);
+        mutex_unlock(&iwlwifi_opmode_table_mtx);
+
         kfree(drv);
 }
 
@@ -943,6 +1013,75 @@ struct iwl_mod_params iwlwifi_mod_params = {
         .auto_agg = true,
         /* the rest are 0 by default */
 };
+EXPORT_SYMBOL_GPL(iwlwifi_mod_params);
+
+int iwl_opmode_register(const char *name, const struct iwl_op_mode_ops *ops)
+{
+        int i;
+        struct iwl_drv *drv;
+
+        mutex_lock(&iwlwifi_opmode_table_mtx);
+        for (i = 0; i < ARRAY_SIZE(iwlwifi_opmode_table); i++) {
+                if (strcmp(iwlwifi_opmode_table[i].name, name))
+                        continue;
+                iwlwifi_opmode_table[i].ops = ops;
+                list_for_each_entry(drv, &iwlwifi_opmode_table[i].drv, list)
+                        drv->op_mode = ops->start(drv->trans, drv->cfg,
+                                                  &drv->fw);
+                mutex_unlock(&iwlwifi_opmode_table_mtx);
+                return 0;
+        }
+        mutex_unlock(&iwlwifi_opmode_table_mtx);
+        return -EIO;
+}
+EXPORT_SYMBOL_GPL(iwl_opmode_register);
+
+void iwl_opmode_deregister(const char *name)
+{
+        int i;
+        struct iwl_drv *drv;
+
+        mutex_lock(&iwlwifi_opmode_table_mtx);
+        for (i = 0; i < ARRAY_SIZE(iwlwifi_opmode_table); i++) {
+                if (strcmp(iwlwifi_opmode_table[i].name, name))
+                        continue;
+                iwlwifi_opmode_table[i].ops = NULL;
+
+                /* call the stop routine for all devices */
+                list_for_each_entry(drv, &iwlwifi_opmode_table[i].drv, list) {
+                        if (drv->op_mode) {
+                                iwl_op_mode_stop(drv->op_mode);
+                                drv->op_mode = NULL;
+                        }
+                }
+                mutex_unlock(&iwlwifi_opmode_table_mtx);
+                return;
+        }
+        mutex_unlock(&iwlwifi_opmode_table_mtx);
+}
+EXPORT_SYMBOL_GPL(iwl_opmode_deregister);
+
+static int __init iwl_drv_init(void)
+{
+        int i;
+
+        mutex_init(&iwlwifi_opmode_table_mtx);
+
+        for (i = 0; i < ARRAY_SIZE(iwlwifi_opmode_table); i++)
+                INIT_LIST_HEAD(&iwlwifi_opmode_table[i].drv);
+
+        pr_info(DRV_DESCRIPTION ", " DRV_VERSION "\n");
+        pr_info(DRV_COPYRIGHT "\n");
+
+        return iwl_pci_register_driver();
+}
+module_init(iwl_drv_init);
+
+static void __exit iwl_drv_exit(void)
+{
+        iwl_pci_unregister_driver();
+}
+module_exit(iwl_drv_exit);
 
 #ifdef CONFIG_IWLWIFI_DEBUG
 module_param_named(debug, iwlwifi_mod_params.debug_level, uint,
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c
new file mode 100644
index 000000000000..c87a05cbec12
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c
@@ -0,0 +1,900 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2012 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2005 - 2012 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+#include <linux/types.h>
+#include <linux/slab.h>
+#include <linux/export.h>
+#include "iwl-modparams.h"
+#include "iwl-eeprom-parse.h"
+
+/* EEPROM offset definitions */
+
+/* indirect access definitions */
+#define ADDRESS_MSK                 0x0000FFFF
+#define INDIRECT_TYPE_MSK           0x000F0000
+#define INDIRECT_HOST               0x00010000
+#define INDIRECT_GENERAL            0x00020000
+#define INDIRECT_REGULATORY         0x00030000
+#define INDIRECT_CALIBRATION        0x00040000
+#define INDIRECT_PROCESS_ADJST      0x00050000
+#define INDIRECT_OTHERS             0x00060000
+#define INDIRECT_TXP_LIMIT          0x00070000
+#define INDIRECT_TXP_LIMIT_SIZE     0x00080000
+#define INDIRECT_ADDRESS            0x00100000
+
+/* corresponding link offsets in EEPROM */
+#define EEPROM_LINK_HOST             (2*0x64)
+#define EEPROM_LINK_GENERAL          (2*0x65)
+#define EEPROM_LINK_REGULATORY       (2*0x66)
+#define EEPROM_LINK_CALIBRATION      (2*0x67)
+#define EEPROM_LINK_PROCESS_ADJST    (2*0x68)
+#define EEPROM_LINK_OTHERS           (2*0x69)
+#define EEPROM_LINK_TXP_LIMIT        (2*0x6a)
+#define EEPROM_LINK_TXP_LIMIT_SIZE   (2*0x6b)
+
+/* General */
+#define EEPROM_DEVICE_ID                    (2*0x08)    /* 2 bytes */
+#define EEPROM_SUBSYSTEM_ID                 (2*0x0A)    /* 2 bytes */
+#define EEPROM_MAC_ADDRESS                  (2*0x15)    /* 6  bytes */
+#define EEPROM_BOARD_REVISION               (2*0x35)    /* 2  bytes */
+#define EEPROM_BOARD_PBA_NUMBER             (2*0x3B+1)  /* 9  bytes */
+#define EEPROM_VERSION                      (2*0x44)    /* 2  bytes */
+#define EEPROM_SKU_CAP                      (2*0x45)    /* 2  bytes */
+#define EEPROM_OEM_MODE                     (2*0x46)    /* 2  bytes */
+#define EEPROM_RADIO_CONFIG                 (2*0x48)    /* 2  bytes */
+#define EEPROM_NUM_MAC_ADDRESS              (2*0x4C)    /* 2  bytes */
+
+/* calibration */
+struct iwl_eeprom_calib_hdr {
+        u8 version;
+        u8 pa_type;
+        __le16 voltage;
+} __packed;
+
+#define EEPROM_CALIB_ALL        (INDIRECT_ADDRESS | INDIRECT_CALIBRATION)
+#define EEPROM_XTAL             ((2*0x128) | EEPROM_CALIB_ALL)
+
+/* temperature */
+#define EEPROM_KELVIN_TEMPERATURE       ((2*0x12A) | EEPROM_CALIB_ALL)
+#define EEPROM_RAW_TEMPERATURE          ((2*0x12B) | EEPROM_CALIB_ALL)
+
+/*
+ * EEPROM bands
+ * These are the channel numbers from each band in the order
+ * that they are stored in the EEPROM band information. Note
+ * that EEPROM bands aren't the same as mac80211 bands, and
+ * there are even special "ht40 bands" in the EEPROM.
+ */
+static const u8 iwl_eeprom_band_1[14] = { /* 2.4 GHz */
+        1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14
+};
+
+static const u8 iwl_eeprom_band_2[] = { /* 4915-5080MHz */
+        183, 184, 185, 187, 188, 189, 192, 196, 7, 8, 11, 12, 16
+};
+
+static const u8 iwl_eeprom_band_3[] = { /* 5170-5320MHz */
+        34, 36, 38, 40, 42, 44, 46, 48, 52, 56, 60, 64
+};
+
+static const u8 iwl_eeprom_band_4[] = { /* 5500-5700MHz */
+        100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140
+};
+
+static const u8 iwl_eeprom_band_5[] = { /* 5725-5825MHz */
+        145, 149, 153, 157, 161, 165
+};
+
+static const u8 iwl_eeprom_band_6[] = { /* 2.4 ht40 channel */
+        1, 2, 3, 4, 5, 6, 7
+};
+
+static const u8 iwl_eeprom_band_7[] = { /* 5.2 ht40 channel */
+        36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157
+};
+
+#define IWL_NUM_CHANNELS        (ARRAY_SIZE(iwl_eeprom_band_1) + \
+                                 ARRAY_SIZE(iwl_eeprom_band_2) + \
+                                 ARRAY_SIZE(iwl_eeprom_band_3) + \
+                                 ARRAY_SIZE(iwl_eeprom_band_4) + \
+                                 ARRAY_SIZE(iwl_eeprom_band_5))
+
+/* rate data (static) */
+static struct ieee80211_rate iwl_cfg80211_rates[] = {
+        { .bitrate = 1 * 10, .hw_value = 0, .hw_value_short = 0, },
+        { .bitrate = 2 * 10, .hw_value = 1, .hw_value_short = 1,
+          .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
+        { .bitrate = 5.5 * 10, .hw_value = 2, .hw_value_short = 2,
+          .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
+        { .bitrate = 11 * 10, .hw_value = 3, .hw_value_short = 3,
+          .flags = IEEE80211_RATE_SHORT_PREAMBLE, },
+        { .bitrate = 6 * 10, .hw_value = 4, .hw_value_short = 4, },
+        { .bitrate = 9 * 10, .hw_value = 5, .hw_value_short = 5, },
+        { .bitrate = 12 * 10, .hw_value = 6, .hw_value_short = 6, },
+        { .bitrate = 18 * 10, .hw_value = 7, .hw_value_short = 7, },
+        { .bitrate = 24 * 10, .hw_value = 8, .hw_value_short = 8, },
+        { .bitrate = 36 * 10, .hw_value = 9, .hw_value_short = 9, },
+        { .bitrate = 48 * 10, .hw_value = 10, .hw_value_short = 10, },
+        { .bitrate = 54 * 10, .hw_value = 11, .hw_value_short = 11, },
+};
+#define RATES_24_OFFS   0
+#define N_RATES_24      ARRAY_SIZE(iwl_cfg80211_rates)
+#define RATES_52_OFFS   4
+#define N_RATES_52      (N_RATES_24 - RATES_52_OFFS)
+
+/* EEPROM reading functions */
+
+static u16 iwl_eeprom_query16(const u8 *eeprom, size_t eeprom_size, int offset)
+{
+        if (WARN_ON(offset + sizeof(u16) > eeprom_size))
+                return 0;
+        return le16_to_cpup((__le16 *)(eeprom + offset));
+}
+
+static u32 eeprom_indirect_address(const u8 *eeprom, size_t eeprom_size,
+                                   u32 address)
+{
+        u16 offset = 0;
+
+        if ((address & INDIRECT_ADDRESS) == 0)
+                return address;
+
+        switch (address & INDIRECT_TYPE_MSK) {
+        case INDIRECT_HOST:
+                offset = iwl_eeprom_query16(eeprom, eeprom_size,
+                                            EEPROM_LINK_HOST);
+                break;
+        case INDIRECT_GENERAL:
+                offset = iwl_eeprom_query16(eeprom, eeprom_size,
+                                            EEPROM_LINK_GENERAL);
+                break;
+        case INDIRECT_REGULATORY:
+                offset = iwl_eeprom_query16(eeprom, eeprom_size,
+                                            EEPROM_LINK_REGULATORY);
+                break;
+        case INDIRECT_TXP_LIMIT:
+                offset = iwl_eeprom_query16(eeprom, eeprom_size,
+                                            EEPROM_LINK_TXP_LIMIT);
+                break;
+        case INDIRECT_TXP_LIMIT_SIZE:
+                offset = iwl_eeprom_query16(eeprom, eeprom_size,
+                                            EEPROM_LINK_TXP_LIMIT_SIZE);
+                break;
+        case INDIRECT_CALIBRATION:
+                offset = iwl_eeprom_query16(eeprom, eeprom_size,
+                                            EEPROM_LINK_CALIBRATION);
+                break;
+        case INDIRECT_PROCESS_ADJST:
+                offset = iwl_eeprom_query16(eeprom, eeprom_size,
+                                            EEPROM_LINK_PROCESS_ADJST);
+                break;
+        case INDIRECT_OTHERS:
+                offset = iwl_eeprom_query16(eeprom, eeprom_size,
+                                            EEPROM_LINK_OTHERS);
+                break;
+        default:
+                WARN_ON(1);
+                break;
+        }
+
+        /* translate the offset from words to byte */
+        return (address & ADDRESS_MSK) + (offset << 1);
+}
+
+static const u8 *iwl_eeprom_query_addr(const u8 *eeprom, size_t eeprom_size,
+                                       u32 offset)
+{
+        u32 address = eeprom_indirect_address(eeprom, eeprom_size, offset);
+
+        if (WARN_ON(address >= eeprom_size))
+                return NULL;
+
+        return &eeprom[address];
+}
+
+static int iwl_eeprom_read_calib(const u8 *eeprom, size_t eeprom_size,
+                                 struct iwl_eeprom_data *data)
+{
+        struct iwl_eeprom_calib_hdr *hdr;
+
+        hdr = (void *)iwl_eeprom_query_addr(eeprom, eeprom_size,
+                                            EEPROM_CALIB_ALL);
+        if (!hdr)
+                return -ENODATA;
+        data->calib_version = hdr->version;
+        data->calib_voltage = hdr->voltage;
+
+        return 0;
+}
+
+/**
+ * enum iwl_eeprom_channel_flags - channel flags in EEPROM
+ * @EEPROM_CHANNEL_VALID: channel is usable for this SKU/geo
+ * @EEPROM_CHANNEL_IBSS: usable as an IBSS channel
+ * @EEPROM_CHANNEL_ACTIVE: active scanning allowed
+ * @EEPROM_CHANNEL_RADAR: radar detection required
+ * @EEPROM_CHANNEL_WIDE: 20 MHz channel okay (?)
+ * @EEPROM_CHANNEL_DFS: dynamic freq selection candidate
+ */
+enum iwl_eeprom_channel_flags {
+        EEPROM_CHANNEL_VALID = BIT(0),
+        EEPROM_CHANNEL_IBSS = BIT(1),
+        EEPROM_CHANNEL_ACTIVE = BIT(3),
+        EEPROM_CHANNEL_RADAR = BIT(4),
+        EEPROM_CHANNEL_WIDE = BIT(5),
+        EEPROM_CHANNEL_DFS = BIT(7),
+};
+
+/**
+ * struct iwl_eeprom_channel - EEPROM channel data
+ * @flags: %EEPROM_CHANNEL_* flags
+ * @max_power_avg: max power (in dBm) on this channel, at most 31 dBm
+ */
+struct iwl_eeprom_channel {
+        u8 flags;
+        s8 max_power_avg;
+} __packed;
+
+
+enum iwl_eeprom_enhanced_txpwr_flags {
+        IWL_EEPROM_ENH_TXP_FL_VALID = BIT(0),
+        IWL_EEPROM_ENH_TXP_FL_BAND_52G = BIT(1),
+        IWL_EEPROM_ENH_TXP_FL_OFDM = BIT(2),
+        IWL_EEPROM_ENH_TXP_FL_40MHZ = BIT(3),
+        IWL_EEPROM_ENH_TXP_FL_HT_AP = BIT(4),
+        IWL_EEPROM_ENH_TXP_FL_RES1 = BIT(5),
+        IWL_EEPROM_ENH_TXP_FL_RES2 = BIT(6),
+        IWL_EEPROM_ENH_TXP_FL_COMMON_TYPE = BIT(7),
+};
+
+/**
+ * iwl_eeprom_enhanced_txpwr structure
+ * @flags: entry flags
+ * @channel: channel number
+ * @chain_a_max_pwr: chain a max power in 1/2 dBm
+ * @chain_b_max_pwr: chain b max power in 1/2 dBm
+ * @chain_c_max_pwr: chain c max power in 1/2 dBm
+ * @delta_20_in_40: 20-in-40 deltas (hi/lo)
+ * @mimo2_max_pwr: mimo2 max power in 1/2 dBm
+ * @mimo3_max_pwr: mimo3 max power in 1/2 dBm
+ *
+ * This structure presents the enhanced regulatory tx power limit layout
+ * in an EEPROM image.
+ */
+struct iwl_eeprom_enhanced_txpwr {
+        u8 flags;
+        u8 channel;
+        s8 chain_a_max;
+        s8 chain_b_max;
+        s8 chain_c_max;
+        u8 delta_20_in_40;
+        s8 mimo2_max;
+        s8 mimo3_max;
+} __packed;
+
+static s8 iwl_get_max_txpwr_half_dbm(const struct iwl_eeprom_data *data,
+                                     struct iwl_eeprom_enhanced_txpwr *txp)
+{
+        s8 result = 0; /* (.5 dBm) */
+
+        /* Take the highest tx power from any valid chains */
+        if (data->valid_tx_ant & ANT_A && txp->chain_a_max > result)
+                result = txp->chain_a_max;
+
+        if (data->valid_tx_ant & ANT_B && txp->chain_b_max > result)
+                result = txp->chain_b_max;
+
+        if (data->valid_tx_ant & ANT_C && txp->chain_c_max > result)
+                result = txp->chain_c_max;
+
+        if ((data->valid_tx_ant == ANT_AB ||
+             data->valid_tx_ant == ANT_BC ||
+             data->valid_tx_ant == ANT_AC) && txp->mimo2_max > result)
+                result = txp->mimo2_max;
+
+        if (data->valid_tx_ant == ANT_ABC && txp->mimo3_max > result)
+                result = txp->mimo3_max;
+
+        return result;
+}
+
+#define EEPROM_TXP_OFFS (0x00 | INDIRECT_ADDRESS | INDIRECT_TXP_LIMIT)
+#define EEPROM_TXP_ENTRY_LEN sizeof(struct iwl_eeprom_enhanced_txpwr)
+#define EEPROM_TXP_SZ_OFFS (0x00 | INDIRECT_ADDRESS | INDIRECT_TXP_LIMIT_SIZE)
+
+#define TXP_CHECK_AND_PRINT(x) \
+        ((txp->flags & IWL_EEPROM_ENH_TXP_FL_##x) ? # x " " : "")
+
+static void
+iwl_eeprom_enh_txp_read_element(struct iwl_eeprom_data *data,
+                                struct iwl_eeprom_enhanced_txpwr *txp,
+                                int n_channels, s8 max_txpower_avg)
+{
+        int ch_idx;
+        enum ieee80211_band band;
+
+        band = txp->flags & IWL_EEPROM_ENH_TXP_FL_BAND_52G ?
+                IEEE80211_BAND_5GHZ : IEEE80211_BAND_2GHZ;
+
+        for (ch_idx = 0; ch_idx < n_channels; ch_idx++) {
+                struct ieee80211_channel *chan = &data->channels[ch_idx];
+
+                /* update matching channel or from common data only */
+                if (txp->channel != 0 && chan->hw_value != txp->channel)
+                        continue;
+
+                /* update matching band only */
+                if (band != chan->band)
+                        continue;
+
+                if (chan->max_power < max_txpower_avg &&
+                    !(txp->flags & IWL_EEPROM_ENH_TXP_FL_40MHZ))
+                        chan->max_power = max_txpower_avg;
+        }
+}
+
+static void iwl_eeprom_enhanced_txpower(struct device *dev,
+                                        struct iwl_eeprom_data *data,
+                                        const u8 *eeprom, size_t eeprom_size,
+                                        int n_channels)
+{
+        struct iwl_eeprom_enhanced_txpwr *txp_array, *txp;
+        int idx, entries;
+        __le16 *txp_len;
+        s8 max_txp_avg_halfdbm;
+
+        BUILD_BUG_ON(sizeof(struct iwl_eeprom_enhanced_txpwr) != 8);
+
+        /* the length is in 16-bit words, but we want entries */
+        txp_len = (__le16 *)iwl_eeprom_query_addr(eeprom, eeprom_size,
+                                                  EEPROM_TXP_SZ_OFFS);
+        entries = le16_to_cpup(txp_len) * 2 / EEPROM_TXP_ENTRY_LEN;
+
+        txp_array = (void *)iwl_eeprom_query_addr(eeprom, eeprom_size,
+                                                  EEPROM_TXP_OFFS);
+
+        for (idx = 0; idx < entries; idx++) {
+                txp = &txp_array[idx];
+                /* skip invalid entries */
+                if (!(txp->flags & IWL_EEPROM_ENH_TXP_FL_VALID))
+                        continue;
+
+                IWL_DEBUG_EEPROM(dev, "%s %d:\t %s%s%s%s%s%s%s%s (0x%02x)\n",
+                                 (txp->channel && (txp->flags &
+                                        IWL_EEPROM_ENH_TXP_FL_COMMON_TYPE)) ?
+                                        "Common " : (txp->channel) ?
+                                        "Channel" : "Common",
+                                 (txp->channel),
+                                 TXP_CHECK_AND_PRINT(VALID),
+                                 TXP_CHECK_AND_PRINT(BAND_52G),
+                                 TXP_CHECK_AND_PRINT(OFDM),
+                                 TXP_CHECK_AND_PRINT(40MHZ),
+                                 TXP_CHECK_AND_PRINT(HT_AP),
+                                 TXP_CHECK_AND_PRINT(RES1),
+                                 TXP_CHECK_AND_PRINT(RES2),
+                                 TXP_CHECK_AND_PRINT(COMMON_TYPE),
+                                 txp->flags);
+                IWL_DEBUG_EEPROM(dev,
+                                 "\t\t chain_A: 0x%02x chain_B: 0X%02x chain_C: 0X%02x\n",
+                                 txp->chain_a_max, txp->chain_b_max,
+                                 txp->chain_c_max);
+                IWL_DEBUG_EEPROM(dev,
+                                 "\t\t MIMO2: 0x%02x MIMO3: 0x%02x High 20_on_40: 0x%02x Low 20_on_40: 0x%02x\n",
+                                 txp->mimo2_max, txp->mimo3_max,
+                                 ((txp->delta_20_in_40 & 0xf0) >> 4),
+                                 (txp->delta_20_in_40 & 0x0f));
+
+                max_txp_avg_halfdbm = iwl_get_max_txpwr_half_dbm(data, txp);
+
+                iwl_eeprom_enh_txp_read_element(data, txp, n_channels,
+                                DIV_ROUND_UP(max_txp_avg_halfdbm, 2));
+
+                if (max_txp_avg_halfdbm > data->max_tx_pwr_half_dbm)
+                        data->max_tx_pwr_half_dbm = max_txp_avg_halfdbm;
+        }
+}
+
+static void iwl_init_band_reference(const struct iwl_cfg *cfg,
+                                    const u8 *eeprom, size_t eeprom_size,
+                                    int eeprom_band, int *eeprom_ch_count,
+                                    const struct iwl_eeprom_channel **ch_info,
+                                    const u8 **eeprom_ch_array)
+{
+        u32 offset = cfg->eeprom_params->regulatory_bands[eeprom_band - 1];
+
+        offset |= INDIRECT_ADDRESS | INDIRECT_REGULATORY;
+
+        *ch_info = (void *)iwl_eeprom_query_addr(eeprom, eeprom_size, offset);
+
+        switch (eeprom_band) {
+        case 1:         /* 2.4GHz band */
+                *eeprom_ch_count = ARRAY_SIZE(iwl_eeprom_band_1);
+                *eeprom_ch_array = iwl_eeprom_band_1;
+                break;
+        case 2:         /* 4.9GHz band */
+                *eeprom_ch_count = ARRAY_SIZE(iwl_eeprom_band_2);
+                *eeprom_ch_array = iwl_eeprom_band_2;
+                break;
+        case 3:         /* 5.2GHz band */
+                *eeprom_ch_count = ARRAY_SIZE(iwl_eeprom_band_3);
+                *eeprom_ch_array = iwl_eeprom_band_3;
+                break;
+        case 4:         /* 5.5GHz band */
+                *eeprom_ch_count = ARRAY_SIZE(iwl_eeprom_band_4);
+                *eeprom_ch_array = iwl_eeprom_band_4;
+                break;
+        case 5:         /* 5.7GHz band */
+                *eeprom_ch_count = ARRAY_SIZE(iwl_eeprom_band_5);
+                *eeprom_ch_array = iwl_eeprom_band_5;
+                break;
+        case 6:         /* 2.4GHz ht40 channels */
+                *eeprom_ch_count = ARRAY_SIZE(iwl_eeprom_band_6);
+                *eeprom_ch_array = iwl_eeprom_band_6;
+                break;
+        case 7:         /* 5 GHz ht40 channels */
+                *eeprom_ch_count = ARRAY_SIZE(iwl_eeprom_band_7);
+                *eeprom_ch_array = iwl_eeprom_band_7;
+                break;
+        default:
+                *eeprom_ch_count = 0;
+                *eeprom_ch_array = NULL;
+                WARN_ON(1);
+        }
+}
+
+#define CHECK_AND_PRINT(x) \
+        ((eeprom_ch->flags & EEPROM_CHANNEL_##x) ? # x " " : "")
+
+static void iwl_mod_ht40_chan_info(struct device *dev,
+                                   struct iwl_eeprom_data *data, int n_channels,
+                                   enum ieee80211_band band, u16 channel,
+                                   const struct iwl_eeprom_channel *eeprom_ch,
+                                   u8 clear_ht40_extension_channel)
+{
+        struct ieee80211_channel *chan = NULL;
+        int i;
+
+        for (i = 0; i < n_channels; i++) {
+                if (data->channels[i].band != band)
+                        continue;
+                if (data->channels[i].hw_value != channel)
+                        continue;
+                chan = &data->channels[i];
+                break;
+        }
+
+        if (!chan)
+                return;
+
+        IWL_DEBUG_EEPROM(dev,
+                         "HT40 Ch. %d [%sGHz] %s%s%s%s%s(0x%02x %ddBm): Ad-Hoc %ssupported\n",
+                         channel,
+                         band == IEEE80211_BAND_5GHZ ? "5.2" : "2.4",
+                         CHECK_AND_PRINT(IBSS),
+                         CHECK_AND_PRINT(ACTIVE),
+                         CHECK_AND_PRINT(RADAR),
+                         CHECK_AND_PRINT(WIDE),
+                         CHECK_AND_PRINT(DFS),
+                         eeprom_ch->flags,
+                         eeprom_ch->max_power_avg,
+                         ((eeprom_ch->flags & EEPROM_CHANNEL_IBSS) &&
+                          !(eeprom_ch->flags & EEPROM_CHANNEL_RADAR)) ? ""
+                                                                      : "not ");
+
+        if (eeprom_ch->flags & EEPROM_CHANNEL_VALID)
+                chan->flags &= ~clear_ht40_extension_channel;
+}
+
+#define CHECK_AND_PRINT_I(x)    \
+        ((eeprom_ch_info[ch_idx].flags & EEPROM_CHANNEL_##x) ? # x " " : "")
+
+static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg,
+                                struct iwl_eeprom_data *data,
+                                const u8 *eeprom, size_t eeprom_size)
+{
+        int band, ch_idx;
+        const struct iwl_eeprom_channel *eeprom_ch_info;
+        const u8 *eeprom_ch_array;
+        int eeprom_ch_count;
+        int n_channels = 0;
+
+        /*
+         * Loop through the 5 EEPROM bands and add them to the parse list
+         */
+        for (band = 1; band <= 5; band++) {
+                struct ieee80211_channel *channel;
+
+                iwl_init_band_reference(cfg, eeprom, eeprom_size, band,
+                                        &eeprom_ch_count, &eeprom_ch_info,
+                                        &eeprom_ch_array);
+
+                /* Loop through each band adding each of the channels */
+                for (ch_idx = 0; ch_idx < eeprom_ch_count; ch_idx++) {
+                        const struct iwl_eeprom_channel *eeprom_ch;
+
+                        eeprom_ch = &eeprom_ch_info[ch_idx];
+
+                        if (!(eeprom_ch->flags & EEPROM_CHANNEL_VALID)) {
+                                IWL_DEBUG_EEPROM(dev,
+                                                 "Ch. %d Flags %x [%sGHz] - No traffic\n",
+                                                 eeprom_ch_array[ch_idx],
+                                                 eeprom_ch_info[ch_idx].flags,
+                                                 (band != 1) ? "5.2" : "2.4");
+                                continue;
+                        }
+
+                        channel = &data->channels[n_channels];
+                        n_channels++;
+
+                        channel->hw_value = eeprom_ch_array[ch_idx];
+                        channel->band = (band == 1) ? IEEE80211_BAND_2GHZ
+                                                    : IEEE80211_BAND_5GHZ;
+                        channel->center_freq =
+                                ieee80211_channel_to_frequency(
+                                        channel->hw_value, channel->band);
+
+                        /* set no-HT40, will enable as appropriate later */
+                        channel->flags = IEEE80211_CHAN_NO_HT40;
+
+                        if (!(eeprom_ch->flags & EEPROM_CHANNEL_IBSS))
+                                channel->flags |= IEEE80211_CHAN_NO_IBSS;
+
+                        if (!(eeprom_ch->flags & EEPROM_CHANNEL_ACTIVE))
+                                channel->flags |= IEEE80211_CHAN_PASSIVE_SCAN;
+
+                        if (eeprom_ch->flags & EEPROM_CHANNEL_RADAR)
+                                channel->flags |= IEEE80211_CHAN_RADAR;
+
+                        /* Initialize regulatory-based run-time data */
+                        channel->max_power =
+                                eeprom_ch_info[ch_idx].max_power_avg;
+                        IWL_DEBUG_EEPROM(dev,
+                                         "Ch. %d [%sGHz] %s%s%s%s%s%s(0x%02x %ddBm): Ad-Hoc %ssupported\n",
+                                         channel->hw_value,
+                                         (band != 1) ? "5.2" : "2.4",
+                                         CHECK_AND_PRINT_I(VALID),
+                                         CHECK_AND_PRINT_I(IBSS),
+                                         CHECK_AND_PRINT_I(ACTIVE),
+                                         CHECK_AND_PRINT_I(RADAR),
+                                         CHECK_AND_PRINT_I(WIDE),
+                                         CHECK_AND_PRINT_I(DFS),
+                                         eeprom_ch_info[ch_idx].flags,
+                                         eeprom_ch_info[ch_idx].max_power_avg,
+                                         ((eeprom_ch_info[ch_idx].flags &
+                                                        EEPROM_CHANNEL_IBSS) &&
+                                          !(eeprom_ch_info[ch_idx].flags &
+                                                        EEPROM_CHANNEL_RADAR))
+                                                ? "" : "not ");
+                }
+        }
+
+        if (cfg->eeprom_params->enhanced_txpower) {
+                /*
+                 * for newer device (6000 series and up)
+                 * EEPROM contain enhanced tx power information
+                 * driver need to process addition information
+                 * to determine the max channel tx power limits
+                 */
+                iwl_eeprom_enhanced_txpower(dev, data, eeprom, eeprom_size,
+                                            n_channels);
+        } else {
+                /* All others use data from channel map */
+                int i;
+
+                data->max_tx_pwr_half_dbm = -128;
+
+                for (i = 0; i < n_channels; i++)
+                        data->max_tx_pwr_half_dbm =
+                                max_t(s8, data->max_tx_pwr_half_dbm,
+                                      data->channels[i].max_power * 2);
+        }
+
+        /* Check if we do have HT40 channels */
+        if (cfg->eeprom_params->regulatory_bands[5] ==
+                                EEPROM_REGULATORY_BAND_NO_HT40 &&
+            cfg->eeprom_params->regulatory_bands[6] ==
+                                EEPROM_REGULATORY_BAND_NO_HT40)
+                return n_channels;
+
+        /* Two additional EEPROM bands for 2.4 and 5 GHz HT40 channels */
+        for (band = 6; band <= 7; band++) {
+                enum ieee80211_band ieeeband;
+
+                iwl_init_band_reference(cfg, eeprom, eeprom_size, band,
+                                        &eeprom_ch_count, &eeprom_ch_info,
+                                        &eeprom_ch_array);
+
+                /* EEPROM band 6 is 2.4, band 7 is 5 GHz */
+                ieeeband = (band == 6) ? IEEE80211_BAND_2GHZ
+                                       : IEEE80211_BAND_5GHZ;
+
+                /* Loop through each band adding each of the channels */
+                for (ch_idx = 0; ch_idx < eeprom_ch_count; ch_idx++) {
+                        /* Set up driver's info for lower half */
+                        iwl_mod_ht40_chan_info(dev, data, n_channels, ieeeband,
+                                               eeprom_ch_array[ch_idx],
+                                               &eeprom_ch_info[ch_idx],
+                                               IEEE80211_CHAN_NO_HT40PLUS);
+
+                        /* Set up driver's info for upper half */
+                        iwl_mod_ht40_chan_info(dev, data, n_channels, ieeeband,
+                                               eeprom_ch_array[ch_idx] + 4,
+                                               &eeprom_ch_info[ch_idx],
+                                               IEEE80211_CHAN_NO_HT40MINUS);
+                }
+        }
+
+        return n_channels;
+}
+
+static int iwl_init_sband_channels(struct iwl_eeprom_data *data,
+                                   struct ieee80211_supported_band *sband,
+                                   int n_channels, enum ieee80211_band band)
+{
+        struct ieee80211_channel *chan = &data->channels[0];
+        int n = 0, idx = 0;
+
+        while (chan->band != band && idx < n_channels)
+                chan = &data->channels[++idx];
+
+        sband->channels = &data->channels[idx];
+
+        while (chan->band == band && idx < n_channels) {
+                chan = &data->channels[++idx];
+                n++;
+        }
+
+        sband->n_channels = n;
+
+        return n;
+}
+
+#define MAX_BIT_RATE_40_MHZ     150 /* Mbps */
+#define MAX_BIT_RATE_20_MHZ     72 /* Mbps */
+
+static void iwl_init_ht_hw_capab(const struct iwl_cfg *cfg,
+                                 struct iwl_eeprom_data *data,
+                                 struct ieee80211_sta_ht_cap *ht_info,
+                                 enum ieee80211_band band)
+{
+        int max_bit_rate = 0;
+        u8 rx_chains;
+        u8 tx_chains;
+
+        tx_chains = hweight8(data->valid_tx_ant);
+        if (cfg->rx_with_siso_diversity)
+                rx_chains = 1;
+        else
+                rx_chains = hweight8(data->valid_rx_ant);
+
+        if (!(data->sku & EEPROM_SKU_CAP_11N_ENABLE) || !cfg->ht_params) {
+                ht_info->ht_supported = false;
+                return;
+        }
+
+        ht_info->ht_supported = true;
+        ht_info->cap = 0;
+
+        if (iwlwifi_mod_params.amsdu_size_8K)
+                ht_info->cap |= IEEE80211_HT_CAP_MAX_AMSDU;
+
+        ht_info->ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
+        ht_info->ampdu_density = IEEE80211_HT_MPDU_DENSITY_4;
+
+        ht_info->mcs.rx_mask[0] = 0xFF;
+        if (rx_chains >= 2)
+                ht_info->mcs.rx_mask[1] = 0xFF;
+        if (rx_chains >= 3)
+                ht_info->mcs.rx_mask[2] = 0xFF;
+
+        if (cfg->ht_params->ht_greenfield_support)
+                ht_info->cap |= IEEE80211_HT_CAP_GRN_FLD;
+        ht_info->cap |= IEEE80211_HT_CAP_SGI_20;
+
+        max_bit_rate = MAX_BIT_RATE_20_MHZ;
+
+        if (cfg->ht_params->ht40_bands & BIT(band)) {
+                ht_info->cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                ht_info->cap |= IEEE80211_HT_CAP_SGI_40;
+                ht_info->mcs.rx_mask[4] = 0x01;
+                max_bit_rate = MAX_BIT_RATE_40_MHZ;
+        }
+
+        /* Highest supported Rx data rate */
+        max_bit_rate *= rx_chains;
+        WARN_ON(max_bit_rate & ~IEEE80211_HT_MCS_RX_HIGHEST_MASK);
+        ht_info->mcs.rx_highest = cpu_to_le16(max_bit_rate);
+
+        /* Tx MCS capabilities */
+        ht_info->mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
+        if (tx_chains != rx_chains) {
+                ht_info->mcs.tx_params |= IEEE80211_HT_MCS_TX_RX_DIFF;
+                ht_info->mcs.tx_params |= ((tx_chains - 1) <<
+                                IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT);
+        }
+}
+
+static void iwl_init_sbands(struct device *dev, const struct iwl_cfg *cfg,
+                            struct iwl_eeprom_data *data,
+                            const u8 *eeprom, size_t eeprom_size)
+{
+        int n_channels = iwl_init_channel_map(dev, cfg, data,
+                                              eeprom, eeprom_size);
+        int n_used = 0;
+        struct ieee80211_supported_band *sband;
+
+        sband = &data->bands[IEEE80211_BAND_2GHZ];
+        sband->band = IEEE80211_BAND_2GHZ;
+        sband->bitrates = &iwl_cfg80211_rates[RATES_24_OFFS];
+        sband->n_bitrates = N_RATES_24;
+        n_used += iwl_init_sband_channels(data, sband, n_channels,
+                                          IEEE80211_BAND_2GHZ);
+        iwl_init_ht_hw_capab(cfg, data, &sband->ht_cap, IEEE80211_BAND_2GHZ);
+
+        sband = &data->bands[IEEE80211_BAND_5GHZ];
+        sband->band = IEEE80211_BAND_5GHZ;
+        sband->bitrates = &iwl_cfg80211_rates[RATES_52_OFFS];
+        sband->n_bitrates = N_RATES_52;
+        n_used += iwl_init_sband_channels(data, sband, n_channels,
+                                          IEEE80211_BAND_5GHZ);
+        iwl_init_ht_hw_capab(cfg, data, &sband->ht_cap, IEEE80211_BAND_5GHZ);
+
+        if (n_channels != n_used)
+                IWL_ERR_DEV(dev, "EEPROM: used only %d of %d channels\n",
+                            n_used, n_channels);
+}
+
+/* EEPROM data functions */
+
+struct iwl_eeprom_data *
+iwl_parse_eeprom_data(struct device *dev, const struct iwl_cfg *cfg,
+                      const u8 *eeprom, size_t eeprom_size)
+{
+        struct iwl_eeprom_data *data;
+        const void *tmp;
+
+        if (WARN_ON(!cfg || !cfg->eeprom_params))
+                return NULL;
+
+        data = kzalloc(sizeof(*data) +
+                       sizeof(struct ieee80211_channel) * IWL_NUM_CHANNELS,
+                       GFP_KERNEL);
+        if (!data)
+                return NULL;
+
+        /* get MAC address(es) */
+        tmp = iwl_eeprom_query_addr(eeprom, eeprom_size, EEPROM_MAC_ADDRESS);
+        if (!tmp)
+                goto err_free;
+        memcpy(data->hw_addr, tmp, ETH_ALEN);
+        data->n_hw_addrs = iwl_eeprom_query16(eeprom, eeprom_size,
+                                              EEPROM_NUM_MAC_ADDRESS);
+
+        if (iwl_eeprom_read_calib(eeprom, eeprom_size, data))
+                goto err_free;
+
+        tmp = iwl_eeprom_query_addr(eeprom, eeprom_size, EEPROM_XTAL);
+        if (!tmp)
+                goto err_free;
+        memcpy(data->xtal_calib, tmp, sizeof(data->xtal_calib));
+
+        tmp = iwl_eeprom_query_addr(eeprom, eeprom_size,
+                                    EEPROM_RAW_TEMPERATURE);
+        if (!tmp)
+                goto err_free;
+        data->raw_temperature = *(__le16 *)tmp;
+
+        tmp = iwl_eeprom_query_addr(eeprom, eeprom_size,
+                                    EEPROM_KELVIN_TEMPERATURE);
+        if (!tmp)
+                goto err_free;
+        data->kelvin_temperature = *(__le16 *)tmp;
+        data->kelvin_voltage = *((__le16 *)tmp + 1);
+
+        data->radio_cfg = iwl_eeprom_query16(eeprom, eeprom_size,
+                                             EEPROM_RADIO_CONFIG);
+        data->sku = iwl_eeprom_query16(eeprom, eeprom_size,
+                                       EEPROM_SKU_CAP);
+        data->eeprom_version = iwl_eeprom_query16(eeprom, eeprom_size,
+                                                  EEPROM_VERSION);
+
+        data->valid_tx_ant = EEPROM_RF_CFG_TX_ANT_MSK(data->radio_cfg);
+        data->valid_rx_ant = EEPROM_RF_CFG_RX_ANT_MSK(data->radio_cfg);
+
+        /* check overrides (some devices have wrong EEPROM) */
+        if (cfg->valid_tx_ant)
+                data->valid_tx_ant = cfg->valid_tx_ant;
+        if (cfg->valid_rx_ant)
+                data->valid_rx_ant = cfg->valid_rx_ant;
+
+        if (!data->valid_tx_ant || !data->valid_rx_ant) {
+                IWL_ERR_DEV(dev, "invalid antennas (0x%x, 0x%x)\n",
+                            data->valid_tx_ant, data->valid_rx_ant);
+                goto err_free;
+        }
+
+        iwl_init_sbands(dev, cfg, data, eeprom, eeprom_size);
+
+        return data;
+ err_free:
+        kfree(data);
+        return NULL;
+}
+EXPORT_SYMBOL_GPL(iwl_parse_eeprom_data);
+
+/* helper functions */
+int iwl_eeprom_check_version(struct iwl_eeprom_data *data,
+                             struct iwl_trans *trans)
+{
+        if (data->eeprom_version >= trans->cfg->eeprom_ver ||
+            data->calib_version >= trans->cfg->eeprom_calib_ver) {
+                IWL_INFO(trans, "device EEPROM VER=0x%x, CALIB=0x%x\n",
+                         data->eeprom_version, data->calib_version);
+                return 0;
+        }
+
+        IWL_ERR(trans,
+                "Unsupported (too old) EEPROM VER=0x%x < 0x%x CALIB=0x%x < 0x%x\n",
+                data->eeprom_version, trans->cfg->eeprom_ver,
+                data->calib_version,  trans->cfg->eeprom_calib_ver);
+        return -EINVAL;
+}
+EXPORT_SYMBOL_GPL(iwl_eeprom_check_version);
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.h b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.h
new file mode 100644
index 000000000000..9c07c670a1ce
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.h
@@ -0,0 +1,138 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2012 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2005 - 2012 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+#ifndef __iwl_eeprom_parse_h__
+#define __iwl_eeprom_parse_h__
+
+#include <linux/types.h>
+#include <linux/if_ether.h>
+#include "iwl-trans.h"
+
+/* SKU Capabilities (actual values from EEPROM definition) */
+#define EEPROM_SKU_CAP_BAND_24GHZ       (1 << 4)
+#define EEPROM_SKU_CAP_BAND_52GHZ       (1 << 5)
+#define EEPROM_SKU_CAP_11N_ENABLE       (1 << 6)
+#define EEPROM_SKU_CAP_AMT_ENABLE       (1 << 7)
+#define EEPROM_SKU_CAP_IPAN_ENABLE      (1 << 8)
+
+/* radio config bits (actual values from EEPROM definition) */
+#define EEPROM_RF_CFG_TYPE_MSK(x)   (x & 0x3)         /* bits 0-1   */
+#define EEPROM_RF_CFG_STEP_MSK(x)   ((x >> 2)  & 0x3) /* bits 2-3   */
+#define EEPROM_RF_CFG_DASH_MSK(x)   ((x >> 4)  & 0x3) /* bits 4-5   */
+#define EEPROM_RF_CFG_PNUM_MSK(x)   ((x >> 6)  & 0x3) /* bits 6-7   */
+#define EEPROM_RF_CFG_TX_ANT_MSK(x) ((x >> 8)  & 0xF) /* bits 8-11  */
+#define EEPROM_RF_CFG_RX_ANT_MSK(x) ((x >> 12) & 0xF) /* bits 12-15 */
+
+struct iwl_eeprom_data {
+        int n_hw_addrs;
+        u8 hw_addr[ETH_ALEN];
+
+        u16 radio_config;
+
+        u8 calib_version;
+        __le16 calib_voltage;
+
+        __le16 raw_temperature;
+        __le16 kelvin_temperature;
+        __le16 kelvin_voltage;
+        __le16 xtal_calib[2];
+
+        u16 sku;
+        u16 radio_cfg;
+        u16 eeprom_version;
+        s8 max_tx_pwr_half_dbm;
+
+        u8 valid_tx_ant, valid_rx_ant;
+
+        struct ieee80211_supported_band bands[IEEE80211_NUM_BANDS];
+        struct ieee80211_channel channels[];
+};
+
+/**
+ * iwl_parse_eeprom_data - parse EEPROM data and return values
+ *
+ * @dev: device pointer we're parsing for, for debug only
+ * @cfg: device configuration for parsing and overrides
+ * @eeprom: the EEPROM data
+ * @eeprom_size: length of the EEPROM data
+ *
+ * This function parses all EEPROM values we need and then
+ * returns a (newly allocated) struct containing all the
+ * relevant values for driver use. The struct must be freed
+ * later with iwl_free_eeprom_data().
+ */
+struct iwl_eeprom_data *
+iwl_parse_eeprom_data(struct device *dev, const struct iwl_cfg *cfg,
+                      const u8 *eeprom, size_t eeprom_size);
+
+/**
+ * iwl_free_eeprom_data - free EEPROM data
+ * @data: the data to free
+ */
+static inline void iwl_free_eeprom_data(struct iwl_eeprom_data *data)
+{
+        kfree(data);
+}
+
+int iwl_eeprom_check_version(struct iwl_eeprom_data *data,
+                             struct iwl_trans *trans);
+
+#endif /* __iwl_eeprom_parse_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom-read.c b/drivers/net/wireless/iwlwifi/iwl-eeprom-read.c
new file mode 100644
index 000000000000..27c7da3c6ed1
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom-read.c
@@ -0,0 +1,463 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2012 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2005 - 2012 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+#include <linux/types.h>
+#include <linux/slab.h>
+#include <linux/export.h>
+
+#include "iwl-debug.h"
+#include "iwl-eeprom-read.h"
+#include "iwl-io.h"
+#include "iwl-prph.h"
+#include "iwl-csr.h"
+
+/*
+ * EEPROM access time values:
+ *
+ * Driver initiates EEPROM read by writing byte address << 1 to CSR_EEPROM_REG.
+ * Driver then polls CSR_EEPROM_REG for CSR_EEPROM_REG_READ_VALID_MSK (0x1).
+ * When polling, wait 10 uSec between polling loops, up to a maximum 5000 uSec.
+ * Driver reads 16-bit value from bits 31-16 of CSR_EEPROM_REG.
+ */
+#define IWL_EEPROM_ACCESS_TIMEOUT       5000 /* uSec */
+
+#define IWL_EEPROM_SEM_TIMEOUT          10   /* microseconds */
+#define IWL_EEPROM_SEM_RETRY_LIMIT      1000 /* number of attempts (not time) */
+
+
+/*
+ * The device's EEPROM semaphore prevents conflicts between driver and uCode
+ * when accessing the EEPROM; each access is a series of pulses to/from the
+ * EEPROM chip, not a single event, so even reads could conflict if they
+ * weren't arbitrated by the semaphore.
+ */
+
+#define EEPROM_SEM_TIMEOUT 10           /* milliseconds */
+#define EEPROM_SEM_RETRY_LIMIT 1000     /* number of attempts (not time) */
+
+static int iwl_eeprom_acquire_semaphore(struct iwl_trans *trans)
+{
+        u16 count;
+        int ret;
+
+        for (count = 0; count < EEPROM_SEM_RETRY_LIMIT; count++) {
+                /* Request semaphore */
+                iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
+                            CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM);
+
+                /* See if we got it */
+                ret = iwl_poll_bit(trans, CSR_HW_IF_CONFIG_REG,
+                                CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM,
+                                CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM,
+                                EEPROM_SEM_TIMEOUT);
+                if (ret >= 0) {
+                        IWL_DEBUG_EEPROM(trans->dev,
+                                         "Acquired semaphore after %d tries.\n",
+                                         count+1);
+                        return ret;
+                }
+        }
+
+        return ret;
+}
+
+static void iwl_eeprom_release_semaphore(struct iwl_trans *trans)
+{
+        iwl_clear_bit(trans, CSR_HW_IF_CONFIG_REG,
+                      CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM);
+}
+
+static int iwl_eeprom_verify_signature(struct iwl_trans *trans, bool nvm_is_otp)
+{
+        u32 gp = iwl_read32(trans, CSR_EEPROM_GP) & CSR_EEPROM_GP_VALID_MSK;
+
+        IWL_DEBUG_EEPROM(trans->dev, "EEPROM signature=0x%08x\n", gp);
+
+        switch (gp) {
+        case CSR_EEPROM_GP_BAD_SIG_EEP_GOOD_SIG_OTP:
+                if (!nvm_is_otp) {
+                        IWL_ERR(trans, "EEPROM with bad signature: 0x%08x\n",
+                                gp);
+                        return -ENOENT;
+                }
+                return 0;
+        case CSR_EEPROM_GP_GOOD_SIG_EEP_LESS_THAN_4K:
+        case CSR_EEPROM_GP_GOOD_SIG_EEP_MORE_THAN_4K:
+                if (nvm_is_otp) {
+                        IWL_ERR(trans, "OTP with bad signature: 0x%08x\n", gp);
+                        return -ENOENT;
+                }
+                return 0;
+        case CSR_EEPROM_GP_BAD_SIGNATURE_BOTH_EEP_AND_OTP:
+        default:
+                IWL_ERR(trans,
+                        "bad EEPROM/OTP signature, type=%s, EEPROM_GP=0x%08x\n",
+                        nvm_is_otp ? "OTP" : "EEPROM", gp);
+                return -ENOENT;
+        }
+}
+
+/******************************************************************************
+ *
+ * OTP related functions
+ *
+******************************************************************************/
+
+static void iwl_set_otp_access_absolute(struct iwl_trans *trans)
+{
+        iwl_read32(trans, CSR_OTP_GP_REG);
+
+        iwl_clear_bit(trans, CSR_OTP_GP_REG,
+                      CSR_OTP_GP_REG_OTP_ACCESS_MODE);
+}
+
+static int iwl_nvm_is_otp(struct iwl_trans *trans)
+{
+        u32 otpgp;
+
+        /* OTP only valid for CP/PP and after */
+        switch (trans->hw_rev & CSR_HW_REV_TYPE_MSK) {
+        case CSR_HW_REV_TYPE_NONE:
+                IWL_ERR(trans, "Unknown hardware type\n");
+                return -EIO;
+        case CSR_HW_REV_TYPE_5300:
+        case CSR_HW_REV_TYPE_5350:
+        case CSR_HW_REV_TYPE_5100:
+        case CSR_HW_REV_TYPE_5150:
+                return 0;
+        default:
+                otpgp = iwl_read32(trans, CSR_OTP_GP_REG);
+                if (otpgp & CSR_OTP_GP_REG_DEVICE_SELECT)
+                        return 1;
+                return 0;
+        }
+}
+
+static int iwl_init_otp_access(struct iwl_trans *trans)
+{
+        int ret;
+
+        /* Enable 40MHz radio clock */
+        iwl_write32(trans, CSR_GP_CNTRL,
+                    iwl_read32(trans, CSR_GP_CNTRL) |
+                    CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
+
+        /* wait for clock to be ready */
+        ret = iwl_poll_bit(trans, CSR_GP_CNTRL,
+                           CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
+                           CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
+                           25000);
+        if (ret < 0) {
+                IWL_ERR(trans, "Time out access OTP\n");
+        } else {
+                iwl_set_bits_prph(trans, APMG_PS_CTRL_REG,
+                                  APMG_PS_CTRL_VAL_RESET_REQ);
+                udelay(5);
+                iwl_clear_bits_prph(trans, APMG_PS_CTRL_REG,
+                                    APMG_PS_CTRL_VAL_RESET_REQ);
+
+                /*
+                 * CSR auto clock gate disable bit -
+                 * this is only applicable for HW with OTP shadow RAM
+                 */
+                if (trans->cfg->base_params->shadow_ram_support)
+                        iwl_set_bit(trans, CSR_DBG_LINK_PWR_MGMT_REG,
+                                    CSR_RESET_LINK_PWR_MGMT_DISABLED);
+        }
+        return ret;
+}
+
+static int iwl_read_otp_word(struct iwl_trans *trans, u16 addr,
+                             __le16 *eeprom_data)
+{
+        int ret = 0;
+        u32 r;
+        u32 otpgp;
+
+        iwl_write32(trans, CSR_EEPROM_REG,
+                    CSR_EEPROM_REG_MSK_ADDR & (addr << 1));
+        ret = iwl_poll_bit(trans, CSR_EEPROM_REG,
+                                 CSR_EEPROM_REG_READ_VALID_MSK,
+                                 CSR_EEPROM_REG_READ_VALID_MSK,
+                                 IWL_EEPROM_ACCESS_TIMEOUT);
+        if (ret < 0) {
+                IWL_ERR(trans, "Time out reading OTP[%d]\n", addr);
+                return ret;
+        }
+        r = iwl_read32(trans, CSR_EEPROM_REG);
+        /* check for ECC errors: */
+        otpgp = iwl_read32(trans, CSR_OTP_GP_REG);
+        if (otpgp & CSR_OTP_GP_REG_ECC_UNCORR_STATUS_MSK) {
+                /* stop in this case */
+                /* set the uncorrectable OTP ECC bit for acknowledgement */
+                iwl_set_bit(trans, CSR_OTP_GP_REG,
+                            CSR_OTP_GP_REG_ECC_UNCORR_STATUS_MSK);
+                IWL_ERR(trans, "Uncorrectable OTP ECC error, abort OTP read\n");
+                return -EINVAL;
+        }
+        if (otpgp & CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK) {
+                /* continue in this case */
+                /* set the correctable OTP ECC bit for acknowledgement */
+                iwl_set_bit(trans, CSR_OTP_GP_REG,
+                            CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK);
+                IWL_ERR(trans, "Correctable OTP ECC error, continue read\n");
+        }
+        *eeprom_data = cpu_to_le16(r >> 16);
+        return 0;
+}
+
+/*
+ * iwl_is_otp_empty: check for empty OTP
+ */
+static bool iwl_is_otp_empty(struct iwl_trans *trans)
+{
+        u16 next_link_addr = 0;
+        __le16 link_value;
+        bool is_empty = false;
+
+        /* locate the beginning of OTP link list */
+        if (!iwl_read_otp_word(trans, next_link_addr, &link_value)) {
+                if (!link_value) {
+                        IWL_ERR(trans, "OTP is empty\n");
+                        is_empty = true;
+                }
+        } else {
+                IWL_ERR(trans, "Unable to read first block of OTP list.\n");
+                is_empty = true;
+        }
+
+        return is_empty;
+}
+
+
+/*
+ * iwl_find_otp_image: find EEPROM image in OTP
+ *   finding the OTP block that contains the EEPROM image.
+ *   the last valid block on the link list (the block _before_ the last block)
+ *   is the block we should read and used to configure the device.
+ *   If all the available OTP blocks are full, the last block will be the block
+ *   we should read and used to configure the device.
+ *   only perform this operation if shadow RAM is disabled
+ */
+static int iwl_find_otp_image(struct iwl_trans *trans,
+                                        u16 *validblockaddr)
+{
+        u16 next_link_addr = 0, valid_addr;
+        __le16 link_value = 0;
+        int usedblocks = 0;
+
+        /* set addressing mode to absolute to traverse the link list */
+        iwl_set_otp_access_absolute(trans);
+
+        /* checking for empty OTP or error */
+        if (iwl_is_otp_empty(trans))
+                return -EINVAL;
+
+        /*
+         * start traverse link list
+         * until reach the max number of OTP blocks
+         * different devices have different number of OTP blocks
+         */
+        do {
+                /* save current valid block address
+                 * check for more block on the link list
+                 */
+                valid_addr = next_link_addr;
+                next_link_addr = le16_to_cpu(link_value) * sizeof(u16);
+                IWL_DEBUG_EEPROM(trans->dev, "OTP blocks %d addr 0x%x\n",
+                                 usedblocks, next_link_addr);
+                if (iwl_read_otp_word(trans, next_link_addr, &link_value))
+                        return -EINVAL;
+                if (!link_value) {
+                        /*
+                         * reach the end of link list, return success and
+                         * set address point to the starting address
+                         * of the image
+                         */
+                        *validblockaddr = valid_addr;
+                        /* skip first 2 bytes (link list pointer) */
+                        *validblockaddr += 2;
+                        return 0;
+                }
+                /* more in the link list, continue */
+                usedblocks++;
+        } while (usedblocks <= trans->cfg->base_params->max_ll_items);
+
+        /* OTP has no valid blocks */
+        IWL_DEBUG_EEPROM(trans->dev, "OTP has no valid blocks\n");
+        return -EINVAL;
+}
+
+/**
+ * iwl_read_eeprom - read EEPROM contents
+ *
+ * Load the EEPROM contents from adapter and return it
+ * and its size.
+ *
+ * NOTE:  This routine uses the non-debug IO access functions.
+ */
+int iwl_read_eeprom(struct iwl_trans *trans, u8 **eeprom, size_t *eeprom_size)
+{
+        __le16 *e;
+        u32 gp = iwl_read32(trans, CSR_EEPROM_GP);
+        int sz;
+        int ret;
+        u16 addr;
+        u16 validblockaddr = 0;
+        u16 cache_addr = 0;
+        int nvm_is_otp;
+
+        if (!eeprom || !eeprom_size)
+                return -EINVAL;
+
+        nvm_is_otp = iwl_nvm_is_otp(trans);
+        if (nvm_is_otp < 0)
+                return nvm_is_otp;
+
+        sz = trans->cfg->base_params->eeprom_size;
+        IWL_DEBUG_EEPROM(trans->dev, "NVM size = %d\n", sz);
+
+        e = kmalloc(sz, GFP_KERNEL);
+        if (!e)
+                return -ENOMEM;
+
+        ret = iwl_eeprom_verify_signature(trans, nvm_is_otp);
+        if (ret < 0) {
+                IWL_ERR(trans, "EEPROM not found, EEPROM_GP=0x%08x\n", gp);
+                goto err_free;
+        }
+
+        /* Make sure driver (instead of uCode) is allowed to read EEPROM */
+        ret = iwl_eeprom_acquire_semaphore(trans);
+        if (ret < 0) {
+                IWL_ERR(trans, "Failed to acquire EEPROM semaphore.\n");
+                goto err_free;
+        }
+
+        if (nvm_is_otp) {
+                ret = iwl_init_otp_access(trans);
+                if (ret) {
+                        IWL_ERR(trans, "Failed to initialize OTP access.\n");
+                        goto err_unlock;
+                }
+
+                iwl_write32(trans, CSR_EEPROM_GP,
+                            iwl_read32(trans, CSR_EEPROM_GP) &
+                            ~CSR_EEPROM_GP_IF_OWNER_MSK);
+
+                iwl_set_bit(trans, CSR_OTP_GP_REG,
+                            CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK |
+                            CSR_OTP_GP_REG_ECC_UNCORR_STATUS_MSK);
+                /* traversing the linked list if no shadow ram supported */
+                if (!trans->cfg->base_params->shadow_ram_support) {
+                        ret = iwl_find_otp_image(trans, &validblockaddr);
+                        if (ret)
+                                goto err_unlock;
+                }
+                for (addr = validblockaddr; addr < validblockaddr + sz;
+                     addr += sizeof(u16)) {
+                        __le16 eeprom_data;
+
+                        ret = iwl_read_otp_word(trans, addr, &eeprom_data);
+                        if (ret)
+                                goto err_unlock;
+                        e[cache_addr / 2] = eeprom_data;
+                        cache_addr += sizeof(u16);
+                }
+        } else {
+                /* eeprom is an array of 16bit values */
+                for (addr = 0; addr < sz; addr += sizeof(u16)) {
+                        u32 r;
+
+                        iwl_write32(trans, CSR_EEPROM_REG,
+                                    CSR_EEPROM_REG_MSK_ADDR & (addr << 1));
+
+                        ret = iwl_poll_bit(trans, CSR_EEPROM_REG,
+                                           CSR_EEPROM_REG_READ_VALID_MSK,
+                                           CSR_EEPROM_REG_READ_VALID_MSK,
+                                           IWL_EEPROM_ACCESS_TIMEOUT);
+                        if (ret < 0) {
+                                IWL_ERR(trans,
+                                        "Time out reading EEPROM[%d]\n", addr);
+                                goto err_unlock;
+                        }
+                        r = iwl_read32(trans, CSR_EEPROM_REG);
+                        e[addr / 2] = cpu_to_le16(r >> 16);
+                }
+        }
+
+        IWL_DEBUG_EEPROM(trans->dev, "NVM Type: %s\n",
+                         nvm_is_otp ? "OTP" : "EEPROM");
+
+        iwl_eeprom_release_semaphore(trans);
+
+        *eeprom_size = sz;
+        *eeprom = (u8 *)e;
+        return 0;
+
+ err_unlock:
+        iwl_eeprom_release_semaphore(trans);
+ err_free:
+        kfree(e);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(iwl_read_eeprom);
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom-read.h b/drivers/net/wireless/iwlwifi/iwl-eeprom-read.h
new file mode 100644
index 000000000000..1337c9d36fee
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom-read.h
@@ -0,0 +1,70 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2012 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2005 - 2012 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+
+#ifndef __iwl_eeprom_h__
+#define __iwl_eeprom_h__
+
+#include "iwl-trans.h"
+
+int iwl_read_eeprom(struct iwl_trans *trans, u8 **eeprom, size_t *eeprom_size);
+
+#endif  /* __iwl_eeprom_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
deleted file mode 100644
index b8e2b223ac36..000000000000
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+++ /dev/null
@@ -1,1148 +0,0 @@
-/******************************************************************************
- *
- * This file is provided under a dual BSD/GPLv2 license.  When using or
- * redistributing this file, you may do so under either license.
- *
- * GPL LICENSE SUMMARY
- *
- * Copyright(c) 2008 - 2012 Intel Corporation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of version 2 of the GNU General Public License as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
- * USA
- *
- * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
- *
- * Contact Information:
- *  Intel Linux Wireless <ilw@linux.intel.com>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- * BSD LICENSE
- *
- * Copyright(c) 2005 - 2012 Intel Corporation. All rights reserved.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *  * Neither the name Intel Corporation nor the names of its
- *    contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *****************************************************************************/
-
-
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/slab.h>
-#include <linux/init.h>
-
-#include <net/mac80211.h>
-
-#include "iwl-dev.h"
-#include "iwl-debug.h"
-#include "iwl-agn.h"
-#include "iwl-eeprom.h"
-#include "iwl-io.h"
-#include "iwl-prph.h"
-
-/************************** EEPROM BANDS ****************************
- *
- * The iwl_eeprom_band definitions below provide the mapping from the
- * EEPROM contents to the specific channel number supported for each
- * band.
- *
- * For example, iwl_priv->eeprom.band_3_channels[4] from the band_3
- * definition below maps to physical channel 42 in the 5.2GHz spectrum.
- * The specific geography and calibration information for that channel
- * is contained in the eeprom map itself.
- *
- * During init, we copy the eeprom information and channel map
- * information into priv->channel_info_24/52 and priv->channel_map_24/52
- *
- * channel_map_24/52 provides the index in the channel_info array for a
- * given channel.  We have to have two separate maps as there is channel
- * overlap with the 2.4GHz and 5.2GHz spectrum as seen in band_1 and
- * band_2
- *
- * A value of 0xff stored in the channel_map indicates that the channel
- * is not supported by the hardware at all.
- *
- * A value of 0xfe in the channel_map indicates that the channel is not
- * valid for Tx with the current hardware.  This means that
- * while the system can tune and receive on a given channel, it may not
- * be able to associate or transmit any frames on that
- * channel.  There is no corresponding channel information for that
- * entry.
- *
- *********************************************************************/
-
-/* 2.4 GHz */
-const u8 iwl_eeprom_band_1[14] = {
-        1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14
-};
-
-/* 5.2 GHz bands */
-static const u8 iwl_eeprom_band_2[] = { /* 4915-5080MHz */
-        183, 184, 185, 187, 188, 189, 192, 196, 7, 8, 11, 12, 16
-};
-
-static const u8 iwl_eeprom_band_3[] = { /* 5170-5320MHz */
-        34, 36, 38, 40, 42, 44, 46, 48, 52, 56, 60, 64
-};
-
-static const u8 iwl_eeprom_band_4[] = { /* 5500-5700MHz */
-        100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140
-};
-
-static const u8 iwl_eeprom_band_5[] = { /* 5725-5825MHz */
-        145, 149, 153, 157, 161, 165
-};
-
-static const u8 iwl_eeprom_band_6[] = {       /* 2.4 ht40 channel */
-        1, 2, 3, 4, 5, 6, 7
-};
-
-static const u8 iwl_eeprom_band_7[] = {       /* 5.2 ht40 channel */
-        36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157
-};
-
-/******************************************************************************
- *
- * generic NVM functions
- *
-******************************************************************************/
-
-/*
- * The device's EEPROM semaphore prevents conflicts between driver and uCode
- * when accessing the EEPROM; each access is a series of pulses to/from the
- * EEPROM chip, not a single event, so even reads could conflict if they
- * weren't arbitrated by the semaphore.
- */
-
-#define EEPROM_SEM_TIMEOUT 10           /* milliseconds */
-#define EEPROM_SEM_RETRY_LIMIT 1000     /* number of attempts (not time) */
-
-static int iwl_eeprom_acquire_semaphore(struct iwl_trans *trans)
-{
-        u16 count;
-        int ret;
-
-        for (count = 0; count < EEPROM_SEM_RETRY_LIMIT; count++) {
-                /* Request semaphore */
-                iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
-                            CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM);
-
-                /* See if we got it */
-                ret = iwl_poll_bit(trans, CSR_HW_IF_CONFIG_REG,
-                                CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM,
-                                CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM,
-                                EEPROM_SEM_TIMEOUT);
-                if (ret >= 0) {
-                        IWL_DEBUG_EEPROM(trans,
-                                "Acquired semaphore after %d tries.\n",
-                                count+1);
-                        return ret;
-                }
-        }
-
-        return ret;
-}
-
-static void iwl_eeprom_release_semaphore(struct iwl_trans *trans)
-{
-        iwl_clear_bit(trans, CSR_HW_IF_CONFIG_REG,
-                CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM);
-
-}
-
-static int iwl_eeprom_verify_signature(struct iwl_priv *priv)
-{
-        u32 gp = iwl_read32(priv->trans, CSR_EEPROM_GP) &
-                           CSR_EEPROM_GP_VALID_MSK;
-        int ret = 0;
-
-        IWL_DEBUG_EEPROM(priv, "EEPROM signature=0x%08x\n", gp);
-        switch (gp) {
-        case CSR_EEPROM_GP_BAD_SIG_EEP_GOOD_SIG_OTP:
-                if (priv->nvm_device_type != NVM_DEVICE_TYPE_OTP) {
-                        IWL_ERR(priv, "EEPROM with bad signature: 0x%08x\n",
-                                gp);
-                        ret = -ENOENT;
-                }
-                break;
-        case CSR_EEPROM_GP_GOOD_SIG_EEP_LESS_THAN_4K:
-        case CSR_EEPROM_GP_GOOD_SIG_EEP_MORE_THAN_4K:
-                if (priv->nvm_device_type != NVM_DEVICE_TYPE_EEPROM) {
-                        IWL_ERR(priv, "OTP with bad signature: 0x%08x\n", gp);
-                        ret = -ENOENT;
-                }
-                break;
-        case CSR_EEPROM_GP_BAD_SIGNATURE_BOTH_EEP_AND_OTP:
-        default:
-                IWL_ERR(priv, "bad EEPROM/OTP signature, type=%s, "
-                        "EEPROM_GP=0x%08x\n",
-                        (priv->nvm_device_type == NVM_DEVICE_TYPE_OTP)
-                        ? "OTP" : "EEPROM", gp);
-                ret = -ENOENT;
-                break;
-        }
-        return ret;
-}
-
-u16 iwl_eeprom_query16(struct iwl_priv *priv, size_t offset)
-{
-        if (!priv->eeprom)
-                return 0;
-        return (u16)priv->eeprom[offset] | ((u16)priv->eeprom[offset + 1] << 8);
-}
-
-int iwl_eeprom_check_version(struct iwl_priv *priv)
-{
-        u16 eeprom_ver;
-        u16 calib_ver;
-
-        eeprom_ver = iwl_eeprom_query16(priv, EEPROM_VERSION);
-        calib_ver = iwl_eeprom_calib_version(priv);
-
-        if (eeprom_ver < priv->cfg->eeprom_ver ||
-            calib_ver < priv->cfg->eeprom_calib_ver)
-                goto err;
-
-        IWL_INFO(priv, "device EEPROM VER=0x%x, CALIB=0x%x\n",
-                 eeprom_ver, calib_ver);
-
-        return 0;
-err:
-        IWL_ERR(priv, "Unsupported (too old) EEPROM VER=0x%x < 0x%x "
-                  "CALIB=0x%x < 0x%x\n",
-                  eeprom_ver, priv->cfg->eeprom_ver,
-                  calib_ver,  priv->cfg->eeprom_calib_ver);
-        return -EINVAL;
-
-}
-
-int iwl_eeprom_init_hw_params(struct iwl_priv *priv)
-{
-        u16 radio_cfg;
-
-        priv->hw_params.sku = iwl_eeprom_query16(priv, EEPROM_SKU_CAP);
-        if (priv->hw_params.sku & EEPROM_SKU_CAP_11N_ENABLE &&
-            !priv->cfg->ht_params) {
-                IWL_ERR(priv, "Invalid 11n configuration\n");
-                return -EINVAL;
-        }
-
-        if (!priv->hw_params.sku) {
-                IWL_ERR(priv, "Invalid device sku\n");
-                return -EINVAL;
-        }
-
-        IWL_INFO(priv, "Device SKU: 0x%X\n", priv->hw_params.sku);
-
-        radio_cfg = iwl_eeprom_query16(priv, EEPROM_RADIO_CONFIG);
-
-        priv->hw_params.valid_tx_ant = EEPROM_RF_CFG_TX_ANT_MSK(radio_cfg);
-        priv->hw_params.valid_rx_ant = EEPROM_RF_CFG_RX_ANT_MSK(radio_cfg);
-
-        /* check overrides (some devices have wrong EEPROM) */
-        if (priv->cfg->valid_tx_ant)
-                priv->hw_params.valid_tx_ant = priv->cfg->valid_tx_ant;
-        if (priv->cfg->valid_rx_ant)
-                priv->hw_params.valid_rx_ant = priv->cfg->valid_rx_ant;
-
-        if (!priv->hw_params.valid_tx_ant || !priv->hw_params.valid_rx_ant) {
-                IWL_ERR(priv, "Invalid chain (0x%X, 0x%X)\n",
-                        priv->hw_params.valid_tx_ant,
-                        priv->hw_params.valid_rx_ant);
-                return -EINVAL;
-        }
-
-        IWL_INFO(priv, "Valid Tx ant: 0x%X, Valid Rx ant: 0x%X\n",
-                 priv->hw_params.valid_tx_ant, priv->hw_params.valid_rx_ant);
-
-        return 0;
-}
-
-u16 iwl_eeprom_calib_version(struct iwl_priv *priv)
-{
-        struct iwl_eeprom_calib_hdr *hdr;
-
-        hdr = (struct iwl_eeprom_calib_hdr *)iwl_eeprom_query_addr(priv,
-                                                        EEPROM_CALIB_ALL);
-        return hdr->version;
-}
-
-static u32 eeprom_indirect_address(struct iwl_priv *priv, u32 address)
-{
-        u16 offset = 0;
-
-        if ((address & INDIRECT_ADDRESS) == 0)
-                return address;
-
-        switch (address & INDIRECT_TYPE_MSK) {
-        case INDIRECT_HOST:
-                offset = iwl_eeprom_query16(priv, EEPROM_LINK_HOST);
-                break;
-        case INDIRECT_GENERAL:
-                offset = iwl_eeprom_query16(priv, EEPROM_LINK_GENERAL);
-                break;
-        case INDIRECT_REGULATORY:
-                offset = iwl_eeprom_query16(priv, EEPROM_LINK_REGULATORY);
-                break;
-        case INDIRECT_TXP_LIMIT:
-                offset = iwl_eeprom_query16(priv, EEPROM_LINK_TXP_LIMIT);
-                break;
-        case INDIRECT_TXP_LIMIT_SIZE:
-                offset = iwl_eeprom_query16(priv, EEPROM_LINK_TXP_LIMIT_SIZE);
-                break;
-        case INDIRECT_CALIBRATION:
-                offset = iwl_eeprom_query16(priv, EEPROM_LINK_CALIBRATION);
-                break;
-        case INDIRECT_PROCESS_ADJST:
-                offset = iwl_eeprom_query16(priv, EEPROM_LINK_PROCESS_ADJST);
-                break;
-        case INDIRECT_OTHERS:
-                offset = iwl_eeprom_query16(priv, EEPROM_LINK_OTHERS);
-                break;
-        default:
-                IWL_ERR(priv, "illegal indirect type: 0x%X\n",
-                address & INDIRECT_TYPE_MSK);
-                break;
-        }
-
-        /* translate the offset from words to byte */
-        return (address & ADDRESS_MSK) + (offset << 1);
-}
-
-const u8 *iwl_eeprom_query_addr(struct iwl_priv *priv, size_t offset)
-{
-        u32 address = eeprom_indirect_address(priv, offset);
-        BUG_ON(address >= priv->cfg->base_params->eeprom_size);
-        return &priv->eeprom[address];
-}
-
-void iwl_eeprom_get_mac(struct iwl_priv *priv, u8 *mac)
-{
-        const u8 *addr = iwl_eeprom_query_addr(priv,
-                                        EEPROM_MAC_ADDRESS);
-        memcpy(mac, addr, ETH_ALEN);
-}
-
-/******************************************************************************
- *
- * OTP related functions
- *
-******************************************************************************/
-
-static void iwl_set_otp_access(struct iwl_trans *trans,
-                               enum iwl_access_mode mode)
-{
-        iwl_read32(trans, CSR_OTP_GP_REG);
-
-        if (mode == IWL_OTP_ACCESS_ABSOLUTE)
-                iwl_clear_bit(trans, CSR_OTP_GP_REG,
-                              CSR_OTP_GP_REG_OTP_ACCESS_MODE);
-        else
-                iwl_set_bit(trans, CSR_OTP_GP_REG,
-                            CSR_OTP_GP_REG_OTP_ACCESS_MODE);
-}
-
-static int iwl_get_nvm_type(struct iwl_trans *trans, u32 hw_rev)
-{
-        u32 otpgp;
-        int nvm_type;
-
-        /* OTP only valid for CP/PP and after */
-        switch (hw_rev & CSR_HW_REV_TYPE_MSK) {
-        case CSR_HW_REV_TYPE_NONE:
-                IWL_ERR(trans, "Unknown hardware type\n");
-                return -ENOENT;
-        case CSR_HW_REV_TYPE_5300:
-        case CSR_HW_REV_TYPE_5350:
-        case CSR_HW_REV_TYPE_5100:
-        case CSR_HW_REV_TYPE_5150:
-                nvm_type = NVM_DEVICE_TYPE_EEPROM;
-                break;
-        default:
-                otpgp = iwl_read32(trans, CSR_OTP_GP_REG);
-                if (otpgp & CSR_OTP_GP_REG_DEVICE_SELECT)
-                        nvm_type = NVM_DEVICE_TYPE_OTP;
-                else
-                        nvm_type = NVM_DEVICE_TYPE_EEPROM;
-                break;
-        }
-        return  nvm_type;
-}
-
-static int iwl_init_otp_access(struct iwl_trans *trans)
-{
-        int ret;
-
-        /* Enable 40MHz radio clock */
-        iwl_write32(trans, CSR_GP_CNTRL,
-                    iwl_read32(trans, CSR_GP_CNTRL) |
-                    CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
-
-        /* wait for clock to be ready */
-        ret = iwl_poll_bit(trans, CSR_GP_CNTRL,
-                                 CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
-                                 CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
-                                 25000);
-        if (ret < 0)
-                IWL_ERR(trans, "Time out access OTP\n");
-        else {
-                iwl_set_bits_prph(trans, APMG_PS_CTRL_REG,
-                                  APMG_PS_CTRL_VAL_RESET_REQ);
-                udelay(5);
-                iwl_clear_bits_prph(trans, APMG_PS_CTRL_REG,
-                                    APMG_PS_CTRL_VAL_RESET_REQ);
-
-                /*
-                 * CSR auto clock gate disable bit -
-                 * this is only applicable for HW with OTP shadow RAM
-                 */
-                if (trans->cfg->base_params->shadow_ram_support)
-                        iwl_set_bit(trans, CSR_DBG_LINK_PWR_MGMT_REG,
-                                CSR_RESET_LINK_PWR_MGMT_DISABLED);
-        }
-        return ret;
-}
-
-static int iwl_read_otp_word(struct iwl_trans *trans, u16 addr,
-                             __le16 *eeprom_data)
-{
-        int ret = 0;
-        u32 r;
-        u32 otpgp;
-
-        iwl_write32(trans, CSR_EEPROM_REG,
-                    CSR_EEPROM_REG_MSK_ADDR & (addr << 1));
-        ret = iwl_poll_bit(trans, CSR_EEPROM_REG,
-                                 CSR_EEPROM_REG_READ_VALID_MSK,
-                                 CSR_EEPROM_REG_READ_VALID_MSK,
-                                 IWL_EEPROM_ACCESS_TIMEOUT);
-        if (ret < 0) {
-                IWL_ERR(trans, "Time out reading OTP[%d]\n", addr);
-                return ret;
-        }
-        r = iwl_read32(trans, CSR_EEPROM_REG);
-        /* check for ECC errors: */
-        otpgp = iwl_read32(trans, CSR_OTP_GP_REG);
-        if (otpgp & CSR_OTP_GP_REG_ECC_UNCORR_STATUS_MSK) {
-                /* stop in this case */
-                /* set the uncorrectable OTP ECC bit for acknowledgement */
-                iwl_set_bit(trans, CSR_OTP_GP_REG,
-                        CSR_OTP_GP_REG_ECC_UNCORR_STATUS_MSK);
-                IWL_ERR(trans, "Uncorrectable OTP ECC error, abort OTP read\n");
-                return -EINVAL;
-        }
-        if (otpgp & CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK) {
-                /* continue in this case */
-                /* set the correctable OTP ECC bit for acknowledgement */
-                iwl_set_bit(trans, CSR_OTP_GP_REG,
-                                CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK);
-                IWL_ERR(trans, "Correctable OTP ECC error, continue read\n");
-        }
-        *eeprom_data = cpu_to_le16(r >> 16);
-        return 0;
-}
-
-/*
- * iwl_is_otp_empty: check for empty OTP
- */
-static bool iwl_is_otp_empty(struct iwl_trans *trans)
-{
-        u16 next_link_addr = 0;
-        __le16 link_value;
-        bool is_empty = false;
-
-        /* locate the beginning of OTP link list */
-        if (!iwl_read_otp_word(trans, next_link_addr, &link_value)) {
-                if (!link_value) {
-                        IWL_ERR(trans, "OTP is empty\n");
-                        is_empty = true;
-                }
-        } else {
-                IWL_ERR(trans, "Unable to read first block of OTP list.\n");
-                is_empty = true;
-        }
-
-        return is_empty;
-}
-
-
-/*
- * iwl_find_otp_image: find EEPROM image in OTP
- *   finding the OTP block that contains the EEPROM image.
- *   the last valid block on the link list (the block _before_ the last block)
- *   is the block we should read and used to configure the device.
- *   If all the available OTP blocks are full, the last block will be the block
- *   we should read and used to configure the device.
- *   only perform this operation if shadow RAM is disabled
- */
-static int iwl_find_otp_image(struct iwl_trans *trans,
-                                        u16 *validblockaddr)
-{
-        u16 next_link_addr = 0, valid_addr;
-        __le16 link_value = 0;
-        int usedblocks = 0;
-
-        /* set addressing mode to absolute to traverse the link list */
-        iwl_set_otp_access(trans, IWL_OTP_ACCESS_ABSOLUTE);
-
-        /* checking for empty OTP or error */
-        if (iwl_is_otp_empty(trans))
-                return -EINVAL;
-
-        /*
-         * start traverse link list
-         * until reach the max number of OTP blocks
-         * different devices have different number of OTP blocks
-         */
-        do {
-                /* save current valid block address
-                 * check for more block on the link list
-                 */
-                valid_addr = next_link_addr;
-                next_link_addr = le16_to_cpu(link_value) * sizeof(u16);
-                IWL_DEBUG_EEPROM(trans, "OTP blocks %d addr 0x%x\n",
-                               usedblocks, next_link_addr);
-                if (iwl_read_otp_word(trans, next_link_addr, &link_value))
-                        return -EINVAL;
-                if (!link_value) {
-                        /*
-                         * reach the end of link list, return success and
-                         * set address point to the starting address
-                         * of the image
-                         */
-                        *validblockaddr = valid_addr;
-                        /* skip first 2 bytes (link list pointer) */
-                        *validblockaddr += 2;
-                        return 0;
-                }
-                /* more in the link list, continue */
-                usedblocks++;
-        } while (usedblocks <= trans->cfg->base_params->max_ll_items);
-
-        /* OTP has no valid blocks */
-        IWL_DEBUG_EEPROM(trans, "OTP has no valid blocks\n");
-        return -EINVAL;
-}
-
-/******************************************************************************
- *
- * Tx Power related functions
- *
-******************************************************************************/
-/**
- * iwl_get_max_txpower_avg - get the highest tx power from all chains.
- *     find the highest tx power from all chains for the channel
- */
-static s8 iwl_get_max_txpower_avg(struct iwl_priv *priv,
-                struct iwl_eeprom_enhanced_txpwr *enhanced_txpower,
-                int element, s8 *max_txpower_in_half_dbm)
-{
-        s8 max_txpower_avg = 0; /* (dBm) */
-
-        /* Take the highest tx power from any valid chains */
-        if ((priv->hw_params.valid_tx_ant & ANT_A) &&
-            (enhanced_txpower[element].chain_a_max > max_txpower_avg))
-                max_txpower_avg = enhanced_txpower[element].chain_a_max;
-        if ((priv->hw_params.valid_tx_ant & ANT_B) &&
-            (enhanced_txpower[element].chain_b_max > max_txpower_avg))
-                max_txpower_avg = enhanced_txpower[element].chain_b_max;
-        if ((priv->hw_params.valid_tx_ant & ANT_C) &&
-            (enhanced_txpower[element].chain_c_max > max_txpower_avg))
-                max_txpower_avg = enhanced_txpower[element].chain_c_max;
-        if (((priv->hw_params.valid_tx_ant == ANT_AB) |
-            (priv->hw_params.valid_tx_ant == ANT_BC) |
-            (priv->hw_params.valid_tx_ant == ANT_AC)) &&
-            (enhanced_txpower[element].mimo2_max > max_txpower_avg))
-                max_txpower_avg =  enhanced_txpower[element].mimo2_max;
-        if ((priv->hw_params.valid_tx_ant == ANT_ABC) &&
-            (enhanced_txpower[element].mimo3_max > max_txpower_avg))
-                max_txpower_avg = enhanced_txpower[element].mimo3_max;
-
-        /*
-         * max. tx power in EEPROM is in 1/2 dBm format
-         * convert from 1/2 dBm to dBm (round-up convert)
-         * but we also do not want to loss 1/2 dBm resolution which
-         * will impact performance
-         */
-        *max_txpower_in_half_dbm = max_txpower_avg;
-        return (max_txpower_avg & 0x01) + (max_txpower_avg >> 1);
-}
-
-static void
-iwl_eeprom_enh_txp_read_element(struct iwl_priv *priv,
-                                    struct iwl_eeprom_enhanced_txpwr *txp,
-                                    s8 max_txpower_avg)
-{
-        int ch_idx;
-        bool is_ht40 = txp->flags & IWL_EEPROM_ENH_TXP_FL_40MHZ;
-        enum ieee80211_band band;
-
-        band = txp->flags & IWL_EEPROM_ENH_TXP_FL_BAND_52G ?
-                IEEE80211_BAND_5GHZ : IEEE80211_BAND_2GHZ;
-
-        for (ch_idx = 0; ch_idx < priv->channel_count; ch_idx++) {
-                struct iwl_channel_info *ch_info = &priv->channel_info[ch_idx];
-
-                /* update matching channel or from common data only */
-                if (txp->channel != 0 && ch_info->channel != txp->channel)
-                        continue;
-
-                /* update matching band only */
-                if (band != ch_info->band)
-                        continue;
-
-                if (ch_info->max_power_avg < max_txpower_avg && !is_ht40) {
-                        ch_info->max_power_avg = max_txpower_avg;
-                        ch_info->curr_txpow = max_txpower_avg;
-                        ch_info->scan_power = max_txpower_avg;
-                }
-
-                if (is_ht40 && ch_info->ht40_max_power_avg < max_txpower_avg)
-                        ch_info->ht40_max_power_avg = max_txpower_avg;
-        }
-}
-
-#define EEPROM_TXP_OFFS (0x00 | INDIRECT_ADDRESS | INDIRECT_TXP_LIMIT)
-#define EEPROM_TXP_ENTRY_LEN sizeof(struct iwl_eeprom_enhanced_txpwr)
-#define EEPROM_TXP_SZ_OFFS (0x00 | INDIRECT_ADDRESS | INDIRECT_TXP_LIMIT_SIZE)
-
-#define TXP_CHECK_AND_PRINT(x) ((txp->flags & IWL_EEPROM_ENH_TXP_FL_##x) \
-                            ? # x " " : "")
-
-static void iwl_eeprom_enhanced_txpower(struct iwl_priv *priv)
-{
-        struct iwl_eeprom_enhanced_txpwr *txp_array, *txp;
-        int idx, entries;
-        __le16 *txp_len;
-        s8 max_txp_avg, max_txp_avg_halfdbm;
-
-        BUILD_BUG_ON(sizeof(struct iwl_eeprom_enhanced_txpwr) != 8);
-
-        /* the length is in 16-bit words, but we want entries */
-        txp_len = (__le16 *) iwl_eeprom_query_addr(priv, EEPROM_TXP_SZ_OFFS);
-        entries = le16_to_cpup(txp_len) * 2 / EEPROM_TXP_ENTRY_LEN;
-
-        txp_array = (void *) iwl_eeprom_query_addr(priv, EEPROM_TXP_OFFS);
-
-        for (idx = 0; idx < entries; idx++) {
-                txp = &txp_array[idx];
-                /* skip invalid entries */
-                if (!(txp->flags & IWL_EEPROM_ENH_TXP_FL_VALID))
-                        continue;
-
-                IWL_DEBUG_EEPROM(priv, "%s %d:\t %s%s%s%s%s%s%s%s (0x%02x)\n",
-                                 (txp->channel && (txp->flags &
-                                        IWL_EEPROM_ENH_TXP_FL_COMMON_TYPE)) ?
-                                        "Common " : (txp->channel) ?
-                                        "Channel" : "Common",
-                                 (txp->channel),
-                                 TXP_CHECK_AND_PRINT(VALID),
-                                 TXP_CHECK_AND_PRINT(BAND_52G),
-                                 TXP_CHECK_AND_PRINT(OFDM),
-                                 TXP_CHECK_AND_PRINT(40MHZ),
-                                 TXP_CHECK_AND_PRINT(HT_AP),
-                                 TXP_CHECK_AND_PRINT(RES1),
-                                 TXP_CHECK_AND_PRINT(RES2),
-                                 TXP_CHECK_AND_PRINT(COMMON_TYPE),
-                                 txp->flags);
-                IWL_DEBUG_EEPROM(priv, "\t\t chain_A: 0x%02x "
-                                 "chain_B: 0X%02x chain_C: 0X%02x\n",
-                                 txp->chain_a_max, txp->chain_b_max,
-                                 txp->chain_c_max);
-                IWL_DEBUG_EEPROM(priv, "\t\t MIMO2: 0x%02x "
-                                 "MIMO3: 0x%02x High 20_on_40: 0x%02x "
-                                 "Low 20_on_40: 0x%02x\n",
-                                 txp->mimo2_max, txp->mimo3_max,
-                                 ((txp->delta_20_in_40 & 0xf0) >> 4),
-                                 (txp->delta_20_in_40 & 0x0f));
-
-                max_txp_avg = iwl_get_max_txpower_avg(priv, txp_array, idx,
-                                                      &max_txp_avg_halfdbm);
-
-                /*
-                 * Update the user limit values values to the highest
-                 * power supported by any channel
-                 */
-                if (max_txp_avg > priv->tx_power_user_lmt)
-                        priv->tx_power_user_lmt = max_txp_avg;
-                if (max_txp_avg_halfdbm > priv->tx_power_lmt_in_half_dbm)
-                        priv->tx_power_lmt_in_half_dbm = max_txp_avg_halfdbm;
-
-                iwl_eeprom_enh_txp_read_element(priv, txp, max_txp_avg);
-        }
-}
-
-/**
- * iwl_eeprom_init - read EEPROM contents
- *
- * Load the EEPROM contents from adapter into priv->eeprom
- *
- * NOTE:  This routine uses the non-debug IO access functions.
- */
-int iwl_eeprom_init(struct iwl_priv *priv, u32 hw_rev)
-{
-        __le16 *e;
-        u32 gp = iwl_read32(priv->trans, CSR_EEPROM_GP);
-        int sz;
-        int ret;
-        u16 addr;
-        u16 validblockaddr = 0;
-        u16 cache_addr = 0;
-
-        priv->nvm_device_type = iwl_get_nvm_type(priv->trans, hw_rev);
-        if (priv->nvm_device_type == -ENOENT)
-                return -ENOENT;
-        /* allocate eeprom */
-        sz = priv->cfg->base_params->eeprom_size;
-        IWL_DEBUG_EEPROM(priv, "NVM size = %d\n", sz);
-        priv->eeprom = kzalloc(sz, GFP_KERNEL);
-        if (!priv->eeprom) {
-                ret = -ENOMEM;
-                goto alloc_err;
-        }
-        e = (__le16 *)priv->eeprom;
-
-        ret = iwl_eeprom_verify_signature(priv);
-        if (ret < 0) {
-                IWL_ERR(priv, "EEPROM not found, EEPROM_GP=0x%08x\n", gp);
-                ret = -ENOENT;
-                goto err;
-        }
-
-        /* Make sure driver (instead of uCode) is allowed to read EEPROM */
-        ret = iwl_eeprom_acquire_semaphore(priv->trans);
-        if (ret < 0) {
-                IWL_ERR(priv, "Failed to acquire EEPROM semaphore.\n");
-                ret = -ENOENT;
-                goto err;
-        }
-
-        if (priv->nvm_device_type == NVM_DEVICE_TYPE_OTP) {
-
-                ret = iwl_init_otp_access(priv->trans);
-                if (ret) {
-                        IWL_ERR(priv, "Failed to initialize OTP access.\n");
-                        ret = -ENOENT;
-                        goto done;
-                }
-                iwl_write32(priv->trans, CSR_EEPROM_GP,
-                            iwl_read32(priv->trans, CSR_EEPROM_GP) &
-                            ~CSR_EEPROM_GP_IF_OWNER_MSK);
-
-                iwl_set_bit(priv->trans, CSR_OTP_GP_REG,
-                             CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK |
-                             CSR_OTP_GP_REG_ECC_UNCORR_STATUS_MSK);
-                /* traversing the linked list if no shadow ram supported */
-                if (!priv->cfg->base_params->shadow_ram_support) {
-                        if (iwl_find_otp_image(priv->trans, &validblockaddr)) {
-                                ret = -ENOENT;
-                                goto done;
-                        }
-                }
-                for (addr = validblockaddr; addr < validblockaddr + sz;
-                     addr += sizeof(u16)) {
-                        __le16 eeprom_data;
-
-                        ret = iwl_read_otp_word(priv->trans, addr,
-                                                &eeprom_data);
-                        if (ret)
-                                goto done;
-                        e[cache_addr / 2] = eeprom_data;
-                        cache_addr += sizeof(u16);
-                }
-        } else {
-                /* eeprom is an array of 16bit values */
-                for (addr = 0; addr < sz; addr += sizeof(u16)) {
-                        u32 r;
-
-                        iwl_write32(priv->trans, CSR_EEPROM_REG,
-                                    CSR_EEPROM_REG_MSK_ADDR & (addr << 1));
-
-                        ret = iwl_poll_bit(priv->trans, CSR_EEPROM_REG,
-                                                  CSR_EEPROM_REG_READ_VALID_MSK,
-                                                  CSR_EEPROM_REG_READ_VALID_MSK,
-                                                  IWL_EEPROM_ACCESS_TIMEOUT);
-                        if (ret < 0) {
-                                IWL_ERR(priv,
-                                        "Time out reading EEPROM[%d]\n", addr);
-                                goto done;
-                        }
-                        r = iwl_read32(priv->trans, CSR_EEPROM_REG);
-                        e[addr / 2] = cpu_to_le16(r >> 16);
-                }
-        }
-
-        IWL_DEBUG_EEPROM(priv, "NVM Type: %s, version: 0x%x\n",
-                       (priv->nvm_device_type == NVM_DEVICE_TYPE_OTP)
-                       ? "OTP" : "EEPROM",
-                       iwl_eeprom_query16(priv, EEPROM_VERSION));
-
-        ret = 0;
-done:
-        iwl_eeprom_release_semaphore(priv->trans);
-
-err:
-        if (ret)
-                iwl_eeprom_free(priv);
-alloc_err:
-        return ret;
-}
-
-void iwl_eeprom_free(struct iwl_priv *priv)
-{
-        kfree(priv->eeprom);
-        priv->eeprom = NULL;
-}
-
-static void iwl_init_band_reference(struct iwl_priv *priv,
-                        int eep_band, int *eeprom_ch_count,
-                        const struct iwl_eeprom_channel **eeprom_ch_info,
-                        const u8 **eeprom_ch_index)
-{
-        u32 offset = priv->lib->
-                        eeprom_ops.regulatory_bands[eep_band - 1];
-        switch (eep_band) {
-        case 1:         /* 2.4GHz band */
-                *eeprom_ch_count = ARRAY_SIZE(iwl_eeprom_band_1);
-                *eeprom_ch_info = (struct iwl_eeprom_channel *)
-                                iwl_eeprom_query_addr(priv, offset);
-                *eeprom_ch_index = iwl_eeprom_band_1;
-                break;
-        case 2:         /* 4.9GHz band */
-                *eeprom_ch_count = ARRAY_SIZE(iwl_eeprom_band_2);
-                *eeprom_ch_info = (struct iwl_eeprom_channel *)
-                                iwl_eeprom_query_addr(priv, offset);
-                *eeprom_ch_index = iwl_eeprom_band_2;
-                break;
-        case 3:         /* 5.2GHz band */
-                *eeprom_ch_count = ARRAY_SIZE(iwl_eeprom_band_3);
-                *eeprom_ch_info = (struct iwl_eeprom_channel *)
-                                iwl_eeprom_query_addr(priv, offset);
-                *eeprom_ch_index = iwl_eeprom_band_3;
-                break;
-        case 4:         /* 5.5GHz band */
-                *eeprom_ch_count = ARRAY_SIZE(iwl_eeprom_band_4);
-                *eeprom_ch_info = (struct iwl_eeprom_channel *)
-                                iwl_eeprom_query_addr(priv, offset);
-                *eeprom_ch_index = iwl_eeprom_band_4;
-                break;
-        case 5:         /* 5.7GHz band */
-                *eeprom_ch_count = ARRAY_SIZE(iwl_eeprom_band_5);
-                *eeprom_ch_info = (struct iwl_eeprom_channel *)
-                                iwl_eeprom_query_addr(priv, offset);
-                *eeprom_ch_index = iwl_eeprom_band_5;
-                break;
-        case 6:         /* 2.4GHz ht40 channels */
-                *eeprom_ch_count = ARRAY_SIZE(iwl_eeprom_band_6);
-                *eeprom_ch_info = (struct iwl_eeprom_channel *)
-                                iwl_eeprom_query_addr(priv, offset);
-                *eeprom_ch_index = iwl_eeprom_band_6;
-                break;
-        case 7:         /* 5 GHz ht40 channels */
-                *eeprom_ch_count = ARRAY_SIZE(iwl_eeprom_band_7);
-                *eeprom_ch_info = (struct iwl_eeprom_channel *)
-                                iwl_eeprom_query_addr(priv, offset);
-                *eeprom_ch_index = iwl_eeprom_band_7;
-                break;
-        default:
-                BUG();
-                return;
-        }
-}
-
-#define CHECK_AND_PRINT(x) ((eeprom_ch->flags & EEPROM_CHANNEL_##x) \
-                            ? # x " " : "")
-/**
- * iwl_mod_ht40_chan_info - Copy ht40 channel info into driver's priv.
- *
- * Does not set up a command, or touch hardware.
- */
-static int iwl_mod_ht40_chan_info(struct iwl_priv *priv,
-                              enum ieee80211_band band, u16 channel,
-                              const struct iwl_eeprom_channel *eeprom_ch,
-                              u8 clear_ht40_extension_channel)
-{
-        struct iwl_channel_info *ch_info;
-
-        ch_info = (struct iwl_channel_info *)
-                        iwl_get_channel_info(priv, band, channel);
-
-        if (!is_channel_valid(ch_info))
-                return -1;
-
-        IWL_DEBUG_EEPROM(priv, "HT40 Ch. %d [%sGHz] %s%s%s%s%s(0x%02x %ddBm):"
-                        " Ad-Hoc %ssupported\n",
-                        ch_info->channel,
-                        is_channel_a_band(ch_info) ?
-                        "5.2" : "2.4",
-                        CHECK_AND_PRINT(IBSS),
-                        CHECK_AND_PRINT(ACTIVE),
-                        CHECK_AND_PRINT(RADAR),
-                        CHECK_AND_PRINT(WIDE),
-                        CHECK_AND_PRINT(DFS),
-                        eeprom_ch->flags,
-                        eeprom_ch->max_power_avg,
-                        ((eeprom_ch->flags & EEPROM_CHANNEL_IBSS)
-                         && !(eeprom_ch->flags & EEPROM_CHANNEL_RADAR)) ?
-                        "" : "not ");
-
-        ch_info->ht40_eeprom = *eeprom_ch;
-        ch_info->ht40_max_power_avg = eeprom_ch->max_power_avg;
-        ch_info->ht40_flags = eeprom_ch->flags;
-        if (eeprom_ch->flags & EEPROM_CHANNEL_VALID)
-                ch_info->ht40_extension_channel &= ~clear_ht40_extension_channel;
-
-        return 0;
-}
-
-#define CHECK_AND_PRINT_I(x) ((eeprom_ch_info[ch].flags & EEPROM_CHANNEL_##x) \
-                            ? # x " " : "")
-
-/**
- * iwl_init_channel_map - Set up driver's info for all possible channels
- */
-int iwl_init_channel_map(struct iwl_priv *priv)
-{
-        int eeprom_ch_count = 0;
-        const u8 *eeprom_ch_index = NULL;
-        const struct iwl_eeprom_channel *eeprom_ch_info = NULL;
-        int band, ch;
-        struct iwl_channel_info *ch_info;
-
-        if (priv->channel_count) {
-                IWL_DEBUG_EEPROM(priv, "Channel map already initialized.\n");
-                return 0;
-        }
-
-        IWL_DEBUG_EEPROM(priv, "Initializing regulatory info from EEPROM\n");
-
-        priv->channel_count =
-            ARRAY_SIZE(iwl_eeprom_band_1) +
-            ARRAY_SIZE(iwl_eeprom_band_2) +
-            ARRAY_SIZE(iwl_eeprom_band_3) +
-            ARRAY_SIZE(iwl_eeprom_band_4) +
-            ARRAY_SIZE(iwl_eeprom_band_5);
-
-        IWL_DEBUG_EEPROM(priv, "Parsing data for %d channels.\n",
-                        priv->channel_count);
-
-        priv->channel_info = kcalloc(priv->channel_count,
-                                     sizeof(struct iwl_channel_info),
-                                     GFP_KERNEL);
-        if (!priv->channel_info) {
-                IWL_ERR(priv, "Could not allocate channel_info\n");
-                priv->channel_count = 0;
-                return -ENOMEM;
-        }
-
-        ch_info = priv->channel_info;
-
-        /* Loop through the 5 EEPROM bands adding them in order to the
-         * channel map we maintain (that contains additional information than
-         * what just in the EEPROM) */
-        for (band = 1; band <= 5; band++) {
-
-                iwl_init_band_reference(priv, band, &eeprom_ch_count,
-                                        &eeprom_ch_info, &eeprom_ch_index);
-
-                /* Loop through each band adding each of the channels */
-                for (ch = 0; ch < eeprom_ch_count; ch++) {
-                        ch_info->channel = eeprom_ch_index[ch];
-                        ch_info->band = (band == 1) ? IEEE80211_BAND_2GHZ :
-                            IEEE80211_BAND_5GHZ;
-
-                        /* permanently store EEPROM's channel regulatory flags
-                         *   and max power in channel info database. */
-                        ch_info->eeprom = eeprom_ch_info[ch];
-
-                        /* Copy the run-time flags so they are there even on
-                         * invalid channels */
-                        ch_info->flags = eeprom_ch_info[ch].flags;
-                        /* First write that ht40 is not enabled, and then enable
-                         * one by one */
-                        ch_info->ht40_extension_channel =
-                                        IEEE80211_CHAN_NO_HT40;
-
-                        if (!(is_channel_valid(ch_info))) {
-                                IWL_DEBUG_EEPROM(priv,
-                                               "Ch. %d Flags %x [%sGHz] - "
-                                               "No traffic\n",
-                                               ch_info->channel,
-                                               ch_info->flags,
-                                               is_channel_a_band(ch_info) ?
-                                               "5.2" : "2.4");
-                                ch_info++;
-                                continue;
-                        }
-
-                        /* Initialize regulatory-based run-time data */
-                        ch_info->max_power_avg = ch_info->curr_txpow =
-                            eeprom_ch_info[ch].max_power_avg;
-                        ch_info->scan_power = eeprom_ch_info[ch].max_power_avg;
-                        ch_info->min_power = 0;
-
-                        IWL_DEBUG_EEPROM(priv, "Ch. %d [%sGHz] "
-                                       "%s%s%s%s%s%s(0x%02x %ddBm):"
-                                       " Ad-Hoc %ssupported\n",
-                                       ch_info->channel,
-                                       is_channel_a_band(ch_info) ?
-                                       "5.2" : "2.4",
-                                       CHECK_AND_PRINT_I(VALID),
-                                       CHECK_AND_PRINT_I(IBSS),
-                                       CHECK_AND_PRINT_I(ACTIVE),
-                                       CHECK_AND_PRINT_I(RADAR),
-                                       CHECK_AND_PRINT_I(WIDE),
-                                       CHECK_AND_PRINT_I(DFS),
-                                       eeprom_ch_info[ch].flags,
-                                       eeprom_ch_info[ch].max_power_avg,
-                                       ((eeprom_ch_info[ch].
-                                         flags & EEPROM_CHANNEL_IBSS)
-                                        && !(eeprom_ch_info[ch].
-                                             flags & EEPROM_CHANNEL_RADAR))
-                                       ? "" : "not ");
-
-                        ch_info++;
-                }
-        }
-
-        /* Check if we do have HT40 channels */
-        if (priv->lib->eeprom_ops.regulatory_bands[5] ==
-            EEPROM_REGULATORY_BAND_NO_HT40 &&
-            priv->lib->eeprom_ops.regulatory_bands[6] ==
-            EEPROM_REGULATORY_BAND_NO_HT40)
-                return 0;
-
-        /* Two additional EEPROM bands for 2.4 and 5 GHz HT40 channels */
-        for (band = 6; band <= 7; band++) {
-                enum ieee80211_band ieeeband;
-
-                iwl_init_band_reference(priv, band, &eeprom_ch_count,
-                                        &eeprom_ch_info, &eeprom_ch_index);
-
-                /* EEPROM band 6 is 2.4, band 7 is 5 GHz */
-                ieeeband =
-                        (band == 6) ? IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
-
-                /* Loop through each band adding each of the channels */
-                for (ch = 0; ch < eeprom_ch_count; ch++) {
-                        /* Set up driver's info for lower half */
-                        iwl_mod_ht40_chan_info(priv, ieeeband,
-                                                eeprom_ch_index[ch],
-                                                &eeprom_ch_info[ch],
-                                                IEEE80211_CHAN_NO_HT40PLUS);
-
-                        /* Set up driver's info for upper half */
-                        iwl_mod_ht40_chan_info(priv, ieeeband,
-                                                eeprom_ch_index[ch] + 4,
-                                                &eeprom_ch_info[ch],
-                                                IEEE80211_CHAN_NO_HT40MINUS);
-                }
-        }
-
-        /* for newer device (6000 series and up)
-         * EEPROM contain enhanced tx power information
-         * driver need to process addition information
-         * to determine the max channel tx power limits
-         */
-        if (priv->lib->eeprom_ops.enhanced_txpower)
-                iwl_eeprom_enhanced_txpower(priv);
-
-        return 0;
-}
-
-/*
- * iwl_free_channel_map - undo allocations in iwl_init_channel_map
- */
-void iwl_free_channel_map(struct iwl_priv *priv)
-{
-        kfree(priv->channel_info);
-        priv->channel_count = 0;
-}
-
-/**
- * iwl_get_channel_info - Find driver's private channel info
- *
- * Based on band and channel number.
- */
-const struct iwl_channel_info *iwl_get_channel_info(const struct iwl_priv *priv,
-                                        enum ieee80211_band band, u16 channel)
-{
-        int i;
-
-        switch (band) {
-        case IEEE80211_BAND_5GHZ:
-                for (i = 14; i < priv->channel_count; i++) {
-                        if (priv->channel_info[i].channel == channel)
-                                return &priv->channel_info[i];
-                }
-                break;
-        case IEEE80211_BAND_2GHZ:
-                if (channel >= 1 && channel <= 14)
-                        return &priv->channel_info[channel - 1];
-                break;
-        default:
-                BUG();
-        }
-
-        return NULL;
-}
-
-void iwl_rf_config(struct iwl_priv *priv)
-{
-        u16 radio_cfg;
-
-        radio_cfg = iwl_eeprom_query16(priv, EEPROM_RADIO_CONFIG);
-
-        /* write radio config values to register */
-        if (EEPROM_RF_CFG_TYPE_MSK(radio_cfg) <= EEPROM_RF_CONFIG_TYPE_MAX) {
-                iwl_set_bit(priv->trans, CSR_HW_IF_CONFIG_REG,
-                            EEPROM_RF_CFG_TYPE_MSK(radio_cfg) |
-                            EEPROM_RF_CFG_STEP_MSK(radio_cfg) |
-                            EEPROM_RF_CFG_DASH_MSK(radio_cfg));
-                IWL_INFO(priv, "Radio type=0x%x-0x%x-0x%x\n",
-                         EEPROM_RF_CFG_TYPE_MSK(radio_cfg),
-                         EEPROM_RF_CFG_STEP_MSK(radio_cfg),
-                         EEPROM_RF_CFG_DASH_MSK(radio_cfg));
-        } else
-                WARN_ON(1);
-
-        /* set CSR_HW_CONFIG_REG for uCode use */
-        iwl_set_bit(priv->trans, CSR_HW_IF_CONFIG_REG,
-                    CSR_HW_IF_CONFIG_REG_BIT_RADIO_SI |
-                    CSR_HW_IF_CONFIG_REG_BIT_MAC_SI);
-}
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
deleted file mode 100644
index 64bfd947caeb..000000000000
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ /dev/null
@@ -1,269 +0,0 @@
-/******************************************************************************
- *
- * This file is provided under a dual BSD/GPLv2 license.  When using or
- * redistributing this file, you may do so under either license.
- *
- * GPL LICENSE SUMMARY
- *
- * Copyright(c) 2008 - 2012 Intel Corporation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of version 2 of the GNU General Public License as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
- * USA
- *
- * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
- *
- * Contact Information:
- *  Intel Linux Wireless <ilw@linux.intel.com>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- * BSD LICENSE
- *
- * Copyright(c) 2005 - 2012 Intel Corporation. All rights reserved.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *  * Neither the name Intel Corporation nor the names of its
- *    contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *****************************************************************************/
-
-#ifndef __iwl_eeprom_h__
-#define __iwl_eeprom_h__
-
-#include <net/mac80211.h>
-
-struct iwl_priv;
-
-/*
- * EEPROM access time values:
- *
- * Driver initiates EEPROM read by writing byte address << 1 to CSR_EEPROM_REG.
- * Driver then polls CSR_EEPROM_REG for CSR_EEPROM_REG_READ_VALID_MSK (0x1).
- * When polling, wait 10 uSec between polling loops, up to a maximum 5000 uSec.
- * Driver reads 16-bit value from bits 31-16 of CSR_EEPROM_REG.
- */
-#define IWL_EEPROM_ACCESS_TIMEOUT       5000 /* uSec */
-
-#define IWL_EEPROM_SEM_TIMEOUT          10   /* microseconds */
-#define IWL_EEPROM_SEM_RETRY_LIMIT      1000 /* number of attempts (not time) */
-
-
-/*
- * Regulatory channel usage flags in EEPROM struct iwl4965_eeprom_channel.flags.
- *
- * IBSS and/or AP operation is allowed *only* on those channels with
- * (VALID && IBSS && ACTIVE && !RADAR).  This restriction is in place because
- * RADAR detection is not supported by the 4965 driver, but is a
- * requirement for establishing a new network for legal operation on channels
- * requiring RADAR detection or restricting ACTIVE scanning.
- *
- * NOTE:  "WIDE" flag does not indicate anything about "HT40" 40 MHz channels.
- *        It only indicates that 20 MHz channel use is supported; HT40 channel
- *        usage is indicated by a separate set of regulatory flags for each
- *        HT40 channel pair.
- *
- * NOTE:  Using a channel inappropriately will result in a uCode error!
- */
-#define IWL_NUM_TX_CALIB_GROUPS 5
-enum {
-        EEPROM_CHANNEL_VALID = (1 << 0),        /* usable for this SKU/geo */
-        EEPROM_CHANNEL_IBSS = (1 << 1),         /* usable as an IBSS channel */
-        /* Bit 2 Reserved */
-        EEPROM_CHANNEL_ACTIVE = (1 << 3),       /* active scanning allowed */
-        EEPROM_CHANNEL_RADAR = (1 << 4),        /* radar detection required */
-        EEPROM_CHANNEL_WIDE = (1 << 5),         /* 20 MHz channel okay */
-        /* Bit 6 Reserved (was Narrow Channel) */
-        EEPROM_CHANNEL_DFS = (1 << 7),  /* dynamic freq selection candidate */
-};
-
-/* SKU Capabilities */
-#define EEPROM_SKU_CAP_BAND_24GHZ                       (1 << 4)
-#define EEPROM_SKU_CAP_BAND_52GHZ                       (1 << 5)
-#define EEPROM_SKU_CAP_11N_ENABLE                       (1 << 6)
-#define EEPROM_SKU_CAP_AMT_ENABLE                       (1 << 7)
-#define EEPROM_SKU_CAP_IPAN_ENABLE                      (1 << 8)
-
-/* *regulatory* channel data format in eeprom, one for each channel.
- * There are separate entries for HT40 (40 MHz) vs. normal (20 MHz) channels. */
-struct iwl_eeprom_channel {
-        u8 flags;               /* EEPROM_CHANNEL_* flags copied from EEPROM */
-        s8 max_power_avg;       /* max power (dBm) on this chnl, limit 31 */
-} __packed;
-
-enum iwl_eeprom_enhanced_txpwr_flags {
-        IWL_EEPROM_ENH_TXP_FL_VALID             = BIT(0),
-        IWL_EEPROM_ENH_TXP_FL_BAND_52G          = BIT(1),
-        IWL_EEPROM_ENH_TXP_FL_OFDM              = BIT(2),
-        IWL_EEPROM_ENH_TXP_FL_40MHZ             = BIT(3),
-        IWL_EEPROM_ENH_TXP_FL_HT_AP             = BIT(4),
-        IWL_EEPROM_ENH_TXP_FL_RES1              = BIT(5),
-        IWL_EEPROM_ENH_TXP_FL_RES2              = BIT(6),
-        IWL_EEPROM_ENH_TXP_FL_COMMON_TYPE       = BIT(7),
-};
-
-/**
- * iwl_eeprom_enhanced_txpwr structure
- *    This structure presents the enhanced regulatory tx power limit layout
- *    in eeprom image
- *    Enhanced regulatory tx power portion of eeprom image can be broken down
- *    into individual structures; each one is 8 bytes in size and contain the
- *    following information
- * @flags: entry flags
- * @channel: channel number
- * @chain_a_max_pwr: chain a max power in 1/2 dBm
- * @chain_b_max_pwr: chain b max power in 1/2 dBm
- * @chain_c_max_pwr: chain c max power in 1/2 dBm
- * @delta_20_in_40: 20-in-40 deltas (hi/lo)
- * @mimo2_max_pwr: mimo2 max power in 1/2 dBm
- * @mimo3_max_pwr: mimo3 max power in 1/2 dBm
- *
- */
-struct iwl_eeprom_enhanced_txpwr {
-        u8 flags;
-        u8 channel;
-        s8 chain_a_max;
-        s8 chain_b_max;
-        s8 chain_c_max;
-        u8 delta_20_in_40;
-        s8 mimo2_max;
-        s8 mimo3_max;
-} __packed;
-
-/* calibration */
-struct iwl_eeprom_calib_hdr {
-        u8 version;
-        u8 pa_type;
-        __le16 voltage;
-} __packed;
-
-#define EEPROM_CALIB_ALL        (INDIRECT_ADDRESS | INDIRECT_CALIBRATION)
-#define EEPROM_XTAL             ((2*0x128) | EEPROM_CALIB_ALL)
-
-/* temperature */
-#define EEPROM_KELVIN_TEMPERATURE       ((2*0x12A) | EEPROM_CALIB_ALL)
-#define EEPROM_RAW_TEMPERATURE          ((2*0x12B) | EEPROM_CALIB_ALL)
-
-
-/* agn links */
-#define EEPROM_LINK_HOST             (2*0x64)
-#define EEPROM_LINK_GENERAL          (2*0x65)
-#define EEPROM_LINK_REGULATORY       (2*0x66)
-#define EEPROM_LINK_CALIBRATION      (2*0x67)
-#define EEPROM_LINK_PROCESS_ADJST    (2*0x68)
-#define EEPROM_LINK_OTHERS           (2*0x69)
-#define EEPROM_LINK_TXP_LIMIT        (2*0x6a)
-#define EEPROM_LINK_TXP_LIMIT_SIZE   (2*0x6b)
-
-/* agn regulatory - indirect access */
-#define EEPROM_REG_BAND_1_CHANNELS       ((0x08)\
-                | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 28 bytes */
-#define EEPROM_REG_BAND_2_CHANNELS       ((0x26)\
-                | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 26 bytes */
-#define EEPROM_REG_BAND_3_CHANNELS       ((0x42)\
-                | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 24 bytes */
-#define EEPROM_REG_BAND_4_CHANNELS       ((0x5C)\
-                | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 22 bytes */
-#define EEPROM_REG_BAND_5_CHANNELS       ((0x74)\
-                | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 12 bytes */
-#define EEPROM_REG_BAND_24_HT40_CHANNELS  ((0x82)\
-                | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 14  bytes */
-#define EEPROM_REG_BAND_52_HT40_CHANNELS  ((0x92)\
-                | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 22  bytes */
-
-/* 6000 regulatory - indirect access */
-#define EEPROM_6000_REG_BAND_24_HT40_CHANNELS  ((0x80)\
-                | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 14  bytes */
-/* 2.4 GHz */
-extern const u8 iwl_eeprom_band_1[14];
-
-#define ADDRESS_MSK                 0x0000FFFF
-#define INDIRECT_TYPE_MSK           0x000F0000
-#define INDIRECT_HOST               0x00010000
-#define INDIRECT_GENERAL            0x00020000
-#define INDIRECT_REGULATORY         0x00030000
-#define INDIRECT_CALIBRATION        0x00040000
-#define INDIRECT_PROCESS_ADJST      0x00050000
-#define INDIRECT_OTHERS             0x00060000
-#define INDIRECT_TXP_LIMIT          0x00070000
-#define INDIRECT_TXP_LIMIT_SIZE     0x00080000
-#define INDIRECT_ADDRESS            0x00100000
-
-/* General */
-#define EEPROM_DEVICE_ID                    (2*0x08)    /* 2 bytes */
-#define EEPROM_SUBSYSTEM_ID                 (2*0x0A)    /* 2 bytes */
-#define EEPROM_MAC_ADDRESS                  (2*0x15)    /* 6  bytes */
-#define EEPROM_BOARD_REVISION               (2*0x35)    /* 2  bytes */
-#define EEPROM_BOARD_PBA_NUMBER             (2*0x3B+1)  /* 9  bytes */
-#define EEPROM_VERSION                      (2*0x44)    /* 2  bytes */
-#define EEPROM_SKU_CAP                      (2*0x45)    /* 2  bytes */
-#define EEPROM_OEM_MODE                     (2*0x46)    /* 2  bytes */
-#define EEPROM_RADIO_CONFIG                 (2*0x48)    /* 2  bytes */
-#define EEPROM_NUM_MAC_ADDRESS              (2*0x4C)    /* 2  bytes */
-
-/* The following masks are to be applied on EEPROM_RADIO_CONFIG */
-#define EEPROM_RF_CFG_TYPE_MSK(x)   (x & 0x3)         /* bits 0-1   */
-#define EEPROM_RF_CFG_STEP_MSK(x)   ((x >> 2)  & 0x3) /* bits 2-3   */
-#define EEPROM_RF_CFG_DASH_MSK(x)   ((x >> 4)  & 0x3) /* bits 4-5   */
-#define EEPROM_RF_CFG_PNUM_MSK(x)   ((x >> 6)  & 0x3) /* bits 6-7   */
-#define EEPROM_RF_CFG_TX_ANT_MSK(x) ((x >> 8)  & 0xF) /* bits 8-11  */
-#define EEPROM_RF_CFG_RX_ANT_MSK(x) ((x >> 12) & 0xF) /* bits 12-15 */
-
-#define EEPROM_RF_CONFIG_TYPE_MAX       0x3
-
-#define EEPROM_REGULATORY_BAND_NO_HT40                  (0)
-
-struct iwl_eeprom_ops {
-        const u32 regulatory_bands[7];
-        bool enhanced_txpower;
-};
-
-
-int iwl_eeprom_init(struct iwl_priv *priv, u32 hw_rev);
-void iwl_eeprom_free(struct iwl_priv *priv);
-int iwl_eeprom_check_version(struct iwl_priv *priv);
-int iwl_eeprom_init_hw_params(struct iwl_priv *priv);
-u16 iwl_eeprom_calib_version(struct iwl_priv *priv);
-const u8 *iwl_eeprom_query_addr(struct iwl_priv *priv, size_t offset);
-u16 iwl_eeprom_query16(struct iwl_priv *priv, size_t offset);
-void iwl_eeprom_get_mac(struct iwl_priv *priv, u8 *mac);
-int iwl_init_channel_map(struct iwl_priv *priv);
-void iwl_free_channel_map(struct iwl_priv *priv);
-const struct iwl_channel_info *iwl_get_channel_info(
-                const struct iwl_priv *priv,
-                enum ieee80211_band band, u16 channel);
-void iwl_rf_config(struct iwl_priv *priv);
-
-#endif  /* __iwl_eeprom_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-fh.h b/drivers/net/wireless/iwlwifi/iwl-fh.h
index 74bce97a8600..806046641747 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fh.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fh.h
@@ -421,6 +421,8 @@ static inline unsigned int FH_MEM_CBBC_QUEUE(unsigned int chnl)
                 (FH_SRVC_LOWER_BOUND + ((_chnl) - 9) * 0x4)
 
 #define FH_TX_CHICKEN_BITS_REG  (FH_MEM_LOWER_BOUND + 0xE98)
+#define FH_TX_TRB_REG(_chan)    (FH_MEM_LOWER_BOUND + 0x958 + (_chan) * 4)
+
 /* Instruct FH to increment the retry count of a packet when
  * it is brought from the memory to TX-FIFO
  */
diff --git a/drivers/net/wireless/iwlwifi/iwl-io.c b/drivers/net/wireless/iwlwifi/iwl-io.c
index 081dd34d2387..66c873399aba 100644
--- a/drivers/net/wireless/iwlwifi/iwl-io.c
+++ b/drivers/net/wireless/iwlwifi/iwl-io.c
@@ -27,6 +27,7 @@
  *****************************************************************************/
 #include <linux/delay.h>
 #include <linux/device.h>
+#include <linux/export.h>
 
 #include "iwl-io.h"
 #include"iwl-csr.h"
@@ -52,6 +53,7 @@ void iwl_set_bit(struct iwl_trans *trans, u32 reg, u32 mask)
         __iwl_set_bit(trans, reg, mask);
         spin_unlock_irqrestore(&trans->reg_lock, flags);
 }
+EXPORT_SYMBOL_GPL(iwl_set_bit);
 
 void iwl_clear_bit(struct iwl_trans *trans, u32 reg, u32 mask)
 {
@@ -61,6 +63,25 @@ void iwl_clear_bit(struct iwl_trans *trans, u32 reg, u32 mask)
         __iwl_clear_bit(trans, reg, mask);
         spin_unlock_irqrestore(&trans->reg_lock, flags);
 }
+EXPORT_SYMBOL_GPL(iwl_clear_bit);
+
+void iwl_set_bits_mask(struct iwl_trans *trans, u32 reg, u32 mask, u32 value)
+{
+        unsigned long flags;
+        u32 v;
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+        WARN_ON_ONCE(value & ~mask);
+#endif
+
+        spin_lock_irqsave(&trans->reg_lock, flags);
+        v = iwl_read32(trans, reg);
+        v &= ~mask;
+        v |= value;
+        iwl_write32(trans, reg, v);
+        spin_unlock_irqrestore(&trans->reg_lock, flags);
+}
+EXPORT_SYMBOL_GPL(iwl_set_bits_mask);
 
 int iwl_poll_bit(struct iwl_trans *trans, u32 addr,
                  u32 bits, u32 mask, int timeout)
@@ -76,6 +97,7 @@ int iwl_poll_bit(struct iwl_trans *trans, u32 addr,
 
         return -ETIMEDOUT;
 }
+EXPORT_SYMBOL_GPL(iwl_poll_bit);
 
 int iwl_grab_nic_access_silent(struct iwl_trans *trans)
 {
@@ -117,6 +139,7 @@ int iwl_grab_nic_access_silent(struct iwl_trans *trans)
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(iwl_grab_nic_access_silent);
 
 bool iwl_grab_nic_access(struct iwl_trans *trans)
 {
@@ -130,6 +153,7 @@ bool iwl_grab_nic_access(struct iwl_trans *trans)
 
         return true;
 }
+EXPORT_SYMBOL_GPL(iwl_grab_nic_access);
 
 void iwl_release_nic_access(struct iwl_trans *trans)
 {
@@ -144,6 +168,7 @@ void iwl_release_nic_access(struct iwl_trans *trans)
          */
         mmiowb();
 }
+EXPORT_SYMBOL_GPL(iwl_release_nic_access);
 
 u32 iwl_read_direct32(struct iwl_trans *trans, u32 reg)
 {
@@ -158,6 +183,7 @@ u32 iwl_read_direct32(struct iwl_trans *trans, u32 reg)
 
         return value;
 }
+EXPORT_SYMBOL_GPL(iwl_read_direct32);
 
 void iwl_write_direct32(struct iwl_trans *trans, u32 reg, u32 value)
 {
@@ -170,6 +196,7 @@ void iwl_write_direct32(struct iwl_trans *trans, u32 reg, u32 value)
         }
         spin_unlock_irqrestore(&trans->reg_lock, flags);
 }
+EXPORT_SYMBOL_GPL(iwl_write_direct32);
 
 int iwl_poll_direct_bit(struct iwl_trans *trans, u32 addr, u32 mask,
                         int timeout)
@@ -185,6 +212,7 @@ int iwl_poll_direct_bit(struct iwl_trans *trans, u32 addr, u32 mask,
 
         return -ETIMEDOUT;
 }
+EXPORT_SYMBOL_GPL(iwl_poll_direct_bit);
 
 static inline u32 __iwl_read_prph(struct iwl_trans *trans, u32 reg)
 {
@@ -211,6 +239,7 @@ u32 iwl_read_prph(struct iwl_trans *trans, u32 reg)
         spin_unlock_irqrestore(&trans->reg_lock, flags);
         return val;
 }
+EXPORT_SYMBOL_GPL(iwl_read_prph);
 
 void iwl_write_prph(struct iwl_trans *trans, u32 addr, u32 val)
 {
@@ -223,6 +252,7 @@ void iwl_write_prph(struct iwl_trans *trans, u32 addr, u32 val)
         }
         spin_unlock_irqrestore(&trans->reg_lock, flags);
 }
+EXPORT_SYMBOL_GPL(iwl_write_prph);
 
 void iwl_set_bits_prph(struct iwl_trans *trans, u32 reg, u32 mask)
 {
@@ -236,6 +266,7 @@ void iwl_set_bits_prph(struct iwl_trans *trans, u32 reg, u32 mask)
         }
         spin_unlock_irqrestore(&trans->reg_lock, flags);
 }
+EXPORT_SYMBOL_GPL(iwl_set_bits_prph);
 
 void iwl_set_bits_mask_prph(struct iwl_trans *trans, u32 reg,
                             u32 bits, u32 mask)
@@ -250,6 +281,7 @@ void iwl_set_bits_mask_prph(struct iwl_trans *trans, u32 reg,
         }
         spin_unlock_irqrestore(&trans->reg_lock, flags);
 }
+EXPORT_SYMBOL_GPL(iwl_set_bits_mask_prph);
 
 void iwl_clear_bits_prph(struct iwl_trans *trans, u32 reg, u32 mask)
 {
@@ -264,9 +296,10 @@ void iwl_clear_bits_prph(struct iwl_trans *trans, u32 reg, u32 mask)
         }
         spin_unlock_irqrestore(&trans->reg_lock, flags);
 }
+EXPORT_SYMBOL_GPL(iwl_clear_bits_prph);
 
-void _iwl_read_targ_mem_words(struct iwl_trans *trans, u32 addr,
-                              void *buf, int words)
+void _iwl_read_targ_mem_dwords(struct iwl_trans *trans, u32 addr,
+                               void *buf, int dwords)
 {
         unsigned long flags;
         int offs;
@@ -275,24 +308,26 @@ void _iwl_read_targ_mem_words(struct iwl_trans *trans, u32 addr,
         spin_lock_irqsave(&trans->reg_lock, flags);
         if (likely(iwl_grab_nic_access(trans))) {
                 iwl_write32(trans, HBUS_TARG_MEM_RADDR, addr);
-                for (offs = 0; offs < words; offs++)
+                for (offs = 0; offs < dwords; offs++)
                         vals[offs] = iwl_read32(trans, HBUS_TARG_MEM_RDAT);
                 iwl_release_nic_access(trans);
         }
         spin_unlock_irqrestore(&trans->reg_lock, flags);
 }
+EXPORT_SYMBOL_GPL(_iwl_read_targ_mem_dwords);
 
 u32 iwl_read_targ_mem(struct iwl_trans *trans, u32 addr)
 {
         u32 value;
 
-        _iwl_read_targ_mem_words(trans, addr, &value, 1);
+        _iwl_read_targ_mem_dwords(trans, addr, &value, 1);
 
         return value;
 }
+EXPORT_SYMBOL_GPL(iwl_read_targ_mem);
 
-int _iwl_write_targ_mem_words(struct iwl_trans *trans, u32 addr,
-                                void *buf, int words)
+int _iwl_write_targ_mem_dwords(struct iwl_trans *trans, u32 addr,
+                               void *buf, int dwords)
 {
         unsigned long flags;
         int offs, result = 0;
@@ -301,7 +336,7 @@ int _iwl_write_targ_mem_words(struct iwl_trans *trans, u32 addr,
         spin_lock_irqsave(&trans->reg_lock, flags);
         if (likely(iwl_grab_nic_access(trans))) {
                 iwl_write32(trans, HBUS_TARG_MEM_WADDR, addr);
-                for (offs = 0; offs < words; offs++)
+                for (offs = 0; offs < dwords; offs++)
                         iwl_write32(trans, HBUS_TARG_MEM_WDAT, vals[offs]);
                 iwl_release_nic_access(trans);
         } else
@@ -310,8 +345,10 @@ int _iwl_write_targ_mem_words(struct iwl_trans *trans, u32 addr,
 
         return result;
 }
+EXPORT_SYMBOL_GPL(_iwl_write_targ_mem_dwords);
 
 int iwl_write_targ_mem(struct iwl_trans *trans, u32 addr, u32 val)
 {
-        return _iwl_write_targ_mem_words(trans, addr, &val, 1);
+        return _iwl_write_targ_mem_dwords(trans, addr, &val, 1);
 }
+EXPORT_SYMBOL_GPL(iwl_write_targ_mem);
diff --git a/drivers/net/wireless/iwlwifi/iwl-io.h b/drivers/net/wireless/iwlwifi/iwl-io.h
index abb3250164ba..50d3819739d1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-io.h
+++ b/drivers/net/wireless/iwlwifi/iwl-io.h
@@ -54,6 +54,8 @@ static inline u32 iwl_read32(struct iwl_trans *trans, u32 ofs)
 void iwl_set_bit(struct iwl_trans *trans, u32 reg, u32 mask);
 void iwl_clear_bit(struct iwl_trans *trans, u32 reg, u32 mask);
 
+void iwl_set_bits_mask(struct iwl_trans *trans, u32 reg, u32 mask, u32 value);
+
 int iwl_poll_bit(struct iwl_trans *trans, u32 addr,
                  u32 bits, u32 mask, int timeout);
 int iwl_poll_direct_bit(struct iwl_trans *trans, u32 addr, u32 mask,
@@ -74,18 +76,18 @@ void iwl_set_bits_mask_prph(struct iwl_trans *trans, u32 reg,
                             u32 bits, u32 mask);
 void iwl_clear_bits_prph(struct iwl_trans *trans, u32 reg, u32 mask);
 
-void _iwl_read_targ_mem_words(struct iwl_trans *trans, u32 addr,
-                              void *buf, int words);
+void _iwl_read_targ_mem_dwords(struct iwl_trans *trans, u32 addr,
+                               void *buf, int dwords);
 
-#define iwl_read_targ_mem_words(trans, addr, buf, bufsize)      \
+#define iwl_read_targ_mem_bytes(trans, addr, buf, bufsize)      \
         do {                                                    \
                 BUILD_BUG_ON((bufsize) % sizeof(u32));          \
-                _iwl_read_targ_mem_words(trans, addr, buf,      \
-                                         (bufsize) / sizeof(u32));\
+                _iwl_read_targ_mem_dwords(trans, addr, buf,     \
+                                          (bufsize) / sizeof(u32));\
         } while (0)
 
-int _iwl_write_targ_mem_words(struct iwl_trans *trans, u32 addr,
-                              void *buf, int words);
+int _iwl_write_targ_mem_dwords(struct iwl_trans *trans, u32 addr,
+                               void *buf, int dwords);
 
 u32 iwl_read_targ_mem(struct iwl_trans *trans, u32 addr);
 int iwl_write_targ_mem(struct iwl_trans *trans, u32 addr, u32 val);
diff --git a/drivers/net/wireless/iwlwifi/iwl-notif-wait.c b/drivers/net/wireless/iwlwifi/iwl-notif-wait.c
index 0066b899fe5c..5cfed29b1b18 100644
--- a/drivers/net/wireless/iwlwifi/iwl-notif-wait.c
+++ b/drivers/net/wireless/iwlwifi/iwl-notif-wait.c
@@ -61,6 +61,7 @@
  *
  *****************************************************************************/
 #include <linux/sched.h>
+#include <linux/export.h>
 
 #include "iwl-notif-wait.h"
 
@@ -71,6 +72,7 @@ void iwl_notification_wait_init(struct iwl_notif_wait_data *notif_wait)
         INIT_LIST_HEAD(&notif_wait->notif_waits);
         init_waitqueue_head(&notif_wait->notif_waitq);
 }
+EXPORT_SYMBOL_GPL(iwl_notification_wait_init);
 
 void iwl_notification_wait_notify(struct iwl_notif_wait_data *notif_wait,
                                   struct iwl_rx_packet *pkt)
@@ -115,6 +117,7 @@ void iwl_notification_wait_notify(struct iwl_notif_wait_data *notif_wait,
         if (triggered)
                 wake_up_all(&notif_wait->notif_waitq);
 }
+EXPORT_SYMBOL_GPL(iwl_notification_wait_notify);
 
 void iwl_abort_notification_waits(struct iwl_notif_wait_data *notif_wait)
 {
@@ -128,7 +131,7 @@ void iwl_abort_notification_waits(struct iwl_notif_wait_data *notif_wait)
 
         wake_up_all(&notif_wait->notif_waitq);
 }
-
+EXPORT_SYMBOL_GPL(iwl_abort_notification_waits);
 
 void
 iwl_init_notification_wait(struct iwl_notif_wait_data *notif_wait,
@@ -152,6 +155,7 @@ iwl_init_notification_wait(struct iwl_notif_wait_data *notif_wait,
         list_add(&wait_entry->list, &notif_wait->notif_waits);
         spin_unlock_bh(&notif_wait->notif_wait_lock);
 }
+EXPORT_SYMBOL_GPL(iwl_init_notification_wait);
 
 int iwl_wait_notification(struct iwl_notif_wait_data *notif_wait,
                           struct iwl_notification_wait *wait_entry,
@@ -175,6 +179,7 @@ int iwl_wait_notification(struct iwl_notif_wait_data *notif_wait,
                 return -ETIMEDOUT;
         return 0;
 }
+EXPORT_SYMBOL_GPL(iwl_wait_notification);
 
 void iwl_remove_notification(struct iwl_notif_wait_data *notif_wait,
                              struct iwl_notification_wait *wait_entry)
@@ -183,3 +188,4 @@ void iwl_remove_notification(struct iwl_notif_wait_data *notif_wait,
         list_del(&wait_entry->list);
         spin_unlock_bh(&notif_wait->notif_wait_lock);
 }
+EXPORT_SYMBOL_GPL(iwl_remove_notification);
diff --git a/drivers/net/wireless/iwlwifi/iwl-op-mode.h b/drivers/net/wireless/iwlwifi/iwl-op-mode.h
index 4ef742b28e08..cd9ef114d3a3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-op-mode.h
+++ b/drivers/net/wireless/iwlwifi/iwl-op-mode.h
@@ -145,6 +145,9 @@ struct iwl_op_mode_ops {
         void (*wimax_active)(struct iwl_op_mode *op_mode);
 };
 
+int iwl_opmode_register(const char *name, const struct iwl_op_mode_ops *ops);
+void iwl_opmode_deregister(const char *name);
+
 /**
  * struct iwl_op_mode - operational mode
  *
@@ -218,9 +221,4 @@ static inline void iwl_op_mode_wimax_active(struct iwl_op_mode *op_mode)
         op_mode->ops->wimax_active(op_mode);
 }
 
-/*****************************************************
-* Op mode layers implementations
-******************************************************/
-extern const struct iwl_op_mode_ops iwl_dvm_ops;
-
 #endif /* __iwl_op_mode_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index dfd54662e3e6..9253ef1dba72 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -187,7 +187,7 @@
 #define SCD_QUEUE_STTS_REG_POS_ACTIVE   (3)
 #define SCD_QUEUE_STTS_REG_POS_WSL      (4)
 #define SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN (19)
-#define SCD_QUEUE_STTS_REG_MSK          (0x00FF0000)
+#define SCD_QUEUE_STTS_REG_MSK          (0x017F0000)
 
 #define SCD_QUEUE_CTX_REG1_CREDIT_POS           (8)
 #define SCD_QUEUE_CTX_REG1_CREDIT_MSK           (0x00FFFF00)
diff --git a/drivers/net/wireless/iwlwifi/iwl-test.c b/drivers/net/wireless/iwlwifi/iwl-test.c
new file mode 100644
index 000000000000..81e8c7126d72
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-test.c
@@ -0,0 +1,856 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2010 - 2012 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2010 - 2012 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#include <linux/export.h>
+#include <net/netlink.h>
+
+#include "iwl-io.h"
+#include "iwl-fh.h"
+#include "iwl-prph.h"
+#include "iwl-trans.h"
+#include "iwl-test.h"
+#include "iwl-csr.h"
+#include "iwl-testmode.h"
+
+/*
+ * Periphery registers absolute lower bound. This is used in order to
+ * differentiate registery access through HBUS_TARG_PRPH_* and
+ * HBUS_TARG_MEM_* accesses.
+ */
+#define IWL_ABS_PRPH_START (0xA00000)
+
+/*
+ * The TLVs used in the gnl message policy between the kernel module and
+ * user space application. iwl_testmode_gnl_msg_policy is to be carried
+ * through the NL80211_CMD_TESTMODE channel regulated by nl80211.
+ * See iwl-testmode.h
+ */
+static
+struct nla_policy iwl_testmode_gnl_msg_policy[IWL_TM_ATTR_MAX] = {
+        [IWL_TM_ATTR_COMMAND] = { .type = NLA_U32, },
+
+        [IWL_TM_ATTR_UCODE_CMD_ID] = { .type = NLA_U8, },
+        [IWL_TM_ATTR_UCODE_CMD_DATA] = { .type = NLA_UNSPEC, },
+
+        [IWL_TM_ATTR_REG_OFFSET] = { .type = NLA_U32, },
+        [IWL_TM_ATTR_REG_VALUE8] = { .type = NLA_U8, },
+        [IWL_TM_ATTR_REG_VALUE32] = { .type = NLA_U32, },
+
+        [IWL_TM_ATTR_SYNC_RSP] = { .type = NLA_UNSPEC, },
+        [IWL_TM_ATTR_UCODE_RX_PKT] = { .type = NLA_UNSPEC, },
+
+        [IWL_TM_ATTR_EEPROM] = { .type = NLA_UNSPEC, },
+
+        [IWL_TM_ATTR_TRACE_ADDR] = { .type = NLA_UNSPEC, },
+        [IWL_TM_ATTR_TRACE_DUMP] = { .type = NLA_UNSPEC, },
+        [IWL_TM_ATTR_TRACE_SIZE] = { .type = NLA_U32, },
+
+        [IWL_TM_ATTR_FIXRATE] = { .type = NLA_U32, },
+
+        [IWL_TM_ATTR_UCODE_OWNER] = { .type = NLA_U8, },
+
+        [IWL_TM_ATTR_MEM_ADDR] = { .type = NLA_U32, },
+        [IWL_TM_ATTR_BUFFER_SIZE] = { .type = NLA_U32, },
+        [IWL_TM_ATTR_BUFFER_DUMP] = { .type = NLA_UNSPEC, },
+
+        [IWL_TM_ATTR_FW_VERSION] = { .type = NLA_U32, },
+        [IWL_TM_ATTR_DEVICE_ID] = { .type = NLA_U32, },
+        [IWL_TM_ATTR_FW_TYPE] = { .type = NLA_U32, },
+        [IWL_TM_ATTR_FW_INST_SIZE] = { .type = NLA_U32, },
+        [IWL_TM_ATTR_FW_DATA_SIZE] = { .type = NLA_U32, },
+
+        [IWL_TM_ATTR_ENABLE_NOTIFICATION] = {.type = NLA_FLAG, },
+};
+
+static inline void iwl_test_trace_clear(struct iwl_test *tst)
+{
+        memset(&tst->trace, 0, sizeof(struct iwl_test_trace));
+}
+
+static void iwl_test_trace_stop(struct iwl_test *tst)
+{
+        if (!tst->trace.enabled)
+                return;
+
+        if (tst->trace.cpu_addr && tst->trace.dma_addr)
+                dma_free_coherent(tst->trans->dev,
+                                  tst->trace.tsize,
+                                  tst->trace.cpu_addr,
+                                  tst->trace.dma_addr);
+
+        iwl_test_trace_clear(tst);
+}
+
+static inline void iwl_test_mem_clear(struct iwl_test *tst)
+{
+        memset(&tst->mem, 0, sizeof(struct iwl_test_mem));
+}
+
+static inline void iwl_test_mem_stop(struct iwl_test *tst)
+{
+        if (!tst->mem.in_read)
+                return;
+
+        iwl_test_mem_clear(tst);
+}
+
+/*
+ * Initializes the test object
+ * During the lifetime of the test object it is assumed that the transport is
+ * started. The test object should be stopped before the transport is stopped.
+ */
+void iwl_test_init(struct iwl_test *tst, struct iwl_trans *trans,
+                   struct iwl_test_ops *ops)
+{
+        tst->trans = trans;
+        tst->ops = ops;
+
+        iwl_test_trace_clear(tst);
+        iwl_test_mem_clear(tst);
+}
+EXPORT_SYMBOL_GPL(iwl_test_init);
+
+/*
+ * Stop the test object
+ */
+void iwl_test_free(struct iwl_test *tst)
+{
+        iwl_test_mem_stop(tst);
+        iwl_test_trace_stop(tst);
+}
+EXPORT_SYMBOL_GPL(iwl_test_free);
+
+static inline int iwl_test_send_cmd(struct iwl_test *tst,
+                                    struct iwl_host_cmd *cmd)
+{
+        return tst->ops->send_cmd(tst->trans->op_mode, cmd);
+}
+
+static inline bool iwl_test_valid_hw_addr(struct iwl_test *tst, u32 addr)
+{
+        return tst->ops->valid_hw_addr(addr);
+}
+
+static inline u32 iwl_test_fw_ver(struct iwl_test *tst)
+{
+        return tst->ops->get_fw_ver(tst->trans->op_mode);
+}
+
+static inline struct sk_buff*
+iwl_test_alloc_reply(struct iwl_test *tst, int len)
+{
+        return tst->ops->alloc_reply(tst->trans->op_mode, len);
+}
+
+static inline int iwl_test_reply(struct iwl_test *tst, struct sk_buff *skb)
+{
+        return tst->ops->reply(tst->trans->op_mode, skb);
+}
+
+static inline struct sk_buff*
+iwl_test_alloc_event(struct iwl_test *tst, int len)
+{
+        return tst->ops->alloc_event(tst->trans->op_mode, len);
+}
+
+static inline void
+iwl_test_event(struct iwl_test *tst, struct sk_buff *skb)
+{
+        return tst->ops->event(tst->trans->op_mode, skb);
+}
+
+/*
+ * This function handles the user application commands to the fw. The fw
+ * commands are sent in a synchronuous manner. In case that the user requested
+ * to get commands response, it is send to the user.
+ */
+static int iwl_test_fw_cmd(struct iwl_test *tst, struct nlattr **tb)
+{
+        struct iwl_host_cmd cmd;
+        struct iwl_rx_packet *pkt;
+        struct sk_buff *skb;
+        void *reply_buf;
+        u32 reply_len;
+        int ret;
+        bool cmd_want_skb;
+
+        memset(&cmd, 0, sizeof(struct iwl_host_cmd));
+
+        if (!tb[IWL_TM_ATTR_UCODE_CMD_ID] ||
+            !tb[IWL_TM_ATTR_UCODE_CMD_DATA]) {
+                IWL_ERR(tst->trans, "Missing fw command mandatory fields\n");
+                return -ENOMSG;
+        }
+
+        cmd.flags = CMD_ON_DEMAND | CMD_SYNC;
+        cmd_want_skb = nla_get_flag(tb[IWL_TM_ATTR_UCODE_CMD_SKB]);
+        if (cmd_want_skb)
+                cmd.flags |= CMD_WANT_SKB;
+
+        cmd.id = nla_get_u8(tb[IWL_TM_ATTR_UCODE_CMD_ID]);
+        cmd.data[0] = nla_data(tb[IWL_TM_ATTR_UCODE_CMD_DATA]);
+        cmd.len[0] = nla_len(tb[IWL_TM_ATTR_UCODE_CMD_DATA]);
+        cmd.dataflags[0] = IWL_HCMD_DFL_NOCOPY;
+        IWL_DEBUG_INFO(tst->trans, "test fw cmd=0x%x, flags 0x%x, len %d\n",
+                       cmd.id, cmd.flags, cmd.len[0]);
+
+        ret = iwl_test_send_cmd(tst, &cmd);
+        if (ret) {
+                IWL_ERR(tst->trans, "Failed to send hcmd\n");
+                return ret;
+        }
+        if (!cmd_want_skb)
+                return ret;
+
+        /* Handling return of SKB to the user */
+        pkt = cmd.resp_pkt;
+        if (!pkt) {
+                IWL_ERR(tst->trans, "HCMD received a null response packet\n");
+                return ret;
+        }
+
+        reply_len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
+        skb = iwl_test_alloc_reply(tst, reply_len + 20);
+        reply_buf = kmalloc(reply_len, GFP_KERNEL);
+        if (!skb || !reply_buf) {
+                kfree_skb(skb);
+                kfree(reply_buf);
+                return -ENOMEM;
+        }
+
+        /* The reply is in a page, that we cannot send to user space. */
+        memcpy(reply_buf, &(pkt->hdr), reply_len);
+        iwl_free_resp(&cmd);
+
+        if (nla_put_u32(skb, IWL_TM_ATTR_COMMAND,
+                        IWL_TM_CMD_DEV2APP_UCODE_RX_PKT) ||
+            nla_put(skb, IWL_TM_ATTR_UCODE_RX_PKT, reply_len, reply_buf))
+                goto nla_put_failure;
+        return iwl_test_reply(tst, skb);
+
+nla_put_failure:
+        IWL_DEBUG_INFO(tst->trans, "Failed creating NL attributes\n");
+        kfree(reply_buf);
+        kfree_skb(skb);
+        return -ENOMSG;
+}
+
+/*
+ * Handles the user application commands for register access.
+ */
+static int iwl_test_reg(struct iwl_test *tst, struct nlattr **tb)
+{
+        u32 ofs, val32, cmd;
+        u8 val8;
+        struct sk_buff *skb;
+        int status = 0;
+        struct iwl_trans *trans = tst->trans;
+
+        if (!tb[IWL_TM_ATTR_REG_OFFSET]) {
+                IWL_ERR(trans, "Missing reg offset\n");
+                return -ENOMSG;
+        }
+
+        ofs = nla_get_u32(tb[IWL_TM_ATTR_REG_OFFSET]);
+        IWL_DEBUG_INFO(trans, "test reg access cmd offset=0x%x\n", ofs);
+
+        cmd = nla_get_u32(tb[IWL_TM_ATTR_COMMAND]);
+
+        /*
+         * Allow access only to FH/CSR/HBUS in direct mode.
+         * Since we don't have the upper bounds for the CSR and HBUS segments,
+         * we will use only the upper bound of FH for sanity check.
+         */
+        if (ofs >= FH_MEM_UPPER_BOUND) {
+                IWL_ERR(trans, "offset out of segment (0x0 - 0x%x)\n",
+                        FH_MEM_UPPER_BOUND);
+                return -EINVAL;
+        }
+
+        switch (cmd) {
+        case IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32:
+                val32 = iwl_read_direct32(tst->trans, ofs);
+                IWL_DEBUG_INFO(trans, "32 value to read 0x%x\n", val32);
+
+                skb = iwl_test_alloc_reply(tst, 20);
+                if (!skb) {
+                        IWL_ERR(trans, "Memory allocation fail\n");
+                        return -ENOMEM;
+                }
+                if (nla_put_u32(skb, IWL_TM_ATTR_REG_VALUE32, val32))
+                        goto nla_put_failure;
+                status = iwl_test_reply(tst, skb);
+                if (status < 0)
+                        IWL_ERR(trans, "Error sending msg : %d\n", status);
+                break;
+
+        case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32:
+                if (!tb[IWL_TM_ATTR_REG_VALUE32]) {
+                        IWL_ERR(trans, "Missing value to write\n");
+                        return -ENOMSG;
+                } else {
+                        val32 = nla_get_u32(tb[IWL_TM_ATTR_REG_VALUE32]);
+                        IWL_DEBUG_INFO(trans, "32b write val=0x%x\n", val32);
+                        iwl_write_direct32(tst->trans, ofs, val32);
+                }
+                break;
+
+        case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8:
+                if (!tb[IWL_TM_ATTR_REG_VALUE8]) {
+                        IWL_ERR(trans, "Missing value to write\n");
+                        return -ENOMSG;
+                } else {
+                        val8 = nla_get_u8(tb[IWL_TM_ATTR_REG_VALUE8]);
+                        IWL_DEBUG_INFO(trans, "8b write val=0x%x\n", val8);
+                        iwl_write8(tst->trans, ofs, val8);
+                }
+                break;
+
+        default:
+                IWL_ERR(trans, "Unknown test register cmd ID\n");
+                return -ENOMSG;
+        }
+
+        return status;
+
+nla_put_failure:
+        kfree_skb(skb);
+        return -EMSGSIZE;
+}
+
+/*
+ * Handles the request to start FW tracing. Allocates of the trace buffer
+ * and sends a reply to user space with the address of the allocated buffer.
+ */
+static int iwl_test_trace_begin(struct iwl_test *tst, struct nlattr **tb)
+{
+        struct sk_buff *skb;
+        int status = 0;
+
+        if (tst->trace.enabled)
+                return -EBUSY;
+
+        if (!tb[IWL_TM_ATTR_TRACE_SIZE])
+                tst->trace.size = TRACE_BUFF_SIZE_DEF;
+        else
+                tst->trace.size =
+                        nla_get_u32(tb[IWL_TM_ATTR_TRACE_SIZE]);
+
+        if (!tst->trace.size)
+                return -EINVAL;
+
+        if (tst->trace.size < TRACE_BUFF_SIZE_MIN ||
+            tst->trace.size > TRACE_BUFF_SIZE_MAX)
+                return -EINVAL;
+
+        tst->trace.tsize = tst->trace.size + TRACE_BUFF_PADD;
+        tst->trace.cpu_addr = dma_alloc_coherent(tst->trans->dev,
+                                                 tst->trace.tsize,
+                                                 &tst->trace.dma_addr,
+                                                 GFP_KERNEL);
+        if (!tst->trace.cpu_addr)
+                return -ENOMEM;
+
+        tst->trace.enabled = true;
+        tst->trace.trace_addr = (u8 *)PTR_ALIGN(tst->trace.cpu_addr, 0x100);
+
+        memset(tst->trace.trace_addr, 0x03B, tst->trace.size);
+
+        skb = iwl_test_alloc_reply(tst, sizeof(tst->trace.dma_addr) + 20);
+        if (!skb) {
+                IWL_ERR(tst->trans, "Memory allocation fail\n");
+                iwl_test_trace_stop(tst);
+                return -ENOMEM;
+        }
+
+        if (nla_put(skb, IWL_TM_ATTR_TRACE_ADDR,
+                    sizeof(tst->trace.dma_addr),
+                    (u64 *)&tst->trace.dma_addr))
+                goto nla_put_failure;
+
+        status = iwl_test_reply(tst, skb);
+        if (status < 0)
+                IWL_ERR(tst->trans, "Error sending msg : %d\n", status);
+
+        tst->trace.nchunks = DIV_ROUND_UP(tst->trace.size,
+                                          DUMP_CHUNK_SIZE);
+
+        return status;
+
+nla_put_failure:
+        kfree_skb(skb);
+        if (nla_get_u32(tb[IWL_TM_ATTR_COMMAND]) ==
+            IWL_TM_CMD_APP2DEV_BEGIN_TRACE)
+                iwl_test_trace_stop(tst);
+        return -EMSGSIZE;
+}
+
+/*
+ * Handles indirect read from the periphery or the SRAM. The read is performed
+ * to a temporary buffer. The user space application should later issue a dump
+ */
+static int iwl_test_indirect_read(struct iwl_test *tst, u32 addr, u32 size)
+{
+        struct iwl_trans *trans = tst->trans;
+        unsigned long flags;
+        int i;
+
+        if (size & 0x3)
+                return -EINVAL;
+
+        tst->mem.size = size;
+        tst->mem.addr = kmalloc(tst->mem.size, GFP_KERNEL);
+        if (tst->mem.addr == NULL)
+                return -ENOMEM;
+
+        /* Hard-coded periphery absolute address */
+        if (IWL_ABS_PRPH_START <= addr &&
+            addr < IWL_ABS_PRPH_START + PRPH_END) {
+                        spin_lock_irqsave(&trans->reg_lock, flags);
+                        iwl_grab_nic_access(trans);
+                        iwl_write32(trans, HBUS_TARG_PRPH_RADDR,
+                                    addr | (3 << 24));
+                        for (i = 0; i < size; i += 4)
+                                *(u32 *)(tst->mem.addr + i) =
+                                        iwl_read32(trans, HBUS_TARG_PRPH_RDAT);
+                        iwl_release_nic_access(trans);
+                        spin_unlock_irqrestore(&trans->reg_lock, flags);
+        } else { /* target memory (SRAM) */
+                _iwl_read_targ_mem_dwords(trans, addr,
+                                          tst->mem.addr,
+                                          tst->mem.size / 4);
+        }
+
+        tst->mem.nchunks =
+                DIV_ROUND_UP(tst->mem.size, DUMP_CHUNK_SIZE);
+        tst->mem.in_read = true;
+        return 0;
+
+}
+
+/*
+ * Handles indirect write to the periphery or SRAM. The  is performed to a
+ * temporary buffer.
+ */
+static int iwl_test_indirect_write(struct iwl_test *tst, u32 addr,
+        u32 size, unsigned char *buf)
+{
+        struct iwl_trans *trans = tst->trans;
+        u32 val, i;
+        unsigned long flags;
+
+        if (IWL_ABS_PRPH_START <= addr &&
+            addr < IWL_ABS_PRPH_START + PRPH_END) {
+                        /* Periphery writes can be 1-3 bytes long, or DWORDs */
+                        if (size < 4) {
+                                memcpy(&val, buf, size);
+                                spin_lock_irqsave(&trans->reg_lock, flags);
+                                iwl_grab_nic_access(trans);
+                                iwl_write32(trans, HBUS_TARG_PRPH_WADDR,
+                                            (addr & 0x0000FFFF) |
+                                            ((size - 1) << 24));
+                                iwl_write32(trans, HBUS_TARG_PRPH_WDAT, val);
+                                iwl_release_nic_access(trans);
+                                /* needed after consecutive writes w/o read */
+                                mmiowb();
+                                spin_unlock_irqrestore(&trans->reg_lock, flags);
+                        } else {
+                                if (size % 4)
+                                        return -EINVAL;
+                                for (i = 0; i < size; i += 4)
+                                        iwl_write_prph(trans, addr+i,
+                                                       *(u32 *)(buf+i));
+                        }
+        } else if (iwl_test_valid_hw_addr(tst, addr)) {
+                _iwl_write_targ_mem_dwords(trans, addr, buf, size / 4);
+        } else {
+                return -EINVAL;
+        }
+        return 0;
+}
+
+/*
+ * Handles the user application commands for indirect read/write
+ * to/from the periphery or the SRAM.
+ */
+static int iwl_test_indirect_mem(struct iwl_test *tst, struct nlattr **tb)
+{
+        u32 addr, size, cmd;
+        unsigned char *buf;
+
+        /* Both read and write should be blocked, for atomicity */
+        if (tst->mem.in_read)
+                return -EBUSY;
+
+        cmd = nla_get_u32(tb[IWL_TM_ATTR_COMMAND]);
+        if (!tb[IWL_TM_ATTR_MEM_ADDR]) {
+                IWL_ERR(tst->trans, "Error finding memory offset address\n");
+                return -ENOMSG;
+        }
+        addr = nla_get_u32(tb[IWL_TM_ATTR_MEM_ADDR]);
+        if (!tb[IWL_TM_ATTR_BUFFER_SIZE]) {
+                IWL_ERR(tst->trans, "Error finding size for memory reading\n");
+                return -ENOMSG;
+        }
+        size = nla_get_u32(tb[IWL_TM_ATTR_BUFFER_SIZE]);
+
+        if (cmd == IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_READ) {
+                return iwl_test_indirect_read(tst, addr,  size);
+        } else {
+                if (!tb[IWL_TM_ATTR_BUFFER_DUMP])
+                        return -EINVAL;
+                buf = (unsigned char *)nla_data(tb[IWL_TM_ATTR_BUFFER_DUMP]);
+                return iwl_test_indirect_write(tst, addr, size, buf);
+        }
+}
+
+/*
+ * Enable notifications to user space
+ */
+static int iwl_test_notifications(struct iwl_test *tst,
+                                  struct nlattr **tb)
+{
+        tst->notify = nla_get_flag(tb[IWL_TM_ATTR_ENABLE_NOTIFICATION]);
+        return 0;
+}
+
+/*
+ * Handles the request to get the device id
+ */
+static int iwl_test_get_dev_id(struct iwl_test *tst, struct nlattr **tb)
+{
+        u32 devid = tst->trans->hw_id;
+        struct sk_buff *skb;
+        int status;
+
+        IWL_DEBUG_INFO(tst->trans, "hw version: 0x%x\n", devid);
+
+        skb = iwl_test_alloc_reply(tst, 20);
+        if (!skb) {
+                IWL_ERR(tst->trans, "Memory allocation fail\n");
+                return -ENOMEM;
+        }
+
+        if (nla_put_u32(skb, IWL_TM_ATTR_DEVICE_ID, devid))
+                goto nla_put_failure;
+        status = iwl_test_reply(tst, skb);
+        if (status < 0)
+                IWL_ERR(tst->trans, "Error sending msg : %d\n", status);
+
+        return 0;
+
+nla_put_failure:
+        kfree_skb(skb);
+        return -EMSGSIZE;
+}
+
+/*
+ * Handles the request to get the FW version
+ */
+static int iwl_test_get_fw_ver(struct iwl_test *tst, struct nlattr **tb)
+{
+        struct sk_buff *skb;
+        int status;
+        u32 ver = iwl_test_fw_ver(tst);
+
+        IWL_DEBUG_INFO(tst->trans, "uCode version raw: 0x%x\n", ver);
+
+        skb = iwl_test_alloc_reply(tst, 20);
+        if (!skb) {
+                IWL_ERR(tst->trans, "Memory allocation fail\n");
+                return -ENOMEM;
+        }
+
+        if (nla_put_u32(skb, IWL_TM_ATTR_FW_VERSION, ver))
+                goto nla_put_failure;
+
+        status = iwl_test_reply(tst, skb);
+        if (status < 0)
+                IWL_ERR(tst->trans, "Error sending msg : %d\n", status);
+
+        return 0;
+
+nla_put_failure:
+        kfree_skb(skb);
+        return -EMSGSIZE;
+}
+
+/*
+ * Parse the netlink message and validate that the IWL_TM_ATTR_CMD exists
+ */
+int iwl_test_parse(struct iwl_test *tst, struct nlattr **tb,
+                   void *data, int len)
+{
+        int result;
+
+        result = nla_parse(tb, IWL_TM_ATTR_MAX - 1, data, len,
+                        iwl_testmode_gnl_msg_policy);
+        if (result) {
+                IWL_ERR(tst->trans, "Fail parse gnl msg: %d\n", result);
+                return result;
+        }
+
+        /* IWL_TM_ATTR_COMMAND is absolutely mandatory */
+        if (!tb[IWL_TM_ATTR_COMMAND]) {
+                IWL_ERR(tst->trans, "Missing testmode command type\n");
+                return -ENOMSG;
+        }
+        return 0;
+}
+EXPORT_SYMBOL_GPL(iwl_test_parse);
+
+/*
+ * Handle test commands.
+ * Returns 1 for unknown commands (not handled by the test object); negative
+ * value in case of error.
+ */
+int iwl_test_handle_cmd(struct iwl_test *tst, struct nlattr **tb)
+{
+        int result;
+
+        switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
+        case IWL_TM_CMD_APP2DEV_UCODE:
+                IWL_DEBUG_INFO(tst->trans, "test cmd to uCode\n");
+                result = iwl_test_fw_cmd(tst, tb);
+                break;
+
+        case IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32:
+        case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32:
+        case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8:
+                IWL_DEBUG_INFO(tst->trans, "test cmd to register\n");
+                result = iwl_test_reg(tst, tb);
+                break;
+
+        case IWL_TM_CMD_APP2DEV_BEGIN_TRACE:
+                IWL_DEBUG_INFO(tst->trans, "test uCode trace cmd to driver\n");
+                result = iwl_test_trace_begin(tst, tb);
+                break;
+
+        case IWL_TM_CMD_APP2DEV_END_TRACE:
+                iwl_test_trace_stop(tst);
+                result = 0;
+                break;
+
+        case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_READ:
+        case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_WRITE:
+                IWL_DEBUG_INFO(tst->trans, "test indirect memory cmd\n");
+                result = iwl_test_indirect_mem(tst, tb);
+                break;
+
+        case IWL_TM_CMD_APP2DEV_NOTIFICATIONS:
+                IWL_DEBUG_INFO(tst->trans, "test notifications cmd\n");
+                result = iwl_test_notifications(tst, tb);
+                break;
+
+        case IWL_TM_CMD_APP2DEV_GET_FW_VERSION:
+                IWL_DEBUG_INFO(tst->trans, "test get FW ver cmd\n");
+                result = iwl_test_get_fw_ver(tst, tb);
+                break;
+
+        case IWL_TM_CMD_APP2DEV_GET_DEVICE_ID:
+                IWL_DEBUG_INFO(tst->trans, "test Get device ID cmd\n");
+                result = iwl_test_get_dev_id(tst, tb);
+                break;
+
+        default:
+                IWL_DEBUG_INFO(tst->trans, "Unknown test command\n");
+                result = 1;
+                break;
+        }
+        return result;
+}
+EXPORT_SYMBOL_GPL(iwl_test_handle_cmd);
+
+static int iwl_test_trace_dump(struct iwl_test *tst, struct sk_buff *skb,
+                               struct netlink_callback *cb)
+{
+        int idx, length;
+
+        if (!tst->trace.enabled || !tst->trace.trace_addr)
+                return -EFAULT;
+
+        idx = cb->args[4];
+        if (idx >= tst->trace.nchunks)
+                return -ENOENT;
+
+        length = DUMP_CHUNK_SIZE;
+        if (((idx + 1) == tst->trace.nchunks) &&
+            (tst->trace.size % DUMP_CHUNK_SIZE))
+                length = tst->trace.size %
+                        DUMP_CHUNK_SIZE;
+
+        if (nla_put(skb, IWL_TM_ATTR_TRACE_DUMP, length,
+                    tst->trace.trace_addr + (DUMP_CHUNK_SIZE * idx)))
+                goto nla_put_failure;
+
+        cb->args[4] = ++idx;
+        return 0;
+
+ nla_put_failure:
+        return -ENOBUFS;
+}
+
+static int iwl_test_buffer_dump(struct iwl_test *tst, struct sk_buff *skb,
+                                struct netlink_callback *cb)
+{
+        int idx, length;
+
+        if (!tst->mem.in_read)
+                return -EFAULT;
+
+        idx = cb->args[4];
+        if (idx >= tst->mem.nchunks) {
+                iwl_test_mem_stop(tst);
+                return -ENOENT;
+        }
+
+        length = DUMP_CHUNK_SIZE;
+        if (((idx + 1) == tst->mem.nchunks) &&
+            (tst->mem.size % DUMP_CHUNK_SIZE))
+                length = tst->mem.size % DUMP_CHUNK_SIZE;
+
+        if (nla_put(skb, IWL_TM_ATTR_BUFFER_DUMP, length,
+                    tst->mem.addr + (DUMP_CHUNK_SIZE * idx)))
+                goto nla_put_failure;
+
+        cb->args[4] = ++idx;
+        return 0;
+
+ nla_put_failure:
+        return -ENOBUFS;
+}
+
+/*
+ * Handle dump commands.
+ * Returns 1 for unknown commands (not handled by the test object); negative
+ * value in case of error.
+ */
+int iwl_test_dump(struct iwl_test *tst, u32 cmd, struct sk_buff *skb,
+                  struct netlink_callback *cb)
+{
+        int result;
+
+        switch (cmd) {
+        case IWL_TM_CMD_APP2DEV_READ_TRACE:
+                IWL_DEBUG_INFO(tst->trans, "uCode trace cmd\n");
+                result = iwl_test_trace_dump(tst, skb, cb);
+                break;
+
+        case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_DUMP:
+                IWL_DEBUG_INFO(tst->trans, "testmode sram dump cmd\n");
+                result = iwl_test_buffer_dump(tst, skb, cb);
+                break;
+
+        default:
+                result = 1;
+                break;
+        }
+        return result;
+}
+EXPORT_SYMBOL_GPL(iwl_test_dump);
+
+/*
+ * Multicast a spontaneous messages from the device to the user space.
+ */
+static void iwl_test_send_rx(struct iwl_test *tst,
+                             struct iwl_rx_cmd_buffer *rxb)
+{
+        struct sk_buff *skb;
+        struct iwl_rx_packet *data;
+        int length;
+
+        data = rxb_addr(rxb);
+        length = le32_to_cpu(data->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
+
+        /* the length doesn't include len_n_flags field, so add it manually */
+        length += sizeof(__le32);
+
+        skb = iwl_test_alloc_event(tst, length + 20);
+        if (skb == NULL) {
+                IWL_ERR(tst->trans, "Out of memory for message to user\n");
+                return;
+        }
+
+        if (nla_put_u32(skb, IWL_TM_ATTR_COMMAND,
+                        IWL_TM_CMD_DEV2APP_UCODE_RX_PKT) ||
+            nla_put(skb, IWL_TM_ATTR_UCODE_RX_PKT, length, data))
+                goto nla_put_failure;
+
+        iwl_test_event(tst, skb);
+        return;
+
+nla_put_failure:
+        kfree_skb(skb);
+        IWL_ERR(tst->trans, "Ouch, overran buffer, check allocation!\n");
+}
+
+/*
+ * Called whenever a Rx frames is recevied from the device. If notifications to
+ * the user space are requested, sends the frames to the user.
+ */
+void iwl_test_rx(struct iwl_test *tst, struct iwl_rx_cmd_buffer *rxb)
+{
+        if (tst->notify)
+                iwl_test_send_rx(tst, rxb);
+}
+EXPORT_SYMBOL_GPL(iwl_test_rx);
diff --git a/drivers/net/wireless/iwlwifi/iwl-test.h b/drivers/net/wireless/iwlwifi/iwl-test.h
new file mode 100644
index 000000000000..e13ffa8acc02
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-test.h
@@ -0,0 +1,161 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2010 - 2012 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2010 - 2012 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef __IWL_TEST_H__
+#define __IWL_TEST_H__
+
+#include <linux/types.h>
+#include "iwl-trans.h"
+
+struct iwl_test_trace {
+        u32 size;
+        u32 tsize;
+        u32 nchunks;
+        u8 *cpu_addr;
+        u8 *trace_addr;
+        dma_addr_t dma_addr;
+        bool enabled;
+};
+
+struct iwl_test_mem {
+        u32 size;
+        u32 nchunks;
+        u8 *addr;
+        bool in_read;
+};
+
+/*
+ * struct iwl_test_ops: callback to the op mode
+ *
+ * The structure defines the callbacks that the op_mode should handle,
+ * inorder to handle logic that is out of the scope of iwl_test. The
+ * op_mode must set all the callbacks.
+
+ * @send_cmd: handler that is used by the test object to request the
+ *  op_mode to send a command to the fw.
+ *
+ * @valid_hw_addr: handler that is used by the test object to request the
+ *  op_mode to check if the given address is a valid address.
+ *
+ * @get_fw_ver: handler used to get the FW version.
+ *
+ * @alloc_reply: handler used by the test object to request the op_mode
+ *  to allocate an skb for sending a reply to the user, and initialize
+ *  the skb. It is assumed that the test object only fills the required
+ *  attributes.
+ *
+ * @reply: handler used by the test object to request the op_mode to reply
+ *  to a request. The skb is an skb previously allocated by the the
+ *  alloc_reply callback.
+ I
+ * @alloc_event: handler used by the test object to request the op_mode
+ *  to allocate an skb for sending an event, and initialize
+ *  the skb. It is assumed that the test object only fills the required
+ *  attributes.
+ *
+ * @reply: handler used by the test object to request the op_mode to send
+ *  an event. The skb is an skb previously allocated by the the
+ *  alloc_event callback.
+ */
+struct iwl_test_ops {
+        int (*send_cmd)(struct iwl_op_mode *op_modes,
+                        struct iwl_host_cmd *cmd);
+        bool (*valid_hw_addr)(u32 addr);
+        u32 (*get_fw_ver)(struct iwl_op_mode *op_mode);
+
+        struct sk_buff *(*alloc_reply)(struct iwl_op_mode *op_mode, int len);
+        int (*reply)(struct iwl_op_mode *op_mode, struct sk_buff *skb);
+        struct sk_buff* (*alloc_event)(struct iwl_op_mode *op_mode, int len);
+        void (*event)(struct iwl_op_mode *op_mode, struct sk_buff *skb);
+};
+
+struct iwl_test {
+        struct iwl_trans *trans;
+        struct iwl_test_ops *ops;
+        struct iwl_test_trace trace;
+        struct iwl_test_mem mem;
+        bool notify;
+};
+
+void iwl_test_init(struct iwl_test *tst, struct iwl_trans *trans,
+                   struct iwl_test_ops *ops);
+
+void iwl_test_free(struct iwl_test *tst);
+
+int iwl_test_parse(struct iwl_test *tst, struct nlattr **tb,
+                   void *data, int len);
+
+int iwl_test_handle_cmd(struct iwl_test *tst, struct nlattr **tb);
+
+int iwl_test_dump(struct iwl_test *tst, u32 cmd, struct sk_buff *skb,
+                  struct netlink_callback *cb);
+
+void iwl_test_rx(struct iwl_test *tst, struct iwl_rx_cmd_buffer *rxb);
+
+static inline void iwl_test_enable_notifications(struct iwl_test *tst,
+                                                 bool enable)
+{
+        tst->notify = enable;
+}
+
+#endif
diff --git a/drivers/net/wireless/iwlwifi/iwl-testmode.c b/drivers/net/wireless/iwlwifi/iwl-testmode.c
deleted file mode 100644
index 060aac3e22f1..000000000000
--- a/drivers/net/wireless/iwlwifi/iwl-testmode.c
+++ /dev/null
@@ -1,1114 +0,0 @@
-/******************************************************************************
- *
- * This file is provided under a dual BSD/GPLv2 license.  When using or
- * redistributing this file, you may do so under either license.
- *
- * GPL LICENSE SUMMARY
- *
- * Copyright(c) 2010 - 2012 Intel Corporation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of version 2 of the GNU General Public License as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
- * USA
- *
- * The full GNU General Public License is included in this distribution
- * in the file called LICENSE.GPL.
- *
- * Contact Information:
- *  Intel Linux Wireless <ilw@linux.intel.com>
- * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
- *
- * BSD LICENSE
- *
- * Copyright(c) 2010 - 2012 Intel Corporation. All rights reserved.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *  * Neither the name Intel Corporation nor the names of its
- *    contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *****************************************************************************/
-#include <linux/init.h>
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/dma-mapping.h>
-#include <net/net_namespace.h>
-#include <linux/netdevice.h>
-#include <net/cfg80211.h>
-#include <net/mac80211.h>
-#include <net/netlink.h>
-
-#include "iwl-dev.h"
-#include "iwl-debug.h"
-#include "iwl-io.h"
-#include "iwl-agn.h"
-#include "iwl-testmode.h"
-#include "iwl-trans.h"
-#include "iwl-fh.h"
-#include "iwl-prph.h"
-
-
-/* Periphery registers absolute lower bound. This is used in order to
- * differentiate registery access through HBUS_TARG_PRPH_* and
- * HBUS_TARG_MEM_* accesses.
- */
-#define IWL_TM_ABS_PRPH_START (0xA00000)
-
-/* The TLVs used in the gnl message policy between the kernel module and
- * user space application. iwl_testmode_gnl_msg_policy is to be carried
- * through the NL80211_CMD_TESTMODE channel regulated by nl80211.
- * See iwl-testmode.h
- */
-static
-struct nla_policy iwl_testmode_gnl_msg_policy[IWL_TM_ATTR_MAX] = {
-        [IWL_TM_ATTR_COMMAND] = { .type = NLA_U32, },
-
-        [IWL_TM_ATTR_UCODE_CMD_ID] = { .type = NLA_U8, },
-        [IWL_TM_ATTR_UCODE_CMD_DATA] = { .type = NLA_UNSPEC, },
-
-        [IWL_TM_ATTR_REG_OFFSET] = { .type = NLA_U32, },
-        [IWL_TM_ATTR_REG_VALUE8] = { .type = NLA_U8, },
-        [IWL_TM_ATTR_REG_VALUE32] = { .type = NLA_U32, },
-
-        [IWL_TM_ATTR_SYNC_RSP] = { .type = NLA_UNSPEC, },
-        [IWL_TM_ATTR_UCODE_RX_PKT] = { .type = NLA_UNSPEC, },
-
-        [IWL_TM_ATTR_EEPROM] = { .type = NLA_UNSPEC, },
-
-        [IWL_TM_ATTR_TRACE_ADDR] = { .type = NLA_UNSPEC, },
-        [IWL_TM_ATTR_TRACE_DUMP] = { .type = NLA_UNSPEC, },
-        [IWL_TM_ATTR_TRACE_SIZE] = { .type = NLA_U32, },
-
-        [IWL_TM_ATTR_FIXRATE] = { .type = NLA_U32, },
-
-        [IWL_TM_ATTR_UCODE_OWNER] = { .type = NLA_U8, },
-
-        [IWL_TM_ATTR_MEM_ADDR] = { .type = NLA_U32, },
-        [IWL_TM_ATTR_BUFFER_SIZE] = { .type = NLA_U32, },
-        [IWL_TM_ATTR_BUFFER_DUMP] = { .type = NLA_UNSPEC, },
-
-        [IWL_TM_ATTR_FW_VERSION] = { .type = NLA_U32, },
-        [IWL_TM_ATTR_DEVICE_ID] = { .type = NLA_U32, },
-        [IWL_TM_ATTR_FW_TYPE] = { .type = NLA_U32, },
-        [IWL_TM_ATTR_FW_INST_SIZE] = { .type = NLA_U32, },
-        [IWL_TM_ATTR_FW_DATA_SIZE] = { .type = NLA_U32, },
-
-        [IWL_TM_ATTR_ENABLE_NOTIFICATION] = {.type = NLA_FLAG, },
-};
-
-/*
- * See the struct iwl_rx_packet in iwl-commands.h for the format of the
- * received events from the device
- */
-static inline int get_event_length(struct iwl_rx_cmd_buffer *rxb)
-{
-        struct iwl_rx_packet *pkt = rxb_addr(rxb);
-        if (pkt)
-                return le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
-        else
-                return 0;
-}
-
-
-/*
- * This function multicasts the spontaneous messages from the device to the
- * user space. It is invoked whenever there is a received messages
- * from the device. This function is called within the ISR of the rx handlers
- * in iwlagn driver.
- *
- * The parsing of the message content is left to the user space application,
- * The message content is treated as unattacked raw data and is encapsulated
- * with IWL_TM_ATTR_UCODE_RX_PKT multicasting to the user space.
- *
- * @priv: the instance of iwlwifi device
- * @rxb: pointer to rx data content received by the ISR
- *
- * See the message policies and TLVs in iwl_testmode_gnl_msg_policy[].
- * For the messages multicasting to the user application, the mandatory
- * TLV fields are :
- *      IWL_TM_ATTR_COMMAND must be IWL_TM_CMD_DEV2APP_UCODE_RX_PKT
- *      IWL_TM_ATTR_UCODE_RX_PKT for carrying the message content
- */
-
-static void iwl_testmode_ucode_rx_pkt(struct iwl_priv *priv,
-                                      struct iwl_rx_cmd_buffer *rxb)
-{
-        struct ieee80211_hw *hw = priv->hw;
-        struct sk_buff *skb;
-        void *data;
-        int length;
-
-        data = (void *)rxb_addr(rxb);
-        length = get_event_length(rxb);
-
-        if (!data || length == 0)
-                return;
-
-        skb = cfg80211_testmode_alloc_event_skb(hw->wiphy, 20 + length,
-                                                                GFP_ATOMIC);
-        if (skb == NULL) {
-                IWL_ERR(priv,
-                         "Run out of memory for messages to user space ?\n");
-                return;
-        }
-        if (nla_put_u32(skb, IWL_TM_ATTR_COMMAND, IWL_TM_CMD_DEV2APP_UCODE_RX_PKT) ||
-            /* the length doesn't include len_n_flags field, so add it manually */
-            nla_put(skb, IWL_TM_ATTR_UCODE_RX_PKT, length + sizeof(__le32), data))
-                goto nla_put_failure;
-        cfg80211_testmode_event(skb, GFP_ATOMIC);
-        return;
-
-nla_put_failure:
-        kfree_skb(skb);
-        IWL_ERR(priv, "Ouch, overran buffer, check allocation!\n");
-}
-
-void iwl_testmode_init(struct iwl_priv *priv)
-{
-        priv->pre_rx_handler = NULL;
-        priv->testmode_trace.trace_enabled = false;
-        priv->testmode_mem.read_in_progress = false;
-}
-
-static void iwl_mem_cleanup(struct iwl_priv *priv)
-{
-        if (priv->testmode_mem.read_in_progress) {
-                kfree(priv->testmode_mem.buff_addr);
-                priv->testmode_mem.buff_addr = NULL;
-                priv->testmode_mem.buff_size = 0;
-                priv->testmode_mem.num_chunks = 0;
-                priv->testmode_mem.read_in_progress = false;
-        }
-}
-
-static void iwl_trace_cleanup(struct iwl_priv *priv)
-{
-        if (priv->testmode_trace.trace_enabled) {
-                if (priv->testmode_trace.cpu_addr &&
-                    priv->testmode_trace.dma_addr)
-                        dma_free_coherent(priv->trans->dev,
-                                        priv->testmode_trace.total_size,
-                                        priv->testmode_trace.cpu_addr,
-                                        priv->testmode_trace.dma_addr);
-                priv->testmode_trace.trace_enabled = false;
-                priv->testmode_trace.cpu_addr = NULL;
-                priv->testmode_trace.trace_addr = NULL;
-                priv->testmode_trace.dma_addr = 0;
-                priv->testmode_trace.buff_size = 0;
-                priv->testmode_trace.total_size = 0;
-        }
-}
-
-
-void iwl_testmode_cleanup(struct iwl_priv *priv)
-{
-        iwl_trace_cleanup(priv);
-        iwl_mem_cleanup(priv);
-}
-
-
-/*
- * This function handles the user application commands to the ucode.
- *
- * It retrieves the mandatory fields IWL_TM_ATTR_UCODE_CMD_ID and
- * IWL_TM_ATTR_UCODE_CMD_DATA and calls to the handler to send the
- * host command to the ucode.
- *
- * If any mandatory field is missing, -ENOMSG is replied to the user space
- * application; otherwise, waits for the host command to be sent and checks
- * the return code. In case or error, it is returned, otherwise a reply is
- * allocated and the reply RX packet
- * is returned.
- *
- * @hw: ieee80211_hw object that represents the device
- * @tb: gnl message fields from the user space
- */
-static int iwl_testmode_ucode(struct ieee80211_hw *hw, struct nlattr **tb)
-{
-        struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
-        struct iwl_host_cmd cmd;
-        struct iwl_rx_packet *pkt;
-        struct sk_buff *skb;
-        void *reply_buf;
-        u32 reply_len;
-        int ret;
-        bool cmd_want_skb;
-
-        memset(&cmd, 0, sizeof(struct iwl_host_cmd));
-
-        if (!tb[IWL_TM_ATTR_UCODE_CMD_ID] ||
-            !tb[IWL_TM_ATTR_UCODE_CMD_DATA]) {
-                IWL_ERR(priv, "Missing ucode command mandatory fields\n");
-                return -ENOMSG;
-        }
-
-        cmd.flags = CMD_ON_DEMAND | CMD_SYNC;
-        cmd_want_skb = nla_get_flag(tb[IWL_TM_ATTR_UCODE_CMD_SKB]);
-        if (cmd_want_skb)
-                cmd.flags |= CMD_WANT_SKB;
-
-        cmd.id = nla_get_u8(tb[IWL_TM_ATTR_UCODE_CMD_ID]);
-        cmd.data[0] = nla_data(tb[IWL_TM_ATTR_UCODE_CMD_DATA]);
-        cmd.len[0] = nla_len(tb[IWL_TM_ATTR_UCODE_CMD_DATA]);
-        cmd.dataflags[0] = IWL_HCMD_DFL_NOCOPY;
-        IWL_DEBUG_INFO(priv, "testmode ucode command ID 0x%x, flags 0x%x,"
-                                " len %d\n", cmd.id, cmd.flags, cmd.len[0]);
-
-        ret = iwl_dvm_send_cmd(priv, &cmd);
-        if (ret) {
-                IWL_ERR(priv, "Failed to send hcmd\n");
-                return ret;
-        }
-        if (!cmd_want_skb)
-                return ret;
-
-        /* Handling return of SKB to the user */
-        pkt = cmd.resp_pkt;
-        if (!pkt) {
-                IWL_ERR(priv, "HCMD received a null response packet\n");
-                return ret;
-        }
-
-        reply_len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
-        skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, reply_len + 20);
-        reply_buf = kmalloc(reply_len, GFP_KERNEL);
-        if (!skb || !reply_buf) {
-                kfree_skb(skb);
-                kfree(reply_buf);
-                return -ENOMEM;
-        }
-
-        /* The reply is in a page, that we cannot send to user space. */
-        memcpy(reply_buf, &(pkt->hdr), reply_len);
-        iwl_free_resp(&cmd);
-
-        if (nla_put_u32(skb, IWL_TM_ATTR_COMMAND, IWL_TM_CMD_DEV2APP_UCODE_RX_PKT) ||
-            nla_put(skb, IWL_TM_ATTR_UCODE_RX_PKT, reply_len, reply_buf))
-                goto nla_put_failure;
-        return cfg80211_testmode_reply(skb);
-
-nla_put_failure:
-        IWL_DEBUG_INFO(priv, "Failed creating NL attributes\n");
-        return -ENOMSG;
-}
-
-
-/*
- * This function handles the user application commands for register access.
- *
- * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
- * handlers respectively.
- *
- * If it's an unknown commdn ID, -ENOSYS is returned; or -ENOMSG if the
- * mandatory fields(IWL_TM_ATTR_REG_OFFSET,IWL_TM_ATTR_REG_VALUE32,
- * IWL_TM_ATTR_REG_VALUE8) are missing; Otherwise 0 is replied indicating
- * the success of the command execution.
- *
- * If IWL_TM_ATTR_COMMAND is IWL_TM_CMD_APP2DEV_REG_READ32, the register read
- * value is returned with IWL_TM_ATTR_REG_VALUE32.
- *
- * @hw: ieee80211_hw object that represents the device
- * @tb: gnl message fields from the user space
- */
-static int iwl_testmode_reg(struct ieee80211_hw *hw, struct nlattr **tb)
-{
-        struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
-        u32 ofs, val32, cmd;
-        u8 val8;
-        struct sk_buff *skb;
-        int status = 0;
-
-        if (!tb[IWL_TM_ATTR_REG_OFFSET]) {
-                IWL_ERR(priv, "Missing register offset\n");
-                return -ENOMSG;
-        }
-        ofs = nla_get_u32(tb[IWL_TM_ATTR_REG_OFFSET]);
-        IWL_INFO(priv, "testmode register access command offset 0x%x\n", ofs);
-
-        /* Allow access only to FH/CSR/HBUS in direct mode.
-        Since we don't have the upper bounds for the CSR and HBUS segments,
-        we will use only the upper bound of FH for sanity check. */
-        cmd = nla_get_u32(tb[IWL_TM_ATTR_COMMAND]);
-        if ((cmd == IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32 ||
-                cmd == IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32 ||
-                cmd == IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8) &&
-                (ofs >= FH_MEM_UPPER_BOUND)) {
-                IWL_ERR(priv, "offset out of segment (0x0 - 0x%x)\n",
-                        FH_MEM_UPPER_BOUND);
-                return -EINVAL;
-        }
-
-        switch (cmd) {
-        case IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32:
-                val32 = iwl_read_direct32(priv->trans, ofs);
-                IWL_INFO(priv, "32bit value to read 0x%x\n", val32);
-
-                skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
-                if (!skb) {
-                        IWL_ERR(priv, "Memory allocation fail\n");
-                        return -ENOMEM;
-                }
-                if (nla_put_u32(skb, IWL_TM_ATTR_REG_VALUE32, val32))
-                        goto nla_put_failure;
-                status = cfg80211_testmode_reply(skb);
-                if (status < 0)
-                        IWL_ERR(priv, "Error sending msg : %d\n", status);
-                break;
-        case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32:
-                if (!tb[IWL_TM_ATTR_REG_VALUE32]) {
-                        IWL_ERR(priv, "Missing value to write\n");
-                        return -ENOMSG;
-                } else {
-                        val32 = nla_get_u32(tb[IWL_TM_ATTR_REG_VALUE32]);
-                        IWL_INFO(priv, "32bit value to write 0x%x\n", val32);
-                        iwl_write_direct32(priv->trans, ofs, val32);
-                }
-                break;
-        case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8:
-                if (!tb[IWL_TM_ATTR_REG_VALUE8]) {
-                        IWL_ERR(priv, "Missing value to write\n");
-                        return -ENOMSG;
-                } else {
-                        val8 = nla_get_u8(tb[IWL_TM_ATTR_REG_VALUE8]);
-                        IWL_INFO(priv, "8bit value to write 0x%x\n", val8);
-                        iwl_write8(priv->trans, ofs, val8);
-                }
-                break;
-        default:
-                IWL_ERR(priv, "Unknown testmode register command ID\n");
-                return -ENOSYS;
-        }
-
-        return status;
-
-nla_put_failure:
-        kfree_skb(skb);
-        return -EMSGSIZE;
-}
-
-
-static int iwl_testmode_cfg_init_calib(struct iwl_priv *priv)
-{
-        struct iwl_notification_wait calib_wait;
-        static const u8 calib_complete[] = {
-                CALIBRATION_COMPLETE_NOTIFICATION
-        };
-        int ret;
-
-        iwl_init_notification_wait(&priv->notif_wait, &calib_wait,
-                                   calib_complete, ARRAY_SIZE(calib_complete),
-                                   NULL, NULL);
-        ret = iwl_init_alive_start(priv);
-        if (ret) {
-                IWL_ERR(priv, "Fail init calibration: %d\n", ret);
-                goto cfg_init_calib_error;
-        }
-
-        ret = iwl_wait_notification(&priv->notif_wait, &calib_wait, 2 * HZ);
-        if (ret)
-                IWL_ERR(priv, "Error detecting"
-                        " CALIBRATION_COMPLETE_NOTIFICATION: %d\n", ret);
-        return ret;
-
-cfg_init_calib_error:
-        iwl_remove_notification(&priv->notif_wait, &calib_wait);
-        return ret;
-}
-
-/*
- * This function handles the user application commands for driver.
- *
- * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
- * handlers respectively.
- *
- * If it's an unknown commdn ID, -ENOSYS is replied; otherwise, the returned
- * value of the actual command execution is replied to the user application.
- *
- * If there's any message responding to the user space, IWL_TM_ATTR_SYNC_RSP
- * is used for carry the message while IWL_TM_ATTR_COMMAND must set to
- * IWL_TM_CMD_DEV2APP_SYNC_RSP.
- *
- * @hw: ieee80211_hw object that represents the device
- * @tb: gnl message fields from the user space
- */
-static int iwl_testmode_driver(struct ieee80211_hw *hw, struct nlattr **tb)
-{
-        struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
-        struct iwl_trans *trans = priv->trans;
-        struct sk_buff *skb;
-        unsigned char *rsp_data_ptr = NULL;
-        int status = 0, rsp_data_len = 0;
-        u32 devid, inst_size = 0, data_size = 0;
-        const struct fw_img *img;
-
-        switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
-        case IWL_TM_CMD_APP2DEV_GET_DEVICENAME:
-                rsp_data_ptr = (unsigned char *)priv->cfg->name;
-                rsp_data_len = strlen(priv->cfg->name);
-                skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
-                                                        rsp_data_len + 20);
-                if (!skb) {
-                        IWL_ERR(priv, "Memory allocation fail\n");
-                        return -ENOMEM;
-                }
-                if (nla_put_u32(skb, IWL_TM_ATTR_COMMAND,
-                                IWL_TM_CMD_DEV2APP_SYNC_RSP) ||
-                    nla_put(skb, IWL_TM_ATTR_SYNC_RSP,
-                            rsp_data_len, rsp_data_ptr))
-                        goto nla_put_failure;
-                status = cfg80211_testmode_reply(skb);
-                if (status < 0)
-                        IWL_ERR(priv, "Error sending msg : %d\n", status);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_LOAD_INIT_FW:
-                status = iwl_load_ucode_wait_alive(priv, IWL_UCODE_INIT);
-                if (status)
-                        IWL_ERR(priv, "Error loading init ucode: %d\n", status);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_CFG_INIT_CALIB:
-                iwl_testmode_cfg_init_calib(priv);
-                priv->ucode_loaded = false;
-                iwl_trans_stop_device(trans);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW:
-                status = iwl_load_ucode_wait_alive(priv, IWL_UCODE_REGULAR);
-                if (status) {
-                        IWL_ERR(priv,
-                                "Error loading runtime ucode: %d\n", status);
-                        break;
-                }
-                status = iwl_alive_start(priv);
-                if (status)
-                        IWL_ERR(priv,
-                                "Error starting the device: %d\n", status);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW:
-                iwl_scan_cancel_timeout(priv, 200);
-                priv->ucode_loaded = false;
-                iwl_trans_stop_device(trans);
-                status = iwl_load_ucode_wait_alive(priv, IWL_UCODE_WOWLAN);
-                if (status) {
-                        IWL_ERR(priv,
-                                "Error loading WOWLAN ucode: %d\n", status);
-                        break;
-                }
-                status = iwl_alive_start(priv);
-                if (status)
-                        IWL_ERR(priv,
-                                "Error starting the device: %d\n", status);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_GET_EEPROM:
-                if (priv->eeprom) {
-                        skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
-                                priv->cfg->base_params->eeprom_size + 20);
-                        if (!skb) {
-                                IWL_ERR(priv, "Memory allocation fail\n");
-                                return -ENOMEM;
-                        }
-                        if (nla_put_u32(skb, IWL_TM_ATTR_COMMAND,
-                                        IWL_TM_CMD_DEV2APP_EEPROM_RSP) ||
-                            nla_put(skb, IWL_TM_ATTR_EEPROM,
-                                    priv->cfg->base_params->eeprom_size,
-                                    priv->eeprom))
-                                goto nla_put_failure;
-                        status = cfg80211_testmode_reply(skb);
-                        if (status < 0)
-                                IWL_ERR(priv, "Error sending msg : %d\n",
-                                        status);
-                } else
-                        return -EFAULT;
-                break;
-
-        case IWL_TM_CMD_APP2DEV_FIXRATE_REQ:
-                if (!tb[IWL_TM_ATTR_FIXRATE]) {
-                        IWL_ERR(priv, "Missing fixrate setting\n");
-                        return -ENOMSG;
-                }
-                priv->tm_fixed_rate = nla_get_u32(tb[IWL_TM_ATTR_FIXRATE]);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_GET_FW_VERSION:
-                IWL_INFO(priv, "uCode version raw: 0x%x\n",
-                         priv->fw->ucode_ver);
-
-                skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
-                if (!skb) {
-                        IWL_ERR(priv, "Memory allocation fail\n");
-                        return -ENOMEM;
-                }
-                if (nla_put_u32(skb, IWL_TM_ATTR_FW_VERSION,
-                                priv->fw->ucode_ver))
-                        goto nla_put_failure;
-                status = cfg80211_testmode_reply(skb);
-                if (status < 0)
-                        IWL_ERR(priv, "Error sending msg : %d\n", status);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_GET_DEVICE_ID:
-                devid = priv->trans->hw_id;
-                IWL_INFO(priv, "hw version: 0x%x\n", devid);
-
-                skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20);
-                if (!skb) {
-                        IWL_ERR(priv, "Memory allocation fail\n");
-                        return -ENOMEM;
-                }
-                if (nla_put_u32(skb, IWL_TM_ATTR_DEVICE_ID, devid))
-                        goto nla_put_failure;
-                status = cfg80211_testmode_reply(skb);
-                if (status < 0)
-                        IWL_ERR(priv, "Error sending msg : %d\n", status);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_GET_FW_INFO:
-                skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy, 20 + 8);
-                if (!skb) {
-                        IWL_ERR(priv, "Memory allocation fail\n");
-                        return -ENOMEM;
-                }
-                if (!priv->ucode_loaded) {
-                        IWL_ERR(priv, "No uCode has not been loaded\n");
-                        return -EINVAL;
-                } else {
-                        img = &priv->fw->img[priv->cur_ucode];
-                        inst_size = img->sec[IWL_UCODE_SECTION_INST].len;
-                        data_size = img->sec[IWL_UCODE_SECTION_DATA].len;
-                }
-                if (nla_put_u32(skb, IWL_TM_ATTR_FW_TYPE, priv->cur_ucode) ||
-                    nla_put_u32(skb, IWL_TM_ATTR_FW_INST_SIZE, inst_size) ||
-                    nla_put_u32(skb, IWL_TM_ATTR_FW_DATA_SIZE, data_size))
-                        goto nla_put_failure;
-                status = cfg80211_testmode_reply(skb);
-                if (status < 0)
-                        IWL_ERR(priv, "Error sending msg : %d\n", status);
-                break;
-
-        default:
-                IWL_ERR(priv, "Unknown testmode driver command ID\n");
-                return -ENOSYS;
-        }
-        return status;
-
-nla_put_failure:
-        kfree_skb(skb);
-        return -EMSGSIZE;
-}
-
-
-/*
- * This function handles the user application commands for uCode trace
- *
- * It retrieves command ID carried with IWL_TM_ATTR_COMMAND and calls to the
- * handlers respectively.
- *
- * If it's an unknown commdn ID, -ENOSYS is replied; otherwise, the returned
- * value of the actual command execution is replied to the user application.
- *
- * @hw: ieee80211_hw object that represents the device
- * @tb: gnl message fields from the user space
- */
-static int iwl_testmode_trace(struct ieee80211_hw *hw, struct nlattr **tb)
-{
-        struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
-        struct sk_buff *skb;
-        int status = 0;
-        struct device *dev = priv->trans->dev;
-
-        switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
-        case IWL_TM_CMD_APP2DEV_BEGIN_TRACE:
-                if (priv->testmode_trace.trace_enabled)
-                        return -EBUSY;
-
-                if (!tb[IWL_TM_ATTR_TRACE_SIZE])
-                        priv->testmode_trace.buff_size = TRACE_BUFF_SIZE_DEF;
-                else
-                        priv->testmode_trace.buff_size =
-                                nla_get_u32(tb[IWL_TM_ATTR_TRACE_SIZE]);
-                if (!priv->testmode_trace.buff_size)
-                        return -EINVAL;
-                if (priv->testmode_trace.buff_size < TRACE_BUFF_SIZE_MIN ||
-                    priv->testmode_trace.buff_size > TRACE_BUFF_SIZE_MAX)
-                        return -EINVAL;
-
-                priv->testmode_trace.total_size =
-                        priv->testmode_trace.buff_size + TRACE_BUFF_PADD;
-                priv->testmode_trace.cpu_addr =
-                        dma_alloc_coherent(dev,
-                                           priv->testmode_trace.total_size,
-                                           &priv->testmode_trace.dma_addr,
-                                           GFP_KERNEL);
-                if (!priv->testmode_trace.cpu_addr)
-                        return -ENOMEM;
-                priv->testmode_trace.trace_enabled = true;
-                priv->testmode_trace.trace_addr = (u8 *)PTR_ALIGN(
-                        priv->testmode_trace.cpu_addr, 0x100);
-                memset(priv->testmode_trace.trace_addr, 0x03B,
-                        priv->testmode_trace.buff_size);
-                skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
-                        sizeof(priv->testmode_trace.dma_addr) + 20);
-                if (!skb) {
-                        IWL_ERR(priv, "Memory allocation fail\n");
-                        iwl_trace_cleanup(priv);
-                        return -ENOMEM;
-                }
-                if (nla_put(skb, IWL_TM_ATTR_TRACE_ADDR,
-                            sizeof(priv->testmode_trace.dma_addr),
-                            (u64 *)&priv->testmode_trace.dma_addr))
-                        goto nla_put_failure;
-                status = cfg80211_testmode_reply(skb);
-                if (status < 0) {
-                        IWL_ERR(priv, "Error sending msg : %d\n", status);
-                }
-                priv->testmode_trace.num_chunks =
-                        DIV_ROUND_UP(priv->testmode_trace.buff_size,
-                                     DUMP_CHUNK_SIZE);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_END_TRACE:
-                iwl_trace_cleanup(priv);
-                break;
-        default:
-                IWL_ERR(priv, "Unknown testmode mem command ID\n");
-                return -ENOSYS;
-        }
-        return status;
-
-nla_put_failure:
-        kfree_skb(skb);
-        if (nla_get_u32(tb[IWL_TM_ATTR_COMMAND]) ==
-            IWL_TM_CMD_APP2DEV_BEGIN_TRACE)
-                iwl_trace_cleanup(priv);
-        return -EMSGSIZE;
-}
-
-static int iwl_testmode_trace_dump(struct ieee80211_hw *hw,
-                                   struct sk_buff *skb,
-                                   struct netlink_callback *cb)
-{
-        struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
-        int idx, length;
-
-        if (priv->testmode_trace.trace_enabled &&
-            priv->testmode_trace.trace_addr) {
-                idx = cb->args[4];
-                if (idx >= priv->testmode_trace.num_chunks)
-                        return -ENOENT;
-                length = DUMP_CHUNK_SIZE;
-                if (((idx + 1) == priv->testmode_trace.num_chunks) &&
-                    (priv->testmode_trace.buff_size % DUMP_CHUNK_SIZE))
-                        length = priv->testmode_trace.buff_size %
-                                DUMP_CHUNK_SIZE;
-
-                if (nla_put(skb, IWL_TM_ATTR_TRACE_DUMP, length,
-                            priv->testmode_trace.trace_addr +
-                            (DUMP_CHUNK_SIZE * idx)))
-                        goto nla_put_failure;
-                idx++;
-                cb->args[4] = idx;
-                return 0;
-        } else
-                return -EFAULT;
-
- nla_put_failure:
-        return -ENOBUFS;
-}
-
-/*
- * This function handles the user application switch ucode ownership.
- *
- * It retrieves the mandatory fields IWL_TM_ATTR_UCODE_OWNER and
- * decide who the current owner of the uCode
- *
- * If the current owner is OWNERSHIP_TM, then the only host command
- * can deliver to uCode is from testmode, all the other host commands
- * will dropped.
- *
- * default driver is the owner of uCode in normal operational mode
- *
- * @hw: ieee80211_hw object that represents the device
- * @tb: gnl message fields from the user space
- */
-static int iwl_testmode_ownership(struct ieee80211_hw *hw, struct nlattr **tb)
-{
-        struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
-        u8 owner;
-
-        if (!tb[IWL_TM_ATTR_UCODE_OWNER]) {
-                IWL_ERR(priv, "Missing ucode owner\n");
-                return -ENOMSG;
-        }
-
-        owner = nla_get_u8(tb[IWL_TM_ATTR_UCODE_OWNER]);
-        if (owner == IWL_OWNERSHIP_DRIVER) {
-                priv->ucode_owner = owner;
-                priv->pre_rx_handler = NULL;
-        } else if (owner == IWL_OWNERSHIP_TM) {
-                priv->pre_rx_handler = iwl_testmode_ucode_rx_pkt;
-                priv->ucode_owner = owner;
-        } else {
-                IWL_ERR(priv, "Invalid owner\n");
-                return -EINVAL;
-        }
-        return 0;
-}
-
-static int iwl_testmode_indirect_read(struct iwl_priv *priv, u32 addr, u32 size)
-{
-        struct iwl_trans *trans = priv->trans;
-        unsigned long flags;
-        int i;
-
-        if (size & 0x3)
-                return -EINVAL;
-        priv->testmode_mem.buff_size = size;
-        priv->testmode_mem.buff_addr =
-                kmalloc(priv->testmode_mem.buff_size, GFP_KERNEL);
-        if (priv->testmode_mem.buff_addr == NULL)
-                return -ENOMEM;
-
-        /* Hard-coded periphery absolute address */
-        if (IWL_TM_ABS_PRPH_START <= addr &&
-                addr < IWL_TM_ABS_PRPH_START + PRPH_END) {
-                        spin_lock_irqsave(&trans->reg_lock, flags);
-                        iwl_grab_nic_access(trans);
-                        iwl_write32(trans, HBUS_TARG_PRPH_RADDR,
-                                addr | (3 << 24));
-                        for (i = 0; i < size; i += 4)
-                                *(u32 *)(priv->testmode_mem.buff_addr + i) =
-                                        iwl_read32(trans, HBUS_TARG_PRPH_RDAT);
-                        iwl_release_nic_access(trans);
-                        spin_unlock_irqrestore(&trans->reg_lock, flags);
-        } else { /* target memory (SRAM) */
-                _iwl_read_targ_mem_words(trans, addr,
-                        priv->testmode_mem.buff_addr,
-                        priv->testmode_mem.buff_size / 4);
-        }
-
-        priv->testmode_mem.num_chunks =
-                DIV_ROUND_UP(priv->testmode_mem.buff_size, DUMP_CHUNK_SIZE);
-        priv->testmode_mem.read_in_progress = true;
-        return 0;
-
-}
-
-static int iwl_testmode_indirect_write(struct iwl_priv *priv, u32 addr,
-        u32 size, unsigned char *buf)
-{
-        struct iwl_trans *trans = priv->trans;
-        u32 val, i;
-        unsigned long flags;
-
-        if (IWL_TM_ABS_PRPH_START <= addr &&
-                addr < IWL_TM_ABS_PRPH_START + PRPH_END) {
-                        /* Periphery writes can be 1-3 bytes long, or DWORDs */
-                        if (size < 4) {
-                                memcpy(&val, buf, size);
-                                spin_lock_irqsave(&trans->reg_lock, flags);
-                                iwl_grab_nic_access(trans);
-                                iwl_write32(trans, HBUS_TARG_PRPH_WADDR,
-                                            (addr & 0x0000FFFF) |
-                                            ((size - 1) << 24));
-                                iwl_write32(trans, HBUS_TARG_PRPH_WDAT, val);
-                                iwl_release_nic_access(trans);
-                                /* needed after consecutive writes w/o read */
-                                mmiowb();
-                                spin_unlock_irqrestore(&trans->reg_lock, flags);
-                        } else {
-                                if (size % 4)
-                                        return -EINVAL;
-                                for (i = 0; i < size; i += 4)
-                                        iwl_write_prph(trans, addr+i,
-                                                *(u32 *)(buf+i));
-                        }
-        } else if (iwlagn_hw_valid_rtc_data_addr(addr) ||
-                (IWLAGN_RTC_INST_LOWER_BOUND <= addr &&
-                addr < IWLAGN_RTC_INST_UPPER_BOUND)) {
-                        _iwl_write_targ_mem_words(trans, addr, buf, size/4);
-        } else
-                return -EINVAL;
-        return 0;
-}
-
-/*
- * This function handles the user application commands for SRAM data dump
- *
- * It retrieves the mandatory fields IWL_TM_ATTR_SRAM_ADDR and
- * IWL_TM_ATTR_SRAM_SIZE to decide the memory area for SRAM data reading
- *
- * Several error will be retured, -EBUSY if the SRAM data retrieved by
- * previous command has not been delivered to userspace, or -ENOMSG if
- * the mandatory fields (IWL_TM_ATTR_SRAM_ADDR,IWL_TM_ATTR_SRAM_SIZE)
- * are missing, or -ENOMEM if the buffer allocation fails.
- *
- * Otherwise 0 is replied indicating the success of the SRAM reading.
- *
- * @hw: ieee80211_hw object that represents the device
- * @tb: gnl message fields from the user space
- */
-static int iwl_testmode_indirect_mem(struct ieee80211_hw *hw,
-        struct nlattr **tb)
-{
-        struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
-        u32 addr, size, cmd;
-        unsigned char *buf;
-
-        /* Both read and write should be blocked, for atomicity */
-        if (priv->testmode_mem.read_in_progress)
-                return -EBUSY;
-
-        cmd = nla_get_u32(tb[IWL_TM_ATTR_COMMAND]);
-        if (!tb[IWL_TM_ATTR_MEM_ADDR]) {
-                IWL_ERR(priv, "Error finding memory offset address\n");
-                return -ENOMSG;
-        }
-        addr = nla_get_u32(tb[IWL_TM_ATTR_MEM_ADDR]);
-        if (!tb[IWL_TM_ATTR_BUFFER_SIZE]) {
-                IWL_ERR(priv, "Error finding size for memory reading\n");
-                return -ENOMSG;
-        }
-        size = nla_get_u32(tb[IWL_TM_ATTR_BUFFER_SIZE]);
-
-        if (cmd == IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_READ)
-                return iwl_testmode_indirect_read(priv, addr,  size);
-        else {
-                if (!tb[IWL_TM_ATTR_BUFFER_DUMP])
-                        return -EINVAL;
-                buf = (unsigned char *) nla_data(tb[IWL_TM_ATTR_BUFFER_DUMP]);
-                return iwl_testmode_indirect_write(priv, addr, size, buf);
-        }
-}
-
-static int iwl_testmode_buffer_dump(struct ieee80211_hw *hw,
-                                    struct sk_buff *skb,
-                                    struct netlink_callback *cb)
-{
-        struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
-        int idx, length;
-
-        if (priv->testmode_mem.read_in_progress) {
-                idx = cb->args[4];
-                if (idx >= priv->testmode_mem.num_chunks) {
-                        iwl_mem_cleanup(priv);
-                        return -ENOENT;
-                }
-                length = DUMP_CHUNK_SIZE;
-                if (((idx + 1) == priv->testmode_mem.num_chunks) &&
-                    (priv->testmode_mem.buff_size % DUMP_CHUNK_SIZE))
-                        length = priv->testmode_mem.buff_size %
-                                DUMP_CHUNK_SIZE;
-
-                if (nla_put(skb, IWL_TM_ATTR_BUFFER_DUMP, length,
-                            priv->testmode_mem.buff_addr +
-                            (DUMP_CHUNK_SIZE * idx)))
-                        goto nla_put_failure;
-                idx++;
-                cb->args[4] = idx;
-                return 0;
-        } else
-                return -EFAULT;
-
- nla_put_failure:
-        return -ENOBUFS;
-}
-
-static int iwl_testmode_notifications(struct ieee80211_hw *hw,
-        struct nlattr **tb)
-{
-        struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
-        bool enable;
-
-        enable = nla_get_flag(tb[IWL_TM_ATTR_ENABLE_NOTIFICATION]);
-        if (enable)
-                priv->pre_rx_handler = iwl_testmode_ucode_rx_pkt;
-        else
-                priv->pre_rx_handler = NULL;
-        return 0;
-}
-
-
-/* The testmode gnl message handler that takes the gnl message from the
- * user space and parses it per the policy iwl_testmode_gnl_msg_policy, then
- * invoke the corresponding handlers.
- *
- * This function is invoked when there is user space application sending
- * gnl message through the testmode tunnel NL80211_CMD_TESTMODE regulated
- * by nl80211.
- *
- * It retrieves the mandatory field, IWL_TM_ATTR_COMMAND, before
- * dispatching it to the corresponding handler.
- *
- * If IWL_TM_ATTR_COMMAND is missing, -ENOMSG is replied to user application;
- * -ENOSYS is replied to the user application if the command is unknown;
- * Otherwise, the command is dispatched to the respective handler.
- *
- * @hw: ieee80211_hw object that represents the device
- * @data: pointer to user space message
- * @len: length in byte of @data
- */
-int iwlagn_mac_testmode_cmd(struct ieee80211_hw *hw, void *data, int len)
-{
-        struct nlattr *tb[IWL_TM_ATTR_MAX];
-        struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
-        int result;
-
-        result = nla_parse(tb, IWL_TM_ATTR_MAX - 1, data, len,
-                        iwl_testmode_gnl_msg_policy);
-        if (result != 0) {
-                IWL_ERR(priv, "Error parsing the gnl message : %d\n", result);
-                return result;
-        }
-
-        /* IWL_TM_ATTR_COMMAND is absolutely mandatory */
-        if (!tb[IWL_TM_ATTR_COMMAND]) {
-                IWL_ERR(priv, "Missing testmode command type\n");
-                return -ENOMSG;
-        }
-        /* in case multiple accesses to the device happens */
-        mutex_lock(&priv->mutex);
-
-        switch (nla_get_u32(tb[IWL_TM_ATTR_COMMAND])) {
-        case IWL_TM_CMD_APP2DEV_UCODE:
-                IWL_DEBUG_INFO(priv, "testmode cmd to uCode\n");
-                result = iwl_testmode_ucode(hw, tb);
-                break;
-        case IWL_TM_CMD_APP2DEV_DIRECT_REG_READ32:
-        case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE32:
-        case IWL_TM_CMD_APP2DEV_DIRECT_REG_WRITE8:
-                IWL_DEBUG_INFO(priv, "testmode cmd to register\n");
-                result = iwl_testmode_reg(hw, tb);
-                break;
-        case IWL_TM_CMD_APP2DEV_GET_DEVICENAME:
-        case IWL_TM_CMD_APP2DEV_LOAD_INIT_FW:
-        case IWL_TM_CMD_APP2DEV_CFG_INIT_CALIB:
-        case IWL_TM_CMD_APP2DEV_LOAD_RUNTIME_FW:
-        case IWL_TM_CMD_APP2DEV_GET_EEPROM:
-        case IWL_TM_CMD_APP2DEV_FIXRATE_REQ:
-        case IWL_TM_CMD_APP2DEV_LOAD_WOWLAN_FW:
-        case IWL_TM_CMD_APP2DEV_GET_FW_VERSION:
-        case IWL_TM_CMD_APP2DEV_GET_DEVICE_ID:
-        case IWL_TM_CMD_APP2DEV_GET_FW_INFO:
-                IWL_DEBUG_INFO(priv, "testmode cmd to driver\n");
-                result = iwl_testmode_driver(hw, tb);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_BEGIN_TRACE:
-        case IWL_TM_CMD_APP2DEV_END_TRACE:
-        case IWL_TM_CMD_APP2DEV_READ_TRACE:
-                IWL_DEBUG_INFO(priv, "testmode uCode trace cmd to driver\n");
-                result = iwl_testmode_trace(hw, tb);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_OWNERSHIP:
-                IWL_DEBUG_INFO(priv, "testmode change uCode ownership\n");
-                result = iwl_testmode_ownership(hw, tb);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_READ:
-        case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_WRITE:
-                IWL_DEBUG_INFO(priv, "testmode indirect memory cmd "
-                        "to driver\n");
-                result = iwl_testmode_indirect_mem(hw, tb);
-                break;
-
-        case IWL_TM_CMD_APP2DEV_NOTIFICATIONS:
-                IWL_DEBUG_INFO(priv, "testmode notifications cmd "
-                        "to driver\n");
-                result = iwl_testmode_notifications(hw, tb);
-                break;
-
-        default:
-                IWL_ERR(priv, "Unknown testmode command\n");
-                result = -ENOSYS;
-                break;
-        }
-
-        mutex_unlock(&priv->mutex);
-        return result;
-}
-
-int iwlagn_mac_testmode_dump(struct ieee80211_hw *hw, struct sk_buff *skb,
-                      struct netlink_callback *cb,
-                      void *data, int len)
-{
-        struct nlattr *tb[IWL_TM_ATTR_MAX];
-        struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
-        int result;
-        u32 cmd;
-
-        if (cb->args[3]) {
-                /* offset by 1 since commands start at 0 */
-                cmd = cb->args[3] - 1;
-        } else {
-                result = nla_parse(tb, IWL_TM_ATTR_MAX - 1, data, len,
-                                iwl_testmode_gnl_msg_policy);
-                if (result) {
-                        IWL_ERR(priv,
-                                "Error parsing the gnl message : %d\n", result);
-                        return result;
-                }
-
-                /* IWL_TM_ATTR_COMMAND is absolutely mandatory */
-                if (!tb[IWL_TM_ATTR_COMMAND]) {
-                        IWL_ERR(priv, "Missing testmode command type\n");
-                        return -ENOMSG;
-                }
-                cmd = nla_get_u32(tb[IWL_TM_ATTR_COMMAND]);
-                cb->args[3] = cmd + 1;
-        }
-
-        /* in case multiple accesses to the device happens */
-        mutex_lock(&priv->mutex);
-        switch (cmd) {
-        case IWL_TM_CMD_APP2DEV_READ_TRACE:
-                IWL_DEBUG_INFO(priv, "uCode trace cmd to driver\n");
-                result = iwl_testmode_trace_dump(hw, skb, cb);
-                break;
-        case IWL_TM_CMD_APP2DEV_INDIRECT_BUFFER_DUMP:
-                IWL_DEBUG_INFO(priv, "testmode sram dump cmd to driver\n");
-                result = iwl_testmode_buffer_dump(hw, skb, cb);
-                break;
-        default:
-                result = -EINVAL;
-                break;
-        }
-
-        mutex_unlock(&priv->mutex);
-        return result;
-}
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index 79a1e7ae4995..00efde8e5536 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -154,6 +154,9 @@ struct iwl_cmd_header {
         __le16 sequence;
 } __packed;
 
+/* iwl_cmd_header flags value */
+#define IWL_CMD_FAILED_MSK 0x40
+
 
 #define FH_RSCSR_FRAME_SIZE_MSK         0x00003FFF      /* bits 0-13 */
 #define FH_RSCSR_FRAME_INVALID          0x55550000
@@ -280,6 +283,8 @@ static inline struct page *rxb_steal_page(struct iwl_rx_cmd_buffer *r)
 
 #define MAX_NO_RECLAIM_CMDS     6
 
+#define IWL_MASK(lo, hi) ((1 << (hi)) | ((1 << (hi)) - (1 << (lo))))
+
 /*
  * Maximum number of HW queues the transport layer
  * currently supports
@@ -350,10 +355,10 @@ struct iwl_trans;
  *      Must be atomic
  * @reclaim: free packet until ssn. Returns a list of freed packets.
  *      Must be atomic
- * @tx_agg_setup: setup a tx queue for AMPDU - will be called once the HW is
+ * @txq_enable: setup a tx queue for AMPDU - will be called once the HW is
  *      ready and a successful ADDBA response has been received.
  *      May sleep
- * @tx_agg_disable: de-configure a Tx queue to send AMPDUs
+ * @txq_disable: de-configure a Tx queue to send AMPDUs
  *      Must be atomic
  * @wait_tx_queue_empty: wait until all tx queues are empty
  *      May sleep
@@ -386,9 +391,9 @@ struct iwl_trans_ops {
         void (*reclaim)(struct iwl_trans *trans, int queue, int ssn,
                         struct sk_buff_head *skbs);
 
-        void (*tx_agg_setup)(struct iwl_trans *trans, int queue, int fifo,
-                             int sta_id, int tid, int frame_limit, u16 ssn);
-        void (*tx_agg_disable)(struct iwl_trans *trans, int queue);
+        void (*txq_enable)(struct iwl_trans *trans, int queue, int fifo,
+                           int sta_id, int tid, int frame_limit, u16 ssn);
+        void (*txq_disable)(struct iwl_trans *trans, int queue);
 
         int (*dbgfs_register)(struct iwl_trans *trans, struct dentry* dir);
         int (*wait_tx_queue_empty)(struct iwl_trans *trans);
@@ -428,6 +433,11 @@ enum iwl_trans_state {
  * @hw_id_str: a string with info about HW ID. Set during transport allocation.
  * @pm_support: set to true in start_hw if link pm is supported
  * @wait_command_queue: the wait_queue for SYNC host commands
+ * @dev_cmd_pool: pool for Tx cmd allocation - for internal use only.
+ *      The user should use iwl_trans_{alloc,free}_tx_cmd.
+ * @dev_cmd_headroom: room needed for the transport's private use before the
+ *      device_cmd for Tx - for internal use only
+ *      The user should use iwl_trans_{alloc,free}_tx_cmd.
  */
 struct iwl_trans {
         const struct iwl_trans_ops *ops;
@@ -445,6 +455,10 @@ struct iwl_trans {
 
         wait_queue_head_t wait_command_queue;
 
+        /* The following fields are internal only */
+        struct kmem_cache *dev_cmd_pool;
+        size_t dev_cmd_headroom;
+
         /* pointer to trans specific struct */
         /*Ensure that this pointer will always be aligned to sizeof pointer */
         char trans_specific[0] __aligned(sizeof(void *));
@@ -520,6 +534,26 @@ static inline int iwl_trans_send_cmd(struct iwl_trans *trans,
         return trans->ops->send_cmd(trans, cmd);
 }
 
+static inline struct iwl_device_cmd *
+iwl_trans_alloc_tx_cmd(struct iwl_trans *trans)
+{
+        u8 *dev_cmd_ptr = kmem_cache_alloc(trans->dev_cmd_pool, GFP_ATOMIC);
+
+        if (unlikely(dev_cmd_ptr == NULL))
+                return NULL;
+
+        return (struct iwl_device_cmd *)
+                        (dev_cmd_ptr + trans->dev_cmd_headroom);
+}
+
+static inline void iwl_trans_free_tx_cmd(struct iwl_trans *trans,
+                                         struct iwl_device_cmd *dev_cmd)
+{
+        u8 *dev_cmd_ptr = (u8 *)dev_cmd - trans->dev_cmd_headroom;
+
+        kmem_cache_free(trans->dev_cmd_pool, dev_cmd_ptr);
+}
+
 static inline int iwl_trans_tx(struct iwl_trans *trans, struct sk_buff *skb,
                                struct iwl_device_cmd *dev_cmd, int queue)
 {
@@ -538,24 +572,24 @@ static inline void iwl_trans_reclaim(struct iwl_trans *trans, int queue,
         trans->ops->reclaim(trans, queue, ssn, skbs);
 }
 
-static inline void iwl_trans_tx_agg_disable(struct iwl_trans *trans, int queue)
+static inline void iwl_trans_txq_disable(struct iwl_trans *trans, int queue)
 {
         WARN_ONCE(trans->state != IWL_TRANS_FW_ALIVE,
                   "%s bad state = %d", __func__, trans->state);
 
-        trans->ops->tx_agg_disable(trans, queue);
+        trans->ops->txq_disable(trans, queue);
 }
 
-static inline void iwl_trans_tx_agg_setup(struct iwl_trans *trans, int queue,
-                                          int fifo, int sta_id, int tid,
-                                          int frame_limit, u16 ssn)
+static inline void iwl_trans_txq_enable(struct iwl_trans *trans, int queue,
+                                        int fifo, int sta_id, int tid,
+                                        int frame_limit, u16 ssn)
 {
         might_sleep();
 
         WARN_ONCE(trans->state != IWL_TRANS_FW_ALIVE,
                   "%s bad state = %d", __func__, trans->state);
 
-        trans->ops->tx_agg_setup(trans, queue, fifo, sta_id, tid,
+        trans->ops->txq_enable(trans, queue, fifo, sta_id, tid,
                                  frame_limit, ssn);
 }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/pcie/1000.c
index 2629a6602dfa..81b83f484f08 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/pcie/1000.c
@@ -27,9 +27,9 @@
 #include <linux/module.h>
 #include <linux/stringify.h>
 #include "iwl-config.h"
-#include "iwl-cfg.h"
 #include "iwl-csr.h"
 #include "iwl-agn-hw.h"
+#include "cfg.h"
 
 /* Highest firmware API version supported */
 #define IWL1000_UCODE_API_MAX 5
@@ -64,13 +64,26 @@ static const struct iwl_base_params iwl1000_base_params = {
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_EXT_LONG_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
-        .wd_timeout = IWL_WATCHHDOG_DISABLED,
+        .wd_timeout = IWL_WATCHDOG_DISABLED,
         .max_event_log_size = 128,
 };
 
 static const struct iwl_ht_params iwl1000_ht_params = {
         .ht_greenfield_support = true,
         .use_rts_for_aggregation = true, /* use rts/cts protection */
+        .ht40_bands = BIT(IEEE80211_BAND_2GHZ),
+};
+
+static const struct iwl_eeprom_params iwl1000_eeprom_params = {
+        .regulatory_bands = {
+                EEPROM_REG_BAND_1_CHANNELS,
+                EEPROM_REG_BAND_2_CHANNELS,
+                EEPROM_REG_BAND_3_CHANNELS,
+                EEPROM_REG_BAND_4_CHANNELS,
+                EEPROM_REG_BAND_5_CHANNELS,
+                EEPROM_REG_BAND_24_HT40_CHANNELS,
+                EEPROM_REGULATORY_BAND_NO_HT40,
+        }
 };
 
 #define IWL_DEVICE_1000                                         \
@@ -84,6 +97,7 @@ static const struct iwl_ht_params iwl1000_ht_params = {
         .eeprom_ver = EEPROM_1000_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_1000_TX_POWER_VERSION,       \
         .base_params = &iwl1000_base_params,                    \
+        .eeprom_params = &iwl1000_eeprom_params,                \
         .led_mode = IWL_LED_BLINK
 
 const struct iwl_cfg iwl1000_bgn_cfg = {
@@ -108,6 +122,7 @@ const struct iwl_cfg iwl1000_bg_cfg = {
         .eeprom_ver = EEPROM_1000_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_1000_TX_POWER_VERSION,       \
         .base_params = &iwl1000_base_params,                    \
+        .eeprom_params = &iwl1000_eeprom_params,                \
         .led_mode = IWL_LED_RF_STATE,                           \
         .rx_with_siso_diversity = true
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-2000.c b/drivers/net/wireless/iwlwifi/pcie/2000.c
index 8133105ac645..fd4e78f56fa6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-2000.c
+++ b/drivers/net/wireless/iwlwifi/pcie/2000.c
@@ -27,9 +27,9 @@
 #include <linux/module.h>
 #include <linux/stringify.h>
 #include "iwl-config.h"
-#include "iwl-cfg.h"
 #include "iwl-agn-hw.h"
-#include "iwl-commands.h" /* needed for BT for now */
+#include "cfg.h"
+#include "dvm/commands.h" /* needed for BT for now */
 
 /* Highest firmware API version supported */
 #define IWL2030_UCODE_API_MAX 6
@@ -104,6 +104,7 @@ static const struct iwl_base_params iwl2030_base_params = {
 static const struct iwl_ht_params iwl2000_ht_params = {
         .ht_greenfield_support = true,
         .use_rts_for_aggregation = true, /* use rts/cts protection */
+        .ht40_bands = BIT(IEEE80211_BAND_2GHZ),
 };
 
 static const struct iwl_bt_params iwl2030_bt_params = {
@@ -116,6 +117,19 @@ static const struct iwl_bt_params iwl2030_bt_params = {
         .bt_session_2 = true,
 };
 
+static const struct iwl_eeprom_params iwl20x0_eeprom_params = {
+        .regulatory_bands = {
+                EEPROM_REG_BAND_1_CHANNELS,
+                EEPROM_REG_BAND_2_CHANNELS,
+                EEPROM_REG_BAND_3_CHANNELS,
+                EEPROM_REG_BAND_4_CHANNELS,
+                EEPROM_REG_BAND_5_CHANNELS,
+                EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
+                EEPROM_REGULATORY_BAND_NO_HT40,
+        },
+        .enhanced_txpower = true,
+};
+
 #define IWL_DEVICE_2000                                         \
         .fw_name_pre = IWL2000_FW_PRE,                          \
         .ucode_api_max = IWL2000_UCODE_API_MAX,                 \
@@ -127,6 +141,7 @@ static const struct iwl_bt_params iwl2030_bt_params = {
         .eeprom_ver = EEPROM_2000_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_2000_TX_POWER_VERSION,       \
         .base_params = &iwl2000_base_params,                    \
+        .eeprom_params = &iwl20x0_eeprom_params,                \
         .need_temp_offset_calib = true,                         \
         .temp_offset_v2 = true,                                 \
         .led_mode = IWL_LED_RF_STATE
@@ -155,6 +170,7 @@ const struct iwl_cfg iwl2000_2bgn_d_cfg = {
         .eeprom_calib_ver = EEPROM_2000_TX_POWER_VERSION,       \
         .base_params = &iwl2030_base_params,                    \
         .bt_params = &iwl2030_bt_params,                        \
+        .eeprom_params = &iwl20x0_eeprom_params,                \
         .need_temp_offset_calib = true,                         \
         .temp_offset_v2 = true,                                 \
         .led_mode = IWL_LED_RF_STATE,                           \
@@ -177,6 +193,7 @@ const struct iwl_cfg iwl2030_2bgn_cfg = {
         .eeprom_ver = EEPROM_2000_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_2000_TX_POWER_VERSION,       \
         .base_params = &iwl2000_base_params,                    \
+        .eeprom_params = &iwl20x0_eeprom_params,                \
         .need_temp_offset_calib = true,                         \
         .temp_offset_v2 = true,                                 \
         .led_mode = IWL_LED_RF_STATE,                           \
@@ -207,6 +224,7 @@ const struct iwl_cfg iwl105_bgn_d_cfg = {
         .eeprom_calib_ver = EEPROM_2000_TX_POWER_VERSION,       \
         .base_params = &iwl2030_base_params,                    \
         .bt_params = &iwl2030_bt_params,                        \
+        .eeprom_params = &iwl20x0_eeprom_params,                \
         .need_temp_offset_calib = true,                         \
         .temp_offset_v2 = true,                                 \
         .led_mode = IWL_LED_RF_STATE,                           \
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/pcie/5000.c
index 8e26bc825f23..d1665fa6d15a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/pcie/5000.c
@@ -27,9 +27,9 @@
 #include <linux/module.h>
 #include <linux/stringify.h>
 #include "iwl-config.h"
-#include "iwl-cfg.h"
 #include "iwl-agn-hw.h"
 #include "iwl-csr.h"
+#include "cfg.h"
 
 /* Highest firmware API version supported */
 #define IWL5000_UCODE_API_MAX 5
@@ -62,13 +62,26 @@ static const struct iwl_base_params iwl5000_base_params = {
         .led_compensation = 51,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
-        .wd_timeout = IWL_WATCHHDOG_DISABLED,
+        .wd_timeout = IWL_WATCHDOG_DISABLED,
         .max_event_log_size = 512,
         .no_idle_support = true,
 };
 
 static const struct iwl_ht_params iwl5000_ht_params = {
         .ht_greenfield_support = true,
+        .ht40_bands = BIT(IEEE80211_BAND_2GHZ) | BIT(IEEE80211_BAND_5GHZ),
+};
+
+static const struct iwl_eeprom_params iwl5000_eeprom_params = {
+        .regulatory_bands = {
+                EEPROM_REG_BAND_1_CHANNELS,
+                EEPROM_REG_BAND_2_CHANNELS,
+                EEPROM_REG_BAND_3_CHANNELS,
+                EEPROM_REG_BAND_4_CHANNELS,
+                EEPROM_REG_BAND_5_CHANNELS,
+                EEPROM_REG_BAND_24_HT40_CHANNELS,
+                EEPROM_REG_BAND_52_HT40_CHANNELS
+        },
 };
 
 #define IWL_DEVICE_5000                                         \
@@ -82,6 +95,7 @@ static const struct iwl_ht_params iwl5000_ht_params = {
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,       \
         .base_params = &iwl5000_base_params,                    \
+        .eeprom_params = &iwl5000_eeprom_params,                \
         .led_mode = IWL_LED_BLINK
 
 const struct iwl_cfg iwl5300_agn_cfg = {
@@ -128,6 +142,7 @@ const struct iwl_cfg iwl5350_agn_cfg = {
         .eeprom_ver = EEPROM_5050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,
         .base_params = &iwl5000_base_params,
+        .eeprom_params = &iwl5000_eeprom_params,
         .ht_params = &iwl5000_ht_params,
         .led_mode = IWL_LED_BLINK,
         .internal_wimax_coex = true,
@@ -144,6 +159,7 @@ const struct iwl_cfg iwl5350_agn_cfg = {
         .eeprom_ver = EEPROM_5050_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,       \
         .base_params = &iwl5000_base_params,                    \
+        .eeprom_params = &iwl5000_eeprom_params,                \
         .no_xtal_calib = true,                                  \
         .led_mode = IWL_LED_BLINK,                              \
         .internal_wimax_coex = true
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/pcie/6000.c
index e5e8ada4aaf6..4a57624afc40 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/pcie/6000.c
@@ -27,9 +27,9 @@
 #include <linux/module.h>
 #include <linux/stringify.h>
 #include "iwl-config.h"
-#include "iwl-cfg.h"
 #include "iwl-agn-hw.h"
-#include "iwl-commands.h" /* needed for BT for now */
+#include "cfg.h"
+#include "dvm/commands.h" /* needed for BT for now */
 
 /* Highest firmware API version supported */
 #define IWL6000_UCODE_API_MAX 6
@@ -127,6 +127,7 @@ static const struct iwl_base_params iwl6000_g2_base_params = {
 static const struct iwl_ht_params iwl6000_ht_params = {
         .ht_greenfield_support = true,
         .use_rts_for_aggregation = true, /* use rts/cts protection */
+        .ht40_bands = BIT(IEEE80211_BAND_2GHZ) | BIT(IEEE80211_BAND_5GHZ),
 };
 
 static const struct iwl_bt_params iwl6000_bt_params = {
@@ -138,6 +139,19 @@ static const struct iwl_bt_params iwl6000_bt_params = {
         .bt_sco_disable = true,
 };
 
+static const struct iwl_eeprom_params iwl6000_eeprom_params = {
+        .regulatory_bands = {
+                EEPROM_REG_BAND_1_CHANNELS,
+                EEPROM_REG_BAND_2_CHANNELS,
+                EEPROM_REG_BAND_3_CHANNELS,
+                EEPROM_REG_BAND_4_CHANNELS,
+                EEPROM_REG_BAND_5_CHANNELS,
+                EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
+                EEPROM_REG_BAND_52_HT40_CHANNELS
+        },
+        .enhanced_txpower = true,
+};
+
 #define IWL_DEVICE_6005                                         \
         .fw_name_pre = IWL6005_FW_PRE,                          \
         .ucode_api_max = IWL6000G2_UCODE_API_MAX,               \
@@ -149,6 +163,7 @@ static const struct iwl_bt_params iwl6000_bt_params = {
         .eeprom_ver = EEPROM_6005_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_6005_TX_POWER_VERSION,       \
         .base_params = &iwl6000_g2_base_params,                 \
+        .eeprom_params = &iwl6000_eeprom_params,                \
         .need_temp_offset_calib = true,                         \
         .led_mode = IWL_LED_RF_STATE
 
@@ -204,6 +219,7 @@ const struct iwl_cfg iwl6005_2agn_mow2_cfg = {
         .eeprom_calib_ver = EEPROM_6030_TX_POWER_VERSION,       \
         .base_params = &iwl6000_g2_base_params,                 \
         .bt_params = &iwl6000_bt_params,                        \
+        .eeprom_params = &iwl6000_eeprom_params,                \
         .need_temp_offset_calib = true,                         \
         .led_mode = IWL_LED_RF_STATE,                           \
         .adv_pm = true                                          \
@@ -242,6 +258,7 @@ const struct iwl_cfg iwl6030_2bg_cfg = {
         .eeprom_calib_ver = EEPROM_6030_TX_POWER_VERSION,       \
         .base_params = &iwl6000_g2_base_params,                 \
         .bt_params = &iwl6000_bt_params,                        \
+        .eeprom_params = &iwl6000_eeprom_params,                \
         .need_temp_offset_calib = true,                         \
         .led_mode = IWL_LED_RF_STATE,                           \
         .adv_pm = true
@@ -292,6 +309,7 @@ const struct iwl_cfg iwl130_bg_cfg = {
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_6000_TX_POWER_VERSION,       \
         .base_params = &iwl6000_base_params,                    \
+        .eeprom_params = &iwl6000_eeprom_params,                \
         .led_mode = IWL_LED_BLINK
 
 const struct iwl_cfg iwl6000i_2agn_cfg = {
@@ -322,6 +340,7 @@ const struct iwl_cfg iwl6000i_2bg_cfg = {
         .eeprom_ver = EEPROM_6050_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_6050_TX_POWER_VERSION,       \
         .base_params = &iwl6050_base_params,                    \
+        .eeprom_params = &iwl6000_eeprom_params,                \
         .led_mode = IWL_LED_BLINK,                              \
         .internal_wimax_coex = true
 
@@ -346,6 +365,7 @@ const struct iwl_cfg iwl6050_2abg_cfg = {
         .eeprom_ver = EEPROM_6150_EEPROM_VERSION,               \
         .eeprom_calib_ver = EEPROM_6150_TX_POWER_VERSION,       \
         .base_params = &iwl6050_base_params,                    \
+        .eeprom_params = &iwl6000_eeprom_params,                \
         .led_mode = IWL_LED_BLINK,                              \
         .internal_wimax_coex = true
 
@@ -372,6 +392,7 @@ const struct iwl_cfg iwl6000_3agn_cfg = {
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_6000_TX_POWER_VERSION,
         .base_params = &iwl6000_base_params,
+        .eeprom_params = &iwl6000_eeprom_params,
         .ht_params = &iwl6000_ht_params,
         .led_mode = IWL_LED_BLINK,
 };
diff --git a/drivers/net/wireless/iwlwifi/iwl-cfg.h b/drivers/net/wireless/iwlwifi/pcie/cfg.h
index 82152311d73b..82152311d73b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-cfg.h
+++ b/drivers/net/wireless/iwlwifi/pcie/cfg.h
diff --git a/drivers/net/wireless/iwlwifi/iwl-pci.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 0c8a1c2d8847..f4c3500b68c6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-pci.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -68,10 +68,11 @@
 #include <linux/pci-aspm.h>
 
 #include "iwl-trans.h"
-#include "iwl-cfg.h"
 #include "iwl-drv.h"
 #include "iwl-trans.h"
-#include "iwl-trans-pcie-int.h"
+
+#include "cfg.h"
+#include "internal.h"
 
 #define IWL_PCI_DEVICE(dev, subdev, cfg) \
         .vendor = PCI_VENDOR_ID_INTEL,  .device = (dev), \
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index e959207c630a..5024fb662bf6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -313,7 +313,7 @@ void iwl_bg_rx_replenish(struct work_struct *data);
 void iwl_irq_tasklet(struct iwl_trans *trans);
 void iwlagn_rx_replenish(struct iwl_trans *trans);
 void iwl_rx_queue_update_write_ptr(struct iwl_trans *trans,
-                        struct iwl_rx_queue *q);
+                                   struct iwl_rx_queue *q);
 
 /*****************************************************
 * ICT
@@ -328,7 +328,7 @@ irqreturn_t iwl_isr_ict(int irq, void *data);
 * TX / HCMD
 ******************************************************/
 void iwl_txq_update_write_ptr(struct iwl_trans *trans,
-                        struct iwl_tx_queue *txq);
+                              struct iwl_tx_queue *txq);
 int iwlagn_txq_attach_buf_to_tfd(struct iwl_trans *trans,
                                  struct iwl_tx_queue *txq,
                                  dma_addr_t addr, u16 len, u8 reset);
@@ -337,17 +337,13 @@ int iwl_trans_pcie_send_cmd(struct iwl_trans *trans, struct iwl_host_cmd *cmd);
 void iwl_tx_cmd_complete(struct iwl_trans *trans,
                          struct iwl_rx_cmd_buffer *rxb, int handler_status);
 void iwl_trans_txq_update_byte_cnt_tbl(struct iwl_trans *trans,
-                                           struct iwl_tx_queue *txq,
-                                           u16 byte_cnt);
-void iwl_trans_pcie_tx_agg_disable(struct iwl_trans *trans, int queue);
-void iwl_trans_set_wr_ptrs(struct iwl_trans *trans, int txq_id, u32 index);
-void iwl_trans_tx_queue_set_status(struct iwl_trans *trans,
-                                   struct iwl_tx_queue *txq,
-                                   int tx_fifo_id, bool active);
-void iwl_trans_pcie_tx_agg_setup(struct iwl_trans *trans, int queue, int fifo,
-                                 int sta_id, int tid, int frame_limit, u16 ssn);
-void iwlagn_txq_free_tfd(struct iwl_trans *trans, struct iwl_tx_queue *txq,
-                         enum dma_data_direction dma_dir);
+                                       struct iwl_tx_queue *txq,
+                                       u16 byte_cnt);
+void iwl_trans_pcie_txq_enable(struct iwl_trans *trans, int txq_id, int fifo,
+                               int sta_id, int tid, int frame_limit, u16 ssn);
+void iwl_trans_pcie_txq_disable(struct iwl_trans *trans, int queue);
+void iwl_txq_free_tfd(struct iwl_trans *trans, struct iwl_tx_queue *txq,
+                      enum dma_data_direction dma_dir);
 int iwl_tx_queue_reclaim(struct iwl_trans *trans, int txq_id, int index,
                          struct sk_buff_head *skbs);
 int iwl_queue_space(const struct iwl_queue *q);
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index 08517d3c80bb..d6860c070c16 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -32,7 +32,7 @@
 
 #include "iwl-prph.h"
 #include "iwl-io.h"
-#include "iwl-trans-pcie-int.h"
+#include "internal.h"
 #include "iwl-op-mode.h"
 
 #ifdef CONFIG_IWLWIFI_IDI
@@ -130,7 +130,7 @@ static int iwl_rx_queue_space(const struct iwl_rx_queue *q)
  * iwl_rx_queue_update_write_ptr - Update the write pointer for the RX queue
  */
 void iwl_rx_queue_update_write_ptr(struct iwl_trans *trans,
-                        struct iwl_rx_queue *q)
+                                   struct iwl_rx_queue *q)
 {
         unsigned long flags;
         u32 reg;
@@ -201,9 +201,7 @@ static inline __le32 iwlagn_dma_addr2rbd_ptr(dma_addr_t dma_addr)
  */
 static void iwlagn_rx_queue_restock(struct iwl_trans *trans)
 {
-        struct iwl_trans_pcie *trans_pcie =
-                IWL_TRANS_GET_PCIE_TRANS(trans);
-
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_rx_queue *rxq = &trans_pcie->rxq;
         struct list_head *element;
         struct iwl_rx_mem_buffer *rxb;
@@ -253,9 +251,7 @@ static void iwlagn_rx_queue_restock(struct iwl_trans *trans)
  */
 static void iwlagn_rx_allocate(struct iwl_trans *trans, gfp_t priority)
 {
-        struct iwl_trans_pcie *trans_pcie =
-                IWL_TRANS_GET_PCIE_TRANS(trans);
-
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_rx_queue *rxq = &trans_pcie->rxq;
         struct list_head *element;
         struct iwl_rx_mem_buffer *rxb;
@@ -278,8 +274,7 @@ static void iwlagn_rx_allocate(struct iwl_trans *trans, gfp_t priority)
                         gfp_mask |= __GFP_COMP;
 
                 /* Alloc a new receive buffer */
-                page = alloc_pages(gfp_mask,
-                                  trans_pcie->rx_page_order);
+                page = alloc_pages(gfp_mask, trans_pcie->rx_page_order);
                 if (!page) {
                         if (net_ratelimit())
                                 IWL_DEBUG_INFO(trans, "alloc_pages failed, "
@@ -315,9 +310,10 @@ static void iwlagn_rx_allocate(struct iwl_trans *trans, gfp_t priority)
                 BUG_ON(rxb->page);
                 rxb->page = page;
                 /* Get physical address of the RB */
-                rxb->page_dma = dma_map_page(trans->dev, page, 0,
-                                PAGE_SIZE << trans_pcie->rx_page_order,
-                                DMA_FROM_DEVICE);
+                rxb->page_dma =
+                        dma_map_page(trans->dev, page, 0,
+                                     PAGE_SIZE << trans_pcie->rx_page_order,
+                                     DMA_FROM_DEVICE);
                 /* dma address must be no more than 36 bits */
                 BUG_ON(rxb->page_dma & ~DMA_BIT_MASK(36));
                 /* and also 256 byte aligned! */
@@ -465,8 +461,8 @@ static void iwl_rx_handle_rxbuf(struct iwl_trans *trans,
         if (rxb->page != NULL) {
                 rxb->page_dma =
                         dma_map_page(trans->dev, rxb->page, 0,
-                                PAGE_SIZE << trans_pcie->rx_page_order,
-                                DMA_FROM_DEVICE);
+                                     PAGE_SIZE << trans_pcie->rx_page_order,
+                                     DMA_FROM_DEVICE);
                 list_add_tail(&rxb->list, &rxq->rx_free);
                 rxq->free_count++;
         } else
@@ -497,7 +493,7 @@ static void iwl_rx_handle(struct iwl_trans *trans)
 
         /* Rx interrupt, but nothing sent from uCode */
         if (i == r)
-                IWL_DEBUG_RX(trans, "r = %d, i = %d\n", r, i);
+                IWL_DEBUG_RX(trans, "HW = SW = %d\n", r);
 
         /* calculate total frames need to be restock after handling RX */
         total_empty = r - rxq->write_actual;
@@ -513,8 +509,8 @@ static void iwl_rx_handle(struct iwl_trans *trans)
                 rxb = rxq->queue[i];
                 rxq->queue[i] = NULL;
 
-                IWL_DEBUG_RX(trans, "rxbuf: r = %d, i = %d (%p)\n", rxb);
-
+                IWL_DEBUG_RX(trans, "rxbuf: HW = %d, SW = %d (%p)\n",
+                             r, i, rxb);
                 iwl_rx_handle_rxbuf(trans, rxb);
 
                 i = (i + 1) & RX_QUEUE_MASK;
@@ -546,12 +542,12 @@ static void iwl_irq_handle_error(struct iwl_trans *trans)
         /* W/A for WiFi/WiMAX coex and WiMAX own the RF */
         if (trans->cfg->internal_wimax_coex &&
             (!(iwl_read_prph(trans, APMG_CLK_CTRL_REG) &
-                        APMS_CLK_VAL_MRB_FUNC_MODE) ||
+                             APMS_CLK_VAL_MRB_FUNC_MODE) ||
              (iwl_read_prph(trans, APMG_PS_CTRL_REG) &
-                        APMG_PS_CTRL_VAL_RESET_REQ))) {
-                struct iwl_trans_pcie *trans_pcie;
+                            APMG_PS_CTRL_VAL_RESET_REQ))) {
+                struct iwl_trans_pcie *trans_pcie =
+                        IWL_TRANS_GET_PCIE_TRANS(trans);
 
-                trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
                 clear_bit(STATUS_HCMD_ACTIVE, &trans_pcie->status);
                 iwl_op_mode_wimax_active(trans->op_mode);
                 wake_up(&trans->wait_command_queue);
@@ -567,6 +563,8 @@ static void iwl_irq_handle_error(struct iwl_trans *trans)
 /* tasklet for iwlagn interrupt */
 void iwl_irq_tasklet(struct iwl_trans *trans)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct isr_statistics *isr_stats = &trans_pcie->isr_stats;
         u32 inta = 0;
         u32 handled = 0;
         unsigned long flags;
@@ -575,10 +573,6 @@ void iwl_irq_tasklet(struct iwl_trans *trans)
         u32 inta_mask;
 #endif
 
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        struct isr_statistics *isr_stats = &trans_pcie->isr_stats;
-
-
         spin_lock_irqsave(&trans_pcie->irq_lock, flags);
 
         /* Ack/clear/reset pending uCode interrupts.
@@ -593,7 +587,7 @@ void iwl_irq_tasklet(struct iwl_trans *trans)
          * interrupt coalescing can still be achieved.
          */
         iwl_write32(trans, CSR_INT,
-                trans_pcie->inta | ~trans_pcie->inta_mask);
+                    trans_pcie->inta | ~trans_pcie->inta_mask);
 
         inta = trans_pcie->inta;
 
@@ -602,7 +596,7 @@ void iwl_irq_tasklet(struct iwl_trans *trans)
                 /* just for debug */
                 inta_mask = iwl_read32(trans, CSR_INT_MASK);
                 IWL_DEBUG_ISR(trans, "inta 0x%08x, enabled 0x%08x\n",
-                                inta, inta_mask);
+                              inta, inta_mask);
         }
 #endif
 
@@ -651,7 +645,7 @@ void iwl_irq_tasklet(struct iwl_trans *trans)
 
                 hw_rfkill = iwl_is_rfkill_set(trans);
                 IWL_WARN(trans, "RF_KILL bit toggled to %s.\n",
-                                hw_rfkill ? "disable radio" : "enable radio");
+                         hw_rfkill ? "disable radio" : "enable radio");
 
                 isr_stats->rfkill++;
 
@@ -693,7 +687,7 @@ void iwl_irq_tasklet(struct iwl_trans *trans)
          * Rx "responses" (frame-received notification), and other
          * notifications from uCode come through here*/
         if (inta & (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX |
-                        CSR_INT_BIT_RX_PERIODIC)) {
+                    CSR_INT_BIT_RX_PERIODIC)) {
                 IWL_DEBUG_ISR(trans, "Rx interrupt\n");
                 if (inta & (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX)) {
                         handled |= (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX);
@@ -733,7 +727,7 @@ void iwl_irq_tasklet(struct iwl_trans *trans)
                  */
                 if (inta & (CSR_INT_BIT_FH_RX | CSR_INT_BIT_SW_RX))
                         iwl_write8(trans, CSR_INT_PERIODIC_REG,
-                                    CSR_INT_PERIODIC_ENA);
+                                   CSR_INT_PERIODIC_ENA);
 
                 isr_stats->rx++;
         }
@@ -782,8 +776,7 @@ void iwl_irq_tasklet(struct iwl_trans *trans)
 /* Free dram table */
 void iwl_free_isr_ict(struct iwl_trans *trans)
 {
-        struct iwl_trans_pcie *trans_pcie =
-                IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
 
         if (trans_pcie->ict_tbl) {
                 dma_free_coherent(trans->dev, ICT_SIZE,
@@ -802,8 +795,7 @@ void iwl_free_isr_ict(struct iwl_trans *trans)
  */
 int iwl_alloc_isr_ict(struct iwl_trans *trans)
 {
-        struct iwl_trans_pcie *trans_pcie =
-                IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
 
         trans_pcie->ict_tbl =
                 dma_alloc_coherent(trans->dev, ICT_SIZE,
@@ -837,10 +829,9 @@ int iwl_alloc_isr_ict(struct iwl_trans *trans)
  */
 void iwl_reset_ict(struct iwl_trans *trans)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         u32 val;
         unsigned long flags;
-        struct iwl_trans_pcie *trans_pcie =
-                IWL_TRANS_GET_PCIE_TRANS(trans);
 
         if (!trans_pcie->ict_tbl)
                 return;
@@ -868,9 +859,7 @@ void iwl_reset_ict(struct iwl_trans *trans)
 /* Device is going down disable ict interrupt usage */
 void iwl_disable_ict(struct iwl_trans *trans)
 {
-        struct iwl_trans_pcie *trans_pcie =
-                IWL_TRANS_GET_PCIE_TRANS(trans);
-
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         unsigned long flags;
 
         spin_lock_irqsave(&trans_pcie->irq_lock, flags);
@@ -934,7 +923,7 @@ static irqreturn_t iwl_isr(int irq, void *data)
         if (likely(inta))
                 tasklet_schedule(&trans_pcie->irq_tasklet);
         else if (test_bit(STATUS_INT_ENABLED, &trans_pcie->status) &&
-                        !trans_pcie->inta)
+                 !trans_pcie->inta)
                 iwl_enable_interrupts(trans);
 
  unplugged:
@@ -945,7 +934,7 @@ static irqreturn_t iwl_isr(int irq, void *data)
         /* re-enable interrupts here since we don't have anything to service. */
         /* only Re-enable if disabled by irq  and no schedules tasklet. */
         if (test_bit(STATUS_INT_ENABLED, &trans_pcie->status) &&
-                !trans_pcie->inta)
+            !trans_pcie->inta)
                 iwl_enable_interrupts(trans);
 
         spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
@@ -1036,7 +1025,7 @@ irqreturn_t iwl_isr_ict(int irq, void *data)
 
         inta = (0xff & val) | ((0xff00 & val) << 16);
         IWL_DEBUG_ISR(trans, "ISR inta 0x%08x, enabled 0x%08x ict 0x%08x\n",
-                        inta, inta_mask, val);
+                      inta, inta_mask, val);
 
         inta &= trans_pcie->inta_mask;
         trans_pcie->inta |= inta;
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 79c6b91417f9..cc935168ae52 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -70,15 +70,12 @@
 
 #include "iwl-drv.h"
 #include "iwl-trans.h"
-#include "iwl-trans-pcie-int.h"
 #include "iwl-csr.h"
 #include "iwl-prph.h"
-#include "iwl-eeprom.h"
 #include "iwl-agn-hw.h"
+#include "internal.h"
 /* FIXME: need to abstract out TX command (once we know what it looks like) */
-#include "iwl-commands.h"
-
-#define IWL_MASK(lo, hi) ((1 << (hi)) | ((1 << (hi)) - (1 << (lo))))
+#include "dvm/commands.h"
 
 #define SCD_QUEUECHAIN_SEL_ALL(trans, trans_pcie)       \
         (((1<<trans->cfg->base_params->num_of_queues) - 1) &\
@@ -86,8 +83,7 @@
 
 static int iwl_trans_rx_alloc(struct iwl_trans *trans)
 {
-        struct iwl_trans_pcie *trans_pcie =
-                IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_rx_queue *rxq = &trans_pcie->rxq;
         struct device *dev = trans->dev;
 
@@ -114,7 +110,7 @@ static int iwl_trans_rx_alloc(struct iwl_trans *trans)
 
 err_rb_stts:
         dma_free_coherent(dev, sizeof(__le32) * RX_QUEUE_SIZE,
-                        rxq->bd, rxq->bd_dma);
+                          rxq->bd, rxq->bd_dma);
         memset(&rxq->bd_dma, 0, sizeof(rxq->bd_dma));
         rxq->bd = NULL;
 err_bd:
@@ -123,8 +119,7 @@ err_bd:
 
 static void iwl_trans_rxq_free_rx_bufs(struct iwl_trans *trans)
 {
-        struct iwl_trans_pcie *trans_pcie =
-                IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_rx_queue *rxq = &trans_pcie->rxq;
         int i;
 
@@ -134,8 +129,8 @@ static void iwl_trans_rxq_free_rx_bufs(struct iwl_trans *trans)
                  * to an SKB, so we need to unmap and free potential storage */
                 if (rxq->pool[i].page != NULL) {
                         dma_unmap_page(trans->dev, rxq->pool[i].page_dma,
-                                PAGE_SIZE << trans_pcie->rx_page_order,
-                                DMA_FROM_DEVICE);
+                                       PAGE_SIZE << trans_pcie->rx_page_order,
+                                       DMA_FROM_DEVICE);
                         __free_pages(rxq->pool[i].page,
                                      trans_pcie->rx_page_order);
                         rxq->pool[i].page = NULL;
@@ -193,8 +188,7 @@ static void iwl_trans_rx_hw_init(struct iwl_trans *trans,
 
 static int iwl_rx_init(struct iwl_trans *trans)
 {
-        struct iwl_trans_pcie *trans_pcie =
-                IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_rx_queue *rxq = &trans_pcie->rxq;
 
         int i, err;
@@ -236,10 +230,8 @@ static int iwl_rx_init(struct iwl_trans *trans)
 
 static void iwl_trans_pcie_rx_free(struct iwl_trans *trans)
 {
-        struct iwl_trans_pcie *trans_pcie =
-                IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_rx_queue *rxq = &trans_pcie->rxq;
-
         unsigned long flags;
 
         /*if rxq->bd is NULL, it means that nothing has been allocated,
@@ -274,11 +266,11 @@ static int iwl_trans_rx_stop(struct iwl_trans *trans)
         /* stop Rx DMA */
         iwl_write_direct32(trans, FH_MEM_RCSR_CHNL0_CONFIG_REG, 0);
         return iwl_poll_direct_bit(trans, FH_MEM_RSSR_RX_STATUS_REG,
-                            FH_RSSR_CHNL0_RX_STATUS_CHNL_IDLE, 1000);
+                                   FH_RSSR_CHNL0_RX_STATUS_CHNL_IDLE, 1000);
 }
 
-static inline int iwlagn_alloc_dma_ptr(struct iwl_trans *trans,
-                                    struct iwl_dma_ptr *ptr, size_t size)
+static int iwlagn_alloc_dma_ptr(struct iwl_trans *trans,
+                                struct iwl_dma_ptr *ptr, size_t size)
 {
         if (WARN_ON(ptr->addr))
                 return -EINVAL;
@@ -291,8 +283,8 @@ static inline int iwlagn_alloc_dma_ptr(struct iwl_trans *trans,
         return 0;
 }
 
-static inline void iwlagn_free_dma_ptr(struct iwl_trans *trans,
-                                    struct iwl_dma_ptr *ptr)
+static void iwlagn_free_dma_ptr(struct iwl_trans *trans,
+                                struct iwl_dma_ptr *ptr)
 {
         if (unlikely(!ptr->addr))
                 return;
@@ -306,6 +298,10 @@ static void iwl_trans_pcie_queue_stuck_timer(unsigned long data)
         struct iwl_tx_queue *txq = (void *)data;
         struct iwl_trans_pcie *trans_pcie = txq->trans_pcie;
         struct iwl_trans *trans = iwl_trans_pcie_get_trans(trans_pcie);
+        u32 scd_sram_addr = trans_pcie->scd_base_addr +
+                SCD_TX_STTS_MEM_LOWER_BOUND + (16 * txq->q.id);
+        u8 buf[16];
+        int i;
 
         spin_lock(&txq->lock);
         /* check if triggered erroneously */
@@ -315,26 +311,51 @@ static void iwl_trans_pcie_queue_stuck_timer(unsigned long data)
         }
         spin_unlock(&txq->lock);
 
-
         IWL_ERR(trans, "Queue %d stuck for %u ms.\n", txq->q.id,
                 jiffies_to_msecs(trans_pcie->wd_timeout));
         IWL_ERR(trans, "Current SW read_ptr %d write_ptr %d\n",
                 txq->q.read_ptr, txq->q.write_ptr);
-        IWL_ERR(trans, "Current HW read_ptr %d write_ptr %d\n",
-                iwl_read_prph(trans, SCD_QUEUE_RDPTR(txq->q.id))
-                                        & (TFD_QUEUE_SIZE_MAX - 1),
-                iwl_read_prph(trans, SCD_QUEUE_WRPTR(txq->q.id)));
+
+        iwl_read_targ_mem_bytes(trans, scd_sram_addr, buf, sizeof(buf));
+
+        iwl_print_hex_error(trans, buf, sizeof(buf));
+
+        for (i = 0; i < FH_TCSR_CHNL_NUM; i++)
+                IWL_ERR(trans, "FH TRBs(%d) = 0x%08x\n", i,
+                        iwl_read_direct32(trans, FH_TX_TRB_REG(i)));
+
+        for (i = 0; i < trans->cfg->base_params->num_of_queues; i++) {
+                u32 status = iwl_read_prph(trans, SCD_QUEUE_STATUS_BITS(i));
+                u8 fifo = (status >> SCD_QUEUE_STTS_REG_POS_TXF) & 0x7;
+                bool active = !!(status & BIT(SCD_QUEUE_STTS_REG_POS_ACTIVE));
+                u32 tbl_dw =
+                        iwl_read_targ_mem(trans,
+                                          trans_pcie->scd_base_addr +
+                                          SCD_TRANS_TBL_OFFSET_QUEUE(i));
+
+                if (i & 0x1)
+                        tbl_dw = (tbl_dw & 0xFFFF0000) >> 16;
+                else
+                        tbl_dw = tbl_dw & 0x0000FFFF;
+
+                IWL_ERR(trans,
+                        "Q %d is %sactive and mapped to fifo %d ra_tid 0x%04x [%d,%d]\n",
+                        i, active ? "" : "in", fifo, tbl_dw,
+                        iwl_read_prph(trans,
+                                      SCD_QUEUE_RDPTR(i)) & (txq->q.n_bd - 1),
+                        iwl_read_prph(trans, SCD_QUEUE_WRPTR(i)));
+        }
 
         iwl_op_mode_nic_error(trans->op_mode);
 }
 
 static int iwl_trans_txq_alloc(struct iwl_trans *trans,
-                                struct iwl_tx_queue *txq, int slots_num,
-                                u32 txq_id)
+                               struct iwl_tx_queue *txq, int slots_num,
+                               u32 txq_id)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         size_t tfd_sz = sizeof(struct iwl_tfd) * TFD_QUEUE_SIZE_MAX;
         int i;
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
 
         if (WARN_ON(txq->entries || txq->tfds))
                 return -EINVAL;
@@ -435,7 +456,7 @@ static void iwl_tx_queue_unmap(struct iwl_trans *trans, int txq_id)
 
         spin_lock_bh(&txq->lock);
         while (q->write_ptr != q->read_ptr) {
-                iwlagn_txq_free_tfd(trans, txq, dma_dir);
+                iwl_txq_free_tfd(trans, txq, dma_dir);
                 q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd);
         }
         spin_unlock_bh(&txq->lock);
@@ -455,6 +476,7 @@ static void iwl_tx_queue_free(struct iwl_trans *trans, int txq_id)
         struct iwl_tx_queue *txq = &trans_pcie->txq[txq_id];
         struct device *dev = trans->dev;
         int i;
+
         if (WARN_ON(!txq))
                 return;
 
@@ -574,11 +596,11 @@ error:
 }
 static int iwl_tx_init(struct iwl_trans *trans)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         int ret;
         int txq_id, slots_num;
         unsigned long flags;
         bool alloc = false;
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
 
         if (!trans_pcie->txq) {
                 ret = iwl_trans_tx_alloc(trans);
@@ -643,10 +665,9 @@ static void iwl_set_pwr_vmain(struct iwl_trans *trans)
 
 static u16 iwl_pciexp_link_ctrl(struct iwl_trans *trans)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         int pos;
         u16 pci_lnk_ctl;
-        struct iwl_trans_pcie *trans_pcie =
-                IWL_TRANS_GET_PCIE_TRANS(trans);
 
         struct pci_dev *pci_dev = trans_pcie->pci_dev;
 
@@ -700,14 +721,14 @@ static int iwl_apm_init(struct iwl_trans *trans)
 
         /* Disable L0S exit timer (platform NMI Work/Around) */
         iwl_set_bit(trans, CSR_GIO_CHICKEN_BITS,
-                          CSR_GIO_CHICKEN_BITS_REG_BIT_DIS_L0S_EXIT_TIMER);
+                    CSR_GIO_CHICKEN_BITS_REG_BIT_DIS_L0S_EXIT_TIMER);
 
         /*
          * Disable L0s without affecting L1;
          *  don't wait for ICH L0s (ICH bug W/A)
          */
         iwl_set_bit(trans, CSR_GIO_CHICKEN_BITS,
-                          CSR_GIO_CHICKEN_BITS_REG_BIT_L1A_NO_L0S_RX);
+                    CSR_GIO_CHICKEN_BITS_REG_BIT_L1A_NO_L0S_RX);
 
         /* Set FH wait threshold to maximum (HW error during stress W/A) */
         iwl_set_bit(trans, CSR_DBG_HPET_MEM_REG, CSR_DBG_HPET_MEM_REG_VAL);
@@ -717,7 +738,7 @@ static int iwl_apm_init(struct iwl_trans *trans)
          * wake device's PCI Express link L1a -> L0s
          */
         iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
-                                    CSR_HW_IF_CONFIG_REG_BIT_HAP_WAKE_L1A);
+                    CSR_HW_IF_CONFIG_REG_BIT_HAP_WAKE_L1A);
 
         iwl_apm_config(trans);
 
@@ -738,8 +759,8 @@ static int iwl_apm_init(struct iwl_trans *trans)
          * and accesses to uCode SRAM.
          */
         ret = iwl_poll_bit(trans, CSR_GP_CNTRL,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
+                           CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
+                           CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
         if (ret < 0) {
                 IWL_DEBUG_INFO(trans, "Failed to init the card\n");
                 goto out;
@@ -773,8 +794,8 @@ static int iwl_apm_stop_master(struct iwl_trans *trans)
         iwl_set_bit(trans, CSR_RESET, CSR_RESET_REG_FLAG_STOP_MASTER);
 
         ret = iwl_poll_bit(trans, CSR_RESET,
-                        CSR_RESET_REG_FLAG_MASTER_DISABLED,
-                        CSR_RESET_REG_FLAG_MASTER_DISABLED, 100);
+                           CSR_RESET_REG_FLAG_MASTER_DISABLED,
+                           CSR_RESET_REG_FLAG_MASTER_DISABLED, 100);
         if (ret)
                 IWL_WARN(trans, "Master Disable Timed Out, 100 usec\n");
 
@@ -816,8 +837,7 @@ static int iwl_nic_init(struct iwl_trans *trans)
         iwl_apm_init(trans);
 
         /* Set interrupt coalescing calibration timer to default (512 usecs) */
-        iwl_write8(trans, CSR_INT_COALESCING,
-                IWL_HOST_INT_CALIB_TIMEOUT_DEF);
+        iwl_write8(trans, CSR_INT_COALESCING, IWL_HOST_INT_CALIB_TIMEOUT_DEF);
 
         spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
 
@@ -836,8 +856,8 @@ static int iwl_nic_init(struct iwl_trans *trans)
 
         if (trans->cfg->base_params->shadow_reg_enable) {
                 /* enable shadow regs in HW */
-                iwl_set_bit(trans, CSR_MAC_SHADOW_REG_CTRL,
-                        0x800FFFFF);
+                iwl_set_bit(trans, CSR_MAC_SHADOW_REG_CTRL, 0x800FFFFF);
+                IWL_DEBUG_INFO(trans, "Enabling shadow registers in device\n");
         }
 
         return 0;
@@ -851,13 +871,13 @@ static int iwl_set_hw_ready(struct iwl_trans *trans)
         int ret;
 
         iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
-                CSR_HW_IF_CONFIG_REG_BIT_NIC_READY);
+                    CSR_HW_IF_CONFIG_REG_BIT_NIC_READY);
 
         /* See if we got it */
         ret = iwl_poll_bit(trans, CSR_HW_IF_CONFIG_REG,
-                                CSR_HW_IF_CONFIG_REG_BIT_NIC_READY,
-                                CSR_HW_IF_CONFIG_REG_BIT_NIC_READY,
-                                HW_READY_TIMEOUT);
+                           CSR_HW_IF_CONFIG_REG_BIT_NIC_READY,
+                           CSR_HW_IF_CONFIG_REG_BIT_NIC_READY,
+                           HW_READY_TIMEOUT);
 
         IWL_DEBUG_INFO(trans, "hardware%s ready\n", ret < 0 ? " not" : "");
         return ret;
@@ -877,11 +897,11 @@ static int iwl_prepare_card_hw(struct iwl_trans *trans)
 
         /* If HW is not ready, prepare the conditions to check again */
         iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
-                        CSR_HW_IF_CONFIG_REG_PREPARE);
+                    CSR_HW_IF_CONFIG_REG_PREPARE);
 
         ret = iwl_poll_bit(trans, CSR_HW_IF_CONFIG_REG,
-                        ~CSR_HW_IF_CONFIG_REG_BIT_NIC_PREPARE_DONE,
-                        CSR_HW_IF_CONFIG_REG_BIT_NIC_PREPARE_DONE, 150000);
+                           ~CSR_HW_IF_CONFIG_REG_BIT_NIC_PREPARE_DONE,
+                           CSR_HW_IF_CONFIG_REG_BIT_NIC_PREPARE_DONE, 150000);
 
         if (ret < 0)
                 return ret;
@@ -908,32 +928,33 @@ static int iwl_load_section(struct iwl_trans *trans, u8 section_num,
         trans_pcie->ucode_write_complete = false;
 
         iwl_write_direct32(trans,
-                FH_TCSR_CHNL_TX_CONFIG_REG(FH_SRVC_CHNL),
-                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_PAUSE);
+                           FH_TCSR_CHNL_TX_CONFIG_REG(FH_SRVC_CHNL),
+                           FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_PAUSE);
 
         iwl_write_direct32(trans,
-                FH_SRVC_CHNL_SRAM_ADDR_REG(FH_SRVC_CHNL), dst_addr);
+                           FH_SRVC_CHNL_SRAM_ADDR_REG(FH_SRVC_CHNL),
+                           dst_addr);
 
         iwl_write_direct32(trans,
                 FH_TFDIB_CTRL0_REG(FH_SRVC_CHNL),
                 phy_addr & FH_MEM_TFDIB_DRAM_ADDR_LSB_MSK);
 
         iwl_write_direct32(trans,
-                FH_TFDIB_CTRL1_REG(FH_SRVC_CHNL),
-                (iwl_get_dma_hi_addr(phy_addr)
-                        << FH_MEM_TFDIB_REG1_ADDR_BITSHIFT) | byte_cnt);
+                           FH_TFDIB_CTRL1_REG(FH_SRVC_CHNL),
+                           (iwl_get_dma_hi_addr(phy_addr)
+                                << FH_MEM_TFDIB_REG1_ADDR_BITSHIFT) | byte_cnt);
 
         iwl_write_direct32(trans,
-                FH_TCSR_CHNL_TX_BUF_STS_REG(FH_SRVC_CHNL),
-                1 << FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_NUM |
-                1 << FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_IDX |
-                FH_TCSR_CHNL_TX_BUF_STS_REG_VAL_TFDB_VALID);
+                           FH_TCSR_CHNL_TX_BUF_STS_REG(FH_SRVC_CHNL),
+                           1 << FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_NUM |
+                           1 << FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_IDX |
+                           FH_TCSR_CHNL_TX_BUF_STS_REG_VAL_TFDB_VALID);
 
         iwl_write_direct32(trans,
-                FH_TCSR_CHNL_TX_CONFIG_REG(FH_SRVC_CHNL),
-                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE       |
-                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_DISABLE    |
-                FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_HOST_ENDTFD);
+                           FH_TCSR_CHNL_TX_CONFIG_REG(FH_SRVC_CHNL),
+                           FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE    |
+                           FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_DISABLE |
+                           FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_HOST_ENDTFD);
 
         IWL_DEBUG_FW(trans, "[%d] uCode section being loaded...\n",
                      section_num);
@@ -1038,6 +1059,10 @@ static void iwl_tx_start(struct iwl_trans *trans)
 
         spin_lock_irqsave(&trans_pcie->irq_lock, flags);
 
+        /* make sure all queue are not stopped/used */
+        memset(trans_pcie->queue_stopped, 0, sizeof(trans_pcie->queue_stopped));
+        memset(trans_pcie->queue_used, 0, sizeof(trans_pcie->queue_used));
+
         trans_pcie->scd_base_addr =
                 iwl_read_prph(trans, SCD_SRAM_BASE_ADDR);
         a = trans_pcie->scd_base_addr + SCD_CONTEXT_MEM_LOWER_BOUND;
@@ -1063,64 +1088,32 @@ static void iwl_tx_start(struct iwl_trans *trans)
          */
         iwl_write_prph(trans, SCD_CHAINEXT_EN, 0);
 
+        for (i = 0; i < trans_pcie->n_q_to_fifo; i++) {
+                int fifo = trans_pcie->setup_q_to_fifo[i];
+
+                iwl_trans_pcie_txq_enable(trans, i, fifo, IWL_INVALID_STATION,
+                                          IWL_TID_NON_QOS, SCD_FRAME_LIMIT, 0);
+        }
+
+        /* Activate all Tx DMA/FIFO channels */
+        iwl_trans_txq_set_sched(trans, IWL_MASK(0, 7));
+
         /* Enable DMA channel */
         for (chan = 0; chan < FH_TCSR_CHNL_NUM ; chan++)
                 iwl_write_direct32(trans, FH_TCSR_CHNL_TX_CONFIG_REG(chan),
-                                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE |
-                                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_ENABLE);
+                                   FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE |
+                                   FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_ENABLE);
 
         /* Update FH chicken bits */
         reg_val = iwl_read_direct32(trans, FH_TX_CHICKEN_BITS_REG);
         iwl_write_direct32(trans, FH_TX_CHICKEN_BITS_REG,
                            reg_val | FH_TX_CHICKEN_BITS_SCD_AUTO_RETRY_EN);
 
-        iwl_write_prph(trans, SCD_QUEUECHAIN_SEL,
-                SCD_QUEUECHAIN_SEL_ALL(trans, trans_pcie));
-        iwl_write_prph(trans, SCD_AGGR_SEL, 0);
-
-        /* initiate the queues */
-        for (i = 0; i < trans->cfg->base_params->num_of_queues; i++) {
-                iwl_write_prph(trans, SCD_QUEUE_RDPTR(i), 0);
-                iwl_write_direct32(trans, HBUS_TARG_WRPTR, 0 | (i << 8));
-                iwl_write_targ_mem(trans, trans_pcie->scd_base_addr +
-                                SCD_CONTEXT_QUEUE_OFFSET(i), 0);
-                iwl_write_targ_mem(trans, trans_pcie->scd_base_addr +
-                                SCD_CONTEXT_QUEUE_OFFSET(i) +
-                                sizeof(u32),
-                                ((SCD_WIN_SIZE <<
-                                SCD_QUEUE_CTX_REG2_WIN_SIZE_POS) &
-                                SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK) |
-                                ((SCD_FRAME_LIMIT <<
-                                SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS) &
-                                SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK));
-        }
-
-        iwl_write_prph(trans, SCD_INTERRUPT_MASK,
-                        IWL_MASK(0, trans->cfg->base_params->num_of_queues));
-
-        /* Activate all Tx DMA/FIFO channels */
-        iwl_trans_txq_set_sched(trans, IWL_MASK(0, 7));
-
-        iwl_trans_set_wr_ptrs(trans, trans_pcie->cmd_queue, 0);
-
-        /* make sure all queue are not stopped/used */
-        memset(trans_pcie->queue_stopped, 0, sizeof(trans_pcie->queue_stopped));
-        memset(trans_pcie->queue_used, 0, sizeof(trans_pcie->queue_used));
-
-        for (i = 0; i < trans_pcie->n_q_to_fifo; i++) {
-                int fifo = trans_pcie->setup_q_to_fifo[i];
-
-                set_bit(i, trans_pcie->queue_used);
-
-                iwl_trans_tx_queue_set_status(trans, &trans_pcie->txq[i],
-                                              fifo, true);
-        }
-
         spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
 
         /* Enable L1-Active */
         iwl_clear_bits_prph(trans, APMG_PCIDEV_STT_REG,
-                          APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
+                            APMG_PCIDEV_STT_VAL_L1_ACT_DIS);
 }
 
 static void iwl_trans_pcie_fw_alive(struct iwl_trans *trans)
@@ -1134,9 +1127,9 @@ static void iwl_trans_pcie_fw_alive(struct iwl_trans *trans)
  */
 static int iwl_trans_tx_stop(struct iwl_trans *trans)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         int ch, txq_id, ret;
         unsigned long flags;
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
 
         /* Turn off all Tx DMA fifos */
         spin_lock_irqsave(&trans_pcie->irq_lock, flags);
@@ -1148,13 +1141,13 @@ static int iwl_trans_tx_stop(struct iwl_trans *trans)
                 iwl_write_direct32(trans,
                                    FH_TCSR_CHNL_TX_CONFIG_REG(ch), 0x0);
                 ret = iwl_poll_direct_bit(trans, FH_TSSR_TX_STATUS_REG,
-                                    FH_TSSR_TX_STATUS_REG_MSK_CHNL_IDLE(ch),
-                                    1000);
+                        FH_TSSR_TX_STATUS_REG_MSK_CHNL_IDLE(ch), 1000);
                 if (ret < 0)
-                        IWL_ERR(trans, "Failing on timeout while stopping"
-                            " DMA channel %d [0x%08x]", ch,
-                            iwl_read_direct32(trans,
-                                              FH_TSSR_TX_STATUS_REG));
+                        IWL_ERR(trans,
+                                "Failing on timeout while stopping DMA channel %d [0x%08x]",
+                                ch,
+                                iwl_read_direct32(trans,
+                                                  FH_TSSR_TX_STATUS_REG));
         }
         spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
 
@@ -1173,8 +1166,8 @@ static int iwl_trans_tx_stop(struct iwl_trans *trans)
 
 static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
 {
-        unsigned long flags;
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        unsigned long flags;
 
         /* tell the device to stop sending interrupts */
         spin_lock_irqsave(&trans_pcie->irq_lock, flags);
@@ -1204,7 +1197,7 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
 
         /* Make sure (redundant) we've released our request to stay awake */
         iwl_clear_bit(trans, CSR_GP_CNTRL,
-                        CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
+                      CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
 
         /* Stop the device, and put it in low power state */
         iwl_apm_stop(trans);
@@ -1273,13 +1266,27 @@ static int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
 
         spin_lock(&txq->lock);
 
+        /* In AGG mode, the index in the ring must correspond to the WiFi
+         * sequence number. This is a HW requirements to help the SCD to parse
+         * the BA.
+         * Check here that the packets are in the right place on the ring.
+         */
+#ifdef CONFIG_IWLWIFI_DEBUG
+        wifi_seq = SEQ_TO_SN(le16_to_cpu(hdr->seq_ctrl));
+        WARN_ONCE((iwl_read_prph(trans, SCD_AGGR_SEL) & BIT(txq_id)) &&
+                  ((wifi_seq & 0xff) != q->write_ptr),
+                  "Q: %d WiFi Seq %d tfdNum %d",
+                  txq_id, wifi_seq, q->write_ptr);
+#endif
+
         /* Set up driver data for this TFD */
         txq->entries[q->write_ptr].skb = skb;
         txq->entries[q->write_ptr].cmd = dev_cmd;
 
         dev_cmd->hdr.cmd = REPLY_TX;
-        dev_cmd->hdr.sequence = cpu_to_le16((u16)(QUEUE_TO_SEQ(txq_id) |
-                                INDEX_TO_SEQ(q->write_ptr)));
+        dev_cmd->hdr.sequence =
+                cpu_to_le16((u16)(QUEUE_TO_SEQ(txq_id) |
+                            INDEX_TO_SEQ(q->write_ptr)));
 
         /* Set up first empty entry in queue's array of Tx/cmd buffers */
         out_meta = &txq->entries[q->write_ptr].meta;
@@ -1344,7 +1351,7 @@ static int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
 
         /* take back ownership of DMA buffer to enable update */
         dma_sync_single_for_cpu(trans->dev, txcmd_phys, firstlen,
-                        DMA_BIDIRECTIONAL);
+                                DMA_BIDIRECTIONAL);
         tx_cmd->dram_lsb_ptr = cpu_to_le32(scratch_phys);
         tx_cmd->dram_msb_ptr = iwl_get_dma_hi_addr(scratch_phys);
 
@@ -1356,7 +1363,7 @@ static int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
         iwl_trans_txq_update_byte_cnt_tbl(trans, txq, le16_to_cpu(tx_cmd->len));
 
         dma_sync_single_for_device(trans->dev, txcmd_phys, firstlen,
-                        DMA_BIDIRECTIONAL);
+                                   DMA_BIDIRECTIONAL);
 
         trace_iwlwifi_dev_tx(trans->dev,
                              &((struct iwl_tfd *)txq->tfds)[txq->q.write_ptr],
@@ -1365,7 +1372,8 @@ static int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
                              skb->data + hdr_len, secondlen);
 
         /* start timer if queue currently empty */
-        if (q->read_ptr == q->write_ptr && trans_pcie->wd_timeout)
+        if (txq->need_update && q->read_ptr == q->write_ptr &&
+            trans_pcie->wd_timeout)
                 mod_timer(&txq->stuck_timer, jiffies + trans_pcie->wd_timeout);
 
         /* Tell device the write index *just past* this latest filled TFD */
@@ -1395,8 +1403,7 @@ static int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
 
 static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
 {
-        struct iwl_trans_pcie *trans_pcie =
-                IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         int err;
         bool hw_rfkill;
 
@@ -1409,7 +1416,7 @@ static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
                 iwl_alloc_isr_ict(trans);
 
                 err = request_irq(trans_pcie->irq, iwl_isr_ict, IRQF_SHARED,
-                        DRV_NAME, trans);
+                                  DRV_NAME, trans);
                 if (err) {
                         IWL_ERR(trans, "Error allocating IRQ %d\n",
                                 trans_pcie->irq);
@@ -1447,9 +1454,9 @@ error:
 static void iwl_trans_pcie_stop_hw(struct iwl_trans *trans,
                                    bool op_mode_leaving)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         bool hw_rfkill;
         unsigned long flags;
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
 
         iwl_apm_stop(trans);
 
@@ -1553,8 +1560,7 @@ static void iwl_trans_pcie_configure(struct iwl_trans *trans,
 
 void iwl_trans_pcie_free(struct iwl_trans *trans)
 {
-        struct iwl_trans_pcie *trans_pcie =
-                IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
 
         iwl_trans_pcie_tx_free(trans);
 #ifndef CONFIG_IWLWIFI_IDI
@@ -1569,6 +1575,7 @@ void iwl_trans_pcie_free(struct iwl_trans *trans)
         iounmap(trans_pcie->hw_base);
         pci_release_regions(trans_pcie->pci_dev);
         pci_disable_device(trans_pcie->pci_dev);
+        kmem_cache_destroy(trans->dev_cmd_pool);
 
         kfree(trans);
 }
@@ -1816,8 +1823,8 @@ static const struct file_operations iwl_dbgfs_##name##_ops = {		\
 };
 
 static ssize_t iwl_dbgfs_tx_queue_read(struct file *file,
-                                                char __user *user_buf,
-                                                size_t count, loff_t *ppos)
+                                       char __user *user_buf,
+                                       size_t count, loff_t *ppos)
 {
         struct iwl_trans *trans = file->private_data;
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
@@ -1853,11 +1860,11 @@ static ssize_t iwl_dbgfs_tx_queue_read(struct file *file,
 }
 
 static ssize_t iwl_dbgfs_rx_queue_read(struct file *file,
-                                                char __user *user_buf,
-                                                size_t count, loff_t *ppos) {
+                                       char __user *user_buf,
+                                       size_t count, loff_t *ppos)
+{
         struct iwl_trans *trans = file->private_data;
-        struct iwl_trans_pcie *trans_pcie =
-                IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_rx_queue *rxq = &trans_pcie->rxq;
         char buf[256];
         int pos = 0;
@@ -1881,11 +1888,10 @@ static ssize_t iwl_dbgfs_rx_queue_read(struct file *file,
 
 static ssize_t iwl_dbgfs_interrupt_read(struct file *file,
                                         char __user *user_buf,
-                                        size_t count, loff_t *ppos) {
-
+                                        size_t count, loff_t *ppos)
+{
         struct iwl_trans *trans = file->private_data;
-        struct iwl_trans_pcie *trans_pcie =
-                IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct isr_statistics *isr_stats = &trans_pcie->isr_stats;
 
         int pos = 0;
@@ -1943,8 +1949,7 @@ static ssize_t iwl_dbgfs_interrupt_write(struct file *file,
                                          size_t count, loff_t *ppos)
 {
         struct iwl_trans *trans = file->private_data;
-        struct iwl_trans_pcie *trans_pcie =
-                IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct isr_statistics *isr_stats = &trans_pcie->isr_stats;
 
         char buf[8];
@@ -1964,8 +1969,8 @@ static ssize_t iwl_dbgfs_interrupt_write(struct file *file,
 }
 
 static ssize_t iwl_dbgfs_csr_write(struct file *file,
-                                         const char __user *user_buf,
-                                         size_t count, loff_t *ppos)
+                                   const char __user *user_buf,
+                                   size_t count, loff_t *ppos)
 {
         struct iwl_trans *trans = file->private_data;
         char buf[8];
@@ -1985,8 +1990,8 @@ static ssize_t iwl_dbgfs_csr_write(struct file *file,
 }
 
 static ssize_t iwl_dbgfs_fh_reg_read(struct file *file,
-                                         char __user *user_buf,
-                                         size_t count, loff_t *ppos)
+                                     char __user *user_buf,
+                                     size_t count, loff_t *ppos)
 {
         struct iwl_trans *trans = file->private_data;
         char *buf;
@@ -2029,7 +2034,7 @@ DEBUGFS_WRITE_FILE_OPS(fw_restart);
  *
  */
 static int iwl_trans_pcie_dbgfs_register(struct iwl_trans *trans,
-                                        struct dentry *dir)
+                                         struct dentry *dir)
 {
         DEBUGFS_ADD_FILE(rx_queue, dir, S_IRUSR);
         DEBUGFS_ADD_FILE(tx_queue, dir, S_IRUSR);
@@ -2041,9 +2046,10 @@ static int iwl_trans_pcie_dbgfs_register(struct iwl_trans *trans,
 }
 #else
 static int iwl_trans_pcie_dbgfs_register(struct iwl_trans *trans,
-                                        struct dentry *dir)
-{ return 0; }
-
+                                         struct dentry *dir)
+{
+        return 0;
+}
 #endif /*CONFIG_IWLWIFI_DEBUGFS */
 
 static const struct iwl_trans_ops trans_ops_pcie = {
@@ -2060,8 +2066,8 @@ static const struct iwl_trans_ops trans_ops_pcie = {
         .tx = iwl_trans_pcie_tx,
         .reclaim = iwl_trans_pcie_reclaim,
 
-        .tx_agg_disable = iwl_trans_pcie_tx_agg_disable,
-        .tx_agg_setup = iwl_trans_pcie_tx_agg_setup,
+        .txq_disable = iwl_trans_pcie_txq_disable,
+        .txq_enable = iwl_trans_pcie_txq_enable,
 
         .dbgfs_register = iwl_trans_pcie_dbgfs_register,
 
@@ -2084,11 +2090,12 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
 {
         struct iwl_trans_pcie *trans_pcie;
         struct iwl_trans *trans;
+        char cmd_pool_name[100];
         u16 pci_cmd;
         int err;
 
         trans = kzalloc(sizeof(struct iwl_trans) +
-                             sizeof(struct iwl_trans_pcie), GFP_KERNEL);
+                        sizeof(struct iwl_trans_pcie), GFP_KERNEL);
 
         if (WARN_ON(!trans))
                 return NULL;
@@ -2104,7 +2111,7 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
         /* W/A - seems to solve weird behavior. We need to remove this if we
          * don't want to stay in L1 all the time. This wastes a lot of power */
         pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1 |
-                                PCIE_LINK_STATE_CLKPM);
+                               PCIE_LINK_STATE_CLKPM);
 
         if (pci_enable_device(pdev)) {
                 err = -ENODEV;
@@ -2120,7 +2127,7 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
                 err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
                 if (!err)
                         err = pci_set_consistent_dma_mask(pdev,
-                                                        DMA_BIT_MASK(32));
+                                                          DMA_BIT_MASK(32));
                 /* both attempts failed: */
                 if (err) {
                         dev_printk(KERN_ERR, &pdev->dev,
@@ -2143,13 +2150,13 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
         }
 
         dev_printk(KERN_INFO, &pdev->dev,
-                "pci_resource_len = 0x%08llx\n",
-                (unsigned long long) pci_resource_len(pdev, 0));
+                   "pci_resource_len = 0x%08llx\n",
+                   (unsigned long long) pci_resource_len(pdev, 0));
         dev_printk(KERN_INFO, &pdev->dev,
-                "pci_resource_base = %p\n", trans_pcie->hw_base);
+                   "pci_resource_base = %p\n", trans_pcie->hw_base);
 
         dev_printk(KERN_INFO, &pdev->dev,
-                "HW Revision ID = 0x%X\n", pdev->revision);
+                   "HW Revision ID = 0x%X\n", pdev->revision);
 
         /* We disable the RETRY_TIMEOUT register (0x41) to keep
          * PCI Tx retries from interfering with C3 CPU state */
@@ -2158,7 +2165,7 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
         err = pci_enable_msi(pdev);
         if (err)
                 dev_printk(KERN_ERR, &pdev->dev,
-                        "pci_enable_msi failed(0X%x)", err);
+                           "pci_enable_msi failed(0X%x)", err);
 
         trans->dev = &pdev->dev;
         trans_pcie->irq = pdev->irq;
@@ -2180,8 +2187,25 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
         init_waitqueue_head(&trans->wait_command_queue);
         spin_lock_init(&trans->reg_lock);
 
+        snprintf(cmd_pool_name, sizeof(cmd_pool_name), "iwl_cmd_pool:%s",
+                 dev_name(trans->dev));
+
+        trans->dev_cmd_headroom = 0;
+        trans->dev_cmd_pool =
+                kmem_cache_create(cmd_pool_name,
+                                  sizeof(struct iwl_device_cmd)
+                                  + trans->dev_cmd_headroom,
+                                  sizeof(void *),
+                                  SLAB_HWCACHE_ALIGN,
+                                  NULL);
+
+        if (!trans->dev_cmd_pool)
+                goto out_pci_disable_msi;
+
         return trans;
 
+out_pci_disable_msi:
+        pci_disable_msi(pdev);
 out_pci_release_regions:
         pci_release_regions(pdev);
 out_pci_disable_device:
@@ -2190,4 +2214,3 @@ out_no_pci:
         kfree(trans);
         return NULL;
 }
-
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index a8750238ee09..6baf8deef519 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -34,11 +34,10 @@
 #include "iwl-csr.h"
 #include "iwl-prph.h"
 #include "iwl-io.h"
-#include "iwl-agn-hw.h"
 #include "iwl-op-mode.h"
-#include "iwl-trans-pcie-int.h"
+#include "internal.h"
 /* FIXME: need to abstract out TX command (once we know what it looks like) */
-#include "iwl-commands.h"
+#include "dvm/commands.h"
 
 #define IWL_TX_CRC_SIZE 4
 #define IWL_TX_DELIMITER_SIZE 4
@@ -47,12 +46,11 @@
  * iwl_trans_txq_update_byte_cnt_tbl - Set up entry in Tx byte-count array
  */
 void iwl_trans_txq_update_byte_cnt_tbl(struct iwl_trans *trans,
-                                           struct iwl_tx_queue *txq,
-                                           u16 byte_cnt)
+                                       struct iwl_tx_queue *txq,
+                                       u16 byte_cnt)
 {
         struct iwlagn_scd_bc_tbl *scd_bc_tbl;
-        struct iwl_trans_pcie *trans_pcie =
-                IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         int write_ptr = txq->q.write_ptr;
         int txq_id = txq->q.id;
         u8 sec_ctl = 0;
@@ -178,8 +176,8 @@ static inline u8 iwl_tfd_get_num_tbs(struct iwl_tfd *tfd)
         return tfd->num_tbs & 0x1f;
 }
 
-static void iwlagn_unmap_tfd(struct iwl_trans *trans, struct iwl_cmd_meta *meta,
-                     struct iwl_tfd *tfd, enum dma_data_direction dma_dir)
+static void iwl_unmap_tfd(struct iwl_trans *trans, struct iwl_cmd_meta *meta,
+                          struct iwl_tfd *tfd, enum dma_data_direction dma_dir)
 {
         int i;
         int num_tbs;
@@ -209,7 +207,7 @@ static void iwlagn_unmap_tfd(struct iwl_trans *trans, struct iwl_cmd_meta *meta,
 }
 
 /**
- * iwlagn_txq_free_tfd - Free all chunks referenced by TFD [txq->q.read_ptr]
+ * iwl_txq_free_tfd - Free all chunks referenced by TFD [txq->q.read_ptr]
  * @trans - transport private data
  * @txq - tx queue
  * @dma_dir - the direction of the DMA mapping
@@ -217,8 +215,8 @@ static void iwlagn_unmap_tfd(struct iwl_trans *trans, struct iwl_cmd_meta *meta,
  * Does NOT advance any TFD circular buffer read/write indexes
  * Does NOT free the TFD itself (which is within circular buffer)
  */
-void iwlagn_txq_free_tfd(struct iwl_trans *trans, struct iwl_tx_queue *txq,
-                         enum dma_data_direction dma_dir)
+void iwl_txq_free_tfd(struct iwl_trans *trans, struct iwl_tx_queue *txq,
+                      enum dma_data_direction dma_dir)
 {
         struct iwl_tfd *tfd_tmp = txq->tfds;
 
@@ -229,8 +227,8 @@ void iwlagn_txq_free_tfd(struct iwl_trans *trans, struct iwl_tx_queue *txq,
         lockdep_assert_held(&txq->lock);
 
         /* We have only q->n_window txq->entries, but we use q->n_bd tfds */
-        iwlagn_unmap_tfd(trans, &txq->entries[idx].meta,
-                         &tfd_tmp[rd_ptr], dma_dir);
+        iwl_unmap_tfd(trans, &txq->entries[idx].meta, &tfd_tmp[rd_ptr],
+                      dma_dir);
 
         /* free SKB */
         if (txq->entries) {
@@ -270,7 +268,7 @@ int iwlagn_txq_attach_buf_to_tfd(struct iwl_trans *trans,
         /* Each TFD can point to a maximum 20 Tx buffers */
         if (num_tbs >= IWL_NUM_OF_TBS) {
                 IWL_ERR(trans, "Error can not send more than %d chunks\n",
-                          IWL_NUM_OF_TBS);
+                        IWL_NUM_OF_TBS);
                 return -EINVAL;
         }
 
@@ -279,7 +277,7 @@ int iwlagn_txq_attach_buf_to_tfd(struct iwl_trans *trans,
 
         if (unlikely(addr & ~IWL_TX_DMA_MASK))
                 IWL_ERR(trans, "Unaligned address = %llx\n",
-                          (unsigned long long)addr);
+                        (unsigned long long)addr);
 
         iwl_tfd_set_tb(tfd, num_tbs, addr, len);
 
@@ -382,16 +380,14 @@ static void iwlagn_txq_inval_byte_cnt_tbl(struct iwl_trans *trans,
                         tfd_offset[TFD_QUEUE_SIZE_MAX + read_ptr] = bc_ent;
 }
 
-static int iwlagn_tx_queue_set_q2ratid(struct iwl_trans *trans, u16 ra_tid,
-                                        u16 txq_id)
+static int iwl_txq_set_ratid_map(struct iwl_trans *trans, u16 ra_tid,
+                                 u16 txq_id)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         u32 tbl_dw_addr;
         u32 tbl_dw;
         u16 scd_q2ratid;
 
-        struct iwl_trans_pcie *trans_pcie =
-                IWL_TRANS_GET_PCIE_TRANS(trans);
-
         scd_q2ratid = ra_tid & SCD_QUEUE_RA_TID_MAP_RATID_MSK;
 
         tbl_dw_addr = trans_pcie->scd_base_addr +
@@ -409,7 +405,7 @@ static int iwlagn_tx_queue_set_q2ratid(struct iwl_trans *trans, u16 ra_tid,
         return 0;
 }
 
-static void iwlagn_tx_queue_stop_scheduler(struct iwl_trans *trans, u16 txq_id)
+static inline void iwl_txq_set_inactive(struct iwl_trans *trans, u16 txq_id)
 {
         /* Simply stop the queue, but don't change any configuration;
          * the SCD_ACT_EN bit is the write-enable mask for the ACTIVE bit. */
@@ -419,102 +415,87 @@ static void iwlagn_tx_queue_stop_scheduler(struct iwl_trans *trans, u16 txq_id)
                 (1 << SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN));
 }
 
-void iwl_trans_set_wr_ptrs(struct iwl_trans *trans,
-                                int txq_id, u32 index)
-{
-        IWL_DEBUG_TX_QUEUES(trans, "Q %d  WrPtr: %d\n", txq_id, index & 0xff);
-        iwl_write_direct32(trans, HBUS_TARG_WRPTR,
-                        (index & 0xff) | (txq_id << 8));
-        iwl_write_prph(trans, SCD_QUEUE_RDPTR(txq_id), index);
-}
-
-void iwl_trans_tx_queue_set_status(struct iwl_trans *trans,
-                                   struct iwl_tx_queue *txq,
-                                   int tx_fifo_id, bool active)
-{
-        int txq_id = txq->q.id;
-
-        iwl_write_prph(trans, SCD_QUEUE_STATUS_BITS(txq_id),
-                        (active << SCD_QUEUE_STTS_REG_POS_ACTIVE) |
-                        (tx_fifo_id << SCD_QUEUE_STTS_REG_POS_TXF) |
-                        (1 << SCD_QUEUE_STTS_REG_POS_WSL) |
-                        SCD_QUEUE_STTS_REG_MSK);
-
-        if (active)
-                IWL_DEBUG_TX_QUEUES(trans, "Activate queue %d on FIFO %d\n",
-                                    txq_id, tx_fifo_id);
-        else
-                IWL_DEBUG_TX_QUEUES(trans, "Deactivate queue %d\n", txq_id);
-}
-
-void iwl_trans_pcie_tx_agg_setup(struct iwl_trans *trans, int txq_id, int fifo,
-                                 int sta_id, int tid, int frame_limit, u16 ssn)
+void iwl_trans_pcie_txq_enable(struct iwl_trans *trans, int txq_id, int fifo,
+                               int sta_id, int tid, int frame_limit, u16 ssn)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        unsigned long flags;
-        u16 ra_tid = BUILD_RAxTID(sta_id, tid);
 
         if (test_and_set_bit(txq_id, trans_pcie->queue_used))
                 WARN_ONCE(1, "queue %d already used - expect issues", txq_id);
 
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
-
         /* Stop this Tx queue before configuring it */
-        iwlagn_tx_queue_stop_scheduler(trans, txq_id);
+        iwl_txq_set_inactive(trans, txq_id);
 
-        /* Map receiver-address / traffic-ID to this queue */
-        iwlagn_tx_queue_set_q2ratid(trans, ra_tid, txq_id);
+        /* Set this queue as a chain-building queue unless it is CMD queue */
+        if (txq_id != trans_pcie->cmd_queue)
+                iwl_set_bits_prph(trans, SCD_QUEUECHAIN_SEL, BIT(txq_id));
 
-        /* Set this queue as a chain-building queue */
-        iwl_set_bits_prph(trans, SCD_QUEUECHAIN_SEL, BIT(txq_id));
+        /* If this queue is mapped to a certain station: it is an AGG queue */
+        if (sta_id != IWL_INVALID_STATION) {
+                u16 ra_tid = BUILD_RAxTID(sta_id, tid);
 
-        /* enable aggregations for the queue */
-        iwl_set_bits_prph(trans, SCD_AGGR_SEL, BIT(txq_id));
+                /* Map receiver-address / traffic-ID to this queue */
+                iwl_txq_set_ratid_map(trans, ra_tid, txq_id);
+
+                /* enable aggregations for the queue */
+                iwl_set_bits_prph(trans, SCD_AGGR_SEL, BIT(txq_id));
+        } else {
+                /*
+                 * disable aggregations for the queue, this will also make the
+                 * ra_tid mapping configuration irrelevant since it is now a
+                 * non-AGG queue.
+                 */
+                iwl_clear_bits_prph(trans, SCD_AGGR_SEL, BIT(txq_id));
+        }
 
         /* Place first TFD at index corresponding to start sequence number.
          * Assumes that ssn_idx is valid (!= 0xFFF) */
         trans_pcie->txq[txq_id].q.read_ptr = (ssn & 0xff);
         trans_pcie->txq[txq_id].q.write_ptr = (ssn & 0xff);
-        iwl_trans_set_wr_ptrs(trans, txq_id, ssn);
+
+        iwl_write_direct32(trans, HBUS_TARG_WRPTR,
+                           (ssn & 0xff) | (txq_id << 8));
+        iwl_write_prph(trans, SCD_QUEUE_RDPTR(txq_id), ssn);
 
         /* Set up Tx window size and frame limit for this queue */
         iwl_write_targ_mem(trans, trans_pcie->scd_base_addr +
+                        SCD_CONTEXT_QUEUE_OFFSET(txq_id), 0);
+        iwl_write_targ_mem(trans, trans_pcie->scd_base_addr +
                         SCD_CONTEXT_QUEUE_OFFSET(txq_id) + sizeof(u32),
                         ((frame_limit << SCD_QUEUE_CTX_REG2_WIN_SIZE_POS) &
                                 SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK) |
                         ((frame_limit << SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS) &
                                 SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK));
 
-        iwl_set_bits_prph(trans, SCD_INTERRUPT_MASK, (1 << txq_id));
-
         /* Set up Status area in SRAM, map to Tx DMA/FIFO, activate the queue */
-        iwl_trans_tx_queue_set_status(trans, &trans_pcie->txq[txq_id],
-                                      fifo, true);
-
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+        iwl_write_prph(trans, SCD_QUEUE_STATUS_BITS(txq_id),
+                       (1 << SCD_QUEUE_STTS_REG_POS_ACTIVE) |
+                       (fifo << SCD_QUEUE_STTS_REG_POS_TXF) |
+                       (1 << SCD_QUEUE_STTS_REG_POS_WSL) |
+                       SCD_QUEUE_STTS_REG_MSK);
+        IWL_DEBUG_TX_QUEUES(trans, "Activate queue %d on FIFO %d WrPtr: %d\n",
+                            txq_id, fifo, ssn & 0xff);
 }
 
-void iwl_trans_pcie_tx_agg_disable(struct iwl_trans *trans, int txq_id)
+void iwl_trans_pcie_txq_disable(struct iwl_trans *trans, int txq_id)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        u16 rd_ptr, wr_ptr;
+        int n_bd = trans_pcie->txq[txq_id].q.n_bd;
 
         if (!test_and_clear_bit(txq_id, trans_pcie->queue_used)) {
                 WARN_ONCE(1, "queue %d not used", txq_id);
                 return;
         }
 
-        iwlagn_tx_queue_stop_scheduler(trans, txq_id);
-
-        iwl_clear_bits_prph(trans, SCD_AGGR_SEL, BIT(txq_id));
+        rd_ptr = iwl_read_prph(trans, SCD_QUEUE_RDPTR(txq_id)) & (n_bd - 1);
+        wr_ptr = iwl_read_prph(trans, SCD_QUEUE_WRPTR(txq_id));
 
-        trans_pcie->txq[txq_id].q.read_ptr = 0;
-        trans_pcie->txq[txq_id].q.write_ptr = 0;
-        iwl_trans_set_wr_ptrs(trans, txq_id, 0);
+        WARN_ONCE(rd_ptr != wr_ptr, "queue %d isn't empty: [%d,%d]",
+                  txq_id, rd_ptr, wr_ptr);
 
-        iwl_clear_bits_prph(trans, SCD_INTERRUPT_MASK, BIT(txq_id));
-
-        iwl_trans_tx_queue_set_status(trans, &trans_pcie->txq[txq_id],
-                                      0, false);
+        iwl_txq_set_inactive(trans, txq_id);
+        IWL_DEBUG_TX_QUEUES(trans, "Deactivate queue %d\n", txq_id);
 }
 
 /*************** HOST COMMAND QUEUE FUNCTIONS   *****/
@@ -615,13 +596,13 @@ static int iwl_enqueue_hcmd(struct iwl_trans *trans, struct iwl_host_cmd *cmd)
         }
 
         IWL_DEBUG_HC(trans,
-                "Sending command %s (#%x), seq: 0x%04X, %d bytes at %d[%d]:%d\n",
-                trans_pcie_get_cmd_string(trans_pcie, out_cmd->hdr.cmd),
-                out_cmd->hdr.cmd, le16_to_cpu(out_cmd->hdr.sequence), cmd_size,
-                q->write_ptr, idx, trans_pcie->cmd_queue);
+                     "Sending command %s (#%x), seq: 0x%04X, %d bytes at %d[%d]:%d\n",
+                     trans_pcie_get_cmd_string(trans_pcie, out_cmd->hdr.cmd),
+                     out_cmd->hdr.cmd, le16_to_cpu(out_cmd->hdr.sequence),
+                     cmd_size, q->write_ptr, idx, trans_pcie->cmd_queue);
 
         phys_addr = dma_map_single(trans->dev, &out_cmd->hdr, copy_size,
-                                DMA_BIDIRECTIONAL);
+                                   DMA_BIDIRECTIONAL);
         if (unlikely(dma_mapping_error(trans->dev, phys_addr))) {
                 idx = -ENOMEM;
                 goto out;
@@ -630,8 +611,7 @@ static int iwl_enqueue_hcmd(struct iwl_trans *trans, struct iwl_host_cmd *cmd)
         dma_unmap_addr_set(out_meta, mapping, phys_addr);
         dma_unmap_len_set(out_meta, len, copy_size);
 
-        iwlagn_txq_attach_buf_to_tfd(trans, txq,
-                                        phys_addr, copy_size, 1);
+        iwlagn_txq_attach_buf_to_tfd(trans, txq, phys_addr, copy_size, 1);
 #ifdef CONFIG_IWLWIFI_DEVICE_TRACING
         trace_bufs[0] = &out_cmd->hdr;
         trace_lens[0] = copy_size;
@@ -643,13 +623,12 @@ static int iwl_enqueue_hcmd(struct iwl_trans *trans, struct iwl_host_cmd *cmd)
                         continue;
                 if (!(cmd->dataflags[i] & IWL_HCMD_DFL_NOCOPY))
                         continue;
-                phys_addr = dma_map_single(trans->dev,
-                                           (void *)cmd->data[i],
+                phys_addr = dma_map_single(trans->dev, (void *)cmd->data[i],
                                            cmd->len[i], DMA_BIDIRECTIONAL);
                 if (dma_mapping_error(trans->dev, phys_addr)) {
-                        iwlagn_unmap_tfd(trans, out_meta,
-                                         &txq->tfds[q->write_ptr],
-                                         DMA_BIDIRECTIONAL);
+                        iwl_unmap_tfd(trans, out_meta,
+                                      &txq->tfds[q->write_ptr],
+                                      DMA_BIDIRECTIONAL);
                         idx = -ENOMEM;
                         goto out;
                 }
@@ -723,9 +702,10 @@ static void iwl_hcmd_queue_reclaim(struct iwl_trans *trans, int txq_id,
         lockdep_assert_held(&txq->lock);
 
         if ((idx >= q->n_bd) || (iwl_queue_used(q, idx) == 0)) {
-                IWL_ERR(trans, "%s: Read index for DMA queue txq id (%d), "
-                          "index %d is out of range [0-%d] %d %d.\n", __func__,
-                          txq_id, idx, q->n_bd, q->write_ptr, q->read_ptr);
+                IWL_ERR(trans,
+                        "%s: Read index for DMA queue txq id (%d), index %d is out of range [0-%d] %d %d.\n",
+                        __func__, txq_id, idx, q->n_bd,
+                        q->write_ptr, q->read_ptr);
                 return;
         }
 
@@ -733,8 +713,8 @@ static void iwl_hcmd_queue_reclaim(struct iwl_trans *trans, int txq_id,
              q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
 
                 if (nfreed++ > 0) {
-                        IWL_ERR(trans, "HCMD skipped: index (%d) %d %d\n", idx,
-                                        q->write_ptr, q->read_ptr);
+                        IWL_ERR(trans, "HCMD skipped: index (%d) %d %d\n",
+                                idx, q->write_ptr, q->read_ptr);
                         iwl_op_mode_nic_error(trans->op_mode);
                 }
 
@@ -771,9 +751,9 @@ void iwl_tx_cmd_complete(struct iwl_trans *trans, struct iwl_rx_cmd_buffer *rxb,
          * in the queue management code. */
         if (WARN(txq_id != trans_pcie->cmd_queue,
                  "wrong command queue %d (should be %d), sequence 0x%X readp=%d writep=%d\n",
-                  txq_id, trans_pcie->cmd_queue, sequence,
-                  trans_pcie->txq[trans_pcie->cmd_queue].q.read_ptr,
-                  trans_pcie->txq[trans_pcie->cmd_queue].q.write_ptr)) {
+                 txq_id, trans_pcie->cmd_queue, sequence,
+                 trans_pcie->txq[trans_pcie->cmd_queue].q.read_ptr,
+                 trans_pcie->txq[trans_pcie->cmd_queue].q.write_ptr)) {
                 iwl_print_hex_error(trans, pkt, 32);
                 return;
         }
@@ -784,8 +764,7 @@ void iwl_tx_cmd_complete(struct iwl_trans *trans, struct iwl_rx_cmd_buffer *rxb,
         cmd = txq->entries[cmd_index].cmd;
         meta = &txq->entries[cmd_index].meta;
 
-        iwlagn_unmap_tfd(trans, meta, &txq->tfds[index],
-                         DMA_BIDIRECTIONAL);
+        iwl_unmap_tfd(trans, meta, &txq->tfds[index], DMA_BIDIRECTIONAL);
 
         /* Input error checking is done when commands are added to queue. */
         if (meta->flags & CMD_WANT_SKB) {
@@ -870,8 +849,9 @@ static int iwl_send_cmd_sync(struct iwl_trans *trans, struct iwl_host_cmd *cmd)
         }
 
         ret = wait_event_timeout(trans->wait_command_queue,
-                        !test_bit(STATUS_HCMD_ACTIVE, &trans_pcie->status),
-                        HOST_COMPLETE_TIMEOUT);
+                                 !test_bit(STATUS_HCMD_ACTIVE,
+                                           &trans_pcie->status),
+                                 HOST_COMPLETE_TIMEOUT);
         if (!ret) {
                 if (test_bit(STATUS_HCMD_ACTIVE, &trans_pcie->status)) {
                         struct iwl_tx_queue *txq =
@@ -956,10 +936,10 @@ int iwl_tx_queue_reclaim(struct iwl_trans *trans, int txq_id, int index,
 
         if ((index >= q->n_bd) ||
            (iwl_queue_used(q, last_to_free) == 0)) {
-                IWL_ERR(trans, "%s: Read index for DMA queue txq id (%d), "
-                          "last_to_free %d is out of range [0-%d] %d %d.\n",
-                          __func__, txq_id, last_to_free, q->n_bd,
-                          q->write_ptr, q->read_ptr);
+                IWL_ERR(trans,
+                        "%s: Read index for DMA queue txq id (%d), last_to_free %d is out of range [0-%d] %d %d.\n",
+                        __func__, txq_id, last_to_free, q->n_bd,
+                        q->write_ptr, q->read_ptr);
                 return 0;
         }
 
@@ -979,7 +959,7 @@ int iwl_tx_queue_reclaim(struct iwl_trans *trans, int txq_id, int index,
 
                 iwlagn_txq_inval_byte_cnt_tbl(trans, txq);
 
-                iwlagn_txq_free_tfd(trans, txq, DMA_TO_DEVICE);
+                iwl_txq_free_tfd(trans, txq, DMA_TO_DEVICE);
                 freed++;
         }
 
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index 2fa879b015b6..f4a203049fb4 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -435,24 +435,40 @@ static int lbs_add_wpa_tlv(u8 *tlv, const u8 *ie, u8 ie_len)
  * Set Channel
  */
 
-static int lbs_cfg_set_channel(struct wiphy *wiphy,
-        struct net_device *netdev,
-        struct ieee80211_channel *channel,
-        enum nl80211_channel_type channel_type)
+static int lbs_cfg_set_monitor_channel(struct wiphy *wiphy,
+                                       struct ieee80211_channel *channel,
+                                       enum nl80211_channel_type channel_type)
 {
         struct lbs_private *priv = wiphy_priv(wiphy);
         int ret = -ENOTSUPP;
 
-        lbs_deb_enter_args(LBS_DEB_CFG80211, "iface %s freq %d, type %d",
-                           netdev_name(netdev), channel->center_freq, channel_type);
+        lbs_deb_enter_args(LBS_DEB_CFG80211, "freq %d, type %d",
+                           channel->center_freq, channel_type);
 
         if (channel_type != NL80211_CHAN_NO_HT)
                 goto out;
 
-        if (netdev == priv->mesh_dev)
-                ret = lbs_mesh_set_channel(priv, channel->hw_value);
-        else
-                ret = lbs_set_channel(priv, channel->hw_value);
+        ret = lbs_set_channel(priv, channel->hw_value);
+
+ out:
+        lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
+        return ret;
+}
+
+static int lbs_cfg_set_mesh_channel(struct wiphy *wiphy,
+                                    struct net_device *netdev,
+                                    struct ieee80211_channel *channel)
+{
+        struct lbs_private *priv = wiphy_priv(wiphy);
+        int ret = -ENOTSUPP;
+
+        lbs_deb_enter_args(LBS_DEB_CFG80211, "iface %s freq %d",
+                           netdev_name(netdev), channel->center_freq);
+
+        if (netdev != priv->mesh_dev)
+                goto out;
+
+        ret = lbs_mesh_set_channel(priv, channel->hw_value);
 
  out:
         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
@@ -2029,7 +2045,8 @@ static int lbs_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
  */
 
 static struct cfg80211_ops lbs_cfg80211_ops = {
-        .set_channel = lbs_cfg_set_channel,
+        .set_monitor_channel = lbs_cfg_set_monitor_channel,
+        .libertas_set_mesh_channel = lbs_cfg_set_mesh_channel,
         .scan = lbs_cfg_scan,
         .connect = lbs_cfg_connect,
         .disconnect = lbs_cfg_disconnect,
diff --git a/drivers/net/wireless/libertas/dev.h b/drivers/net/wireless/libertas/dev.h
index 672005430aca..60996ce89f77 100644
--- a/drivers/net/wireless/libertas/dev.h
+++ b/drivers/net/wireless/libertas/dev.h
@@ -58,6 +58,7 @@ struct lbs_private {
         uint16_t mesh_tlv;
         u8 mesh_ssid[IEEE80211_MAX_SSID_LEN + 1];
         u8 mesh_ssid_len;
+        u8 mesh_channel;
 #endif
 
         /* Debugfs */
diff --git a/drivers/net/wireless/libertas/mesh.c b/drivers/net/wireless/libertas/mesh.c
index e87c031b298f..97807751ebcf 100644
--- a/drivers/net/wireless/libertas/mesh.c
+++ b/drivers/net/wireless/libertas/mesh.c
@@ -131,16 +131,13 @@ static int lbs_mesh_config(struct lbs_private *priv, uint16_t action,
 
 int lbs_mesh_set_channel(struct lbs_private *priv, u8 channel)
 {
+        priv->mesh_channel = channel;
         return lbs_mesh_config(priv, CMD_ACT_MESH_CONFIG_START, channel);
 }
 
 static uint16_t lbs_mesh_get_channel(struct lbs_private *priv)
 {
-        struct wireless_dev *mesh_wdev = priv->mesh_dev->ieee80211_ptr;
-        if (mesh_wdev->channel)
-                return mesh_wdev->channel->hw_value;
-        else
-                return 1;
+        return priv->mesh_channel ?: 1;
 }
 
 /***************************************************************************
diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c
index c1cb004db913..0f18ef6a30c8 100644
--- a/drivers/net/wireless/mwifiex/init.c
+++ b/drivers/net/wireless/mwifiex/init.c
@@ -57,6 +57,68 @@ static int mwifiex_add_bss_prio_tbl(struct mwifiex_private *priv)
         return 0;
 }
 
+static void scan_delay_timer_fn(unsigned long data)
+{
+        struct mwifiex_private *priv = (struct mwifiex_private *)data;
+        struct mwifiex_adapter *adapter = priv->adapter;
+        struct cmd_ctrl_node *cmd_node, *tmp_node;
+        unsigned long flags;
+
+        if (!mwifiex_wmm_lists_empty(adapter)) {
+                if (adapter->scan_delay_cnt == MWIFIEX_MAX_SCAN_DELAY_CNT) {
+                        /*
+                         * Abort scan operation by cancelling all pending scan
+                         * command
+                         */
+                        spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);
+                        list_for_each_entry_safe(cmd_node, tmp_node,
+                                                 &adapter->scan_pending_q,
+                                                 list) {
+                                list_del(&cmd_node->list);
+                                cmd_node->wait_q_enabled = false;
+                                mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
+                        }
+                        spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
+                                               flags);
+
+                        spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
+                        adapter->scan_processing = false;
+                        spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock,
+                                               flags);
+
+                        if (priv->user_scan_cfg) {
+                                dev_dbg(priv->adapter->dev,
+                                        "info: %s: scan aborted\n", __func__);
+                                cfg80211_scan_done(priv->scan_request, 1);
+                                priv->scan_request = NULL;
+                                kfree(priv->user_scan_cfg);
+                                priv->user_scan_cfg = NULL;
+                        }
+                } else {
+                        /*
+                         * Tx data queue is still not empty, delay scan
+                         * operation further by 20msec.
+                         */
+                        mod_timer(&priv->scan_delay_timer, jiffies +
+                                  msecs_to_jiffies(MWIFIEX_SCAN_DELAY_MSEC));
+                        adapter->scan_delay_cnt++;
+                }
+        } else {
+                /*
+                 * Tx data queue is empty. Get scan command from scan_pending_q
+                 * and put to cmd_pending_q to resume scan operation
+                 */
+                adapter->scan_delay_cnt = 0;
+                spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);
+                cmd_node = list_first_entry(&adapter->scan_pending_q,
+                                            struct cmd_ctrl_node, list);
+                list_del(&cmd_node->list);
+                spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
+
+                mwifiex_insert_cmd_to_pending_q(adapter, cmd_node, true);
+        }
+}
+
 /*
  * This function initializes the private structure and sets default
  * values to the members.
@@ -136,6 +198,9 @@ static int mwifiex_init_priv(struct mwifiex_private *priv)
 
         priv->scan_block = false;
 
+        setup_timer(&priv->scan_delay_timer, scan_delay_timer_fn,
+                    (unsigned long)priv);
+
         return mwifiex_add_bss_prio_tbl(priv);
 }
 
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 3192855c31c0..0f06f07a70e6 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -244,8 +244,8 @@ process_start:
                         }
                 }
 
-                if (!adapter->scan_processing && !adapter->data_sent &&
-                    !mwifiex_wmm_lists_empty(adapter)) {
+                if ((!adapter->scan_processing || adapter->scan_delay_cnt) &&
+                    !adapter->data_sent && !mwifiex_wmm_lists_empty(adapter)) {
                         mwifiex_wmm_process_tx(adapter);
                         if (adapter->hs_activated) {
                                 adapter->is_hs_configured = false;
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index bd3b0bf94b9e..5b32221077c4 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -79,14 +79,17 @@ enum {
 
 #define SCAN_BEACON_ENTRY_PAD                   6
 
-#define MWIFIEX_PASSIVE_SCAN_CHAN_TIME  200
-#define MWIFIEX_ACTIVE_SCAN_CHAN_TIME   200
-#define MWIFIEX_SPECIFIC_SCAN_CHAN_TIME 110
+#define MWIFIEX_PASSIVE_SCAN_CHAN_TIME  110
+#define MWIFIEX_ACTIVE_SCAN_CHAN_TIME   30
+#define MWIFIEX_SPECIFIC_SCAN_CHAN_TIME 30
 
 #define SCAN_RSSI(RSSI)                                 (0x100 - ((u8)(RSSI)))
 
 #define MWIFIEX_MAX_TOTAL_SCAN_TIME     (MWIFIEX_TIMER_10S - MWIFIEX_TIMER_1S)
 
+#define MWIFIEX_MAX_SCAN_DELAY_CNT                      50
+#define MWIFIEX_SCAN_DELAY_MSEC                         20
+
 #define RSN_GTK_OUI_OFFSET                              2
 
 #define MWIFIEX_OUI_NOT_PRESENT                 0
@@ -482,6 +485,7 @@ struct mwifiex_private {
         u16 proberesp_idx;
         u16 assocresp_idx;
         u16 rsn_idx;
+        struct timer_list scan_delay_timer;
 };
 
 enum mwifiex_ba_status {
@@ -686,6 +690,7 @@ struct mwifiex_adapter {
         struct completion fw_load;
         u8 country_code[IEEE80211_COUNTRY_STRING_LEN];
         u16 max_mgmt_ie_index;
+        u8 scan_delay_cnt;
 };
 
 int mwifiex_init_lock_list(struct mwifiex_adapter *adapter);
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 74f045715723..efaf26ccd6ba 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -28,7 +28,10 @@
 /* The maximum number of channels the firmware can scan per command */
 #define MWIFIEX_MAX_CHANNELS_PER_SPECIFIC_SCAN   14
 
-#define MWIFIEX_CHANNELS_PER_SCAN_CMD            4
+#define MWIFIEX_DEF_CHANNELS_PER_SCAN_CMD       4
+#define MWIFIEX_LIMIT_1_CHANNEL_PER_SCAN_CMD    15
+#define MWIFIEX_LIMIT_2_CHANNELS_PER_SCAN_CMD   27
+#define MWIFIEX_LIMIT_3_CHANNELS_PER_SCAN_CMD   35
 
 /* Memory needed to store a max sized Channel List TLV for a firmware scan */
 #define CHAN_TLV_MAX_SIZE  (sizeof(struct mwifiex_ie_types_header)         \
@@ -471,7 +474,7 @@ mwifiex_is_network_compatible(struct mwifiex_private *priv,
  * This routine is used for any scan that is not provided with a
  * specific channel list to scan.
  */
-static void
+static int
 mwifiex_scan_create_channel_list(struct mwifiex_private *priv,
                                  const struct mwifiex_user_scan_cfg
                                                         *user_scan_in,
@@ -528,6 +531,7 @@ mwifiex_scan_create_channel_list(struct mwifiex_private *priv,
                 }
 
         }
+        return chan_idx;
 }
 
 /*
@@ -727,6 +731,7 @@ mwifiex_config_scan(struct mwifiex_private *priv,
         u32 num_probes;
         u32 ssid_len;
         u32 chan_idx;
+        u32 chan_num;
         u32 scan_type;
         u16 scan_dur;
         u8 channel;
@@ -850,7 +855,7 @@ mwifiex_config_scan(struct mwifiex_private *priv,
         if (*filtered_scan)
                 *max_chan_per_scan = MWIFIEX_MAX_CHANNELS_PER_SPECIFIC_SCAN;
         else
-                *max_chan_per_scan = MWIFIEX_CHANNELS_PER_SCAN_CMD;
+                *max_chan_per_scan = MWIFIEX_DEF_CHANNELS_PER_SCAN_CMD;
 
         /* If the input config or adapter has the number of Probes set,
            add tlv */
@@ -962,13 +967,28 @@ mwifiex_config_scan(struct mwifiex_private *priv,
                         dev_dbg(adapter->dev,
                                 "info: Scan: Scanning current channel only\n");
                 }
-
+                chan_num = chan_idx;
         } else {
                 dev_dbg(adapter->dev,
                         "info: Scan: Creating full region channel list\n");
-                mwifiex_scan_create_channel_list(priv, user_scan_in,
-                                                 scan_chan_list,
-                                                 *filtered_scan);
+                chan_num = mwifiex_scan_create_channel_list(priv, user_scan_in,
+                                                            scan_chan_list,
+                                                            *filtered_scan);
+        }
+
+        /*
+         * In associated state we will reduce the number of channels scanned per
+         * scan command to avoid any traffic delay/loss. This number is decided
+         * based on total number of channels to be scanned due to constraints
+         * of command buffers.
+         */
+        if (priv->media_connected) {
+                if (chan_num < MWIFIEX_LIMIT_1_CHANNEL_PER_SCAN_CMD)
+                        *max_chan_per_scan = 1;
+                else if (chan_num < MWIFIEX_LIMIT_2_CHANNELS_PER_SCAN_CMD)
+                        *max_chan_per_scan = 2;
+                else if (chan_num < MWIFIEX_LIMIT_3_CHANNELS_PER_SCAN_CMD)
+                        *max_chan_per_scan = 3;
         }
 }
 
@@ -1772,14 +1792,23 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                         priv->user_scan_cfg = NULL;
                 }
         } else {
-                /* Get scan command from scan_pending_q and put to
-                   cmd_pending_q */
-                cmd_node = list_first_entry(&adapter->scan_pending_q,
-                                            struct cmd_ctrl_node, list);
-                list_del(&cmd_node->list);
-                spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
-
-                mwifiex_insert_cmd_to_pending_q(adapter, cmd_node, true);
+                if (!mwifiex_wmm_lists_empty(adapter)) {
+                        spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
+                                               flags);
+                        adapter->scan_delay_cnt = 1;
+                        mod_timer(&priv->scan_delay_timer, jiffies +
+                                  msecs_to_jiffies(MWIFIEX_SCAN_DELAY_MSEC));
+                } else {
+                        /* Get scan command from scan_pending_q and put to
+                           cmd_pending_q */
+                        cmd_node = list_first_entry(&adapter->scan_pending_q,
+                                                    struct cmd_ctrl_node, list);
+                        list_del(&cmd_node->list);
+                        spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
+                                               flags);
+                        mwifiex_insert_cmd_to_pending_q(adapter, cmd_node,
+                                                        true);
+                }
         }
 
 done:
diff --git a/drivers/net/wireless/orinoco/cfg.c b/drivers/net/wireless/orinoco/cfg.c
index f7b15b8934fa..e15675585fb1 100644
--- a/drivers/net/wireless/orinoco/cfg.c
+++ b/drivers/net/wireless/orinoco/cfg.c
@@ -160,10 +160,9 @@ static int orinoco_scan(struct wiphy *wiphy, struct net_device *dev,
         return err;
 }
 
-static int orinoco_set_channel(struct wiphy *wiphy,
-                        struct net_device *netdev,
-                        struct ieee80211_channel *chan,
-                        enum nl80211_channel_type channel_type)
+static int orinoco_set_monitor_channel(struct wiphy *wiphy,
+                                       struct ieee80211_channel *chan,
+                                       enum nl80211_channel_type channel_type)
 {
         struct orinoco_private *priv = wiphy_priv(wiphy);
         int err = 0;
@@ -286,7 +285,7 @@ static int orinoco_set_wiphy_params(struct wiphy *wiphy, u32 changed)
 
 const struct cfg80211_ops orinoco_cfg_ops = {
         .change_virtual_intf = orinoco_change_vif,
-        .set_channel = orinoco_set_channel,
+        .set_monitor_channel = orinoco_set_monitor_channel,
         .scan = orinoco_scan,
         .set_wiphy_params = orinoco_set_wiphy_params,
 };
diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h
index 9348521e0832..1ca88cdc6ece 100644
--- a/drivers/net/wireless/rt2x00/rt2800.h
+++ b/drivers/net/wireless/rt2x00/rt2800.h
@@ -51,6 +51,7 @@
  * RF3320 2.4G 1T1R(RT3350/RT3370/RT3390)
  * RF3322 2.4G 2T2R(RT3352/RT3371/RT3372/RT3391/RT3392)
  * RF3053 2.4G/5G 3T3R(RT3883/RT3563/RT3573/RT3593/RT3662)
+ * RF5360 2.4G 1T1R
  * RF5370 2.4G 1T1R
  * RF5390 2.4G 1T1R
  */
@@ -67,9 +68,11 @@
 #define RF3320                          0x000b
 #define RF3322                          0x000c
 #define RF3053                          0x000d
+#define RF5360                          0x5360
 #define RF5370                          0x5370
 #define RF5372                          0x5372
 #define RF5390                          0x5390
+#define RF5392                          0x5392
 
 /*
  * Chipset revisions.
@@ -1944,6 +1947,11 @@ struct mac_iveiv_entry {
 #define RFCSR49_TX                      FIELD8(0x3f)
 
 /*
+ * RFCSR 50:
+ */
+#define RFCSR50_TX                      FIELD8(0x3f)
+
+/*
  * RF registers
  */
 
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index dfc90d34be6d..4d3747c3010b 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -1958,7 +1958,22 @@ static void rt2800_config_channel_rf53xx(struct rt2x00_dev *rt2x00dev,
                 rt2x00_set_field8(&rfcsr, RFCSR49_TX, info->default_power1);
         rt2800_rfcsr_write(rt2x00dev, 49, rfcsr);
 
+        if (rt2x00_rt(rt2x00dev, RT5392)) {
+                rt2800_rfcsr_read(rt2x00dev, 50, &rfcsr);
+                if (info->default_power1 > RT5390_POWER_BOUND)
+                        rt2x00_set_field8(&rfcsr, RFCSR50_TX,
+                                          RT5390_POWER_BOUND);
+                else
+                        rt2x00_set_field8(&rfcsr, RFCSR50_TX,
+                                          info->default_power2);
+                rt2800_rfcsr_write(rt2x00dev, 50, rfcsr);
+        }
+
         rt2800_rfcsr_read(rt2x00dev, 1, &rfcsr);
+        if (rt2x00_rt(rt2x00dev, RT5392)) {
+                rt2x00_set_field8(&rfcsr, RFCSR1_RX1_PD, 1);
+                rt2x00_set_field8(&rfcsr, RFCSR1_TX1_PD, 1);
+        }
         rt2x00_set_field8(&rfcsr, RFCSR1_RF_BLOCK_EN, 1);
         rt2x00_set_field8(&rfcsr, RFCSR1_PLL_PD, 1);
         rt2x00_set_field8(&rfcsr, RFCSR1_RX0_PD, 1);
@@ -2060,9 +2075,11 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
         case RF3052:
                 rt2800_config_channel_rf3052(rt2x00dev, conf, rf, info);
                 break;
+        case RF5360:
         case RF5370:
         case RF5372:
         case RF5390:
+        case RF5392:
                 rt2800_config_channel_rf53xx(rt2x00dev, conf, rf, info);
                 break;
         default:
@@ -2549,9 +2566,11 @@ void rt2800_vco_calibration(struct rt2x00_dev *rt2x00dev)
                 rt2x00_set_field8(&rfcsr, RFCSR7_RF_TUNING, 1);
                 rt2800_rfcsr_write(rt2x00dev, 7, rfcsr);
                 break;
+        case RF5360:
         case RF5370:
         case RF5372:
         case RF5390:
+        case RF5392:
                 rt2800_rfcsr_read(rt2x00dev, 3, &rfcsr);
                 rt2x00_set_field8(&rfcsr, RFCSR30_RF_CALIBRATION, 1);
                 rt2800_rfcsr_write(rt2x00dev, 3, rfcsr);
@@ -4263,9 +4282,11 @@ int rt2800_init_eeprom(struct rt2x00_dev *rt2x00dev)
         case RF3022:
         case RF3052:
         case RF3320:
+        case RF5360:
         case RF5370:
         case RF5372:
         case RF5390:
+        case RF5392:
                 break;
         default:
                 ERROR(rt2x00dev, "Invalid RF chipset 0x%04x detected.\n",
@@ -4577,9 +4598,11 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
                    rt2x00_rf(rt2x00dev, RF3021) ||
                    rt2x00_rf(rt2x00dev, RF3022) ||
                    rt2x00_rf(rt2x00dev, RF3320) ||
+                   rt2x00_rf(rt2x00dev, RF5360) ||
                    rt2x00_rf(rt2x00dev, RF5370) ||
                    rt2x00_rf(rt2x00dev, RF5372) ||
-                   rt2x00_rf(rt2x00dev, RF5390)) {
+                   rt2x00_rf(rt2x00dev, RF5390) ||
+                   rt2x00_rf(rt2x00dev, RF5392)) {
                 spec->num_channels = 14;
                 spec->channels = rf_vals_3x;
         } else if (rt2x00_rf(rt2x00dev, RF3052)) {
@@ -4662,9 +4685,11 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         case RF3022:
         case RF3320:
         case RF3052:
+        case RF5360:
         case RF5370:
         case RF5372:
         case RF5390:
+        case RF5392:
                 __set_bit(CAPABILITY_VCO_RECALIBRATION, &rt2x00dev->cap_flags);
                 break;
         }
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index cad25bfebd7a..206158b67426 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -1188,6 +1188,7 @@ static DEFINE_PCI_DEVICE_TABLE(rt2800pci_device_table) = {
         { PCI_DEVICE(0x1814, 0x3593) },
 #endif
 #ifdef CONFIG_RT2800PCI_RT53XX
+        { PCI_DEVICE(0x1814, 0x5360) },
         { PCI_DEVICE(0x1814, 0x5362) },
         { PCI_DEVICE(0x1814, 0x5390) },
         { PCI_DEVICE(0x1814, 0x5392) },
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index bf78317a6adb..20a504072895 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -1137,6 +1137,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
 #ifdef CONFIG_RT2800USB_RT33XX
         /* Belkin */
         { USB_DEVICE(0x050d, 0x945b) },
+        /* D-Link */
+        { USB_DEVICE(0x2001, 0x3c17) },
         /* Panasonic */
         { USB_DEVICE(0x083a, 0xb511) },
         /* Philips */
@@ -1237,7 +1239,6 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* D-Link */
         { USB_DEVICE(0x07d1, 0x3c0b) },
         { USB_DEVICE(0x07d1, 0x3c17) },
-        { USB_DEVICE(0x2001, 0x3c17) },
         /* Encore */
         { USB_DEVICE(0x203d, 0x14a1) },
         /* Gemtek */
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index e5404e576251..a6b88bd4a1a5 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1161,6 +1161,8 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
                     BIT(NL80211_IFTYPE_MESH_POINT) |
                     BIT(NL80211_IFTYPE_WDS);
 
+        rt2x00dev->hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
+
         /*
          * Initialize work.
          */
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index dd24b2663b5e..4ff26c2159bf 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -506,9 +506,19 @@ int rt2x00mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 
         if (!test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags))
                 return 0;
-        else if (!test_bit(CAPABILITY_HW_CRYPTO, &rt2x00dev->cap_flags))
+
+        if (!test_bit(CAPABILITY_HW_CRYPTO, &rt2x00dev->cap_flags))
+                return -EOPNOTSUPP;
+
+        /*
+         * To support IBSS RSN, don't program group keys in IBSS, the
+         * hardware will then not attempt to decrypt the frames.
+         */
+        if (vif->type == NL80211_IFTYPE_ADHOC &&
+            !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
                 return -EOPNOTSUPP;
-        else if (key->keylen > 32)
+
+        if (key->keylen > 32)
                 return -ENOSPC;
 
         memset(&crypto, 0, sizeof(crypto));
diff --git a/drivers/net/wireless/ti/Kconfig b/drivers/net/wireless/ti/Kconfig
index 1a72932e2213..be800119d0a3 100644
--- a/drivers/net/wireless/ti/Kconfig
+++ b/drivers/net/wireless/ti/Kconfig
@@ -8,6 +8,7 @@ menuconfig WL_TI
 if WL_TI
 source "drivers/net/wireless/ti/wl1251/Kconfig"
 source "drivers/net/wireless/ti/wl12xx/Kconfig"
+source "drivers/net/wireless/ti/wl18xx/Kconfig"
 
 # keep last for automatic dependencies
 source "drivers/net/wireless/ti/wlcore/Kconfig"
diff --git a/drivers/net/wireless/ti/Makefile b/drivers/net/wireless/ti/Makefile
index 0a565622d4a4..4d6823983c04 100644
--- a/drivers/net/wireless/ti/Makefile
+++ b/drivers/net/wireless/ti/Makefile
@@ -2,3 +2,4 @@ obj-$(CONFIG_WLCORE)			+= wlcore/
 obj-$(CONFIG_WL12XX)                    += wl12xx/
 obj-$(CONFIG_WL12XX_PLATFORM_DATA)      += wlcore/
 obj-$(CONFIG_WL1251)                    += wl1251/
+obj-$(CONFIG_WL18XX)                    += wl18xx/
diff --git a/drivers/net/wireless/ti/wl12xx/Makefile b/drivers/net/wireless/ti/wl12xx/Makefile
index 87f64b14db35..da509aa7d009 100644
--- a/drivers/net/wireless/ti/wl12xx/Makefile
+++ b/drivers/net/wireless/ti/wl12xx/Makefile
@@ -1,3 +1,3 @@
-wl12xx-objs     = main.o cmd.o acx.o
+wl12xx-objs     = main.o cmd.o acx.o debugfs.o
 
 obj-$(CONFIG_WL12XX)            += wl12xx.o
diff --git a/drivers/net/wireless/ti/wl12xx/acx.h b/drivers/net/wireless/ti/wl12xx/acx.h
index d1f5aba0afce..2a26868b837d 100644
--- a/drivers/net/wireless/ti/wl12xx/acx.h
+++ b/drivers/net/wireless/ti/wl12xx/acx.h
@@ -24,6 +24,21 @@
 #define __WL12XX_ACX_H__
 
 #include "../wlcore/wlcore.h"
+#include "../wlcore/acx.h"
+
+#define WL12XX_ACX_ALL_EVENTS_VECTOR    (WL1271_ACX_INTR_WATCHDOG      | \
+                                        WL1271_ACX_INTR_INIT_COMPLETE | \
+                                        WL1271_ACX_INTR_EVENT_A       | \
+                                        WL1271_ACX_INTR_EVENT_B       | \
+                                        WL1271_ACX_INTR_CMD_COMPLETE  | \
+                                        WL1271_ACX_INTR_HW_AVAILABLE  | \
+                                        WL1271_ACX_INTR_DATA)
+
+#define WL12XX_INTR_MASK                (WL1271_ACX_INTR_WATCHDOG      | \
+                                        WL1271_ACX_INTR_EVENT_A       | \
+                                        WL1271_ACX_INTR_EVENT_B       | \
+                                        WL1271_ACX_INTR_HW_AVAILABLE  | \
+                                        WL1271_ACX_INTR_DATA)
 
 struct wl1271_acx_host_config_bitmap {
         struct acx_header header;
@@ -31,6 +46,228 @@ struct wl1271_acx_host_config_bitmap {
         __le32 host_cfg_bitmap;
 } __packed;
 
+struct wl12xx_acx_tx_statistics {
+        __le32 internal_desc_overflow;
+}  __packed;
+
+struct wl12xx_acx_rx_statistics {
+        __le32 out_of_mem;
+        __le32 hdr_overflow;
+        __le32 hw_stuck;
+        __le32 dropped;
+        __le32 fcs_err;
+        __le32 xfr_hint_trig;
+        __le32 path_reset;
+        __le32 reset_counter;
+} __packed;
+
+struct wl12xx_acx_dma_statistics {
+        __le32 rx_requested;
+        __le32 rx_errors;
+        __le32 tx_requested;
+        __le32 tx_errors;
+}  __packed;
+
+struct wl12xx_acx_isr_statistics {
+        /* host command complete */
+        __le32 cmd_cmplt;
+
+        /* fiqisr() */
+        __le32 fiqs;
+
+        /* (INT_STS_ND & INT_TRIG_RX_HEADER) */
+        __le32 rx_headers;
+
+        /* (INT_STS_ND & INT_TRIG_RX_CMPLT) */
+        __le32 rx_completes;
+
+        /* (INT_STS_ND & INT_TRIG_NO_RX_BUF) */
+        __le32 rx_mem_overflow;
+
+        /* (INT_STS_ND & INT_TRIG_S_RX_RDY) */
+        __le32 rx_rdys;
+
+        /* irqisr() */
+        __le32 irqs;
+
+        /* (INT_STS_ND & INT_TRIG_TX_PROC) */
+        __le32 tx_procs;
+
+        /* (INT_STS_ND & INT_TRIG_DECRYPT_DONE) */
+        __le32 decrypt_done;
+
+        /* (INT_STS_ND & INT_TRIG_DMA0) */
+        __le32 dma0_done;
+
+        /* (INT_STS_ND & INT_TRIG_DMA1) */
+        __le32 dma1_done;
+
+        /* (INT_STS_ND & INT_TRIG_TX_EXC_CMPLT) */
+        __le32 tx_exch_complete;
+
+        /* (INT_STS_ND & INT_TRIG_COMMAND) */
+        __le32 commands;
+
+        /* (INT_STS_ND & INT_TRIG_RX_PROC) */
+        __le32 rx_procs;
+
+        /* (INT_STS_ND & INT_TRIG_PM_802) */
+        __le32 hw_pm_mode_changes;
+
+        /* (INT_STS_ND & INT_TRIG_ACKNOWLEDGE) */
+        __le32 host_acknowledges;
+
+        /* (INT_STS_ND & INT_TRIG_PM_PCI) */
+        __le32 pci_pm;
+
+        /* (INT_STS_ND & INT_TRIG_ACM_WAKEUP) */
+        __le32 wakeups;
+
+        /* (INT_STS_ND & INT_TRIG_LOW_RSSI) */
+        __le32 low_rssi;
+} __packed;
+
+struct wl12xx_acx_wep_statistics {
+        /* WEP address keys configured */
+        __le32 addr_key_count;
+
+        /* default keys configured */
+        __le32 default_key_count;
+
+        __le32 reserved;
+
+        /* number of times that WEP key not found on lookup */
+        __le32 key_not_found;
+
+        /* number of times that WEP key decryption failed */
+        __le32 decrypt_fail;
+
+        /* WEP packets decrypted */
+        __le32 packets;
+
+        /* WEP decrypt interrupts */
+        __le32 interrupt;
+} __packed;
+
+#define ACX_MISSED_BEACONS_SPREAD 10
+
+struct wl12xx_acx_pwr_statistics {
+        /* the amount of enters into power save mode (both PD & ELP) */
+        __le32 ps_enter;
+
+        /* the amount of enters into ELP mode */
+        __le32 elp_enter;
+
+        /* the amount of missing beacon interrupts to the host */
+        __le32 missing_bcns;
+
+        /* the amount of wake on host-access times */
+        __le32 wake_on_host;
+
+        /* the amount of wake on timer-expire */
+        __le32 wake_on_timer_exp;
+
+        /* the number of packets that were transmitted with PS bit set */
+        __le32 tx_with_ps;
+
+        /* the number of packets that were transmitted with PS bit clear */
+        __le32 tx_without_ps;
+
+        /* the number of received beacons */
+        __le32 rcvd_beacons;
+
+        /* the number of entering into PowerOn (power save off) */
+        __le32 power_save_off;
+
+        /* the number of entries into power save mode */
+        __le16 enable_ps;
+
+        /*
+         * the number of exits from power save, not including failed PS
+         * transitions
+         */
+        __le16 disable_ps;
+
+        /*
+         * the number of times the TSF counter was adjusted because
+         * of drift
+         */
+        __le32 fix_tsf_ps;
+
+        /* Gives statistics about the spread continuous missed beacons.
+         * The 16 LSB are dedicated for the PS mode.
+         * The 16 MSB are dedicated for the PS mode.
+         * cont_miss_bcns_spread[0] - single missed beacon.
+         * cont_miss_bcns_spread[1] - two continuous missed beacons.
+         * cont_miss_bcns_spread[2] - three continuous missed beacons.
+         * ...
+         * cont_miss_bcns_spread[9] - ten and more continuous missed beacons.
+        */
+        __le32 cont_miss_bcns_spread[ACX_MISSED_BEACONS_SPREAD];
+
+        /* the number of beacons in awake mode */
+        __le32 rcvd_awake_beacons;
+} __packed;
+
+struct wl12xx_acx_mic_statistics {
+        __le32 rx_pkts;
+        __le32 calc_failure;
+} __packed;
+
+struct wl12xx_acx_aes_statistics {
+        __le32 encrypt_fail;
+        __le32 decrypt_fail;
+        __le32 encrypt_packets;
+        __le32 decrypt_packets;
+        __le32 encrypt_interrupt;
+        __le32 decrypt_interrupt;
+} __packed;
+
+struct wl12xx_acx_event_statistics {
+        __le32 heart_beat;
+        __le32 calibration;
+        __le32 rx_mismatch;
+        __le32 rx_mem_empty;
+        __le32 rx_pool;
+        __le32 oom_late;
+        __le32 phy_transmit_error;
+        __le32 tx_stuck;
+} __packed;
+
+struct wl12xx_acx_ps_statistics {
+        __le32 pspoll_timeouts;
+        __le32 upsd_timeouts;
+        __le32 upsd_max_sptime;
+        __le32 upsd_max_apturn;
+        __le32 pspoll_max_apturn;
+        __le32 pspoll_utilization;
+        __le32 upsd_utilization;
+} __packed;
+
+struct wl12xx_acx_rxpipe_statistics {
+        __le32 rx_prep_beacon_drop;
+        __le32 descr_host_int_trig_rx_data;
+        __le32 beacon_buffer_thres_host_int_trig_rx_data;
+        __le32 missed_beacon_host_int_trig_rx_data;
+        __le32 tx_xfr_host_int_trig_rx_data;
+} __packed;
+
+struct wl12xx_acx_statistics {
+        struct acx_header header;
+
+        struct wl12xx_acx_tx_statistics tx;
+        struct wl12xx_acx_rx_statistics rx;
+        struct wl12xx_acx_dma_statistics dma;
+        struct wl12xx_acx_isr_statistics isr;
+        struct wl12xx_acx_wep_statistics wep;
+        struct wl12xx_acx_pwr_statistics pwr;
+        struct wl12xx_acx_aes_statistics aes;
+        struct wl12xx_acx_mic_statistics mic;
+        struct wl12xx_acx_event_statistics event;
+        struct wl12xx_acx_ps_statistics ps;
+        struct wl12xx_acx_rxpipe_statistics rxpipe;
+} __packed;
+
 int wl1271_acx_host_if_cfg_bitmap(struct wl1271 *wl, u32 host_cfg_bitmap);
 
 #endif /* __WL12XX_ACX_H__ */
diff --git a/drivers/net/wireless/ti/wl12xx/cmd.c b/drivers/net/wireless/ti/wl12xx/cmd.c
index 8ffaeb5f2147..50ba7480b790 100644
--- a/drivers/net/wireless/ti/wl12xx/cmd.c
+++ b/drivers/net/wireless/ti/wl12xx/cmd.c
@@ -65,6 +65,7 @@ int wl1271_cmd_general_parms(struct wl1271 *wl)
         struct wl1271_general_parms_cmd *gen_parms;
         struct wl1271_ini_general_params *gp =
                 &((struct wl1271_nvs_file *)wl->nvs)->general_params;
+        struct wl12xx_priv *priv = wl->priv;
         bool answer = false;
         int ret;
 
@@ -88,7 +89,7 @@ int wl1271_cmd_general_parms(struct wl1271 *wl)
                 answer = true;
 
         /* Override the REF CLK from the NVS with the one from platform data */
-        gen_parms->general_params.ref_clock = wl->ref_clock;
+        gen_parms->general_params.ref_clock = priv->ref_clock;
 
         ret = wl1271_cmd_test(wl, gen_parms, sizeof(*gen_parms), answer);
         if (ret < 0) {
@@ -118,6 +119,7 @@ int wl128x_cmd_general_parms(struct wl1271 *wl)
         struct wl128x_general_parms_cmd *gen_parms;
         struct wl128x_ini_general_params *gp =
                 &((struct wl128x_nvs_file *)wl->nvs)->general_params;
+        struct wl12xx_priv *priv = wl->priv;
         bool answer = false;
         int ret;
 
@@ -141,8 +143,8 @@ int wl128x_cmd_general_parms(struct wl1271 *wl)
                 answer = true;
 
         /* Replace REF and TCXO CLKs with the ones from platform data */
-        gen_parms->general_params.ref_clock = wl->ref_clock;
-        gen_parms->general_params.tcxo_ref_clock = wl->tcxo_clock;
+        gen_parms->general_params.ref_clock = priv->ref_clock;
+        gen_parms->general_params.tcxo_ref_clock = priv->tcxo_clock;
 
         ret = wl1271_cmd_test(wl, gen_parms, sizeof(*gen_parms), answer);
         if (ret < 0) {
diff --git a/drivers/net/wireless/ti/wl12xx/debugfs.c b/drivers/net/wireless/ti/wl12xx/debugfs.c
new file mode 100644
index 000000000000..0521cbf858cf
--- /dev/null
+++ b/drivers/net/wireless/ti/wl12xx/debugfs.c
@@ -0,0 +1,243 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ * Copyright (C) 2011-2012 Texas Instruments
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include "../wlcore/debugfs.h"
+#include "../wlcore/wlcore.h"
+
+#include "wl12xx.h"
+#include "acx.h"
+#include "debugfs.h"
+
+#define WL12XX_DEBUGFS_FWSTATS_FILE(a, b, c) \
+        DEBUGFS_FWSTATS_FILE(a, b, c, wl12xx_acx_statistics)
+
+WL12XX_DEBUGFS_FWSTATS_FILE(tx, internal_desc_overflow, "%u");
+
+WL12XX_DEBUGFS_FWSTATS_FILE(rx, out_of_mem, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(rx, hdr_overflow, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(rx, hw_stuck, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(rx, dropped, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(rx, fcs_err, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(rx, xfr_hint_trig, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(rx, path_reset, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(rx, reset_counter, "%u");
+
+WL12XX_DEBUGFS_FWSTATS_FILE(dma, rx_requested, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(dma, rx_errors, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(dma, tx_requested, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(dma, tx_errors, "%u");
+
+WL12XX_DEBUGFS_FWSTATS_FILE(isr, cmd_cmplt, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(isr, fiqs, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(isr, rx_headers, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(isr, rx_mem_overflow, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(isr, rx_rdys, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(isr, irqs, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(isr, tx_procs, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(isr, decrypt_done, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(isr, dma0_done, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(isr, dma1_done, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(isr, tx_exch_complete, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(isr, commands, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(isr, rx_procs, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(isr, hw_pm_mode_changes, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(isr, host_acknowledges, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(isr, pci_pm, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(isr, wakeups, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(isr, low_rssi, "%u");
+
+WL12XX_DEBUGFS_FWSTATS_FILE(wep, addr_key_count, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(wep, default_key_count, "%u");
+/* skipping wep.reserved */
+WL12XX_DEBUGFS_FWSTATS_FILE(wep, key_not_found, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(wep, decrypt_fail, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(wep, packets, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(wep, interrupt, "%u");
+
+WL12XX_DEBUGFS_FWSTATS_FILE(pwr, ps_enter, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(pwr, elp_enter, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(pwr, missing_bcns, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(pwr, wake_on_host, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(pwr, wake_on_timer_exp, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(pwr, tx_with_ps, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(pwr, tx_without_ps, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(pwr, rcvd_beacons, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(pwr, power_save_off, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(pwr, enable_ps, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(pwr, disable_ps, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(pwr, fix_tsf_ps, "%u");
+/* skipping cont_miss_bcns_spread for now */
+WL12XX_DEBUGFS_FWSTATS_FILE(pwr, rcvd_awake_beacons, "%u");
+
+WL12XX_DEBUGFS_FWSTATS_FILE(mic, rx_pkts, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(mic, calc_failure, "%u");
+
+WL12XX_DEBUGFS_FWSTATS_FILE(aes, encrypt_fail, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(aes, decrypt_fail, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(aes, encrypt_packets, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(aes, decrypt_packets, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(aes, encrypt_interrupt, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(aes, decrypt_interrupt, "%u");
+
+WL12XX_DEBUGFS_FWSTATS_FILE(event, heart_beat, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(event, calibration, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(event, rx_mismatch, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(event, rx_mem_empty, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(event, rx_pool, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(event, oom_late, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(event, phy_transmit_error, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(event, tx_stuck, "%u");
+
+WL12XX_DEBUGFS_FWSTATS_FILE(ps, pspoll_timeouts, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(ps, upsd_timeouts, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(ps, upsd_max_sptime, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(ps, upsd_max_apturn, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(ps, pspoll_max_apturn, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(ps, pspoll_utilization, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(ps, upsd_utilization, "%u");
+
+WL12XX_DEBUGFS_FWSTATS_FILE(rxpipe, rx_prep_beacon_drop, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(rxpipe, descr_host_int_trig_rx_data, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(rxpipe, beacon_buffer_thres_host_int_trig_rx_data,
+                            "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(rxpipe, missed_beacon_host_int_trig_rx_data, "%u");
+WL12XX_DEBUGFS_FWSTATS_FILE(rxpipe, tx_xfr_host_int_trig_rx_data, "%u");
+
+int wl12xx_debugfs_add_files(struct wl1271 *wl,
+                             struct dentry *rootdir)
+{
+        int ret = 0;
+        struct dentry *entry, *stats, *moddir;
+
+        moddir = debugfs_create_dir(KBUILD_MODNAME, rootdir);
+        if (!moddir || IS_ERR(moddir)) {
+                entry = moddir;
+                goto err;
+        }
+
+        stats = debugfs_create_dir("fw_stats", moddir);
+        if (!stats || IS_ERR(stats)) {
+                entry = stats;
+                goto err;
+        }
+
+        DEBUGFS_FWSTATS_ADD(tx, internal_desc_overflow);
+
+        DEBUGFS_FWSTATS_ADD(rx, out_of_mem);
+        DEBUGFS_FWSTATS_ADD(rx, hdr_overflow);
+        DEBUGFS_FWSTATS_ADD(rx, hw_stuck);
+        DEBUGFS_FWSTATS_ADD(rx, dropped);
+        DEBUGFS_FWSTATS_ADD(rx, fcs_err);
+        DEBUGFS_FWSTATS_ADD(rx, xfr_hint_trig);
+        DEBUGFS_FWSTATS_ADD(rx, path_reset);
+        DEBUGFS_FWSTATS_ADD(rx, reset_counter);
+
+        DEBUGFS_FWSTATS_ADD(dma, rx_requested);
+        DEBUGFS_FWSTATS_ADD(dma, rx_errors);
+        DEBUGFS_FWSTATS_ADD(dma, tx_requested);
+        DEBUGFS_FWSTATS_ADD(dma, tx_errors);
+
+        DEBUGFS_FWSTATS_ADD(isr, cmd_cmplt);
+        DEBUGFS_FWSTATS_ADD(isr, fiqs);
+        DEBUGFS_FWSTATS_ADD(isr, rx_headers);
+        DEBUGFS_FWSTATS_ADD(isr, rx_mem_overflow);
+        DEBUGFS_FWSTATS_ADD(isr, rx_rdys);
+        DEBUGFS_FWSTATS_ADD(isr, irqs);
+        DEBUGFS_FWSTATS_ADD(isr, tx_procs);
+        DEBUGFS_FWSTATS_ADD(isr, decrypt_done);
+        DEBUGFS_FWSTATS_ADD(isr, dma0_done);
+        DEBUGFS_FWSTATS_ADD(isr, dma1_done);
+        DEBUGFS_FWSTATS_ADD(isr, tx_exch_complete);
+        DEBUGFS_FWSTATS_ADD(isr, commands);
+        DEBUGFS_FWSTATS_ADD(isr, rx_procs);
+        DEBUGFS_FWSTATS_ADD(isr, hw_pm_mode_changes);
+        DEBUGFS_FWSTATS_ADD(isr, host_acknowledges);
+        DEBUGFS_FWSTATS_ADD(isr, pci_pm);
+        DEBUGFS_FWSTATS_ADD(isr, wakeups);
+        DEBUGFS_FWSTATS_ADD(isr, low_rssi);
+
+        DEBUGFS_FWSTATS_ADD(wep, addr_key_count);
+        DEBUGFS_FWSTATS_ADD(wep, default_key_count);
+        /* skipping wep.reserved */
+        DEBUGFS_FWSTATS_ADD(wep, key_not_found);
+        DEBUGFS_FWSTATS_ADD(wep, decrypt_fail);
+        DEBUGFS_FWSTATS_ADD(wep, packets);
+        DEBUGFS_FWSTATS_ADD(wep, interrupt);
+
+        DEBUGFS_FWSTATS_ADD(pwr, ps_enter);
+        DEBUGFS_FWSTATS_ADD(pwr, elp_enter);
+        DEBUGFS_FWSTATS_ADD(pwr, missing_bcns);
+        DEBUGFS_FWSTATS_ADD(pwr, wake_on_host);
+        DEBUGFS_FWSTATS_ADD(pwr, wake_on_timer_exp);
+        DEBUGFS_FWSTATS_ADD(pwr, tx_with_ps);
+        DEBUGFS_FWSTATS_ADD(pwr, tx_without_ps);
+        DEBUGFS_FWSTATS_ADD(pwr, rcvd_beacons);
+        DEBUGFS_FWSTATS_ADD(pwr, power_save_off);
+        DEBUGFS_FWSTATS_ADD(pwr, enable_ps);
+        DEBUGFS_FWSTATS_ADD(pwr, disable_ps);
+        DEBUGFS_FWSTATS_ADD(pwr, fix_tsf_ps);
+        /* skipping cont_miss_bcns_spread for now */
+        DEBUGFS_FWSTATS_ADD(pwr, rcvd_awake_beacons);
+
+        DEBUGFS_FWSTATS_ADD(mic, rx_pkts);
+        DEBUGFS_FWSTATS_ADD(mic, calc_failure);
+
+        DEBUGFS_FWSTATS_ADD(aes, encrypt_fail);
+        DEBUGFS_FWSTATS_ADD(aes, decrypt_fail);
+        DEBUGFS_FWSTATS_ADD(aes, encrypt_packets);
+        DEBUGFS_FWSTATS_ADD(aes, decrypt_packets);
+        DEBUGFS_FWSTATS_ADD(aes, encrypt_interrupt);
+        DEBUGFS_FWSTATS_ADD(aes, decrypt_interrupt);
+
+        DEBUGFS_FWSTATS_ADD(event, heart_beat);
+        DEBUGFS_FWSTATS_ADD(event, calibration);
+        DEBUGFS_FWSTATS_ADD(event, rx_mismatch);
+        DEBUGFS_FWSTATS_ADD(event, rx_mem_empty);
+        DEBUGFS_FWSTATS_ADD(event, rx_pool);
+        DEBUGFS_FWSTATS_ADD(event, oom_late);
+        DEBUGFS_FWSTATS_ADD(event, phy_transmit_error);
+        DEBUGFS_FWSTATS_ADD(event, tx_stuck);
+
+        DEBUGFS_FWSTATS_ADD(ps, pspoll_timeouts);
+        DEBUGFS_FWSTATS_ADD(ps, upsd_timeouts);
+        DEBUGFS_FWSTATS_ADD(ps, upsd_max_sptime);
+        DEBUGFS_FWSTATS_ADD(ps, upsd_max_apturn);
+        DEBUGFS_FWSTATS_ADD(ps, pspoll_max_apturn);
+        DEBUGFS_FWSTATS_ADD(ps, pspoll_utilization);
+        DEBUGFS_FWSTATS_ADD(ps, upsd_utilization);
+
+        DEBUGFS_FWSTATS_ADD(rxpipe, rx_prep_beacon_drop);
+        DEBUGFS_FWSTATS_ADD(rxpipe, descr_host_int_trig_rx_data);
+        DEBUGFS_FWSTATS_ADD(rxpipe, beacon_buffer_thres_host_int_trig_rx_data);
+        DEBUGFS_FWSTATS_ADD(rxpipe, missed_beacon_host_int_trig_rx_data);
+        DEBUGFS_FWSTATS_ADD(rxpipe, tx_xfr_host_int_trig_rx_data);
+
+        return 0;
+
+err:
+        if (IS_ERR(entry))
+                ret = PTR_ERR(entry);
+        else
+                ret = -ENOMEM;
+
+        return ret;
+}
diff --git a/drivers/net/wireless/ti/wl12xx/debugfs.h b/drivers/net/wireless/ti/wl12xx/debugfs.h
new file mode 100644
index 000000000000..96898e291b78
--- /dev/null
+++ b/drivers/net/wireless/ti/wl12xx/debugfs.h
@@ -0,0 +1,28 @@
+/*
+ * This file is part of wl12xx
+ *
+ * Copyright (C) 2012 Texas Instruments. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL12XX_DEBUGFS_H__
+#define __WL12XX_DEBUGFS_H__
+
+int wl12xx_debugfs_add_files(struct wl1271 *wl,
+                             struct dentry *rootdir);
+
+#endif /* __WL12XX_DEBUGFS_H__ */
diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c
index d7dd3def07b5..85d1600ee340 100644
--- a/drivers/net/wireless/ti/wl12xx/main.c
+++ b/drivers/net/wireless/ti/wl12xx/main.c
@@ -39,6 +39,10 @@
 #include "reg.h"
 #include "cmd.h"
 #include "acx.h"
+#include "debugfs.h"
+
+static char *fref_param;
+static char *tcxo_param;
 
 static struct wlcore_conf wl12xx_conf = {
         .sg = {
@@ -212,7 +216,7 @@ static struct wlcore_conf wl12xx_conf = {
                 .suspend_wake_up_event       = CONF_WAKE_UP_EVENT_N_DTIM,
                 .suspend_listen_interval     = 3,
                 .bcn_filt_mode               = CONF_BCN_FILT_MODE_ENABLED,
-                .bcn_filt_ie_count           = 2,
+                .bcn_filt_ie_count           = 3,
                 .bcn_filt_ie = {
                         [0] = {
                                 .ie          = WLAN_EID_CHANNEL_SWITCH,
@@ -222,9 +226,13 @@ static struct wlcore_conf wl12xx_conf = {
                                 .ie          = WLAN_EID_HT_OPERATION,
                                 .rule        = CONF_BCN_RULE_PASS_ON_CHANGE,
                         },
+                        [2] = {
+                                .ie          = WLAN_EID_ERP_INFO,
+                                .rule        = CONF_BCN_RULE_PASS_ON_CHANGE,
+                        },
                 },
-                .synch_fail_thold            = 10,
-                .bss_lose_timeout            = 100,
+                .synch_fail_thold            = 12,
+                .bss_lose_timeout            = 400,
                 .beacon_rx_timeout           = 10000,
                 .broadcast_timeout           = 20000,
                 .rx_broadcast_in_ps          = 1,
@@ -234,7 +242,7 @@ static struct wlcore_conf wl12xx_conf = {
                 .psm_entry_retries           = 8,
                 .psm_exit_retries            = 16,
                 .psm_entry_nullfunc_retries  = 3,
-                .dynamic_ps_timeout          = 40,
+                .dynamic_ps_timeout          = 200,
                 .forced_ps                   = false,
                 .keep_alive_interval         = 55000,
                 .max_listen_interval         = 20,
@@ -245,7 +253,7 @@ static struct wlcore_conf wl12xx_conf = {
         },
         .pm_config = {
                 .host_clk_settling_time = 5000,
-                .host_fast_wakeup_support = false
+                .host_fast_wakeup_support = CONF_FAST_WAKEUP_DISABLE,
         },
         .roam_trigger = {
                 .trigger_pacing               = 1,
@@ -305,8 +313,8 @@ static struct wlcore_conf wl12xx_conf = {
                 .swallow_period               = 5,
                 .n_divider_fref_set_1         = 0xff,       /* default */
                 .n_divider_fref_set_2         = 12,
-                .m_divider_fref_set_1         = 148,
-                .m_divider_fref_set_2         = 0xffff,     /* default */
+                .m_divider_fref_set_1         = 0xffff,
+                .m_divider_fref_set_2         = 148,        /* default */
                 .coex_pll_stabilization_time  = 0xffffffff, /* default */
                 .ldo_stabilization_time       = 0xffff,     /* default */
                 .fm_disturbed_band_margin     = 0xff,       /* default */
@@ -593,7 +601,7 @@ static void wl127x_prepare_read(struct wl1271 *wl, u32 rx_desc, u32 len)
 {
         if (wl->chip.id != CHIP_ID_1283_PG20) {
                 struct wl1271_acx_mem_map *wl_mem_map = wl->target_mem_map;
-                struct wl1271_rx_mem_pool_addr rx_mem_addr;
+                struct wl127x_rx_mem_pool_addr rx_mem_addr;
 
                 /*
                  * Choose the block we want to read
@@ -621,10 +629,8 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
                 wl1271_warning("chip id 0x%x (1271 PG10) support is obsolete",
                                wl->chip.id);
 
-                /* clear the alignment quirk, since we don't support it */
-                wl->quirks &= ~WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN;
-
-                wl->quirks |= WLCORE_QUIRK_LEGACY_NVS;
+                wl->quirks |= WLCORE_QUIRK_LEGACY_NVS |
+                              WLCORE_QUIRK_TKIP_HEADER_SPACE;
                 wl->sr_fw_name = WL127X_FW_NAME_SINGLE;
                 wl->mr_fw_name = WL127X_FW_NAME_MULTI;
                 memcpy(&wl->conf.mem, &wl12xx_default_priv_conf.mem_wl127x,
@@ -639,10 +645,8 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
                 wl1271_debug(DEBUG_BOOT, "chip id 0x%x (1271 PG20)",
                              wl->chip.id);
 
-                /* clear the alignment quirk, since we don't support it */
-                wl->quirks &= ~WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN;
-
-                wl->quirks |= WLCORE_QUIRK_LEGACY_NVS;
+                wl->quirks |= WLCORE_QUIRK_LEGACY_NVS |
+                              WLCORE_QUIRK_TKIP_HEADER_SPACE;
                 wl->plt_fw_name = WL127X_PLT_FW_NAME;
                 wl->sr_fw_name = WL127X_FW_NAME_SINGLE;
                 wl->mr_fw_name = WL127X_FW_NAME_MULTI;
@@ -660,6 +664,11 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
                 wl->plt_fw_name = WL128X_PLT_FW_NAME;
                 wl->sr_fw_name = WL128X_FW_NAME_SINGLE;
                 wl->mr_fw_name = WL128X_FW_NAME_MULTI;
+
+                /* wl128x requires TX blocksize alignment */
+                wl->quirks |= WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN |
+                              WLCORE_QUIRK_TKIP_HEADER_SPACE;
+
                 break;
         case CHIP_ID_1283_PG10:
         default:
@@ -773,6 +782,7 @@ static int wl128x_configure_mcs_pll(struct wl1271 *wl, int clk)
         u16 spare_reg;
         u16 pll_config;
         u8 input_freq;
+        struct wl12xx_priv *priv = wl->priv;
 
         /* Mask bits [3:1] in the sys_clk_cfg register */
         spare_reg = wl12xx_top_reg_read(wl, WL_SPARE_REG);
@@ -782,8 +792,8 @@ static int wl128x_configure_mcs_pll(struct wl1271 *wl, int clk)
         wl12xx_top_reg_write(wl, WL_SPARE_REG, spare_reg);
 
         /* Handle special cases of the TCXO clock */
-        if (wl->tcxo_clock == WL12XX_TCXOCLOCK_16_8 ||
-            wl->tcxo_clock == WL12XX_TCXOCLOCK_33_6)
+        if (priv->tcxo_clock == WL12XX_TCXOCLOCK_16_8 ||
+            priv->tcxo_clock == WL12XX_TCXOCLOCK_33_6)
                 return wl128x_manually_configure_mcs_pll(wl);
 
         /* Set the input frequency according to the selected clock source */
@@ -808,11 +818,12 @@ static int wl128x_configure_mcs_pll(struct wl1271 *wl, int clk)
  */
 static int wl128x_boot_clk(struct wl1271 *wl, int *selected_clock)
 {
+        struct wl12xx_priv *priv = wl->priv;
         u16 sys_clk_cfg;
 
         /* For XTAL-only modes, FREF will be used after switching from TCXO */
-        if (wl->ref_clock == WL12XX_REFCLOCK_26_XTAL ||
-            wl->ref_clock == WL12XX_REFCLOCK_38_XTAL) {
+        if (priv->ref_clock == WL12XX_REFCLOCK_26_XTAL ||
+            priv->ref_clock == WL12XX_REFCLOCK_38_XTAL) {
                 if (!wl128x_switch_tcxo_to_fref(wl))
                         return -EINVAL;
                 goto fref_clk;
@@ -826,8 +837,8 @@ static int wl128x_boot_clk(struct wl1271 *wl, int *selected_clock)
                 goto fref_clk;
 
         /* If TCXO is either 32.736MHz or 16.368MHz, switch to FREF */
-        if (wl->tcxo_clock == WL12XX_TCXOCLOCK_16_368 ||
-            wl->tcxo_clock == WL12XX_TCXOCLOCK_32_736) {
+        if (priv->tcxo_clock == WL12XX_TCXOCLOCK_16_368 ||
+            priv->tcxo_clock == WL12XX_TCXOCLOCK_32_736) {
                 if (!wl128x_switch_tcxo_to_fref(wl))
                         return -EINVAL;
                 goto fref_clk;
@@ -836,14 +847,14 @@ static int wl128x_boot_clk(struct wl1271 *wl, int *selected_clock)
         /* TCXO clock is selected */
         if (!wl128x_is_tcxo_valid(wl))
                 return -EINVAL;
-        *selected_clock = wl->tcxo_clock;
+        *selected_clock = priv->tcxo_clock;
         goto config_mcs_pll;
 
 fref_clk:
         /* FREF clock is selected */
         if (!wl128x_is_fref_valid(wl))
                 return -EINVAL;
-        *selected_clock = wl->ref_clock;
+        *selected_clock = priv->ref_clock;
 
 config_mcs_pll:
         return wl128x_configure_mcs_pll(wl, *selected_clock);
@@ -851,25 +862,27 @@ config_mcs_pll:
 
 static int wl127x_boot_clk(struct wl1271 *wl)
 {
+        struct wl12xx_priv *priv = wl->priv;
         u32 pause;
         u32 clk;
 
         if (WL127X_PG_GET_MAJOR(wl->hw_pg_ver) < 3)
                 wl->quirks |= WLCORE_QUIRK_END_OF_TRANSACTION;
 
-        if (wl->ref_clock == CONF_REF_CLK_19_2_E ||
-            wl->ref_clock == CONF_REF_CLK_38_4_E ||
-            wl->ref_clock == CONF_REF_CLK_38_4_M_XTAL)
+        if (priv->ref_clock == CONF_REF_CLK_19_2_E ||
+            priv->ref_clock == CONF_REF_CLK_38_4_E ||
+            priv->ref_clock == CONF_REF_CLK_38_4_M_XTAL)
                 /* ref clk: 19.2/38.4/38.4-XTAL */
                 clk = 0x3;
-        else if (wl->ref_clock == CONF_REF_CLK_26_E ||
-                 wl->ref_clock == CONF_REF_CLK_52_E)
+        else if (priv->ref_clock == CONF_REF_CLK_26_E ||
+                 priv->ref_clock == CONF_REF_CLK_26_M_XTAL ||
+                 priv->ref_clock == CONF_REF_CLK_52_E)
                 /* ref clk: 26/52 */
                 clk = 0x5;
         else
                 return -EINVAL;
 
-        if (wl->ref_clock != CONF_REF_CLK_19_2_E) {
+        if (priv->ref_clock != CONF_REF_CLK_19_2_E) {
                 u16 val;
                 /* Set clock type (open drain) */
                 val = wl12xx_top_reg_read(wl, OCP_REG_CLK_TYPE);
@@ -939,6 +952,7 @@ static int wl1271_boot_soft_reset(struct wl1271 *wl)
 
 static int wl12xx_pre_boot(struct wl1271 *wl)
 {
+        struct wl12xx_priv *priv = wl->priv;
         int ret = 0;
         u32 clk;
         int selected_clock = -1;
@@ -970,7 +984,7 @@ static int wl12xx_pre_boot(struct wl1271 *wl)
         if (wl->chip.id == CHIP_ID_1283_PG20)
                 clk |= ((selected_clock & 0x3) << 1) << 4;
         else
-                clk |= (wl->ref_clock << 1) << 4;
+                clk |= (priv->ref_clock << 1) << 4;
 
         wl1271_write32(wl, WL12XX_DRPW_SCRATCH_START, clk);
 
@@ -989,7 +1003,7 @@ out:
 
 static void wl12xx_pre_upload(struct wl1271 *wl)
 {
-        u32 tmp;
+        u32 tmp, polarity;
 
         /* write firmware's last address (ie. it's length) to
          * ACX_EEPROMLESS_IND_REG */
@@ -1009,23 +1023,23 @@ static void wl12xx_pre_upload(struct wl1271 *wl)
 
         if (wl->chip.id == CHIP_ID_1283_PG20)
                 wl12xx_top_reg_write(wl, SDIO_IO_DS, HCI_IO_DS_6MA);
-}
-
-static void wl12xx_enable_interrupts(struct wl1271 *wl)
-{
-        u32 polarity;
 
+        /* polarity must be set before the firmware is loaded */
         polarity = wl12xx_top_reg_read(wl, OCP_REG_POLARITY);
 
         /* We use HIGH polarity, so unset the LOW bit */
         polarity &= ~POLARITY_LOW;
         wl12xx_top_reg_write(wl, OCP_REG_POLARITY, polarity);
 
-        wlcore_write_reg(wl, REG_INTERRUPT_MASK, WL1271_ACX_ALL_EVENTS_VECTOR);
+}
+
+static void wl12xx_enable_interrupts(struct wl1271 *wl)
+{
+        wlcore_write_reg(wl, REG_INTERRUPT_MASK, WL12XX_ACX_ALL_EVENTS_VECTOR);
 
         wlcore_enable_interrupts(wl);
         wlcore_write_reg(wl, REG_INTERRUPT_MASK,
-                         WL1271_ACX_INTR_ALL & ~(WL1271_INTR_MASK));
+                         WL1271_ACX_INTR_ALL & ~(WL12XX_INTR_MASK));
 
         wl1271_write32(wl, WL12XX_HI_CFG, HI_CFG_DEF_VAL);
 }
@@ -1149,7 +1163,8 @@ static u32 wl12xx_get_rx_packet_len(struct wl1271 *wl, void *rx_data,
 
 static void wl12xx_tx_delayed_compl(struct wl1271 *wl)
 {
-        if (wl->fw_status->tx_results_counter == (wl->tx_results_count & 0xff))
+        if (wl->fw_status_1->tx_results_counter ==
+            (wl->tx_results_count & 0xff))
                 return;
 
         wl1271_tx_complete(wl);
@@ -1288,10 +1303,90 @@ static void wl12xx_get_mac(struct wl1271 *wl)
                 wl12xx_get_fuse_mac(wl);
 }
 
+static void wl12xx_set_tx_desc_csum(struct wl1271 *wl,
+                                    struct wl1271_tx_hw_descr *desc,
+                                    struct sk_buff *skb)
+{
+        desc->wl12xx_reserved = 0;
+}
+
+static int wl12xx_plt_init(struct wl1271 *wl)
+{
+        int ret;
+
+        ret = wl->ops->boot(wl);
+        if (ret < 0)
+                goto out;
+
+        ret = wl->ops->hw_init(wl);
+        if (ret < 0)
+                goto out_irq_disable;
+
+        ret = wl1271_acx_init_mem_config(wl);
+        if (ret < 0)
+                goto out_irq_disable;
+
+        ret = wl12xx_acx_mem_cfg(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* Enable data path */
+        ret = wl1271_cmd_data_path(wl, 1);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* Configure for CAM power saving (ie. always active) */
+        ret = wl1271_acx_sleep_auth(wl, WL1271_PSM_CAM);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        /* configure PM */
+        ret = wl1271_acx_pm_config(wl);
+        if (ret < 0)
+                goto out_free_memmap;
+
+        goto out;
+
+out_free_memmap:
+        kfree(wl->target_mem_map);
+        wl->target_mem_map = NULL;
+
+out_irq_disable:
+        mutex_unlock(&wl->mutex);
+        /* Unlocking the mutex in the middle of handling is
+           inherently unsafe. In this case we deem it safe to do,
+           because we need to let any possibly pending IRQ out of
+           the system (and while we are WL1271_STATE_OFF the IRQ
+           work function will not do anything.) Also, any other
+           possible concurrent operations will fail due to the
+           current state, hence the wl1271 struct should be safe. */
+        wlcore_disable_interrupts(wl);
+        mutex_lock(&wl->mutex);
+out:
+        return ret;
+}
+
+static int wl12xx_get_spare_blocks(struct wl1271 *wl, bool is_gem)
+{
+        if (is_gem)
+                return WL12XX_TX_HW_BLOCK_GEM_SPARE;
+
+        return WL12XX_TX_HW_BLOCK_SPARE_DEFAULT;
+}
+
+static int wl12xx_set_key(struct wl1271 *wl, enum set_key_cmd cmd,
+                          struct ieee80211_vif *vif,
+                          struct ieee80211_sta *sta,
+                          struct ieee80211_key_conf *key_conf)
+{
+        return wlcore_set_key(wl, cmd, vif, sta, key_conf);
+}
+
 static struct wlcore_ops wl12xx_ops = {
         .identify_chip          = wl12xx_identify_chip,
         .identify_fw            = wl12xx_identify_fw,
         .boot                   = wl12xx_boot,
+        .plt_init               = wl12xx_plt_init,
         .trigger_cmd            = wl12xx_trigger_cmd,
         .ack_event              = wl12xx_ack_event,
         .calc_tx_blocks         = wl12xx_calc_tx_blocks,
@@ -1306,6 +1401,13 @@ static struct wlcore_ops wl12xx_ops = {
         .sta_get_ap_rate_mask   = wl12xx_sta_get_ap_rate_mask,
         .get_pg_ver             = wl12xx_get_pg_ver,
         .get_mac                = wl12xx_get_mac,
+        .set_tx_desc_csum       = wl12xx_set_tx_desc_csum,
+        .set_rx_csum            = NULL,
+        .ap_get_mimo_wide_rate_mask = NULL,
+        .debugfs_init           = wl12xx_debugfs_add_files,
+        .get_spare_blocks       = wl12xx_get_spare_blocks,
+        .set_key                = wl12xx_set_key,
+        .pre_pkt_send           = NULL,
 };
 
 static struct ieee80211_sta_ht_cap wl12xx_ht_cap = {
@@ -1323,6 +1425,7 @@ static struct ieee80211_sta_ht_cap wl12xx_ht_cap = {
 
 static int __devinit wl12xx_probe(struct platform_device *pdev)
 {
+        struct wl12xx_platform_data *pdata = pdev->dev.platform_data;
         struct wl1271 *wl;
         struct ieee80211_hw *hw;
         struct wl12xx_priv *priv;
@@ -1334,19 +1437,65 @@ static int __devinit wl12xx_probe(struct platform_device *pdev)
         }
 
         wl = hw->priv;
+        priv = wl->priv;
         wl->ops = &wl12xx_ops;
         wl->ptable = wl12xx_ptable;
         wl->rtable = wl12xx_rtable;
         wl->num_tx_desc = 16;
-        wl->normal_tx_spare = WL12XX_TX_HW_BLOCK_SPARE_DEFAULT;
-        wl->gem_tx_spare = WL12XX_TX_HW_BLOCK_GEM_SPARE;
+        wl->num_rx_desc = 8;
         wl->band_rate_to_idx = wl12xx_band_rate_to_idx;
         wl->hw_tx_rate_tbl_size = WL12XX_CONF_HW_RXTX_RATE_MAX;
         wl->hw_min_ht_rate = WL12XX_CONF_HW_RXTX_RATE_MCS0;
         wl->fw_status_priv_len = 0;
-        memcpy(&wl->ht_cap, &wl12xx_ht_cap, sizeof(wl12xx_ht_cap));
+        wl->stats.fw_stats_len = sizeof(struct wl12xx_acx_statistics);
+        memcpy(&wl->ht_cap[IEEE80211_BAND_2GHZ], &wl12xx_ht_cap,
+               sizeof(wl12xx_ht_cap));
+        memcpy(&wl->ht_cap[IEEE80211_BAND_5GHZ], &wl12xx_ht_cap,
+               sizeof(wl12xx_ht_cap));
         wl12xx_conf_init(wl);
 
+        if (!fref_param) {
+                priv->ref_clock = pdata->board_ref_clock;
+        } else {
+                if (!strcmp(fref_param, "19.2"))
+                        priv->ref_clock = WL12XX_REFCLOCK_19;
+                else if (!strcmp(fref_param, "26"))
+                        priv->ref_clock = WL12XX_REFCLOCK_26;
+                else if (!strcmp(fref_param, "26x"))
+                        priv->ref_clock = WL12XX_REFCLOCK_26_XTAL;
+                else if (!strcmp(fref_param, "38.4"))
+                        priv->ref_clock = WL12XX_REFCLOCK_38;
+                else if (!strcmp(fref_param, "38.4x"))
+                        priv->ref_clock = WL12XX_REFCLOCK_38_XTAL;
+                else if (!strcmp(fref_param, "52"))
+                        priv->ref_clock = WL12XX_REFCLOCK_52;
+                else
+                        wl1271_error("Invalid fref parameter %s", fref_param);
+        }
+
+        if (!tcxo_param) {
+                priv->tcxo_clock = pdata->board_tcxo_clock;
+        } else {
+                if (!strcmp(tcxo_param, "19.2"))
+                        priv->tcxo_clock = WL12XX_TCXOCLOCK_19_2;
+                else if (!strcmp(tcxo_param, "26"))
+                        priv->tcxo_clock = WL12XX_TCXOCLOCK_26;
+                else if (!strcmp(tcxo_param, "38.4"))
+                        priv->tcxo_clock = WL12XX_TCXOCLOCK_38_4;
+                else if (!strcmp(tcxo_param, "52"))
+                        priv->tcxo_clock = WL12XX_TCXOCLOCK_52;
+                else if (!strcmp(tcxo_param, "16.368"))
+                        priv->tcxo_clock = WL12XX_TCXOCLOCK_16_368;
+                else if (!strcmp(tcxo_param, "32.736"))
+                        priv->tcxo_clock = WL12XX_TCXOCLOCK_32_736;
+                else if (!strcmp(tcxo_param, "16.8"))
+                        priv->tcxo_clock = WL12XX_TCXOCLOCK_16_8;
+                else if (!strcmp(tcxo_param, "33.6"))
+                        priv->tcxo_clock = WL12XX_TCXOCLOCK_33_6;
+                else
+                        wl1271_error("Invalid tcxo parameter %s", tcxo_param);
+        }
+
         return wlcore_probe(wl, pdev);
 }
 
@@ -1378,6 +1527,13 @@ static void __exit wl12xx_exit(void)
 }
 module_exit(wl12xx_exit);
 
+module_param_named(fref, fref_param, charp, 0);
+MODULE_PARM_DESC(fref, "FREF clock: 19.2, 26, 26x, 38.4, 38.4x, 52");
+
+module_param_named(tcxo, tcxo_param, charp, 0);
+MODULE_PARM_DESC(tcxo,
+                 "TCXO clock: 19.2, 26, 38.4, 52, 16.368, 32.736, 16.8, 33.6");
+
 MODULE_LICENSE("GPL v2");
 MODULE_AUTHOR("Luciano Coelho <coelho@ti.com>");
 MODULE_FIRMWARE(WL127X_FW_NAME_SINGLE);
diff --git a/drivers/net/wireless/ti/wl12xx/wl12xx.h b/drivers/net/wireless/ti/wl12xx/wl12xx.h
index 74cd332e23ef..de1132410876 100644
--- a/drivers/net/wireless/ti/wl12xx/wl12xx.h
+++ b/drivers/net/wireless/ti/wl12xx/wl12xx.h
@@ -24,8 +24,16 @@
 
 #include "conf.h"
 
+struct wl127x_rx_mem_pool_addr {
+        u32 addr;
+        u32 addr_extra;
+};
+
 struct wl12xx_priv {
         struct wl12xx_priv_conf conf;
+
+        int ref_clock;
+        int tcxo_clock;
 };
 
 #endif /* __WL12XX_PRIV_H__ */
diff --git a/drivers/net/wireless/ti/wl18xx/Kconfig b/drivers/net/wireless/ti/wl18xx/Kconfig
new file mode 100644
index 000000000000..1cfdb2548821
--- /dev/null
+++ b/drivers/net/wireless/ti/wl18xx/Kconfig
@@ -0,0 +1,7 @@
+config WL18XX
+        tristate "TI wl18xx support"
+        depends on MAC80211
+        select WLCORE
+        ---help---
+          This module adds support for wireless adapters based on TI
+          WiLink 8 chipsets.
diff --git a/drivers/net/wireless/ti/wl18xx/Makefile b/drivers/net/wireless/ti/wl18xx/Makefile
new file mode 100644
index 000000000000..67c098734c7f
--- /dev/null
+++ b/drivers/net/wireless/ti/wl18xx/Makefile
@@ -0,0 +1,3 @@
+wl18xx-objs     = main.o acx.o tx.o io.o debugfs.o
+
+obj-$(CONFIG_WL18XX)            += wl18xx.o
diff --git a/drivers/net/wireless/ti/wl18xx/acx.c b/drivers/net/wireless/ti/wl18xx/acx.c
new file mode 100644
index 000000000000..72840e23bf59
--- /dev/null
+++ b/drivers/net/wireless/ti/wl18xx/acx.c
@@ -0,0 +1,111 @@
+/*
+ * This file is part of wl18xx
+ *
+ * Copyright (C) 2011 Texas Instruments Inc.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include "../wlcore/cmd.h"
+#include "../wlcore/debug.h"
+#include "../wlcore/acx.h"
+
+#include "acx.h"
+
+int wl18xx_acx_host_if_cfg_bitmap(struct wl1271 *wl, u32 host_cfg_bitmap,
+                                  u32 sdio_blk_size, u32 extra_mem_blks,
+                                  u32 len_field_size)
+{
+        struct wl18xx_acx_host_config_bitmap *bitmap_conf;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx cfg bitmap %d blk %d spare %d field %d",
+                     host_cfg_bitmap, sdio_blk_size, extra_mem_blks,
+                     len_field_size);
+
+        bitmap_conf = kzalloc(sizeof(*bitmap_conf), GFP_KERNEL);
+        if (!bitmap_conf) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        bitmap_conf->host_cfg_bitmap = cpu_to_le32(host_cfg_bitmap);
+        bitmap_conf->host_sdio_block_size = cpu_to_le32(sdio_blk_size);
+        bitmap_conf->extra_mem_blocks = cpu_to_le32(extra_mem_blks);
+        bitmap_conf->length_field_size = cpu_to_le32(len_field_size);
+
+        ret = wl1271_cmd_configure(wl, ACX_HOST_IF_CFG_BITMAP,
+                                   bitmap_conf, sizeof(*bitmap_conf));
+        if (ret < 0) {
+                wl1271_warning("wl1271 bitmap config opt failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(bitmap_conf);
+
+        return ret;
+}
+
+int wl18xx_acx_set_checksum_state(struct wl1271 *wl)
+{
+        struct wl18xx_acx_checksum_state *acx;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx checksum state");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->checksum_state = CHECKSUM_OFFLOAD_ENABLED;
+
+        ret = wl1271_cmd_configure(wl, ACX_CHECKSUM_CONFIG, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("failed to set Tx checksum state: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+int wl18xx_acx_clear_statistics(struct wl1271 *wl)
+{
+        struct wl18xx_acx_clear_statistics *acx;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_ACX, "acx clear statistics");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        ret = wl1271_cmd_configure(wl, ACX_CLEAR_STATISTICS, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("failed to clear firmware statistics: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
diff --git a/drivers/net/wireless/ti/wl18xx/acx.h b/drivers/net/wireless/ti/wl18xx/acx.h
new file mode 100644
index 000000000000..ebbaf611e97b
--- /dev/null
+++ b/drivers/net/wireless/ti/wl18xx/acx.h
@@ -0,0 +1,291 @@
+/*
+ * This file is part of wl18xx
+ *
+ * Copyright (C) 2011 Texas Instruments. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL18XX_ACX_H__
+#define __WL18XX_ACX_H__
+
+#include "../wlcore/wlcore.h"
+#include "../wlcore/acx.h"
+
+enum {
+        ACX_CLEAR_STATISTICS             = 0x0047,
+};
+
+/* numbers of bits the length field takes (add 1 for the actual number) */
+#define WL18XX_HOST_IF_LEN_SIZE_FIELD 15
+
+#define WL18XX_ACX_EVENTS_VECTOR_PG1    (WL1271_ACX_INTR_WATCHDOG      | \
+                                        WL1271_ACX_INTR_INIT_COMPLETE | \
+                                        WL1271_ACX_INTR_EVENT_A       | \
+                                        WL1271_ACX_INTR_EVENT_B       | \
+                                        WL1271_ACX_INTR_CMD_COMPLETE  | \
+                                        WL1271_ACX_INTR_HW_AVAILABLE  | \
+                                        WL1271_ACX_INTR_DATA)
+
+#define WL18XX_ACX_EVENTS_VECTOR_PG2    (WL18XX_ACX_EVENTS_VECTOR_PG1 | \
+                                        WL1271_ACX_SW_INTR_WATCHDOG)
+
+#define WL18XX_INTR_MASK_PG1            (WL1271_ACX_INTR_WATCHDOG      | \
+                                        WL1271_ACX_INTR_EVENT_A       | \
+                                        WL1271_ACX_INTR_EVENT_B       | \
+                                        WL1271_ACX_INTR_HW_AVAILABLE  | \
+                                        WL1271_ACX_INTR_DATA)
+
+#define WL18XX_INTR_MASK_PG2            (WL18XX_INTR_MASK_PG1         | \
+                                        WL1271_ACX_SW_INTR_WATCHDOG)
+
+struct wl18xx_acx_host_config_bitmap {
+        struct acx_header header;
+
+        __le32 host_cfg_bitmap;
+
+        __le32 host_sdio_block_size;
+
+        /* extra mem blocks per frame in TX. */
+        __le32 extra_mem_blocks;
+
+        /*
+         * number of bits of the length field in the first TX word
+         * (up to 15 - for using the entire 16 bits).
+         */
+        __le32 length_field_size;
+
+} __packed;
+
+enum {
+        CHECKSUM_OFFLOAD_DISABLED = 0,
+        CHECKSUM_OFFLOAD_ENABLED  = 1,
+        CHECKSUM_OFFLOAD_FAKE_RX  = 2,
+        CHECKSUM_OFFLOAD_INVALID  = 0xFF
+};
+
+struct wl18xx_acx_checksum_state {
+        struct acx_header header;
+
+         /* enum acx_checksum_state */
+        u8 checksum_state;
+        u8 pad[3];
+} __packed;
+
+
+struct wl18xx_acx_error_stats {
+        u32 error_frame;
+        u32 error_null_Frame_tx_start;
+        u32 error_numll_frame_cts_start;
+        u32 error_bar_retry;
+        u32 error_frame_cts_nul_flid;
+} __packed;
+
+struct wl18xx_acx_debug_stats {
+        u32 debug1;
+        u32 debug2;
+        u32 debug3;
+        u32 debug4;
+        u32 debug5;
+        u32 debug6;
+} __packed;
+
+struct wl18xx_acx_ring_stats {
+        u32 prepared_descs;
+        u32 tx_cmplt;
+} __packed;
+
+struct wl18xx_acx_tx_stats {
+        u32 tx_prepared_descs;
+        u32 tx_cmplt;
+        u32 tx_template_prepared;
+        u32 tx_data_prepared;
+        u32 tx_template_programmed;
+        u32 tx_data_programmed;
+        u32 tx_burst_programmed;
+        u32 tx_starts;
+        u32 tx_imm_resp;
+        u32 tx_start_templates;
+        u32 tx_start_int_templates;
+        u32 tx_start_fw_gen;
+        u32 tx_start_data;
+        u32 tx_start_null_frame;
+        u32 tx_exch;
+        u32 tx_retry_template;
+        u32 tx_retry_data;
+        u32 tx_exch_pending;
+        u32 tx_exch_expiry;
+        u32 tx_done_template;
+        u32 tx_done_data;
+        u32 tx_done_int_template;
+        u32 tx_frame_checksum;
+        u32 tx_checksum_result;
+        u32 frag_called;
+        u32 frag_mpdu_alloc_failed;
+        u32 frag_init_called;
+        u32 frag_in_process_called;
+        u32 frag_tkip_called;
+        u32 frag_key_not_found;
+        u32 frag_need_fragmentation;
+        u32 frag_bad_mblk_num;
+        u32 frag_failed;
+        u32 frag_cache_hit;
+        u32 frag_cache_miss;
+} __packed;
+
+struct wl18xx_acx_rx_stats {
+        u32 rx_beacon_early_term;
+        u32 rx_out_of_mpdu_nodes;
+        u32 rx_hdr_overflow;
+        u32 rx_dropped_frame;
+        u32 rx_done_stage;
+        u32 rx_done;
+        u32 rx_defrag;
+        u32 rx_defrag_end;
+        u32 rx_cmplt;
+        u32 rx_pre_complt;
+        u32 rx_cmplt_task;
+        u32 rx_phy_hdr;
+        u32 rx_timeout;
+        u32 rx_timeout_wa;
+        u32 rx_wa_density_dropped_frame;
+        u32 rx_wa_ba_not_expected;
+        u32 rx_frame_checksum;
+        u32 rx_checksum_result;
+        u32 defrag_called;
+        u32 defrag_init_called;
+        u32 defrag_in_process_called;
+        u32 defrag_tkip_called;
+        u32 defrag_need_defrag;
+        u32 defrag_decrypt_failed;
+        u32 decrypt_key_not_found;
+        u32 defrag_need_decrypt;
+        u32 rx_tkip_replays;
+} __packed;
+
+struct wl18xx_acx_isr_stats {
+        u32 irqs;
+} __packed;
+
+#define PWR_STAT_MAX_CONT_MISSED_BCNS_SPREAD 10
+
+struct wl18xx_acx_pwr_stats {
+        u32 missing_bcns_cnt;
+        u32 rcvd_bcns_cnt;
+        u32 connection_out_of_sync;
+        u32 cont_miss_bcns_spread[PWR_STAT_MAX_CONT_MISSED_BCNS_SPREAD];
+        u32 rcvd_awake_bcns_cnt;
+} __packed;
+
+struct wl18xx_acx_event_stats {
+        u32 calibration;
+        u32 rx_mismatch;
+        u32 rx_mem_empty;
+} __packed;
+
+struct wl18xx_acx_ps_poll_stats {
+        u32 ps_poll_timeouts;
+        u32 upsd_timeouts;
+        u32 upsd_max_ap_turn;
+        u32 ps_poll_max_ap_turn;
+        u32 ps_poll_utilization;
+        u32 upsd_utilization;
+} __packed;
+
+struct wl18xx_acx_rx_filter_stats {
+        u32 beacon_filter;
+        u32 arp_filter;
+        u32 mc_filter;
+        u32 dup_filter;
+        u32 data_filter;
+        u32 ibss_filter;
+        u32 protection_filter;
+        u32 accum_arp_pend_requests;
+        u32 max_arp_queue_dep;
+} __packed;
+
+struct wl18xx_acx_rx_rate_stats {
+        u32 rx_frames_per_rates[50];
+} __packed;
+
+#define AGGR_STATS_TX_AGG       16
+#define AGGR_STATS_TX_RATE      16
+#define AGGR_STATS_RX_SIZE_LEN  16
+
+struct wl18xx_acx_aggr_stats {
+        u32 tx_agg_vs_rate[AGGR_STATS_TX_AGG * AGGR_STATS_TX_RATE];
+        u32 rx_size[AGGR_STATS_RX_SIZE_LEN];
+} __packed;
+
+#define PIPE_STATS_HW_FIFO      11
+
+struct wl18xx_acx_pipeline_stats {
+        u32 hs_tx_stat_fifo_int;
+        u32 hs_rx_stat_fifo_int;
+        u32 tcp_tx_stat_fifo_int;
+        u32 tcp_rx_stat_fifo_int;
+        u32 enc_tx_stat_fifo_int;
+        u32 enc_rx_stat_fifo_int;
+        u32 rx_complete_stat_fifo_int;
+        u32 pre_proc_swi;
+        u32 post_proc_swi;
+        u32 sec_frag_swi;
+        u32 pre_to_defrag_swi;
+        u32 defrag_to_csum_swi;
+        u32 csum_to_rx_xfer_swi;
+        u32 dec_packet_in;
+        u32 dec_packet_in_fifo_full;
+        u32 dec_packet_out;
+        u32 cs_rx_packet_in;
+        u32 cs_rx_packet_out;
+        u16 pipeline_fifo_full[PIPE_STATS_HW_FIFO];
+} __packed;
+
+struct wl18xx_acx_mem_stats {
+        u32 rx_free_mem_blks;
+        u32 tx_free_mem_blks;
+        u32 fwlog_free_mem_blks;
+        u32 fw_gen_free_mem_blks;
+} __packed;
+
+struct wl18xx_acx_statistics {
+        struct acx_header header;
+
+        struct wl18xx_acx_error_stats           error;
+        struct wl18xx_acx_debug_stats           debug;
+        struct wl18xx_acx_tx_stats              tx;
+        struct wl18xx_acx_rx_stats              rx;
+        struct wl18xx_acx_isr_stats             isr;
+        struct wl18xx_acx_pwr_stats             pwr;
+        struct wl18xx_acx_ps_poll_stats         ps_poll;
+        struct wl18xx_acx_rx_filter_stats       rx_filter;
+        struct wl18xx_acx_rx_rate_stats         rx_rate;
+        struct wl18xx_acx_aggr_stats            aggr_size;
+        struct wl18xx_acx_pipeline_stats        pipeline;
+        struct wl18xx_acx_mem_stats             mem;
+} __packed;
+
+struct wl18xx_acx_clear_statistics {
+        struct acx_header header;
+};
+
+int wl18xx_acx_host_if_cfg_bitmap(struct wl1271 *wl, u32 host_cfg_bitmap,
+                                  u32 sdio_blk_size, u32 extra_mem_blks,
+                                  u32 len_field_size);
+int wl18xx_acx_set_checksum_state(struct wl1271 *wl);
+int wl18xx_acx_clear_statistics(struct wl1271 *wl);
+
+#endif /* __WL18XX_ACX_H__ */
diff --git a/drivers/net/wireless/ti/wl18xx/conf.h b/drivers/net/wireless/ti/wl18xx/conf.h
new file mode 100644
index 000000000000..fac0b7e87e75
--- /dev/null
+++ b/drivers/net/wireless/ti/wl18xx/conf.h
@@ -0,0 +1,92 @@
+/*
+ * This file is part of wl18xx
+ *
+ * Copyright (C) 2011 Texas Instruments Inc.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL18XX_CONF_H__
+#define __WL18XX_CONF_H__
+
+#define WL18XX_CONF_MAGIC       0x10e100ca
+#define WL18XX_CONF_VERSION     (WLCORE_CONF_VERSION | 0x0002)
+#define WL18XX_CONF_MASK        0x0000ffff
+#define WL18XX_CONF_SIZE        (WLCORE_CONF_SIZE + \
+                                 sizeof(struct wl18xx_priv_conf))
+
+#define NUM_OF_CHANNELS_11_ABG 150
+#define NUM_OF_CHANNELS_11_P 7
+#define WL18XX_NUM_OF_SUB_BANDS 9
+#define SRF_TABLE_LEN 16
+#define PIN_MUXING_SIZE 2
+
+struct wl18xx_mac_and_phy_params {
+        u8 phy_standalone;
+        u8 rdl;
+        u8 enable_clpc;
+        u8 enable_tx_low_pwr_on_siso_rdl;
+        u8 auto_detect;
+        u8 dedicated_fem;
+
+        u8 low_band_component;
+
+        /* Bit 0: One Hot, Bit 1: Control Enable, Bit 2: 1.8V, Bit 3: 3V */
+        u8 low_band_component_type;
+
+        u8 high_band_component;
+
+        /* Bit 0: One Hot, Bit 1: Control Enable, Bit 2: 1.8V, Bit 3: 3V */
+        u8 high_band_component_type;
+        u8 number_of_assembled_ant2_4;
+        u8 number_of_assembled_ant5;
+        u8 pin_muxing_platform_options[PIN_MUXING_SIZE];
+        u8 external_pa_dc2dc;
+        u8 tcxo_ldo_voltage;
+        u8 xtal_itrim_val;
+        u8 srf_state;
+        u8 srf1[SRF_TABLE_LEN];
+        u8 srf2[SRF_TABLE_LEN];
+        u8 srf3[SRF_TABLE_LEN];
+        u8 io_configuration;
+        u8 sdio_configuration;
+        u8 settings;
+        u8 rx_profile;
+        u8 per_chan_pwr_limit_arr_11abg[NUM_OF_CHANNELS_11_ABG];
+        u8 pwr_limit_reference_11_abg;
+        u8 per_chan_pwr_limit_arr_11p[NUM_OF_CHANNELS_11_P];
+        u8 pwr_limit_reference_11p;
+        u8 per_sub_band_tx_trace_loss[WL18XX_NUM_OF_SUB_BANDS];
+        u8 per_sub_band_rx_trace_loss[WL18XX_NUM_OF_SUB_BANDS];
+        u8 primary_clock_setting_time;
+        u8 clock_valid_on_wake_up;
+        u8 secondary_clock_setting_time;
+        u8 board_type;
+        /* enable point saturation */
+        u8 psat;
+        /* low/medium/high Tx power in dBm */
+        s8 low_power_val;
+        s8 med_power_val;
+        s8 high_power_val;
+        u8 padding[1];
+} __packed;
+
+struct wl18xx_priv_conf {
+        /* this structure is copied wholesale to FW */
+        struct wl18xx_mac_and_phy_params phy;
+} __packed;
+
+#endif /* __WL18XX_CONF_H__ */
diff --git a/drivers/net/wireless/ti/wl18xx/debugfs.c b/drivers/net/wireless/ti/wl18xx/debugfs.c
new file mode 100644
index 000000000000..3ce6f1039af3
--- /dev/null
+++ b/drivers/net/wireless/ti/wl18xx/debugfs.c
@@ -0,0 +1,403 @@
+/*
+ * This file is part of wl18xx
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ * Copyright (C) 2011-2012 Texas Instruments
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include "../wlcore/debugfs.h"
+#include "../wlcore/wlcore.h"
+
+#include "wl18xx.h"
+#include "acx.h"
+#include "debugfs.h"
+
+#define WL18XX_DEBUGFS_FWSTATS_FILE(a, b, c) \
+        DEBUGFS_FWSTATS_FILE(a, b, c, wl18xx_acx_statistics)
+#define WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY(a, b, c) \
+        DEBUGFS_FWSTATS_FILE_ARRAY(a, b, c, wl18xx_acx_statistics)
+
+
+WL18XX_DEBUGFS_FWSTATS_FILE(debug, debug1, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(debug, debug2, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(debug, debug3, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(debug, debug4, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(debug, debug5, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(debug, debug6, "%u");
+
+WL18XX_DEBUGFS_FWSTATS_FILE(error, error_frame, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(error, error_null_Frame_tx_start, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(error, error_numll_frame_cts_start, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(error, error_bar_retry, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(error, error_frame_cts_nul_flid, "%u");
+
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, tx_prepared_descs, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, tx_cmplt, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, tx_template_prepared, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, tx_data_prepared, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, tx_template_programmed, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, tx_data_programmed, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, tx_burst_programmed, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, tx_starts, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, tx_imm_resp, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, tx_start_templates, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, tx_start_int_templates, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, tx_start_fw_gen, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, tx_start_data, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, tx_start_null_frame, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, tx_exch, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, tx_retry_template, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, tx_retry_data, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, tx_exch_pending, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, tx_exch_expiry, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, tx_done_template, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, tx_done_data, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, tx_done_int_template, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, tx_frame_checksum, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, tx_checksum_result, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, frag_called, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, frag_mpdu_alloc_failed, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, frag_init_called, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, frag_in_process_called, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, frag_tkip_called, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, frag_key_not_found, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, frag_need_fragmentation, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, frag_bad_mblk_num, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, frag_failed, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, frag_cache_hit, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(tx, frag_cache_miss, "%u");
+
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, rx_beacon_early_term, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, rx_out_of_mpdu_nodes, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, rx_hdr_overflow, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, rx_dropped_frame, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, rx_done, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, rx_defrag, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, rx_defrag_end, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, rx_cmplt, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, rx_pre_complt, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, rx_cmplt_task, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, rx_phy_hdr, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, rx_timeout, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, rx_timeout_wa, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, rx_wa_density_dropped_frame, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, rx_wa_ba_not_expected, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, rx_frame_checksum, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, rx_checksum_result, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, defrag_called, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, defrag_init_called, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, defrag_in_process_called, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, defrag_tkip_called, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, defrag_need_defrag, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, defrag_decrypt_failed, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, decrypt_key_not_found, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, defrag_need_decrypt, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx, rx_tkip_replays, "%u");
+
+WL18XX_DEBUGFS_FWSTATS_FILE(isr, irqs, "%u");
+
+WL18XX_DEBUGFS_FWSTATS_FILE(pwr, missing_bcns_cnt, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(pwr, rcvd_bcns_cnt, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(pwr, connection_out_of_sync, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY(pwr, cont_miss_bcns_spread,
+                                  PWR_STAT_MAX_CONT_MISSED_BCNS_SPREAD);
+WL18XX_DEBUGFS_FWSTATS_FILE(pwr, rcvd_awake_bcns_cnt, "%u");
+
+
+WL18XX_DEBUGFS_FWSTATS_FILE(ps_poll, ps_poll_timeouts, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(ps_poll, upsd_timeouts, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(ps_poll, upsd_max_ap_turn, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(ps_poll, ps_poll_max_ap_turn, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(ps_poll, ps_poll_utilization, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(ps_poll, upsd_utilization, "%u");
+
+WL18XX_DEBUGFS_FWSTATS_FILE(rx_filter, beacon_filter, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx_filter, arp_filter, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx_filter, mc_filter, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx_filter, dup_filter, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx_filter, data_filter, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx_filter, ibss_filter, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx_filter, protection_filter, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx_filter, accum_arp_pend_requests, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(rx_filter, max_arp_queue_dep, "%u");
+
+WL18XX_DEBUGFS_FWSTATS_FILE(rx_rate, rx_frames_per_rates, "%u");
+
+WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY(aggr_size, tx_agg_vs_rate,
+                                  AGGR_STATS_TX_AGG*AGGR_STATS_TX_RATE);
+WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY(aggr_size, rx_size,
+                                  AGGR_STATS_RX_SIZE_LEN);
+
+WL18XX_DEBUGFS_FWSTATS_FILE(pipeline, hs_tx_stat_fifo_int, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(pipeline, tcp_tx_stat_fifo_int, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(pipeline, tcp_rx_stat_fifo_int, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(pipeline, enc_tx_stat_fifo_int, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(pipeline, enc_rx_stat_fifo_int, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(pipeline, rx_complete_stat_fifo_int, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(pipeline, pre_proc_swi, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(pipeline, post_proc_swi, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(pipeline, sec_frag_swi, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(pipeline, pre_to_defrag_swi, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(pipeline, defrag_to_csum_swi, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(pipeline, csum_to_rx_xfer_swi, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(pipeline, dec_packet_in, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(pipeline, dec_packet_in_fifo_full, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(pipeline, dec_packet_out, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(pipeline, cs_rx_packet_in, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(pipeline, cs_rx_packet_out, "%u");
+
+WL18XX_DEBUGFS_FWSTATS_FILE_ARRAY(pipeline, pipeline_fifo_full,
+                                  PIPE_STATS_HW_FIFO);
+
+WL18XX_DEBUGFS_FWSTATS_FILE(mem, rx_free_mem_blks, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(mem, tx_free_mem_blks, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(mem, fwlog_free_mem_blks, "%u");
+WL18XX_DEBUGFS_FWSTATS_FILE(mem, fw_gen_free_mem_blks, "%u");
+
+static ssize_t conf_read(struct file *file, char __user *user_buf,
+                         size_t count, loff_t *ppos)
+{
+        struct wl1271 *wl = file->private_data;
+        struct wl18xx_priv *priv = wl->priv;
+        struct wlcore_conf_header header;
+        char *buf, *pos;
+        size_t len;
+        int ret;
+
+        len = WL18XX_CONF_SIZE;
+        buf = kmalloc(len, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        header.magic    = cpu_to_le32(WL18XX_CONF_MAGIC);
+        header.version  = cpu_to_le32(WL18XX_CONF_VERSION);
+        header.checksum = 0;
+
+        mutex_lock(&wl->mutex);
+
+        pos = buf;
+        memcpy(pos, &header, sizeof(header));
+        pos += sizeof(header);
+        memcpy(pos, &wl->conf, sizeof(wl->conf));
+        pos += sizeof(wl->conf);
+        memcpy(pos, &priv->conf, sizeof(priv->conf));
+
+        mutex_unlock(&wl->mutex);
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+
+        kfree(buf);
+        return ret;
+}
+
+static const struct file_operations conf_ops = {
+        .read = conf_read,
+        .open = simple_open,
+        .llseek = default_llseek,
+};
+
+static ssize_t clear_fw_stats_write(struct file *file,
+                              const char __user *user_buf,
+                              size_t count, loff_t *ppos)
+{
+        struct wl1271 *wl = file->private_data;
+        int ret;
+
+        mutex_lock(&wl->mutex);
+
+        if (wl->state == WL1271_STATE_OFF)
+                goto out;
+
+        ret = wl18xx_acx_clear_statistics(wl);
+        if (ret < 0) {
+                count = ret;
+                goto out;
+        }
+out:
+        mutex_unlock(&wl->mutex);
+        return count;
+}
+
+static const struct file_operations clear_fw_stats_ops = {
+        .write = clear_fw_stats_write,
+        .open = simple_open,
+        .llseek = default_llseek,
+};
+
+int wl18xx_debugfs_add_files(struct wl1271 *wl,
+                             struct dentry *rootdir)
+{
+        int ret = 0;
+        struct dentry *entry, *stats, *moddir;
+
+        moddir = debugfs_create_dir(KBUILD_MODNAME, rootdir);
+        if (!moddir || IS_ERR(moddir)) {
+                entry = moddir;
+                goto err;
+        }
+
+        stats = debugfs_create_dir("fw_stats", moddir);
+        if (!stats || IS_ERR(stats)) {
+                entry = stats;
+                goto err;
+        }
+
+        DEBUGFS_ADD(clear_fw_stats, stats);
+
+        DEBUGFS_FWSTATS_ADD(debug, debug1);
+        DEBUGFS_FWSTATS_ADD(debug, debug2);
+        DEBUGFS_FWSTATS_ADD(debug, debug3);
+        DEBUGFS_FWSTATS_ADD(debug, debug4);
+        DEBUGFS_FWSTATS_ADD(debug, debug5);
+        DEBUGFS_FWSTATS_ADD(debug, debug6);
+
+        DEBUGFS_FWSTATS_ADD(error, error_frame);
+        DEBUGFS_FWSTATS_ADD(error, error_null_Frame_tx_start);
+        DEBUGFS_FWSTATS_ADD(error, error_numll_frame_cts_start);
+        DEBUGFS_FWSTATS_ADD(error, error_bar_retry);
+        DEBUGFS_FWSTATS_ADD(error, error_frame_cts_nul_flid);
+
+        DEBUGFS_FWSTATS_ADD(tx, tx_prepared_descs);
+        DEBUGFS_FWSTATS_ADD(tx, tx_cmplt);
+        DEBUGFS_FWSTATS_ADD(tx, tx_template_prepared);
+        DEBUGFS_FWSTATS_ADD(tx, tx_data_prepared);
+        DEBUGFS_FWSTATS_ADD(tx, tx_template_programmed);
+        DEBUGFS_FWSTATS_ADD(tx, tx_data_programmed);
+        DEBUGFS_FWSTATS_ADD(tx, tx_burst_programmed);
+        DEBUGFS_FWSTATS_ADD(tx, tx_starts);
+        DEBUGFS_FWSTATS_ADD(tx, tx_imm_resp);
+        DEBUGFS_FWSTATS_ADD(tx, tx_start_templates);
+        DEBUGFS_FWSTATS_ADD(tx, tx_start_int_templates);
+        DEBUGFS_FWSTATS_ADD(tx, tx_start_fw_gen);
+        DEBUGFS_FWSTATS_ADD(tx, tx_start_data);
+        DEBUGFS_FWSTATS_ADD(tx, tx_start_null_frame);
+        DEBUGFS_FWSTATS_ADD(tx, tx_exch);
+        DEBUGFS_FWSTATS_ADD(tx, tx_retry_template);
+        DEBUGFS_FWSTATS_ADD(tx, tx_retry_data);
+        DEBUGFS_FWSTATS_ADD(tx, tx_exch_pending);
+        DEBUGFS_FWSTATS_ADD(tx, tx_exch_expiry);
+        DEBUGFS_FWSTATS_ADD(tx, tx_done_template);
+        DEBUGFS_FWSTATS_ADD(tx, tx_done_data);
+        DEBUGFS_FWSTATS_ADD(tx, tx_done_int_template);
+        DEBUGFS_FWSTATS_ADD(tx, tx_frame_checksum);
+        DEBUGFS_FWSTATS_ADD(tx, tx_checksum_result);
+        DEBUGFS_FWSTATS_ADD(tx, frag_called);
+        DEBUGFS_FWSTATS_ADD(tx, frag_mpdu_alloc_failed);
+        DEBUGFS_FWSTATS_ADD(tx, frag_init_called);
+        DEBUGFS_FWSTATS_ADD(tx, frag_in_process_called);
+        DEBUGFS_FWSTATS_ADD(tx, frag_tkip_called);
+        DEBUGFS_FWSTATS_ADD(tx, frag_key_not_found);
+        DEBUGFS_FWSTATS_ADD(tx, frag_need_fragmentation);
+        DEBUGFS_FWSTATS_ADD(tx, frag_bad_mblk_num);
+        DEBUGFS_FWSTATS_ADD(tx, frag_failed);
+        DEBUGFS_FWSTATS_ADD(tx, frag_cache_hit);
+        DEBUGFS_FWSTATS_ADD(tx, frag_cache_miss);
+
+        DEBUGFS_FWSTATS_ADD(rx, rx_beacon_early_term);
+        DEBUGFS_FWSTATS_ADD(rx, rx_out_of_mpdu_nodes);
+        DEBUGFS_FWSTATS_ADD(rx, rx_hdr_overflow);
+        DEBUGFS_FWSTATS_ADD(rx, rx_dropped_frame);
+        DEBUGFS_FWSTATS_ADD(rx, rx_done);
+        DEBUGFS_FWSTATS_ADD(rx, rx_defrag);
+        DEBUGFS_FWSTATS_ADD(rx, rx_defrag_end);
+        DEBUGFS_FWSTATS_ADD(rx, rx_cmplt);
+        DEBUGFS_FWSTATS_ADD(rx, rx_pre_complt);
+        DEBUGFS_FWSTATS_ADD(rx, rx_cmplt_task);
+        DEBUGFS_FWSTATS_ADD(rx, rx_phy_hdr);
+        DEBUGFS_FWSTATS_ADD(rx, rx_timeout);
+        DEBUGFS_FWSTATS_ADD(rx, rx_timeout_wa);
+        DEBUGFS_FWSTATS_ADD(rx, rx_wa_density_dropped_frame);
+        DEBUGFS_FWSTATS_ADD(rx, rx_wa_ba_not_expected);
+        DEBUGFS_FWSTATS_ADD(rx, rx_frame_checksum);
+        DEBUGFS_FWSTATS_ADD(rx, rx_checksum_result);
+        DEBUGFS_FWSTATS_ADD(rx, defrag_called);
+        DEBUGFS_FWSTATS_ADD(rx, defrag_init_called);
+        DEBUGFS_FWSTATS_ADD(rx, defrag_in_process_called);
+        DEBUGFS_FWSTATS_ADD(rx, defrag_tkip_called);
+        DEBUGFS_FWSTATS_ADD(rx, defrag_need_defrag);
+        DEBUGFS_FWSTATS_ADD(rx, defrag_decrypt_failed);
+        DEBUGFS_FWSTATS_ADD(rx, decrypt_key_not_found);
+        DEBUGFS_FWSTATS_ADD(rx, defrag_need_decrypt);
+        DEBUGFS_FWSTATS_ADD(rx, rx_tkip_replays);
+
+        DEBUGFS_FWSTATS_ADD(isr, irqs);
+
+        DEBUGFS_FWSTATS_ADD(pwr, missing_bcns_cnt);
+        DEBUGFS_FWSTATS_ADD(pwr, rcvd_bcns_cnt);
+        DEBUGFS_FWSTATS_ADD(pwr, connection_out_of_sync);
+        DEBUGFS_FWSTATS_ADD(pwr, cont_miss_bcns_spread);
+        DEBUGFS_FWSTATS_ADD(pwr, rcvd_awake_bcns_cnt);
+
+        DEBUGFS_FWSTATS_ADD(ps_poll, ps_poll_timeouts);
+        DEBUGFS_FWSTATS_ADD(ps_poll, upsd_timeouts);
+        DEBUGFS_FWSTATS_ADD(ps_poll, upsd_max_ap_turn);
+        DEBUGFS_FWSTATS_ADD(ps_poll, ps_poll_max_ap_turn);
+        DEBUGFS_FWSTATS_ADD(ps_poll, ps_poll_utilization);
+        DEBUGFS_FWSTATS_ADD(ps_poll, upsd_utilization);
+
+        DEBUGFS_FWSTATS_ADD(rx_filter, beacon_filter);
+        DEBUGFS_FWSTATS_ADD(rx_filter, arp_filter);
+        DEBUGFS_FWSTATS_ADD(rx_filter, mc_filter);
+        DEBUGFS_FWSTATS_ADD(rx_filter, dup_filter);
+        DEBUGFS_FWSTATS_ADD(rx_filter, data_filter);
+        DEBUGFS_FWSTATS_ADD(rx_filter, ibss_filter);
+        DEBUGFS_FWSTATS_ADD(rx_filter, protection_filter);
+        DEBUGFS_FWSTATS_ADD(rx_filter, accum_arp_pend_requests);
+        DEBUGFS_FWSTATS_ADD(rx_filter, max_arp_queue_dep);
+
+        DEBUGFS_FWSTATS_ADD(rx_rate, rx_frames_per_rates);
+
+        DEBUGFS_FWSTATS_ADD(aggr_size, tx_agg_vs_rate);
+        DEBUGFS_FWSTATS_ADD(aggr_size, rx_size);
+
+        DEBUGFS_FWSTATS_ADD(pipeline, hs_tx_stat_fifo_int);
+        DEBUGFS_FWSTATS_ADD(pipeline, tcp_tx_stat_fifo_int);
+        DEBUGFS_FWSTATS_ADD(pipeline, tcp_rx_stat_fifo_int);
+        DEBUGFS_FWSTATS_ADD(pipeline, enc_tx_stat_fifo_int);
+        DEBUGFS_FWSTATS_ADD(pipeline, enc_rx_stat_fifo_int);
+        DEBUGFS_FWSTATS_ADD(pipeline, rx_complete_stat_fifo_int);
+        DEBUGFS_FWSTATS_ADD(pipeline, pre_proc_swi);
+        DEBUGFS_FWSTATS_ADD(pipeline, post_proc_swi);
+        DEBUGFS_FWSTATS_ADD(pipeline, sec_frag_swi);
+        DEBUGFS_FWSTATS_ADD(pipeline, pre_to_defrag_swi);
+        DEBUGFS_FWSTATS_ADD(pipeline, defrag_to_csum_swi);
+        DEBUGFS_FWSTATS_ADD(pipeline, csum_to_rx_xfer_swi);
+        DEBUGFS_FWSTATS_ADD(pipeline, dec_packet_in);
+        DEBUGFS_FWSTATS_ADD(pipeline, dec_packet_in_fifo_full);
+        DEBUGFS_FWSTATS_ADD(pipeline, dec_packet_out);
+        DEBUGFS_FWSTATS_ADD(pipeline, cs_rx_packet_in);
+        DEBUGFS_FWSTATS_ADD(pipeline, cs_rx_packet_out);
+        DEBUGFS_FWSTATS_ADD(pipeline, pipeline_fifo_full);
+
+        DEBUGFS_FWSTATS_ADD(mem, rx_free_mem_blks);
+        DEBUGFS_FWSTATS_ADD(mem, tx_free_mem_blks);
+        DEBUGFS_FWSTATS_ADD(mem, fwlog_free_mem_blks);
+        DEBUGFS_FWSTATS_ADD(mem, fw_gen_free_mem_blks);
+
+        DEBUGFS_ADD(conf, moddir);
+
+        return 0;
+
+err:
+        if (IS_ERR(entry))
+                ret = PTR_ERR(entry);
+        else
+                ret = -ENOMEM;
+
+        return ret;
+}
diff --git a/drivers/net/wireless/ti/wl18xx/debugfs.h b/drivers/net/wireless/ti/wl18xx/debugfs.h
new file mode 100644
index 000000000000..ed679bebf620
--- /dev/null
+++ b/drivers/net/wireless/ti/wl18xx/debugfs.h
@@ -0,0 +1,28 @@
+/*
+ * This file is part of wl18xx
+ *
+ * Copyright (C) 2012 Texas Instruments. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL18XX_DEBUGFS_H__
+#define __WL18XX_DEBUGFS_H__
+
+int wl18xx_debugfs_add_files(struct wl1271 *wl,
+                             struct dentry *rootdir);
+
+#endif /* __WL18XX_DEBUGFS_H__ */
diff --git a/drivers/net/wireless/ti/wl18xx/io.c b/drivers/net/wireless/ti/wl18xx/io.c
new file mode 100644
index 000000000000..598c057e722b
--- /dev/null
+++ b/drivers/net/wireless/ti/wl18xx/io.c
@@ -0,0 +1,60 @@
+/*
+ * This file is part of wl18xx
+ *
+ * Copyright (C) 2011 Texas Instruments
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include "../wlcore/wlcore.h"
+#include "../wlcore/io.h"
+
+#include "io.h"
+
+void wl18xx_top_reg_write(struct wl1271 *wl, int addr, u16 val)
+{
+        u32 tmp;
+
+        if (WARN_ON(addr % 2))
+                return;
+
+        if ((addr % 4) == 0) {
+                tmp = wl1271_read32(wl, addr);
+                tmp = (tmp & 0xffff0000) | val;
+                wl1271_write32(wl, addr, tmp);
+        } else {
+                tmp = wl1271_read32(wl, addr - 2);
+                tmp = (tmp & 0xffff) | (val << 16);
+                wl1271_write32(wl, addr - 2, tmp);
+        }
+}
+
+u16 wl18xx_top_reg_read(struct wl1271 *wl, int addr)
+{
+        u32 val;
+
+        if (WARN_ON(addr % 2))
+                return 0;
+
+        if ((addr % 4) == 0) {
+                /* address is 4-bytes aligned */
+                val = wl1271_read32(wl, addr);
+                return val & 0xffff;
+        } else {
+                val = wl1271_read32(wl, addr - 2);
+                return (val & 0xffff0000) >> 16;
+        }
+}
diff --git a/drivers/net/wireless/ti/wl18xx/io.h b/drivers/net/wireless/ti/wl18xx/io.h
new file mode 100644
index 000000000000..be4e126ff617
--- /dev/null
+++ b/drivers/net/wireless/ti/wl18xx/io.h
@@ -0,0 +1,28 @@
+/*
+ * This file is part of wl18xx
+ *
+ * Copyright (C) 2011 Texas Instruments
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL18XX_IO_H__
+#define __WL18XX_IO_H__
+
+void wl18xx_top_reg_write(struct wl1271 *wl, int addr, u16 val);
+u16 wl18xx_top_reg_read(struct wl1271 *wl, int addr);
+
+#endif /* __WL18XX_IO_H__ */
diff --git a/drivers/net/wireless/ti/wl18xx/main.c b/drivers/net/wireless/ti/wl18xx/main.c
new file mode 100644
index 000000000000..ed9c3650e08a
--- /dev/null
+++ b/drivers/net/wireless/ti/wl18xx/main.c
@@ -0,0 +1,1463 @@
+/*
+ * This file is part of wl18xx
+ *
+ * Copyright (C) 2011 Texas Instruments
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/ip.h>
+#include <linux/firmware.h>
+
+#include "../wlcore/wlcore.h"
+#include "../wlcore/debug.h"
+#include "../wlcore/io.h"
+#include "../wlcore/acx.h"
+#include "../wlcore/tx.h"
+#include "../wlcore/rx.h"
+#include "../wlcore/io.h"
+#include "../wlcore/boot.h"
+
+#include "reg.h"
+#include "conf.h"
+#include "acx.h"
+#include "tx.h"
+#include "wl18xx.h"
+#include "io.h"
+#include "debugfs.h"
+
+#define WL18XX_RX_CHECKSUM_MASK      0x40
+
+static char *ht_mode_param = "wide";
+static char *board_type_param = "hdk";
+static bool checksum_param = false;
+static bool enable_11a_param = true;
+
+/* phy paramters */
+static int dc2dc_param = -1;
+static int n_antennas_2_param = -1;
+static int n_antennas_5_param = -1;
+static int low_band_component_param = -1;
+static int low_band_component_type_param = -1;
+static int high_band_component_param = -1;
+static int high_band_component_type_param = -1;
+static int pwr_limit_reference_11_abg_param = -1;
+
+static const u8 wl18xx_rate_to_idx_2ghz[] = {
+        /* MCS rates are used only with 11n */
+        15,                            /* WL18XX_CONF_HW_RXTX_RATE_MCS15 */
+        14,                            /* WL18XX_CONF_HW_RXTX_RATE_MCS14 */
+        13,                            /* WL18XX_CONF_HW_RXTX_RATE_MCS13 */
+        12,                            /* WL18XX_CONF_HW_RXTX_RATE_MCS12 */
+        11,                            /* WL18XX_CONF_HW_RXTX_RATE_MCS11 */
+        10,                            /* WL18XX_CONF_HW_RXTX_RATE_MCS10 */
+        9,                             /* WL18XX_CONF_HW_RXTX_RATE_MCS9 */
+        8,                             /* WL18XX_CONF_HW_RXTX_RATE_MCS8 */
+        7,                             /* WL18XX_CONF_HW_RXTX_RATE_MCS7 */
+        6,                             /* WL18XX_CONF_HW_RXTX_RATE_MCS6 */
+        5,                             /* WL18XX_CONF_HW_RXTX_RATE_MCS5 */
+        4,                             /* WL18XX_CONF_HW_RXTX_RATE_MCS4 */
+        3,                             /* WL18XX_CONF_HW_RXTX_RATE_MCS3 */
+        2,                             /* WL18XX_CONF_HW_RXTX_RATE_MCS2 */
+        1,                             /* WL18XX_CONF_HW_RXTX_RATE_MCS1 */
+        0,                             /* WL18XX_CONF_HW_RXTX_RATE_MCS0 */
+
+        11,                            /* WL18XX_CONF_HW_RXTX_RATE_54   */
+        10,                            /* WL18XX_CONF_HW_RXTX_RATE_48   */
+        9,                             /* WL18XX_CONF_HW_RXTX_RATE_36   */
+        8,                             /* WL18XX_CONF_HW_RXTX_RATE_24   */
+
+        /* TI-specific rate */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* WL18XX_CONF_HW_RXTX_RATE_22   */
+
+        7,                             /* WL18XX_CONF_HW_RXTX_RATE_18   */
+        6,                             /* WL18XX_CONF_HW_RXTX_RATE_12   */
+        3,                             /* WL18XX_CONF_HW_RXTX_RATE_11   */
+        5,                             /* WL18XX_CONF_HW_RXTX_RATE_9    */
+        4,                             /* WL18XX_CONF_HW_RXTX_RATE_6    */
+        2,                             /* WL18XX_CONF_HW_RXTX_RATE_5_5  */
+        1,                             /* WL18XX_CONF_HW_RXTX_RATE_2    */
+        0                              /* WL18XX_CONF_HW_RXTX_RATE_1    */
+};
+
+static const u8 wl18xx_rate_to_idx_5ghz[] = {
+        /* MCS rates are used only with 11n */
+        15,                           /* WL18XX_CONF_HW_RXTX_RATE_MCS15 */
+        14,                           /* WL18XX_CONF_HW_RXTX_RATE_MCS14 */
+        13,                           /* WL18XX_CONF_HW_RXTX_RATE_MCS13 */
+        12,                           /* WL18XX_CONF_HW_RXTX_RATE_MCS12 */
+        11,                           /* WL18XX_CONF_HW_RXTX_RATE_MCS11 */
+        10,                           /* WL18XX_CONF_HW_RXTX_RATE_MCS10 */
+        9,                            /* WL18XX_CONF_HW_RXTX_RATE_MCS9 */
+        8,                            /* WL18XX_CONF_HW_RXTX_RATE_MCS8 */
+        7,                            /* WL18XX_CONF_HW_RXTX_RATE_MCS7 */
+        6,                            /* WL18XX_CONF_HW_RXTX_RATE_MCS6 */
+        5,                            /* WL18XX_CONF_HW_RXTX_RATE_MCS5 */
+        4,                            /* WL18XX_CONF_HW_RXTX_RATE_MCS4 */
+        3,                            /* WL18XX_CONF_HW_RXTX_RATE_MCS3 */
+        2,                            /* WL18XX_CONF_HW_RXTX_RATE_MCS2 */
+        1,                            /* WL18XX_CONF_HW_RXTX_RATE_MCS1 */
+        0,                            /* WL18XX_CONF_HW_RXTX_RATE_MCS0 */
+
+        7,                             /* WL18XX_CONF_HW_RXTX_RATE_54   */
+        6,                             /* WL18XX_CONF_HW_RXTX_RATE_48   */
+        5,                             /* WL18XX_CONF_HW_RXTX_RATE_36   */
+        4,                             /* WL18XX_CONF_HW_RXTX_RATE_24   */
+
+        /* TI-specific rate */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* WL18XX_CONF_HW_RXTX_RATE_22   */
+
+        3,                             /* WL18XX_CONF_HW_RXTX_RATE_18   */
+        2,                             /* WL18XX_CONF_HW_RXTX_RATE_12   */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* WL18XX_CONF_HW_RXTX_RATE_11   */
+        1,                             /* WL18XX_CONF_HW_RXTX_RATE_9    */
+        0,                             /* WL18XX_CONF_HW_RXTX_RATE_6    */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* WL18XX_CONF_HW_RXTX_RATE_5_5  */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* WL18XX_CONF_HW_RXTX_RATE_2    */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* WL18XX_CONF_HW_RXTX_RATE_1    */
+};
+
+static const u8 *wl18xx_band_rate_to_idx[] = {
+        [IEEE80211_BAND_2GHZ] = wl18xx_rate_to_idx_2ghz,
+        [IEEE80211_BAND_5GHZ] = wl18xx_rate_to_idx_5ghz
+};
+
+enum wl18xx_hw_rates {
+        WL18XX_CONF_HW_RXTX_RATE_MCS15 = 0,
+        WL18XX_CONF_HW_RXTX_RATE_MCS14,
+        WL18XX_CONF_HW_RXTX_RATE_MCS13,
+        WL18XX_CONF_HW_RXTX_RATE_MCS12,
+        WL18XX_CONF_HW_RXTX_RATE_MCS11,
+        WL18XX_CONF_HW_RXTX_RATE_MCS10,
+        WL18XX_CONF_HW_RXTX_RATE_MCS9,
+        WL18XX_CONF_HW_RXTX_RATE_MCS8,
+        WL18XX_CONF_HW_RXTX_RATE_MCS7,
+        WL18XX_CONF_HW_RXTX_RATE_MCS6,
+        WL18XX_CONF_HW_RXTX_RATE_MCS5,
+        WL18XX_CONF_HW_RXTX_RATE_MCS4,
+        WL18XX_CONF_HW_RXTX_RATE_MCS3,
+        WL18XX_CONF_HW_RXTX_RATE_MCS2,
+        WL18XX_CONF_HW_RXTX_RATE_MCS1,
+        WL18XX_CONF_HW_RXTX_RATE_MCS0,
+        WL18XX_CONF_HW_RXTX_RATE_54,
+        WL18XX_CONF_HW_RXTX_RATE_48,
+        WL18XX_CONF_HW_RXTX_RATE_36,
+        WL18XX_CONF_HW_RXTX_RATE_24,
+        WL18XX_CONF_HW_RXTX_RATE_22,
+        WL18XX_CONF_HW_RXTX_RATE_18,
+        WL18XX_CONF_HW_RXTX_RATE_12,
+        WL18XX_CONF_HW_RXTX_RATE_11,
+        WL18XX_CONF_HW_RXTX_RATE_9,
+        WL18XX_CONF_HW_RXTX_RATE_6,
+        WL18XX_CONF_HW_RXTX_RATE_5_5,
+        WL18XX_CONF_HW_RXTX_RATE_2,
+        WL18XX_CONF_HW_RXTX_RATE_1,
+        WL18XX_CONF_HW_RXTX_RATE_MAX,
+};
+
+static struct wlcore_conf wl18xx_conf = {
+        .sg = {
+                .params = {
+                        [CONF_SG_ACL_BT_MASTER_MIN_BR] = 10,
+                        [CONF_SG_ACL_BT_MASTER_MAX_BR] = 180,
+                        [CONF_SG_ACL_BT_SLAVE_MIN_BR] = 10,
+                        [CONF_SG_ACL_BT_SLAVE_MAX_BR] = 180,
+                        [CONF_SG_ACL_BT_MASTER_MIN_EDR] = 10,
+                        [CONF_SG_ACL_BT_MASTER_MAX_EDR] = 80,
+                        [CONF_SG_ACL_BT_SLAVE_MIN_EDR] = 10,
+                        [CONF_SG_ACL_BT_SLAVE_MAX_EDR] = 80,
+                        [CONF_SG_ACL_WLAN_PS_MASTER_BR] = 8,
+                        [CONF_SG_ACL_WLAN_PS_SLAVE_BR] = 8,
+                        [CONF_SG_ACL_WLAN_PS_MASTER_EDR] = 20,
+                        [CONF_SG_ACL_WLAN_PS_SLAVE_EDR] = 20,
+                        [CONF_SG_ACL_WLAN_ACTIVE_MASTER_MIN_BR] = 20,
+                        [CONF_SG_ACL_WLAN_ACTIVE_MASTER_MAX_BR] = 35,
+                        [CONF_SG_ACL_WLAN_ACTIVE_SLAVE_MIN_BR] = 16,
+                        [CONF_SG_ACL_WLAN_ACTIVE_SLAVE_MAX_BR] = 35,
+                        [CONF_SG_ACL_WLAN_ACTIVE_MASTER_MIN_EDR] = 32,
+                        [CONF_SG_ACL_WLAN_ACTIVE_MASTER_MAX_EDR] = 50,
+                        [CONF_SG_ACL_WLAN_ACTIVE_SLAVE_MIN_EDR] = 28,
+                        [CONF_SG_ACL_WLAN_ACTIVE_SLAVE_MAX_EDR] = 50,
+                        [CONF_SG_ACL_ACTIVE_SCAN_WLAN_BR] = 10,
+                        [CONF_SG_ACL_ACTIVE_SCAN_WLAN_EDR] = 20,
+                        [CONF_SG_ACL_PASSIVE_SCAN_BT_BR] = 75,
+                        [CONF_SG_ACL_PASSIVE_SCAN_WLAN_BR] = 15,
+                        [CONF_SG_ACL_PASSIVE_SCAN_BT_EDR] = 27,
+                        [CONF_SG_ACL_PASSIVE_SCAN_WLAN_EDR] = 17,
+                        /* active scan params */
+                        [CONF_SG_AUTO_SCAN_PROBE_REQ] = 170,
+                        [CONF_SG_ACTIVE_SCAN_DURATION_FACTOR_HV3] = 50,
+                        [CONF_SG_ACTIVE_SCAN_DURATION_FACTOR_A2DP] = 100,
+                        /* passive scan params */
+                        [CONF_SG_PASSIVE_SCAN_DURATION_FACTOR_A2DP_BR] = 800,
+                        [CONF_SG_PASSIVE_SCAN_DURATION_FACTOR_A2DP_EDR] = 200,
+                        [CONF_SG_PASSIVE_SCAN_DURATION_FACTOR_HV3] = 200,
+                        /* passive scan in dual antenna params */
+                        [CONF_SG_CONSECUTIVE_HV3_IN_PASSIVE_SCAN] = 0,
+                        [CONF_SG_BCN_HV3_COLLISION_THRESH_IN_PASSIVE_SCAN] = 0,
+                        [CONF_SG_TX_RX_PROTECTION_BWIDTH_IN_PASSIVE_SCAN] = 0,
+                        /* general params */
+                        [CONF_SG_STA_FORCE_PS_IN_BT_SCO] = 1,
+                        [CONF_SG_ANTENNA_CONFIGURATION] = 0,
+                        [CONF_SG_BEACON_MISS_PERCENT] = 60,
+                        [CONF_SG_DHCP_TIME] = 5000,
+                        [CONF_SG_RXT] = 1200,
+                        [CONF_SG_TXT] = 1000,
+                        [CONF_SG_ADAPTIVE_RXT_TXT] = 1,
+                        [CONF_SG_GENERAL_USAGE_BIT_MAP] = 3,
+                        [CONF_SG_HV3_MAX_SERVED] = 6,
+                        [CONF_SG_PS_POLL_TIMEOUT] = 10,
+                        [CONF_SG_UPSD_TIMEOUT] = 10,
+                        [CONF_SG_CONSECUTIVE_CTS_THRESHOLD] = 2,
+                        [CONF_SG_STA_RX_WINDOW_AFTER_DTIM] = 5,
+                        [CONF_SG_STA_CONNECTION_PROTECTION_TIME] = 30,
+                        /* AP params */
+                        [CONF_AP_BEACON_MISS_TX] = 3,
+                        [CONF_AP_RX_WINDOW_AFTER_BEACON] = 10,
+                        [CONF_AP_BEACON_WINDOW_INTERVAL] = 2,
+                        [CONF_AP_CONNECTION_PROTECTION_TIME] = 0,
+                        [CONF_AP_BT_ACL_VAL_BT_SERVE_TIME] = 25,
+                        [CONF_AP_BT_ACL_VAL_WL_SERVE_TIME] = 25,
+                        /* CTS Diluting params */
+                        [CONF_SG_CTS_DILUTED_BAD_RX_PACKETS_TH] = 0,
+                        [CONF_SG_CTS_CHOP_IN_DUAL_ANT_SCO_MASTER] = 0,
+                },
+                .state = CONF_SG_PROTECTIVE,
+        },
+        .rx = {
+                .rx_msdu_life_time           = 512000,
+                .packet_detection_threshold  = 0,
+                .ps_poll_timeout             = 15,
+                .upsd_timeout                = 15,
+                .rts_threshold               = IEEE80211_MAX_RTS_THRESHOLD,
+                .rx_cca_threshold            = 0,
+                .irq_blk_threshold           = 0xFFFF,
+                .irq_pkt_threshold           = 0,
+                .irq_timeout                 = 600,
+                .queue_type                  = CONF_RX_QUEUE_TYPE_LOW_PRIORITY,
+        },
+        .tx = {
+                .tx_energy_detection         = 0,
+                .sta_rc_conf                 = {
+                        .enabled_rates       = 0,
+                        .short_retry_limit   = 10,
+                        .long_retry_limit    = 10,
+                        .aflags              = 0,
+                },
+                .ac_conf_count               = 4,
+                .ac_conf                     = {
+                        [CONF_TX_AC_BE] = {
+                                .ac          = CONF_TX_AC_BE,
+                                .cw_min      = 15,
+                                .cw_max      = 63,
+                                .aifsn       = 3,
+                                .tx_op_limit = 0,
+                        },
+                        [CONF_TX_AC_BK] = {
+                                .ac          = CONF_TX_AC_BK,
+                                .cw_min      = 15,
+                                .cw_max      = 63,
+                                .aifsn       = 7,
+                                .tx_op_limit = 0,
+                        },
+                        [CONF_TX_AC_VI] = {
+                                .ac          = CONF_TX_AC_VI,
+                                .cw_min      = 15,
+                                .cw_max      = 63,
+                                .aifsn       = CONF_TX_AIFS_PIFS,
+                                .tx_op_limit = 3008,
+                        },
+                        [CONF_TX_AC_VO] = {
+                                .ac          = CONF_TX_AC_VO,
+                                .cw_min      = 15,
+                                .cw_max      = 63,
+                                .aifsn       = CONF_TX_AIFS_PIFS,
+                                .tx_op_limit = 1504,
+                        },
+                },
+                .max_tx_retries = 100,
+                .ap_aging_period = 300,
+                .tid_conf_count = 4,
+                .tid_conf = {
+                        [CONF_TX_AC_BE] = {
+                                .queue_id    = CONF_TX_AC_BE,
+                                .channel_type = CONF_CHANNEL_TYPE_EDCF,
+                                .tsid        = CONF_TX_AC_BE,
+                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
+                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
+                                .apsd_conf   = {0, 0},
+                        },
+                        [CONF_TX_AC_BK] = {
+                                .queue_id    = CONF_TX_AC_BK,
+                                .channel_type = CONF_CHANNEL_TYPE_EDCF,
+                                .tsid        = CONF_TX_AC_BK,
+                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
+                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
+                                .apsd_conf   = {0, 0},
+                        },
+                        [CONF_TX_AC_VI] = {
+                                .queue_id    = CONF_TX_AC_VI,
+                                .channel_type = CONF_CHANNEL_TYPE_EDCF,
+                                .tsid        = CONF_TX_AC_VI,
+                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
+                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
+                                .apsd_conf   = {0, 0},
+                        },
+                        [CONF_TX_AC_VO] = {
+                                .queue_id    = CONF_TX_AC_VO,
+                                .channel_type = CONF_CHANNEL_TYPE_EDCF,
+                                .tsid        = CONF_TX_AC_VO,
+                                .ps_scheme   = CONF_PS_SCHEME_LEGACY,
+                                .ack_policy  = CONF_ACK_POLICY_LEGACY,
+                                .apsd_conf   = {0, 0},
+                        },
+                },
+                .frag_threshold              = IEEE80211_MAX_FRAG_THRESHOLD,
+                .tx_compl_timeout            = 350,
+                .tx_compl_threshold          = 10,
+                .basic_rate                  = CONF_HW_BIT_RATE_1MBPS,
+                .basic_rate_5                = CONF_HW_BIT_RATE_6MBPS,
+                .tmpl_short_retry_limit      = 10,
+                .tmpl_long_retry_limit       = 10,
+                .tx_watchdog_timeout         = 5000,
+        },
+        .conn = {
+                .wake_up_event               = CONF_WAKE_UP_EVENT_DTIM,
+                .listen_interval             = 1,
+                .suspend_wake_up_event       = CONF_WAKE_UP_EVENT_N_DTIM,
+                .suspend_listen_interval     = 3,
+                .bcn_filt_mode               = CONF_BCN_FILT_MODE_ENABLED,
+                .bcn_filt_ie_count           = 3,
+                .bcn_filt_ie = {
+                        [0] = {
+                                .ie          = WLAN_EID_CHANNEL_SWITCH,
+                                .rule        = CONF_BCN_RULE_PASS_ON_APPEARANCE,
+                        },
+                        [1] = {
+                                .ie          = WLAN_EID_HT_OPERATION,
+                                .rule        = CONF_BCN_RULE_PASS_ON_CHANGE,
+                        },
+                        [2] = {
+                                .ie          = WLAN_EID_ERP_INFO,
+                                .rule        = CONF_BCN_RULE_PASS_ON_CHANGE,
+                        },
+                },
+                .synch_fail_thold            = 12,
+                .bss_lose_timeout            = 400,
+                .beacon_rx_timeout           = 10000,
+                .broadcast_timeout           = 20000,
+                .rx_broadcast_in_ps          = 1,
+                .ps_poll_threshold           = 10,
+                .bet_enable                  = CONF_BET_MODE_ENABLE,
+                .bet_max_consecutive         = 50,
+                .psm_entry_retries           = 8,
+                .psm_exit_retries            = 16,
+                .psm_entry_nullfunc_retries  = 3,
+                .dynamic_ps_timeout          = 200,
+                .forced_ps                   = false,
+                .keep_alive_interval         = 55000,
+                .max_listen_interval         = 20,
+        },
+        .itrim = {
+                .enable = false,
+                .timeout = 50000,
+        },
+        .pm_config = {
+                .host_clk_settling_time = 5000,
+                .host_fast_wakeup_support = CONF_FAST_WAKEUP_DISABLE,
+        },
+        .roam_trigger = {
+                .trigger_pacing               = 1,
+                .avg_weight_rssi_beacon       = 20,
+                .avg_weight_rssi_data         = 10,
+                .avg_weight_snr_beacon        = 20,
+                .avg_weight_snr_data          = 10,
+        },
+        .scan = {
+                .min_dwell_time_active        = 7500,
+                .max_dwell_time_active        = 30000,
+                .min_dwell_time_passive       = 100000,
+                .max_dwell_time_passive       = 100000,
+                .num_probe_reqs               = 2,
+                .split_scan_timeout           = 50000,
+        },
+        .sched_scan = {
+                /*
+                 * Values are in TU/1000 but since sched scan FW command
+                 * params are in TUs rounding up may occur.
+                 */
+                .base_dwell_time                = 7500,
+                .max_dwell_time_delta           = 22500,
+                /* based on 250bits per probe @1Mbps */
+                .dwell_time_delta_per_probe     = 2000,
+                /* based on 250bits per probe @6Mbps (plus a bit more) */
+                .dwell_time_delta_per_probe_5   = 350,
+                .dwell_time_passive             = 100000,
+                .dwell_time_dfs                 = 150000,
+                .num_probe_reqs                 = 2,
+                .rssi_threshold                 = -90,
+                .snr_threshold                  = 0,
+        },
+        .ht = {
+                .rx_ba_win_size = 10,
+                .tx_ba_win_size = 64,
+                .inactivity_timeout = 10000,
+                .tx_ba_tid_bitmap = CONF_TX_BA_ENABLED_TID_BITMAP,
+        },
+        .mem = {
+                .num_stations                 = 1,
+                .ssid_profiles                = 1,
+                .rx_block_num                 = 40,
+                .tx_min_block_num             = 40,
+                .dynamic_memory               = 1,
+                .min_req_tx_blocks            = 45,
+                .min_req_rx_blocks            = 22,
+                .tx_min                       = 27,
+        },
+        .fm_coex = {
+                .enable                       = true,
+                .swallow_period               = 5,
+                .n_divider_fref_set_1         = 0xff,       /* default */
+                .n_divider_fref_set_2         = 12,
+                .m_divider_fref_set_1         = 0xffff,
+                .m_divider_fref_set_2         = 148,        /* default */
+                .coex_pll_stabilization_time  = 0xffffffff, /* default */
+                .ldo_stabilization_time       = 0xffff,     /* default */
+                .fm_disturbed_band_margin     = 0xff,       /* default */
+                .swallow_clk_diff             = 0xff,       /* default */
+        },
+        .rx_streaming = {
+                .duration                      = 150,
+                .queues                        = 0x1,
+                .interval                      = 20,
+                .always                        = 0,
+        },
+        .fwlog = {
+                .mode                         = WL12XX_FWLOG_ON_DEMAND,
+                .mem_blocks                   = 2,
+                .severity                     = 0,
+                .timestamp                    = WL12XX_FWLOG_TIMESTAMP_DISABLED,
+                .output                       = WL12XX_FWLOG_OUTPUT_HOST,
+                .threshold                    = 0,
+        },
+        .rate = {
+                .rate_retry_score = 32000,
+                .per_add = 8192,
+                .per_th1 = 2048,
+                .per_th2 = 4096,
+                .max_per = 8100,
+                .inverse_curiosity_factor = 5,
+                .tx_fail_low_th = 4,
+                .tx_fail_high_th = 10,
+                .per_alpha_shift = 4,
+                .per_add_shift = 13,
+                .per_beta1_shift = 10,
+                .per_beta2_shift = 8,
+                .rate_check_up = 2,
+                .rate_check_down = 12,
+                .rate_retry_policy = {
+                        0x00, 0x00, 0x00, 0x00, 0x00,
+                        0x00, 0x00, 0x00, 0x00, 0x00,
+                        0x00, 0x00, 0x00,
+                },
+        },
+        .hangover = {
+                .recover_time               = 0,
+                .hangover_period            = 20,
+                .dynamic_mode               = 1,
+                .early_termination_mode     = 1,
+                .max_period                 = 20,
+                .min_period                 = 1,
+                .increase_delta             = 1,
+                .decrease_delta             = 2,
+                .quiet_time                 = 4,
+                .increase_time              = 1,
+                .window_size                = 16,
+        },
+};
+
+static struct wl18xx_priv_conf wl18xx_default_priv_conf = {
+        .phy = {
+                .phy_standalone                 = 0x00,
+                .primary_clock_setting_time     = 0x05,
+                .clock_valid_on_wake_up         = 0x00,
+                .secondary_clock_setting_time   = 0x05,
+                .rdl                            = 0x01,
+                .auto_detect                    = 0x00,
+                .dedicated_fem                  = FEM_NONE,
+                .low_band_component             = COMPONENT_2_WAY_SWITCH,
+                .low_band_component_type        = 0x05,
+                .high_band_component            = COMPONENT_2_WAY_SWITCH,
+                .high_band_component_type       = 0x09,
+                .tcxo_ldo_voltage               = 0x00,
+                .xtal_itrim_val                 = 0x04,
+                .srf_state                      = 0x00,
+                .io_configuration               = 0x01,
+                .sdio_configuration             = 0x00,
+                .settings                       = 0x00,
+                .enable_clpc                    = 0x00,
+                .enable_tx_low_pwr_on_siso_rdl  = 0x00,
+                .rx_profile                     = 0x00,
+                .pwr_limit_reference_11_abg     = 0xc8,
+                .psat                           = 0,
+                .low_power_val                  = 0x00,
+                .med_power_val                  = 0x0a,
+                .high_power_val                 = 0x1e,
+                .external_pa_dc2dc              = 0,
+                .number_of_assembled_ant2_4     = 1,
+                .number_of_assembled_ant5       = 1,
+        },
+};
+
+static const struct wlcore_partition_set wl18xx_ptable[PART_TABLE_LEN] = {
+        [PART_TOP_PRCM_ELP_SOC] = {
+                .mem  = { .start = 0x00A02000, .size  = 0x00010000 },
+                .reg  = { .start = 0x00807000, .size  = 0x00005000 },
+                .mem2 = { .start = 0x00800000, .size  = 0x0000B000 },
+                .mem3 = { .start = 0x00000000, .size  = 0x00000000 },
+        },
+        [PART_DOWN] = {
+                .mem  = { .start = 0x00000000, .size  = 0x00014000 },
+                .reg  = { .start = 0x00810000, .size  = 0x0000BFFF },
+                .mem2 = { .start = 0x00000000, .size  = 0x00000000 },
+                .mem3 = { .start = 0x00000000, .size  = 0x00000000 },
+        },
+        [PART_BOOT] = {
+                .mem  = { .start = 0x00700000, .size = 0x0000030c },
+                .reg  = { .start = 0x00802000, .size = 0x00014578 },
+                .mem2 = { .start = 0x00B00404, .size = 0x00001000 },
+                .mem3 = { .start = 0x00C00000, .size = 0x00000400 },
+        },
+        [PART_WORK] = {
+                .mem  = { .start = 0x00800000, .size  = 0x000050FC },
+                .reg  = { .start = 0x00B00404, .size  = 0x00001000 },
+                .mem2 = { .start = 0x00C00000, .size  = 0x00000400 },
+                .mem3 = { .start = 0x00000000, .size  = 0x00000000 },
+        },
+        [PART_PHY_INIT] = {
+                .mem  = { .start = 0x80926000,
+                          .size = sizeof(struct wl18xx_mac_and_phy_params) },
+                .reg  = { .start = 0x00000000, .size = 0x00000000 },
+                .mem2 = { .start = 0x00000000, .size = 0x00000000 },
+                .mem3 = { .start = 0x00000000, .size = 0x00000000 },
+        },
+};
+
+static const int wl18xx_rtable[REG_TABLE_LEN] = {
+        [REG_ECPU_CONTROL]              = WL18XX_REG_ECPU_CONTROL,
+        [REG_INTERRUPT_NO_CLEAR]        = WL18XX_REG_INTERRUPT_NO_CLEAR,
+        [REG_INTERRUPT_ACK]             = WL18XX_REG_INTERRUPT_ACK,
+        [REG_COMMAND_MAILBOX_PTR]       = WL18XX_REG_COMMAND_MAILBOX_PTR,
+        [REG_EVENT_MAILBOX_PTR]         = WL18XX_REG_EVENT_MAILBOX_PTR,
+        [REG_INTERRUPT_TRIG]            = WL18XX_REG_INTERRUPT_TRIG_H,
+        [REG_INTERRUPT_MASK]            = WL18XX_REG_INTERRUPT_MASK,
+        [REG_PC_ON_RECOVERY]            = WL18XX_SCR_PAD4,
+        [REG_CHIP_ID_B]                 = WL18XX_REG_CHIP_ID_B,
+        [REG_CMD_MBOX_ADDRESS]          = WL18XX_CMD_MBOX_ADDRESS,
+
+        /* data access memory addresses, used with partition translation */
+        [REG_SLV_MEM_DATA]              = WL18XX_SLV_MEM_DATA,
+        [REG_SLV_REG_DATA]              = WL18XX_SLV_REG_DATA,
+
+        /* raw data access memory addresses */
+        [REG_RAW_FW_STATUS_ADDR]        = WL18XX_FW_STATUS_ADDR,
+};
+
+static const struct wl18xx_clk_cfg wl18xx_clk_table[NUM_CLOCK_CONFIGS] = {
+        [CLOCK_CONFIG_16_2_M]   = { 7,  104,  801, 4,  true },
+        [CLOCK_CONFIG_16_368_M] = { 9,  132, 3751, 4,  true },
+        [CLOCK_CONFIG_16_8_M]   = { 7,  100,    0, 0, false },
+        [CLOCK_CONFIG_19_2_M]   = { 8,  100,    0, 0, false },
+        [CLOCK_CONFIG_26_M]     = { 13, 120,    0, 0, false },
+        [CLOCK_CONFIG_32_736_M] = { 9,  132, 3751, 4,  true },
+        [CLOCK_CONFIG_33_6_M]   = { 7,  100,    0, 0, false },
+        [CLOCK_CONFIG_38_468_M] = { 8,  100,    0, 0, false },
+        [CLOCK_CONFIG_52_M]     = { 13, 120,    0, 0, false },
+};
+
+/* TODO: maybe move to a new header file? */
+#define WL18XX_FW_NAME "ti-connectivity/wl18xx-fw.bin"
+
+static int wl18xx_identify_chip(struct wl1271 *wl)
+{
+        int ret = 0;
+
+        switch (wl->chip.id) {
+        case CHIP_ID_185x_PG20:
+                wl1271_debug(DEBUG_BOOT, "chip id 0x%x (185x PG20)",
+                                 wl->chip.id);
+                wl->sr_fw_name = WL18XX_FW_NAME;
+                /* wl18xx uses the same firmware for PLT */
+                wl->plt_fw_name = WL18XX_FW_NAME;
+                wl->quirks |= WLCORE_QUIRK_NO_ELP |
+                              WLCORE_QUIRK_RX_BLOCKSIZE_ALIGN |
+                              WLCORE_QUIRK_TX_PAD_LAST_FRAME;
+
+                break;
+        case CHIP_ID_185x_PG10:
+                wl1271_debug(DEBUG_BOOT, "chip id 0x%x (185x PG10)",
+                             wl->chip.id);
+                wl->sr_fw_name = WL18XX_FW_NAME;
+                /* wl18xx uses the same firmware for PLT */
+                wl->plt_fw_name = WL18XX_FW_NAME;
+                wl->quirks |= WLCORE_QUIRK_NO_ELP |
+                        WLCORE_QUIRK_FWLOG_NOT_IMPLEMENTED |
+                        WLCORE_QUIRK_RX_BLOCKSIZE_ALIGN |
+                        WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN;
+
+                /* PG 1.0 has some problems with MCS_13, so disable it */
+                wl->ht_cap[IEEE80211_BAND_2GHZ].mcs.rx_mask[1] &= ~BIT(5);
+
+                break;
+        default:
+                wl1271_warning("unsupported chip id: 0x%x", wl->chip.id);
+                ret = -ENODEV;
+                goto out;
+        }
+
+out:
+        return ret;
+}
+
+static void wl18xx_set_clk(struct wl1271 *wl)
+{
+        u32 clk_freq;
+
+        wlcore_set_partition(wl, &wl->ptable[PART_TOP_PRCM_ELP_SOC]);
+
+        /* TODO: PG2: apparently we need to read the clk type */
+
+        clk_freq = wl18xx_top_reg_read(wl, PRIMARY_CLK_DETECT);
+        wl1271_debug(DEBUG_BOOT, "clock freq %d (%d, %d, %d, %d, %s)", clk_freq,
+                     wl18xx_clk_table[clk_freq].n, wl18xx_clk_table[clk_freq].m,
+                     wl18xx_clk_table[clk_freq].p, wl18xx_clk_table[clk_freq].q,
+                     wl18xx_clk_table[clk_freq].swallow ? "swallow" : "spit");
+
+        wl18xx_top_reg_write(wl, PLLSH_WCS_PLL_N, wl18xx_clk_table[clk_freq].n);
+        wl18xx_top_reg_write(wl, PLLSH_WCS_PLL_M, wl18xx_clk_table[clk_freq].m);
+
+        if (wl18xx_clk_table[clk_freq].swallow) {
+                /* first the 16 lower bits */
+                wl18xx_top_reg_write(wl, PLLSH_WCS_PLL_Q_FACTOR_CFG_1,
+                                     wl18xx_clk_table[clk_freq].q &
+                                     PLLSH_WCS_PLL_Q_FACTOR_CFG_1_MASK);
+                /* then the 16 higher bits, masked out */
+                wl18xx_top_reg_write(wl, PLLSH_WCS_PLL_Q_FACTOR_CFG_2,
+                                     (wl18xx_clk_table[clk_freq].q >> 16) &
+                                     PLLSH_WCS_PLL_Q_FACTOR_CFG_2_MASK);
+
+                /* first the 16 lower bits */
+                wl18xx_top_reg_write(wl, PLLSH_WCS_PLL_P_FACTOR_CFG_1,
+                                     wl18xx_clk_table[clk_freq].p &
+                                     PLLSH_WCS_PLL_P_FACTOR_CFG_1_MASK);
+                /* then the 16 higher bits, masked out */
+                wl18xx_top_reg_write(wl, PLLSH_WCS_PLL_P_FACTOR_CFG_2,
+                                     (wl18xx_clk_table[clk_freq].p >> 16) &
+                                     PLLSH_WCS_PLL_P_FACTOR_CFG_2_MASK);
+        } else {
+                wl18xx_top_reg_write(wl, PLLSH_WCS_PLL_SWALLOW_EN,
+                                     PLLSH_WCS_PLL_SWALLOW_EN_VAL2);
+        }
+}
+
+static void wl18xx_boot_soft_reset(struct wl1271 *wl)
+{
+        /* disable Rx/Tx */
+        wl1271_write32(wl, WL18XX_ENABLE, 0x0);
+
+        /* disable auto calibration on start*/
+        wl1271_write32(wl, WL18XX_SPARE_A2, 0xffff);
+}
+
+static int wl18xx_pre_boot(struct wl1271 *wl)
+{
+        wl18xx_set_clk(wl);
+
+        /* Continue the ELP wake up sequence */
+        wl1271_write32(wl, WL18XX_WELP_ARM_COMMAND, WELP_ARM_COMMAND_VAL);
+        udelay(500);
+
+        wlcore_set_partition(wl, &wl->ptable[PART_BOOT]);
+
+        /* Disable interrupts */
+        wlcore_write_reg(wl, REG_INTERRUPT_MASK, WL1271_ACX_INTR_ALL);
+
+        wl18xx_boot_soft_reset(wl);
+
+        return 0;
+}
+
+static void wl18xx_pre_upload(struct wl1271 *wl)
+{
+        u32 tmp;
+
+        wlcore_set_partition(wl, &wl->ptable[PART_BOOT]);
+
+        /* TODO: check if this is all needed */
+        wl1271_write32(wl, WL18XX_EEPROMLESS_IND, WL18XX_EEPROMLESS_IND);
+
+        tmp = wlcore_read_reg(wl, REG_CHIP_ID_B);
+
+        wl1271_debug(DEBUG_BOOT, "chip id 0x%x", tmp);
+
+        tmp = wl1271_read32(wl, WL18XX_SCR_PAD2);
+}
+
+static void wl18xx_set_mac_and_phy(struct wl1271 *wl)
+{
+        struct wl18xx_priv *priv = wl->priv;
+        size_t len;
+
+        /* the parameters struct is smaller for PG1 */
+        if (wl->chip.id == CHIP_ID_185x_PG10)
+                len = offsetof(struct wl18xx_mac_and_phy_params, psat) + 1;
+        else
+                len = sizeof(struct wl18xx_mac_and_phy_params);
+
+        wlcore_set_partition(wl, &wl->ptable[PART_PHY_INIT]);
+        wl1271_write(wl, WL18XX_PHY_INIT_MEM_ADDR, (u8 *)&priv->conf.phy, len,
+                     false);
+}
+
+static void wl18xx_enable_interrupts(struct wl1271 *wl)
+{
+        u32 event_mask, intr_mask;
+
+        if (wl->chip.id == CHIP_ID_185x_PG10) {
+                event_mask = WL18XX_ACX_EVENTS_VECTOR_PG1;
+                intr_mask = WL18XX_INTR_MASK_PG1;
+        } else {
+                event_mask = WL18XX_ACX_EVENTS_VECTOR_PG2;
+                intr_mask = WL18XX_INTR_MASK_PG2;
+        }
+
+        wlcore_write_reg(wl, REG_INTERRUPT_MASK, event_mask);
+
+        wlcore_enable_interrupts(wl);
+        wlcore_write_reg(wl, REG_INTERRUPT_MASK,
+                         WL1271_ACX_INTR_ALL & ~intr_mask);
+}
+
+static int wl18xx_boot(struct wl1271 *wl)
+{
+        int ret;
+
+        ret = wl18xx_pre_boot(wl);
+        if (ret < 0)
+                goto out;
+
+        wl18xx_pre_upload(wl);
+
+        ret = wlcore_boot_upload_firmware(wl);
+        if (ret < 0)
+                goto out;
+
+        wl18xx_set_mac_and_phy(wl);
+
+        ret = wlcore_boot_run_firmware(wl);
+        if (ret < 0)
+                goto out;
+
+        wl18xx_enable_interrupts(wl);
+
+out:
+        return ret;
+}
+
+static void wl18xx_trigger_cmd(struct wl1271 *wl, int cmd_box_addr,
+                               void *buf, size_t len)
+{
+        struct wl18xx_priv *priv = wl->priv;
+
+        memcpy(priv->cmd_buf, buf, len);
+        memset(priv->cmd_buf + len, 0, WL18XX_CMD_MAX_SIZE - len);
+
+        wl1271_write(wl, cmd_box_addr, priv->cmd_buf, WL18XX_CMD_MAX_SIZE,
+                     false);
+}
+
+static void wl18xx_ack_event(struct wl1271 *wl)
+{
+        wlcore_write_reg(wl, REG_INTERRUPT_TRIG, WL18XX_INTR_TRIG_EVENT_ACK);
+}
+
+static u32 wl18xx_calc_tx_blocks(struct wl1271 *wl, u32 len, u32 spare_blks)
+{
+        u32 blk_size = WL18XX_TX_HW_BLOCK_SIZE;
+        return (len + blk_size - 1) / blk_size + spare_blks;
+}
+
+static void
+wl18xx_set_tx_desc_blocks(struct wl1271 *wl, struct wl1271_tx_hw_descr *desc,
+                          u32 blks, u32 spare_blks)
+{
+        desc->wl18xx_mem.total_mem_blocks = blks;
+}
+
+static void
+wl18xx_set_tx_desc_data_len(struct wl1271 *wl, struct wl1271_tx_hw_descr *desc,
+                            struct sk_buff *skb)
+{
+        desc->length = cpu_to_le16(skb->len);
+
+        /* if only the last frame is to be padded, we unset this bit on Tx */
+        if (wl->quirks & WLCORE_QUIRK_TX_PAD_LAST_FRAME)
+                desc->wl18xx_mem.ctrl = WL18XX_TX_CTRL_NOT_PADDED;
+        else
+                desc->wl18xx_mem.ctrl = 0;
+
+        wl1271_debug(DEBUG_TX, "tx_fill_hdr: hlid: %d "
+                     "len: %d life: %d mem: %d", desc->hlid,
+                     le16_to_cpu(desc->length),
+                     le16_to_cpu(desc->life_time),
+                     desc->wl18xx_mem.total_mem_blocks);
+}
+
+static enum wl_rx_buf_align
+wl18xx_get_rx_buf_align(struct wl1271 *wl, u32 rx_desc)
+{
+        if (rx_desc & RX_BUF_PADDED_PAYLOAD)
+                return WLCORE_RX_BUF_PADDED;
+
+        return WLCORE_RX_BUF_ALIGNED;
+}
+
+static u32 wl18xx_get_rx_packet_len(struct wl1271 *wl, void *rx_data,
+                                    u32 data_len)
+{
+        struct wl1271_rx_descriptor *desc = rx_data;
+
+        /* invalid packet */
+        if (data_len < sizeof(*desc))
+                return 0;
+
+        return data_len - sizeof(*desc);
+}
+
+static void wl18xx_tx_immediate_completion(struct wl1271 *wl)
+{
+        wl18xx_tx_immediate_complete(wl);
+}
+
+static int wl18xx_set_host_cfg_bitmap(struct wl1271 *wl, u32 extra_mem_blk)
+{
+        int ret;
+        u32 sdio_align_size = 0;
+        u32 host_cfg_bitmap = HOST_IF_CFG_RX_FIFO_ENABLE |
+                              HOST_IF_CFG_ADD_RX_ALIGNMENT;
+
+        /* Enable Tx SDIO padding */
+        if (wl->quirks & WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN) {
+                host_cfg_bitmap |= HOST_IF_CFG_TX_PAD_TO_SDIO_BLK;
+                sdio_align_size = WL12XX_BUS_BLOCK_SIZE;
+        }
+
+        /* Enable Rx SDIO padding */
+        if (wl->quirks & WLCORE_QUIRK_RX_BLOCKSIZE_ALIGN) {
+                host_cfg_bitmap |= HOST_IF_CFG_RX_PAD_TO_SDIO_BLK;
+                sdio_align_size = WL12XX_BUS_BLOCK_SIZE;
+        }
+
+        ret = wl18xx_acx_host_if_cfg_bitmap(wl, host_cfg_bitmap,
+                                            sdio_align_size, extra_mem_blk,
+                                            WL18XX_HOST_IF_LEN_SIZE_FIELD);
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+static int wl18xx_hw_init(struct wl1271 *wl)
+{
+        int ret;
+        struct wl18xx_priv *priv = wl->priv;
+
+        /* (re)init private structures. Relevant on recovery as well. */
+        priv->last_fw_rls_idx = 0;
+        priv->extra_spare_vif_count = 0;
+
+        /* set the default amount of spare blocks in the bitmap */
+        ret = wl18xx_set_host_cfg_bitmap(wl, WL18XX_TX_HW_BLOCK_SPARE);
+        if (ret < 0)
+                return ret;
+
+        if (checksum_param) {
+                ret = wl18xx_acx_set_checksum_state(wl);
+                if (ret != 0)
+                        return ret;
+        }
+
+        return ret;
+}
+
+static void wl18xx_set_tx_desc_csum(struct wl1271 *wl,
+                                    struct wl1271_tx_hw_descr *desc,
+                                    struct sk_buff *skb)
+{
+        u32 ip_hdr_offset;
+        struct iphdr *ip_hdr;
+
+        if (!checksum_param) {
+                desc->wl18xx_checksum_data = 0;
+                return;
+        }
+
+        if (skb->ip_summed != CHECKSUM_PARTIAL) {
+                desc->wl18xx_checksum_data = 0;
+                return;
+        }
+
+        ip_hdr_offset = skb_network_header(skb) - skb_mac_header(skb);
+        if (WARN_ON(ip_hdr_offset >= (1<<7))) {
+                desc->wl18xx_checksum_data = 0;
+                return;
+        }
+
+        desc->wl18xx_checksum_data = ip_hdr_offset << 1;
+
+        /* FW is interested only in the LSB of the protocol  TCP=0 UDP=1 */
+        ip_hdr = (void *)skb_network_header(skb);
+        desc->wl18xx_checksum_data |= (ip_hdr->protocol & 0x01);
+}
+
+static void wl18xx_set_rx_csum(struct wl1271 *wl,
+                               struct wl1271_rx_descriptor *desc,
+                               struct sk_buff *skb)
+{
+        if (desc->status & WL18XX_RX_CHECKSUM_MASK)
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
+}
+
+/*
+ * TODO: instead of having these two functions to get the rate mask,
+ * we should modify the wlvif->rate_set instead
+ */
+static u32 wl18xx_sta_get_ap_rate_mask(struct wl1271 *wl,
+                                       struct wl12xx_vif *wlvif)
+{
+        u32 hw_rate_set = wlvif->rate_set;
+
+        if (wlvif->channel_type == NL80211_CHAN_HT40MINUS ||
+            wlvif->channel_type == NL80211_CHAN_HT40PLUS) {
+                wl1271_debug(DEBUG_ACX, "using wide channel rate mask");
+                hw_rate_set |= CONF_TX_RATE_USE_WIDE_CHAN;
+
+                /* we don't support MIMO in wide-channel mode */
+                hw_rate_set &= ~CONF_TX_MIMO_RATES;
+        }
+
+        return hw_rate_set;
+}
+
+static u32 wl18xx_ap_get_mimo_wide_rate_mask(struct wl1271 *wl,
+                                             struct wl12xx_vif *wlvif)
+{
+        if ((wlvif->channel_type == NL80211_CHAN_HT40MINUS ||
+             wlvif->channel_type == NL80211_CHAN_HT40PLUS) &&
+            !strcmp(ht_mode_param, "wide")) {
+                wl1271_debug(DEBUG_ACX, "using wide channel rate mask");
+                return CONF_TX_RATE_USE_WIDE_CHAN;
+        } else if (!strcmp(ht_mode_param, "mimo")) {
+                wl1271_debug(DEBUG_ACX, "using MIMO rate mask");
+
+                /*
+                 * PG 1.0 has some problems with MCS_13, so disable it
+                 *
+                 * TODO: instead of hacking this in here, we should
+                 * make it more general and change a bit in the
+                 * wlvif->rate_set instead.
+                 */
+                if (wl->chip.id == CHIP_ID_185x_PG10)
+                        return CONF_TX_MIMO_RATES & ~CONF_HW_BIT_RATE_MCS_13;
+
+                return CONF_TX_MIMO_RATES;
+        } else {
+                return 0;
+        }
+}
+
+static s8 wl18xx_get_pg_ver(struct wl1271 *wl)
+{
+        u32 fuse;
+
+        wlcore_set_partition(wl, &wl->ptable[PART_TOP_PRCM_ELP_SOC]);
+
+        fuse = wl1271_read32(wl, WL18XX_REG_FUSE_DATA_1_3);
+        fuse = (fuse & WL18XX_PG_VER_MASK) >> WL18XX_PG_VER_OFFSET;
+
+        wlcore_set_partition(wl, &wl->ptable[PART_BOOT]);
+
+        return (s8)fuse;
+}
+
+#define WL18XX_CONF_FILE_NAME "ti-connectivity/wl18xx-conf.bin"
+static int wl18xx_conf_init(struct wl1271 *wl, struct device *dev)
+{
+        struct wl18xx_priv *priv = wl->priv;
+        struct wlcore_conf_file *conf_file;
+        const struct firmware *fw;
+        int ret;
+
+        ret = request_firmware(&fw, WL18XX_CONF_FILE_NAME, dev);
+        if (ret < 0) {
+                wl1271_error("could not get configuration binary %s: %d",
+                             WL18XX_CONF_FILE_NAME, ret);
+                goto out_fallback;
+        }
+
+        if (fw->size != WL18XX_CONF_SIZE) {
+                wl1271_error("configuration binary file size is wrong, "
+                             "expected %ld got %zd",
+                             WL18XX_CONF_SIZE, fw->size);
+                ret = -EINVAL;
+                goto out;
+        }
+
+        conf_file = (struct wlcore_conf_file *) fw->data;
+
+        if (conf_file->header.magic != cpu_to_le32(WL18XX_CONF_MAGIC)) {
+                wl1271_error("configuration binary file magic number mismatch, "
+                             "expected 0x%0x got 0x%0x", WL18XX_CONF_MAGIC,
+                             conf_file->header.magic);
+                ret = -EINVAL;
+                goto out;
+        }
+
+        if (conf_file->header.version != cpu_to_le32(WL18XX_CONF_VERSION)) {
+                wl1271_error("configuration binary file version not supported, "
+                             "expected 0x%08x got 0x%08x",
+                             WL18XX_CONF_VERSION, conf_file->header.version);
+                ret = -EINVAL;
+                goto out;
+        }
+
+        memcpy(&wl->conf, &conf_file->core, sizeof(wl18xx_conf));
+        memcpy(&priv->conf, &conf_file->priv, sizeof(priv->conf));
+
+        goto out;
+
+out_fallback:
+        wl1271_warning("falling back to default config");
+
+        /* apply driver default configuration */
+        memcpy(&wl->conf, &wl18xx_conf, sizeof(wl18xx_conf));
+        /* apply default private configuration */
+        memcpy(&priv->conf, &wl18xx_default_priv_conf, sizeof(priv->conf));
+
+        /* For now we just fallback */
+        return 0;
+
+out:
+        release_firmware(fw);
+        return ret;
+}
+
+static int wl18xx_plt_init(struct wl1271 *wl)
+{
+        wl1271_write32(wl, WL18XX_SCR_PAD8, WL18XX_SCR_PAD8_PLT);
+
+        return wl->ops->boot(wl);
+}
+
+static void wl18xx_get_mac(struct wl1271 *wl)
+{
+        u32 mac1, mac2;
+
+        wlcore_set_partition(wl, &wl->ptable[PART_TOP_PRCM_ELP_SOC]);
+
+        mac1 = wl1271_read32(wl, WL18XX_REG_FUSE_BD_ADDR_1);
+        mac2 = wl1271_read32(wl, WL18XX_REG_FUSE_BD_ADDR_2);
+
+        /* these are the two parts of the BD_ADDR */
+        wl->fuse_oui_addr = ((mac2 & 0xffff) << 8) +
+                ((mac1 & 0xff000000) >> 24);
+        wl->fuse_nic_addr = (mac1 & 0xffffff);
+
+        wlcore_set_partition(wl, &wl->ptable[PART_DOWN]);
+}
+
+static int wl18xx_handle_static_data(struct wl1271 *wl,
+                                     struct wl1271_static_data *static_data)
+{
+        struct wl18xx_static_data_priv *static_data_priv =
+                (struct wl18xx_static_data_priv *) static_data->priv;
+
+        wl1271_info("PHY firmware version: %s", static_data_priv->phy_version);
+
+        return 0;
+}
+
+static int wl18xx_get_spare_blocks(struct wl1271 *wl, bool is_gem)
+{
+        struct wl18xx_priv *priv = wl->priv;
+
+        /* If we have VIFs requiring extra spare, indulge them */
+        if (priv->extra_spare_vif_count)
+                return WL18XX_TX_HW_EXTRA_BLOCK_SPARE;
+
+        return WL18XX_TX_HW_BLOCK_SPARE;
+}
+
+static int wl18xx_set_key(struct wl1271 *wl, enum set_key_cmd cmd,
+                          struct ieee80211_vif *vif,
+                          struct ieee80211_sta *sta,
+                          struct ieee80211_key_conf *key_conf)
+{
+        struct wl18xx_priv *priv = wl->priv;
+        bool change_spare = false;
+        int ret;
+
+        /*
+         * when adding the first or removing the last GEM/TKIP interface,
+         * we have to adjust the number of spare blocks.
+         */
+        change_spare = (key_conf->cipher == WL1271_CIPHER_SUITE_GEM ||
+                key_conf->cipher == WLAN_CIPHER_SUITE_TKIP) &&
+                ((priv->extra_spare_vif_count == 0 && cmd == SET_KEY) ||
+                 (priv->extra_spare_vif_count == 1 && cmd == DISABLE_KEY));
+
+        /* no need to change spare - just regular set_key */
+        if (!change_spare)
+                return wlcore_set_key(wl, cmd, vif, sta, key_conf);
+
+        /*
+         * stop the queues and flush to ensure the next packets are
+         * in sync with FW spare block accounting
+         */
+        wlcore_stop_queues(wl, WLCORE_QUEUE_STOP_REASON_SPARE_BLK);
+        wl1271_tx_flush(wl);
+
+        ret = wlcore_set_key(wl, cmd, vif, sta, key_conf);
+        if (ret < 0)
+                goto out;
+
+        /* key is now set, change the spare blocks */
+        if (cmd == SET_KEY) {
+                ret = wl18xx_set_host_cfg_bitmap(wl,
+                                        WL18XX_TX_HW_EXTRA_BLOCK_SPARE);
+                if (ret < 0)
+                        goto out;
+
+                priv->extra_spare_vif_count++;
+        } else {
+                ret = wl18xx_set_host_cfg_bitmap(wl,
+                                        WL18XX_TX_HW_BLOCK_SPARE);
+                if (ret < 0)
+                        goto out;
+
+                priv->extra_spare_vif_count--;
+        }
+
+out:
+        wlcore_wake_queues(wl, WLCORE_QUEUE_STOP_REASON_SPARE_BLK);
+        return ret;
+}
+
+static u32 wl18xx_pre_pkt_send(struct wl1271 *wl,
+                               u32 buf_offset, u32 last_len)
+{
+        if (wl->quirks & WLCORE_QUIRK_TX_PAD_LAST_FRAME) {
+                struct wl1271_tx_hw_descr *last_desc;
+
+                /* get the last TX HW descriptor written to the aggr buf */
+                last_desc = (struct wl1271_tx_hw_descr *)(wl->aggr_buf +
+                                                        buf_offset - last_len);
+
+                /* the last frame is padded up to an SDIO block */
+                last_desc->wl18xx_mem.ctrl &= ~WL18XX_TX_CTRL_NOT_PADDED;
+                return ALIGN(buf_offset, WL12XX_BUS_BLOCK_SIZE);
+        }
+
+        /* no modifications */
+        return buf_offset;
+}
+
+static struct wlcore_ops wl18xx_ops = {
+        .identify_chip  = wl18xx_identify_chip,
+        .boot           = wl18xx_boot,
+        .plt_init       = wl18xx_plt_init,
+        .trigger_cmd    = wl18xx_trigger_cmd,
+        .ack_event      = wl18xx_ack_event,
+        .calc_tx_blocks = wl18xx_calc_tx_blocks,
+        .set_tx_desc_blocks = wl18xx_set_tx_desc_blocks,
+        .set_tx_desc_data_len = wl18xx_set_tx_desc_data_len,
+        .get_rx_buf_align = wl18xx_get_rx_buf_align,
+        .get_rx_packet_len = wl18xx_get_rx_packet_len,
+        .tx_immediate_compl = wl18xx_tx_immediate_completion,
+        .tx_delayed_compl = NULL,
+        .hw_init        = wl18xx_hw_init,
+        .set_tx_desc_csum = wl18xx_set_tx_desc_csum,
+        .get_pg_ver     = wl18xx_get_pg_ver,
+        .set_rx_csum = wl18xx_set_rx_csum,
+        .sta_get_ap_rate_mask = wl18xx_sta_get_ap_rate_mask,
+        .ap_get_mimo_wide_rate_mask = wl18xx_ap_get_mimo_wide_rate_mask,
+        .get_mac        = wl18xx_get_mac,
+        .debugfs_init   = wl18xx_debugfs_add_files,
+        .handle_static_data     = wl18xx_handle_static_data,
+        .get_spare_blocks = wl18xx_get_spare_blocks,
+        .set_key        = wl18xx_set_key,
+        .pre_pkt_send   = wl18xx_pre_pkt_send,
+};
+
+/* HT cap appropriate for wide channels */
+static struct ieee80211_sta_ht_cap wl18xx_siso40_ht_cap = {
+        .cap = IEEE80211_HT_CAP_SGI_20 | IEEE80211_HT_CAP_SGI_40 |
+               IEEE80211_HT_CAP_SUP_WIDTH_20_40 | IEEE80211_HT_CAP_DSSSCCK40,
+        .ht_supported = true,
+        .ampdu_factor = IEEE80211_HT_MAX_AMPDU_16K,
+        .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
+        .mcs = {
+                .rx_mask = { 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+                .rx_highest = cpu_to_le16(150),
+                .tx_params = IEEE80211_HT_MCS_TX_DEFINED,
+                },
+};
+
+/* HT cap appropriate for SISO 20 */
+static struct ieee80211_sta_ht_cap wl18xx_siso20_ht_cap = {
+        .cap = IEEE80211_HT_CAP_SGI_20,
+        .ht_supported = true,
+        .ampdu_factor = IEEE80211_HT_MAX_AMPDU_16K,
+        .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
+        .mcs = {
+                .rx_mask = { 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+                .rx_highest = cpu_to_le16(72),
+                .tx_params = IEEE80211_HT_MCS_TX_DEFINED,
+                },
+};
+
+/* HT cap appropriate for MIMO rates in 20mhz channel */
+static struct ieee80211_sta_ht_cap wl18xx_mimo_ht_cap_2ghz = {
+        .cap = IEEE80211_HT_CAP_SGI_20,
+        .ht_supported = true,
+        .ampdu_factor = IEEE80211_HT_MAX_AMPDU_16K,
+        .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
+        .mcs = {
+                .rx_mask = { 0xff, 0xff, 0, 0, 0, 0, 0, 0, 0, 0, },
+                .rx_highest = cpu_to_le16(144),
+                .tx_params = IEEE80211_HT_MCS_TX_DEFINED,
+                },
+};
+
+static struct ieee80211_sta_ht_cap wl18xx_mimo_ht_cap_5ghz = {
+        .cap = IEEE80211_HT_CAP_SGI_20,
+        .ht_supported = true,
+        .ampdu_factor = IEEE80211_HT_MAX_AMPDU_16K,
+        .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
+        .mcs = {
+                .rx_mask = { 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
+                .rx_highest = cpu_to_le16(72),
+                .tx_params = IEEE80211_HT_MCS_TX_DEFINED,
+                },
+};
+
+static int __devinit wl18xx_probe(struct platform_device *pdev)
+{
+        struct wl1271 *wl;
+        struct ieee80211_hw *hw;
+        struct wl18xx_priv *priv;
+        int ret;
+
+        hw = wlcore_alloc_hw(sizeof(*priv));
+        if (IS_ERR(hw)) {
+                wl1271_error("can't allocate hw");
+                ret = PTR_ERR(hw);
+                goto out;
+        }
+
+        wl = hw->priv;
+        priv = wl->priv;
+        wl->ops = &wl18xx_ops;
+        wl->ptable = wl18xx_ptable;
+        wl->rtable = wl18xx_rtable;
+        wl->num_tx_desc = 32;
+        wl->num_rx_desc = 16;
+        wl->band_rate_to_idx = wl18xx_band_rate_to_idx;
+        wl->hw_tx_rate_tbl_size = WL18XX_CONF_HW_RXTX_RATE_MAX;
+        wl->hw_min_ht_rate = WL18XX_CONF_HW_RXTX_RATE_MCS0;
+        wl->fw_status_priv_len = sizeof(struct wl18xx_fw_status_priv);
+        wl->stats.fw_stats_len = sizeof(struct wl18xx_acx_statistics);
+        wl->static_data_priv_len = sizeof(struct wl18xx_static_data_priv);
+
+        if (!strcmp(ht_mode_param, "wide")) {
+                memcpy(&wl->ht_cap[IEEE80211_BAND_2GHZ],
+                       &wl18xx_siso40_ht_cap,
+                       sizeof(wl18xx_siso40_ht_cap));
+                memcpy(&wl->ht_cap[IEEE80211_BAND_5GHZ],
+                       &wl18xx_siso40_ht_cap,
+                       sizeof(wl18xx_siso40_ht_cap));
+        } else if (!strcmp(ht_mode_param, "mimo")) {
+                memcpy(&wl->ht_cap[IEEE80211_BAND_2GHZ],
+                       &wl18xx_mimo_ht_cap_2ghz,
+                       sizeof(wl18xx_mimo_ht_cap_2ghz));
+                memcpy(&wl->ht_cap[IEEE80211_BAND_5GHZ],
+                       &wl18xx_mimo_ht_cap_5ghz,
+                       sizeof(wl18xx_mimo_ht_cap_5ghz));
+        } else if (!strcmp(ht_mode_param, "siso20")) {
+                memcpy(&wl->ht_cap[IEEE80211_BAND_2GHZ],
+                       &wl18xx_siso20_ht_cap,
+                       sizeof(wl18xx_siso20_ht_cap));
+                memcpy(&wl->ht_cap[IEEE80211_BAND_5GHZ],
+                       &wl18xx_siso20_ht_cap,
+                       sizeof(wl18xx_siso20_ht_cap));
+        } else {
+                wl1271_error("invalid ht_mode '%s'", ht_mode_param);
+                ret = -EINVAL;
+                goto out_free;
+        }
+
+        ret = wl18xx_conf_init(wl, &pdev->dev);
+        if (ret < 0)
+                goto out_free;
+
+        if (!strcmp(board_type_param, "fpga")) {
+                priv->conf.phy.board_type = BOARD_TYPE_FPGA_18XX;
+        } else if (!strcmp(board_type_param, "hdk")) {
+                priv->conf.phy.board_type = BOARD_TYPE_HDK_18XX;
+                /* HACK! Just for now we hardcode HDK to 0x06 */
+                priv->conf.phy.low_band_component_type = 0x06;
+        } else if (!strcmp(board_type_param, "dvp")) {
+                priv->conf.phy.board_type = BOARD_TYPE_DVP_18XX;
+        } else if (!strcmp(board_type_param, "evb")) {
+                priv->conf.phy.board_type = BOARD_TYPE_EVB_18XX;
+        } else if (!strcmp(board_type_param, "com8")) {
+                priv->conf.phy.board_type = BOARD_TYPE_COM8_18XX;
+                /* HACK! Just for now we hardcode COM8 to 0x06 */
+                priv->conf.phy.low_band_component_type = 0x06;
+        } else {
+                wl1271_error("invalid board type '%s'", board_type_param);
+                ret = -EINVAL;
+                goto out_free;
+        }
+
+        /* If the module param is set, update it in conf */
+        if (low_band_component_param != -1)
+                priv->conf.phy.low_band_component = low_band_component_param;
+        if (low_band_component_type_param != -1)
+                priv->conf.phy.low_band_component_type =
+                        low_band_component_type_param;
+        if (high_band_component_param != -1)
+                priv->conf.phy.high_band_component = high_band_component_param;
+        if (high_band_component_type_param != -1)
+                priv->conf.phy.high_band_component_type =
+                        high_band_component_type_param;
+        if (pwr_limit_reference_11_abg_param != -1)
+                priv->conf.phy.pwr_limit_reference_11_abg =
+                        pwr_limit_reference_11_abg_param;
+        if (n_antennas_2_param != -1)
+                priv->conf.phy.number_of_assembled_ant2_4 = n_antennas_2_param;
+        if (n_antennas_5_param != -1)
+                priv->conf.phy.number_of_assembled_ant5 = n_antennas_5_param;
+        if (dc2dc_param != -1)
+                priv->conf.phy.external_pa_dc2dc = dc2dc_param;
+
+        if (!checksum_param) {
+                wl18xx_ops.set_rx_csum = NULL;
+                wl18xx_ops.init_vif = NULL;
+        }
+
+        wl->enable_11a = enable_11a_param;
+
+        return wlcore_probe(wl, pdev);
+
+out_free:
+        wlcore_free_hw(wl);
+out:
+        return ret;
+}
+
+static const struct platform_device_id wl18xx_id_table[] __devinitconst = {
+        { "wl18xx", 0 },
+        {  } /* Terminating Entry */
+};
+MODULE_DEVICE_TABLE(platform, wl18xx_id_table);
+
+static struct platform_driver wl18xx_driver = {
+        .probe          = wl18xx_probe,
+        .remove         = __devexit_p(wlcore_remove),
+        .id_table       = wl18xx_id_table,
+        .driver = {
+                .name   = "wl18xx_driver",
+                .owner  = THIS_MODULE,
+        }
+};
+
+static int __init wl18xx_init(void)
+{
+        return platform_driver_register(&wl18xx_driver);
+}
+module_init(wl18xx_init);
+
+static void __exit wl18xx_exit(void)
+{
+        platform_driver_unregister(&wl18xx_driver);
+}
+module_exit(wl18xx_exit);
+
+module_param_named(ht_mode, ht_mode_param, charp, S_IRUSR);
+MODULE_PARM_DESC(ht_mode, "Force HT mode: wide (default), mimo or siso20");
+
+module_param_named(board_type, board_type_param, charp, S_IRUSR);
+MODULE_PARM_DESC(board_type, "Board type: fpga, hdk (default), evb, com8 or "
+                 "dvp");
+
+module_param_named(checksum, checksum_param, bool, S_IRUSR);
+MODULE_PARM_DESC(checksum, "Enable TCP checksum: boolean (defaults to false)");
+
+module_param_named(enable_11a, enable_11a_param, bool, S_IRUSR);
+MODULE_PARM_DESC(enable_11a, "Enable 11a (5GHz): boolean (defaults to true)");
+
+module_param_named(dc2dc, dc2dc_param, int, S_IRUSR);
+MODULE_PARM_DESC(dc2dc, "External DC2DC: u8 (defaults to 0)");
+
+module_param_named(n_antennas_2, n_antennas_2_param, int, S_IRUSR);
+MODULE_PARM_DESC(n_antennas_2,
+                 "Number of installed 2.4GHz antennas: 1 (default) or 2");
+
+module_param_named(n_antennas_5, n_antennas_5_param, int, S_IRUSR);
+MODULE_PARM_DESC(n_antennas_5,
+                 "Number of installed 5GHz antennas: 1 (default) or 2");
+
+module_param_named(low_band_component, low_band_component_param, int,
+                   S_IRUSR);
+MODULE_PARM_DESC(low_band_component, "Low band component: u8 "
+                 "(default is 0x01)");
+
+module_param_named(low_band_component_type, low_band_component_type_param,
+                   int, S_IRUSR);
+MODULE_PARM_DESC(low_band_component_type, "Low band component type: u8 "
+                 "(default is 0x05 or 0x06 depending on the board_type)");
+
+module_param_named(high_band_component, high_band_component_param, int,
+                   S_IRUSR);
+MODULE_PARM_DESC(high_band_component, "High band component: u8, "
+                 "(default is 0x01)");
+
+module_param_named(high_band_component_type, high_band_component_type_param,
+                   int, S_IRUSR);
+MODULE_PARM_DESC(high_band_component_type, "High band component type: u8 "
+                 "(default is 0x09)");
+
+module_param_named(pwr_limit_reference_11_abg,
+                   pwr_limit_reference_11_abg_param, int, S_IRUSR);
+MODULE_PARM_DESC(pwr_limit_reference_11_abg, "Power limit reference: u8 "
+                 "(default is 0xc8)");
+
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Luciano Coelho <coelho@ti.com>");
+MODULE_FIRMWARE(WL18XX_FW_NAME);
diff --git a/drivers/net/wireless/ti/wl18xx/reg.h b/drivers/net/wireless/ti/wl18xx/reg.h
new file mode 100644
index 000000000000..937b71d8783f
--- /dev/null
+++ b/drivers/net/wireless/ti/wl18xx/reg.h
@@ -0,0 +1,191 @@
+/*
+ * This file is part of wlcore
+ *
+ * Copyright (C) 2011 Texas Instruments Inc.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __REG_H__
+#define __REG_H__
+
+#define WL18XX_REGISTERS_BASE      0x00800000
+#define WL18XX_CODE_BASE           0x00000000
+#define WL18XX_DATA_BASE           0x00400000
+#define WL18XX_DOUBLE_BUFFER_BASE  0x00600000
+#define WL18XX_MCU_KEY_SEARCH_BASE 0x00700000
+#define WL18XX_PHY_BASE            0x00900000
+#define WL18XX_TOP_OCP_BASE        0x00A00000
+#define WL18XX_PACKET_RAM_BASE     0x00B00000
+#define WL18XX_HOST_BASE           0x00C00000
+
+#define WL18XX_REGISTERS_DOWN_SIZE 0x0000B000
+
+#define WL18XX_REG_BOOT_PART_START 0x00802000
+#define WL18XX_REG_BOOT_PART_SIZE  0x00014578
+
+#define WL18XX_PHY_INIT_MEM_ADDR   0x80926000
+
+#define WL18XX_SDIO_WSPI_BASE           (WL18XX_REGISTERS_BASE)
+#define WL18XX_REG_CONFIG_BASE          (WL18XX_REGISTERS_BASE + 0x02000)
+#define WL18XX_WGCM_REGS_BASE           (WL18XX_REGISTERS_BASE + 0x03000)
+#define WL18XX_ENC_BASE                 (WL18XX_REGISTERS_BASE + 0x04000)
+#define WL18XX_INTERRUPT_BASE           (WL18XX_REGISTERS_BASE + 0x05000)
+#define WL18XX_UART_BASE                (WL18XX_REGISTERS_BASE + 0x06000)
+#define WL18XX_WELP_BASE                (WL18XX_REGISTERS_BASE + 0x07000)
+#define WL18XX_TCP_CKSM_BASE            (WL18XX_REGISTERS_BASE + 0x08000)
+#define WL18XX_FIFO_BASE                (WL18XX_REGISTERS_BASE + 0x09000)
+#define WL18XX_OCP_BRIDGE_BASE          (WL18XX_REGISTERS_BASE + 0x0A000)
+#define WL18XX_PMAC_RX_BASE             (WL18XX_REGISTERS_BASE + 0x14800)
+#define WL18XX_PMAC_ACM_BASE            (WL18XX_REGISTERS_BASE + 0x14C00)
+#define WL18XX_PMAC_TX_BASE             (WL18XX_REGISTERS_BASE + 0x15000)
+#define WL18XX_PMAC_CSR_BASE            (WL18XX_REGISTERS_BASE + 0x15400)
+
+#define WL18XX_REG_ECPU_CONTROL         (WL18XX_REGISTERS_BASE + 0x02004)
+#define WL18XX_REG_INTERRUPT_NO_CLEAR   (WL18XX_REGISTERS_BASE + 0x050E8)
+#define WL18XX_REG_INTERRUPT_ACK        (WL18XX_REGISTERS_BASE + 0x050F0)
+#define WL18XX_REG_INTERRUPT_TRIG       (WL18XX_REGISTERS_BASE + 0x5074)
+#define WL18XX_REG_INTERRUPT_TRIG_H     (WL18XX_REGISTERS_BASE + 0x5078)
+#define WL18XX_REG_INTERRUPT_MASK       (WL18XX_REGISTERS_BASE + 0x0050DC)
+
+#define WL18XX_REG_CHIP_ID_B            (WL18XX_REGISTERS_BASE + 0x01542C)
+
+#define WL18XX_SLV_MEM_DATA             (WL18XX_HOST_BASE + 0x0018)
+#define WL18XX_SLV_REG_DATA             (WL18XX_HOST_BASE + 0x0008)
+
+/* Scratch Pad registers*/
+#define WL18XX_SCR_PAD0                 (WL18XX_REGISTERS_BASE + 0x0154EC)
+#define WL18XX_SCR_PAD1                 (WL18XX_REGISTERS_BASE + 0x0154F0)
+#define WL18XX_SCR_PAD2                 (WL18XX_REGISTERS_BASE + 0x0154F4)
+#define WL18XX_SCR_PAD3                 (WL18XX_REGISTERS_BASE + 0x0154F8)
+#define WL18XX_SCR_PAD4                 (WL18XX_REGISTERS_BASE + 0x0154FC)
+#define WL18XX_SCR_PAD4_SET             (WL18XX_REGISTERS_BASE + 0x015504)
+#define WL18XX_SCR_PAD4_CLR             (WL18XX_REGISTERS_BASE + 0x015500)
+#define WL18XX_SCR_PAD5                 (WL18XX_REGISTERS_BASE + 0x015508)
+#define WL18XX_SCR_PAD5_SET             (WL18XX_REGISTERS_BASE + 0x015510)
+#define WL18XX_SCR_PAD5_CLR             (WL18XX_REGISTERS_BASE + 0x01550C)
+#define WL18XX_SCR_PAD6                 (WL18XX_REGISTERS_BASE + 0x015514)
+#define WL18XX_SCR_PAD7                 (WL18XX_REGISTERS_BASE + 0x015518)
+#define WL18XX_SCR_PAD8                 (WL18XX_REGISTERS_BASE + 0x01551C)
+#define WL18XX_SCR_PAD9                 (WL18XX_REGISTERS_BASE + 0x015520)
+
+/* Spare registers*/
+#define WL18XX_SPARE_A1                 (WL18XX_REGISTERS_BASE + 0x002194)
+#define WL18XX_SPARE_A2                 (WL18XX_REGISTERS_BASE + 0x002198)
+#define WL18XX_SPARE_A3                 (WL18XX_REGISTERS_BASE + 0x00219C)
+#define WL18XX_SPARE_A4                 (WL18XX_REGISTERS_BASE + 0x0021A0)
+#define WL18XX_SPARE_A5                 (WL18XX_REGISTERS_BASE + 0x0021A4)
+#define WL18XX_SPARE_A6                 (WL18XX_REGISTERS_BASE + 0x0021A8)
+#define WL18XX_SPARE_A7                 (WL18XX_REGISTERS_BASE + 0x0021AC)
+#define WL18XX_SPARE_A8                 (WL18XX_REGISTERS_BASE + 0x0021B0)
+#define WL18XX_SPARE_B1                 (WL18XX_REGISTERS_BASE + 0x015524)
+#define WL18XX_SPARE_B2                 (WL18XX_REGISTERS_BASE + 0x015528)
+#define WL18XX_SPARE_B3                 (WL18XX_REGISTERS_BASE + 0x01552C)
+#define WL18XX_SPARE_B4                 (WL18XX_REGISTERS_BASE + 0x015530)
+#define WL18XX_SPARE_B5                 (WL18XX_REGISTERS_BASE + 0x015534)
+#define WL18XX_SPARE_B6                 (WL18XX_REGISTERS_BASE + 0x015538)
+#define WL18XX_SPARE_B7                 (WL18XX_REGISTERS_BASE + 0x01553C)
+#define WL18XX_SPARE_B8                 (WL18XX_REGISTERS_BASE + 0x015540)
+
+#define WL18XX_REG_COMMAND_MAILBOX_PTR  (WL18XX_SCR_PAD0)
+#define WL18XX_REG_EVENT_MAILBOX_PTR    (WL18XX_SCR_PAD1)
+#define WL18XX_EEPROMLESS_IND           (WL18XX_SCR_PAD4)
+
+#define WL18XX_WELP_ARM_COMMAND         (WL18XX_REGISTERS_BASE + 0x7100)
+#define WL18XX_ENABLE                   (WL18XX_REGISTERS_BASE + 0x01543C)
+
+/* PRCM registers */
+#define PLATFORM_DETECTION              0xA0E3E0
+#define OCS_EN                          0xA02080
+#define PRIMARY_CLK_DETECT              0xA020A6
+#define PLLSH_WCS_PLL_N                 0xA02362
+#define PLLSH_WCS_PLL_M                 0xA02360
+#define PLLSH_WCS_PLL_Q_FACTOR_CFG_1    0xA02364
+#define PLLSH_WCS_PLL_Q_FACTOR_CFG_2    0xA02366
+#define PLLSH_WCS_PLL_P_FACTOR_CFG_1    0xA02368
+#define PLLSH_WCS_PLL_P_FACTOR_CFG_2    0xA0236A
+#define PLLSH_WCS_PLL_SWALLOW_EN        0xA0236C
+#define PLLSH_WL_PLL_EN                 0xA02392
+
+#define PLLSH_WCS_PLL_Q_FACTOR_CFG_1_MASK       0xFFFF
+#define PLLSH_WCS_PLL_Q_FACTOR_CFG_2_MASK       0x007F
+#define PLLSH_WCS_PLL_P_FACTOR_CFG_1_MASK       0xFFFF
+#define PLLSH_WCS_PLL_P_FACTOR_CFG_2_MASK       0x000F
+
+#define PLLSH_WCS_PLL_SWALLOW_EN_VAL1   0x1
+#define PLLSH_WCS_PLL_SWALLOW_EN_VAL2   0x12
+
+#define WL18XX_REG_FUSE_DATA_1_3        0xA0260C
+#define WL18XX_PG_VER_MASK              0x70
+#define WL18XX_PG_VER_OFFSET            4
+
+#define WL18XX_REG_FUSE_BD_ADDR_1       0xA02602
+#define WL18XX_REG_FUSE_BD_ADDR_2       0xA02606
+
+#define WL18XX_CMD_MBOX_ADDRESS         0xB007B4
+
+#define WL18XX_FW_STATUS_ADDR           0x50F8
+
+#define CHIP_ID_185x_PG10              (0x06030101)
+#define CHIP_ID_185x_PG20              (0x06030111)
+
+/*
+ * Host Command Interrupt. Setting this bit masks
+ * the interrupt that the host issues to inform
+ * the FW that it has sent a command
+ * to the Wlan hardware Command Mailbox.
+ */
+#define WL18XX_INTR_TRIG_CMD       BIT(28)
+
+/*
+ * Host Event Acknowlegde Interrupt. The host
+ * sets this bit to acknowledge that it received
+ * the unsolicited information from the event
+ * mailbox.
+ */
+#define WL18XX_INTR_TRIG_EVENT_ACK BIT(29)
+
+/*
+ * To boot the firmware in PLT mode we need to write this value in
+ * SCR_PAD8 before starting.
+ */
+#define WL18XX_SCR_PAD8_PLT     0xBABABEBE
+
+enum {
+        COMPONENT_NO_SWITCH     = 0x0,
+        COMPONENT_2_WAY_SWITCH  = 0x1,
+        COMPONENT_3_WAY_SWITCH  = 0x2,
+        COMPONENT_MATCHING      = 0x3,
+};
+
+enum {
+        FEM_NONE        = 0x0,
+        FEM_VENDOR_1    = 0x1,
+        FEM_VENDOR_2    = 0x2,
+        FEM_VENDOR_3    = 0x3,
+};
+
+enum {
+        BOARD_TYPE_EVB_18XX     = 0,
+        BOARD_TYPE_DVP_18XX     = 1,
+        BOARD_TYPE_HDK_18XX     = 2,
+        BOARD_TYPE_FPGA_18XX    = 3,
+        BOARD_TYPE_COM8_18XX    = 4,
+
+        NUM_BOARD_TYPES,
+};
+
+#endif /* __REG_H__ */
diff --git a/drivers/net/wireless/ti/wl18xx/tx.c b/drivers/net/wireless/ti/wl18xx/tx.c
new file mode 100644
index 000000000000..5b1fb10d9fd7
--- /dev/null
+++ b/drivers/net/wireless/ti/wl18xx/tx.c
@@ -0,0 +1,127 @@
+/*
+ * This file is part of wl18xx
+ *
+ * Copyright (C) 2011 Texas Instruments Inc.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include "../wlcore/wlcore.h"
+#include "../wlcore/cmd.h"
+#include "../wlcore/debug.h"
+#include "../wlcore/acx.h"
+#include "../wlcore/tx.h"
+
+#include "wl18xx.h"
+#include "tx.h"
+
+static void wl18xx_tx_complete_packet(struct wl1271 *wl, u8 tx_stat_byte)
+{
+        struct ieee80211_tx_info *info;
+        struct sk_buff *skb;
+        int id = tx_stat_byte & WL18XX_TX_STATUS_DESC_ID_MASK;
+        bool tx_success;
+
+        /* check for id legality */
+        if (unlikely(id >= wl->num_tx_desc || wl->tx_frames[id] == NULL)) {
+                wl1271_warning("illegal id in tx completion: %d", id);
+                return;
+        }
+
+        /* a zero bit indicates Tx success */
+        tx_success = !(tx_stat_byte & BIT(WL18XX_TX_STATUS_STAT_BIT_IDX));
+
+
+        skb = wl->tx_frames[id];
+        info = IEEE80211_SKB_CB(skb);
+
+        if (wl12xx_is_dummy_packet(wl, skb)) {
+                wl1271_free_tx_id(wl, id);
+                return;
+        }
+
+        /* update the TX status info */
+        if (tx_success && !(info->flags & IEEE80211_TX_CTL_NO_ACK))
+                info->flags |= IEEE80211_TX_STAT_ACK;
+
+        /* no real data about Tx completion */
+        info->status.rates[0].idx = -1;
+        info->status.rates[0].count = 0;
+        info->status.rates[0].flags = 0;
+        info->status.ack_signal = -1;
+
+        if (!tx_success)
+                wl->stats.retry_count++;
+
+        /*
+         * TODO: update sequence number for encryption? seems to be
+         * unsupported for now. needed for recovery with encryption.
+         */
+
+        /* remove private header from packet */
+        skb_pull(skb, sizeof(struct wl1271_tx_hw_descr));
+
+        /* remove TKIP header space if present */
+        if ((wl->quirks & WLCORE_QUIRK_TKIP_HEADER_SPACE) &&
+            info->control.hw_key &&
+            info->control.hw_key->cipher == WLAN_CIPHER_SUITE_TKIP) {
+                int hdrlen = ieee80211_get_hdrlen_from_skb(skb);
+                memmove(skb->data + WL1271_EXTRA_SPACE_TKIP, skb->data, hdrlen);
+                skb_pull(skb, WL1271_EXTRA_SPACE_TKIP);
+        }
+
+        wl1271_debug(DEBUG_TX, "tx status id %u skb 0x%p success %d",
+                     id, skb, tx_success);
+
+        /* return the packet to the stack */
+        skb_queue_tail(&wl->deferred_tx_queue, skb);
+        queue_work(wl->freezable_wq, &wl->netstack_work);
+        wl1271_free_tx_id(wl, id);
+}
+
+void wl18xx_tx_immediate_complete(struct wl1271 *wl)
+{
+        struct wl18xx_fw_status_priv *status_priv =
+                (struct wl18xx_fw_status_priv *)wl->fw_status_2->priv;
+        struct wl18xx_priv *priv = wl->priv;
+        u8 i;
+
+        /* nothing to do here */
+        if (priv->last_fw_rls_idx == status_priv->fw_release_idx)
+                return;
+
+        /* freed Tx descriptors */
+        wl1271_debug(DEBUG_TX, "last released desc = %d, current idx = %d",
+                     priv->last_fw_rls_idx, status_priv->fw_release_idx);
+
+        if (status_priv->fw_release_idx >= WL18XX_FW_MAX_TX_STATUS_DESC) {
+                wl1271_error("invalid desc release index %d",
+                             status_priv->fw_release_idx);
+                WARN_ON(1);
+                return;
+        }
+
+        for (i = priv->last_fw_rls_idx;
+             i != status_priv->fw_release_idx;
+             i = (i + 1) % WL18XX_FW_MAX_TX_STATUS_DESC) {
+                wl18xx_tx_complete_packet(wl,
+                        status_priv->released_tx_desc[i]);
+
+                wl->tx_results_count++;
+        }
+
+        priv->last_fw_rls_idx = status_priv->fw_release_idx;
+}
diff --git a/drivers/net/wireless/ti/wl18xx/tx.h b/drivers/net/wireless/ti/wl18xx/tx.h
new file mode 100644
index 000000000000..ccddc548e44a
--- /dev/null
+++ b/drivers/net/wireless/ti/wl18xx/tx.h
@@ -0,0 +1,46 @@
+/*
+ * This file is part of wl18xx
+ *
+ * Copyright (C) 2011 Texas Instruments. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL18XX_TX_H__
+#define __WL18XX_TX_H__
+
+#include "../wlcore/wlcore.h"
+
+#define WL18XX_TX_HW_BLOCK_SPARE        1
+/* for special cases - namely, TKIP and GEM */
+#define WL18XX_TX_HW_EXTRA_BLOCK_SPARE  2
+#define WL18XX_TX_HW_BLOCK_SIZE         268
+
+#define WL18XX_TX_STATUS_DESC_ID_MASK    0x7F
+#define WL18XX_TX_STATUS_STAT_BIT_IDX    7
+
+/* Indicates this TX HW frame is not padded to SDIO block size */
+#define WL18XX_TX_CTRL_NOT_PADDED       BIT(7)
+
+/*
+ * The FW uses a special bit to indicate a wide channel should be used in
+ * the rate policy.
+ */
+#define CONF_TX_RATE_USE_WIDE_CHAN BIT(31)
+
+void wl18xx_tx_immediate_complete(struct wl1271 *wl);
+
+#endif /* __WL12XX_TX_H__ */
diff --git a/drivers/net/wireless/ti/wl18xx/wl18xx.h b/drivers/net/wireless/ti/wl18xx/wl18xx.h
new file mode 100644
index 000000000000..bc67a4750615
--- /dev/null
+++ b/drivers/net/wireless/ti/wl18xx/wl18xx.h
@@ -0,0 +1,88 @@
+/*
+ * This file is part of wl18xx
+ *
+ * Copyright (C) 2011 Texas Instruments Inc.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#ifndef __WL18XX_PRIV_H__
+#define __WL18XX_PRIV_H__
+
+#include "conf.h"
+
+#define WL18XX_CMD_MAX_SIZE          740
+
+struct wl18xx_priv {
+        /* buffer for sending commands to FW */
+        u8 cmd_buf[WL18XX_CMD_MAX_SIZE];
+
+        struct wl18xx_priv_conf conf;
+
+        /* Index of last released Tx desc in FW */
+        u8 last_fw_rls_idx;
+
+        /* number of VIFs requiring extra spare mem-blocks */
+        int extra_spare_vif_count;
+};
+
+#define WL18XX_FW_MAX_TX_STATUS_DESC 33
+
+struct wl18xx_fw_status_priv {
+        /*
+         * Index in released_tx_desc for first byte that holds
+         * released tx host desc
+         */
+        u8 fw_release_idx;
+
+        /*
+         * Array of host Tx descriptors, where fw_release_idx
+         * indicated the first released idx.
+         */
+        u8 released_tx_desc[WL18XX_FW_MAX_TX_STATUS_DESC];
+
+        u8 padding[2];
+};
+
+#define WL18XX_PHY_VERSION_MAX_LEN 20
+
+struct wl18xx_static_data_priv {
+        char phy_version[WL18XX_PHY_VERSION_MAX_LEN];
+};
+
+struct wl18xx_clk_cfg {
+        u32 n;
+        u32 m;
+        u32 p;
+        u32 q;
+        bool swallow;
+};
+
+enum {
+        CLOCK_CONFIG_16_2_M     = 1,
+        CLOCK_CONFIG_16_368_M,
+        CLOCK_CONFIG_16_8_M,
+        CLOCK_CONFIG_19_2_M,
+        CLOCK_CONFIG_26_M,
+        CLOCK_CONFIG_32_736_M,
+        CLOCK_CONFIG_33_6_M,
+        CLOCK_CONFIG_38_468_M,
+        CLOCK_CONFIG_52_M,
+
+        NUM_CLOCK_CONFIGS,
+};
+
+#endif /* __WL18XX_PRIV_H__ */
diff --git a/drivers/net/wireless/ti/wlcore/acx.c b/drivers/net/wireless/ti/wlcore/acx.c
index f3d6fa508269..b9ec42c83757 100644
--- a/drivers/net/wireless/ti/wlcore/acx.c
+++ b/drivers/net/wireless/ti/wlcore/acx.c
@@ -86,6 +86,7 @@ out:
         kfree(auth);
         return ret;
 }
+EXPORT_SYMBOL_GPL(wl1271_acx_sleep_auth);
 
 int wl1271_acx_tx_power(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                         int power)
@@ -708,14 +709,14 @@ out:
         return ret;
 }
 
-int wl1271_acx_statistics(struct wl1271 *wl, struct acx_statistics *stats)
+int wl1271_acx_statistics(struct wl1271 *wl, void *stats)
 {
         int ret;
 
         wl1271_debug(DEBUG_ACX, "acx statistics");
 
         ret = wl1271_cmd_interrogate(wl, ACX_STATISTICS, stats,
-                                     sizeof(*stats));
+                                     wl->stats.fw_stats_len);
         if (ret < 0) {
                 wl1271_warning("acx statistics failed: %d", ret);
                 return -ENOMEM;
@@ -997,6 +998,7 @@ out:
         kfree(mem_conf);
         return ret;
 }
+EXPORT_SYMBOL_GPL(wl12xx_acx_mem_cfg);
 
 int wl1271_acx_init_mem_config(struct wl1271 *wl)
 {
@@ -1027,6 +1029,7 @@ int wl1271_acx_init_mem_config(struct wl1271 *wl)
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(wl1271_acx_init_mem_config);
 
 int wl1271_acx_init_rx_interrupt(struct wl1271 *wl)
 {
@@ -1150,6 +1153,7 @@ out:
         kfree(acx);
         return ret;
 }
+EXPORT_SYMBOL_GPL(wl1271_acx_pm_config);
 
 int wl1271_acx_keep_alive_mode(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                                bool enable)
diff --git a/drivers/net/wireless/ti/wlcore/acx.h b/drivers/net/wireless/ti/wlcore/acx.h
index e6a74869a5ff..c0181258b722 100644
--- a/drivers/net/wireless/ti/wlcore/acx.h
+++ b/drivers/net/wireless/ti/wlcore/acx.h
@@ -51,21 +51,18 @@
 #define WL1271_ACX_INTR_TRACE_A            BIT(7)
 /* Trace message on MBOX #B */
 #define WL1271_ACX_INTR_TRACE_B            BIT(8)
+/* SW FW Initiated interrupt Watchdog timer expiration */
+#define WL1271_ACX_SW_INTR_WATCHDOG        BIT(9)
 
-#define WL1271_ACX_INTR_ALL                0xFFFFFFFF
-#define WL1271_ACX_ALL_EVENTS_VECTOR       (WL1271_ACX_INTR_WATCHDOG      | \
-                                            WL1271_ACX_INTR_INIT_COMPLETE | \
-                                            WL1271_ACX_INTR_EVENT_A       | \
-                                            WL1271_ACX_INTR_EVENT_B       | \
-                                            WL1271_ACX_INTR_CMD_COMPLETE  | \
-                                            WL1271_ACX_INTR_HW_AVAILABLE  | \
-                                            WL1271_ACX_INTR_DATA)
-
-#define WL1271_INTR_MASK                   (WL1271_ACX_INTR_WATCHDOG     | \
-                                            WL1271_ACX_INTR_EVENT_A      | \
-                                            WL1271_ACX_INTR_EVENT_B      | \
-                                            WL1271_ACX_INTR_HW_AVAILABLE | \
-                                            WL1271_ACX_INTR_DATA)
+#define WL1271_ACX_INTR_ALL             0xFFFFFFFF
+
+/* all possible interrupts - only appropriate ones will be masked in */
+#define WLCORE_ALL_INTR_MASK            (WL1271_ACX_INTR_WATCHDOG     | \
+                                        WL1271_ACX_INTR_EVENT_A       | \
+                                        WL1271_ACX_INTR_EVENT_B       | \
+                                        WL1271_ACX_INTR_HW_AVAILABLE  | \
+                                        WL1271_ACX_INTR_DATA          | \
+                                        WL1271_ACX_SW_INTR_WATCHDOG)
 
 /* Target's information element */
 struct acx_header {
@@ -417,228 +414,6 @@ struct acx_ctsprotect {
         u8 padding[2];
 } __packed;
 
-struct acx_tx_statistics {
-        __le32 internal_desc_overflow;
-}  __packed;
-
-struct acx_rx_statistics {
-        __le32 out_of_mem;
-        __le32 hdr_overflow;
-        __le32 hw_stuck;
-        __le32 dropped;
-        __le32 fcs_err;
-        __le32 xfr_hint_trig;
-        __le32 path_reset;
-        __le32 reset_counter;
-} __packed;
-
-struct acx_dma_statistics {
-        __le32 rx_requested;
-        __le32 rx_errors;
-        __le32 tx_requested;
-        __le32 tx_errors;
-}  __packed;
-
-struct acx_isr_statistics {
-        /* host command complete */
-        __le32 cmd_cmplt;
-
-        /* fiqisr() */
-        __le32 fiqs;
-
-        /* (INT_STS_ND & INT_TRIG_RX_HEADER) */
-        __le32 rx_headers;
-
-        /* (INT_STS_ND & INT_TRIG_RX_CMPLT) */
-        __le32 rx_completes;
-
-        /* (INT_STS_ND & INT_TRIG_NO_RX_BUF) */
-        __le32 rx_mem_overflow;
-
-        /* (INT_STS_ND & INT_TRIG_S_RX_RDY) */
-        __le32 rx_rdys;
-
-        /* irqisr() */
-        __le32 irqs;
-
-        /* (INT_STS_ND & INT_TRIG_TX_PROC) */
-        __le32 tx_procs;
-
-        /* (INT_STS_ND & INT_TRIG_DECRYPT_DONE) */
-        __le32 decrypt_done;
-
-        /* (INT_STS_ND & INT_TRIG_DMA0) */
-        __le32 dma0_done;
-
-        /* (INT_STS_ND & INT_TRIG_DMA1) */
-        __le32 dma1_done;
-
-        /* (INT_STS_ND & INT_TRIG_TX_EXC_CMPLT) */
-        __le32 tx_exch_complete;
-
-        /* (INT_STS_ND & INT_TRIG_COMMAND) */
-        __le32 commands;
-
-        /* (INT_STS_ND & INT_TRIG_RX_PROC) */
-        __le32 rx_procs;
-
-        /* (INT_STS_ND & INT_TRIG_PM_802) */
-        __le32 hw_pm_mode_changes;
-
-        /* (INT_STS_ND & INT_TRIG_ACKNOWLEDGE) */
-        __le32 host_acknowledges;
-
-        /* (INT_STS_ND & INT_TRIG_PM_PCI) */
-        __le32 pci_pm;
-
-        /* (INT_STS_ND & INT_TRIG_ACM_WAKEUP) */
-        __le32 wakeups;
-
-        /* (INT_STS_ND & INT_TRIG_LOW_RSSI) */
-        __le32 low_rssi;
-} __packed;
-
-struct acx_wep_statistics {
-        /* WEP address keys configured */
-        __le32 addr_key_count;
-
-        /* default keys configured */
-        __le32 default_key_count;
-
-        __le32 reserved;
-
-        /* number of times that WEP key not found on lookup */
-        __le32 key_not_found;
-
-        /* number of times that WEP key decryption failed */
-        __le32 decrypt_fail;
-
-        /* WEP packets decrypted */
-        __le32 packets;
-
-        /* WEP decrypt interrupts */
-        __le32 interrupt;
-} __packed;
-
-#define ACX_MISSED_BEACONS_SPREAD 10
-
-struct acx_pwr_statistics {
-        /* the amount of enters into power save mode (both PD & ELP) */
-        __le32 ps_enter;
-
-        /* the amount of enters into ELP mode */
-        __le32 elp_enter;
-
-        /* the amount of missing beacon interrupts to the host */
-        __le32 missing_bcns;
-
-        /* the amount of wake on host-access times */
-        __le32 wake_on_host;
-
-        /* the amount of wake on timer-expire */
-        __le32 wake_on_timer_exp;
-
-        /* the number of packets that were transmitted with PS bit set */
-        __le32 tx_with_ps;
-
-        /* the number of packets that were transmitted with PS bit clear */
-        __le32 tx_without_ps;
-
-        /* the number of received beacons */
-        __le32 rcvd_beacons;
-
-        /* the number of entering into PowerOn (power save off) */
-        __le32 power_save_off;
-
-        /* the number of entries into power save mode */
-        __le16 enable_ps;
-
-        /*
-         * the number of exits from power save, not including failed PS
-         * transitions
-         */
-        __le16 disable_ps;
-
-        /*
-         * the number of times the TSF counter was adjusted because
-         * of drift
-         */
-        __le32 fix_tsf_ps;
-
-        /* Gives statistics about the spread continuous missed beacons.
-         * The 16 LSB are dedicated for the PS mode.
-         * The 16 MSB are dedicated for the PS mode.
-         * cont_miss_bcns_spread[0] - single missed beacon.
-         * cont_miss_bcns_spread[1] - two continuous missed beacons.
-         * cont_miss_bcns_spread[2] - three continuous missed beacons.
-         * ...
-         * cont_miss_bcns_spread[9] - ten and more continuous missed beacons.
-        */
-        __le32 cont_miss_bcns_spread[ACX_MISSED_BEACONS_SPREAD];
-
-        /* the number of beacons in awake mode */
-        __le32 rcvd_awake_beacons;
-} __packed;
-
-struct acx_mic_statistics {
-        __le32 rx_pkts;
-        __le32 calc_failure;
-} __packed;
-
-struct acx_aes_statistics {
-        __le32 encrypt_fail;
-        __le32 decrypt_fail;
-        __le32 encrypt_packets;
-        __le32 decrypt_packets;
-        __le32 encrypt_interrupt;
-        __le32 decrypt_interrupt;
-} __packed;
-
-struct acx_event_statistics {
-        __le32 heart_beat;
-        __le32 calibration;
-        __le32 rx_mismatch;
-        __le32 rx_mem_empty;
-        __le32 rx_pool;
-        __le32 oom_late;
-        __le32 phy_transmit_error;
-        __le32 tx_stuck;
-} __packed;
-
-struct acx_ps_statistics {
-        __le32 pspoll_timeouts;
-        __le32 upsd_timeouts;
-        __le32 upsd_max_sptime;
-        __le32 upsd_max_apturn;
-        __le32 pspoll_max_apturn;
-        __le32 pspoll_utilization;
-        __le32 upsd_utilization;
-} __packed;
-
-struct acx_rxpipe_statistics {
-        __le32 rx_prep_beacon_drop;
-        __le32 descr_host_int_trig_rx_data;
-        __le32 beacon_buffer_thres_host_int_trig_rx_data;
-        __le32 missed_beacon_host_int_trig_rx_data;
-        __le32 tx_xfr_host_int_trig_rx_data;
-} __packed;
-
-struct acx_statistics {
-        struct acx_header header;
-
-        struct acx_tx_statistics tx;
-        struct acx_rx_statistics rx;
-        struct acx_dma_statistics dma;
-        struct acx_isr_statistics isr;
-        struct acx_wep_statistics wep;
-        struct acx_pwr_statistics pwr;
-        struct acx_aes_statistics aes;
-        struct acx_mic_statistics mic;
-        struct acx_event_statistics event;
-        struct acx_ps_statistics ps;
-        struct acx_rxpipe_statistics rxpipe;
-} __packed;
-
 struct acx_rate_class {
         __le32 enabled_rates;
         u8 short_retry_limit;
@@ -828,6 +603,8 @@ struct wl1271_acx_keep_alive_config {
 #define HOST_IF_CFG_RX_FIFO_ENABLE     BIT(0)
 #define HOST_IF_CFG_TX_EXTRA_BLKS_SWAP BIT(1)
 #define HOST_IF_CFG_TX_PAD_TO_SDIO_BLK BIT(3)
+#define HOST_IF_CFG_RX_PAD_TO_SDIO_BLK BIT(4)
+#define HOST_IF_CFG_ADD_RX_ALIGNMENT   BIT(6)
 
 enum {
         WL1271_ACX_TRIG_TYPE_LEVEL = 0,
@@ -946,7 +723,7 @@ struct wl1271_acx_ht_information {
         u8 padding[2];
 } __packed;
 
-#define RX_BA_MAX_SESSIONS 2
+#define RX_BA_MAX_SESSIONS 3
 
 struct wl1271_acx_ba_initiator_policy {
         struct acx_header header;
@@ -1243,6 +1020,7 @@ enum {
         ACX_CONFIG_HANGOVER              = 0x0042,
         ACX_FEATURE_CFG                  = 0x0043,
         ACX_PROTECTION_CFG               = 0x0044,
+        ACX_CHECKSUM_CONFIG              = 0x0045,
 };
 
 
@@ -1281,7 +1059,7 @@ int wl1271_acx_set_preamble(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                             enum acx_preamble_type preamble);
 int wl1271_acx_cts_protect(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                            enum acx_ctsprotect_type ctsprotect);
-int wl1271_acx_statistics(struct wl1271 *wl, struct acx_statistics *stats);
+int wl1271_acx_statistics(struct wl1271 *wl, void *stats);
 int wl1271_acx_sta_rate_policies(struct wl1271 *wl, struct wl12xx_vif *wlvif);
 int wl1271_acx_ap_rate_policy(struct wl1271 *wl, struct conf_tx_rate_class *c,
                       u8 idx);
diff --git a/drivers/net/wireless/ti/wlcore/boot.c b/drivers/net/wireless/ti/wlcore/boot.c
index 9b98230f84ce..0fda500c01c9 100644
--- a/drivers/net/wireless/ti/wlcore/boot.c
+++ b/drivers/net/wireless/ti/wlcore/boot.c
@@ -45,10 +45,17 @@ static void wl1271_boot_set_ecpu_ctrl(struct wl1271 *wl, u32 flag)
         wlcore_write_reg(wl, REG_ECPU_CONTROL, cpu_ctrl);
 }
 
-static int wlcore_parse_fw_ver(struct wl1271 *wl)
+static int wlcore_boot_parse_fw_ver(struct wl1271 *wl,
+                                    struct wl1271_static_data *static_data)
 {
         int ret;
 
+        strncpy(wl->chip.fw_ver_str, static_data->fw_version,
+                sizeof(wl->chip.fw_ver_str));
+
+        /* make sure the string is NULL-terminated */
+        wl->chip.fw_ver_str[sizeof(wl->chip.fw_ver_str) - 1] = '\0';
+
         ret = sscanf(wl->chip.fw_ver_str + 4, "%u.%u.%u.%u.%u",
                      &wl->chip.fw_ver[0], &wl->chip.fw_ver[1],
                      &wl->chip.fw_ver[2], &wl->chip.fw_ver[3],
@@ -57,43 +64,43 @@ static int wlcore_parse_fw_ver(struct wl1271 *wl)
         if (ret != 5) {
                 wl1271_warning("fw version incorrect value");
                 memset(wl->chip.fw_ver, 0, sizeof(wl->chip.fw_ver));
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out;
         }
 
         ret = wlcore_identify_fw(wl);
         if (ret < 0)
-                return ret;
-
-        return 0;
+                goto out;
+out:
+        return ret;
 }
 
-static int wlcore_boot_fw_version(struct wl1271 *wl)
+static int wlcore_boot_static_data(struct wl1271 *wl)
 {
         struct wl1271_static_data *static_data;
+        size_t len = sizeof(*static_data) + wl->static_data_priv_len;
         int ret;
 
-        static_data = kmalloc(sizeof(*static_data), GFP_KERNEL | GFP_DMA);
+        static_data = kmalloc(len, GFP_KERNEL);
         if (!static_data) {
-                wl1271_error("Couldn't allocate memory for static data!");
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto out;
         }
 
-        wl1271_read(wl, wl->cmd_box_addr, static_data, sizeof(*static_data),
-                    false);
-
-        strncpy(wl->chip.fw_ver_str, static_data->fw_version,
-                sizeof(wl->chip.fw_ver_str));
-
-        kfree(static_data);
+        wl1271_read(wl, wl->cmd_box_addr, static_data, len, false);
 
-        /* make sure the string is NULL-terminated */
-        wl->chip.fw_ver_str[sizeof(wl->chip.fw_ver_str) - 1] = '\0';
+        ret = wlcore_boot_parse_fw_ver(wl, static_data);
+        if (ret < 0)
+                goto out_free;
 
-        ret = wlcore_parse_fw_ver(wl);
+        ret = wlcore_handle_static_data(wl, static_data);
         if (ret < 0)
-                return ret;
+                goto out_free;
 
-        return 0;
+out_free:
+        kfree(static_data);
+out:
+        return ret;
 }
 
 static int wl1271_boot_upload_firmware_chunk(struct wl1271 *wl, void *buf,
@@ -204,8 +211,10 @@ int wlcore_boot_upload_nvs(struct wl1271 *wl)
         u32 dest_addr, val;
         u8 *nvs_ptr, *nvs_aligned;
 
-        if (wl->nvs == NULL)
+        if (wl->nvs == NULL) {
+                wl1271_error("NVS file is needed during boot");
                 return -ENODEV;
+        }
 
         if (wl->quirks & WLCORE_QUIRK_LEGACY_NVS) {
                 struct wl1271_nvs_file *nvs =
@@ -400,9 +409,9 @@ int wlcore_boot_run_firmware(struct wl1271 *wl)
         wl1271_debug(DEBUG_MAILBOX, "MBOX ptrs: 0x%x 0x%x",
                      wl->mbox_ptr[0], wl->mbox_ptr[1]);
 
-        ret = wlcore_boot_fw_version(wl);
+        ret = wlcore_boot_static_data(wl);
         if (ret < 0) {
-                wl1271_error("couldn't boot firmware");
+                wl1271_error("error getting static data");
                 return ret;
         }
 
diff --git a/drivers/net/wireless/ti/wlcore/boot.h b/drivers/net/wireless/ti/wlcore/boot.h
index 094981dd2227..a525225f990c 100644
--- a/drivers/net/wireless/ti/wlcore/boot.h
+++ b/drivers/net/wireless/ti/wlcore/boot.h
@@ -40,6 +40,7 @@ struct wl1271_static_data {
         u8 fw_version[WL1271_FW_VERSION_MAX_LEN];
         u32 hw_version;
         u8 tx_power_table[WL1271_NO_SUBBANDS][WL1271_NO_POWER_LEVELS];
+        u8 priv[0];
 };
 
 /* number of times we try to read the INIT interrupt */
diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c
index 5b128a971449..885364ca4344 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.c
+++ b/drivers/net/wireless/ti/wlcore/cmd.c
@@ -36,6 +36,7 @@
 #include "cmd.h"
 #include "event.h"
 #include "tx.h"
+#include "hw_ops.h"
 
 #define WL1271_CMD_FAST_POLL_COUNT       50
 
@@ -291,6 +292,23 @@ static int wl12xx_get_new_session_id(struct wl1271 *wl,
         return wlvif->session_counter;
 }
 
+static u8 wlcore_get_native_channel_type(u8 nl_channel_type)
+{
+        switch (nl_channel_type) {
+        case NL80211_CHAN_NO_HT:
+                return WLCORE_CHAN_NO_HT;
+        case NL80211_CHAN_HT20:
+                return WLCORE_CHAN_HT20;
+        case NL80211_CHAN_HT40MINUS:
+                return WLCORE_CHAN_HT40MINUS;
+        case NL80211_CHAN_HT40PLUS:
+                return WLCORE_CHAN_HT40PLUS;
+        default:
+                WARN_ON(1);
+                return WLCORE_CHAN_NO_HT;
+        }
+}
+
 static int wl12xx_cmd_role_start_dev(struct wl1271 *wl,
                                      struct wl12xx_vif *wlvif)
 {
@@ -407,6 +425,7 @@ int wl12xx_cmd_role_start_sta(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         memcpy(cmd->sta.ssid, wlvif->ssid, wlvif->ssid_len);
         memcpy(cmd->sta.bssid, vif->bss_conf.bssid, ETH_ALEN);
         cmd->sta.local_rates = cpu_to_le32(wlvif->rate_set);
+        cmd->channel_type = wlcore_get_native_channel_type(wlvif->channel_type);
 
         if (wlvif->sta.hlid == WL12XX_INVALID_LINK_ID) {
                 ret = wl12xx_allocate_link(wl, wlvif, &wlvif->sta.hlid);
@@ -482,6 +501,7 @@ int wl12xx_cmd_role_start_ap(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         struct wl12xx_cmd_role_start *cmd;
         struct ieee80211_vif *vif = wl12xx_wlvif_to_vif(wlvif);
         struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
+        u32 supported_rates;
         int ret;
 
         wl1271_debug(DEBUG_CMD, "cmd role start ap %d", wlvif->role_id);
@@ -519,6 +539,7 @@ int wl12xx_cmd_role_start_ap(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         /* FIXME: Change when adding DFS */
         cmd->ap.reset_tsf = 1;  /* By default reset AP TSF */
         cmd->channel = wlvif->channel;
+        cmd->channel_type = wlcore_get_native_channel_type(wlvif->channel_type);
 
         if (!bss_conf->hidden_ssid) {
                 /* take the SSID from the beacon for backward compatibility */
@@ -531,7 +552,13 @@ int wl12xx_cmd_role_start_ap(struct wl1271 *wl, struct wl12xx_vif *wlvif)
                 memcpy(cmd->ap.ssid, bss_conf->ssid, bss_conf->ssid_len);
         }
 
-        cmd->ap.local_rates = cpu_to_le32(0xffffffff);
+        supported_rates = CONF_TX_AP_ENABLED_RATES | CONF_TX_MCS_RATES |
+                wlcore_hw_ap_get_mimo_wide_rate_mask(wl, wlvif);
+
+        wl1271_debug(DEBUG_CMD, "cmd role start ap with supported_rates 0x%08x",
+                     supported_rates);
+
+        cmd->ap.local_rates = cpu_to_le32(supported_rates);
 
         switch (wlvif->band) {
         case IEEE80211_BAND_2GHZ:
@@ -797,6 +824,7 @@ out:
         kfree(cmd);
         return ret;
 }
+EXPORT_SYMBOL_GPL(wl1271_cmd_data_path);
 
 int wl1271_cmd_ps_mode(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                        u8 ps_mode, u16 auto_ps_timeout)
@@ -1018,7 +1046,7 @@ out:
 
 int wl1271_cmd_build_arp_rsp(struct wl1271 *wl, struct wl12xx_vif *wlvif)
 {
-        int ret, extra;
+        int ret, extra = 0;
         u16 fc;
         struct ieee80211_vif *vif = wl12xx_wlvif_to_vif(wlvif);
         struct sk_buff *skb;
@@ -1057,7 +1085,8 @@ int wl1271_cmd_build_arp_rsp(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         /* encryption space */
         switch (wlvif->encryption_type) {
         case KEY_TKIP:
-                extra = WL1271_EXTRA_SPACE_TKIP;
+                if (wl->quirks & WLCORE_QUIRK_TKIP_HEADER_SPACE)
+                        extra = WL1271_EXTRA_SPACE_TKIP;
                 break;
         case KEY_AES:
                 extra = WL1271_EXTRA_SPACE_AES;
@@ -1346,13 +1375,18 @@ int wl12xx_cmd_add_peer(struct wl1271 *wl, struct wl12xx_vif *wlvif,
 
         for (i = 0; i < NUM_ACCESS_CATEGORIES_COPY; i++)
                 if (sta->wme && (sta->uapsd_queues & BIT(i)))
-                        cmd->psd_type[i] = WL1271_PSD_UPSD_TRIGGER;
+                        cmd->psd_type[NUM_ACCESS_CATEGORIES_COPY-1-i] =
+                                        WL1271_PSD_UPSD_TRIGGER;
                 else
-                        cmd->psd_type[i] = WL1271_PSD_LEGACY;
+                        cmd->psd_type[NUM_ACCESS_CATEGORIES_COPY-1-i] =
+                                        WL1271_PSD_LEGACY;
+
 
         sta_rates = sta->supp_rates[wlvif->band];
         if (sta->ht_cap.ht_supported)
-                sta_rates |= sta->ht_cap.mcs.rx_mask[0] << HW_HT_RATES_OFFSET;
+                sta_rates |=
+                        (sta->ht_cap.mcs.rx_mask[0] << HW_HT_RATES_OFFSET) |
+                        (sta->ht_cap.mcs.rx_mask[1] << HW_MIMO_RATES_OFFSET);
 
         cmd->supported_rates =
                 cpu_to_le32(wl1271_tx_enabled_rates_get(wl, sta_rates,
@@ -1573,19 +1607,25 @@ out:
 int wl12xx_roc(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 role_id)
 {
         int ret = 0;
+        bool is_first_roc;
 
         if (WARN_ON(test_bit(role_id, wl->roc_map)))
                 return 0;
 
+        is_first_roc = (find_first_bit(wl->roc_map, WL12XX_MAX_ROLES) >=
+                        WL12XX_MAX_ROLES);
+
         ret = wl12xx_cmd_roc(wl, wlvif, role_id);
         if (ret < 0)
                 goto out;
 
-        ret = wl1271_cmd_wait_for_event(wl,
-                                        REMAIN_ON_CHANNEL_COMPLETE_EVENT_ID);
-        if (ret < 0) {
-                wl1271_error("cmd roc event completion error");
-                goto out;
+        if (is_first_roc) {
+                ret = wl1271_cmd_wait_for_event(wl,
+                                           REMAIN_ON_CHANNEL_COMPLETE_EVENT_ID);
+                if (ret < 0) {
+                        wl1271_error("cmd roc event completion error");
+                        goto out;
+                }
         }
 
         __set_bit(role_id, wl->roc_map);
diff --git a/drivers/net/wireless/ti/wlcore/cmd.h b/drivers/net/wireless/ti/wlcore/cmd.h
index a46ae07cb77e..85171f2bf68e 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.h
+++ b/drivers/net/wireless/ti/wlcore/cmd.h
@@ -192,7 +192,7 @@ enum cmd_templ {
 #define WL1271_COMMAND_TIMEOUT     2000
 #define WL1271_CMD_TEMPL_DFLT_SIZE 252
 #define WL1271_CMD_TEMPL_MAX_SIZE  512
-#define WL1271_EVENT_TIMEOUT       750
+#define WL1271_EVENT_TIMEOUT       1000
 
 struct wl1271_cmd_header {
         __le16 id;
@@ -266,13 +266,22 @@ enum wlcore_band {
         WLCORE_BAND_MAX_RADIO           = 0x7F,
 };
 
+enum wlcore_channel_type {
+        WLCORE_CHAN_NO_HT,
+        WLCORE_CHAN_HT20,
+        WLCORE_CHAN_HT40MINUS,
+        WLCORE_CHAN_HT40PLUS
+};
+
 struct wl12xx_cmd_role_start {
         struct wl1271_cmd_header header;
 
         u8 role_id;
         u8 band;
         u8 channel;
-        u8 padding;
+
+        /* enum wlcore_channel_type */
+        u8 channel_type;
 
         union {
                 struct {
diff --git a/drivers/net/wireless/ti/wlcore/conf.h b/drivers/net/wireless/ti/wlcore/conf.h
index fef0db4213bc..03c635872335 100644
--- a/drivers/net/wireless/ti/wlcore/conf.h
+++ b/drivers/net/wireless/ti/wlcore/conf.h
@@ -45,7 +45,15 @@ enum {
         CONF_HW_BIT_RATE_MCS_4   = BIT(17),
         CONF_HW_BIT_RATE_MCS_5   = BIT(18),
         CONF_HW_BIT_RATE_MCS_6   = BIT(19),
-        CONF_HW_BIT_RATE_MCS_7   = BIT(20)
+        CONF_HW_BIT_RATE_MCS_7   = BIT(20),
+        CONF_HW_BIT_RATE_MCS_8   = BIT(21),
+        CONF_HW_BIT_RATE_MCS_9   = BIT(22),
+        CONF_HW_BIT_RATE_MCS_10  = BIT(23),
+        CONF_HW_BIT_RATE_MCS_11  = BIT(24),
+        CONF_HW_BIT_RATE_MCS_12  = BIT(25),
+        CONF_HW_BIT_RATE_MCS_13  = BIT(26),
+        CONF_HW_BIT_RATE_MCS_14  = BIT(27),
+        CONF_HW_BIT_RATE_MCS_15  = BIT(28),
 };
 
 enum {
@@ -310,7 +318,7 @@ enum {
 struct conf_sg_settings {
         u32 params[CONF_SG_PARAMS_MAX];
         u8 state;
-};
+} __packed;
 
 enum conf_rx_queue_type {
         CONF_RX_QUEUE_TYPE_LOW_PRIORITY,  /* All except the high priority */
@@ -394,7 +402,7 @@ struct conf_rx_settings {
          * Range: RX_QUEUE_TYPE_RX_LOW_PRIORITY, RX_QUEUE_TYPE_RX_HIGH_PRIORITY,
          */
         u8 queue_type;
-};
+} __packed;
 
 #define CONF_TX_MAX_RATE_CLASSES       10
 
@@ -435,6 +443,12 @@ struct conf_rx_settings {
         CONF_HW_BIT_RATE_MCS_5 | CONF_HW_BIT_RATE_MCS_6 |        \
         CONF_HW_BIT_RATE_MCS_7)
 
+#define CONF_TX_MIMO_RATES (CONF_HW_BIT_RATE_MCS_8 |             \
+        CONF_HW_BIT_RATE_MCS_9 | CONF_HW_BIT_RATE_MCS_10 |       \
+        CONF_HW_BIT_RATE_MCS_11 | CONF_HW_BIT_RATE_MCS_12 |      \
+        CONF_HW_BIT_RATE_MCS_13 | CONF_HW_BIT_RATE_MCS_14 |      \
+        CONF_HW_BIT_RATE_MCS_15)
+
 /*
  * Default rates for management traffic when operating in AP mode. This
  * should be configured according to the basic rate set of the AP
@@ -487,7 +501,7 @@ struct conf_tx_rate_class {
          *               the policy (0 - long preamble, 1 - short preamble.
          */
         u8 aflags;
-};
+} __packed;
 
 #define CONF_TX_MAX_AC_COUNT 4
 
@@ -504,7 +518,7 @@ enum conf_tx_ac {
         CONF_TX_AC_VI = 2,         /* video */
         CONF_TX_AC_VO = 3,         /* voice */
         CONF_TX_AC_CTS2SELF = 4,   /* fictitious AC, follows AC_VO */
-        CONF_TX_AC_ANY_TID = 0x1f
+        CONF_TX_AC_ANY_TID = 0xff
 };
 
 struct conf_tx_ac_category {
@@ -544,7 +558,7 @@ struct conf_tx_ac_category {
          * Range: u16
          */
         u16 tx_op_limit;
-};
+} __packed;
 
 #define CONF_TX_MAX_TID_COUNT 8
 
@@ -578,7 +592,7 @@ struct conf_tx_tid {
         u8 ps_scheme;
         u8 ack_policy;
         u32 apsd_conf[2];
-};
+} __packed;
 
 struct conf_tx_settings {
         /*
@@ -664,7 +678,7 @@ struct conf_tx_settings {
 
         /* Time in ms for Tx watchdog timer to expire */
         u32 tx_watchdog_timeout;
-};
+} __packed;
 
 enum {
         CONF_WAKE_UP_EVENT_BEACON    = 0x01, /* Wake on every Beacon*/
@@ -711,7 +725,7 @@ struct conf_bcn_filt_rule {
          * Version for the vendor specifie IE (221)
          */
         u8 version[CONF_BCN_IE_VER_LEN];
-};
+} __packed;
 
 #define CONF_MAX_RSSI_SNR_TRIGGERS 8
 
@@ -762,7 +776,7 @@ struct conf_sig_weights {
          * Range: u8
          */
         u8 snr_pkt_avg_weight;
-};
+} __packed;
 
 enum conf_bcn_filt_mode {
         CONF_BCN_FILT_MODE_DISABLED = 0,
@@ -810,7 +824,7 @@ struct conf_conn_settings {
          *
          * Range: CONF_BCN_FILT_MODE_*
          */
-        enum conf_bcn_filt_mode bcn_filt_mode;
+        u8 bcn_filt_mode;
 
         /*
          * Configure Beacon filter pass-thru rules.
@@ -937,7 +951,7 @@ struct conf_conn_settings {
          * Range: u16
          */
         u8 max_listen_interval;
-};
+} __packed;
 
 enum {
         CONF_REF_CLK_19_2_E,
@@ -965,6 +979,11 @@ struct conf_itrim_settings {
 
         /* moderation timeout in microsecs from the last TX */
         u32 timeout;
+} __packed;
+
+enum conf_fast_wakeup {
+        CONF_FAST_WAKEUP_ENABLE,
+        CONF_FAST_WAKEUP_DISABLE,
 };
 
 struct conf_pm_config_settings {
@@ -978,10 +997,10 @@ struct conf_pm_config_settings {
         /*
          * Host fast wakeup support
          *
-         * Range: true, false
+         * Range: enum conf_fast_wakeup
          */
-        bool host_fast_wakeup_support;
-};
+        u8 host_fast_wakeup_support;
+} __packed;
 
 struct conf_roam_trigger_settings {
         /*
@@ -1018,7 +1037,7 @@ struct conf_roam_trigger_settings {
          * Range: 0 - 255
          */
         u8 avg_weight_snr_data;
-};
+} __packed;
 
 struct conf_scan_settings {
         /*
@@ -1064,7 +1083,7 @@ struct conf_scan_settings {
          * Range: u32 Microsecs
          */
         u32 split_scan_timeout;
-};
+} __packed;
 
 struct conf_sched_scan_settings {
         /*
@@ -1102,7 +1121,7 @@ struct conf_sched_scan_settings {
 
         /* SNR threshold to be used for filtering */
         s8 snr_threshold;
-};
+} __packed;
 
 struct conf_ht_setting {
         u8 rx_ba_win_size;
@@ -1111,7 +1130,7 @@ struct conf_ht_setting {
 
         /* bitmap of enabled TIDs for TX BA sessions */
         u8 tx_ba_tid_bitmap;
-};
+} __packed;
 
 struct conf_memory_settings {
         /* Number of stations supported in IBSS mode */
@@ -1151,7 +1170,7 @@ struct conf_memory_settings {
          * Range: 0-120
          */
         u8 tx_min;
-};
+} __packed;
 
 struct conf_fm_coex {
         u8 enable;
@@ -1164,7 +1183,7 @@ struct conf_fm_coex {
         u16 ldo_stabilization_time;
         u8 fm_disturbed_band_margin;
         u8 swallow_clk_diff;
-};
+} __packed;
 
 struct conf_rx_streaming_settings {
         /*
@@ -1193,7 +1212,7 @@ struct conf_rx_streaming_settings {
          * enable rx streaming also when there is no coex activity
          */
         u8 always;
-};
+} __packed;
 
 struct conf_fwlog {
         /* Continuous or on-demand */
@@ -1217,7 +1236,7 @@ struct conf_fwlog {
 
         /* Regulates the frequency of log messages */
         u8 threshold;
-};
+} __packed;
 
 #define ACX_RATE_MGMT_NUM_OF_RATES 13
 struct conf_rate_policy_settings {
@@ -1236,7 +1255,7 @@ struct conf_rate_policy_settings {
         u8 rate_check_up;
         u8 rate_check_down;
         u8 rate_retry_policy[ACX_RATE_MGMT_NUM_OF_RATES];
-};
+} __packed;
 
 struct conf_hangover_settings {
         u32 recover_time;
@@ -1250,7 +1269,23 @@ struct conf_hangover_settings {
         u8 quiet_time;
         u8 increase_time;
         u8 window_size;
-};
+} __packed;
+
+/*
+ * The conf version consists of 4 bytes.  The two MSB are the wlcore
+ * version, the two LSB are the lower driver's private conf
+ * version.
+ */
+#define WLCORE_CONF_VERSION     (0x0001 << 16)
+#define WLCORE_CONF_MASK        0xffff0000
+#define WLCORE_CONF_SIZE        (sizeof(struct wlcore_conf_header) +    \
+                                 sizeof(struct wlcore_conf))
+
+struct wlcore_conf_header {
+        __le32 magic;
+        __le32 version;
+        __le32 checksum;
+} __packed;
 
 struct wlcore_conf {
         struct conf_sg_settings sg;
@@ -1269,6 +1304,12 @@ struct wlcore_conf {
         struct conf_fwlog fwlog;
         struct conf_rate_policy_settings rate;
         struct conf_hangover_settings hangover;
-};
+} __packed;
+
+struct wlcore_conf_file {
+        struct wlcore_conf_header header;
+        struct wlcore_conf core;
+        u8 priv[0];
+} __packed;
 
 #endif
diff --git a/drivers/net/wireless/ti/wlcore/debugfs.c b/drivers/net/wireless/ti/wlcore/debugfs.c
index d5aea1ff5ad1..689a847005c9 100644
--- a/drivers/net/wireless/ti/wlcore/debugfs.c
+++ b/drivers/net/wireless/ti/wlcore/debugfs.c
@@ -25,6 +25,7 @@
 
 #include <linux/skbuff.h>
 #include <linux/slab.h>
+#include <linux/module.h>
 
 #include "wlcore.h"
 #include "debug.h"
@@ -32,14 +33,14 @@
 #include "ps.h"
 #include "io.h"
 #include "tx.h"
+#include "hw_ops.h"
 
 /* ms */
 #define WL1271_DEBUGFS_STATS_LIFETIME 1000
 
 /* debugfs macros idea from mac80211 */
-#define DEBUGFS_FORMAT_BUFFER_SIZE 100
-static int wl1271_format_buffer(char __user *userbuf, size_t count,
-                                    loff_t *ppos, char *fmt, ...)
+int wl1271_format_buffer(char __user *userbuf, size_t count,
+                         loff_t *ppos, char *fmt, ...)
 {
         va_list args;
         char buf[DEBUGFS_FORMAT_BUFFER_SIZE];
@@ -51,59 +52,9 @@ static int wl1271_format_buffer(char __user *userbuf, size_t count,
 
         return simple_read_from_buffer(userbuf, count, ppos, buf, res);
 }
+EXPORT_SYMBOL_GPL(wl1271_format_buffer);
 
-#define DEBUGFS_READONLY_FILE(name, fmt, value...)                      \
-static ssize_t name## _read(struct file *file, char __user *userbuf,    \
-                            size_t count, loff_t *ppos)                 \
-{                                                                       \
-        struct wl1271 *wl = file->private_data;                         \
-        return wl1271_format_buffer(userbuf, count, ppos,               \
-                                    fmt "\n", ##value);                 \
-}                                                                       \
-                                                                        \
-static const struct file_operations name## _ops = {                     \
-        .read = name## _read,                                           \
-        .open = simple_open,                                            \
-        .llseek = generic_file_llseek,                                  \
-};
-
-#define DEBUGFS_ADD(name, parent)                                       \
-        entry = debugfs_create_file(#name, 0400, parent,                \
-                                    wl, &name## _ops);                  \
-        if (!entry || IS_ERR(entry))                                    \
-                goto err;                                               \
-
-#define DEBUGFS_ADD_PREFIX(prefix, name, parent)                        \
-        do {                                                            \
-                entry = debugfs_create_file(#name, 0400, parent,        \
-                                    wl, &prefix## _## name## _ops);     \
-                if (!entry || IS_ERR(entry))                            \
-                        goto err;                                       \
-        } while (0);
-
-#define DEBUGFS_FWSTATS_FILE(sub, name, fmt)                            \
-static ssize_t sub## _ ##name## _read(struct file *file,                \
-                                      char __user *userbuf,             \
-                                      size_t count, loff_t *ppos)       \
-{                                                                       \
-        struct wl1271 *wl = file->private_data;                         \
-                                                                        \
-        wl1271_debugfs_update_stats(wl);                                \
-                                                                        \
-        return wl1271_format_buffer(userbuf, count, ppos, fmt "\n",     \
-                                    wl->stats.fw_stats->sub.name);      \
-}                                                                       \
-                                                                        \
-static const struct file_operations sub## _ ##name## _ops = {           \
-        .read = sub## _ ##name## _read,                                 \
-        .open = simple_open,                                            \
-        .llseek = generic_file_llseek,                                  \
-};
-
-#define DEBUGFS_FWSTATS_ADD(sub, name)                          \
-        DEBUGFS_ADD(sub## _ ##name, stats)
-
-static void wl1271_debugfs_update_stats(struct wl1271 *wl)
+void wl1271_debugfs_update_stats(struct wl1271 *wl)
 {
         int ret;
 
@@ -125,97 +76,7 @@ static void wl1271_debugfs_update_stats(struct wl1271 *wl)
 out:
         mutex_unlock(&wl->mutex);
 }
-
-DEBUGFS_FWSTATS_FILE(tx, internal_desc_overflow, "%u");
-
-DEBUGFS_FWSTATS_FILE(rx, out_of_mem, "%u");
-DEBUGFS_FWSTATS_FILE(rx, hdr_overflow, "%u");
-DEBUGFS_FWSTATS_FILE(rx, hw_stuck, "%u");
-DEBUGFS_FWSTATS_FILE(rx, dropped, "%u");
-DEBUGFS_FWSTATS_FILE(rx, fcs_err, "%u");
-DEBUGFS_FWSTATS_FILE(rx, xfr_hint_trig, "%u");
-DEBUGFS_FWSTATS_FILE(rx, path_reset, "%u");
-DEBUGFS_FWSTATS_FILE(rx, reset_counter, "%u");
-
-DEBUGFS_FWSTATS_FILE(dma, rx_requested, "%u");
-DEBUGFS_FWSTATS_FILE(dma, rx_errors, "%u");
-DEBUGFS_FWSTATS_FILE(dma, tx_requested, "%u");
-DEBUGFS_FWSTATS_FILE(dma, tx_errors, "%u");
-
-DEBUGFS_FWSTATS_FILE(isr, cmd_cmplt, "%u");
-DEBUGFS_FWSTATS_FILE(isr, fiqs, "%u");
-DEBUGFS_FWSTATS_FILE(isr, rx_headers, "%u");
-DEBUGFS_FWSTATS_FILE(isr, rx_mem_overflow, "%u");
-DEBUGFS_FWSTATS_FILE(isr, rx_rdys, "%u");
-DEBUGFS_FWSTATS_FILE(isr, irqs, "%u");
-DEBUGFS_FWSTATS_FILE(isr, tx_procs, "%u");
-DEBUGFS_FWSTATS_FILE(isr, decrypt_done, "%u");
-DEBUGFS_FWSTATS_FILE(isr, dma0_done, "%u");
-DEBUGFS_FWSTATS_FILE(isr, dma1_done, "%u");
-DEBUGFS_FWSTATS_FILE(isr, tx_exch_complete, "%u");
-DEBUGFS_FWSTATS_FILE(isr, commands, "%u");
-DEBUGFS_FWSTATS_FILE(isr, rx_procs, "%u");
-DEBUGFS_FWSTATS_FILE(isr, hw_pm_mode_changes, "%u");
-DEBUGFS_FWSTATS_FILE(isr, host_acknowledges, "%u");
-DEBUGFS_FWSTATS_FILE(isr, pci_pm, "%u");
-DEBUGFS_FWSTATS_FILE(isr, wakeups, "%u");
-DEBUGFS_FWSTATS_FILE(isr, low_rssi, "%u");
-
-DEBUGFS_FWSTATS_FILE(wep, addr_key_count, "%u");
-DEBUGFS_FWSTATS_FILE(wep, default_key_count, "%u");
-/* skipping wep.reserved */
-DEBUGFS_FWSTATS_FILE(wep, key_not_found, "%u");
-DEBUGFS_FWSTATS_FILE(wep, decrypt_fail, "%u");
-DEBUGFS_FWSTATS_FILE(wep, packets, "%u");
-DEBUGFS_FWSTATS_FILE(wep, interrupt, "%u");
-
-DEBUGFS_FWSTATS_FILE(pwr, ps_enter, "%u");
-DEBUGFS_FWSTATS_FILE(pwr, elp_enter, "%u");
-DEBUGFS_FWSTATS_FILE(pwr, missing_bcns, "%u");
-DEBUGFS_FWSTATS_FILE(pwr, wake_on_host, "%u");
-DEBUGFS_FWSTATS_FILE(pwr, wake_on_timer_exp, "%u");
-DEBUGFS_FWSTATS_FILE(pwr, tx_with_ps, "%u");
-DEBUGFS_FWSTATS_FILE(pwr, tx_without_ps, "%u");
-DEBUGFS_FWSTATS_FILE(pwr, rcvd_beacons, "%u");
-DEBUGFS_FWSTATS_FILE(pwr, power_save_off, "%u");
-DEBUGFS_FWSTATS_FILE(pwr, enable_ps, "%u");
-DEBUGFS_FWSTATS_FILE(pwr, disable_ps, "%u");
-DEBUGFS_FWSTATS_FILE(pwr, fix_tsf_ps, "%u");
-/* skipping cont_miss_bcns_spread for now */
-DEBUGFS_FWSTATS_FILE(pwr, rcvd_awake_beacons, "%u");
-
-DEBUGFS_FWSTATS_FILE(mic, rx_pkts, "%u");
-DEBUGFS_FWSTATS_FILE(mic, calc_failure, "%u");
-
-DEBUGFS_FWSTATS_FILE(aes, encrypt_fail, "%u");
-DEBUGFS_FWSTATS_FILE(aes, decrypt_fail, "%u");
-DEBUGFS_FWSTATS_FILE(aes, encrypt_packets, "%u");
-DEBUGFS_FWSTATS_FILE(aes, decrypt_packets, "%u");
-DEBUGFS_FWSTATS_FILE(aes, encrypt_interrupt, "%u");
-DEBUGFS_FWSTATS_FILE(aes, decrypt_interrupt, "%u");
-
-DEBUGFS_FWSTATS_FILE(event, heart_beat, "%u");
-DEBUGFS_FWSTATS_FILE(event, calibration, "%u");
-DEBUGFS_FWSTATS_FILE(event, rx_mismatch, "%u");
-DEBUGFS_FWSTATS_FILE(event, rx_mem_empty, "%u");
-DEBUGFS_FWSTATS_FILE(event, rx_pool, "%u");
-DEBUGFS_FWSTATS_FILE(event, oom_late, "%u");
-DEBUGFS_FWSTATS_FILE(event, phy_transmit_error, "%u");
-DEBUGFS_FWSTATS_FILE(event, tx_stuck, "%u");
-
-DEBUGFS_FWSTATS_FILE(ps, pspoll_timeouts, "%u");
-DEBUGFS_FWSTATS_FILE(ps, upsd_timeouts, "%u");
-DEBUGFS_FWSTATS_FILE(ps, upsd_max_sptime, "%u");
-DEBUGFS_FWSTATS_FILE(ps, upsd_max_apturn, "%u");
-DEBUGFS_FWSTATS_FILE(ps, pspoll_max_apturn, "%u");
-DEBUGFS_FWSTATS_FILE(ps, pspoll_utilization, "%u");
-DEBUGFS_FWSTATS_FILE(ps, upsd_utilization, "%u");
-
-DEBUGFS_FWSTATS_FILE(rxpipe, rx_prep_beacon_drop, "%u");
-DEBUGFS_FWSTATS_FILE(rxpipe, descr_host_int_trig_rx_data, "%u");
-DEBUGFS_FWSTATS_FILE(rxpipe, beacon_buffer_thres_host_int_trig_rx_data, "%u");
-DEBUGFS_FWSTATS_FILE(rxpipe, missed_beacon_host_int_trig_rx_data, "%u");
-DEBUGFS_FWSTATS_FILE(rxpipe, tx_xfr_host_int_trig_rx_data, "%u");
+EXPORT_SYMBOL_GPL(wl1271_debugfs_update_stats);
 
 DEBUGFS_READONLY_FILE(retry_count, "%u", wl->stats.retry_count);
 DEBUGFS_READONLY_FILE(excessive_retries, "%u",
@@ -241,6 +102,89 @@ static const struct file_operations tx_queue_len_ops = {
         .llseek = default_llseek,
 };
 
+static void chip_op_handler(struct wl1271 *wl, unsigned long value,
+                            void *arg)
+{
+        int ret;
+        int (*chip_op) (struct wl1271 *wl);
+
+        if (!arg) {
+                wl1271_warning("debugfs chip_op_handler with no callback");
+                return;
+        }
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                return;
+
+        chip_op = arg;
+        chip_op(wl);
+
+        wl1271_ps_elp_sleep(wl);
+}
+
+
+static inline void no_write_handler(struct wl1271 *wl,
+                                    unsigned long value,
+                                    unsigned long param)
+{
+}
+
+#define WL12XX_CONF_DEBUGFS(param, conf_sub_struct,                     \
+                            min_val, max_val, write_handler_locked,     \
+                            write_handler_arg)                          \
+        static ssize_t param##_read(struct file *file,                  \
+                                      char __user *user_buf,            \
+                                      size_t count, loff_t *ppos)       \
+        {                                                               \
+        struct wl1271 *wl = file->private_data;                         \
+        return wl1271_format_buffer(user_buf, count,                    \
+                                    ppos, "%d\n",                       \
+                                    wl->conf.conf_sub_struct.param);    \
+        }                                                               \
+                                                                        \
+        static ssize_t param##_write(struct file *file,                 \
+                                     const char __user *user_buf,       \
+                                     size_t count, loff_t *ppos)        \
+        {                                                               \
+        struct wl1271 *wl = file->private_data;                         \
+        unsigned long value;                                            \
+        int ret;                                                        \
+                                                                        \
+        ret = kstrtoul_from_user(user_buf, count, 10, &value);          \
+        if (ret < 0) {                                                  \
+                wl1271_warning("illegal value for " #param);            \
+                return -EINVAL;                                         \
+        }                                                               \
+                                                                        \
+        if (value < min_val || value > max_val) {                       \
+                wl1271_warning(#param " is not in valid range");        \
+                return -ERANGE;                                         \
+        }                                                               \
+                                                                        \
+        mutex_lock(&wl->mutex);                                         \
+        wl->conf.conf_sub_struct.param = value;                         \
+                                                                        \
+        write_handler_locked(wl, value, write_handler_arg);             \
+                                                                        \
+        mutex_unlock(&wl->mutex);                                       \
+        return count;                                                   \
+        }                                                               \
+                                                                        \
+        static const struct file_operations param##_ops = {             \
+                .read = param##_read,                                   \
+                .write = param##_write,                                 \
+                .open = simple_open,                                    \
+                .llseek = default_llseek,                               \
+        };
+
+WL12XX_CONF_DEBUGFS(irq_pkt_threshold, rx, 0, 65535,
+                    chip_op_handler, wl1271_acx_init_rx_interrupt)
+WL12XX_CONF_DEBUGFS(irq_blk_threshold, rx, 0, 65535,
+                    chip_op_handler, wl1271_acx_init_rx_interrupt)
+WL12XX_CONF_DEBUGFS(irq_timeout, rx, 0, 100,
+                    chip_op_handler, wl1271_acx_init_rx_interrupt)
+
 static ssize_t gpio_power_read(struct file *file, char __user *user_buf,
                           size_t count, loff_t *ppos)
 {
@@ -535,8 +479,7 @@ static ssize_t driver_state_read(struct file *file, char __user *user_buf,
         DRIVER_STATE_PRINT_LHEX(ap_ps_map);
         DRIVER_STATE_PRINT_HEX(quirks);
         DRIVER_STATE_PRINT_HEX(irq);
-        DRIVER_STATE_PRINT_HEX(ref_clock);
-        DRIVER_STATE_PRINT_HEX(tcxo_clock);
+        /* TODO: ref_clock and tcxo_clock were moved to wl12xx priv */
         DRIVER_STATE_PRINT_HEX(hw_pg_ver);
         DRIVER_STATE_PRINT_HEX(platform_quirks);
         DRIVER_STATE_PRINT_HEX(chip.id);
@@ -647,7 +590,6 @@ static ssize_t vifs_state_read(struct file *file, char __user *user_buf,
                 VIF_STATE_PRINT_INT(last_rssi_event);
                 VIF_STATE_PRINT_INT(ba_support);
                 VIF_STATE_PRINT_INT(ba_allowed);
-                VIF_STATE_PRINT_INT(is_gem);
                 VIF_STATE_PRINT_LLHEX(tx_security_seq);
                 VIF_STATE_PRINT_INT(tx_security_last_seq_lsb);
         }
@@ -1002,108 +944,30 @@ static const struct file_operations beacon_filtering_ops = {
         .llseek = default_llseek,
 };
 
-static int wl1271_debugfs_add_files(struct wl1271 *wl,
-                                     struct dentry *rootdir)
+static ssize_t fw_stats_raw_read(struct file *file,
+                                 char __user *userbuf,
+                                 size_t count, loff_t *ppos)
 {
-        int ret = 0;
-        struct dentry *entry, *stats, *streaming;
+        struct wl1271 *wl = file->private_data;
 
-        stats = debugfs_create_dir("fw-statistics", rootdir);
-        if (!stats || IS_ERR(stats)) {
-                entry = stats;
-                goto err;
-        }
+        wl1271_debugfs_update_stats(wl);
 
-        DEBUGFS_FWSTATS_ADD(tx, internal_desc_overflow);
-
-        DEBUGFS_FWSTATS_ADD(rx, out_of_mem);
-        DEBUGFS_FWSTATS_ADD(rx, hdr_overflow);
-        DEBUGFS_FWSTATS_ADD(rx, hw_stuck);
-        DEBUGFS_FWSTATS_ADD(rx, dropped);
-        DEBUGFS_FWSTATS_ADD(rx, fcs_err);
-        DEBUGFS_FWSTATS_ADD(rx, xfr_hint_trig);
-        DEBUGFS_FWSTATS_ADD(rx, path_reset);
-        DEBUGFS_FWSTATS_ADD(rx, reset_counter);
-
-        DEBUGFS_FWSTATS_ADD(dma, rx_requested);
-        DEBUGFS_FWSTATS_ADD(dma, rx_errors);
-        DEBUGFS_FWSTATS_ADD(dma, tx_requested);
-        DEBUGFS_FWSTATS_ADD(dma, tx_errors);
-
-        DEBUGFS_FWSTATS_ADD(isr, cmd_cmplt);
-        DEBUGFS_FWSTATS_ADD(isr, fiqs);
-        DEBUGFS_FWSTATS_ADD(isr, rx_headers);
-        DEBUGFS_FWSTATS_ADD(isr, rx_mem_overflow);
-        DEBUGFS_FWSTATS_ADD(isr, rx_rdys);
-        DEBUGFS_FWSTATS_ADD(isr, irqs);
-        DEBUGFS_FWSTATS_ADD(isr, tx_procs);
-        DEBUGFS_FWSTATS_ADD(isr, decrypt_done);
-        DEBUGFS_FWSTATS_ADD(isr, dma0_done);
-        DEBUGFS_FWSTATS_ADD(isr, dma1_done);
-        DEBUGFS_FWSTATS_ADD(isr, tx_exch_complete);
-        DEBUGFS_FWSTATS_ADD(isr, commands);
-        DEBUGFS_FWSTATS_ADD(isr, rx_procs);
-        DEBUGFS_FWSTATS_ADD(isr, hw_pm_mode_changes);
-        DEBUGFS_FWSTATS_ADD(isr, host_acknowledges);
-        DEBUGFS_FWSTATS_ADD(isr, pci_pm);
-        DEBUGFS_FWSTATS_ADD(isr, wakeups);
-        DEBUGFS_FWSTATS_ADD(isr, low_rssi);
-
-        DEBUGFS_FWSTATS_ADD(wep, addr_key_count);
-        DEBUGFS_FWSTATS_ADD(wep, default_key_count);
-        /* skipping wep.reserved */
-        DEBUGFS_FWSTATS_ADD(wep, key_not_found);
-        DEBUGFS_FWSTATS_ADD(wep, decrypt_fail);
-        DEBUGFS_FWSTATS_ADD(wep, packets);
-        DEBUGFS_FWSTATS_ADD(wep, interrupt);
-
-        DEBUGFS_FWSTATS_ADD(pwr, ps_enter);
-        DEBUGFS_FWSTATS_ADD(pwr, elp_enter);
-        DEBUGFS_FWSTATS_ADD(pwr, missing_bcns);
-        DEBUGFS_FWSTATS_ADD(pwr, wake_on_host);
-        DEBUGFS_FWSTATS_ADD(pwr, wake_on_timer_exp);
-        DEBUGFS_FWSTATS_ADD(pwr, tx_with_ps);
-        DEBUGFS_FWSTATS_ADD(pwr, tx_without_ps);
-        DEBUGFS_FWSTATS_ADD(pwr, rcvd_beacons);
-        DEBUGFS_FWSTATS_ADD(pwr, power_save_off);
-        DEBUGFS_FWSTATS_ADD(pwr, enable_ps);
-        DEBUGFS_FWSTATS_ADD(pwr, disable_ps);
-        DEBUGFS_FWSTATS_ADD(pwr, fix_tsf_ps);
-        /* skipping cont_miss_bcns_spread for now */
-        DEBUGFS_FWSTATS_ADD(pwr, rcvd_awake_beacons);
-
-        DEBUGFS_FWSTATS_ADD(mic, rx_pkts);
-        DEBUGFS_FWSTATS_ADD(mic, calc_failure);
-
-        DEBUGFS_FWSTATS_ADD(aes, encrypt_fail);
-        DEBUGFS_FWSTATS_ADD(aes, decrypt_fail);
-        DEBUGFS_FWSTATS_ADD(aes, encrypt_packets);
-        DEBUGFS_FWSTATS_ADD(aes, decrypt_packets);
-        DEBUGFS_FWSTATS_ADD(aes, encrypt_interrupt);
-        DEBUGFS_FWSTATS_ADD(aes, decrypt_interrupt);
-
-        DEBUGFS_FWSTATS_ADD(event, heart_beat);
-        DEBUGFS_FWSTATS_ADD(event, calibration);
-        DEBUGFS_FWSTATS_ADD(event, rx_mismatch);
-        DEBUGFS_FWSTATS_ADD(event, rx_mem_empty);
-        DEBUGFS_FWSTATS_ADD(event, rx_pool);
-        DEBUGFS_FWSTATS_ADD(event, oom_late);
-        DEBUGFS_FWSTATS_ADD(event, phy_transmit_error);
-        DEBUGFS_FWSTATS_ADD(event, tx_stuck);
-
-        DEBUGFS_FWSTATS_ADD(ps, pspoll_timeouts);
-        DEBUGFS_FWSTATS_ADD(ps, upsd_timeouts);
-        DEBUGFS_FWSTATS_ADD(ps, upsd_max_sptime);
-        DEBUGFS_FWSTATS_ADD(ps, upsd_max_apturn);
-        DEBUGFS_FWSTATS_ADD(ps, pspoll_max_apturn);
-        DEBUGFS_FWSTATS_ADD(ps, pspoll_utilization);
-        DEBUGFS_FWSTATS_ADD(ps, upsd_utilization);
-
-        DEBUGFS_FWSTATS_ADD(rxpipe, rx_prep_beacon_drop);
-        DEBUGFS_FWSTATS_ADD(rxpipe, descr_host_int_trig_rx_data);
-        DEBUGFS_FWSTATS_ADD(rxpipe, beacon_buffer_thres_host_int_trig_rx_data);
-        DEBUGFS_FWSTATS_ADD(rxpipe, missed_beacon_host_int_trig_rx_data);
-        DEBUGFS_FWSTATS_ADD(rxpipe, tx_xfr_host_int_trig_rx_data);
+        return simple_read_from_buffer(userbuf, count, ppos,
+                                       wl->stats.fw_stats,
+                                       wl->stats.fw_stats_len);
+}
+
+static const struct file_operations fw_stats_raw_ops = {
+        .read = fw_stats_raw_read,
+        .open = simple_open,
+        .llseek = default_llseek,
+};
+
+static int wl1271_debugfs_add_files(struct wl1271 *wl,
+                                    struct dentry *rootdir)
+{
+        int ret = 0;
+        struct dentry *entry, *streaming;
 
         DEBUGFS_ADD(tx_queue_len, rootdir);
         DEBUGFS_ADD(retry_count, rootdir);
@@ -1120,6 +984,10 @@ static int wl1271_debugfs_add_files(struct wl1271 *wl,
         DEBUGFS_ADD(dynamic_ps_timeout, rootdir);
         DEBUGFS_ADD(forced_ps, rootdir);
         DEBUGFS_ADD(split_scan_timeout, rootdir);
+        DEBUGFS_ADD(irq_pkt_threshold, rootdir);
+        DEBUGFS_ADD(irq_blk_threshold, rootdir);
+        DEBUGFS_ADD(irq_timeout, rootdir);
+        DEBUGFS_ADD(fw_stats_raw, rootdir);
 
         streaming = debugfs_create_dir("rx_streaming", rootdir);
         if (!streaming || IS_ERR(streaming))
@@ -1145,7 +1013,7 @@ void wl1271_debugfs_reset(struct wl1271 *wl)
         if (!wl->stats.fw_stats)
                 return;
 
-        memset(wl->stats.fw_stats, 0, sizeof(*wl->stats.fw_stats));
+        memset(wl->stats.fw_stats, 0, wl->stats.fw_stats_len);
         wl->stats.retry_count = 0;
         wl->stats.excessive_retries = 0;
 }
@@ -1160,34 +1028,34 @@ int wl1271_debugfs_init(struct wl1271 *wl)
 
         if (IS_ERR(rootdir)) {
                 ret = PTR_ERR(rootdir);
-                goto err;
+                goto out;
         }
 
-        wl->stats.fw_stats = kzalloc(sizeof(*wl->stats.fw_stats),
-                                      GFP_KERNEL);
-
+        wl->stats.fw_stats = kzalloc(wl->stats.fw_stats_len, GFP_KERNEL);
         if (!wl->stats.fw_stats) {
                 ret = -ENOMEM;
-                goto err_fw;
+                goto out_remove;
         }
 
         wl->stats.fw_stats_update = jiffies;
 
         ret = wl1271_debugfs_add_files(wl, rootdir);
+        if (ret < 0)
+                goto out_exit;
 
+        ret = wlcore_debugfs_init(wl, rootdir);
         if (ret < 0)
-                goto err_file;
+                goto out_exit;
 
-        return 0;
+        goto out;
 
-err_file:
-        kfree(wl->stats.fw_stats);
-        wl->stats.fw_stats = NULL;
+out_exit:
+        wl1271_debugfs_exit(wl);
 
-err_fw:
+out_remove:
         debugfs_remove_recursive(rootdir);
 
-err:
+out:
         return ret;
 }
 
diff --git a/drivers/net/wireless/ti/wlcore/debugfs.h b/drivers/net/wireless/ti/wlcore/debugfs.h
index a8d3aef011ff..f7381dd69009 100644
--- a/drivers/net/wireless/ti/wlcore/debugfs.h
+++ b/drivers/net/wireless/ti/wlcore/debugfs.h
@@ -26,8 +26,95 @@
 
 #include "wlcore.h"
 
+int wl1271_format_buffer(char __user *userbuf, size_t count,
+                         loff_t *ppos, char *fmt, ...);
+
 int wl1271_debugfs_init(struct wl1271 *wl);
 void wl1271_debugfs_exit(struct wl1271 *wl);
 void wl1271_debugfs_reset(struct wl1271 *wl);
+void wl1271_debugfs_update_stats(struct wl1271 *wl);
+
+#define DEBUGFS_FORMAT_BUFFER_SIZE 256
+
+#define DEBUGFS_READONLY_FILE(name, fmt, value...)                      \
+static ssize_t name## _read(struct file *file, char __user *userbuf,    \
+                            size_t count, loff_t *ppos)                 \
+{                                                                       \
+        struct wl1271 *wl = file->private_data;                         \
+        return wl1271_format_buffer(userbuf, count, ppos,               \
+                                    fmt "\n", ##value);                 \
+}                                                                       \
+                                                                        \
+static const struct file_operations name## _ops = {                     \
+        .read = name## _read,                                           \
+        .open = simple_open,                                            \
+        .llseek = generic_file_llseek,                                  \
+};
+
+#define DEBUGFS_ADD(name, parent)                                       \
+        do {                                                            \
+                entry = debugfs_create_file(#name, 0400, parent,        \
+                                            wl, &name## _ops);          \
+                if (!entry || IS_ERR(entry))                            \
+                        goto err;                                       \
+        } while (0);
+
+
+#define DEBUGFS_ADD_PREFIX(prefix, name, parent)                        \
+        do {                                                            \
+                entry = debugfs_create_file(#name, 0400, parent,        \
+                                    wl, &prefix## _## name## _ops);     \
+                if (!entry || IS_ERR(entry))                            \
+                        goto err;                                       \
+        } while (0);
+
+#define DEBUGFS_FWSTATS_FILE(sub, name, fmt, struct_type)               \
+static ssize_t sub## _ ##name## _read(struct file *file,                \
+                                      char __user *userbuf,             \
+                                      size_t count, loff_t *ppos)       \
+{                                                                       \
+        struct wl1271 *wl = file->private_data;                         \
+        struct struct_type *stats = wl->stats.fw_stats;                 \
+                                                                        \
+        wl1271_debugfs_update_stats(wl);                                \
+                                                                        \
+        return wl1271_format_buffer(userbuf, count, ppos, fmt "\n",     \
+                                    stats->sub.name);                   \
+}                                                                       \
+                                                                        \
+static const struct file_operations sub## _ ##name## _ops = {           \
+        .read = sub## _ ##name## _read,                                 \
+        .open = simple_open,                                            \
+        .llseek = generic_file_llseek,                                  \
+};
+
+#define DEBUGFS_FWSTATS_FILE_ARRAY(sub, name, len, struct_type)         \
+static ssize_t sub## _ ##name## _read(struct file *file,                \
+                                      char __user *userbuf,             \
+                                      size_t count, loff_t *ppos)       \
+{                                                                       \
+        struct wl1271 *wl = file->private_data;                         \
+        struct struct_type *stats = wl->stats.fw_stats;                 \
+        char buf[DEBUGFS_FORMAT_BUFFER_SIZE] = "";                      \
+        int res, i;                                                     \
+                                                                        \
+        wl1271_debugfs_update_stats(wl);                                \
+                                                                        \
+        for (i = 0; i < len; i++)                                       \
+                res = snprintf(buf, sizeof(buf), "%s[%d] = %d\n",       \
+                               buf, i, stats->sub.name[i]);             \
+                                                                        \
+        return wl1271_format_buffer(userbuf, count, ppos, "%s", buf);   \
+}                                                                       \
+                                                                        \
+static const struct file_operations sub## _ ##name## _ops = {           \
+        .read = sub## _ ##name## _read,                                 \
+        .open = simple_open,                                            \
+        .llseek = generic_file_llseek,                                  \
+};
+
+#define DEBUGFS_FWSTATS_ADD(sub, name)                                  \
+        DEBUGFS_ADD(sub## _ ##name, stats)
+
 
 #endif /* WL1271_DEBUGFS_H */
diff --git a/drivers/net/wireless/ti/wlcore/event.c b/drivers/net/wireless/ti/wlcore/event.c
index 28e2a633c3be..c976f0409865 100644
--- a/drivers/net/wireless/ti/wlcore/event.c
+++ b/drivers/net/wireless/ti/wlcore/event.c
@@ -148,15 +148,33 @@ static int wl1271_event_process(struct wl1271 *wl)
                 int delay = wl->conf.conn.synch_fail_thold *
                                         wl->conf.conn.bss_lose_timeout;
                 wl1271_info("Beacon loss detected.");
-                cancel_delayed_work_sync(&wl->connection_loss_work);
+
+                /*
+                 * if the work is already queued, it should take place. We
+                 * don't want to delay the connection loss indication
+                 * any more.
+                 */
                 ieee80211_queue_delayed_work(wl->hw, &wl->connection_loss_work,
-                      msecs_to_jiffies(delay));
+                                             msecs_to_jiffies(delay));
+
+                wl12xx_for_each_wlvif_sta(wl, wlvif) {
+                        vif = wl12xx_wlvif_to_vif(wlvif);
+
+                        ieee80211_cqm_rssi_notify(
+                                        vif,
+                                        NL80211_CQM_RSSI_BEACON_LOSS_EVENT,
+                                        GFP_KERNEL);
+                }
         }
 
         if (vector & REGAINED_BSS_EVENT_ID) {
                 /* TODO: check for multi-role */
                 wl1271_info("Beacon regained.");
-                cancel_delayed_work_sync(&wl->connection_loss_work);
+                cancel_delayed_work(&wl->connection_loss_work);
+
+                /* sanity check - we can't lose and gain the beacon together */
+                WARN(vector & BSS_LOSE_EVENT_ID,
+                     "Concurrent beacon loss and gain from FW");
         }
 
         if (vector & RSSI_SNR_TRIGGER_0_EVENT_ID) {
diff --git a/drivers/net/wireless/ti/wlcore/hw_ops.h b/drivers/net/wireless/ti/wlcore/hw_ops.h
index 9384b4d56c24..9e7787ba9610 100644
--- a/drivers/net/wireless/ti/wlcore/hw_ops.h
+++ b/drivers/net/wireless/ti/wlcore/hw_ops.h
@@ -119,4 +119,82 @@ static inline int wlcore_identify_fw(struct wl1271 *wl)
         return 0;
 }
 
+static inline void
+wlcore_hw_set_tx_desc_csum(struct wl1271 *wl,
+                           struct wl1271_tx_hw_descr *desc,
+                           struct sk_buff *skb)
+{
+        if (!wl->ops->set_tx_desc_csum)
+                BUG_ON(1);
+
+        wl->ops->set_tx_desc_csum(wl, desc, skb);
+}
+
+static inline void
+wlcore_hw_set_rx_csum(struct wl1271 *wl,
+                      struct wl1271_rx_descriptor *desc,
+                      struct sk_buff *skb)
+{
+        if (wl->ops->set_rx_csum)
+                wl->ops->set_rx_csum(wl, desc, skb);
+}
+
+static inline u32
+wlcore_hw_ap_get_mimo_wide_rate_mask(struct wl1271 *wl,
+                                     struct wl12xx_vif *wlvif)
+{
+        if (wl->ops->ap_get_mimo_wide_rate_mask)
+                return wl->ops->ap_get_mimo_wide_rate_mask(wl, wlvif);
+
+        return 0;
+}
+
+static inline int
+wlcore_debugfs_init(struct wl1271 *wl, struct dentry *rootdir)
+{
+        if (wl->ops->debugfs_init)
+                return wl->ops->debugfs_init(wl, rootdir);
+
+        return 0;
+}
+
+static inline int
+wlcore_handle_static_data(struct wl1271 *wl, void *static_data)
+{
+        if (wl->ops->handle_static_data)
+                return wl->ops->handle_static_data(wl, static_data);
+
+        return 0;
+}
+
+static inline int
+wlcore_hw_get_spare_blocks(struct wl1271 *wl, bool is_gem)
+{
+        if (!wl->ops->get_spare_blocks)
+                BUG_ON(1);
+
+        return wl->ops->get_spare_blocks(wl, is_gem);
+}
+
+static inline int
+wlcore_hw_set_key(struct wl1271 *wl, enum set_key_cmd cmd,
+                  struct ieee80211_vif *vif,
+                  struct ieee80211_sta *sta,
+                  struct ieee80211_key_conf *key_conf)
+{
+        if (!wl->ops->set_key)
+                BUG_ON(1);
+
+        return wl->ops->set_key(wl, cmd, vif, sta, key_conf);
+}
+
+static inline u32
+wlcore_hw_pre_pkt_send(struct wl1271 *wl, u32 buf_offset, u32 last_len)
+{
+        if (wl->ops->pre_pkt_send)
+                return wl->ops->pre_pkt_send(wl, buf_offset, last_len);
+
+        return buf_offset;
+}
+
 #endif
diff --git a/drivers/net/wireless/ti/wlcore/init.c b/drivers/net/wireless/ti/wlcore/init.c
index 9f89255eb6e6..645abd4b660d 100644
--- a/drivers/net/wireless/ti/wlcore/init.c
+++ b/drivers/net/wireless/ti/wlcore/init.c
@@ -460,6 +460,9 @@ int wl1271_init_ap_rates(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         /* unconditionally enable HT rates */
         supported_rates |= CONF_TX_MCS_RATES;
 
+        /* get extra MIMO or wide-chan rates where the HW supports it */
+        supported_rates |= wlcore_hw_ap_get_mimo_wide_rate_mask(wl, wlvif);
+
         /* configure unicast TX rate classes */
         for (i = 0; i < wl->conf.tx.ac_conf_count; i++) {
                 rc.enabled_rates = supported_rates;
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index acef93390d3d..1156e3f578c1 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -320,46 +320,6 @@ static void wlcore_adjust_conf(struct wl1271 *wl)
         }
 }
 
-static int wl1271_plt_init(struct wl1271 *wl)
-{
-        int ret;
-
-        ret = wl->ops->hw_init(wl);
-        if (ret < 0)
-                return ret;
-
-        ret = wl1271_acx_init_mem_config(wl);
-        if (ret < 0)
-                return ret;
-
-        ret = wl12xx_acx_mem_cfg(wl);
-        if (ret < 0)
-                goto out_free_memmap;
-
-        /* Enable data path */
-        ret = wl1271_cmd_data_path(wl, 1);
-        if (ret < 0)
-                goto out_free_memmap;
-
-        /* Configure for CAM power saving (ie. always active) */
-        ret = wl1271_acx_sleep_auth(wl, WL1271_PSM_CAM);
-        if (ret < 0)
-                goto out_free_memmap;
-
-        /* configure PM */
-        ret = wl1271_acx_pm_config(wl);
-        if (ret < 0)
-                goto out_free_memmap;
-
-        return 0;
-
- out_free_memmap:
-        kfree(wl->target_mem_map);
-        wl->target_mem_map = NULL;
-
-        return ret;
-}
-
 static void wl12xx_irq_ps_regulate_link(struct wl1271 *wl,
                                         struct wl12xx_vif *wlvif,
                                         u8 hlid, u8 tx_pkts)
@@ -387,7 +347,7 @@ static void wl12xx_irq_ps_regulate_link(struct wl1271 *wl,
 
 static void wl12xx_irq_update_links_status(struct wl1271 *wl,
                                            struct wl12xx_vif *wlvif,
-                                           struct wl_fw_status *status)
+                                           struct wl_fw_status_2 *status)
 {
         struct wl1271_link *lnk;
         u32 cur_fw_ps_map;
@@ -419,7 +379,8 @@ static void wl12xx_irq_update_links_status(struct wl1271 *wl,
 }
 
 static void wl12xx_fw_status(struct wl1271 *wl,
-                             struct wl_fw_status *status)
+                             struct wl_fw_status_1 *status_1,
+                             struct wl_fw_status_2 *status_2)
 {
         struct wl12xx_vif *wlvif;
         struct timespec ts;
@@ -428,37 +389,38 @@ static void wl12xx_fw_status(struct wl1271 *wl,
         int i;
         size_t status_len;
 
-        status_len = sizeof(*status) + wl->fw_status_priv_len;
+        status_len = WLCORE_FW_STATUS_1_LEN(wl->num_rx_desc) +
+                sizeof(*status_2) + wl->fw_status_priv_len;
 
-        wlcore_raw_read_data(wl, REG_RAW_FW_STATUS_ADDR, status,
+        wlcore_raw_read_data(wl, REG_RAW_FW_STATUS_ADDR, status_1,
                              status_len, false);
 
         wl1271_debug(DEBUG_IRQ, "intr: 0x%x (fw_rx_counter = %d, "
                      "drv_rx_counter = %d, tx_results_counter = %d)",
-                     status->intr,
-                     status->fw_rx_counter,
-                     status->drv_rx_counter,
-                     status->tx_results_counter);
+                     status_1->intr,
+                     status_1->fw_rx_counter,
+                     status_1->drv_rx_counter,
+                     status_1->tx_results_counter);
 
         for (i = 0; i < NUM_TX_QUEUES; i++) {
                 /* prevent wrap-around in freed-packets counter */
                 wl->tx_allocated_pkts[i] -=
-                                (status->counters.tx_released_pkts[i] -
+                                (status_2->counters.tx_released_pkts[i] -
                                 wl->tx_pkts_freed[i]) & 0xff;
 
-                wl->tx_pkts_freed[i] = status->counters.tx_released_pkts[i];
+                wl->tx_pkts_freed[i] = status_2->counters.tx_released_pkts[i];
         }
 
         /* prevent wrap-around in total blocks counter */
         if (likely(wl->tx_blocks_freed <=
-                   le32_to_cpu(status->total_released_blks)))
-                freed_blocks = le32_to_cpu(status->total_released_blks) -
+                   le32_to_cpu(status_2->total_released_blks)))
+                freed_blocks = le32_to_cpu(status_2->total_released_blks) -
                                wl->tx_blocks_freed;
         else
                 freed_blocks = 0x100000000LL - wl->tx_blocks_freed +
-                               le32_to_cpu(status->total_released_blks);
+                               le32_to_cpu(status_2->total_released_blks);
 
-        wl->tx_blocks_freed = le32_to_cpu(status->total_released_blks);
+        wl->tx_blocks_freed = le32_to_cpu(status_2->total_released_blks);
 
         wl->tx_allocated_blocks -= freed_blocks;
 
@@ -474,7 +436,7 @@ static void wl12xx_fw_status(struct wl1271 *wl,
                         cancel_delayed_work(&wl->tx_watchdog_work);
         }
 
-        avail = le32_to_cpu(status->tx_total) - wl->tx_allocated_blocks;
+        avail = le32_to_cpu(status_2->tx_total) - wl->tx_allocated_blocks;
 
         /*
          * The FW might change the total number of TX memblocks before
@@ -493,13 +455,13 @@ static void wl12xx_fw_status(struct wl1271 *wl,
 
         /* for AP update num of allocated TX blocks per link and ps status */
         wl12xx_for_each_wlvif_ap(wl, wlvif) {
-                wl12xx_irq_update_links_status(wl, wlvif, status);
+                wl12xx_irq_update_links_status(wl, wlvif, status_2);
         }
 
         /* update the host-chipset time offset */
         getnstimeofday(&ts);
         wl->time_offset = (timespec_to_ns(&ts) >> 10) -
-                (s64)le32_to_cpu(status->fw_localtime);
+                (s64)le32_to_cpu(status_2->fw_localtime);
 }
 
 static void wl1271_flush_deferred_work(struct wl1271 *wl)
@@ -568,20 +530,30 @@ static irqreturn_t wl1271_irq(int irq, void *cookie)
                 clear_bit(WL1271_FLAG_IRQ_RUNNING, &wl->flags);
                 smp_mb__after_clear_bit();
 
-                wl12xx_fw_status(wl, wl->fw_status);
+                wl12xx_fw_status(wl, wl->fw_status_1, wl->fw_status_2);
 
                 wlcore_hw_tx_immediate_compl(wl);
 
-                intr = le32_to_cpu(wl->fw_status->intr);
-                intr &= WL1271_INTR_MASK;
+                intr = le32_to_cpu(wl->fw_status_1->intr);
+                intr &= WLCORE_ALL_INTR_MASK;
                 if (!intr) {
                         done = true;
                         continue;
                 }
 
                 if (unlikely(intr & WL1271_ACX_INTR_WATCHDOG)) {
-                        wl1271_error("watchdog interrupt received! "
+                        wl1271_error("HW watchdog interrupt received! starting recovery.");
+                        wl->watchdog_recovery = true;
+                        wl12xx_queue_recovery_work(wl);
+
+                        /* restarting the chip. ignore any other interrupt. */
+                        goto out;
+                }
+
+                if (unlikely(intr & WL1271_ACX_SW_INTR_WATCHDOG)) {
+                        wl1271_error("SW watchdog interrupt received! "
                                      "starting recovery.");
+                        wl->watchdog_recovery = true;
                         wl12xx_queue_recovery_work(wl);
 
                         /* restarting the chip. ignore any other interrupt. */
@@ -591,7 +563,7 @@ static irqreturn_t wl1271_irq(int irq, void *cookie)
                 if (likely(intr & WL1271_ACX_INTR_DATA)) {
                         wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_DATA");
 
-                        wl12xx_rx(wl, wl->fw_status);
+                        wl12xx_rx(wl, wl->fw_status_1);
 
                         /* Check if any tx blocks were freed */
                         spin_lock_irqsave(&wl->wl_lock, flags);
@@ -743,7 +715,7 @@ out:
         return ret;
 }
 
-static int wl1271_fetch_nvs(struct wl1271 *wl)
+static void wl1271_fetch_nvs(struct wl1271 *wl)
 {
         const struct firmware *fw;
         int ret;
@@ -751,16 +723,15 @@ static int wl1271_fetch_nvs(struct wl1271 *wl)
         ret = request_firmware(&fw, WL12XX_NVS_NAME, wl->dev);
 
         if (ret < 0) {
-                wl1271_error("could not get nvs file %s: %d", WL12XX_NVS_NAME,
-                             ret);
-                return ret;
+                wl1271_debug(DEBUG_BOOT, "could not get nvs file %s: %d",
+                             WL12XX_NVS_NAME, ret);
+                return;
         }
 
         wl->nvs = kmemdup(fw->data, fw->size, GFP_KERNEL);
 
         if (!wl->nvs) {
                 wl1271_error("could not allocate memory for the nvs file");
-                ret = -ENOMEM;
                 goto out;
         }
 
@@ -768,8 +739,6 @@ static int wl1271_fetch_nvs(struct wl1271 *wl)
 
 out:
         release_firmware(fw);
-
-        return ret;
 }
 
 void wl12xx_queue_recovery_work(struct wl1271 *wl)
@@ -820,14 +789,16 @@ static void wl12xx_read_fwlog_panic(struct wl1271 *wl)
 
         /*
          * Make sure the chip is awake and the logger isn't active.
-         * This might fail if the firmware hanged.
+         * Do not send a stop fwlog command if the fw is hanged.
          */
-        if (!wl1271_ps_elp_wakeup(wl))
+        if (!wl1271_ps_elp_wakeup(wl) && !wl->watchdog_recovery)
                 wl12xx_cmd_stop_fwlog(wl);
+        else
+                goto out;
 
         /* Read the first memory block address */
-        wl12xx_fw_status(wl, wl->fw_status);
-        first_addr = le32_to_cpu(wl->fw_status->log_start_addr);
+        wl12xx_fw_status(wl, wl->fw_status_1, wl->fw_status_2);
+        first_addr = le32_to_cpu(wl->fw_status_2->log_start_addr);
         if (!first_addr)
                 goto out;
 
@@ -872,9 +843,14 @@ static void wl1271_recovery_work(struct work_struct *work)
 
         wl12xx_read_fwlog_panic(wl);
 
-        wl1271_info("Hardware recovery in progress. FW ver: %s pc: 0x%x",
+        /* change partitions momentarily so we can read the FW pc */
+        wlcore_set_partition(wl, &wl->ptable[PART_BOOT]);
+        wl1271_info("Hardware recovery in progress. FW ver: %s pc: 0x%x "
+                    "hint_sts: 0x%08x",
                     wl->chip.fw_ver_str,
-                    wlcore_read_reg(wl, REG_PC_ON_RECOVERY));
+                    wlcore_read_reg(wl, REG_PC_ON_RECOVERY),
+                    wlcore_read_reg(wl, REG_INTERRUPT_NO_CLEAR));
+        wlcore_set_partition(wl, &wl->ptable[PART_WORK]);
 
         BUG_ON(bug_on_recovery &&
                !test_bit(WL1271_FLAG_INTENDED_FW_RECOVERY, &wl->flags));
@@ -885,8 +861,6 @@ static void wl1271_recovery_work(struct work_struct *work)
                 goto out_unlock;
         }
 
-        BUG_ON(bug_on_recovery);
-
         /*
          * Advance security sequence number to overcome potential progress
          * in the firmware during recovery. This doens't hurt if the network is
@@ -900,7 +874,7 @@ static void wl1271_recovery_work(struct work_struct *work)
         }
 
         /* Prevent spurious TX during FW restart */
-        ieee80211_stop_queues(wl->hw);
+        wlcore_stop_queues(wl, WLCORE_QUEUE_STOP_REASON_FW_RESTART);
 
         if (wl->sched_scanning) {
                 ieee80211_sched_scan_stopped(wl->hw);
@@ -914,6 +888,7 @@ static void wl1271_recovery_work(struct work_struct *work)
                 vif = wl12xx_wlvif_to_vif(wlvif);
                 __wl1271_op_remove_interface(wl, vif, false);
         }
+        wl->watchdog_recovery = false;
         mutex_unlock(&wl->mutex);
         wl1271_op_stop(wl->hw);
 
@@ -925,9 +900,10 @@ static void wl1271_recovery_work(struct work_struct *work)
          * Its safe to enable TX now - the queues are stopped after a request
          * to restart the HW.
          */
-        ieee80211_wake_queues(wl->hw);
+        wlcore_wake_queues(wl, WLCORE_QUEUE_STOP_REASON_FW_RESTART);
         return;
 out_unlock:
+        wl->watchdog_recovery = false;
         mutex_unlock(&wl->mutex);
 }
 
@@ -938,13 +914,19 @@ static void wl1271_fw_wakeup(struct wl1271 *wl)
 
 static int wl1271_setup(struct wl1271 *wl)
 {
-        wl->fw_status = kmalloc(sizeof(*wl->fw_status), GFP_KERNEL);
-        if (!wl->fw_status)
+        wl->fw_status_1 = kmalloc(WLCORE_FW_STATUS_1_LEN(wl->num_rx_desc) +
+                                  sizeof(*wl->fw_status_2) +
+                                  wl->fw_status_priv_len, GFP_KERNEL);
+        if (!wl->fw_status_1)
                 return -ENOMEM;
 
+        wl->fw_status_2 = (struct wl_fw_status_2 *)
+                                (((u8 *) wl->fw_status_1) +
+                                WLCORE_FW_STATUS_1_LEN(wl->num_rx_desc));
+
         wl->tx_res_if = kmalloc(sizeof(*wl->tx_res_if), GFP_KERNEL);
         if (!wl->tx_res_if) {
-                kfree(wl->fw_status);
+                kfree(wl->fw_status_1);
                 return -ENOMEM;
         }
 
@@ -987,13 +969,12 @@ static int wl12xx_chip_wakeup(struct wl1271 *wl, bool plt)
          * simplify the code and since the performance impact is
          * negligible, we use the same block size for all different
          * chip types.
+         *
+         * Check if the bus supports blocksize alignment and, if it
+         * doesn't, make sure we don't have the quirk.
          */
-        if (wl1271_set_block_size(wl))
-                wl->quirks |= WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN;
-
-        ret = wl->ops->identify_chip(wl);
-        if (ret < 0)
-                goto out;
+        if (!wl1271_set_block_size(wl))
+                wl->quirks &= ~WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN;
 
         /* TODO: make sure the lower driver has set things up correctly */
 
@@ -1005,13 +986,6 @@ static int wl12xx_chip_wakeup(struct wl1271 *wl, bool plt)
         if (ret < 0)
                 goto out;
 
-        /* No NVS from netlink, try to get it from the filesystem */
-        if (wl->nvs == NULL) {
-                ret = wl1271_fetch_nvs(wl);
-                if (ret < 0)
-                        goto out;
-        }
-
 out:
         return ret;
 }
@@ -1039,14 +1013,10 @@ int wl1271_plt_start(struct wl1271 *wl)
                 if (ret < 0)
                         goto power_off;
 
-                ret = wl->ops->boot(wl);
+                ret = wl->ops->plt_init(wl);
                 if (ret < 0)
                         goto power_off;
 
-                ret = wl1271_plt_init(wl);
-                if (ret < 0)
-                        goto irq_disable;
-
                 wl->plt = true;
                 wl->state = WL1271_STATE_ON;
                 wl1271_notice("firmware booted in PLT mode (%s)",
@@ -1059,19 +1029,6 @@ int wl1271_plt_start(struct wl1271 *wl)
 
                 goto out;
 
-irq_disable:
-                mutex_unlock(&wl->mutex);
-                /* Unlocking the mutex in the middle of handling is
-                   inherently unsafe. In this case we deem it safe to do,
-                   because we need to let any possibly pending IRQ out of
-                   the system (and while we are WL1271_STATE_OFF the IRQ
-                   work function will not do anything.) Also, any other
-                   possible concurrent operations will fail due to the
-                   current state, hence the wl1271 struct should be safe. */
-                wlcore_disable_interrupts(wl);
-                wl1271_flush_deferred_work(wl);
-                cancel_work_sync(&wl->netstack_work);
-                mutex_lock(&wl->mutex);
 power_off:
                 wl1271_power_off(wl);
         }
@@ -1154,9 +1111,16 @@ static void wl1271_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 
         spin_lock_irqsave(&wl->wl_lock, flags);
 
-        /* queue the packet */
+        /*
+         * drop the packet if the link is invalid or the queue is stopped
+         * for any reason but watermark. Watermark is a "soft"-stop so we
+         * allow these packets through.
+         */
         if (hlid == WL12XX_INVALID_LINK_ID ||
-            (wlvif && !test_bit(hlid, wlvif->links_map))) {
+            (wlvif && !test_bit(hlid, wlvif->links_map)) ||
+             (wlcore_is_queue_stopped(wl, q) &&
+              !wlcore_is_queue_stopped_by_reason(wl, q,
+                        WLCORE_QUEUE_STOP_REASON_WATERMARK))) {
                 wl1271_debug(DEBUG_TX, "DROP skb hlid %d q %d", hlid, q);
                 ieee80211_free_txskb(hw, skb);
                 goto out;
@@ -1174,8 +1138,8 @@ static void wl1271_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
          */
         if (wl->tx_queue_count[q] >= WL1271_TX_QUEUE_HIGH_WATERMARK) {
                 wl1271_debug(DEBUG_TX, "op_tx: stopping queues for q %d", q);
-                ieee80211_stop_queue(wl->hw, mapping);
-                set_bit(q, &wl->stopped_queues_map);
+                wlcore_stop_queue_locked(wl, q,
+                                         WLCORE_QUEUE_STOP_REASON_WATERMARK);
         }
 
         /*
@@ -1758,7 +1722,7 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
         cancel_delayed_work_sync(&wl->connection_loss_work);
 
         /* let's notify MAC80211 about the remaining pending TX frames */
-        wl12xx_tx_reset(wl, true);
+        wl12xx_tx_reset(wl);
         mutex_lock(&wl->mutex);
 
         wl1271_power_off(wl);
@@ -1767,6 +1731,7 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
 
         wl->rx_counter = 0;
         wl->power_level = WL1271_DEFAULT_POWER_LEVEL;
+        wl->channel_type = NL80211_CHAN_NO_HT;
         wl->tx_blocks_available = 0;
         wl->tx_allocated_blocks = 0;
         wl->tx_results_count = 0;
@@ -1799,8 +1764,9 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
 
         wl1271_debugfs_reset(wl);
 
-        kfree(wl->fw_status);
-        wl->fw_status = NULL;
+        kfree(wl->fw_status_1);
+        wl->fw_status_1 = NULL;
+        wl->fw_status_2 = NULL;
         kfree(wl->tx_res_if);
         wl->tx_res_if = NULL;
         kfree(wl->target_mem_map);
@@ -1894,6 +1860,9 @@ static int wl12xx_init_vif_data(struct wl1271 *wl, struct ieee80211_vif *vif)
                 wl12xx_allocate_rate_policy(wl, &wlvif->sta.basic_rate_idx);
                 wl12xx_allocate_rate_policy(wl, &wlvif->sta.ap_rate_idx);
                 wl12xx_allocate_rate_policy(wl, &wlvif->sta.p2p_rate_idx);
+                wlvif->basic_rate_set = CONF_TX_RATE_MASK_BASIC;
+                wlvif->basic_rate = CONF_TX_RATE_MASK_BASIC;
+                wlvif->rate_set = CONF_TX_RATE_MASK_BASIC;
         } else {
                 /* init ap data */
                 wlvif->ap.bcast_hlid = WL12XX_INVALID_LINK_ID;
@@ -1903,13 +1872,19 @@ static int wl12xx_init_vif_data(struct wl1271 *wl, struct ieee80211_vif *vif)
                 for (i = 0; i < CONF_TX_MAX_AC_COUNT; i++)
                         wl12xx_allocate_rate_policy(wl,
                                                 &wlvif->ap.ucast_rate_idx[i]);
+                wlvif->basic_rate_set = CONF_TX_AP_ENABLED_RATES;
+                /*
+                 * TODO: check if basic_rate shouldn't be
+                 * wl1271_tx_min_rate_get(wl, wlvif->basic_rate_set);
+                 * instead (the same thing for STA above).
+                */
+                wlvif->basic_rate = CONF_TX_AP_ENABLED_RATES;
+                /* TODO: this seems to be used only for STA, check it */
+                wlvif->rate_set = CONF_TX_AP_ENABLED_RATES;
         }
 
         wlvif->bitrate_masks[IEEE80211_BAND_2GHZ] = wl->conf.tx.basic_rate;
         wlvif->bitrate_masks[IEEE80211_BAND_5GHZ] = wl->conf.tx.basic_rate_5;
-        wlvif->basic_rate_set = CONF_TX_RATE_MASK_BASIC;
-        wlvif->basic_rate = CONF_TX_RATE_MASK_BASIC;
-        wlvif->rate_set = CONF_TX_RATE_MASK_BASIC;
         wlvif->beacon_int = WL1271_DEFAULT_BEACON_INT;
 
         /*
@@ -1919,6 +1894,7 @@ static int wl12xx_init_vif_data(struct wl1271 *wl, struct ieee80211_vif *vif)
         wlvif->band = wl->band;
         wlvif->channel = wl->channel;
         wlvif->power_level = wl->power_level;
+        wlvif->channel_type = wl->channel_type;
 
         INIT_WORK(&wlvif->rx_streaming_enable_work,
                   wl1271_rx_streaming_enable_work);
@@ -2444,7 +2420,7 @@ static int wl1271_sta_handle_idle(struct wl1271 *wl, struct wl12xx_vif *wlvif,
         } else {
                 /* The current firmware only supports sched_scan in idle */
                 if (wl->sched_scanning) {
-                        wl1271_scan_sched_scan_stop(wl);
+                        wl1271_scan_sched_scan_stop(wl, wlvif);
                         ieee80211_sched_scan_stopped(wl->hw);
                 }
 
@@ -2469,13 +2445,20 @@ static int wl12xx_config_vif(struct wl1271 *wl, struct wl12xx_vif *wlvif,
         /* if the channel changes while joined, join again */
         if (changed & IEEE80211_CONF_CHANGE_CHANNEL &&
             ((wlvif->band != conf->channel->band) ||
-             (wlvif->channel != channel))) {
+             (wlvif->channel != channel) ||
+             (wlvif->channel_type != conf->channel_type))) {
                 /* send all pending packets */
                 wl1271_tx_work_locked(wl);
                 wlvif->band = conf->channel->band;
                 wlvif->channel = channel;
+                wlvif->channel_type = conf->channel_type;
 
-                if (!is_ap) {
+                if (is_ap) {
+                        ret = wl1271_init_ap_rates(wl, wlvif);
+                        if (ret < 0)
+                                wl1271_error("AP rate policy change failed %d",
+                                             ret);
+                } else {
                         /*
                          * FIXME: the mac80211 should really provide a fixed
                          * rate to use here. for now, just use the smallest
@@ -2583,8 +2566,9 @@ static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
          * frames, such as the deauth. To make sure those frames reach the air,
          * wait here until the TX queue is fully flushed.
          */
-        if ((changed & IEEE80211_CONF_CHANGE_IDLE) &&
-            (conf->flags & IEEE80211_CONF_IDLE))
+        if ((changed & IEEE80211_CONF_CHANGE_CHANNEL) ||
+            ((changed & IEEE80211_CONF_CHANGE_IDLE) &&
+             (conf->flags & IEEE80211_CONF_IDLE)))
                 wl1271_tx_flush(wl);
 
         mutex_lock(&wl->mutex);
@@ -2593,6 +2577,7 @@ static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
                 wl->band = conf->channel->band;
                 wl->channel = channel;
+                wl->channel_type = conf->channel_type;
         }
 
         if (changed & IEEE80211_CONF_CHANGE_POWER)
@@ -2825,17 +2810,6 @@ static int wl1271_set_key(struct wl1271 *wl, struct wl12xx_vif *wlvif,
         int ret;
         bool is_ap = (wlvif->bss_type == BSS_TYPE_AP_BSS);
 
-        /*
-         * A role set to GEM cipher requires different Tx settings (namely
-         * spare blocks). Note when we are in this mode so the HW can adjust.
-         */
-        if (key_type == KEY_GEM) {
-                if (action == KEY_ADD_OR_REPLACE)
-                        wlvif->is_gem = true;
-                else if (action == KEY_REMOVE)
-                        wlvif->is_gem = false;
-        }
-
         if (is_ap) {
                 struct wl1271_station *wl_sta;
                 u8 hlid;
@@ -2913,12 +2887,21 @@ static int wl1271_set_key(struct wl1271 *wl, struct wl12xx_vif *wlvif,
         return 0;
 }
 
-static int wl1271_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+static int wlcore_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                              struct ieee80211_vif *vif,
                              struct ieee80211_sta *sta,
                              struct ieee80211_key_conf *key_conf)
 {
         struct wl1271 *wl = hw->priv;
+
+        return wlcore_hw_set_key(wl, cmd, vif, sta, key_conf);
+}
+
+int wlcore_set_key(struct wl1271 *wl, enum set_key_cmd cmd,
+                   struct ieee80211_vif *vif,
+                   struct ieee80211_sta *sta,
+                   struct ieee80211_key_conf *key_conf)
+{
         struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
         int ret;
         u32 tx_seq_32 = 0;
@@ -3029,6 +3012,7 @@ out_unlock:
 
         return ret;
 }
+EXPORT_SYMBOL_GPL(wlcore_set_key);
 
 static int wl1271_op_hw_scan(struct ieee80211_hw *hw,
                              struct ieee80211_vif *vif,
@@ -3167,6 +3151,7 @@ static void wl1271_op_sched_scan_stop(struct ieee80211_hw *hw,
                                       struct ieee80211_vif *vif)
 {
         struct wl1271 *wl = hw->priv;
+        struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
         int ret;
 
         wl1271_debug(DEBUG_MAC80211, "wl1271_op_sched_scan_stop");
@@ -3180,7 +3165,7 @@ static void wl1271_op_sched_scan_stop(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out;
 
-        wl1271_scan_sched_scan_stop(wl);
+        wl1271_scan_sched_scan_stop(wl, wlvif);
 
         wl1271_ps_elp_sleep(wl);
 out:
@@ -3316,8 +3301,15 @@ static int wl1271_ap_set_probe_resp_tmpl(struct wl1271 *wl, u32 rates,
                                       skb->data,
                                       skb->len, 0,
                                       rates);
-
         dev_kfree_skb(skb);
+
+        if (ret < 0)
+                goto out;
+
+        wl1271_debug(DEBUG_AP, "probe response updated");
+        set_bit(WLVIF_FLAG_AP_PROBE_RESP_SET, &wlvif->flags);
+
+out:
         return ret;
 }
 
@@ -3422,6 +3414,87 @@ out:
         return ret;
 }
 
+static int wlcore_set_beacon_template(struct wl1271 *wl,
+                                      struct ieee80211_vif *vif,
+                                      bool is_ap)
+{
+        struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
+        struct ieee80211_hdr *hdr;
+        u32 min_rate;
+        int ret;
+        int ieoffset = offsetof(struct ieee80211_mgmt,
+                                u.beacon.variable);
+        struct sk_buff *beacon = ieee80211_beacon_get(wl->hw, vif);
+        u16 tmpl_id;
+
+        if (!beacon) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        wl1271_debug(DEBUG_MASTER, "beacon updated");
+
+        ret = wl1271_ssid_set(vif, beacon, ieoffset);
+        if (ret < 0) {
+                dev_kfree_skb(beacon);
+                goto out;
+        }
+        min_rate = wl1271_tx_min_rate_get(wl, wlvif->basic_rate_set);
+        tmpl_id = is_ap ? CMD_TEMPL_AP_BEACON :
+                CMD_TEMPL_BEACON;
+        ret = wl1271_cmd_template_set(wl, wlvif->role_id, tmpl_id,
+                                      beacon->data,
+                                      beacon->len, 0,
+                                      min_rate);
+        if (ret < 0) {
+                dev_kfree_skb(beacon);
+                goto out;
+        }
+
+        /*
+         * In case we already have a probe-resp beacon set explicitly
+         * by usermode, don't use the beacon data.
+         */
+        if (test_bit(WLVIF_FLAG_AP_PROBE_RESP_SET, &wlvif->flags))
+                goto end_bcn;
+
+        /* remove TIM ie from probe response */
+        wl12xx_remove_ie(beacon, WLAN_EID_TIM, ieoffset);
+
+        /*
+         * remove p2p ie from probe response.
+         * the fw reponds to probe requests that don't include
+         * the p2p ie. probe requests with p2p ie will be passed,
+         * and will be responded by the supplicant (the spec
+         * forbids including the p2p ie when responding to probe
+         * requests that didn't include it).
+         */
+        wl12xx_remove_vendor_ie(beacon, WLAN_OUI_WFA,
+                                WLAN_OUI_TYPE_WFA_P2P, ieoffset);
+
+        hdr = (struct ieee80211_hdr *) beacon->data;
+        hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                         IEEE80211_STYPE_PROBE_RESP);
+        if (is_ap)
+                ret = wl1271_ap_set_probe_resp_tmpl_legacy(wl, vif,
+                                                           beacon->data,
+                                                           beacon->len,
+                                                           min_rate);
+        else
+                ret = wl1271_cmd_template_set(wl, wlvif->role_id,
+                                              CMD_TEMPL_PROBE_RESPONSE,
+                                              beacon->data,
+                                              beacon->len, 0,
+                                              min_rate);
+end_bcn:
+        dev_kfree_skb(beacon);
+        if (ret < 0)
+                goto out;
+
+out:
+        return ret;
+}
+
 static int wl1271_bss_beacon_info_changed(struct wl1271 *wl,
                                           struct ieee80211_vif *vif,
                                           struct ieee80211_bss_conf *bss_conf,
@@ -3440,81 +3513,12 @@ static int wl1271_bss_beacon_info_changed(struct wl1271 *wl,
 
         if ((changed & BSS_CHANGED_AP_PROBE_RESP) && is_ap) {
                 u32 rate = wl1271_tx_min_rate_get(wl, wlvif->basic_rate_set);
-                if (!wl1271_ap_set_probe_resp_tmpl(wl, rate, vif)) {
-                        wl1271_debug(DEBUG_AP, "probe response updated");
-                        set_bit(WLVIF_FLAG_AP_PROBE_RESP_SET, &wlvif->flags);
-                }
+
+                wl1271_ap_set_probe_resp_tmpl(wl, rate, vif);
         }
 
         if ((changed & BSS_CHANGED_BEACON)) {
-                struct ieee80211_hdr *hdr;
-                u32 min_rate;
-                int ieoffset = offsetof(struct ieee80211_mgmt,
-                                        u.beacon.variable);
-                struct sk_buff *beacon = ieee80211_beacon_get(wl->hw, vif);
-                u16 tmpl_id;
-
-                if (!beacon) {
-                        ret = -EINVAL;
-                        goto out;
-                }
-
-                wl1271_debug(DEBUG_MASTER, "beacon updated");
-
-                ret = wl1271_ssid_set(vif, beacon, ieoffset);
-                if (ret < 0) {
-                        dev_kfree_skb(beacon);
-                        goto out;
-                }
-                min_rate = wl1271_tx_min_rate_get(wl, wlvif->basic_rate_set);
-                tmpl_id = is_ap ? CMD_TEMPL_AP_BEACON :
-                                  CMD_TEMPL_BEACON;
-                ret = wl1271_cmd_template_set(wl, wlvif->role_id, tmpl_id,
-                                              beacon->data,
-                                              beacon->len, 0,
-                                              min_rate);
-                if (ret < 0) {
-                        dev_kfree_skb(beacon);
-                        goto out;
-                }
-
-                /*
-                 * In case we already have a probe-resp beacon set explicitly
-                 * by usermode, don't use the beacon data.
-                 */
-                if (test_bit(WLVIF_FLAG_AP_PROBE_RESP_SET, &wlvif->flags))
-                        goto end_bcn;
-
-                /* remove TIM ie from probe response */
-                wl12xx_remove_ie(beacon, WLAN_EID_TIM, ieoffset);
-
-                /*
-                 * remove p2p ie from probe response.
-                 * the fw reponds to probe requests that don't include
-                 * the p2p ie. probe requests with p2p ie will be passed,
-                 * and will be responded by the supplicant (the spec
-                 * forbids including the p2p ie when responding to probe
-                 * requests that didn't include it).
-                 */
-                wl12xx_remove_vendor_ie(beacon, WLAN_OUI_WFA,
-                                        WLAN_OUI_TYPE_WFA_P2P, ieoffset);
-
-                hdr = (struct ieee80211_hdr *) beacon->data;
-                hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                                 IEEE80211_STYPE_PROBE_RESP);
-                if (is_ap)
-                        ret = wl1271_ap_set_probe_resp_tmpl_legacy(wl, vif,
-                                                beacon->data,
-                                                beacon->len,
-                                                min_rate);
-                else
-                        ret = wl1271_cmd_template_set(wl, wlvif->role_id,
-                                                CMD_TEMPL_PROBE_RESPONSE,
-                                                beacon->data,
-                                                beacon->len, 0,
-                                                min_rate);
-end_bcn:
-                dev_kfree_skb(beacon);
+                ret = wlcore_set_beacon_template(wl, vif, is_ap);
                 if (ret < 0)
                         goto out;
         }
@@ -3551,6 +3555,14 @@ static void wl1271_bss_info_changed_ap(struct wl1271 *wl,
                 ret = wl1271_ap_init_templates(wl, vif);
                 if (ret < 0)
                         goto out;
+
+                ret = wl1271_ap_set_probe_resp_tmpl(wl, wlvif->basic_rate, vif);
+                if (ret < 0)
+                        goto out;
+
+                ret = wlcore_set_beacon_template(wl, vif, true);
+                if (ret < 0)
+                        goto out;
         }
 
         ret = wl1271_bss_beacon_info_changed(wl, vif, bss_conf, changed);
@@ -3691,7 +3703,8 @@ static void wl1271_bss_info_changed_sta(struct wl1271 *wl,
                 sta_rate_set = sta->supp_rates[wl->hw->conf.channel->band];
                 if (sta->ht_cap.ht_supported)
                         sta_rate_set |=
-                            (sta->ht_cap.mcs.rx_mask[0] << HW_HT_RATES_OFFSET);
+                          (sta->ht_cap.mcs.rx_mask[0] << HW_HT_RATES_OFFSET) |
+                          (sta->ht_cap.mcs.rx_mask[1] << HW_MIMO_RATES_OFFSET);
                 sta_ht_cap = sta->ht_cap;
                 sta_exists = true;
 
@@ -3704,13 +3717,11 @@ sta_not_found:
                         u32 rates;
                         int ieoffset;
                         wlvif->aid = bss_conf->aid;
+                        wlvif->channel_type = bss_conf->channel_type;
                         wlvif->beacon_int = bss_conf->beacon_int;
                         do_join = true;
                         set_assoc = true;
 
-                        /* Cancel connection_loss_work */
-                        cancel_delayed_work_sync(&wl->connection_loss_work);
-
                         /*
                          * use basic rates from AP, and determine lowest rate
                          * to use with control frames.
@@ -3960,6 +3971,17 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
         wl1271_debug(DEBUG_MAC80211, "mac80211 bss info changed 0x%x",
                      (int)changed);
 
+        /*
+         * make sure to cancel pending disconnections if our association
+         * state changed
+         */
+        if (!is_ap && (changed & BSS_CHANGED_ASSOC))
+                cancel_delayed_work_sync(&wl->connection_loss_work);
+
+        if (is_ap && (changed & BSS_CHANGED_BEACON_ENABLED) &&
+            !bss_conf->enable_beacon)
+                wl1271_tx_flush(wl);
+
         mutex_lock(&wl->mutex);
 
         if (unlikely(wl->state == WL1271_STATE_OFF))
@@ -4636,7 +4658,7 @@ static const struct ieee80211_ops wl1271_ops = {
         .prepare_multicast = wl1271_op_prepare_multicast,
         .configure_filter = wl1271_op_configure_filter,
         .tx = wl1271_op_tx,
-        .set_key = wl1271_op_set_key,
+        .set_key = wlcore_op_set_key,
         .hw_scan = wl1271_op_hw_scan,
         .cancel_hw_scan = wl1271_op_cancel_hw_scan,
         .sched_scan_start = wl1271_op_sched_scan_start,
@@ -4905,14 +4927,8 @@ static int wl1271_register_hw(struct wl1271 *wl)
         if (wl->mac80211_registered)
                 return 0;
 
-        ret = wl12xx_get_hw_info(wl);
-        if (ret < 0) {
-                wl1271_error("couldn't get hw info");
-                goto out;
-        }
-
-        ret = wl1271_fetch_nvs(wl);
-        if (ret == 0) {
+        wl1271_fetch_nvs(wl);
+        if (wl->nvs != NULL) {
                 /* NOTE: The wl->nvs->nvs element must be first, in
                  * order to simplify the casting, we assume it is at
                  * the beginning of the wl->nvs structure.
@@ -4970,9 +4986,11 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
                 WL1271_CIPHER_SUITE_GEM,
         };
 
-        /* The tx descriptor buffer and the TKIP space. */
-        wl->hw->extra_tx_headroom = WL1271_EXTRA_SPACE_TKIP +
-                sizeof(struct wl1271_tx_hw_descr);
+        /* The tx descriptor buffer */
+        wl->hw->extra_tx_headroom = sizeof(struct wl1271_tx_hw_descr);
+
+        if (wl->quirks & WLCORE_QUIRK_TKIP_HEADER_SPACE)
+                wl->hw->extra_tx_headroom += WL1271_EXTRA_SPACE_TKIP;
 
         /* unit us */
         /* FIXME: find a proper value */
@@ -5025,12 +5043,14 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
          */
         memcpy(&wl->bands[IEEE80211_BAND_2GHZ], &wl1271_band_2ghz,
                sizeof(wl1271_band_2ghz));
-        memcpy(&wl->bands[IEEE80211_BAND_2GHZ].ht_cap, &wl->ht_cap,
-               sizeof(wl->ht_cap));
+        memcpy(&wl->bands[IEEE80211_BAND_2GHZ].ht_cap,
+               &wl->ht_cap[IEEE80211_BAND_2GHZ],
+               sizeof(*wl->ht_cap));
         memcpy(&wl->bands[IEEE80211_BAND_5GHZ], &wl1271_band_5ghz,
                sizeof(wl1271_band_5ghz));
-        memcpy(&wl->bands[IEEE80211_BAND_5GHZ].ht_cap, &wl->ht_cap,
-               sizeof(wl->ht_cap));
+        memcpy(&wl->bands[IEEE80211_BAND_5GHZ].ht_cap,
+               &wl->ht_cap[IEEE80211_BAND_5GHZ],
+               sizeof(*wl->ht_cap));
 
         wl->hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
                 &wl->bands[IEEE80211_BAND_2GHZ];
@@ -5117,6 +5137,7 @@ struct ieee80211_hw *wlcore_alloc_hw(size_t priv_size)
         wl->rx_counter = 0;
         wl->power_level = WL1271_DEFAULT_POWER_LEVEL;
         wl->band = IEEE80211_BAND_2GHZ;
+        wl->channel_type = NL80211_CHAN_NO_HT;
         wl->flags = 0;
         wl->sg_enabled = true;
         wl->hw_pg_ver = -1;
@@ -5142,6 +5163,7 @@ struct ieee80211_hw *wlcore_alloc_hw(size_t priv_size)
         wl->state = WL1271_STATE_OFF;
         wl->fw_type = WL12XX_FW_TYPE_NONE;
         mutex_init(&wl->mutex);
+        mutex_init(&wl->flush_mutex);
 
         order = get_order(WL1271_AGGR_BUFFER_SIZE);
         wl->aggr_buf = (u8 *)__get_free_pages(GFP_KERNEL, order);
@@ -5222,7 +5244,7 @@ int wlcore_free_hw(struct wl1271 *wl)
         kfree(wl->nvs);
         wl->nvs = NULL;
 
-        kfree(wl->fw_status);
+        kfree(wl->fw_status_1);
         kfree(wl->tx_res_if);
         destroy_workqueue(wl->freezable_wq);
 
@@ -5279,8 +5301,6 @@ int __devinit wlcore_probe(struct wl1271 *wl, struct platform_device *pdev)
         wlcore_adjust_conf(wl);
 
         wl->irq = platform_get_irq(pdev, 0);
-        wl->ref_clock = pdata->board_ref_clock;
-        wl->tcxo_clock = pdata->board_tcxo_clock;
         wl->platform_quirks = pdata->platform_quirks;
         wl->set_power = pdata->set_power;
         wl->dev = &pdev->dev;
@@ -5316,6 +5336,16 @@ int __devinit wlcore_probe(struct wl1271 *wl, struct platform_device *pdev)
         }
         disable_irq(wl->irq);
 
+        ret = wl12xx_get_hw_info(wl);
+        if (ret < 0) {
+                wl1271_error("couldn't get hw info");
+                goto out;
+        }
+
+        ret = wl->ops->identify_chip(wl);
+        if (ret < 0)
+                goto out;
+
         ret = wl1271_init_ieee80211(wl);
         if (ret)
                 goto out_irq;
diff --git a/drivers/net/wireless/ti/wlcore/ps.c b/drivers/net/wireless/ti/wlcore/ps.c
index 756eee2257b4..47e81b32f7da 100644
--- a/drivers/net/wireless/ti/wlcore/ps.c
+++ b/drivers/net/wireless/ti/wlcore/ps.c
@@ -28,6 +28,8 @@
 
 #define WL1271_WAKEUP_TIMEOUT 500
 
+#define ELP_ENTRY_DELAY  5
+
 void wl1271_elp_work(struct work_struct *work)
 {
         struct delayed_work *dwork;
@@ -72,6 +74,7 @@ out:
 void wl1271_ps_elp_sleep(struct wl1271 *wl)
 {
         struct wl12xx_vif *wlvif;
+        u32 timeout;
 
         if (wl->quirks & WLCORE_QUIRK_NO_ELP)
                 return;
@@ -89,8 +92,13 @@ void wl1271_ps_elp_sleep(struct wl1271 *wl)
                         return;
         }
 
+        if (wl->conf.conn.forced_ps)
+                timeout = ELP_ENTRY_DELAY;
+        else
+                timeout = wl->conf.conn.dynamic_ps_timeout;
+
         ieee80211_queue_delayed_work(wl->hw, &wl->elp_work,
-                msecs_to_jiffies(wl->conf.conn.dynamic_ps_timeout));
+                                     msecs_to_jiffies(timeout));
 }
 
 int wl1271_ps_elp_wakeup(struct wl1271 *wl)
@@ -185,8 +193,12 @@ int wl1271_ps_set_mode(struct wl1271 *wl, struct wl12xx_vif *wlvif,
 
                 set_bit(WLVIF_FLAG_IN_PS, &wlvif->flags);
 
-                /* enable beacon early termination. Not relevant for 5GHz */
-                if (wlvif->band == IEEE80211_BAND_2GHZ) {
+                /*
+                 * enable beacon early termination.
+                 * Not relevant for 5GHz and for high rates.
+                 */
+                if ((wlvif->band == IEEE80211_BAND_2GHZ) &&
+                    (wlvif->basic_rate < CONF_HW_BIT_RATE_9MBPS)) {
                         ret = wl1271_acx_bet_enable(wl, wlvif, true);
                         if (ret < 0)
                                 return ret;
@@ -196,7 +208,8 @@ int wl1271_ps_set_mode(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                 wl1271_debug(DEBUG_PSM, "leaving psm");
 
                 /* disable beacon early termination */
-                if (wlvif->band == IEEE80211_BAND_2GHZ) {
+                if ((wlvif->band == IEEE80211_BAND_2GHZ) &&
+                    (wlvif->basic_rate < CONF_HW_BIT_RATE_9MBPS)) {
                         ret = wl1271_acx_bet_enable(wl, wlvif, false);
                         if (ret < 0)
                                 return ret;
diff --git a/drivers/net/wireless/ti/wlcore/rx.c b/drivers/net/wireless/ti/wlcore/rx.c
index d6a3c6b07827..78200dcacfca 100644
--- a/drivers/net/wireless/ti/wlcore/rx.c
+++ b/drivers/net/wireless/ti/wlcore/rx.c
@@ -186,6 +186,7 @@ static int wl1271_rx_handle_data(struct wl1271 *wl, u8 *data, u32 length,
                 is_data = 1;
 
         wl1271_rx_status(wl, desc, IEEE80211_SKB_RXCB(skb), beacon);
+        wlcore_hw_set_rx_csum(wl, desc, skb);
 
         seq_num = (le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4;
         wl1271_debug(DEBUG_RX, "rx skb 0x%p: %d B %s seq %d hlid %d", skb,
@@ -199,12 +200,12 @@ static int wl1271_rx_handle_data(struct wl1271 *wl, u8 *data, u32 length,
         return is_data;
 }
 
-void wl12xx_rx(struct wl1271 *wl, struct wl_fw_status *status)
+void wl12xx_rx(struct wl1271 *wl, struct wl_fw_status_1 *status)
 {
         unsigned long active_hlids[BITS_TO_LONGS(WL12XX_MAX_LINKS)] = {0};
         u32 buf_size;
-        u32 fw_rx_counter  = status->fw_rx_counter & NUM_RX_PKT_DESC_MOD_MASK;
-        u32 drv_rx_counter = wl->rx_counter & NUM_RX_PKT_DESC_MOD_MASK;
+        u32 fw_rx_counter = status->fw_rx_counter % wl->num_rx_desc;
+        u32 drv_rx_counter = wl->rx_counter % wl->num_rx_desc;
         u32 rx_counter;
         u32 pkt_len, align_pkt_len;
         u32 pkt_offset, des;
@@ -223,7 +224,7 @@ void wl12xx_rx(struct wl1271 *wl, struct wl_fw_status *status)
                                 break;
                         buf_size += align_pkt_len;
                         rx_counter++;
-                        rx_counter &= NUM_RX_PKT_DESC_MOD_MASK;
+                        rx_counter %= wl->num_rx_desc;
                 }
 
                 if (buf_size == 0) {
@@ -263,7 +264,7 @@ void wl12xx_rx(struct wl1271 *wl, struct wl_fw_status *status)
 
                         wl->rx_counter++;
                         drv_rx_counter++;
-                        drv_rx_counter &= NUM_RX_PKT_DESC_MOD_MASK;
+                        drv_rx_counter %= wl->num_rx_desc;
                         pkt_offset += wlcore_rx_get_align_buf_size(wl, pkt_len);
                 }
         }
diff --git a/drivers/net/wireless/ti/wlcore/rx.h b/drivers/net/wireless/ti/wlcore/rx.h
index e9a162a864ca..9be780179456 100644
--- a/drivers/net/wireless/ti/wlcore/rx.h
+++ b/drivers/net/wireless/ti/wlcore/rx.h
@@ -38,8 +38,6 @@
 #define RX_DESC_PACKETID_SHIFT 11
 #define RX_MAX_PACKET_ID 3
 
-#define NUM_RX_PKT_DESC_MOD_MASK   7
-
 #define RX_DESC_VALID_FCS         0x0001
 #define RX_DESC_MATCH_RXADDR1     0x0002
 #define RX_DESC_MCAST             0x0004
@@ -102,6 +100,9 @@
 /* If set, the start of IP payload is not 4 bytes aligned */
 #define RX_BUF_UNALIGNED_PAYLOAD     BIT(20)
 
+/* If set, the buffer was padded by the FW to be 4 bytes aligned */
+#define RX_BUF_PADDED_PAYLOAD        BIT(30)
+
 /* Describes the alignment state of a Rx buffer */
 enum wl_rx_buf_align {
         WLCORE_RX_BUF_ALIGNED,
@@ -136,7 +137,7 @@ struct wl1271_rx_descriptor {
         u8  reserved;
 } __packed;
 
-void wl12xx_rx(struct wl1271 *wl, struct wl_fw_status *status);
+void wl12xx_rx(struct wl1271 *wl, struct wl_fw_status_1 *status);
 u8 wl1271_rate_to_idx(int rate, enum ieee80211_band band);
 int wl1271_rx_filter_enable(struct wl1271 *wl,
                             int index, bool enable,
diff --git a/drivers/net/wireless/ti/wlcore/scan.c b/drivers/net/wireless/ti/wlcore/scan.c
index ade21a011c45..d9daed53ceb7 100644
--- a/drivers/net/wireless/ti/wlcore/scan.c
+++ b/drivers/net/wireless/ti/wlcore/scan.c
@@ -411,7 +411,8 @@ wl1271_scan_get_sched_scan_channels(struct wl1271 *wl,
                                     struct cfg80211_sched_scan_request *req,
                                     struct conn_scan_ch_params *channels,
                                     u32 band, bool radar, bool passive,
-                                    int start, int max_channels)
+                                    int start, int max_channels,
+                                    u8 *n_pactive_ch)
 {
         struct conf_sched_scan_settings *c = &wl->conf.sched_scan;
         int i, j;
@@ -479,6 +480,23 @@ wl1271_scan_get_sched_scan_channels(struct wl1271 *wl,
                         channels[j].tx_power_att = req->channels[i]->max_power;
                         channels[j].channel = req->channels[i]->hw_value;
 
+                        if ((band == IEEE80211_BAND_2GHZ) &&
+                            (channels[j].channel >= 12) &&
+                            (channels[j].channel <= 14) &&
+                            (flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
+                            !force_passive) {
+                                /* pactive channels treated as DFS */
+                                channels[j].flags = SCAN_CHANNEL_FLAGS_DFS;
+
+                                /*
+                                 * n_pactive_ch is counted down from the end of
+                                 * the passive channel list
+                                 */
+                                (*n_pactive_ch)++;
+                                wl1271_debug(DEBUG_SCAN, "n_pactive_ch = %d",
+                                             *n_pactive_ch);
+                        }
+
                         j++;
                 }
         }
@@ -491,38 +509,47 @@ wl1271_scan_sched_scan_channels(struct wl1271 *wl,
                                 struct cfg80211_sched_scan_request *req,
                                 struct wl1271_cmd_sched_scan_config *cfg)
 {
+        u8 n_pactive_ch = 0;
+
         cfg->passive[0] =
                 wl1271_scan_get_sched_scan_channels(wl, req, cfg->channels_2,
                                                     IEEE80211_BAND_2GHZ,
                                                     false, true, 0,
-                                                    MAX_CHANNELS_2GHZ);
+                                                    MAX_CHANNELS_2GHZ,
+                                                    &n_pactive_ch);
         cfg->active[0] =
                 wl1271_scan_get_sched_scan_channels(wl, req, cfg->channels_2,
                                                     IEEE80211_BAND_2GHZ,
                                                     false, false,
                                                     cfg->passive[0],
-                                                    MAX_CHANNELS_2GHZ);
+                                                    MAX_CHANNELS_2GHZ,
+                                                    &n_pactive_ch);
         cfg->passive[1] =
                 wl1271_scan_get_sched_scan_channels(wl, req, cfg->channels_5,
                                                     IEEE80211_BAND_5GHZ,
                                                     false, true, 0,
-                                                    MAX_CHANNELS_5GHZ);
+                                                    MAX_CHANNELS_5GHZ,
+                                                    &n_pactive_ch);
         cfg->dfs =
                 wl1271_scan_get_sched_scan_channels(wl, req, cfg->channels_5,
                                                     IEEE80211_BAND_5GHZ,
                                                     true, true,
                                                     cfg->passive[1],
-                                                    MAX_CHANNELS_5GHZ);
+                                                    MAX_CHANNELS_5GHZ,
+                                                    &n_pactive_ch);
         cfg->active[1] =
                 wl1271_scan_get_sched_scan_channels(wl, req, cfg->channels_5,
                                                     IEEE80211_BAND_5GHZ,
                                                     false, false,
                                                     cfg->passive[1] + cfg->dfs,
-                                                    MAX_CHANNELS_5GHZ);
+                                                    MAX_CHANNELS_5GHZ,
+                                                    &n_pactive_ch);
         /* 802.11j channels are not supported yet */
         cfg->passive[2] = 0;
         cfg->active[2] = 0;
 
+        cfg->n_pactive_ch = n_pactive_ch;
+
         wl1271_debug(DEBUG_SCAN, "    2.4GHz: active %d passive %d",
                      cfg->active[0], cfg->passive[0]);
         wl1271_debug(DEBUG_SCAN, "    5GHz: active %d passive %d",
@@ -537,6 +564,7 @@ wl1271_scan_sched_scan_channels(struct wl1271 *wl,
 /* Returns the scan type to be used or a negative value on error */
 static int
 wl12xx_scan_sched_scan_ssid_list(struct wl1271 *wl,
+                                 struct wl12xx_vif *wlvif,
                                  struct cfg80211_sched_scan_request *req)
 {
         struct wl1271_cmd_sched_scan_ssid_list *cmd = NULL;
@@ -565,6 +593,7 @@ wl12xx_scan_sched_scan_ssid_list(struct wl1271 *wl,
                 goto out;
         }
 
+        cmd->role_id = wlvif->dev_role_id;
         if (!n_match_ssids) {
                 /* No filter, with ssids */
                 type = SCAN_SSID_FILTER_DISABLED;
@@ -603,7 +632,9 @@ wl12xx_scan_sched_scan_ssid_list(struct wl1271 *wl,
                                         continue;
 
                                 for (j = 0; j < cmd->n_ssids; j++)
-                                        if (!memcmp(req->ssids[i].ssid,
+                                        if ((req->ssids[i].ssid_len ==
+                                             req->ssids[j].ssid_len) &&
+                                            !memcmp(req->ssids[i].ssid,
                                                    cmd->ssids[j].ssid,
                                                    req->ssids[i].ssid_len)) {
                                                 cmd->ssids[j].type =
@@ -652,6 +683,7 @@ int wl1271_scan_sched_scan_config(struct wl1271 *wl,
         if (!cfg)
                 return -ENOMEM;
 
+        cfg->role_id = wlvif->dev_role_id;
         cfg->rssi_threshold = c->rssi_threshold;
         cfg->snr_threshold  = c->snr_threshold;
         cfg->n_probe_reqs = c->num_probe_reqs;
@@ -669,7 +701,7 @@ int wl1271_scan_sched_scan_config(struct wl1271 *wl,
                 cfg->intervals[i] = cpu_to_le32(req->interval);
 
         cfg->ssid_len = 0;
-        ret = wl12xx_scan_sched_scan_ssid_list(wl, req);
+        ret = wl12xx_scan_sched_scan_ssid_list(wl, wlvif, req);
         if (ret < 0)
                 goto out;
 
@@ -741,6 +773,7 @@ int wl1271_scan_sched_scan_start(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         if (!start)
                 return -ENOMEM;
 
+        start->role_id = wlvif->dev_role_id;
         start->tag = WL1271_SCAN_DEFAULT_TAG;
 
         ret = wl1271_cmd_send(wl, CMD_START_PERIODIC_SCAN, start,
@@ -762,7 +795,7 @@ void wl1271_scan_sched_scan_results(struct wl1271 *wl)
         ieee80211_sched_scan_results(wl->hw);
 }
 
-void wl1271_scan_sched_scan_stop(struct wl1271 *wl)
+void wl1271_scan_sched_scan_stop(struct wl1271 *wl,  struct wl12xx_vif *wlvif)
 {
         struct wl1271_cmd_sched_scan_stop *stop;
         int ret = 0;
@@ -776,6 +809,7 @@ void wl1271_scan_sched_scan_stop(struct wl1271 *wl)
                 return;
         }
 
+        stop->role_id = wlvif->dev_role_id;
         stop->tag = WL1271_SCAN_DEFAULT_TAG;
 
         ret = wl1271_cmd_send(wl, CMD_STOP_PERIODIC_SCAN, stop,
diff --git a/drivers/net/wireless/ti/wlcore/scan.h b/drivers/net/wireless/ti/wlcore/scan.h
index 81ee36ac2078..29f3c8d6b046 100644
--- a/drivers/net/wireless/ti/wlcore/scan.h
+++ b/drivers/net/wireless/ti/wlcore/scan.h
@@ -40,7 +40,7 @@ int wl1271_scan_sched_scan_config(struct wl1271 *wl,
                                      struct cfg80211_sched_scan_request *req,
                                      struct ieee80211_sched_scan_ies *ies);
 int wl1271_scan_sched_scan_start(struct wl1271 *wl, struct wl12xx_vif *wlvif);
-void wl1271_scan_sched_scan_stop(struct wl1271 *wl);
+void wl1271_scan_sched_scan_stop(struct wl1271 *wl,  struct wl12xx_vif *wlvif);
 void wl1271_scan_sched_scan_results(struct wl1271 *wl);
 
 #define WL1271_SCAN_MAX_CHANNELS       24
@@ -142,7 +142,8 @@ enum {
         SCAN_BSS_TYPE_ANY,
 };
 
-#define SCAN_CHANNEL_FLAGS_DFS          BIT(0)
+#define SCAN_CHANNEL_FLAGS_DFS          BIT(0) /* channel is passive until an
+                                                  activity is detected on it */
 #define SCAN_CHANNEL_FLAGS_DFS_ENABLED  BIT(1)
 
 struct conn_scan_ch_params {
@@ -185,7 +186,10 @@ struct wl1271_cmd_sched_scan_config {
 
         u8 dfs;
 
-        u8 padding[3];
+        u8 n_pactive_ch; /* number of pactive (passive until fw detects energy)
+                            channels in BG band */
+        u8 role_id;
+        u8 padding[1];
 
         struct conn_scan_ch_params channels_2[MAX_CHANNELS_2GHZ];
         struct conn_scan_ch_params channels_5[MAX_CHANNELS_5GHZ];
@@ -212,21 +216,24 @@ struct wl1271_cmd_sched_scan_ssid_list {
 
         u8 n_ssids;
         struct wl1271_ssid ssids[SCHED_SCAN_MAX_SSIDS];
-        u8 padding[3];
+        u8 role_id;
+        u8 padding[2];
 } __packed;
 
 struct wl1271_cmd_sched_scan_start {
         struct wl1271_cmd_header header;
 
         u8 tag;
-        u8 padding[3];
+        u8 role_id;
+        u8 padding[2];
 } __packed;
 
 struct wl1271_cmd_sched_scan_stop {
         struct wl1271_cmd_header header;
 
         u8 tag;
-        u8 padding[3];
+        u8 role_id;
+        u8 padding[2];
 } __packed;
 
 
diff --git a/drivers/net/wireless/ti/wlcore/sdio.c b/drivers/net/wireless/ti/wlcore/sdio.c
index 0a72347cfc4c..c67ec482e445 100644
--- a/drivers/net/wireless/ti/wlcore/sdio.c
+++ b/drivers/net/wireless/ti/wlcore/sdio.c
@@ -25,6 +25,7 @@
 #include <linux/module.h>
 #include <linux/vmalloc.h>
 #include <linux/platform_device.h>
+#include <linux/mmc/sdio.h>
 #include <linux/mmc/sdio_func.h>
 #include <linux/mmc/sdio_ids.h>
 #include <linux/mmc/card.h>
@@ -32,6 +33,7 @@
 #include <linux/gpio.h>
 #include <linux/wl12xx.h>
 #include <linux/pm_runtime.h>
+#include <linux/printk.h>
 
 #include "wlcore.h"
 #include "wl12xx_80211.h"
@@ -45,6 +47,8 @@
 #define SDIO_DEVICE_ID_TI_WL1271        0x4076
 #endif
 
+static bool dump = false;
+
 struct wl12xx_sdio_glue {
         struct device *dev;
         struct platform_device *core;
@@ -76,6 +80,13 @@ static void wl12xx_sdio_raw_read(struct device *child, int addr, void *buf,
 
         sdio_claim_host(func);
 
+        if (unlikely(dump)) {
+                printk(KERN_DEBUG "wlcore_sdio: READ from 0x%04x\n", addr);
+                print_hex_dump(KERN_DEBUG, "wlcore_sdio: READ ",
+                                DUMP_PREFIX_OFFSET, 16, 1,
+                                buf, len, false);
+        }
+
         if (unlikely(addr == HW_ACCESS_ELP_CTRL_REG)) {
                 ((u8 *)buf)[0] = sdio_f0_readb(func, addr, &ret);
                 dev_dbg(child->parent, "sdio read 52 addr 0x%x, byte 0x%02x\n",
@@ -105,6 +116,13 @@ static void wl12xx_sdio_raw_write(struct device *child, int addr, void *buf,
 
         sdio_claim_host(func);
 
+        if (unlikely(dump)) {
+                printk(KERN_DEBUG "wlcore_sdio: WRITE to 0x%04x\n", addr);
+                print_hex_dump(KERN_DEBUG, "wlcore_sdio: WRITE ",
+                                DUMP_PREFIX_OFFSET, 16, 1,
+                                buf, len, false);
+        }
+
         if (unlikely(addr == HW_ACCESS_ELP_CTRL_REG)) {
                 sdio_f0_writeb(func, ((u8 *)buf)[0], addr, &ret);
                 dev_dbg(child->parent, "sdio write 52 addr 0x%x, byte 0x%02x\n",
@@ -196,6 +214,7 @@ static int __devinit wl1271_probe(struct sdio_func *func,
         struct resource res[1];
         mmc_pm_flag_t mmcflags;
         int ret = -ENOMEM;
+        const char *chip_family;
 
         /* We are only able to handle the wlan function */
         if (func->num != 0x02)
@@ -236,7 +255,18 @@ static int __devinit wl1271_probe(struct sdio_func *func,
         /* Tell PM core that we don't need the card to be powered now */
         pm_runtime_put_noidle(&func->dev);
 
-        glue->core = platform_device_alloc("wl12xx", -1);
+        /*
+         * Due to a hardware bug, we can't differentiate wl18xx from
+         * wl12xx, because both report the same device ID.  The only
+         * way to differentiate is by checking the SDIO revision,
+         * which is 3.00 on the wl18xx chips.
+         */
+        if (func->card->cccr.sdio_vsn == SDIO_SDIO_REV_3_00)
+                chip_family = "wl18xx";
+        else
+                chip_family = "wl12xx";
+
+        glue->core = platform_device_alloc(chip_family, -1);
         if (!glue->core) {
                 dev_err(glue->dev, "can't allocate platform_device");
                 ret = -ENOMEM;
@@ -367,6 +397,9 @@ static void __exit wl1271_exit(void)
 module_init(wl1271_init);
 module_exit(wl1271_exit);
 
+module_param(dump, bool, S_IRUSR | S_IWUSR);
+MODULE_PARM_DESC(dump, "Enable sdio read/write dumps.");
+
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Luciano Coelho <coelho@ti.com>");
 MODULE_AUTHOR("Juuso Oikarinen <juuso.oikarinen@nokia.com>");
diff --git a/drivers/net/wireless/ti/wlcore/tx.c b/drivers/net/wireless/ti/wlcore/tx.c
index 6893bc207994..6983e7a829d0 100644
--- a/drivers/net/wireless/ti/wlcore/tx.c
+++ b/drivers/net/wireless/ti/wlcore/tx.c
@@ -72,7 +72,7 @@ static int wl1271_alloc_tx_id(struct wl1271 *wl, struct sk_buff *skb)
         return id;
 }
 
-static void wl1271_free_tx_id(struct wl1271 *wl, int id)
+void wl1271_free_tx_id(struct wl1271 *wl, int id)
 {
         if (__test_and_clear_bit(id, wl->tx_frames_map)) {
                 if (unlikely(wl->tx_frames_cnt == wl->num_tx_desc))
@@ -82,6 +82,7 @@ static void wl1271_free_tx_id(struct wl1271 *wl, int id)
                 wl->tx_frames_cnt--;
         }
 }
+EXPORT_SYMBOL(wl1271_free_tx_id);
 
 static void wl1271_tx_ap_update_inconnection_sta(struct wl1271 *wl,
                                                  struct sk_buff *skb)
@@ -127,6 +128,7 @@ bool wl12xx_is_dummy_packet(struct wl1271 *wl, struct sk_buff *skb)
 {
         return wl->dummy_packet == skb;
 }
+EXPORT_SYMBOL(wl12xx_is_dummy_packet);
 
 u8 wl12xx_tx_get_hlid_ap(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                          struct sk_buff *skb)
@@ -146,10 +148,10 @@ u8 wl12xx_tx_get_hlid_ap(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                         return wl->system_hlid;
 
                 hdr = (struct ieee80211_hdr *)skb->data;
-                if (ieee80211_is_mgmt(hdr->frame_control))
-                        return wlvif->ap.global_hlid;
-                else
+                if (is_multicast_ether_addr(ieee80211_get_DA(hdr)))
                         return wlvif->ap.bcast_hlid;
+                else
+                        return wlvif->ap.global_hlid;
         }
 }
 
@@ -176,37 +178,34 @@ u8 wl12xx_tx_get_hlid(struct wl1271 *wl, struct wl12xx_vif *wlvif,
 unsigned int wlcore_calc_packet_alignment(struct wl1271 *wl,
                                           unsigned int packet_length)
 {
-        if (wl->quirks & WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN)
-                return ALIGN(packet_length, WL12XX_BUS_BLOCK_SIZE);
-        else
+        if ((wl->quirks & WLCORE_QUIRK_TX_PAD_LAST_FRAME) ||
+            !(wl->quirks & WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN))
                 return ALIGN(packet_length, WL1271_TX_ALIGN_TO);
+        else
+                return ALIGN(packet_length, WL12XX_BUS_BLOCK_SIZE);
 }
 EXPORT_SYMBOL(wlcore_calc_packet_alignment);
 
 static int wl1271_tx_allocate(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                               struct sk_buff *skb, u32 extra, u32 buf_offset,
-                              u8 hlid)
+                              u8 hlid, bool is_gem)
 {
         struct wl1271_tx_hw_descr *desc;
         u32 total_len = skb->len + sizeof(struct wl1271_tx_hw_descr) + extra;
         u32 total_blocks;
         int id, ret = -EBUSY, ac;
-        u32 spare_blocks = wl->normal_tx_spare;
-        bool is_dummy = false;
+        u32 spare_blocks;
 
         if (buf_offset + total_len > WL1271_AGGR_BUFFER_SIZE)
                 return -EAGAIN;
 
+        spare_blocks = wlcore_hw_get_spare_blocks(wl, is_gem);
+
         /* allocate free identifier for the packet */
         id = wl1271_alloc_tx_id(wl, skb);
         if (id < 0)
                 return id;
 
-        if (unlikely(wl12xx_is_dummy_packet(wl, skb)))
-                is_dummy = true;
-        else if (wlvif->is_gem)
-                spare_blocks = wl->gem_tx_spare;
-
         total_blocks = wlcore_hw_calc_tx_blocks(wl, total_len, spare_blocks);
 
         if (total_blocks <= wl->tx_blocks_available) {
@@ -228,7 +227,7 @@ static int wl1271_tx_allocate(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                 ac = wl1271_tx_get_queue(skb_get_queue_mapping(skb));
                 wl->tx_allocated_pkts[ac]++;
 
-                if (!is_dummy && wlvif &&
+                if (!wl12xx_is_dummy_packet(wl, skb) && wlvif &&
                     wlvif->bss_type == BSS_TYPE_AP_BSS &&
                     test_bit(hlid, wlvif->ap.sta_hlid_map))
                         wl->links[hlid].allocated_pkts++;
@@ -268,6 +267,7 @@ static void wl1271_tx_fill_hdr(struct wl1271 *wl, struct wl12xx_vif *wlvif,
         if (extra) {
                 int hdrlen = ieee80211_hdrlen(frame_control);
                 memmove(frame_start, hdr, hdrlen);
+                skb_set_network_header(skb, skb_network_offset(skb) + extra);
         }
 
         /* configure packet life time */
@@ -330,9 +330,9 @@ static void wl1271_tx_fill_hdr(struct wl1271 *wl, struct wl12xx_vif *wlvif,
             ieee80211_has_protected(frame_control))
                 tx_attr |= TX_HW_ATTR_HOST_ENCRYPT;
 
-        desc->reserved = 0;
         desc->tx_attr = cpu_to_le16(tx_attr);
 
+        wlcore_hw_set_tx_desc_csum(wl, desc, skb);
         wlcore_hw_set_tx_desc_data_len(wl, desc, skb);
 }
 
@@ -346,6 +346,7 @@ static int wl1271_prepare_tx_frame(struct wl1271 *wl, struct wl12xx_vif *wlvif,
         u32 total_len;
         u8 hlid;
         bool is_dummy;
+        bool is_gem = false;
 
         if (!skb)
                 return -EINVAL;
@@ -355,7 +356,8 @@ static int wl1271_prepare_tx_frame(struct wl1271 *wl, struct wl12xx_vif *wlvif,
         /* TODO: handle dummy packets on multi-vifs */
         is_dummy = wl12xx_is_dummy_packet(wl, skb);
 
-        if (info->control.hw_key &&
+        if ((wl->quirks & WLCORE_QUIRK_TKIP_HEADER_SPACE) &&
+            info->control.hw_key &&
             info->control.hw_key->cipher == WLAN_CIPHER_SUITE_TKIP)
                 extra = WL1271_EXTRA_SPACE_TKIP;
 
@@ -373,6 +375,8 @@ static int wl1271_prepare_tx_frame(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                                 return ret;
                         wlvif->default_key = idx;
                 }
+
+                is_gem = (cipher == WL1271_CIPHER_SUITE_GEM);
         }
         hlid = wl12xx_tx_get_hlid(wl, wlvif, skb);
         if (hlid == WL12XX_INVALID_LINK_ID) {
@@ -380,7 +384,8 @@ static int wl1271_prepare_tx_frame(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                 return -EINVAL;
         }
 
-        ret = wl1271_tx_allocate(wl, wlvif, skb, extra, buf_offset, hlid);
+        ret = wl1271_tx_allocate(wl, wlvif, skb, extra, buf_offset, hlid,
+                                 is_gem);
         if (ret < 0)
                 return ret;
 
@@ -425,10 +430,10 @@ u32 wl1271_tx_enabled_rates_get(struct wl1271 *wl, u32 rate_set,
                 rate_set >>= 1;
         }
 
-        /* MCS rates indication are on bits 16 - 23 */
+        /* MCS rates indication are on bits 16 - 31 */
         rate_set >>= HW_HT_RATES_OFFSET - band->n_bitrates;
 
-        for (bit = 0; bit < 8; bit++) {
+        for (bit = 0; bit < 16; bit++) {
                 if (rate_set & 0x1)
                         enabled_rates |= (CONF_HW_BIT_RATE_MCS_0 << bit);
                 rate_set >>= 1;
@@ -439,18 +444,15 @@ u32 wl1271_tx_enabled_rates_get(struct wl1271 *wl, u32 rate_set,
 
 void wl1271_handle_tx_low_watermark(struct wl1271 *wl)
 {
-        unsigned long flags;
         int i;
 
         for (i = 0; i < NUM_TX_QUEUES; i++) {
-                if (test_bit(i, &wl->stopped_queues_map) &&
+                if (wlcore_is_queue_stopped_by_reason(wl, i,
+                        WLCORE_QUEUE_STOP_REASON_WATERMARK) &&
                     wl->tx_queue_count[i] <= WL1271_TX_QUEUE_LOW_WATERMARK) {
                         /* firmware buffer has space, restart queues */
-                        spin_lock_irqsave(&wl->wl_lock, flags);
-                        ieee80211_wake_queue(wl->hw,
-                                             wl1271_tx_get_mac80211_queue(i));
-                        clear_bit(i, &wl->stopped_queues_map);
-                        spin_unlock_irqrestore(&wl->wl_lock, flags);
+                        wlcore_wake_queue(wl, i,
+                                          WLCORE_QUEUE_STOP_REASON_WATERMARK);
                 }
         }
 }
@@ -661,7 +663,7 @@ void wl1271_tx_work_locked(struct wl1271 *wl)
         struct wl12xx_vif *wlvif;
         struct sk_buff *skb;
         struct wl1271_tx_hw_descr *desc;
-        u32 buf_offset = 0;
+        u32 buf_offset = 0, last_len = 0;
         bool sent_packets = false;
         unsigned long active_hlids[BITS_TO_LONGS(WL12XX_MAX_LINKS)] = {0};
         int ret;
@@ -685,6 +687,9 @@ void wl1271_tx_work_locked(struct wl1271 *wl)
                          * Flush buffer and try again.
                          */
                         wl1271_skb_queue_head(wl, wlvif, skb);
+
+                        buf_offset = wlcore_hw_pre_pkt_send(wl, buf_offset,
+                                                            last_len);
                         wlcore_write_data(wl, REG_SLV_MEM_DATA, wl->aggr_buf,
                                           buf_offset, true);
                         sent_packets = true;
@@ -710,7 +715,8 @@ void wl1271_tx_work_locked(struct wl1271 *wl)
                                 ieee80211_free_txskb(wl->hw, skb);
                         goto out_ack;
                 }
-                buf_offset += ret;
+                last_len = ret;
+                buf_offset += last_len;
                 wl->tx_packets_count++;
                 if (has_data) {
                         desc = (struct wl1271_tx_hw_descr *) skb->data;
@@ -720,6 +726,7 @@ void wl1271_tx_work_locked(struct wl1271 *wl)
 
 out_ack:
         if (buf_offset) {
+                buf_offset = wlcore_hw_pre_pkt_send(wl, buf_offset, last_len);
                 wlcore_write_data(wl, REG_SLV_MEM_DATA, wl->aggr_buf,
                                   buf_offset, true);
                 sent_packets = true;
@@ -849,7 +856,8 @@ static void wl1271_tx_complete_packet(struct wl1271 *wl,
         skb_pull(skb, sizeof(struct wl1271_tx_hw_descr));
 
         /* remove TKIP header space if present */
-        if (info->control.hw_key &&
+        if ((wl->quirks & WLCORE_QUIRK_TKIP_HEADER_SPACE) &&
+            info->control.hw_key &&
             info->control.hw_key->cipher == WLAN_CIPHER_SUITE_TKIP) {
                 int hdrlen = ieee80211_get_hdrlen_from_skb(skb);
                 memmove(skb->data + WL1271_EXTRA_SPACE_TKIP, skb->data,
@@ -958,7 +966,7 @@ void wl12xx_tx_reset_wlvif(struct wl1271 *wl, struct wl12xx_vif *wlvif)
 
 }
 /* caller must hold wl->mutex and TX must be stopped */
-void wl12xx_tx_reset(struct wl1271 *wl, bool reset_tx_queues)
+void wl12xx_tx_reset(struct wl1271 *wl)
 {
         int i;
         struct sk_buff *skb;
@@ -973,15 +981,12 @@ void wl12xx_tx_reset(struct wl1271 *wl, bool reset_tx_queues)
                         wl->tx_queue_count[i] = 0;
         }
 
-        wl->stopped_queues_map = 0;
-
         /*
          * Make sure the driver is at a consistent state, in case this
          * function is called from a context other than interface removal.
          * This call will always wake the TX queues.
          */
-        if (reset_tx_queues)
-                wl1271_handle_tx_low_watermark(wl);
+        wl1271_handle_tx_low_watermark(wl);
 
         for (i = 0; i < wl->num_tx_desc; i++) {
                 if (wl->tx_frames[i] == NULL)
@@ -998,7 +1003,8 @@ void wl12xx_tx_reset(struct wl1271 *wl, bool reset_tx_queues)
                          */
                         info = IEEE80211_SKB_CB(skb);
                         skb_pull(skb, sizeof(struct wl1271_tx_hw_descr));
-                        if (info->control.hw_key &&
+                        if ((wl->quirks & WLCORE_QUIRK_TKIP_HEADER_SPACE) &&
+                            info->control.hw_key &&
                             info->control.hw_key->cipher ==
                             WLAN_CIPHER_SUITE_TKIP) {
                                 int hdrlen = ieee80211_get_hdrlen_from_skb(skb);
@@ -1024,6 +1030,11 @@ void wl1271_tx_flush(struct wl1271 *wl)
         int i;
         timeout = jiffies + usecs_to_jiffies(WL1271_TX_FLUSH_TIMEOUT);
 
+        /* only one flush should be in progress, for consistent queue state */
+        mutex_lock(&wl->flush_mutex);
+
+        wlcore_stop_queues(wl, WLCORE_QUEUE_STOP_REASON_FLUSH);
+
         while (!time_after(jiffies, timeout)) {
                 mutex_lock(&wl->mutex);
                 wl1271_debug(DEBUG_TX, "flushing tx buffer: %d %d",
@@ -1032,7 +1043,7 @@ void wl1271_tx_flush(struct wl1271 *wl)
                 if ((wl->tx_frames_cnt == 0) &&
                     (wl1271_tx_total_queue_count(wl) == 0)) {
                         mutex_unlock(&wl->mutex);
-                        return;
+                        goto out;
                 }
                 mutex_unlock(&wl->mutex);
                 msleep(1);
@@ -1045,7 +1056,12 @@ void wl1271_tx_flush(struct wl1271 *wl)
         for (i = 0; i < WL12XX_MAX_LINKS; i++)
                 wl1271_tx_reset_link_queues(wl, i);
         mutex_unlock(&wl->mutex);
+
+out:
+        wlcore_wake_queues(wl, WLCORE_QUEUE_STOP_REASON_FLUSH);
+        mutex_unlock(&wl->flush_mutex);
 }
+EXPORT_SYMBOL_GPL(wl1271_tx_flush);
 
 u32 wl1271_tx_min_rate_get(struct wl1271 *wl, u32 rate_set)
 {
@@ -1054,3 +1070,96 @@ u32 wl1271_tx_min_rate_get(struct wl1271 *wl, u32 rate_set)
 
         return BIT(__ffs(rate_set));
 }
+
+void wlcore_stop_queue_locked(struct wl1271 *wl, u8 queue,
+                              enum wlcore_queue_stop_reason reason)
+{
+        bool stopped = !!wl->queue_stop_reasons[queue];
+
+        /* queue should not be stopped for this reason */
+        WARN_ON(test_and_set_bit(reason, &wl->queue_stop_reasons[queue]));
+
+        if (stopped)
+                return;
+
+        ieee80211_stop_queue(wl->hw, wl1271_tx_get_mac80211_queue(queue));
+}
+
+void wlcore_stop_queue(struct wl1271 *wl, u8 queue,
+                       enum wlcore_queue_stop_reason reason)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&wl->wl_lock, flags);
+        wlcore_stop_queue_locked(wl, queue, reason);
+        spin_unlock_irqrestore(&wl->wl_lock, flags);
+}
+
+void wlcore_wake_queue(struct wl1271 *wl, u8 queue,
+                       enum wlcore_queue_stop_reason reason)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&wl->wl_lock, flags);
+
+        /* queue should not be clear for this reason */
+        WARN_ON(!test_and_clear_bit(reason, &wl->queue_stop_reasons[queue]));
+
+        if (wl->queue_stop_reasons[queue])
+                goto out;
+
+        ieee80211_wake_queue(wl->hw, wl1271_tx_get_mac80211_queue(queue));
+
+out:
+        spin_unlock_irqrestore(&wl->wl_lock, flags);
+}
+
+void wlcore_stop_queues(struct wl1271 *wl,
+                        enum wlcore_queue_stop_reason reason)
+{
+        int i;
+
+        for (i = 0; i < NUM_TX_QUEUES; i++)
+                wlcore_stop_queue(wl, i, reason);
+}
+EXPORT_SYMBOL_GPL(wlcore_stop_queues);
+
+void wlcore_wake_queues(struct wl1271 *wl,
+                        enum wlcore_queue_stop_reason reason)
+{
+        int i;
+
+        for (i = 0; i < NUM_TX_QUEUES; i++)
+                wlcore_wake_queue(wl, i, reason);
+}
+EXPORT_SYMBOL_GPL(wlcore_wake_queues);
+
+void wlcore_reset_stopped_queues(struct wl1271 *wl)
+{
+        int i;
+        unsigned long flags;
+
+        spin_lock_irqsave(&wl->wl_lock, flags);
+
+        for (i = 0; i < NUM_TX_QUEUES; i++) {
+                if (!wl->queue_stop_reasons[i])
+                        continue;
+
+                wl->queue_stop_reasons[i] = 0;
+                ieee80211_wake_queue(wl->hw,
+                                     wl1271_tx_get_mac80211_queue(i));
+        }
+
+        spin_unlock_irqrestore(&wl->wl_lock, flags);
+}
+
+bool wlcore_is_queue_stopped_by_reason(struct wl1271 *wl, u8 queue,
+                             enum wlcore_queue_stop_reason reason)
+{
+        return test_bit(reason, &wl->queue_stop_reasons[queue]);
+}
+
+bool wlcore_is_queue_stopped(struct wl1271 *wl, u8 queue)
+{
+        return !!wl->queue_stop_reasons[queue];
+}
diff --git a/drivers/net/wireless/ti/wlcore/tx.h b/drivers/net/wireless/ti/wlcore/tx.h
index 2fd6e5dc6f75..fa4be1b91135 100644
--- a/drivers/net/wireless/ti/wlcore/tx.h
+++ b/drivers/net/wireless/ti/wlcore/tx.h
@@ -85,6 +85,19 @@ struct wl128x_tx_mem {
         u8 extra_bytes;
 } __packed;
 
+struct wl18xx_tx_mem {
+        /*
+         * Total number of memory blocks allocated by the host for
+         * this packet.
+         */
+        u8 total_mem_blocks;
+
+        /*
+         * control bits
+         */
+        u8 ctrl;
+} __packed;
+
 /*
  * On wl128x based devices, when TX packets are aggregated, each packet
  * size must be aligned to the SDIO block size. The maximum block size
@@ -100,6 +113,7 @@ struct wl1271_tx_hw_descr {
         union {
                 struct wl127x_tx_mem wl127x_mem;
                 struct wl128x_tx_mem wl128x_mem;
+                struct wl18xx_tx_mem wl18xx_mem;
         } __packed;
         /* Device time (in us) when the packet arrived to the driver */
         __le32 start_time;
@@ -116,7 +130,16 @@ struct wl1271_tx_hw_descr {
         u8 tid;
         /* host link ID (HLID) */
         u8 hlid;
-        u8 reserved;
+
+        union {
+                u8 wl12xx_reserved;
+
+                /*
+                 * bit 0   -> 0 = udp, 1 = tcp
+                 * bit 1:7 -> IP header offset
+                 */
+                u8 wl18xx_checksum_data;
+        } __packed;
 } __packed;
 
 enum wl1271_tx_hw_res_status {
@@ -161,6 +184,13 @@ struct wl1271_tx_hw_res_if {
         struct wl1271_tx_hw_res_descr tx_results_queue[TX_HW_RESULT_QUEUE_LEN];
 } __packed;
 
+enum wlcore_queue_stop_reason {
+        WLCORE_QUEUE_STOP_REASON_WATERMARK,
+        WLCORE_QUEUE_STOP_REASON_FW_RESTART,
+        WLCORE_QUEUE_STOP_REASON_FLUSH,
+        WLCORE_QUEUE_STOP_REASON_SPARE_BLK, /* 18xx specific */
+};
+
 static inline int wl1271_tx_get_queue(int queue)
 {
         switch (queue) {
@@ -207,7 +237,7 @@ void wl1271_tx_work(struct work_struct *work);
 void wl1271_tx_work_locked(struct wl1271 *wl);
 void wl1271_tx_complete(struct wl1271 *wl);
 void wl12xx_tx_reset_wlvif(struct wl1271 *wl, struct wl12xx_vif *wlvif);
-void wl12xx_tx_reset(struct wl1271 *wl, bool reset_tx_queues);
+void wl12xx_tx_reset(struct wl1271 *wl);
 void wl1271_tx_flush(struct wl1271 *wl);
 u8 wlcore_rate_to_idx(struct wl1271 *wl, u8 rate, enum ieee80211_band band);
 u32 wl1271_tx_enabled_rates_get(struct wl1271 *wl, u32 rate_set,
@@ -223,6 +253,21 @@ bool wl12xx_is_dummy_packet(struct wl1271 *wl, struct sk_buff *skb);
 void wl12xx_rearm_rx_streaming(struct wl1271 *wl, unsigned long *active_hlids);
 unsigned int wlcore_calc_packet_alignment(struct wl1271 *wl,
                                           unsigned int packet_length);
+void wl1271_free_tx_id(struct wl1271 *wl, int id);
+void wlcore_stop_queue_locked(struct wl1271 *wl, u8 queue,
+                              enum wlcore_queue_stop_reason reason);
+void wlcore_stop_queue(struct wl1271 *wl, u8 queue,
+                       enum wlcore_queue_stop_reason reason);
+void wlcore_wake_queue(struct wl1271 *wl, u8 queue,
+                       enum wlcore_queue_stop_reason reason);
+void wlcore_stop_queues(struct wl1271 *wl,
+                        enum wlcore_queue_stop_reason reason);
+void wlcore_wake_queues(struct wl1271 *wl,
+                        enum wlcore_queue_stop_reason reason);
+void wlcore_reset_stopped_queues(struct wl1271 *wl);
+bool wlcore_is_queue_stopped_by_reason(struct wl1271 *wl, u8 queue,
+                                       enum wlcore_queue_stop_reason reason);
+bool wlcore_is_queue_stopped(struct wl1271 *wl, u8 queue);
 
 /* from main.c */
 void wl1271_free_sta(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 hlid);
diff --git a/drivers/net/wireless/ti/wlcore/wlcore.h b/drivers/net/wireless/ti/wlcore/wlcore.h
index 0b3f0b586f4b..761a72f4b8d1 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore.h
@@ -24,8 +24,9 @@
 
 #include <linux/platform_device.h>
 
-#include "wl12xx.h"
+#include "wlcore_i.h"
 #include "event.h"
+#include "boot.h"
 
 /* The maximum number of Tx descriptors in all chip families */
 #define WLCORE_MAX_TX_DESCRIPTORS 32
@@ -33,11 +34,13 @@
 /* forward declaration */
 struct wl1271_tx_hw_descr;
 enum wl_rx_buf_align;
+struct wl1271_rx_descriptor;
 
 struct wlcore_ops {
         int (*identify_chip)(struct wl1271 *wl);
         int (*identify_fw)(struct wl1271 *wl);
         int (*boot)(struct wl1271 *wl);
+        int (*plt_init)(struct wl1271 *wl);
         void (*trigger_cmd)(struct wl1271 *wl, int cmd_box_addr,
                             void *buf, size_t len);
         void (*ack_event)(struct wl1271 *wl);
@@ -61,6 +64,23 @@ struct wlcore_ops {
                                     struct wl12xx_vif *wlvif);
         s8 (*get_pg_ver)(struct wl1271 *wl);
         void (*get_mac)(struct wl1271 *wl);
+        void (*set_tx_desc_csum)(struct wl1271 *wl,
+                                 struct wl1271_tx_hw_descr *desc,
+                                 struct sk_buff *skb);
+        void (*set_rx_csum)(struct wl1271 *wl,
+                            struct wl1271_rx_descriptor *desc,
+                            struct sk_buff *skb);
+        u32 (*ap_get_mimo_wide_rate_mask)(struct wl1271 *wl,
+                                          struct wl12xx_vif *wlvif);
+        int (*debugfs_init)(struct wl1271 *wl, struct dentry *rootdir);
+        int (*handle_static_data)(struct wl1271 *wl,
+                                  struct wl1271_static_data *static_data);
+        int (*get_spare_blocks)(struct wl1271 *wl, bool is_gem);
+        int (*set_key)(struct wl1271 *wl, enum set_key_cmd cmd,
+                       struct ieee80211_vif *vif,
+                       struct ieee80211_sta *sta,
+                       struct ieee80211_key_conf *key_conf);
+        u32 (*pre_pkt_send)(struct wl1271 *wl, u32 buf_offset, u32 last_len);
 };
 
 enum wlcore_partitions {
@@ -109,6 +129,15 @@ enum wlcore_registers {
         REG_TABLE_LEN,
 };
 
+struct wl1271_stats {
+        void *fw_stats;
+        unsigned long fw_stats_update;
+        size_t fw_stats_len;
+
+        unsigned int retry_count;
+        unsigned int excessive_retries;
+};
+
 struct wl1271 {
         struct ieee80211_hw *hw;
         bool mac80211_registered;
@@ -121,7 +150,6 @@ struct wl1271 {
 
         void (*set_power)(bool enable);
         int irq;
-        int ref_clock;
 
         spinlock_t wl_lock;
 
@@ -186,7 +214,7 @@ struct wl1271 {
 
         /* Frames scheduled for transmission, not handled yet */
         int tx_queue_count[NUM_TX_QUEUES];
-        long stopped_queues_map;
+        unsigned long queue_stop_reasons[NUM_TX_QUEUES];
 
         /* Frames received, not handled yet by mac80211 */
         struct sk_buff_head deferred_rx_queue;
@@ -205,9 +233,6 @@ struct wl1271 {
         /* FW Rx counter */
         u32 rx_counter;
 
-        /* Rx memory pool address */
-        struct wl1271_rx_mem_pool_addr rx_mem_pool_addr;
-
         /* Intermediate buffer, used for packet aggregation */
         u8 *aggr_buf;
 
@@ -228,6 +253,7 @@ struct wl1271 {
 
         /* Hardware recovery work */
         struct work_struct recovery_work;
+        bool watchdog_recovery;
 
         /* Pointer that holds DMA-friendly block for the mailbox */
         struct event_mailbox *mbox;
@@ -263,7 +289,8 @@ struct wl1271 {
         u32 buffer_cmd;
         u32 buffer_busyword[WL1271_BUSY_WORD_CNT];
 
-        struct wl_fw_status *fw_status;
+        struct wl_fw_status_1 *fw_status_1;
+        struct wl_fw_status_2 *fw_status_2;
         struct wl1271_tx_hw_res_if *tx_res_if;
 
         /* Current chipset configuration */
@@ -279,8 +306,6 @@ struct wl1271 {
         /* bands supported by this instance of wl12xx */
         struct ieee80211_supported_band bands[IEEE80211_NUM_BANDS];
 
-        int tcxo_clock;
-
         /*
          * wowlan trigger was configured during suspend.
          * (currently, only "ANY" trigger is supported)
@@ -333,10 +358,8 @@ struct wl1271 {
 
         /* number of TX descriptors the HW supports. */
         u32 num_tx_desc;
-
-        /* spare Tx blocks for normal/GEM operating modes */
-        u32 normal_tx_spare;
-        u32 gem_tx_spare;
+        /* number of RX descriptors the HW supports. */
+        u32 num_rx_desc;
 
         /* translate HW Tx rates to standard rate-indices */
         const u8 **band_rate_to_idx;
@@ -348,19 +371,32 @@ struct wl1271 {
         u8 hw_min_ht_rate;
 
         /* HW HT (11n) capabilities */
-        struct ieee80211_sta_ht_cap ht_cap;
+        struct ieee80211_sta_ht_cap ht_cap[IEEE80211_NUM_BANDS];
 
         /* size of the private FW status data */
         size_t fw_status_priv_len;
 
         /* RX Data filter rule state - enabled/disabled */
         bool rx_filter_enabled[WL1271_MAX_RX_FILTERS];
+
+        /* size of the private static data */
+        size_t static_data_priv_len;
+
+        /* the current channel type */
+        enum nl80211_channel_type channel_type;
+
+        /* mutex for protecting the tx_flush function */
+        struct mutex flush_mutex;
 };
 
 int __devinit wlcore_probe(struct wl1271 *wl, struct platform_device *pdev);
 int __devexit wlcore_remove(struct platform_device *pdev);
 struct ieee80211_hw *wlcore_alloc_hw(size_t priv_size);
 int wlcore_free_hw(struct wl1271 *wl);
+int wlcore_set_key(struct wl1271 *wl, enum set_key_cmd cmd,
+                   struct ieee80211_vif *vif,
+                   struct ieee80211_sta *sta,
+                   struct ieee80211_key_conf *key_conf);
 
 /* Firmware image load chunk size */
 #define CHUNK_SIZE      16384
@@ -385,6 +421,12 @@ int wlcore_free_hw(struct wl1271 *wl);
 /* Some firmwares may not support ELP */
 #define WLCORE_QUIRK_NO_ELP                     BIT(6)
 
+/* pad only the last frame in the aggregate buffer */
+#define WLCORE_QUIRK_TX_PAD_LAST_FRAME          BIT(7)
+
+/* extra header space is required for TKIP */
+#define WLCORE_QUIRK_TKIP_HEADER_SPACE          BIT(8)
+
 /* TODO: move to the lower drivers when all usages are abstracted */
 #define CHIP_ID_1271_PG10              (0x4030101)
 #define CHIP_ID_1271_PG20              (0x4030111)
diff --git a/drivers/net/wireless/ti/wlcore/wl12xx.h b/drivers/net/wireless/ti/wlcore/wlcore_i.h
index f12bdf745180..8260b1e9288a 100644
--- a/drivers/net/wireless/ti/wlcore/wl12xx.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore_i.h
@@ -22,8 +22,8 @@
  *
  */
 
-#ifndef __WL12XX_H__
-#define __WL12XX_H__
+#ifndef __WLCORE_I_H__
+#define __WLCORE_I_H__
 
 #include <linux/mutex.h>
 #include <linux/completion.h>
@@ -89,7 +89,7 @@
 #define WL1271_AP_BSS_INDEX        0
 #define WL1271_AP_DEF_BEACON_EXP   20
 
-#define WL1271_AGGR_BUFFER_SIZE (4 * PAGE_SIZE)
+#define WL1271_AGGR_BUFFER_SIZE (5 * PAGE_SIZE)
 
 enum wl1271_state {
         WL1271_STATE_OFF,
@@ -132,16 +132,7 @@ struct wl1271_chip {
         unsigned int fw_ver[NUM_FW_VER];
 };
 
-struct wl1271_stats {
-        struct acx_statistics *fw_stats;
-        unsigned long fw_stats_update;
-
-        unsigned int retry_count;
-        unsigned int excessive_retries;
-};
-
 #define NUM_TX_QUEUES              4
-#define NUM_RX_PKT_DESC            8
 
 #define AP_MAX_STATIONS            8
 
@@ -159,13 +150,26 @@ struct wl_fw_packet_counters {
 } __packed;
 
 /* FW status registers */
-struct wl_fw_status {
+struct wl_fw_status_1 {
         __le32 intr;
         u8  fw_rx_counter;
         u8  drv_rx_counter;
         u8  reserved;
         u8  tx_results_counter;
-        __le32 rx_pkt_descs[NUM_RX_PKT_DESC];
+        __le32 rx_pkt_descs[0];
+} __packed;
+
+/*
+ * Each HW arch has a different number of Rx descriptors.
+ * The length of the status depends on it, since it holds an array
+ * of descriptors.
+ */
+#define WLCORE_FW_STATUS_1_LEN(num_rx_desc) \
+                (sizeof(struct wl_fw_status_1) + \
+                (sizeof(((struct wl_fw_status_1 *)0)->rx_pkt_descs[0])) * \
+                num_rx_desc)
+
+struct wl_fw_status_2 {
         __le32 fw_localtime;
 
         /*
@@ -194,11 +198,6 @@ struct wl_fw_status {
         u8 priv[0];
 } __packed;
 
-struct wl1271_rx_mem_pool_addr {
-        u32 addr;
-        u32 addr_extra;
-};
-
 #define WL1271_MAX_CHANNELS 64
 struct wl1271_scan {
         struct cfg80211_scan_request *req;
@@ -367,6 +366,7 @@ struct wl12xx_vif {
         /* The current band */
         enum ieee80211_band band;
         int channel;
+        enum nl80211_channel_type channel_type;
 
         u32 bitrate_masks[IEEE80211_NUM_BANDS];
         u32 basic_rate_set;
@@ -417,9 +417,6 @@ struct wl12xx_vif {
         struct work_struct rx_streaming_disable_work;
         struct timer_list rx_streaming_timer;
 
-        /* does the current role use GEM for encryption (AP or STA) */
-        bool is_gem;
-
         /*
          * This struct must be last!
          * data that has to be saved acrossed reconfigs (e.g. recovery)
@@ -501,7 +498,8 @@ void wl1271_rx_filter_flatten_fields(struct wl12xx_rx_filter *filter,
 /* Macros to handle wl1271.sta_rate_set */
 #define HW_BG_RATES_MASK        0xffff
 #define HW_HT_RATES_OFFSET      16
+#define HW_MIMO_RATES_OFFSET    24
 
 #define WL12XX_HW_BLOCK_SIZE    256
 
-#endif
+#endif /* __WLCORE_I_H__ */
diff --git a/drivers/nfc/pn533.c b/drivers/nfc/pn533.c
index 19110f0eb15f..9ac829e22e73 100644
--- a/drivers/nfc/pn533.c
+++ b/drivers/nfc/pn533.c
@@ -45,6 +45,9 @@ static const struct usb_device_id pn533_table[] = {
 };
 MODULE_DEVICE_TABLE(usb, pn533_table);
 
+/* How much time we spend listening for initiators */
+#define PN533_LISTEN_TIME 2
+
 /* frame definitions */
 #define PN533_FRAME_TAIL_SIZE 2
 #define PN533_FRAME_SIZE(f) (sizeof(struct pn533_frame) + f->datalen + \
@@ -74,6 +77,10 @@ MODULE_DEVICE_TABLE(usb, pn533_table);
 #define PN533_CMD_IN_RELEASE 0x52
 #define PN533_CMD_IN_JUMP_FOR_DEP 0x56
 
+#define PN533_CMD_TG_INIT_AS_TARGET 0x8c
+#define PN533_CMD_TG_GET_DATA 0x86
+#define PN533_CMD_TG_SET_DATA 0x8e
+
 #define PN533_CMD_RESPONSE(cmd) (cmd + 1)
 
 /* PN533 Return codes */
@@ -81,6 +88,9 @@ MODULE_DEVICE_TABLE(usb, pn533_table);
 #define PN533_CMD_MI_MASK 0x40
 #define PN533_CMD_RET_SUCCESS 0x00
 
+/* PN533 status codes */
+#define PN533_STATUS_TARGET_RELEASED 0x29
+
 struct pn533;
 
 typedef int (*pn533_cmd_complete_t) (struct pn533 *dev, void *arg,
@@ -97,8 +107,14 @@ struct pn533_fw_version {
 };
 
 /* PN533_CMD_RF_CONFIGURATION */
+#define PN533_CFGITEM_TIMING 0x02
 #define PN533_CFGITEM_MAX_RETRIES 0x05
 
+#define PN533_CONFIG_TIMING_102 0xb
+#define PN533_CONFIG_TIMING_204 0xc
+#define PN533_CONFIG_TIMING_409 0xd
+#define PN533_CONFIG_TIMING_819 0xe
+
 #define PN533_CONFIG_MAX_RETRIES_NO_RETRY 0x00
 #define PN533_CONFIG_MAX_RETRIES_ENDLESS 0xFF
 
@@ -108,6 +124,12 @@ struct pn533_config_max_retries {
         u8 mx_rty_passive_act;
 } __packed;
 
+struct pn533_config_timing {
+        u8 rfu;
+        u8 atr_res_timeout;
+        u8 dep_timeout;
+} __packed;
+
 /* PN533_CMD_IN_LIST_PASSIVE_TARGET */
 
 /* felica commands opcode */
@@ -144,6 +166,7 @@ enum {
         PN533_POLL_MOD_424KBPS_FELICA,
         PN533_POLL_MOD_106KBPS_JEWEL,
         PN533_POLL_MOD_847KBPS_B,
+        PN533_LISTEN_MOD,
 
         __PN533_POLL_MOD_AFTER_LAST,
 };
@@ -211,6 +234,9 @@ const struct pn533_poll_modulations poll_mod[] = {
                 },
                 .len = 3,
         },
+        [PN533_LISTEN_MOD] = {
+                .len = 0,
+        },
 };
 
 /* PN533_CMD_IN_ATR */
@@ -237,7 +263,7 @@ struct pn533_cmd_jump_dep {
         u8 active;
         u8 baud;
         u8 next;
-        u8 gt[];
+        u8 data[];
 } __packed;
 
 struct pn533_cmd_jump_dep_response {
@@ -253,6 +279,29 @@ struct pn533_cmd_jump_dep_response {
         u8 gt[];
 } __packed;
 
+
+/* PN533_TG_INIT_AS_TARGET */
+#define PN533_INIT_TARGET_PASSIVE 0x1
+#define PN533_INIT_TARGET_DEP 0x2
+
+#define PN533_INIT_TARGET_RESP_FRAME_MASK 0x3
+#define PN533_INIT_TARGET_RESP_ACTIVE     0x1
+#define PN533_INIT_TARGET_RESP_DEP        0x4
+
+struct pn533_cmd_init_target {
+        u8 mode;
+        u8 mifare[6];
+        u8 felica[18];
+        u8 nfcid3[10];
+        u8 gb_len;
+        u8 gb[];
+} __packed;
+
+struct pn533_cmd_init_target_response {
+        u8 mode;
+        u8 cmd[];
+} __packed;
+
 struct pn533 {
         struct usb_device *udev;
         struct usb_interface *interface;
@@ -270,22 +319,31 @@ struct pn533 {
 
         struct workqueue_struct *wq;
         struct work_struct cmd_work;
+        struct work_struct poll_work;
         struct work_struct mi_work;
+        struct work_struct tg_work;
+        struct timer_list listen_timer;
         struct pn533_frame *wq_in_frame;
         int wq_in_error;
+        int cancel_listen;
 
         pn533_cmd_complete_t cmd_complete;
         void *cmd_complete_arg;
-        struct semaphore cmd_lock;
+        struct mutex cmd_lock;
         u8 cmd;
 
         struct pn533_poll_modulations *poll_mod_active[PN533_POLL_MOD_MAX + 1];
         u8 poll_mod_count;
         u8 poll_mod_curr;
         u32 poll_protocols;
+        u32 listen_protocols;
+
+        u8 *gb;
+        size_t gb_len;
 
         u8 tgt_available_prots;
         u8 tgt_active_prot;
+        u8 tgt_mode;
 };
 
 struct pn533_frame {
@@ -405,7 +463,7 @@ static void pn533_wq_cmd_complete(struct work_struct *work)
                                         PN533_FRAME_CMD_PARAMS_LEN(in_frame));
 
         if (rc != -EINPROGRESS)
-                up(&dev->cmd_lock);
+                mutex_unlock(&dev->cmd_lock);
 }
 
 static void pn533_recv_response(struct urb *urb)
@@ -583,7 +641,7 @@ static int pn533_send_cmd_frame_async(struct pn533 *dev,
 
         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 
-        if (down_trylock(&dev->cmd_lock))
+        if (!mutex_trylock(&dev->cmd_lock))
                 return -EBUSY;
 
         rc = __pn533_send_cmd_frame_async(dev, out_frame, in_frame,
@@ -593,7 +651,7 @@ static int pn533_send_cmd_frame_async(struct pn533 *dev,
 
         return 0;
 error:
-        up(&dev->cmd_lock);
+        mutex_unlock(&dev->cmd_lock);
         return rc;
 }
 
@@ -963,6 +1021,11 @@ static int pn533_target_found(struct pn533 *dev,
         return 0;
 }
 
+static inline void pn533_poll_next_mod(struct pn533 *dev)
+{
+        dev->poll_mod_curr = (dev->poll_mod_curr + 1) % dev->poll_mod_count;
+}
+
 static void pn533_poll_reset_mod_list(struct pn533 *dev)
 {
         dev->poll_mod_count = 0;
@@ -975,102 +1038,283 @@ static void pn533_poll_add_mod(struct pn533 *dev, u8 mod_index)
         dev->poll_mod_count++;
 }
 
-static void pn533_poll_create_mod_list(struct pn533 *dev, u32 protocols)
+static void pn533_poll_create_mod_list(struct pn533 *dev,
+                                       u32 im_protocols, u32 tm_protocols)
 {
         pn533_poll_reset_mod_list(dev);
 
-        if (protocols & NFC_PROTO_MIFARE_MASK
-                                        || protocols & NFC_PROTO_ISO14443_MASK
-                                        || protocols & NFC_PROTO_NFC_DEP_MASK)
+        if (im_protocols & NFC_PROTO_MIFARE_MASK
+            || im_protocols & NFC_PROTO_ISO14443_MASK
+            || im_protocols & NFC_PROTO_NFC_DEP_MASK)
                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_A);
 
-        if (protocols & NFC_PROTO_FELICA_MASK
-                                        || protocols & NFC_PROTO_NFC_DEP_MASK) {
+        if (im_protocols & NFC_PROTO_FELICA_MASK
+            || im_protocols & NFC_PROTO_NFC_DEP_MASK) {
                 pn533_poll_add_mod(dev, PN533_POLL_MOD_212KBPS_FELICA);
                 pn533_poll_add_mod(dev, PN533_POLL_MOD_424KBPS_FELICA);
         }
 
-        if (protocols & NFC_PROTO_JEWEL_MASK)
+        if (im_protocols & NFC_PROTO_JEWEL_MASK)
                 pn533_poll_add_mod(dev, PN533_POLL_MOD_106KBPS_JEWEL);
 
-        if (protocols & NFC_PROTO_ISO14443_MASK)
+        if (im_protocols & NFC_PROTO_ISO14443_MASK)
                 pn533_poll_add_mod(dev, PN533_POLL_MOD_847KBPS_B);
+
+        if (tm_protocols)
+                pn533_poll_add_mod(dev, PN533_LISTEN_MOD);
+}
+
+static int pn533_start_poll_complete(struct pn533 *dev, void *arg,
+                                     u8 *params, int params_len)
+{
+        struct pn533_poll_response *resp;
+        int rc;
+
+        nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
+
+        resp = (struct pn533_poll_response *) params;
+        if (resp->nbtg) {
+                rc = pn533_target_found(dev, resp, params_len);
+
+                /* We must stop the poll after a valid target found */
+                if (rc == 0) {
+                        pn533_poll_reset_mod_list(dev);
+                        return 0;
+                }
+        }
+
+        return -EAGAIN;
 }
 
-static void pn533_start_poll_frame(struct pn533_frame *frame,
-                                        struct pn533_poll_modulations *mod)
+static int pn533_init_target_frame(struct pn533_frame *frame,
+                                   u8 *gb, size_t gb_len)
 {
+        struct pn533_cmd_init_target *cmd;
+        size_t cmd_len;
+        u8 felica_params[18] = {0x1, 0xfe, /* DEP */
+                                0x0, 0x0, 0x0, 0x0, 0x0, 0x0, /* random */
+                                0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
+                                0xff, 0xff}; /* System code */
+        u8 mifare_params[6] = {0x1, 0x1, /* SENS_RES */
+                               0x0, 0x0, 0x0,
+                               0x40}; /* SEL_RES for DEP */
+
+        cmd_len = sizeof(struct pn533_cmd_init_target) + gb_len + 1;
+        cmd = kzalloc(cmd_len, GFP_KERNEL);
+        if (cmd == NULL)
+                return -ENOMEM;
+
+        pn533_tx_frame_init(frame, PN533_CMD_TG_INIT_AS_TARGET);
+
+        /* DEP support only */
+        cmd->mode |= PN533_INIT_TARGET_DEP;
+
+        /* Felica params */
+        memcpy(cmd->felica, felica_params, 18);
+        get_random_bytes(cmd->felica + 2, 6);
+
+        /* NFCID3 */
+        memset(cmd->nfcid3, 0, 10);
+        memcpy(cmd->nfcid3, cmd->felica, 8);
 
-        pn533_tx_frame_init(frame, PN533_CMD_IN_LIST_PASSIVE_TARGET);
+        /* MIFARE params */
+        memcpy(cmd->mifare, mifare_params, 6);
 
-        memcpy(PN533_FRAME_CMD_PARAMS_PTR(frame), &mod->data, mod->len);
-        frame->datalen += mod->len;
+        /* General bytes */
+        cmd->gb_len = gb_len;
+        memcpy(cmd->gb, gb, gb_len);
+
+        /* Len Tk */
+        cmd->gb[gb_len] = 0;
+
+        memcpy(PN533_FRAME_CMD_PARAMS_PTR(frame), cmd, cmd_len);
+
+        frame->datalen += cmd_len;
 
         pn533_tx_frame_finish(frame);
+
+        kfree(cmd);
+
+        return 0;
 }
 
-static int pn533_start_poll_complete(struct pn533 *dev, void *arg,
-                                                u8 *params, int params_len)
+#define PN533_CMD_DATAEXCH_HEAD_LEN (sizeof(struct pn533_frame) + 3)
+#define PN533_CMD_DATAEXCH_DATA_MAXLEN 262
+static int pn533_tm_get_data_complete(struct pn533 *dev, void *arg,
+                                      u8 *params, int params_len)
 {
-        struct pn533_poll_response *resp;
-        struct pn533_poll_modulations *next_mod;
-        int rc;
+        struct sk_buff *skb_resp = arg;
+        struct pn533_frame *in_frame = (struct pn533_frame *) skb_resp->data;
 
         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 
-        if (params_len == -ENOENT) {
-                nfc_dev_dbg(&dev->interface->dev, "Polling operation has been"
-                                                                " stopped");
-                goto stop_poll;
+        if (params_len < 0) {
+                nfc_dev_err(&dev->interface->dev,
+                            "Error %d when starting as a target",
+                            params_len);
+
+                return params_len;
         }
 
+        if (params_len > 0 && params[0] != 0) {
+                nfc_tm_deactivated(dev->nfc_dev);
+
+                dev->tgt_mode = 0;
+
+                kfree_skb(skb_resp);
+                return 0;
+        }
+
+        skb_put(skb_resp, PN533_FRAME_SIZE(in_frame));
+        skb_pull(skb_resp, PN533_CMD_DATAEXCH_HEAD_LEN);
+        skb_trim(skb_resp, skb_resp->len - PN533_FRAME_TAIL_SIZE);
+
+        return nfc_tm_data_received(dev->nfc_dev, skb_resp);
+}
+
+static void pn533_wq_tg_get_data(struct work_struct *work)
+{
+        struct pn533 *dev = container_of(work, struct pn533, tg_work);
+        struct pn533_frame *in_frame;
+        struct sk_buff *skb_resp;
+        size_t skb_resp_len;
+
+        nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
+
+        skb_resp_len = PN533_CMD_DATAEXCH_HEAD_LEN +
+                PN533_CMD_DATAEXCH_DATA_MAXLEN +
+                PN533_FRAME_TAIL_SIZE;
+
+        skb_resp = nfc_alloc_recv_skb(skb_resp_len, GFP_KERNEL);
+        if (!skb_resp)
+                return;
+
+        in_frame = (struct pn533_frame *)skb_resp->data;
+
+        pn533_tx_frame_init(dev->out_frame, PN533_CMD_TG_GET_DATA);
+        pn533_tx_frame_finish(dev->out_frame);
+
+        pn533_send_cmd_frame_async(dev, dev->out_frame, in_frame,
+                                   skb_resp_len,
+                                   pn533_tm_get_data_complete,
+                                   skb_resp, GFP_KERNEL);
+
+        return;
+}
+
+#define ATR_REQ_GB_OFFSET 17
+static int pn533_init_target_complete(struct pn533 *dev, void *arg,
+                                      u8 *params, int params_len)
+{
+        struct pn533_cmd_init_target_response *resp;
+        u8 frame, comm_mode = NFC_COMM_PASSIVE, *gb;
+        size_t gb_len;
+        int rc;
+
+        nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
+
         if (params_len < 0) {
-                nfc_dev_err(&dev->interface->dev, "Error %d when running poll",
-                                                                params_len);
-                goto stop_poll;
+                nfc_dev_err(&dev->interface->dev,
+                            "Error %d when starting as a target",
+                            params_len);
+
+                return params_len;
         }
 
-        resp = (struct pn533_poll_response *) params;
-        if (resp->nbtg) {
-                rc = pn533_target_found(dev, resp, params_len);
+        if (params_len < ATR_REQ_GB_OFFSET + 1)
+                return -EINVAL;
 
-                /* We must stop the poll after a valid target found */
-                if (rc == 0)
-                        goto stop_poll;
+        resp = (struct pn533_cmd_init_target_response *) params;
+
+        nfc_dev_dbg(&dev->interface->dev, "Target mode 0x%x param len %d\n",
+                    resp->mode, params_len);
+
+        frame = resp->mode & PN533_INIT_TARGET_RESP_FRAME_MASK;
+        if (frame == PN533_INIT_TARGET_RESP_ACTIVE)
+                comm_mode = NFC_COMM_ACTIVE;
 
-                if (rc != -EAGAIN)
-                        nfc_dev_err(&dev->interface->dev, "The target found is"
-                                        " not valid - continuing to poll");
+        /* Again, only DEP */
+        if ((resp->mode & PN533_INIT_TARGET_RESP_DEP) == 0)
+                return -EOPNOTSUPP;
+
+        gb = resp->cmd + ATR_REQ_GB_OFFSET;
+        gb_len = params_len - (ATR_REQ_GB_OFFSET + 1);
+
+        rc = nfc_tm_activated(dev->nfc_dev, NFC_PROTO_NFC_DEP_MASK,
+                              comm_mode, gb, gb_len);
+        if (rc < 0) {
+                nfc_dev_err(&dev->interface->dev,
+                            "Error when signaling target activation");
+                return rc;
         }
 
-        dev->poll_mod_curr = (dev->poll_mod_curr + 1) % dev->poll_mod_count;
+        dev->tgt_mode = 1;
 
-        next_mod = dev->poll_mod_active[dev->poll_mod_curr];
+        queue_work(dev->wq, &dev->tg_work);
 
-        nfc_dev_dbg(&dev->interface->dev, "Polling next modulation (0x%x)",
-                                                        dev->poll_mod_curr);
+        return 0;
+}
+
+static void pn533_listen_mode_timer(unsigned long data)
+{
+        struct pn533 *dev = (struct pn533 *) data;
+
+        nfc_dev_dbg(&dev->interface->dev, "Listen mode timeout");
+
+        /* An ack will cancel the last issued command (poll) */
+        pn533_send_ack(dev, GFP_ATOMIC);
+
+        dev->cancel_listen = 1;
+
+        mutex_unlock(&dev->cmd_lock);
+
+        pn533_poll_next_mod(dev);
+
+        queue_work(dev->wq, &dev->poll_work);
+}
 
-        pn533_start_poll_frame(dev->out_frame, next_mod);
+static int pn533_poll_complete(struct pn533 *dev, void *arg,
+                               u8 *params, int params_len)
+{
+        struct pn533_poll_modulations *cur_mod;
+        int rc;
 
-        /* Don't need to down the semaphore again */
-        rc = __pn533_send_cmd_frame_async(dev, dev->out_frame, dev->in_frame,
-                                dev->in_maxlen, pn533_start_poll_complete,
-                                NULL, GFP_ATOMIC);
+        nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
+
+        if (params_len == -ENOENT) {
+                if (dev->poll_mod_count != 0)
+                        return 0;
+
+                nfc_dev_err(&dev->interface->dev,
+                            "Polling operation has been stopped");
 
-        if (rc == -EPERM) {
-                nfc_dev_dbg(&dev->interface->dev, "Cannot poll next modulation"
-                                        " because poll has been stopped");
                 goto stop_poll;
         }
 
-        if (rc) {
-                nfc_dev_err(&dev->interface->dev, "Error %d when trying to poll"
-                                                        " next modulation", rc);
+        if (params_len < 0) {
+                nfc_dev_err(&dev->interface->dev,
+                            "Error %d when running poll", params_len);
+
                 goto stop_poll;
         }
 
-        /* Inform caller function to do not up the semaphore */
-        return -EINPROGRESS;
+        cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
+
+        if (cur_mod->len == 0) {
+                del_timer(&dev->listen_timer);
+
+                return pn533_init_target_complete(dev, arg, params, params_len);
+        } else {
+                rc = pn533_start_poll_complete(dev, arg, params, params_len);
+                if (!rc)
+                        return rc;
+        }
+
+        pn533_poll_next_mod(dev);
+
+        queue_work(dev->wq, &dev->poll_work);
+
+        return 0;
 
 stop_poll:
         pn533_poll_reset_mod_list(dev);
@@ -1078,61 +1322,104 @@ stop_poll:
         return 0;
 }
 
-static int pn533_start_poll(struct nfc_dev *nfc_dev, u32 protocols)
+static void pn533_build_poll_frame(struct pn533 *dev,
+                                   struct pn533_frame *frame,
+                                   struct pn533_poll_modulations *mod)
 {
-        struct pn533 *dev = nfc_get_drvdata(nfc_dev);
-        struct pn533_poll_modulations *start_mod;
-        int rc;
+        nfc_dev_dbg(&dev->interface->dev, "mod len %d\n", mod->len);
 
-        nfc_dev_dbg(&dev->interface->dev, "%s - protocols=0x%x", __func__,
-                                                                protocols);
+        if (mod->len == 0) {
+                /* Listen mode */
+                pn533_init_target_frame(frame, dev->gb, dev->gb_len);
+        } else {
+                /* Polling mode */
+                pn533_tx_frame_init(frame, PN533_CMD_IN_LIST_PASSIVE_TARGET);
 
-        if (dev->poll_mod_count) {
-                nfc_dev_err(&dev->interface->dev, "Polling operation already"
-                                                                " active");
-                return -EBUSY;
-        }
+                memcpy(PN533_FRAME_CMD_PARAMS_PTR(frame), &mod->data, mod->len);
+                frame->datalen += mod->len;
 
-        if (dev->tgt_active_prot) {
-                nfc_dev_err(&dev->interface->dev, "Cannot poll with a target"
-                                                        " already activated");
-                return -EBUSY;
+                pn533_tx_frame_finish(frame);
         }
+}
 
-        pn533_poll_create_mod_list(dev, protocols);
+static int pn533_send_poll_frame(struct pn533 *dev)
+{
+        struct pn533_poll_modulations *cur_mod;
+        int rc;
 
-        if (!dev->poll_mod_count) {
-                nfc_dev_err(&dev->interface->dev, "No valid protocols"
-                                                                " specified");
-                rc = -EINVAL;
-                goto error;
+        cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
+
+        pn533_build_poll_frame(dev, dev->out_frame, cur_mod);
+
+        rc = pn533_send_cmd_frame_async(dev, dev->out_frame, dev->in_frame,
+                                dev->in_maxlen, pn533_poll_complete,
+                                NULL, GFP_KERNEL);
+        if (rc)
+                nfc_dev_err(&dev->interface->dev, "Polling loop error %d", rc);
+
+        return rc;
+}
+
+static void pn533_wq_poll(struct work_struct *work)
+{
+        struct pn533 *dev = container_of(work, struct pn533, poll_work);
+        struct pn533_poll_modulations *cur_mod;
+        int rc;
+
+        cur_mod = dev->poll_mod_active[dev->poll_mod_curr];
+
+        nfc_dev_dbg(&dev->interface->dev,
+                    "%s cancel_listen %d modulation len %d",
+                    __func__, dev->cancel_listen, cur_mod->len);
+
+        if (dev->cancel_listen == 1) {
+                dev->cancel_listen = 0;
+                usb_kill_urb(dev->in_urb);
         }
 
-        nfc_dev_dbg(&dev->interface->dev, "It will poll %d modulations types",
-                                                        dev->poll_mod_count);
+        rc = pn533_send_poll_frame(dev);
+        if (rc)
+                return;
 
-        dev->poll_mod_curr = 0;
-        start_mod = dev->poll_mod_active[dev->poll_mod_curr];
+        if (cur_mod->len == 0 && dev->poll_mod_count > 1)
+                mod_timer(&dev->listen_timer, jiffies + PN533_LISTEN_TIME * HZ);
 
-        pn533_start_poll_frame(dev->out_frame, start_mod);
+        return;
+}
 
-        rc = pn533_send_cmd_frame_async(dev, dev->out_frame, dev->in_frame,
-                                dev->in_maxlen, pn533_start_poll_complete,
-                                NULL, GFP_KERNEL);
+static int pn533_start_poll(struct nfc_dev *nfc_dev,
+                            u32 im_protocols, u32 tm_protocols)
+{
+        struct pn533 *dev = nfc_get_drvdata(nfc_dev);
 
-        if (rc) {
-                nfc_dev_err(&dev->interface->dev, "Error %d when trying to"
-                                                        " start poll", rc);
-                goto error;
+        nfc_dev_dbg(&dev->interface->dev,
+                    "%s: im protocols 0x%x tm protocols 0x%x",
+                    __func__, im_protocols, tm_protocols);
+
+        if (dev->tgt_active_prot) {
+                nfc_dev_err(&dev->interface->dev,
+                            "Cannot poll with a target already activated");
+                return -EBUSY;
         }
 
-        dev->poll_protocols = protocols;
+        if (dev->tgt_mode) {
+                nfc_dev_err(&dev->interface->dev,
+                            "Cannot poll while already being activated");
+                return -EBUSY;
+        }
 
-        return 0;
+        if (tm_protocols) {
+                dev->gb = nfc_get_local_general_bytes(nfc_dev, &dev->gb_len);
+                if (dev->gb == NULL)
+                        tm_protocols = 0;
+        }
 
-error:
-        pn533_poll_reset_mod_list(dev);
-        return rc;
+        dev->poll_mod_curr = 0;
+        pn533_poll_create_mod_list(dev, im_protocols, tm_protocols);
+        dev->poll_protocols = im_protocols;
+        dev->listen_protocols = tm_protocols;
+
+        return pn533_send_poll_frame(dev);
 }
 
 static void pn533_stop_poll(struct nfc_dev *nfc_dev)
@@ -1141,6 +1428,8 @@ static void pn533_stop_poll(struct nfc_dev *nfc_dev)
 
         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 
+        del_timer(&dev->listen_timer);
+
         if (!dev->poll_mod_count) {
                 nfc_dev_dbg(&dev->interface->dev, "Polling operation was not"
                                                                 " running");
@@ -1152,6 +1441,8 @@ static void pn533_stop_poll(struct nfc_dev *nfc_dev)
 
         /* prevent pn533_start_poll_complete to issue a new poll meanwhile */
         usb_kill_urb(dev->in_urb);
+
+        pn533_poll_reset_mod_list(dev);
 }
 
 static int pn533_activate_target_nfcdep(struct pn533 *dev)
@@ -1349,13 +1640,29 @@ static int pn533_in_dep_link_up_complete(struct pn533 *dev, void *arg,
         return 0;
 }
 
+static int pn533_mod_to_baud(struct pn533 *dev)
+{
+        switch (dev->poll_mod_curr) {
+        case PN533_POLL_MOD_106KBPS_A:
+                return 0;
+        case PN533_POLL_MOD_212KBPS_FELICA:
+                return 1;
+        case PN533_POLL_MOD_424KBPS_FELICA:
+                return 2;
+        default:
+                return -EINVAL;
+        }
+}
+
+#define PASSIVE_DATA_LEN 5
 static int pn533_dep_link_up(struct nfc_dev *nfc_dev, struct nfc_target *target,
                              u8 comm_mode, u8* gb, size_t gb_len)
 {
         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
         struct pn533_cmd_jump_dep *cmd;
-        u8 cmd_len;
-        int rc;
+        u8 cmd_len, *data_ptr;
+        u8 passive_data[PASSIVE_DATA_LEN] = {0x00, 0xff, 0xff, 0x00, 0x3};
+        int rc, baud;
 
         nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
 
@@ -1371,7 +1678,17 @@ static int pn533_dep_link_up(struct nfc_dev *nfc_dev, struct nfc_target *target,
                 return -EBUSY;
         }
 
+        baud = pn533_mod_to_baud(dev);
+        if (baud < 0) {
+                nfc_dev_err(&dev->interface->dev,
+                            "Invalid curr modulation %d", dev->poll_mod_curr);
+                return baud;
+        }
+
         cmd_len = sizeof(struct pn533_cmd_jump_dep) + gb_len;
+        if (comm_mode == NFC_COMM_PASSIVE)
+                cmd_len += PASSIVE_DATA_LEN;
+
         cmd = kzalloc(cmd_len, GFP_KERNEL);
         if (cmd == NULL)
                 return -ENOMEM;
@@ -1379,10 +1696,18 @@ static int pn533_dep_link_up(struct nfc_dev *nfc_dev, struct nfc_target *target,
         pn533_tx_frame_init(dev->out_frame, PN533_CMD_IN_JUMP_FOR_DEP);
 
         cmd->active = !comm_mode;
-        cmd->baud = 0;
+        cmd->next = 0;
+        cmd->baud = baud;
+        data_ptr = cmd->data;
+        if (comm_mode == NFC_COMM_PASSIVE && cmd->baud > 0) {
+                memcpy(data_ptr, passive_data, PASSIVE_DATA_LEN);
+                cmd->next |= 1;
+                data_ptr += PASSIVE_DATA_LEN;
+        }
+
         if (gb != NULL && gb_len > 0) {
-                cmd->next = 4; /* We have some Gi */
-                memcpy(cmd->gt, gb, gb_len);
+                cmd->next |= 4; /* We have some Gi */
+                memcpy(data_ptr, gb, gb_len);
         } else {
                 cmd->next = 0;
         }
@@ -1407,15 +1732,25 @@ out:
 
 static int pn533_dep_link_down(struct nfc_dev *nfc_dev)
 {
-        pn533_deactivate_target(nfc_dev, 0);
+        struct pn533 *dev = nfc_get_drvdata(nfc_dev);
+
+        pn533_poll_reset_mod_list(dev);
+
+        if (dev->tgt_mode || dev->tgt_active_prot) {
+                pn533_send_ack(dev, GFP_KERNEL);
+                usb_kill_urb(dev->in_urb);
+        }
+
+        dev->tgt_active_prot = 0;
+        dev->tgt_mode = 0;
+
+        skb_queue_purge(&dev->resp_q);
 
         return 0;
 }
 
-#define PN533_CMD_DATAEXCH_HEAD_LEN (sizeof(struct pn533_frame) + 3)
-#define PN533_CMD_DATAEXCH_DATA_MAXLEN 262
-
-static int pn533_data_exchange_tx_frame(struct pn533 *dev, struct sk_buff *skb)
+static int pn533_build_tx_frame(struct pn533 *dev, struct sk_buff *skb,
+                                bool target)
 {
         int payload_len = skb->len;
         struct pn533_frame *out_frame;
@@ -1432,14 +1767,20 @@ static int pn533_data_exchange_tx_frame(struct pn533 *dev, struct sk_buff *skb)
                 return -ENOSYS;
         }
 
-        skb_push(skb, PN533_CMD_DATAEXCH_HEAD_LEN);
-        out_frame = (struct pn533_frame *) skb->data;
+        if (target == true) {
+                skb_push(skb, PN533_CMD_DATAEXCH_HEAD_LEN);
+                out_frame = (struct pn533_frame *) skb->data;
 
-        pn533_tx_frame_init(out_frame, PN533_CMD_IN_DATA_EXCHANGE);
+                pn533_tx_frame_init(out_frame, PN533_CMD_IN_DATA_EXCHANGE);
+                tg = 1;
+                memcpy(PN533_FRAME_CMD_PARAMS_PTR(out_frame), &tg, sizeof(u8));
+                out_frame->datalen += sizeof(u8);
+        } else {
+                skb_push(skb, PN533_CMD_DATAEXCH_HEAD_LEN - 1);
+                out_frame = (struct pn533_frame *) skb->data;
+                pn533_tx_frame_init(out_frame, PN533_CMD_TG_SET_DATA);
+        }
 
-        tg = 1;
-        memcpy(PN533_FRAME_CMD_PARAMS_PTR(out_frame), &tg, sizeof(u8));
-        out_frame->datalen += sizeof(u8);
 
         /* The data is already in the out_frame, just update the datalen */
         out_frame->datalen += payload_len;
@@ -1550,9 +1891,9 @@ error:
         return 0;
 }
 
-static int pn533_data_exchange(struct nfc_dev *nfc_dev,
-                               struct nfc_target *target, struct sk_buff *skb,
-                               data_exchange_cb_t cb, void *cb_context)
+static int pn533_transceive(struct nfc_dev *nfc_dev,
+                            struct nfc_target *target, struct sk_buff *skb,
+                            data_exchange_cb_t cb, void *cb_context)
 {
         struct pn533 *dev = nfc_get_drvdata(nfc_dev);
         struct pn533_frame *out_frame, *in_frame;
@@ -1570,7 +1911,7 @@ static int pn533_data_exchange(struct nfc_dev *nfc_dev,
                 goto error;
         }
 
-        rc = pn533_data_exchange_tx_frame(dev, skb);
+        rc = pn533_build_tx_frame(dev, skb, true);
         if (rc)
                 goto error;
 
@@ -1618,6 +1959,63 @@ error:
         return rc;
 }
 
+static int pn533_tm_send_complete(struct pn533 *dev, void *arg,
+                                  u8 *params, int params_len)
+{
+        nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
+
+        if (params_len < 0) {
+                nfc_dev_err(&dev->interface->dev,
+                            "Error %d when sending data",
+                            params_len);
+
+                return params_len;
+        }
+
+        if (params_len > 0 && params[0] != 0) {
+                nfc_tm_deactivated(dev->nfc_dev);
+
+                dev->tgt_mode = 0;
+
+                return 0;
+        }
+
+        queue_work(dev->wq, &dev->tg_work);
+
+        return 0;
+}
+
+static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
+{
+        struct pn533 *dev = nfc_get_drvdata(nfc_dev);
+        struct pn533_frame *out_frame;
+        int rc;
+
+        nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
+
+        rc = pn533_build_tx_frame(dev, skb, false);
+        if (rc)
+                goto error;
+
+        out_frame = (struct pn533_frame *) skb->data;
+
+        rc = pn533_send_cmd_frame_async(dev, out_frame, dev->in_frame,
+                                        dev->in_maxlen, pn533_tm_send_complete,
+                                        NULL, GFP_KERNEL);
+        if (rc) {
+                nfc_dev_err(&dev->interface->dev,
+                            "Error %d when trying to send data", rc);
+                goto error;
+        }
+
+        return 0;
+
+error:
+        kfree_skb(skb);
+
+        return rc;
+}
+
 static void pn533_wq_mi_recv(struct work_struct *work)
 {
         struct pn533 *dev = container_of(work, struct pn533, mi_work);
@@ -1638,7 +2036,7 @@ static void pn533_wq_mi_recv(struct work_struct *work)
 
         skb_reserve(skb_cmd, PN533_CMD_DATAEXCH_HEAD_LEN);
 
-        rc = pn533_data_exchange_tx_frame(dev, skb_cmd);
+        rc = pn533_build_tx_frame(dev, skb_cmd, true);
         if (rc)
                 goto error_frame;
 
@@ -1677,7 +2075,7 @@ error_cmd:
 
         kfree(arg);
 
-        up(&dev->cmd_lock);
+        mutex_unlock(&dev->cmd_lock);
 }
 
 static int pn533_set_configuration(struct pn533 *dev, u8 cfgitem, u8 *cfgdata,
@@ -1712,7 +2110,8 @@ struct nfc_ops pn533_nfc_ops = {
         .stop_poll = pn533_stop_poll,
         .activate_target = pn533_activate_target,
         .deactivate_target = pn533_deactivate_target,
-        .data_exchange = pn533_data_exchange,
+        .im_transceive = pn533_transceive,
+        .tm_send = pn533_tm_send,
 };
 
 static int pn533_probe(struct usb_interface *interface,
@@ -1723,6 +2122,7 @@ static int pn533_probe(struct usb_interface *interface,
         struct usb_host_interface *iface_desc;
         struct usb_endpoint_descriptor *endpoint;
         struct pn533_config_max_retries max_retries;
+        struct pn533_config_timing timing;
         int in_endpoint = 0;
         int out_endpoint = 0;
         int rc = -ENOMEM;
@@ -1735,7 +2135,7 @@ static int pn533_probe(struct usb_interface *interface,
 
         dev->udev = usb_get_dev(interface_to_usbdev(interface));
         dev->interface = interface;
-        sema_init(&dev->cmd_lock, 1);
+        mutex_init(&dev->cmd_lock);
 
         iface_desc = interface->cur_altsetting;
         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
@@ -1779,12 +2179,18 @@ static int pn533_probe(struct usb_interface *interface,
 
         INIT_WORK(&dev->cmd_work, pn533_wq_cmd_complete);
         INIT_WORK(&dev->mi_work, pn533_wq_mi_recv);
+        INIT_WORK(&dev->tg_work, pn533_wq_tg_get_data);
+        INIT_WORK(&dev->poll_work, pn533_wq_poll);
         dev->wq = alloc_workqueue("pn533",
                                   WQ_NON_REENTRANT | WQ_UNBOUND | WQ_MEM_RECLAIM,
                                   1);
         if (dev->wq == NULL)
                 goto error;
 
+        init_timer(&dev->listen_timer);
+        dev->listen_timer.data = (unsigned long) dev;
+        dev->listen_timer.function = pn533_listen_mode_timer;
+
         skb_queue_head_init(&dev->resp_q);
 
         usb_set_intfdata(interface, dev);
@@ -1830,13 +2236,29 @@ static int pn533_probe(struct usb_interface *interface,
         if (rc) {
                 nfc_dev_err(&dev->interface->dev, "Error on setting MAX_RETRIES"
                                                                 " config");
-                goto free_nfc_dev;
+                goto unregister_nfc_dev;
+        }
+
+        timing.rfu = PN533_CONFIG_TIMING_102;
+        timing.atr_res_timeout = PN533_CONFIG_TIMING_204;
+        timing.dep_timeout = PN533_CONFIG_TIMING_409;
+
+        rc = pn533_set_configuration(dev, PN533_CFGITEM_TIMING,
+                                (u8 *) &timing, sizeof(timing));
+        if (rc) {
+                nfc_dev_err(&dev->interface->dev,
+                            "Error on setting RF timings");
+                goto unregister_nfc_dev;
         }
 
         return 0;
 
+unregister_nfc_dev:
+        nfc_unregister_device(dev->nfc_dev);
+
 free_nfc_dev:
         nfc_free_device(dev->nfc_dev);
+
 destroy_wq:
         destroy_workqueue(dev->wq);
 error:
@@ -1865,6 +2287,8 @@ static void pn533_disconnect(struct usb_interface *interface)
 
         skb_queue_purge(&dev->resp_q);
 
+        del_timer(&dev->listen_timer);
+
         kfree(dev->in_frame);
         usb_free_urb(dev->in_urb);
         kfree(dev->out_frame);
diff --git a/drivers/nfc/pn544_hci.c b/drivers/nfc/pn544_hci.c
index 281f18c2fb82..457eac35dc74 100644
--- a/drivers/nfc/pn544_hci.c
+++ b/drivers/nfc/pn544_hci.c
@@ -576,7 +576,8 @@ static int pn544_hci_xmit(struct nfc_shdlc *shdlc, struct sk_buff *skb)
         return pn544_hci_i2c_write(client, skb->data, skb->len);
 }
 
-static int pn544_hci_start_poll(struct nfc_shdlc *shdlc, u32 protocols)
+static int pn544_hci_start_poll(struct nfc_shdlc *shdlc,
+                                u32 im_protocols, u32 tm_protocols)
 {
         struct nfc_hci_dev *hdev = nfc_shdlc_get_hci_dev(shdlc);
         u8 phases = 0;
@@ -584,7 +585,8 @@ static int pn544_hci_start_poll(struct nfc_shdlc *shdlc, u32 protocols)
         u8 duration[2];
         u8 activated;
 
-        pr_info(DRIVER_DESC ": %s protocols = %d\n", __func__, protocols);
+        pr_info(DRIVER_DESC ": %s protocols 0x%x 0x%x\n",
+                __func__, im_protocols, tm_protocols);
 
         r = nfc_hci_send_event(hdev, NFC_HCI_RF_READER_A_GATE,
                                NFC_HCI_EVT_END_OPERATION, NULL, 0);
@@ -604,10 +606,10 @@ static int pn544_hci_start_poll(struct nfc_shdlc *shdlc, u32 protocols)
         if (r < 0)
                 return r;
 
-        if (protocols & (NFC_PROTO_ISO14443_MASK | NFC_PROTO_MIFARE_MASK |
+        if (im_protocols & (NFC_PROTO_ISO14443_MASK | NFC_PROTO_MIFARE_MASK |
                          NFC_PROTO_JEWEL_MASK))
                 phases |= 1;            /* Type A */
-        if (protocols & NFC_PROTO_FELICA_MASK) {
+        if (im_protocols & NFC_PROTO_FELICA_MASK) {
                 phases |= (1 << 2);     /* Type F 212 */
                 phases |= (1 << 3);     /* Type F 424 */
         }
diff --git a/drivers/ssb/b43_pci_bridge.c b/drivers/ssb/b43_pci_bridge.c
index f551e5376147..266aa1648a02 100644
--- a/drivers/ssb/b43_pci_bridge.c
+++ b/drivers/ssb/b43_pci_bridge.c
@@ -36,6 +36,7 @@ static const struct pci_device_id b43_pci_bridge_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4328) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4329) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x432b) },
+        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x432c) },
         { 0, },
 };
 MODULE_DEVICE_TABLE(pci, b43_pci_bridge_tbl);
diff --git a/drivers/ssb/scan.c b/drivers/ssb/scan.c
index 266c7c5c86dc..ab4627cf1114 100644
--- a/drivers/ssb/scan.c
+++ b/drivers/ssb/scan.c
@@ -90,6 +90,8 @@ const char *ssb_core_name(u16 coreid)
                 return "ARM 1176";
         case SSB_DEV_ARM_7TDMI:
                 return "ARM 7TDMI";
+        case SSB_DEV_ARM_CM3:
+                return "ARM Cortex M3";
         }
         return "UNKNOWN";
 }
diff --git a/include/linux/nfc.h b/include/linux/nfc.h
index 0ae9b5857c83..f4e6dd915b1c 100644
--- a/include/linux/nfc.h
+++ b/include/linux/nfc.h
@@ -56,6 +56,10 @@
  *      %NFC_ATTR_PROTOCOLS)
  * @NFC_EVENT_DEVICE_REMOVED: event emitted when a device is removed
  *      (it sends %NFC_ATTR_DEVICE_INDEX)
+ * @NFC_EVENT_TM_ACTIVATED: event emitted when the adapter is activated in
+ *      target mode.
+ * @NFC_EVENT_DEVICE_DEACTIVATED: event emitted when the adapter is deactivated
+ *      from target mode.
  */
 enum nfc_commands {
         NFC_CMD_UNSPEC,
@@ -71,6 +75,8 @@ enum nfc_commands {
         NFC_EVENT_DEVICE_ADDED,
         NFC_EVENT_DEVICE_REMOVED,
         NFC_EVENT_TARGET_LOST,
+        NFC_EVENT_TM_ACTIVATED,
+        NFC_EVENT_TM_DEACTIVATED,
 /* private: internal use only */
         __NFC_CMD_AFTER_LAST
 };
@@ -94,6 +100,8 @@ enum nfc_commands {
  * @NFC_ATTR_TARGET_SENSF_RES: NFC-F targets extra information, max 18 bytes
  * @NFC_ATTR_COMM_MODE: Passive or active mode
  * @NFC_ATTR_RF_MODE: Initiator or target
+ * @NFC_ATTR_IM_PROTOCOLS: Initiator mode protocols to poll for
+ * @NFC_ATTR_TM_PROTOCOLS: Target mode protocols to listen for
  */
 enum nfc_attrs {
         NFC_ATTR_UNSPEC,
@@ -109,6 +117,8 @@ enum nfc_attrs {
         NFC_ATTR_COMM_MODE,
         NFC_ATTR_RF_MODE,
         NFC_ATTR_DEVICE_POWERED,
+        NFC_ATTR_IM_PROTOCOLS,
+        NFC_ATTR_TM_PROTOCOLS,
 /* private: internal use only */
         __NFC_ATTR_AFTER_LAST
 };
@@ -118,6 +128,7 @@ enum nfc_attrs {
 #define NFC_NFCID1_MAXSIZE 10
 #define NFC_SENSB_RES_MAXSIZE 12
 #define NFC_SENSF_RES_MAXSIZE 18
+#define NFC_GB_MAXSIZE        48
 
 /* NFC protocols */
 #define NFC_PROTO_JEWEL         1
@@ -135,6 +146,7 @@ enum nfc_attrs {
 /* NFC RF modes */
 #define NFC_RF_INITIATOR 0
 #define NFC_RF_TARGET    1
+#define NFC_RF_NONE      2
 
 /* NFC protocols masks used in bitsets */
 #define NFC_PROTO_JEWEL_MASK    (1 << NFC_PROTO_JEWEL)
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index a6959f72745e..970afdf5a605 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -170,6 +170,8 @@
  *      %NL80211_ATTR_CIPHER_GROUP, %NL80211_ATTR_WPA_VERSIONS,
  *      %NL80211_ATTR_AKM_SUITES, %NL80211_ATTR_PRIVACY,
  *      %NL80211_ATTR_AUTH_TYPE and %NL80211_ATTR_INACTIVITY_TIMEOUT.
+ *      The channel to use can be set on the interface or be given using the
+ *      %NL80211_ATTR_WIPHY_FREQ and %NL80211_ATTR_WIPHY_CHANNEL_TYPE attrs.
  * @NL80211_CMD_NEW_BEACON: old alias for %NL80211_CMD_START_AP
  * @NL80211_CMD_STOP_AP: Stop AP operation on the given interface
  * @NL80211_CMD_DEL_BEACON: old alias for %NL80211_CMD_STOP_AP
@@ -1520,6 +1522,8 @@ enum nl80211_attrs {
 #define NL80211_MAX_NR_CIPHER_SUITES            5
 #define NL80211_MAX_NR_AKM_SUITES               2
 
+#define NL80211_MIN_REMAIN_ON_CHANNEL_TIME      10
+
 /**
  * enum nl80211_iftype - (virtual) interface types
  *
@@ -2534,10 +2538,14 @@ enum nl80211_attr_cqm {
  *      configured threshold
  * @NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH: The RSSI is higher than the
  *      configured threshold
+ * @NL80211_CQM_RSSI_BEACON_LOSS_EVENT: The device experienced beacon loss.
+ *      (Note that deauth/disassoc will still follow if the AP is not
+ *      available. This event might get used as roaming event, etc.)
  */
 enum nl80211_cqm_rssi_threshold_event {
         NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
         NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
+        NL80211_CQM_RSSI_BEACON_LOSS_EVENT,
 };
 
 
diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h
index bc14bd738ade..bb674c02f306 100644
--- a/include/linux/ssb/ssb.h
+++ b/include/linux/ssb/ssb.h
@@ -243,6 +243,7 @@ struct ssb_bus_ops {
 #define SSB_DEV_MINI_MACPHY     0x823
 #define SSB_DEV_ARM_1176        0x824
 #define SSB_DEV_ARM_7TDMI       0x825
+#define SSB_DEV_ARM_CM3         0x82A
 
 /* Vendor-ID values */
 #define SSB_VENDOR_BROADCOM     0x4243
diff --git a/include/net/bluetooth/a2mp.h b/include/net/bluetooth/a2mp.h
new file mode 100644
index 000000000000..6a76e0a0705e
--- /dev/null
+++ b/include/net/bluetooth/a2mp.h
@@ -0,0 +1,126 @@
+/*
+   Copyright (c) 2010,2011 Code Aurora Forum.  All rights reserved.
+   Copyright (c) 2011,2012 Intel Corp.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 and
+   only version 2 as published by the Free Software Foundation.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+*/
+
+#ifndef __A2MP_H
+#define __A2MP_H
+
+#include <net/bluetooth/l2cap.h>
+
+#define A2MP_FEAT_EXT   0x8000
+
+struct amp_mgr {
+        struct l2cap_conn       *l2cap_conn;
+        struct l2cap_chan       *a2mp_chan;
+        struct kref             kref;
+        __u8                    ident;
+        __u8                    handle;
+        unsigned long           flags;
+};
+
+struct a2mp_cmd {
+        __u8    code;
+        __u8    ident;
+        __le16  len;
+        __u8    data[0];
+} __packed;
+
+/* A2MP command codes */
+#define A2MP_COMMAND_REJ         0x01
+struct a2mp_cmd_rej {
+        __le16  reason;
+        __u8    data[0];
+} __packed;
+
+#define A2MP_DISCOVER_REQ        0x02
+struct a2mp_discov_req {
+        __le16  mtu;
+        __le16  ext_feat;
+} __packed;
+
+struct a2mp_cl {
+        __u8    id;
+        __u8    type;
+        __u8    status;
+} __packed;
+
+#define A2MP_DISCOVER_RSP        0x03
+struct a2mp_discov_rsp {
+        __le16     mtu;
+        __le16     ext_feat;
+        struct a2mp_cl cl[0];
+} __packed;
+
+#define A2MP_CHANGE_NOTIFY       0x04
+#define A2MP_CHANGE_RSP          0x05
+
+#define A2MP_GETINFO_REQ         0x06
+struct a2mp_info_req {
+        __u8       id;
+} __packed;
+
+#define A2MP_GETINFO_RSP         0x07
+struct a2mp_info_rsp {
+        __u8    id;
+        __u8    status;
+        __le32  total_bw;
+        __le32  max_bw;
+        __le32  min_latency;
+        __le16  pal_cap;
+        __le16  assoc_size;
+} __packed;
+
+#define A2MP_GETAMPASSOC_REQ     0x08
+struct a2mp_amp_assoc_req {
+        __u8    id;
+} __packed;
+
+#define A2MP_GETAMPASSOC_RSP     0x09
+struct a2mp_amp_assoc_rsp {
+        __u8    id;
+        __u8    status;
+        __u8    amp_assoc[0];
+} __packed;
+
+#define A2MP_CREATEPHYSLINK_REQ  0x0A
+#define A2MP_DISCONNPHYSLINK_REQ 0x0C
+struct a2mp_physlink_req {
+        __u8    local_id;
+        __u8    remote_id;
+        __u8    amp_assoc[0];
+} __packed;
+
+#define A2MP_CREATEPHYSLINK_RSP  0x0B
+#define A2MP_DISCONNPHYSLINK_RSP 0x0D
+struct a2mp_physlink_rsp {
+        __u8    local_id;
+        __u8    remote_id;
+        __u8    status;
+} __packed;
+
+/* A2MP response status */
+#define A2MP_STATUS_SUCCESS                     0x00
+#define A2MP_STATUS_INVALID_CTRL_ID             0x01
+#define A2MP_STATUS_UNABLE_START_LINK_CREATION  0x02
+#define A2MP_STATUS_NO_PHYSICAL_LINK_EXISTS     0x02
+#define A2MP_STATUS_COLLISION_OCCURED           0x03
+#define A2MP_STATUS_DISCONN_REQ_RECVD           0x04
+#define A2MP_STATUS_PHYS_LINK_EXISTS            0x05
+#define A2MP_STATUS_SECURITY_VIOLATION          0x06
+
+void amp_mgr_get(struct amp_mgr *mgr);
+int amp_mgr_put(struct amp_mgr *mgr);
+struct l2cap_chan *a2mp_channel_create(struct l2cap_conn *conn,
+                                       struct sk_buff *skb);
+
+#endif /* __A2MP_H */
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 961669b648fd..565d4bee1e49 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -1,4 +1,4 @@
-/* 
+/*
    BlueZ - Bluetooth protocol stack for Linux
    Copyright (C) 2000-2001 Qualcomm Incorporated
 
@@ -12,22 +12,19 @@
    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
-   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
-   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
-   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
-   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
    SOFTWARE IS DISCLAIMED.
 */
 
 #ifndef __BLUETOOTH_H
 #define __BLUETOOTH_H
 
-#include <asm/types.h>
-#include <asm/byteorder.h>
-#include <linux/list.h>
 #include <linux/poll.h>
 #include <net/sock.h>
 
@@ -168,8 +165,8 @@ typedef struct {
 #define BDADDR_LE_PUBLIC        0x01
 #define BDADDR_LE_RANDOM        0x02
 
-#define BDADDR_ANY   (&(bdaddr_t) {{0, 0, 0, 0, 0, 0}})
-#define BDADDR_LOCAL (&(bdaddr_t) {{0, 0, 0, 0xff, 0xff, 0xff}})
+#define BDADDR_ANY   (&(bdaddr_t) {{0, 0, 0, 0, 0, 0} })
+#define BDADDR_LOCAL (&(bdaddr_t) {{0, 0, 0, 0xff, 0xff, 0xff} })
 
 /* Copy, swap, convert BD Address */
 static inline int bacmp(bdaddr_t *ba1, bdaddr_t *ba2)
@@ -215,7 +212,7 @@ int  bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                                 struct msghdr *msg, size_t len, int flags);
 int  bt_sock_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                         struct msghdr *msg, size_t len, int flags);
-uint bt_sock_poll(struct file * file, struct socket *sock, poll_table *wait);
+uint bt_sock_poll(struct file *file, struct socket *sock, poll_table *wait);
 int  bt_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
 int  bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo);
 
@@ -225,12 +222,12 @@ struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock);
 
 /* Skb helpers */
 struct l2cap_ctrl {
-        unsigned int    sframe  : 1,
-                        poll    : 1,
-                        final   : 1,
-                        fcs     : 1,
-                        sar     : 2,
-                        super   : 2;
+        unsigned int    sframe:1,
+                        poll:1,
+                        final:1,
+                        fcs:1,
+                        sar:2,
+                        super:2;
         __u16           reqseq;
         __u16           txseq;
         __u8            retries;
@@ -249,7 +246,8 @@ static inline struct sk_buff *bt_skb_alloc(unsigned int len, gfp_t how)
 {
         struct sk_buff *skb;
 
-        if ((skb = alloc_skb(len + BT_SKB_RESERVE, how))) {
+        skb = alloc_skb(len + BT_SKB_RESERVE, how);
+        if (skb) {
                 skb_reserve(skb, BT_SKB_RESERVE);
                 bt_cb(skb)->incoming  = 0;
         }
@@ -261,7 +259,8 @@ static inline struct sk_buff *bt_skb_send_alloc(struct sock *sk,
 {
         struct sk_buff *skb;
 
-        if ((skb = sock_alloc_send_skb(sk, len + BT_SKB_RESERVE, nb, err))) {
+        skb = sock_alloc_send_skb(sk, len + BT_SKB_RESERVE, nb, err);
+        if (skb) {
                 skb_reserve(skb, BT_SKB_RESERVE);
                 bt_cb(skb)->incoming  = 0;
         }
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 3def64ba77fa..2a6b0b8b7120 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -30,6 +30,9 @@
 #define HCI_MAX_EVENT_SIZE      260
 #define HCI_MAX_FRAME_SIZE      (HCI_MAX_ACL_SIZE + 4)
 
+#define HCI_LINK_KEY_SIZE       16
+#define HCI_AMP_LINK_KEY_SIZE   (2 * HCI_LINK_KEY_SIZE)
+
 /* HCI dev events */
 #define HCI_DEV_REG                     1
 #define HCI_DEV_UNREG                   2
@@ -56,9 +59,12 @@
 #define HCI_BREDR       0x00
 #define HCI_AMP         0x01
 
+/* First BR/EDR Controller shall have ID = 0 */
+#define HCI_BREDR_ID    0
+
 /* HCI device quirks */
 enum {
-        HCI_QUIRK_NO_RESET,
+        HCI_QUIRK_RESET_ON_CLOSE,
         HCI_QUIRK_RAW_DEVICE,
         HCI_QUIRK_FIXUP_BUFFER_SIZE
 };
@@ -133,10 +139,8 @@ enum {
 #define HCIINQUIRY      _IOR('H', 240, int)
 
 /* HCI timeouts */
-#define HCI_CONNECT_TIMEOUT     (40000) /* 40 seconds */
 #define HCI_DISCONN_TIMEOUT     (2000)  /* 2 seconds */
 #define HCI_PAIRING_TIMEOUT     (60000) /* 60 seconds */
-#define HCI_IDLE_TIMEOUT        (6000)  /* 6 seconds */
 #define HCI_INIT_TIMEOUT        (10000) /* 10 seconds */
 #define HCI_CMD_TIMEOUT         (1000)  /* 1 seconds */
 #define HCI_ACL_TX_TIMEOUT      (45000) /* 45 seconds */
@@ -371,7 +375,7 @@ struct hci_cp_reject_conn_req {
 #define HCI_OP_LINK_KEY_REPLY           0x040b
 struct hci_cp_link_key_reply {
         bdaddr_t bdaddr;
-        __u8     link_key[16];
+        __u8     link_key[HCI_LINK_KEY_SIZE];
 } __packed;
 
 #define HCI_OP_LINK_KEY_NEG_REPLY       0x040c
@@ -523,6 +527,28 @@ struct hci_cp_io_capability_neg_reply {
         __u8     reason;
 } __packed;
 
+#define HCI_OP_CREATE_PHY_LINK          0x0435
+struct hci_cp_create_phy_link {
+        __u8     phy_handle;
+        __u8     key_len;
+        __u8     key_type;
+        __u8     key[HCI_AMP_LINK_KEY_SIZE];
+} __packed;
+
+#define HCI_OP_ACCEPT_PHY_LINK          0x0436
+struct hci_cp_accept_phy_link {
+        __u8     phy_handle;
+        __u8     key_len;
+        __u8     key_type;
+        __u8     key[HCI_AMP_LINK_KEY_SIZE];
+} __packed;
+
+#define HCI_OP_DISCONN_PHY_LINK 0x0437
+struct hci_cp_disconn_phy_link {
+        __u8     phy_handle;
+        __u8     reason;
+} __packed;
+
 #define HCI_OP_SNIFF_MODE               0x0803
 struct hci_cp_sniff_mode {
         __le16   handle;
@@ -818,6 +844,31 @@ struct hci_rp_read_local_amp_info {
         __le32   be_flush_to;
 } __packed;
 
+#define HCI_OP_READ_LOCAL_AMP_ASSOC     0x140a
+struct hci_cp_read_local_amp_assoc {
+        __u8     phy_handle;
+        __le16   len_so_far;
+        __le16   max_len;
+} __packed;
+struct hci_rp_read_local_amp_assoc {
+        __u8     status;
+        __u8     phy_handle;
+        __le16   rem_len;
+        __u8     frag[0];
+} __packed;
+
+#define HCI_OP_WRITE_REMOTE_AMP_ASSOC   0x140b
+struct hci_cp_write_remote_amp_assoc {
+        __u8     phy_handle;
+        __le16   len_so_far;
+        __le16   rem_len;
+        __u8     frag[0];
+} __packed;
+struct hci_rp_write_remote_amp_assoc {
+        __u8     status;
+        __u8     phy_handle;
+} __packed;
+
 #define HCI_OP_LE_SET_EVENT_MASK        0x2001
 struct hci_cp_le_set_event_mask {
         __u8     mask[8];
@@ -1048,7 +1099,7 @@ struct hci_ev_link_key_req {
 #define HCI_EV_LINK_KEY_NOTIFY          0x18
 struct hci_ev_link_key_notify {
         bdaddr_t bdaddr;
-        __u8     link_key[16];
+        __u8     link_key[HCI_LINK_KEY_SIZE];
         __u8     key_type;
 } __packed;
 
@@ -1196,6 +1247,39 @@ struct hci_ev_le_meta {
         __u8     subevent;
 } __packed;
 
+#define HCI_EV_PHY_LINK_COMPLETE        0x40
+struct hci_ev_phy_link_complete {
+        __u8     status;
+        __u8     phy_handle;
+} __packed;
+
+#define HCI_EV_CHANNEL_SELECTED         0x41
+struct hci_ev_channel_selected {
+        __u8     phy_handle;
+} __packed;
+
+#define HCI_EV_DISCONN_PHY_LINK_COMPLETE        0x42
+struct hci_ev_disconn_phy_link_complete {
+        __u8     status;
+        __u8     phy_handle;
+        __u8     reason;
+} __packed;
+
+#define HCI_EV_LOGICAL_LINK_COMPLETE            0x45
+struct hci_ev_logical_link_complete {
+        __u8     status;
+        __le16   handle;
+        __u8     phy_handle;
+        __u8     flow_spec_id;
+} __packed;
+
+#define HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE    0x46
+struct hci_ev_disconn_logical_link_complete {
+        __u8     status;
+        __le16   handle;
+        __u8     reason;
+} __packed;
+
 #define HCI_EV_NUM_COMP_BLOCKS          0x48
 struct hci_comp_blocks_info {
         __le16   handle;
@@ -1296,7 +1380,6 @@ struct hci_sco_hdr {
         __u8    dlen;
 } __packed;
 
-#include <linux/skbuff.h>
 static inline struct hci_event_hdr *hci_event_hdr(const struct sk_buff *skb)
 {
         return (struct hci_event_hdr *) skb->data;
@@ -1313,12 +1396,12 @@ static inline struct hci_sco_hdr *hci_sco_hdr(const struct sk_buff *skb)
 }
 
 /* Command opcode pack/unpack */
-#define hci_opcode_pack(ogf, ocf)       (__u16) ((ocf & 0x03ff)|(ogf << 10))
+#define hci_opcode_pack(ogf, ocf)       ((__u16) ((ocf & 0x03ff)|(ogf << 10)))
 #define hci_opcode_ogf(op)              (op >> 10)
 #define hci_opcode_ocf(op)              (op & 0x03ff)
 
 /* ACL handle and flags pack/unpack */
-#define hci_handle_pack(h, f)   (__u16) ((h & 0x0fff)|(f << 12))
+#define hci_handle_pack(h, f)   ((__u16) ((h & 0x0fff)|(f << 12)))
 #define hci_handle(h)           (h & 0x0fff)
 #define hci_flags(h)            (h >> 12)
 
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 9fc7728f94e4..20fd57367ddc 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -25,7 +25,6 @@
 #ifndef __HCI_CORE_H
 #define __HCI_CORE_H
 
-#include <linux/interrupt.h>
 #include <net/bluetooth/hci.h>
 
 /* HCI priority */
@@ -65,7 +64,7 @@ struct discovery_state {
                 DISCOVERY_RESOLVING,
                 DISCOVERY_STOPPING,
         } state;
-        struct list_head        all;            /* All devices found during inquiry */
+        struct list_head        all;    /* All devices found during inquiry */
         struct list_head        unknown;        /* Name state not known */
         struct list_head        resolve;        /* Name needs to be resolved */
         __u32                   timestamp;
@@ -105,7 +104,7 @@ struct link_key {
         struct list_head list;
         bdaddr_t bdaddr;
         u8 type;
-        u8 val[16];
+        u8 val[HCI_LINK_KEY_SIZE];
         u8 pin_len;
 };
 
@@ -333,6 +332,7 @@ struct hci_conn {
         void            *l2cap_data;
         void            *sco_data;
         void            *smp_conn;
+        struct amp_mgr  *amp_mgr;
 
         struct hci_conn *link;
 
@@ -360,7 +360,8 @@ extern int l2cap_connect_cfm(struct hci_conn *hcon, u8 status);
 extern int l2cap_disconn_ind(struct hci_conn *hcon);
 extern int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason);
 extern int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt);
-extern int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags);
+extern int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb,
+                              u16 flags);
 
 extern int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr);
 extern int sco_connect_cfm(struct hci_conn *hcon, __u8 status);
@@ -429,8 +430,8 @@ enum {
 static inline bool hci_conn_ssp_enabled(struct hci_conn *conn)
 {
         struct hci_dev *hdev = conn->hdev;
-        return (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
-                                test_bit(HCI_CONN_SSP_ENABLED, &conn->flags));
+        return test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
+               test_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
 }
 
 static inline void hci_conn_hash_init(struct hci_dev *hdev)
@@ -640,6 +641,19 @@ static inline void hci_set_drvdata(struct hci_dev *hdev, void *data)
         dev_set_drvdata(&hdev->dev, data);
 }
 
+/* hci_dev_list shall be locked */
+static inline uint8_t __hci_num_ctrl(void)
+{
+        uint8_t count = 0;
+        struct list_head *p;
+
+        list_for_each(p, &hci_dev_list) {
+                count++;
+        }
+
+        return count;
+}
+
 struct hci_dev *hci_dev_get(int index);
 struct hci_dev *hci_get_route(bdaddr_t *src, bdaddr_t *dst);
 
@@ -661,7 +675,8 @@ int hci_get_conn_info(struct hci_dev *hdev, void __user *arg);
 int hci_get_auth_info(struct hci_dev *hdev, void __user *arg);
 int hci_inquiry(void __user *arg);
 
-struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr);
+struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
+                                         bdaddr_t *bdaddr);
 int hci_blacklist_clear(struct hci_dev *hdev);
 int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
 int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 1c7d1cd5e679..d80e3f0691b4 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -40,11 +40,11 @@
 #define L2CAP_DEFAULT_MONITOR_TO        12000   /* 12 seconds */
 #define L2CAP_DEFAULT_MAX_PDU_SIZE      1009    /* Sized for 3-DH5 packet */
 #define L2CAP_DEFAULT_ACK_TO            200
-#define L2CAP_LE_DEFAULT_MTU            23
 #define L2CAP_DEFAULT_MAX_SDU_SIZE      0xFFFF
 #define L2CAP_DEFAULT_SDU_ITIME         0xFFFFFFFF
 #define L2CAP_DEFAULT_ACC_LAT           0xFFFFFFFF
 #define L2CAP_BREDR_MAX_PAYLOAD         1019    /* 3-DH5 packet */
+#define L2CAP_LE_MIN_MTU                23
 
 #define L2CAP_DISC_TIMEOUT              msecs_to_jiffies(100)
 #define L2CAP_DISC_REJ_TIMEOUT          msecs_to_jiffies(5000)
@@ -52,6 +52,8 @@
 #define L2CAP_CONN_TIMEOUT              msecs_to_jiffies(40000)
 #define L2CAP_INFO_TIMEOUT              msecs_to_jiffies(4000)
 
+#define L2CAP_A2MP_DEFAULT_MTU          670
+
 /* L2CAP socket address */
 struct sockaddr_l2 {
         sa_family_t     l2_family;
@@ -229,9 +231,14 @@ struct l2cap_conn_rsp {
         __le16     status;
 } __packed;
 
+/* protocol/service multiplexer (PSM) */
+#define L2CAP_PSM_SDP           0x0001
+#define L2CAP_PSM_RFCOMM        0x0003
+
 /* channel indentifier */
 #define L2CAP_CID_SIGNALING     0x0001
 #define L2CAP_CID_CONN_LESS     0x0002
+#define L2CAP_CID_A2MP          0x0003
 #define L2CAP_CID_LE_DATA       0x0004
 #define L2CAP_CID_LE_SIGNALING  0x0005
 #define L2CAP_CID_SMP           0x0006
@@ -271,6 +278,9 @@ struct l2cap_conf_rsp {
 #define L2CAP_CONF_PENDING      0x0004
 #define L2CAP_CONF_EFS_REJECT   0x0005
 
+/* configuration req/rsp continuation flag */
+#define L2CAP_CONF_FLAG_CONTINUATION    0x0001
+
 struct l2cap_conf_opt {
         __u8       type;
         __u8       len;
@@ -419,11 +429,6 @@ struct l2cap_seq_list {
 #define L2CAP_SEQ_LIST_CLEAR    0xFFFF
 #define L2CAP_SEQ_LIST_TAIL     0x8000
 
-struct srej_list {
-        __u16   tx_seq;
-        struct list_head list;
-};
-
 struct l2cap_chan {
         struct sock *sk;
 
@@ -475,14 +480,12 @@ struct l2cap_chan {
         __u16           expected_ack_seq;
         __u16           expected_tx_seq;
         __u16           buffer_seq;
-        __u16           buffer_seq_srej;
         __u16           srej_save_reqseq;
         __u16           last_acked_seq;
         __u16           frames_sent;
         __u16           unacked_frames;
         __u8            retry_count;
         __u16           srej_queue_next;
-        __u8            num_acked;
         __u16           sdu_len;
         struct sk_buff  *sdu;
         struct sk_buff  *sdu_last_frag;
@@ -515,7 +518,6 @@ struct l2cap_chan {
         struct sk_buff_head     srej_q;
         struct l2cap_seq_list   srej_list;
         struct l2cap_seq_list   retrans_list;
-        struct list_head        srej_l;
 
         struct list_head        list;
         struct list_head        global_l;
@@ -528,10 +530,14 @@ struct l2cap_chan {
 struct l2cap_ops {
         char                    *name;
 
-        struct l2cap_chan       *(*new_connection) (void *data);
-        int                     (*recv) (void *data, struct sk_buff *skb);
-        void                    (*close) (void *data);
-        void                    (*state_change) (void *data, int state);
+        struct l2cap_chan       *(*new_connection) (struct l2cap_chan *chan);
+        int                     (*recv) (struct l2cap_chan * chan,
+                                         struct sk_buff *skb);
+        void                    (*teardown) (struct l2cap_chan *chan, int err);
+        void                    (*close) (struct l2cap_chan *chan);
+        void                    (*state_change) (struct l2cap_chan *chan,
+                                                 int state);
+        void                    (*ready) (struct l2cap_chan *chan);
         struct sk_buff          *(*alloc_skb) (struct l2cap_chan *chan,
                                                unsigned long len, int nb);
 };
@@ -575,6 +581,7 @@ struct l2cap_conn {
 #define L2CAP_CHAN_RAW                  1
 #define L2CAP_CHAN_CONN_LESS            2
 #define L2CAP_CHAN_CONN_ORIENTED        3
+#define L2CAP_CHAN_CONN_FIX_A2MP        4
 
 /* ----- L2CAP socket info ----- */
 #define l2cap_pi(sk) ((struct l2cap_pinfo *) sk)
@@ -597,6 +604,7 @@ enum {
         CONF_EWS_RECV,
         CONF_LOC_CONF_PEND,
         CONF_REM_CONF_PEND,
+        CONF_NOT_COMPLETE,
 };
 
 #define L2CAP_CONF_MAX_CONF_REQ 2
@@ -713,11 +721,7 @@ static inline bool l2cap_clear_timer(struct l2cap_chan *chan,
 
 #define __set_chan_timer(c, t) l2cap_set_timer(c, &c->chan_timer, (t))
 #define __clear_chan_timer(c) l2cap_clear_timer(c, &c->chan_timer)
-#define __set_retrans_timer(c) l2cap_set_timer(c, &c->retrans_timer, \
-                msecs_to_jiffies(L2CAP_DEFAULT_RETRANS_TO));
 #define __clear_retrans_timer(c) l2cap_clear_timer(c, &c->retrans_timer)
-#define __set_monitor_timer(c) l2cap_set_timer(c, &c->monitor_timer, \
-                msecs_to_jiffies(L2CAP_DEFAULT_MONITOR_TO));
 #define __clear_monitor_timer(c) l2cap_clear_timer(c, &c->monitor_timer)
 #define __set_ack_timer(c) l2cap_set_timer(c, &chan->ack_timer, \
                 msecs_to_jiffies(L2CAP_DEFAULT_ACK_TO));
@@ -736,173 +740,17 @@ static inline __u16 __next_seq(struct l2cap_chan *chan, __u16 seq)
         return (seq + 1) % (chan->tx_win_max + 1);
 }
 
-static inline int l2cap_tx_window_full(struct l2cap_chan *ch)
-{
-        int sub;
-
-        sub = (ch->next_tx_seq - ch->expected_ack_seq) % 64;
-
-        if (sub < 0)
-                sub += 64;
-
-        return sub == ch->remote_tx_win;
-}
-
-static inline __u16 __get_reqseq(struct l2cap_chan *chan, __u32 ctrl)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (ctrl & L2CAP_EXT_CTRL_REQSEQ) >>
-                                                L2CAP_EXT_CTRL_REQSEQ_SHIFT;
-        else
-                return (ctrl & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
-}
-
-static inline __u32 __set_reqseq(struct l2cap_chan *chan, __u32 reqseq)
+static inline struct l2cap_chan *l2cap_chan_no_new_connection(struct l2cap_chan *chan)
 {
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT) &
-                                                        L2CAP_EXT_CTRL_REQSEQ;
-        else
-                return (reqseq << L2CAP_CTRL_REQSEQ_SHIFT) & L2CAP_CTRL_REQSEQ;
+        return NULL;
 }
 
-static inline __u16 __get_txseq(struct l2cap_chan *chan, __u32 ctrl)
+static inline void l2cap_chan_no_teardown(struct l2cap_chan *chan, int err)
 {
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (ctrl & L2CAP_EXT_CTRL_TXSEQ) >>
-                                                L2CAP_EXT_CTRL_TXSEQ_SHIFT;
-        else
-                return (ctrl & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
 }
 
-static inline __u32 __set_txseq(struct l2cap_chan *chan, __u32 txseq)
+static inline void l2cap_chan_no_ready(struct l2cap_chan *chan)
 {
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT) &
-                                                        L2CAP_EXT_CTRL_TXSEQ;
-        else
-                return (txseq << L2CAP_CTRL_TXSEQ_SHIFT) & L2CAP_CTRL_TXSEQ;
-}
-
-static inline bool __is_sframe(struct l2cap_chan *chan, __u32 ctrl)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return ctrl & L2CAP_EXT_CTRL_FRAME_TYPE;
-        else
-                return ctrl & L2CAP_CTRL_FRAME_TYPE;
-}
-
-static inline __u32 __set_sframe(struct l2cap_chan *chan)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return L2CAP_EXT_CTRL_FRAME_TYPE;
-        else
-                return L2CAP_CTRL_FRAME_TYPE;
-}
-
-static inline __u8 __get_ctrl_sar(struct l2cap_chan *chan, __u32 ctrl)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (ctrl & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
-        else
-                return (ctrl & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
-}
-
-static inline __u32 __set_ctrl_sar(struct l2cap_chan *chan, __u32 sar)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (sar << L2CAP_EXT_CTRL_SAR_SHIFT) & L2CAP_EXT_CTRL_SAR;
-        else
-                return (sar << L2CAP_CTRL_SAR_SHIFT) & L2CAP_CTRL_SAR;
-}
-
-static inline bool __is_sar_start(struct l2cap_chan *chan, __u32 ctrl)
-{
-        return __get_ctrl_sar(chan, ctrl) == L2CAP_SAR_START;
-}
-
-static inline __u32 __get_sar_mask(struct l2cap_chan *chan)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return L2CAP_EXT_CTRL_SAR;
-        else
-                return L2CAP_CTRL_SAR;
-}
-
-static inline __u8 __get_ctrl_super(struct l2cap_chan *chan, __u32 ctrl)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (ctrl & L2CAP_EXT_CTRL_SUPERVISE) >>
-                                                L2CAP_EXT_CTRL_SUPER_SHIFT;
-        else
-                return (ctrl & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
-}
-
-static inline __u32 __set_ctrl_super(struct l2cap_chan *chan, __u32 super)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return (super << L2CAP_EXT_CTRL_SUPER_SHIFT) &
-                                                L2CAP_EXT_CTRL_SUPERVISE;
-        else
-                return (super << L2CAP_CTRL_SUPER_SHIFT) &
-                                                        L2CAP_CTRL_SUPERVISE;
-}
-
-static inline __u32 __set_ctrl_final(struct l2cap_chan *chan)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return L2CAP_EXT_CTRL_FINAL;
-        else
-                return L2CAP_CTRL_FINAL;
-}
-
-static inline bool __is_ctrl_final(struct l2cap_chan *chan, __u32 ctrl)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return ctrl & L2CAP_EXT_CTRL_FINAL;
-        else
-                return ctrl & L2CAP_CTRL_FINAL;
-}
-
-static inline __u32 __set_ctrl_poll(struct l2cap_chan *chan)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return L2CAP_EXT_CTRL_POLL;
-        else
-                return L2CAP_CTRL_POLL;
-}
-
-static inline bool __is_ctrl_poll(struct l2cap_chan *chan, __u32 ctrl)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return ctrl & L2CAP_EXT_CTRL_POLL;
-        else
-                return ctrl & L2CAP_CTRL_POLL;
-}
-
-static inline __u32 __get_control(struct l2cap_chan *chan, void *p)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return get_unaligned_le32(p);
-        else
-                return get_unaligned_le16(p);
-}
-
-static inline void __put_control(struct l2cap_chan *chan, __u32 control,
-                                                                void *p)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return put_unaligned_le32(control, p);
-        else
-                return put_unaligned_le16(control, p);
-}
-
-static inline __u8 __ctrl_size(struct l2cap_chan *chan)
-{
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                return L2CAP_EXT_HDR_SIZE - L2CAP_HDR_SIZE;
-        else
-                return L2CAP_ENH_HDR_SIZE - L2CAP_HDR_SIZE;
 }
 
 extern bool disable_ertm;
@@ -926,5 +774,8 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
 void l2cap_chan_busy(struct l2cap_chan *chan, int busy);
 int l2cap_chan_check_security(struct l2cap_chan *chan);
 void l2cap_chan_set_defaults(struct l2cap_chan *chan);
+int l2cap_ertm_init(struct l2cap_chan *chan);
+void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan);
+void l2cap_chan_del(struct l2cap_chan *chan, int err);
 
 #endif /* __L2CAP_H */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 0289d4ce7070..7319f25250b6 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -404,6 +404,8 @@ struct cfg80211_beacon_data {
  *
  * Used to configure an AP interface.
  *
+ * @channel: the channel to start the AP on
+ * @channel_type: the channel type to use
  * @beacon: beacon data
  * @beacon_interval: beacon interval
  * @dtim_period: DTIM period
@@ -417,6 +419,9 @@ struct cfg80211_beacon_data {
  * @inactivity_timeout: time in seconds to determine station's inactivity.
  */
 struct cfg80211_ap_settings {
+        struct ieee80211_channel *channel;
+        enum nl80211_channel_type channel_type;
+
         struct cfg80211_beacon_data beacon;
 
         int beacon_interval, dtim_period;
@@ -826,6 +831,8 @@ struct mesh_config {
 
 /**
  * struct mesh_setup - 802.11s mesh setup configuration
+ * @channel: the channel to start the mesh network on
+ * @channel_type: the channel type to use
  * @mesh_id: the mesh ID
  * @mesh_id_len: length of the mesh ID, at least 1 and at most 32 bytes
  * @sync_method: which synchronization method to use
@@ -840,6 +847,8 @@ struct mesh_config {
  * These parameters are fixed when the mesh is created.
  */
 struct mesh_setup {
+        struct ieee80211_channel *channel;
+        enum nl80211_channel_type channel_type;
         const u8 *mesh_id;
         u8 mesh_id_len;
         u8 sync_method;
@@ -1411,11 +1420,14 @@ struct cfg80211_gtk_rekey_data {
  *
  * @set_txq_params: Set TX queue parameters
  *
- * @set_channel: Set channel for a given wireless interface. Some devices
- *      may support multi-channel operation (by channel hopping) so cfg80211
- *      doesn't verify much. Note, however, that the passed netdev may be
- *      %NULL as well if the user requested changing the channel for the
- *      device itself, or for a monitor interface.
+ * @libertas_set_mesh_channel: Only for backward compatibility for libertas,
+ *      as it doesn't implement join_mesh and needs to set the channel to
+ *      join the mesh instead.
+ *
+ * @set_monitor_channel: Set the monitor mode channel for the device. If other
+ *      interfaces are active this callback should reject the configuration.
+ *      If no interfaces are active or the device is down, the channel should
+ *      be stored for when a monitor interface becomes active.
  * @get_channel: Get the current operating channel, should return %NULL if
  *      there's no single defined operating channel if for example the
  *      device implements channel hopping for multi-channel virtual interfaces.
@@ -1605,9 +1617,13 @@ struct cfg80211_ops {
         int     (*set_txq_params)(struct wiphy *wiphy, struct net_device *dev,
                                   struct ieee80211_txq_params *params);
 
-        int     (*set_channel)(struct wiphy *wiphy, struct net_device *dev,
-                               struct ieee80211_channel *chan,
-                               enum nl80211_channel_type channel_type);
+        int     (*libertas_set_mesh_channel)(struct wiphy *wiphy,
+                                             struct net_device *dev,
+                                             struct ieee80211_channel *chan);
+
+        int     (*set_monitor_channel)(struct wiphy *wiphy,
+                                       struct ieee80211_channel *chan,
+                                       enum nl80211_channel_type channel_type);
 
         int     (*scan)(struct wiphy *wiphy, struct net_device *dev,
                         struct cfg80211_scan_request *request);
@@ -2263,7 +2279,10 @@ struct cfg80211_cached_keys;
  * @netdev: (private) Used to reference back to the netdev
  * @current_bss: (private) Used by the internal configuration code
  * @channel: (private) Used by the internal configuration code to track
- *      user-set AP, monitor and WDS channels for wireless extensions
+ *      the user-set AP, monitor and WDS channel
+ * @preset_chan: (private) Used by the internal configuration code to
+ *      track the channel to be used for AP later
+ * @preset_chantype: (private) the corresponding channel type
  * @bssid: (private) Used by the internal configuration code
  * @ssid: (private) Used by the internal configuration code
  * @ssid_len: (private) Used by the internal configuration code
@@ -2313,7 +2332,8 @@ struct wireless_dev {
         spinlock_t event_lock;
 
         struct cfg80211_internal_bss *current_bss; /* associated / joined */
-        struct ieee80211_channel *channel;
+        struct ieee80211_channel *preset_chan;
+        enum nl80211_channel_type preset_chantype;
 
         bool ps;
         int ps_timeout;
@@ -3359,11 +3379,14 @@ void cfg80211_report_obss_beacon(struct wiphy *wiphy,
                                  const u8 *frame, size_t len,
                                  int freq, int sig_dbm, gfp_t gfp);
 
-/*
+/**
  * cfg80211_can_beacon_sec_chan - test if ht40 on extension channel can be used
  * @wiphy: the wiphy
  * @chan: main channel
  * @channel_type: HT mode
+ *
+ * This function returns true if there is no secondary channel or the secondary
+ * channel can be used for beaconing (i.e. is not a radar channel etc.)
  */
 bool cfg80211_can_beacon_sec_chan(struct wiphy *wiphy,
                                   struct ieee80211_channel *chan,
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 95e39b6a02ec..6914f9978aea 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1297,6 +1297,10 @@ enum ieee80211_hw_flags {
  *      reports, by default it is set to _MCS, _GI and _BW but doesn't
  *      include _FMT. Use %IEEE80211_RADIOTAP_MCS_HAVE_* values, only
  *      adding _BW is supported today.
+ *
+ * @netdev_features: netdev features to be set in each netdev created
+ *      from this HW. Note only HW checksum features are currently
+ *      compatible with mac80211. Other feature bits will be rejected.
  */
 struct ieee80211_hw {
         struct ieee80211_conf conf;
@@ -1319,6 +1323,7 @@ struct ieee80211_hw {
         u8 max_tx_aggregation_subframes;
         u8 offchannel_tx_hw_queue;
         u8 radiotap_mcs_details;
+        netdev_features_t netdev_features;
 };
 
 /**
@@ -2183,7 +2188,10 @@ enum ieee80211_rate_control_changed {
  *      offload. Frames to transmit on the off-channel channel are transmitted
  *      normally except for the %IEEE80211_TX_CTL_TX_OFFCHAN flag. When the
  *      duration (which will always be non-zero) expires, the driver must call
- *      ieee80211_remain_on_channel_expired(). This callback may sleep.
+ *      ieee80211_remain_on_channel_expired().
+ *      Note that this callback may be called while the device is in IDLE and
+ *      must be accepted in this case.
+ *      This callback may sleep.
  * @cancel_remain_on_channel: Requests that an ongoing off-channel period is
  *      aborted before it expires. This callback may sleep.
  *
@@ -3557,16 +3565,6 @@ void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
                                gfp_t gfp);
 
 /**
- * ieee80211_get_operstate - get the operstate of the vif
- *
- * @vif: &struct ieee80211_vif pointer from the add_interface callback.
- *
- * The driver might need to know the operstate of the net_device
- * (specifically, whether the link is IF_OPER_UP after resume)
- */
-unsigned char ieee80211_get_operstate(struct ieee80211_vif *vif);
-
-/**
  * ieee80211_chswitch_done - Complete channel switch process
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  * @success: make the channel switch successful or not
@@ -3845,4 +3843,28 @@ int ieee80211_add_ext_srates_ie(struct ieee80211_vif *vif,
  */
 int ieee80211_ave_rssi(struct ieee80211_vif *vif);
 
+/* Extra debugging macros */
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+#define ht_vdbg(fmt, ...)                       \
+        pr_debug(fmt, ##__VA_ARGS__)
+#else
+#define ht_vdbg(fmt, ...)                       \
+do {                                            \
+        if (0)                                  \
+                pr_debug(fmt, ##__VA_ARGS__);   \
+} while (0)
+#endif
+
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
+#define ibss_vdbg(fmt, ...)                     \
+        pr_debug(fmt, ##__VA_ARGS__)
+#else
+#define ibss_vdbg(fmt, ...)                     \
+do {                                            \
+        if (0)                                  \
+                pr_debug(fmt, ##__VA_ARGS__);   \
+} while (0)
+#endif
+
 #endif /* MAC80211_H */
diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h
index 4467c9460857..e30e6a869714 100644
--- a/include/net/nfc/hci.h
+++ b/include/net/nfc/hci.h
@@ -31,7 +31,8 @@ struct nfc_hci_ops {
         void (*close) (struct nfc_hci_dev *hdev);
         int (*hci_ready) (struct nfc_hci_dev *hdev);
         int (*xmit) (struct nfc_hci_dev *hdev, struct sk_buff *skb);
-        int (*start_poll) (struct nfc_hci_dev *hdev, u32 protocols);
+        int (*start_poll) (struct nfc_hci_dev *hdev,
+                           u32 im_protocols, u32 tm_protocols);
         int (*target_from_gate) (struct nfc_hci_dev *hdev, u8 gate,
                                  struct nfc_target *target);
         int (*complete_target_discovered) (struct nfc_hci_dev *hdev, u8 gate,
diff --git a/include/net/nfc/nfc.h b/include/net/nfc/nfc.h
index b7ca4a2a1d72..180964b954ab 100644
--- a/include/net/nfc/nfc.h
+++ b/include/net/nfc/nfc.h
@@ -53,7 +53,8 @@ struct nfc_target;
 struct nfc_ops {
         int (*dev_up)(struct nfc_dev *dev);
         int (*dev_down)(struct nfc_dev *dev);
-        int (*start_poll)(struct nfc_dev *dev, u32 protocols);
+        int (*start_poll)(struct nfc_dev *dev,
+                          u32 im_protocols, u32 tm_protocols);
         void (*stop_poll)(struct nfc_dev *dev);
         int (*dep_link_up)(struct nfc_dev *dev, struct nfc_target *target,
                            u8 comm_mode, u8 *gb, size_t gb_len);
@@ -62,9 +63,10 @@ struct nfc_ops {
                                u32 protocol);
         void (*deactivate_target)(struct nfc_dev *dev,
                                   struct nfc_target *target);
-        int (*data_exchange)(struct nfc_dev *dev, struct nfc_target *target,
+        int (*im_transceive)(struct nfc_dev *dev, struct nfc_target *target,
                              struct sk_buff *skb, data_exchange_cb_t cb,
                              void *cb_context);
+        int (*tm_send)(struct nfc_dev *dev, struct sk_buff *skb);
         int (*check_presence)(struct nfc_dev *dev, struct nfc_target *target);
 };
 
@@ -99,10 +101,10 @@ struct nfc_dev {
         int targets_generation;
         struct device dev;
         bool dev_up;
+        u8 rf_mode;
         bool polling;
         struct nfc_target *active_target;
         bool dep_link_up;
-        u32 dep_rf_mode;
         struct nfc_genl_data genl_data;
         u32 supported_protocols;
 
@@ -188,6 +190,7 @@ struct sk_buff *nfc_alloc_recv_skb(unsigned int size, gfp_t gfp);
 
 int nfc_set_remote_general_bytes(struct nfc_dev *dev,
                                  u8 *gt, u8 gt_len);
+u8 *nfc_get_local_general_bytes(struct nfc_dev *dev, size_t *gb_len);
 
 int nfc_targets_found(struct nfc_dev *dev,
                       struct nfc_target *targets, int ntargets);
@@ -196,4 +199,9 @@ int nfc_target_lost(struct nfc_dev *dev, u32 target_idx);
 int nfc_dep_link_is_up(struct nfc_dev *dev, u32 target_idx,
                        u8 comm_mode, u8 rf_mode);
 
+int nfc_tm_activated(struct nfc_dev *dev, u32 protocol, u8 comm_mode,
+                     u8 *gb, size_t gb_len);
+int nfc_tm_deactivated(struct nfc_dev *dev);
+int nfc_tm_data_received(struct nfc_dev *dev, struct sk_buff *skb);
+
 #endif /* __NET_NFC_H */
diff --git a/include/net/nfc/shdlc.h b/include/net/nfc/shdlc.h
index ab06afd462da..35e930d2f638 100644
--- a/include/net/nfc/shdlc.h
+++ b/include/net/nfc/shdlc.h
@@ -27,7 +27,8 @@ struct nfc_shdlc_ops {
         void (*close) (struct nfc_shdlc *shdlc);
         int (*hci_ready) (struct nfc_shdlc *shdlc);
         int (*xmit) (struct nfc_shdlc *shdlc, struct sk_buff *skb);
-        int (*start_poll) (struct nfc_shdlc *shdlc, u32 protocols);
+        int (*start_poll) (struct nfc_shdlc *shdlc,
+                           u32 im_protocols, u32 tm_protocols);
         int (*target_from_gate) (struct nfc_shdlc *shdlc, u8 gate,
                                  struct nfc_target *target);
         int (*complete_target_discovered) (struct nfc_shdlc *shdlc, u8 gate,
diff --git a/net/bluetooth/Makefile b/net/bluetooth/Makefile
index 2dc5a5700f53..fa6d94a4602a 100644
--- a/net/bluetooth/Makefile
+++ b/net/bluetooth/Makefile
@@ -9,4 +9,5 @@ obj-$(CONFIG_BT_CMTP)	+= cmtp/
 obj-$(CONFIG_BT_HIDP)   += hidp/
 
 bluetooth-y := af_bluetooth.o hci_core.o hci_conn.o hci_event.o mgmt.o \
-        hci_sock.o hci_sysfs.o l2cap_core.o l2cap_sock.o smp.o sco.o lib.o
+        hci_sock.o hci_sysfs.o l2cap_core.o l2cap_sock.o smp.o sco.o lib.o \
+        a2mp.o
diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
new file mode 100644
index 000000000000..fb93250b3938
--- /dev/null
+++ b/net/bluetooth/a2mp.c
@@ -0,0 +1,568 @@
+/*
+   Copyright (c) 2010,2011 Code Aurora Forum.  All rights reserved.
+   Copyright (c) 2011,2012 Intel Corp.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 and
+   only version 2 as published by the Free Software Foundation.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+*/
+
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+#include <net/bluetooth/l2cap.h>
+#include <net/bluetooth/a2mp.h>
+
+/* A2MP build & send command helper functions */
+static struct a2mp_cmd *__a2mp_build(u8 code, u8 ident, u16 len, void *data)
+{
+        struct a2mp_cmd *cmd;
+        int plen;
+
+        plen = sizeof(*cmd) + len;
+        cmd = kzalloc(plen, GFP_KERNEL);
+        if (!cmd)
+                return NULL;
+
+        cmd->code = code;
+        cmd->ident = ident;
+        cmd->len = cpu_to_le16(len);
+
+        memcpy(cmd->data, data, len);
+
+        return cmd;
+}
+
+static void a2mp_send(struct amp_mgr *mgr, u8 code, u8 ident, u16 len,
+                      void *data)
+{
+        struct l2cap_chan *chan = mgr->a2mp_chan;
+        struct a2mp_cmd *cmd;
+        u16 total_len = len + sizeof(*cmd);
+        struct kvec iv;
+        struct msghdr msg;
+
+        cmd = __a2mp_build(code, ident, len, data);
+        if (!cmd)
+                return;
+
+        iv.iov_base = cmd;
+        iv.iov_len = total_len;
+
+        memset(&msg, 0, sizeof(msg));
+
+        msg.msg_iov = (struct iovec *) &iv;
+        msg.msg_iovlen = 1;
+
+        l2cap_chan_send(chan, &msg, total_len, 0);
+
+        kfree(cmd);
+}
+
+static inline void __a2mp_cl_bredr(struct a2mp_cl *cl)
+{
+        cl->id = 0;
+        cl->type = 0;
+        cl->status = 1;
+}
+
+/* hci_dev_list shall be locked */
+static void __a2mp_add_cl(struct amp_mgr *mgr, struct a2mp_cl *cl, u8 num_ctrl)
+{
+        int i = 0;
+        struct hci_dev *hdev;
+
+        __a2mp_cl_bredr(cl);
+
+        list_for_each_entry(hdev, &hci_dev_list, list) {
+                /* Iterate through AMP controllers */
+                if (hdev->id == HCI_BREDR_ID)
+                        continue;
+
+                /* Starting from second entry */
+                if (++i >= num_ctrl)
+                        return;
+
+                cl[i].id = hdev->id;
+                cl[i].type = hdev->amp_type;
+                cl[i].status = hdev->amp_status;
+        }
+}
+
+/* Processing A2MP messages */
+static int a2mp_command_rej(struct amp_mgr *mgr, struct sk_buff *skb,
+                            struct a2mp_cmd *hdr)
+{
+        struct a2mp_cmd_rej *rej = (void *) skb->data;
+
+        if (le16_to_cpu(hdr->len) < sizeof(*rej))
+                return -EINVAL;
+
+        BT_DBG("ident %d reason %d", hdr->ident, le16_to_cpu(rej->reason));
+
+        skb_pull(skb, sizeof(*rej));
+
+        return 0;
+}
+
+static int a2mp_discover_req(struct amp_mgr *mgr, struct sk_buff *skb,
+                             struct a2mp_cmd *hdr)
+{
+        struct a2mp_discov_req *req = (void *) skb->data;
+        u16 len = le16_to_cpu(hdr->len);
+        struct a2mp_discov_rsp *rsp;
+        u16 ext_feat;
+        u8 num_ctrl;
+
+        if (len < sizeof(*req))
+                return -EINVAL;
+
+        skb_pull(skb, sizeof(*req));
+
+        ext_feat = le16_to_cpu(req->ext_feat);
+
+        BT_DBG("mtu %d efm 0x%4.4x", le16_to_cpu(req->mtu), ext_feat);
+
+        /* check that packet is not broken for now */
+        while (ext_feat & A2MP_FEAT_EXT) {
+                if (len < sizeof(ext_feat))
+                        return -EINVAL;
+
+                ext_feat = get_unaligned_le16(skb->data);
+                BT_DBG("efm 0x%4.4x", ext_feat);
+                len -= sizeof(ext_feat);
+                skb_pull(skb, sizeof(ext_feat));
+        }
+
+        read_lock(&hci_dev_list_lock);
+
+        num_ctrl = __hci_num_ctrl();
+        len = num_ctrl * sizeof(struct a2mp_cl) + sizeof(*rsp);
+        rsp = kmalloc(len, GFP_ATOMIC);
+        if (!rsp) {
+                read_unlock(&hci_dev_list_lock);
+                return -ENOMEM;
+        }
+
+        rsp->mtu = __constant_cpu_to_le16(L2CAP_A2MP_DEFAULT_MTU);
+        rsp->ext_feat = 0;
+
+        __a2mp_add_cl(mgr, rsp->cl, num_ctrl);
+
+        read_unlock(&hci_dev_list_lock);
+
+        a2mp_send(mgr, A2MP_DISCOVER_RSP, hdr->ident, len, rsp);
+
+        kfree(rsp);
+        return 0;
+}
+
+static int a2mp_change_notify(struct amp_mgr *mgr, struct sk_buff *skb,
+                              struct a2mp_cmd *hdr)
+{
+        struct a2mp_cl *cl = (void *) skb->data;
+
+        while (skb->len >= sizeof(*cl)) {
+                BT_DBG("Controller id %d type %d status %d", cl->id, cl->type,
+                       cl->status);
+                cl = (struct a2mp_cl *) skb_pull(skb, sizeof(*cl));
+        }
+
+        /* TODO send A2MP_CHANGE_RSP */
+
+        return 0;
+}
+
+static int a2mp_getinfo_req(struct amp_mgr *mgr, struct sk_buff *skb,
+                            struct a2mp_cmd *hdr)
+{
+        struct a2mp_info_req *req  = (void *) skb->data;
+        struct a2mp_info_rsp rsp;
+        struct hci_dev *hdev;
+
+        if (le16_to_cpu(hdr->len) < sizeof(*req))
+                return -EINVAL;
+
+        BT_DBG("id %d", req->id);
+
+        rsp.id = req->id;
+        rsp.status = A2MP_STATUS_INVALID_CTRL_ID;
+
+        hdev = hci_dev_get(req->id);
+        if (hdev && hdev->amp_type != HCI_BREDR) {
+                rsp.status = 0;
+                rsp.total_bw = cpu_to_le32(hdev->amp_total_bw);
+                rsp.max_bw = cpu_to_le32(hdev->amp_max_bw);
+                rsp.min_latency = cpu_to_le32(hdev->amp_min_latency);
+                rsp.pal_cap = cpu_to_le16(hdev->amp_pal_cap);
+                rsp.assoc_size = cpu_to_le16(hdev->amp_assoc_size);
+        }
+
+        if (hdev)
+                hci_dev_put(hdev);
+
+        a2mp_send(mgr, A2MP_GETINFO_RSP, hdr->ident, sizeof(rsp), &rsp);
+
+        skb_pull(skb, sizeof(*req));
+        return 0;
+}
+
+static int a2mp_getampassoc_req(struct amp_mgr *mgr, struct sk_buff *skb,
+                                struct a2mp_cmd *hdr)
+{
+        struct a2mp_amp_assoc_req *req = (void *) skb->data;
+        struct hci_dev *hdev;
+
+        if (le16_to_cpu(hdr->len) < sizeof(*req))
+                return -EINVAL;
+
+        BT_DBG("id %d", req->id);
+
+        hdev = hci_dev_get(req->id);
+        if (!hdev || hdev->amp_type == HCI_BREDR) {
+                struct a2mp_amp_assoc_rsp rsp;
+                rsp.id = req->id;
+                rsp.status = A2MP_STATUS_INVALID_CTRL_ID;
+
+                a2mp_send(mgr, A2MP_GETAMPASSOC_RSP, hdr->ident, sizeof(rsp),
+                          &rsp);
+                goto clean;
+        }
+
+        /* Placeholder for HCI Read AMP Assoc */
+
+clean:
+        if (hdev)
+                hci_dev_put(hdev);
+
+        skb_pull(skb, sizeof(*req));
+        return 0;
+}
+
+static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb,
+                                   struct a2mp_cmd *hdr)
+{
+        struct a2mp_physlink_req *req = (void *) skb->data;
+
+        struct a2mp_physlink_rsp rsp;
+        struct hci_dev *hdev;
+
+        if (le16_to_cpu(hdr->len) < sizeof(*req))
+                return -EINVAL;
+
+        BT_DBG("local_id %d, remote_id %d", req->local_id, req->remote_id);
+
+        rsp.local_id = req->remote_id;
+        rsp.remote_id = req->local_id;
+
+        hdev = hci_dev_get(req->remote_id);
+        if (!hdev || hdev->amp_type != HCI_AMP) {
+                rsp.status = A2MP_STATUS_INVALID_CTRL_ID;
+                goto send_rsp;
+        }
+
+        /* TODO process physlink create */
+
+        rsp.status = A2MP_STATUS_SUCCESS;
+
+send_rsp:
+        if (hdev)
+                hci_dev_put(hdev);
+
+        a2mp_send(mgr, A2MP_CREATEPHYSLINK_RSP, hdr->ident, sizeof(rsp),
+                  &rsp);
+
+        skb_pull(skb, le16_to_cpu(hdr->len));
+        return 0;
+}
+
+static int a2mp_discphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb,
+                                 struct a2mp_cmd *hdr)
+{
+        struct a2mp_physlink_req *req = (void *) skb->data;
+        struct a2mp_physlink_rsp rsp;
+        struct hci_dev *hdev;
+
+        if (le16_to_cpu(hdr->len) < sizeof(*req))
+                return -EINVAL;
+
+        BT_DBG("local_id %d remote_id %d", req->local_id, req->remote_id);
+
+        rsp.local_id = req->remote_id;
+        rsp.remote_id = req->local_id;
+        rsp.status = A2MP_STATUS_SUCCESS;
+
+        hdev = hci_dev_get(req->local_id);
+        if (!hdev) {
+                rsp.status = A2MP_STATUS_INVALID_CTRL_ID;
+                goto send_rsp;
+        }
+
+        /* TODO Disconnect Phys Link here */
+
+        hci_dev_put(hdev);
+
+send_rsp:
+        a2mp_send(mgr, A2MP_DISCONNPHYSLINK_RSP, hdr->ident, sizeof(rsp), &rsp);
+
+        skb_pull(skb, sizeof(*req));
+        return 0;
+}
+
+static inline int a2mp_cmd_rsp(struct amp_mgr *mgr, struct sk_buff *skb,
+                               struct a2mp_cmd *hdr)
+{
+        BT_DBG("ident %d code %d", hdr->ident, hdr->code);
+
+        skb_pull(skb, le16_to_cpu(hdr->len));
+        return 0;
+}
+
+/* Handle A2MP signalling */
+static int a2mp_chan_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
+{
+        struct a2mp_cmd *hdr = (void *) skb->data;
+        struct amp_mgr *mgr = chan->data;
+        int err = 0;
+
+        amp_mgr_get(mgr);
+
+        while (skb->len >= sizeof(*hdr)) {
+                struct a2mp_cmd *hdr = (void *) skb->data;
+                u16 len = le16_to_cpu(hdr->len);
+
+                BT_DBG("code 0x%02x id %d len %d", hdr->code, hdr->ident, len);
+
+                skb_pull(skb, sizeof(*hdr));
+
+                if (len > skb->len || !hdr->ident) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                mgr->ident = hdr->ident;
+
+                switch (hdr->code) {
+                case A2MP_COMMAND_REJ:
+                        a2mp_command_rej(mgr, skb, hdr);
+                        break;
+
+                case A2MP_DISCOVER_REQ:
+                        err = a2mp_discover_req(mgr, skb, hdr);
+                        break;
+
+                case A2MP_CHANGE_NOTIFY:
+                        err = a2mp_change_notify(mgr, skb, hdr);
+                        break;
+
+                case A2MP_GETINFO_REQ:
+                        err = a2mp_getinfo_req(mgr, skb, hdr);
+                        break;
+
+                case A2MP_GETAMPASSOC_REQ:
+                        err = a2mp_getampassoc_req(mgr, skb, hdr);
+                        break;
+
+                case A2MP_CREATEPHYSLINK_REQ:
+                        err = a2mp_createphyslink_req(mgr, skb, hdr);
+                        break;
+
+                case A2MP_DISCONNPHYSLINK_REQ:
+                        err = a2mp_discphyslink_req(mgr, skb, hdr);
+                        break;
+
+                case A2MP_CHANGE_RSP:
+                case A2MP_DISCOVER_RSP:
+                case A2MP_GETINFO_RSP:
+                case A2MP_GETAMPASSOC_RSP:
+                case A2MP_CREATEPHYSLINK_RSP:
+                case A2MP_DISCONNPHYSLINK_RSP:
+                        err = a2mp_cmd_rsp(mgr, skb, hdr);
+                        break;
+
+                default:
+                        BT_ERR("Unknown A2MP sig cmd 0x%2.2x", hdr->code);
+                        err = -EINVAL;
+                        break;
+                }
+        }
+
+        if (err) {
+                struct a2mp_cmd_rej rej;
+                rej.reason = __constant_cpu_to_le16(0);
+
+                BT_DBG("Send A2MP Rej: cmd 0x%2.2x err %d", hdr->code, err);
+
+                a2mp_send(mgr, A2MP_COMMAND_REJ, hdr->ident, sizeof(rej),
+                          &rej);
+        }
+
+        /* Always free skb and return success error code to prevent
+           from sending L2CAP Disconnect over A2MP channel */
+        kfree_skb(skb);
+
+        amp_mgr_put(mgr);
+
+        return 0;
+}
+
+static void a2mp_chan_close_cb(struct l2cap_chan *chan)
+{
+        l2cap_chan_destroy(chan);
+}
+
+static void a2mp_chan_state_change_cb(struct l2cap_chan *chan, int state)
+{
+        struct amp_mgr *mgr = chan->data;
+
+        if (!mgr)
+                return;
+
+        BT_DBG("chan %p state %s", chan, state_to_string(state));
+
+        chan->state = state;
+
+        switch (state) {
+        case BT_CLOSED:
+                if (mgr)
+                        amp_mgr_put(mgr);
+                break;
+        }
+}
+
+static struct sk_buff *a2mp_chan_alloc_skb_cb(struct l2cap_chan *chan,
+                                              unsigned long len, int nb)
+{
+        return bt_skb_alloc(len, GFP_KERNEL);
+}
+
+static struct l2cap_ops a2mp_chan_ops = {
+        .name = "L2CAP A2MP channel",
+        .recv = a2mp_chan_recv_cb,
+        .close = a2mp_chan_close_cb,
+        .state_change = a2mp_chan_state_change_cb,
+        .alloc_skb = a2mp_chan_alloc_skb_cb,
+
+        /* Not implemented for A2MP */
+        .new_connection = l2cap_chan_no_new_connection,
+        .teardown = l2cap_chan_no_teardown,
+        .ready = l2cap_chan_no_ready,
+};
+
+static struct l2cap_chan *a2mp_chan_open(struct l2cap_conn *conn)
+{
+        struct l2cap_chan *chan;
+        int err;
+
+        chan = l2cap_chan_create();
+        if (!chan)
+                return NULL;
+
+        BT_DBG("chan %p", chan);
+
+        chan->chan_type = L2CAP_CHAN_CONN_FIX_A2MP;
+        chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
+
+        chan->ops = &a2mp_chan_ops;
+
+        l2cap_chan_set_defaults(chan);
+        chan->remote_max_tx = chan->max_tx;
+        chan->remote_tx_win = chan->tx_win;
+
+        chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
+        chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
+
+        skb_queue_head_init(&chan->tx_q);
+
+        chan->mode = L2CAP_MODE_ERTM;
+
+        err = l2cap_ertm_init(chan);
+        if (err < 0) {
+                l2cap_chan_del(chan, 0);
+                return NULL;
+        }
+
+        chan->conf_state = 0;
+
+        l2cap_chan_add(conn, chan);
+
+        chan->remote_mps = chan->omtu;
+        chan->mps = chan->omtu;
+
+        chan->state = BT_CONNECTED;
+
+        return chan;
+}
+
+/* AMP Manager functions */
+void amp_mgr_get(struct amp_mgr *mgr)
+{
+        BT_DBG("mgr %p", mgr);
+
+        kref_get(&mgr->kref);
+}
+
+static void amp_mgr_destroy(struct kref *kref)
+{
+        struct amp_mgr *mgr = container_of(kref, struct amp_mgr, kref);
+
+        BT_DBG("mgr %p", mgr);
+
+        kfree(mgr);
+}
+
+int amp_mgr_put(struct amp_mgr *mgr)
+{
+        BT_DBG("mgr %p", mgr);
+
+        return kref_put(&mgr->kref, &amp_mgr_destroy);
+}
+
+static struct amp_mgr *amp_mgr_create(struct l2cap_conn *conn)
+{
+        struct amp_mgr *mgr;
+        struct l2cap_chan *chan;
+
+        mgr = kzalloc(sizeof(*mgr), GFP_KERNEL);
+        if (!mgr)
+                return NULL;
+
+        BT_DBG("conn %p mgr %p", conn, mgr);
+
+        mgr->l2cap_conn = conn;
+
+        chan = a2mp_chan_open(conn);
+        if (!chan) {
+                kfree(mgr);
+                return NULL;
+        }
+
+        mgr->a2mp_chan = chan;
+        chan->data = mgr;
+
+        conn->hcon->amp_mgr = mgr;
+
+        kref_init(&mgr->kref);
+
+        return mgr;
+}
+
+struct l2cap_chan *a2mp_channel_create(struct l2cap_conn *conn,
+                                       struct sk_buff *skb)
+{
+        struct amp_mgr *mgr;
+
+        mgr = amp_mgr_create(conn);
+        if (!mgr) {
+                BT_ERR("Could not create AMP manager");
+                return NULL;
+        }
+
+        BT_DBG("mgr: %p chan %p", mgr, mgr->a2mp_chan);
+
+        return mgr->a2mp_chan;
+}
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 3e18af4dadc4..f7db5792ec64 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -25,18 +25,7 @@
 /* Bluetooth address family and sockets. */
 
 #include <linux/module.h>
-
-#include <linux/types.h>
-#include <linux/list.h>
-#include <linux/errno.h>
-#include <linux/kernel.h>
-#include <linux/sched.h>
-#include <linux/skbuff.h>
-#include <linux/init.h>
-#include <linux/poll.h>
-#include <net/sock.h>
 #include <asm/ioctls.h>
-#include <linux/kmod.h>
 
 #include <net/bluetooth/bluetooth.h>
 
@@ -418,7 +407,8 @@ static inline unsigned int bt_accept_poll(struct sock *parent)
         return 0;
 }
 
-unsigned int bt_sock_poll(struct file *file, struct socket *sock, poll_table *wait)
+unsigned int bt_sock_poll(struct file *file, struct socket *sock,
+                          poll_table *wait)
 {
         struct sock *sk = sock->sk;
         unsigned int mask = 0;
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index 031d7d656754..4a6620bc1570 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -26,26 +26,9 @@
 */
 
 #include <linux/module.h>
-
-#include <linux/kernel.h>
-#include <linux/sched.h>
-#include <linux/signal.h>
-#include <linux/init.h>
-#include <linux/wait.h>
-#include <linux/freezer.h>
-#include <linux/errno.h>
-#include <linux/net.h>
-#include <linux/slab.h>
 #include <linux/kthread.h>
-#include <net/sock.h>
-
-#include <linux/socket.h>
 #include <linux/file.h>
-
-#include <linux/netdevice.h>
 #include <linux/etherdevice.h>
-#include <linux/skbuff.h>
-
 #include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
@@ -306,7 +289,7 @@ static u8 __bnep_rx_hlen[] = {
         ETH_ALEN + 2  /* BNEP_COMPRESSED_DST_ONLY */
 };
 
-static inline int bnep_rx_frame(struct bnep_session *s, struct sk_buff *skb)
+static int bnep_rx_frame(struct bnep_session *s, struct sk_buff *skb)
 {
         struct net_device *dev = s->dev;
         struct sk_buff *nskb;
@@ -404,7 +387,7 @@ static u8 __bnep_tx_types[] = {
         BNEP_COMPRESSED
 };
 
-static inline int bnep_tx_frame(struct bnep_session *s, struct sk_buff *skb)
+static int bnep_tx_frame(struct bnep_session *s, struct sk_buff *skb)
 {
         struct ethhdr *eh = (void *) skb->data;
         struct socket *sock = s->sock;
diff --git a/net/bluetooth/bnep/netdev.c b/net/bluetooth/bnep/netdev.c
index bc4086480d97..98f86f91d47c 100644
--- a/net/bluetooth/bnep/netdev.c
+++ b/net/bluetooth/bnep/netdev.c
@@ -25,16 +25,8 @@
    SOFTWARE IS DISCLAIMED.
 */
 
-#include <linux/module.h>
-#include <linux/slab.h>
-
-#include <linux/socket.h>
-#include <linux/netdevice.h>
+#include <linux/export.h>
 #include <linux/etherdevice.h>
-#include <linux/skbuff.h>
-#include <linux/wait.h>
-
-#include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
@@ -128,7 +120,7 @@ static void bnep_net_timeout(struct net_device *dev)
 }
 
 #ifdef CONFIG_BT_BNEP_MC_FILTER
-static inline int bnep_net_mc_filter(struct sk_buff *skb, struct bnep_session *s)
+static int bnep_net_mc_filter(struct sk_buff *skb, struct bnep_session *s)
 {
         struct ethhdr *eh = (void *) skb->data;
 
@@ -140,7 +132,7 @@ static inline int bnep_net_mc_filter(struct sk_buff *skb, struct bnep_session *s
 
 #ifdef CONFIG_BT_BNEP_PROTO_FILTER
 /* Determine ether protocol. Based on eth_type_trans. */
-static inline u16 bnep_net_eth_proto(struct sk_buff *skb)
+static u16 bnep_net_eth_proto(struct sk_buff *skb)
 {
         struct ethhdr *eh = (void *) skb->data;
         u16 proto = ntohs(eh->h_proto);
@@ -154,7 +146,7 @@ static inline u16 bnep_net_eth_proto(struct sk_buff *skb)
         return ETH_P_802_2;
 }
 
-static inline int bnep_net_proto_filter(struct sk_buff *skb, struct bnep_session *s)
+static int bnep_net_proto_filter(struct sk_buff *skb, struct bnep_session *s)
 {
         u16 proto = bnep_net_eth_proto(skb);
         struct bnep_proto_filter *f = s->proto_filter;
diff --git a/net/bluetooth/bnep/sock.c b/net/bluetooth/bnep/sock.c
index 180bfc45810d..5e5f5b410e0b 100644
--- a/net/bluetooth/bnep/sock.c
+++ b/net/bluetooth/bnep/sock.c
@@ -24,24 +24,8 @@
    SOFTWARE IS DISCLAIMED.
 */
 
-#include <linux/module.h>
-
-#include <linux/types.h>
-#include <linux/capability.h>
-#include <linux/errno.h>
-#include <linux/kernel.h>
-#include <linux/poll.h>
-#include <linux/fcntl.h>
-#include <linux/skbuff.h>
-#include <linux/socket.h>
-#include <linux/ioctl.h>
+#include <linux/export.h>
 #include <linux/file.h>
-#include <linux/init.h>
-#include <linux/compat.h>
-#include <linux/gfp.h>
-#include <linux/uaccess.h>
-#include <net/sock.h>
-
 
 #include "bnep.h"
 
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 3f18a6ed9731..2fcced377e50 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -24,24 +24,11 @@
 
 /* Bluetooth HCI connection handling. */
 
-#include <linux/module.h>
-
-#include <linux/types.h>
-#include <linux/errno.h>
-#include <linux/kernel.h>
-#include <linux/slab.h>
-#include <linux/poll.h>
-#include <linux/fcntl.h>
-#include <linux/init.h>
-#include <linux/skbuff.h>
-#include <linux/interrupt.h>
-#include <net/sock.h>
-
-#include <linux/uaccess.h>
-#include <asm/unaligned.h>
+#include <linux/export.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
+#include <net/bluetooth/a2mp.h>
 
 static void hci_le_connect(struct hci_conn *conn)
 {
@@ -54,15 +41,15 @@ static void hci_le_connect(struct hci_conn *conn)
         conn->sec_level = BT_SECURITY_LOW;
 
         memset(&cp, 0, sizeof(cp));
-        cp.scan_interval = cpu_to_le16(0x0060);
-        cp.scan_window = cpu_to_le16(0x0030);
+        cp.scan_interval = __constant_cpu_to_le16(0x0060);
+        cp.scan_window = __constant_cpu_to_le16(0x0030);
         bacpy(&cp.peer_addr, &conn->dst);
         cp.peer_addr_type = conn->dst_type;
-        cp.conn_interval_min = cpu_to_le16(0x0028);
-        cp.conn_interval_max = cpu_to_le16(0x0038);
-        cp.supervision_timeout = cpu_to_le16(0x002a);
-        cp.min_ce_len = cpu_to_le16(0x0000);
-        cp.max_ce_len = cpu_to_le16(0x0000);
+        cp.conn_interval_min = __constant_cpu_to_le16(0x0028);
+        cp.conn_interval_max = __constant_cpu_to_le16(0x0038);
+        cp.supervision_timeout = __constant_cpu_to_le16(0x002a);
+        cp.min_ce_len = __constant_cpu_to_le16(0x0000);
+        cp.max_ce_len = __constant_cpu_to_le16(0x0000);
 
         hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
 }
@@ -99,7 +86,7 @@ void hci_acl_connect(struct hci_conn *conn)
                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
                         cp.pscan_mode     = ie->data.pscan_mode;
                         cp.clock_offset   = ie->data.clock_offset |
-                                                        cpu_to_le16(0x8000);
+                                            __constant_cpu_to_le16(0x8000);
                 }
 
                 memcpy(conn->dev_class, ie->data.dev_class, 3);
@@ -175,9 +162,9 @@ void hci_setup_sync(struct hci_conn *conn, __u16 handle)
         cp.handle   = cpu_to_le16(handle);
         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 
-        cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
-        cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
-        cp.max_latency    = cpu_to_le16(0xffff);
+        cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
+        cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
+        cp.max_latency    = __constant_cpu_to_le16(0xffff);
         cp.voice_setting  = cpu_to_le16(hdev->voice_setting);
         cp.retrans_effort = 0xff;
 
@@ -185,7 +172,7 @@ void hci_setup_sync(struct hci_conn *conn, __u16 handle)
 }
 
 void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
-                                        u16 latency, u16 to_multiplier)
+                        u16 latency, u16 to_multiplier)
 {
         struct hci_cp_le_conn_update cp;
         struct hci_dev *hdev = conn->hdev;
@@ -197,15 +184,14 @@ void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
         cp.conn_interval_max    = cpu_to_le16(max);
         cp.conn_latency         = cpu_to_le16(latency);
         cp.supervision_timeout  = cpu_to_le16(to_multiplier);
-        cp.min_ce_len           = cpu_to_le16(0x0001);
-        cp.max_ce_len           = cpu_to_le16(0x0001);
+        cp.min_ce_len           = __constant_cpu_to_le16(0x0001);
+        cp.max_ce_len           = __constant_cpu_to_le16(0x0001);
 
         hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
 }
-EXPORT_SYMBOL(hci_le_conn_update);
 
 void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
-                                                        __u8 ltk[16])
+                      __u8 ltk[16])
 {
         struct hci_dev *hdev = conn->hdev;
         struct hci_cp_le_start_enc cp;
@@ -221,7 +207,6 @@ void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
 
         hci_send_cmd(hdev, HCI_OP_LE_START_ENC, sizeof(cp), &cp);
 }
-EXPORT_SYMBOL(hci_le_start_enc);
 
 /* Device _must_ be locked */
 void hci_sco_setup(struct hci_conn *conn, __u8 status)
@@ -247,7 +232,7 @@ void hci_sco_setup(struct hci_conn *conn, __u8 status)
 static void hci_conn_timeout(struct work_struct *work)
 {
         struct hci_conn *conn = container_of(work, struct hci_conn,
-                                                        disc_work.work);
+                                             disc_work.work);
         __u8 reason;
 
         BT_DBG("conn %p state %s", conn, state_to_string(conn->state));
@@ -295,9 +280,9 @@ static void hci_conn_enter_sniff_mode(struct hci_conn *conn)
         if (lmp_sniffsubr_capable(hdev) && lmp_sniffsubr_capable(conn)) {
                 struct hci_cp_sniff_subrate cp;
                 cp.handle             = cpu_to_le16(conn->handle);
-                cp.max_latency        = cpu_to_le16(0);
-                cp.min_remote_timeout = cpu_to_le16(0);
-                cp.min_local_timeout  = cpu_to_le16(0);
+                cp.max_latency        = __constant_cpu_to_le16(0);
+                cp.min_remote_timeout = __constant_cpu_to_le16(0);
+                cp.min_local_timeout  = __constant_cpu_to_le16(0);
                 hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
         }
 
@@ -306,8 +291,8 @@ static void hci_conn_enter_sniff_mode(struct hci_conn *conn)
                 cp.handle       = cpu_to_le16(conn->handle);
                 cp.max_interval = cpu_to_le16(hdev->sniff_max_interval);
                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
-                cp.attempt      = cpu_to_le16(4);
-                cp.timeout      = cpu_to_le16(1);
+                cp.attempt      = __constant_cpu_to_le16(4);
+                cp.timeout      = __constant_cpu_to_le16(1);
                 hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
         }
 }
@@ -327,7 +312,7 @@ static void hci_conn_auto_accept(unsigned long arg)
         struct hci_dev *hdev = conn->hdev;
 
         hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
-                                                                &conn->dst);
+                     &conn->dst);
 }
 
 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
@@ -376,7 +361,7 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
         INIT_DELAYED_WORK(&conn->disc_work, hci_conn_timeout);
         setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
         setup_timer(&conn->auto_accept_timer, hci_conn_auto_accept,
-                                                        (unsigned long) conn);
+                    (unsigned long) conn);
 
         atomic_set(&conn->refcnt, 0);
 
@@ -425,9 +410,11 @@ int hci_conn_del(struct hci_conn *conn)
                 }
         }
 
-
         hci_chan_list_flush(conn);
 
+        if (conn->amp_mgr)
+                amp_mgr_put(conn->amp_mgr);
+
         hci_conn_hash_del(hdev, conn);
         if (hdev->notify)
                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
@@ -454,7 +441,8 @@ struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
         read_lock(&hci_dev_list_lock);
 
         list_for_each_entry(d, &hci_dev_list, list) {
-                if (!test_bit(HCI_UP, &d->flags) || test_bit(HCI_RAW, &d->flags))
+                if (!test_bit(HCI_UP, &d->flags) ||
+                    test_bit(HCI_RAW, &d->flags))
                         continue;
 
                 /* Simple routing:
@@ -495,6 +483,11 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
         if (type == LE_LINK) {
                 le = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
                 if (!le) {
+                        le = hci_conn_hash_lookup_state(hdev, LE_LINK,
+                                                        BT_CONNECT);
+                        if (le)
+                                return ERR_PTR(-EBUSY);
+
                         le = hci_conn_add(hdev, LE_LINK, dst);
                         if (!le)
                                 return ERR_PTR(-ENOMEM);
@@ -545,7 +538,7 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
         hci_conn_hold(sco);
 
         if (acl->state == BT_CONNECTED &&
-                        (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
+            (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
                 set_bit(HCI_CONN_POWER_SAVE, &acl->flags);
                 hci_conn_enter_active_mode(acl, BT_POWER_FORCE_ACTIVE_ON);
 
@@ -560,7 +553,6 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
 
         return sco;
 }
-EXPORT_SYMBOL(hci_connect);
 
 /* Check link security requirement */
 int hci_conn_check_link_mode(struct hci_conn *conn)
@@ -572,7 +564,6 @@ int hci_conn_check_link_mode(struct hci_conn *conn)
 
         return 1;
 }
-EXPORT_SYMBOL(hci_conn_check_link_mode);
 
 /* Authenticate remote device */
 static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
@@ -600,7 +591,7 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 
                 cp.handle = cpu_to_le16(conn->handle);
                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
-                                                        sizeof(cp), &cp);
+                             sizeof(cp), &cp);
                 if (conn->key_type != 0xff)
                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
         }
@@ -618,7 +609,7 @@ static void hci_conn_encrypt(struct hci_conn *conn)
                 cp.handle  = cpu_to_le16(conn->handle);
                 cp.encrypt = 0x01;
                 hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
-                                                                        &cp);
+                             &cp);
         }
 }
 
@@ -648,8 +639,7 @@ int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
         /* An unauthenticated combination key has sufficient security for
            security level 1 and 2. */
         if (conn->key_type == HCI_LK_UNAUTH_COMBINATION &&
-                        (sec_level == BT_SECURITY_MEDIUM ||
-                        sec_level == BT_SECURITY_LOW))
+            (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
                 goto encrypt;
 
         /* A combination key has always sufficient security for the security
@@ -657,8 +647,7 @@ int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
            is generated using maximum PIN code length (16).
            For pre 2.1 units. */
         if (conn->key_type == HCI_LK_COMBINATION &&
-                        (sec_level != BT_SECURITY_HIGH ||
-                        conn->pin_length == 16))
+            (sec_level != BT_SECURITY_HIGH || conn->pin_length == 16))
                 goto encrypt;
 
 auth:
@@ -701,12 +690,11 @@ int hci_conn_change_link_key(struct hci_conn *conn)
                 struct hci_cp_change_conn_link_key cp;
                 cp.handle = cpu_to_le16(conn->handle);
                 hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY,
-                                                        sizeof(cp), &cp);
+                             sizeof(cp), &cp);
         }
 
         return 0;
 }
-EXPORT_SYMBOL(hci_conn_change_link_key);
 
 /* Switch role */
 int hci_conn_switch_role(struct hci_conn *conn, __u8 role)
@@ -752,7 +740,7 @@ void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
 timer:
         if (hdev->idle_timeout > 0)
                 mod_timer(&conn->idle_timer,
-                        jiffies + msecs_to_jiffies(hdev->idle_timeout));
+                          jiffies + msecs_to_jiffies(hdev->idle_timeout));
 }
 
 /* Drop all connection on the device */
@@ -802,7 +790,7 @@ EXPORT_SYMBOL(hci_conn_put_device);
 
 int hci_get_conn_list(void __user *arg)
 {
-        register struct hci_conn *c;
+        struct hci_conn *c;
         struct hci_conn_list_req req, *cl;
         struct hci_conn_info *ci;
         struct hci_dev *hdev;
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 411ace8e647b..08994ecc3b6a 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -25,28 +25,10 @@
 
 /* Bluetooth HCI core. */
 
-#include <linux/jiffies.h>
-#include <linux/module.h>
-#include <linux/kmod.h>
-
-#include <linux/types.h>
-#include <linux/errno.h>
-#include <linux/kernel.h>
-#include <linux/sched.h>
-#include <linux/slab.h>
-#include <linux/poll.h>
-#include <linux/fcntl.h>
-#include <linux/init.h>
-#include <linux/skbuff.h>
-#include <linux/workqueue.h>
-#include <linux/interrupt.h>
-#include <linux/rfkill.h>
-#include <linux/timer.h>
-#include <linux/crypto.h>
-#include <net/sock.h>
+#include <linux/export.h>
+#include <linux/idr.h>
 
-#include <linux/uaccess.h>
-#include <asm/unaligned.h>
+#include <linux/rfkill.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
@@ -65,6 +47,9 @@ DEFINE_RWLOCK(hci_dev_list_lock);
 LIST_HEAD(hci_cb_list);
 DEFINE_RWLOCK(hci_cb_list_lock);
 
+/* HCI ID Numbering */
+static DEFINE_IDA(hci_index_ida);
+
 /* ---- HCI notifications ---- */
 
 static void hci_notify(struct hci_dev *hdev, int event)
@@ -124,8 +109,9 @@ static void hci_req_cancel(struct hci_dev *hdev, int err)
 }
 
 /* Execute request and wait for completion. */
-static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
-                                        unsigned long opt, __u32 timeout)
+static int __hci_request(struct hci_dev *hdev,
+                         void (*req)(struct hci_dev *hdev, unsigned long opt),
+                         unsigned long opt, __u32 timeout)
 {
         DECLARE_WAITQUEUE(wait, current);
         int err = 0;
@@ -166,8 +152,9 @@ static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev,
         return err;
 }
 
-static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
-                                        unsigned long opt, __u32 timeout)
+static int hci_request(struct hci_dev *hdev,
+                       void (*req)(struct hci_dev *hdev, unsigned long opt),
+                       unsigned long opt, __u32 timeout)
 {
         int ret;
 
@@ -202,7 +189,7 @@ static void bredr_init(struct hci_dev *hdev)
         /* Mandatory initialization */
 
         /* Reset */
-        if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
+        if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
                 set_bit(HCI_RESET, &hdev->flags);
                 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
         }
@@ -235,7 +222,7 @@ static void bredr_init(struct hci_dev *hdev)
         hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
 
         /* Connection accept timeout ~20 secs */
-        param = cpu_to_le16(0x7d00);
+        param = __constant_cpu_to_le16(0x7d00);
         hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
 
         bacpy(&cp.bdaddr, BDADDR_ANY);
@@ -417,7 +404,8 @@ static void inquiry_cache_flush(struct hci_dev *hdev)
         INIT_LIST_HEAD(&cache->resolve);
 }
 
-struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
+struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
+                                               bdaddr_t *bdaddr)
 {
         struct discovery_state *cache = &hdev->discovery;
         struct inquiry_entry *e;
@@ -478,7 +466,7 @@ void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
 
         list_for_each_entry(p, &cache->resolve, list) {
                 if (p->name_state != NAME_PENDING &&
-                                abs(p->data.rssi) >= abs(ie->data.rssi))
+                    abs(p->data.rssi) >= abs(ie->data.rssi))
                         break;
                 pos = &p->list;
         }
@@ -503,7 +491,7 @@ bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
                         *ssp = true;
 
                 if (ie->name_state == NAME_NEEDED &&
-                                                data->rssi != ie->data.rssi) {
+                    data->rssi != ie->data.rssi) {
                         ie->data.rssi = data->rssi;
                         hci_inquiry_cache_update_resolve(hdev, ie);
                 }
@@ -527,7 +515,7 @@ bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
 
 update:
         if (name_known && ie->name_state != NAME_KNOWN &&
-                                        ie->name_state != NAME_PENDING) {
+            ie->name_state != NAME_PENDING) {
                 ie->name_state = NAME_KNOWN;
                 list_del(&ie->list);
         }
@@ -605,8 +593,7 @@ int hci_inquiry(void __user *arg)
 
         hci_dev_lock(hdev);
         if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
-                                inquiry_cache_empty(hdev) ||
-                                ir.flags & IREQ_CACHE_FLUSH) {
+            inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
                 inquiry_cache_flush(hdev);
                 do_inquiry = 1;
         }
@@ -620,7 +607,9 @@ int hci_inquiry(void __user *arg)
                         goto done;
         }
 
-        /* for unlimited number of responses we will use buffer with 255 entries */
+        /* for unlimited number of responses we will use buffer with
+         * 255 entries
+         */
         max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
 
         /* cache_dump can't sleep. Therefore we allocate temp buffer and then
@@ -641,7 +630,7 @@ int hci_inquiry(void __user *arg)
         if (!copy_to_user(ptr, &ir, sizeof(ir))) {
                 ptr += sizeof(ir);
                 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
-                                        ir.num_rsp))
+                                 ir.num_rsp))
                         err = -EFAULT;
         } else
                 err = -EFAULT;
@@ -702,11 +691,11 @@ int hci_dev_open(__u16 dev)
                 hdev->init_last_cmd = 0;
 
                 ret = __hci_request(hdev, hci_init_req, 0,
-                                        msecs_to_jiffies(HCI_INIT_TIMEOUT));
+                                    msecs_to_jiffies(HCI_INIT_TIMEOUT));
 
                 if (lmp_host_le_capable(hdev))
                         ret = __hci_request(hdev, hci_le_init_req, 0,
-                                        msecs_to_jiffies(HCI_INIT_TIMEOUT));
+                                            msecs_to_jiffies(HCI_INIT_TIMEOUT));
 
                 clear_bit(HCI_INIT, &hdev->flags);
         }
@@ -791,10 +780,10 @@ static int hci_dev_do_close(struct hci_dev *hdev)
         skb_queue_purge(&hdev->cmd_q);
         atomic_set(&hdev->cmd_cnt, 1);
         if (!test_bit(HCI_RAW, &hdev->flags) &&
-                                test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
+            test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
                 set_bit(HCI_INIT, &hdev->flags);
                 __hci_request(hdev, hci_reset_req, 0,
-                                        msecs_to_jiffies(250));
+                              msecs_to_jiffies(250));
                 clear_bit(HCI_INIT, &hdev->flags);
         }
 
@@ -884,7 +873,7 @@ int hci_dev_reset(__u16 dev)
 
         if (!test_bit(HCI_RAW, &hdev->flags))
                 ret = __hci_request(hdev, hci_reset_req, 0,
-                                        msecs_to_jiffies(HCI_INIT_TIMEOUT));
+                                    msecs_to_jiffies(HCI_INIT_TIMEOUT));
 
 done:
         hci_req_unlock(hdev);
@@ -924,7 +913,7 @@ int hci_dev_cmd(unsigned int cmd, void __user *arg)
         switch (cmd) {
         case HCISETAUTH:
                 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
-                                        msecs_to_jiffies(HCI_INIT_TIMEOUT));
+                                  msecs_to_jiffies(HCI_INIT_TIMEOUT));
                 break;
 
         case HCISETENCRYPT:
@@ -936,23 +925,23 @@ int hci_dev_cmd(unsigned int cmd, void __user *arg)
                 if (!test_bit(HCI_AUTH, &hdev->flags)) {
                         /* Auth must be enabled first */
                         err = hci_request(hdev, hci_auth_req, dr.dev_opt,
-                                        msecs_to_jiffies(HCI_INIT_TIMEOUT));
+                                          msecs_to_jiffies(HCI_INIT_TIMEOUT));
                         if (err)
                                 break;
                 }
 
                 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
-                                        msecs_to_jiffies(HCI_INIT_TIMEOUT));
+                                  msecs_to_jiffies(HCI_INIT_TIMEOUT));
                 break;
 
         case HCISETSCAN:
                 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
-                                        msecs_to_jiffies(HCI_INIT_TIMEOUT));
+                                  msecs_to_jiffies(HCI_INIT_TIMEOUT));
                 break;
 
         case HCISETLINKPOL:
                 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
-                                        msecs_to_jiffies(HCI_INIT_TIMEOUT));
+                                  msecs_to_jiffies(HCI_INIT_TIMEOUT));
                 break;
 
         case HCISETLINKMODE:
@@ -1103,7 +1092,7 @@ static void hci_power_on(struct work_struct *work)
 
         if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
                 schedule_delayed_work(&hdev->power_off,
-                                        msecs_to_jiffies(AUTO_OFF_TIMEOUT));
+                                      msecs_to_jiffies(AUTO_OFF_TIMEOUT));
 
         if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags))
                 mgmt_index_added(hdev);
@@ -1112,7 +1101,7 @@ static void hci_power_on(struct work_struct *work)
 static void hci_power_off(struct work_struct *work)
 {
         struct hci_dev *hdev = container_of(work, struct hci_dev,
-                                                        power_off.work);
+                                            power_off.work);
 
         BT_DBG("%s", hdev->name);
 
@@ -1193,7 +1182,7 @@ struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
 }
 
 static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
-                                                u8 key_type, u8 old_key_type)
+                               u8 key_type, u8 old_key_type)
 {
         /* Legacy key */
         if (key_type < 0x03)
@@ -1234,7 +1223,7 @@ struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
 
         list_for_each_entry(k, &hdev->long_term_keys, list) {
                 if (k->ediv != ediv ||
-                                memcmp(rand, k->rand, sizeof(k->rand)))
+                    memcmp(rand, k->rand, sizeof(k->rand)))
                         continue;
 
                 return k;
@@ -1242,7 +1231,6 @@ struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
 
         return NULL;
 }
-EXPORT_SYMBOL(hci_find_ltk);
 
 struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
                                      u8 addr_type)
@@ -1251,12 +1239,11 @@ struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
 
         list_for_each_entry(k, &hdev->long_term_keys, list)
                 if (addr_type == k->bdaddr_type &&
-                                        bacmp(bdaddr, &k->bdaddr) == 0)
+                    bacmp(bdaddr, &k->bdaddr) == 0)
                         return k;
 
         return NULL;
 }
-EXPORT_SYMBOL(hci_find_ltk_by_addr);
 
 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
                      bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
@@ -1283,15 +1270,14 @@ int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
          * combination key for legacy pairing even when there's no
          * previous key */
         if (type == HCI_LK_CHANGED_COMBINATION &&
-                                        (!conn || conn->remote_auth == 0xff) &&
-                                        old_key_type == 0xff) {
+            (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
                 type = HCI_LK_COMBINATION;
                 if (conn)
                         conn->key_type = type;
         }
 
         bacpy(&key->bdaddr, bdaddr);
-        memcpy(key->val, val, 16);
+        memcpy(key->val, val, HCI_LINK_KEY_SIZE);
         key->pin_len = pin_len;
 
         if (type == HCI_LK_CHANGED_COMBINATION)
@@ -1540,6 +1526,7 @@ static void le_scan_enable_req(struct hci_dev *hdev, unsigned long opt)
 
         memset(&cp, 0, sizeof(cp));
         cp.enable = 1;
+        cp.filter_dup = 1;
 
         hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
 }
@@ -1707,41 +1694,39 @@ EXPORT_SYMBOL(hci_free_dev);
 /* Register HCI device */
 int hci_register_dev(struct hci_dev *hdev)
 {
-        struct list_head *head, *p;
         int id, error;
 
         if (!hdev->open || !hdev->close)
                 return -EINVAL;
 
-        write_lock(&hci_dev_list_lock);
-
         /* Do not allow HCI_AMP devices to register at index 0,
          * so the index can be used as the AMP controller ID.
          */
-        id = (hdev->dev_type == HCI_BREDR) ? 0 : 1;
-        head = &hci_dev_list;
-
-        /* Find first available device id */
-        list_for_each(p, &hci_dev_list) {
-                int nid = list_entry(p, struct hci_dev, list)->id;
-                if (nid > id)
-                        break;
-                if (nid == id)
-                        id++;
-                head = p;
+        switch (hdev->dev_type) {
+        case HCI_BREDR:
+                id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
+                break;
+        case HCI_AMP:
+                id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
+                break;
+        default:
+                return -EINVAL;
         }
 
+        if (id < 0)
+                return id;
+
         sprintf(hdev->name, "hci%d", id);
         hdev->id = id;
 
         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
 
-        list_add(&hdev->list, head);
-
+        write_lock(&hci_dev_list_lock);
+        list_add(&hdev->list, &hci_dev_list);
         write_unlock(&hci_dev_list_lock);
 
         hdev->workqueue = alloc_workqueue(hdev->name, WQ_HIGHPRI | WQ_UNBOUND |
-                                                        WQ_MEM_RECLAIM, 1);
+                                          WQ_MEM_RECLAIM, 1);
         if (!hdev->workqueue) {
                 error = -ENOMEM;
                 goto err;
@@ -1752,7 +1737,8 @@ int hci_register_dev(struct hci_dev *hdev)
                 goto err_wqueue;
 
         hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
-                                RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, hdev);
+                                    RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
+                                    hdev);
         if (hdev->rfkill) {
                 if (rfkill_register(hdev->rfkill) < 0) {
                         rfkill_destroy(hdev->rfkill);
@@ -1772,6 +1758,7 @@ int hci_register_dev(struct hci_dev *hdev)
 err_wqueue:
         destroy_workqueue(hdev->workqueue);
 err:
+        ida_simple_remove(&hci_index_ida, hdev->id);
         write_lock(&hci_dev_list_lock);
         list_del(&hdev->list);
         write_unlock(&hci_dev_list_lock);
@@ -1783,12 +1770,14 @@ EXPORT_SYMBOL(hci_register_dev);
 /* Unregister HCI device */
 void hci_unregister_dev(struct hci_dev *hdev)
 {
-        int i;
+        int i, id;
 
         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
 
         set_bit(HCI_UNREGISTER, &hdev->dev_flags);
 
+        id = hdev->id;
+
         write_lock(&hci_dev_list_lock);
         list_del(&hdev->list);
         write_unlock(&hci_dev_list_lock);
@@ -1799,7 +1788,7 @@ void hci_unregister_dev(struct hci_dev *hdev)
                 kfree_skb(hdev->reassembly[i]);
 
         if (!test_bit(HCI_INIT, &hdev->flags) &&
-                                !test_bit(HCI_SETUP, &hdev->dev_flags)) {
+            !test_bit(HCI_SETUP, &hdev->dev_flags)) {
                 hci_dev_lock(hdev);
                 mgmt_index_removed(hdev);
                 hci_dev_unlock(hdev);
@@ -1829,6 +1818,8 @@ void hci_unregister_dev(struct hci_dev *hdev)
         hci_dev_unlock(hdev);
 
         hci_dev_put(hdev);
+
+        ida_simple_remove(&hci_index_ida, id);
 }
 EXPORT_SYMBOL(hci_unregister_dev);
 
@@ -1853,7 +1844,7 @@ int hci_recv_frame(struct sk_buff *skb)
 {
         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
         if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
-                                && !test_bit(HCI_INIT, &hdev->flags))) {
+                      && !test_bit(HCI_INIT, &hdev->flags))) {
                 kfree_skb(skb);
                 return -ENXIO;
         }
@@ -1872,7 +1863,7 @@ int hci_recv_frame(struct sk_buff *skb)
 EXPORT_SYMBOL(hci_recv_frame);
 
 static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
-                                                  int count, __u8 index)
+                          int count, __u8 index)
 {
         int len = 0;
         int hlen = 0;
@@ -1881,7 +1872,7 @@ static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
         struct bt_skb_cb *scb;
 
         if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
-                                index >= NUM_REASSEMBLY)
+            index >= NUM_REASSEMBLY)
                 return -EILSEQ;
 
         skb = hdev->reassembly[index];
@@ -2023,7 +2014,7 @@ int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
                         type = bt_cb(skb)->pkt_type;
 
                 rem = hci_reassembly(hdev, type, data, count,
-                                                        STREAM_REASSEMBLY);
+                                     STREAM_REASSEMBLY);
                 if (rem < 0)
                         return rem;
 
@@ -2157,7 +2148,7 @@ static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
 }
 
 static void hci_queue_acl(struct hci_conn *conn, struct sk_buff_head *queue,
-                                struct sk_buff *skb, __u16 flags)
+                          struct sk_buff *skb, __u16 flags)
 {
         struct hci_dev *hdev = conn->hdev;
         struct sk_buff *list;
@@ -2216,7 +2207,6 @@ void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
 
         queue_work(hdev->workqueue, &hdev->tx_work);
 }
-EXPORT_SYMBOL(hci_send_acl);
 
 /* Send SCO data */
 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
@@ -2239,12 +2229,12 @@ void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
         skb_queue_tail(&conn->data_q, skb);
         queue_work(hdev->workqueue, &hdev->tx_work);
 }
-EXPORT_SYMBOL(hci_send_sco);
 
 /* ---- HCI TX task (outgoing data) ---- */
 
 /* HCI Connection scheduler */
-static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
+static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
+                                     int *quote)
 {
         struct hci_conn_hash *h = &hdev->conn_hash;
         struct hci_conn *conn = NULL, *c;
@@ -2303,7 +2293,7 @@ static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int
         return conn;
 }
 
-static inline void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
+static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
 {
         struct hci_conn_hash *h = &hdev->conn_hash;
         struct hci_conn *c;
@@ -2316,16 +2306,16 @@ static inline void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
         list_for_each_entry_rcu(c, &h->list, list) {
                 if (c->type == type && c->sent) {
                         BT_ERR("%s killing stalled connection %s",
-                                hdev->name, batostr(&c->dst));
-                        hci_acl_disconn(c, 0x13);
+                               hdev->name, batostr(&c->dst));
+                        hci_acl_disconn(c, HCI_ERROR_REMOTE_USER_TERM);
                 }
         }
 
         rcu_read_unlock();
 }
 
-static inline struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
-                                                int *quote)
+static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
+                                      int *quote)
 {
         struct hci_conn_hash *h = &hdev->conn_hash;
         struct hci_chan *chan = NULL;
@@ -2442,7 +2432,7 @@ static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
                         skb->priority = HCI_PRIO_MAX - 1;
 
                         BT_DBG("chan %p skb %p promoted to %d", chan, skb,
-                                                                skb->priority);
+                               skb->priority);
                 }
 
                 if (hci_conn_num(hdev, type) == num)
@@ -2459,18 +2449,18 @@ static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
         return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
 }
 
-static inline void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
+static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
 {
         if (!test_bit(HCI_RAW, &hdev->flags)) {
                 /* ACL tx timeout must be longer than maximum
                  * link supervision timeout (40.9 seconds) */
                 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
-                                        msecs_to_jiffies(HCI_ACL_TX_TIMEOUT)))
+                                       msecs_to_jiffies(HCI_ACL_TX_TIMEOUT)))
                         hci_link_tx_to(hdev, ACL_LINK);
         }
 }
 
-static inline void hci_sched_acl_pkt(struct hci_dev *hdev)
+static void hci_sched_acl_pkt(struct hci_dev *hdev)
 {
         unsigned int cnt = hdev->acl_cnt;
         struct hci_chan *chan;
@@ -2480,11 +2470,11 @@ static inline void hci_sched_acl_pkt(struct hci_dev *hdev)
         __check_timeout(hdev, cnt);
 
         while (hdev->acl_cnt &&
-                        (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
+               (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
                 u32 priority = (skb_peek(&chan->data_q))->priority;
                 while (quote-- && (skb = skb_peek(&chan->data_q))) {
                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
-                                        skb->len, skb->priority);
+                               skb->len, skb->priority);
 
                         /* Stop if priority has changed */
                         if (skb->priority < priority)
@@ -2508,7 +2498,7 @@ static inline void hci_sched_acl_pkt(struct hci_dev *hdev)
                 hci_prio_recalculate(hdev, ACL_LINK);
 }
 
-static inline void hci_sched_acl_blk(struct hci_dev *hdev)
+static void hci_sched_acl_blk(struct hci_dev *hdev)
 {
         unsigned int cnt = hdev->block_cnt;
         struct hci_chan *chan;
@@ -2518,13 +2508,13 @@ static inline void hci_sched_acl_blk(struct hci_dev *hdev)
         __check_timeout(hdev, cnt);
 
         while (hdev->block_cnt > 0 &&
-                        (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
+               (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
                 u32 priority = (skb_peek(&chan->data_q))->priority;
                 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
                         int blocks;
 
                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
-                                                skb->len, skb->priority);
+                               skb->len, skb->priority);
 
                         /* Stop if priority has changed */
                         if (skb->priority < priority)
@@ -2537,7 +2527,7 @@ static inline void hci_sched_acl_blk(struct hci_dev *hdev)
                                 return;
 
                         hci_conn_enter_active_mode(chan->conn,
-                                                bt_cb(skb)->force_active);
+                                                   bt_cb(skb)->force_active);
 
                         hci_send_frame(skb);
                         hdev->acl_last_tx = jiffies;
@@ -2554,7 +2544,7 @@ static inline void hci_sched_acl_blk(struct hci_dev *hdev)
                 hci_prio_recalculate(hdev, ACL_LINK);
 }
 
-static inline void hci_sched_acl(struct hci_dev *hdev)
+static void hci_sched_acl(struct hci_dev *hdev)
 {
         BT_DBG("%s", hdev->name);
 
@@ -2573,7 +2563,7 @@ static inline void hci_sched_acl(struct hci_dev *hdev)
 }
 
 /* Schedule SCO */
-static inline void hci_sched_sco(struct hci_dev *hdev)
+static void hci_sched_sco(struct hci_dev *hdev)
 {
         struct hci_conn *conn;
         struct sk_buff *skb;
@@ -2596,7 +2586,7 @@ static inline void hci_sched_sco(struct hci_dev *hdev)
         }
 }
 
-static inline void hci_sched_esco(struct hci_dev *hdev)
+static void hci_sched_esco(struct hci_dev *hdev)
 {
         struct hci_conn *conn;
         struct sk_buff *skb;
@@ -2607,7 +2597,8 @@ static inline void hci_sched_esco(struct hci_dev *hdev)
         if (!hci_conn_num(hdev, ESCO_LINK))
                 return;
 
-        while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
+        while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
+                                                     &quote))) {
                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
                         BT_DBG("skb %p len %d", skb, skb->len);
                         hci_send_frame(skb);
@@ -2619,7 +2610,7 @@ static inline void hci_sched_esco(struct hci_dev *hdev)
         }
 }
 
-static inline void hci_sched_le(struct hci_dev *hdev)
+static void hci_sched_le(struct hci_dev *hdev)
 {
         struct hci_chan *chan;
         struct sk_buff *skb;
@@ -2634,7 +2625,7 @@ static inline void hci_sched_le(struct hci_dev *hdev)
                 /* LE tx timeout must be longer than maximum
                  * link supervision timeout (40.9 seconds) */
                 if (!hdev->le_cnt && hdev->le_pkts &&
-                                time_after(jiffies, hdev->le_last_tx + HZ * 45))
+                    time_after(jiffies, hdev->le_last_tx + HZ * 45))
                         hci_link_tx_to(hdev, LE_LINK);
         }
 
@@ -2644,7 +2635,7 @@ static inline void hci_sched_le(struct hci_dev *hdev)
                 u32 priority = (skb_peek(&chan->data_q))->priority;
                 while (quote-- && (skb = skb_peek(&chan->data_q))) {
                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
-                                        skb->len, skb->priority);
+                               skb->len, skb->priority);
 
                         /* Stop if priority has changed */
                         if (skb->priority < priority)
@@ -2676,7 +2667,7 @@ static void hci_tx_work(struct work_struct *work)
         struct sk_buff *skb;
 
         BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
-                hdev->sco_cnt, hdev->le_cnt);
+               hdev->sco_cnt, hdev->le_cnt);
 
         /* Schedule queues and send stuff to HCI driver */
 
@@ -2696,7 +2687,7 @@ static void hci_tx_work(struct work_struct *work)
 /* ----- HCI RX task (incoming data processing) ----- */
 
 /* ACL data packet */
-static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_acl_hdr *hdr = (void *) skb->data;
         struct hci_conn *conn;
@@ -2708,7 +2699,8 @@ static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
         flags  = hci_flags(handle);
         handle = hci_handle(handle);
 
-        BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
+        BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len,
+               handle, flags);
 
         hdev->stat.acl_rx++;
 
@@ -2732,14 +2724,14 @@ static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
                 return;
         } else {
                 BT_ERR("%s ACL packet for unknown connection handle %d",
-                        hdev->name, handle);
+                       hdev->name, handle);
         }
 
         kfree_skb(skb);
 }
 
 /* SCO data packet */
-static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_sco_hdr *hdr = (void *) skb->data;
         struct hci_conn *conn;
@@ -2763,7 +2755,7 @@ static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
                 return;
         } else {
                 BT_ERR("%s SCO packet for unknown connection handle %d",
-                        hdev->name, handle);
+                       hdev->name, handle);
         }
 
         kfree_skb(skb);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 94ad124a4ea3..1ba929c05d0d 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -24,20 +24,7 @@
 
 /* Bluetooth HCI event handling. */
 
-#include <linux/module.h>
-
-#include <linux/types.h>
-#include <linux/errno.h>
-#include <linux/kernel.h>
-#include <linux/slab.h>
-#include <linux/poll.h>
-#include <linux/fcntl.h>
-#include <linux/init.h>
-#include <linux/skbuff.h>
-#include <linux/interrupt.h>
-#include <net/sock.h>
-
-#include <linux/uaccess.h>
+#include <linux/export.h>
 #include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
@@ -95,7 +82,8 @@ static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
         hci_conn_check_pending(hdev);
 }
 
-static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
+                                          struct sk_buff *skb)
 {
         BT_DBG("%s", hdev->name);
 }
@@ -166,7 +154,8 @@ static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
         hci_dev_unlock(hdev);
 }
 
-static void hci_cc_read_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
+                                        struct sk_buff *skb)
 {
         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 
@@ -178,7 +167,8 @@ static void hci_cc_read_def_link_policy(struct hci_dev *hdev, struct sk_buff *sk
         hdev->link_policy = __le16_to_cpu(rp->policy);
 }
 
-static void hci_cc_write_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
+                                         struct sk_buff *skb)
 {
         __u8 status = *((__u8 *) skb->data);
         void *sent;
@@ -329,7 +319,7 @@ static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
                 if (hdev->discov_timeout > 0) {
                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
-                                                                        to);
+                                           to);
                 }
         } else if (old_iscan)
                 mgmt_discoverable(hdev, 0);
@@ -358,7 +348,7 @@ static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
         memcpy(hdev->dev_class, rp->dev_class, 3);
 
         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
-                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
+               hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 }
 
 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
@@ -406,7 +396,8 @@ static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 }
 
-static void hci_cc_write_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_cc_write_voice_setting(struct hci_dev *hdev,
+                                       struct sk_buff *skb)
 {
         __u8 status = *((__u8 *) skb->data);
         __u16 setting;
@@ -473,7 +464,7 @@ static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
                 return 1;
 
         if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
-                                                hdev->lmp_subver == 0x0757)
+            hdev->lmp_subver == 0x0757)
                 return 1;
 
         if (hdev->manufacturer == 15) {
@@ -486,7 +477,7 @@ static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
         }
 
         if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
-                                                hdev->lmp_subver == 0x1805)
+            hdev->lmp_subver == 0x1805)
                 return 1;
 
         return 0;
@@ -566,7 +557,7 @@ static void hci_setup(struct hci_dev *hdev)
         if (hdev->hci_ver > BLUETOOTH_VER_1_1)
                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 
-        if (hdev->features[6] & LMP_SIMPLE_PAIR) {
+        if (lmp_ssp_capable(hdev)) {
                 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
                         u8 mode = 0x01;
                         hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE,
@@ -618,8 +609,7 @@ static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
         hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 
         BT_DBG("%s manufacturer %d hci ver %d:%d", hdev->name,
-                                        hdev->manufacturer,
-                                        hdev->hci_ver, hdev->hci_rev);
+               hdev->manufacturer, hdev->hci_ver, hdev->hci_rev);
 
         if (test_bit(HCI_INIT, &hdev->flags))
                 hci_setup(hdev);
@@ -646,7 +636,8 @@ static void hci_setup_link_policy(struct hci_dev *hdev)
         hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
 }
 
-static void hci_cc_read_local_commands(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_cc_read_local_commands(struct hci_dev *hdev,
+                                       struct sk_buff *skb)
 {
         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 
@@ -664,7 +655,8 @@ done:
         hci_req_complete(hdev, HCI_OP_READ_LOCAL_COMMANDS, rp->status);
 }
 
-static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_cc_read_local_features(struct hci_dev *hdev,
+                                       struct sk_buff *skb)
 {
         struct hci_rp_read_local_features *rp = (void *) skb->data;
 
@@ -713,10 +705,10 @@ static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb
                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 
         BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
-                                        hdev->features[0], hdev->features[1],
-                                        hdev->features[2], hdev->features[3],
-                                        hdev->features[4], hdev->features[5],
-                                        hdev->features[6], hdev->features[7]);
+               hdev->features[0], hdev->features[1],
+               hdev->features[2], hdev->features[3],
+               hdev->features[4], hdev->features[5],
+               hdev->features[6], hdev->features[7]);
 }
 
 static void hci_set_le_support(struct hci_dev *hdev)
@@ -736,7 +728,7 @@ static void hci_set_le_support(struct hci_dev *hdev)
 }
 
 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
-                                                        struct sk_buff *skb)
+                                           struct sk_buff *skb)
 {
         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 
@@ -762,7 +754,7 @@ done:
 }
 
 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
-                                                struct sk_buff *skb)
+                                          struct sk_buff *skb)
 {
         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 
@@ -798,9 +790,8 @@ static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
         hdev->acl_cnt = hdev->acl_pkts;
         hdev->sco_cnt = hdev->sco_pkts;
 
-        BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name,
-                                        hdev->acl_mtu, hdev->acl_pkts,
-                                        hdev->sco_mtu, hdev->sco_pkts);
+        BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
+               hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 }
 
 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
@@ -816,7 +807,7 @@ static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 }
 
 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
-                                                        struct sk_buff *skb)
+                                        struct sk_buff *skb)
 {
         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 
@@ -832,7 +823,7 @@ static void hci_cc_read_data_block_size(struct hci_dev *hdev,
         hdev->block_cnt = hdev->num_blocks;
 
         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
-                                        hdev->block_cnt, hdev->block_len);
+               hdev->block_cnt, hdev->block_len);
 
         hci_req_complete(hdev, HCI_OP_READ_DATA_BLOCK_SIZE, rp->status);
 }
@@ -847,7 +838,7 @@ static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
 }
 
 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
-                struct sk_buff *skb)
+                                       struct sk_buff *skb)
 {
         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 
@@ -871,7 +862,7 @@ static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 }
 
 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
-                                                        struct sk_buff *skb)
+                                          struct sk_buff *skb)
 {
         __u8 status = *((__u8 *) skb->data);
 
@@ -890,7 +881,7 @@ static void hci_cc_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
 }
 
 static void hci_cc_write_inquiry_mode(struct hci_dev *hdev,
-                                                        struct sk_buff *skb)
+                                      struct sk_buff *skb)
 {
         __u8 status = *((__u8 *) skb->data);
 
@@ -900,7 +891,7 @@ static void hci_cc_write_inquiry_mode(struct hci_dev *hdev,
 }
 
 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
-                                                        struct sk_buff *skb)
+                                         struct sk_buff *skb)
 {
         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 
@@ -959,7 +950,7 @@ static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 
         if (test_bit(HCI_MGMT, &hdev->dev_flags))
                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
-                                                                rp->status);
+                                                 rp->status);
 
         hci_dev_unlock(hdev);
 }
@@ -1000,7 +991,7 @@ static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 }
 
 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
-                                                        struct sk_buff *skb)
+                                          struct sk_buff *skb)
 {
         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 
@@ -1031,7 +1022,7 @@ static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
 }
 
 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
-                                                        struct sk_buff *skb)
+                                          struct sk_buff *skb)
 {
         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 
@@ -1047,7 +1038,7 @@ static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
 }
 
 static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
-                                                        struct sk_buff *skb)
+                                             struct sk_buff *skb)
 {
         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
 
@@ -1076,7 +1067,7 @@ static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
 }
 
 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
-                                        struct sk_buff *skb)
+                                      struct sk_buff *skb)
 {
         struct hci_cp_le_set_scan_enable *cp;
         __u8 status = *((__u8 *) skb->data);
@@ -1156,8 +1147,8 @@ static void hci_cc_le_ltk_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
         hci_req_complete(hdev, HCI_OP_LE_LTK_NEG_REPLY, rp->status);
 }
 
-static inline void hci_cc_write_le_host_supported(struct hci_dev *hdev,
-                                                        struct sk_buff *skb)
+static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
+                                           struct sk_buff *skb)
 {
         struct hci_cp_write_le_host_supported *sent;
         __u8 status = *((__u8 *) skb->data);
@@ -1176,13 +1167,13 @@ static inline void hci_cc_write_le_host_supported(struct hci_dev *hdev,
         }
 
         if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
-                                        !test_bit(HCI_INIT, &hdev->flags))
+            !test_bit(HCI_INIT, &hdev->flags))
                 mgmt_le_enable_complete(hdev, sent->le, status);
 
         hci_req_complete(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, status);
 }
 
-static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
+static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
 {
         BT_DBG("%s status 0x%x", hdev->name, status);
 
@@ -1203,7 +1194,7 @@ static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
+static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
 {
         struct hci_cp_create_conn *cp;
         struct hci_conn *conn;
@@ -1333,7 +1324,7 @@ static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
 }
 
 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
-                                                        struct hci_conn *conn)
+                                    struct hci_conn *conn)
 {
         if (conn->state != BT_CONFIG || !conn->out)
                 return 0;
@@ -1343,15 +1334,14 @@ static int hci_outgoing_auth_needed(struct hci_dev *hdev,
 
         /* Only request authentication for SSP connections or non-SSP
          * devices with sec_level HIGH or if MITM protection is requested */
-        if (!hci_conn_ssp_enabled(conn) &&
-                                conn->pending_sec_level != BT_SECURITY_HIGH &&
-                                !(conn->auth_type & 0x01))
+        if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
+            conn->pending_sec_level != BT_SECURITY_HIGH)
                 return 0;
 
         return 1;
 }
 
-static inline int hci_resolve_name(struct hci_dev *hdev,
+static int hci_resolve_name(struct hci_dev *hdev,
                                    struct inquiry_entry *e)
 {
         struct hci_cp_remote_name_req cp;
@@ -1638,7 +1628,7 @@ static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
 
         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->peer_addr),
-                conn);
+               conn);
 
         if (status) {
                 if (conn && conn->state == BT_CONNECT) {
@@ -1668,7 +1658,7 @@ static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
         BT_DBG("%s status 0x%x", hdev->name, status);
 }
 
-static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         __u8 status = *((__u8 *) skb->data);
         struct discovery_state *discov = &hdev->discovery;
@@ -1708,7 +1698,7 @@ unlock:
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct inquiry_data data;
         struct inquiry_info *info = (void *) (skb->data + 1);
@@ -1745,7 +1735,7 @@ static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_conn_complete *ev = (void *) skb->data;
         struct hci_conn *conn;
@@ -1823,18 +1813,18 @@ unlock:
         hci_conn_check_pending(hdev);
 }
 
-static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_conn_request *ev = (void *) skb->data;
         int mask = hdev->link_mode;
 
-        BT_DBG("%s bdaddr %s type 0x%x", hdev->name,
-                                        batostr(&ev->bdaddr), ev->link_type);
+        BT_DBG("%s bdaddr %s type 0x%x", hdev->name, batostr(&ev->bdaddr),
+               ev->link_type);
 
         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
 
         if ((mask & HCI_LM_ACCEPT) &&
-                        !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
+            !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
                 /* Connection accepted */
                 struct inquiry_entry *ie;
                 struct hci_conn *conn;
@@ -1845,7 +1835,8 @@ static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *sk
                 if (ie)
                         memcpy(ie->data.dev_class, ev->dev_class, 3);
 
-                conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
+                conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
+                                               &ev->bdaddr);
                 if (!conn) {
                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
                         if (!conn) {
@@ -1878,9 +1869,9 @@ static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *sk
                         bacpy(&cp.bdaddr, &ev->bdaddr);
                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
 
-                        cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
-                        cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
-                        cp.max_latency    = cpu_to_le16(0xffff);
+                        cp.tx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
+                        cp.rx_bandwidth   = __constant_cpu_to_le32(0x00001f40);
+                        cp.max_latency    = __constant_cpu_to_le16(0xffff);
                         cp.content_format = cpu_to_le16(hdev->voice_setting);
                         cp.retrans_effort = 0xff;
 
@@ -1897,7 +1888,7 @@ static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *sk
         }
 }
 
-static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_disconn_complete *ev = (void *) skb->data;
         struct hci_conn *conn;
@@ -1914,10 +1905,10 @@ static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff
                 conn->state = BT_CLOSED;
 
         if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags) &&
-                        (conn->type == ACL_LINK || conn->type == LE_LINK)) {
+            (conn->type == ACL_LINK || conn->type == LE_LINK)) {
                 if (ev->status != 0)
                         mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
-                                                conn->dst_type, ev->status);
+                                               conn->dst_type, ev->status);
                 else
                         mgmt_device_disconnected(hdev, &conn->dst, conn->type,
                                                  conn->dst_type);
@@ -1934,7 +1925,7 @@ unlock:
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_auth_complete *ev = (void *) skb->data;
         struct hci_conn *conn;
@@ -1949,7 +1940,7 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
 
         if (!ev->status) {
                 if (!hci_conn_ssp_enabled(conn) &&
-                                test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
+                    test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
                         BT_INFO("re-auth of legacy device is not possible.");
                 } else {
                         conn->link_mode |= HCI_LM_AUTH;
@@ -1969,7 +1960,7 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                         cp.handle  = ev->handle;
                         cp.encrypt = 0x01;
                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
-                                                                        &cp);
+                                     &cp);
                 } else {
                         conn->state = BT_CONNECTED;
                         hci_proto_connect_cfm(conn, ev->status);
@@ -1989,7 +1980,7 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                         cp.handle  = ev->handle;
                         cp.encrypt = 0x01;
                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
-                                                                        &cp);
+                                     &cp);
                 } else {
                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
                         hci_encrypt_cfm(conn, ev->status, 0x00);
@@ -2000,7 +1991,7 @@ unlock:
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_remote_name *ev = (void *) skb->data;
         struct hci_conn *conn;
@@ -2039,7 +2030,7 @@ unlock:
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_encrypt_change *ev = (void *) skb->data;
         struct hci_conn *conn;
@@ -2082,7 +2073,8 @@ unlock:
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_change_link_key_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
+                                             struct sk_buff *skb)
 {
         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
         struct hci_conn *conn;
@@ -2104,7 +2096,8 @@ static inline void hci_change_link_key_complete_evt(struct hci_dev *hdev, struct
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_remote_features_evt(struct hci_dev *hdev,
+                                    struct sk_buff *skb)
 {
         struct hci_ev_remote_features *ev = (void *) skb->data;
         struct hci_conn *conn;
@@ -2128,7 +2121,7 @@ static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff
                 cp.handle = ev->handle;
                 cp.page = 0x01;
                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
-                                                        sizeof(cp), &cp);
+                             sizeof(cp), &cp);
                 goto unlock;
         }
 
@@ -2153,17 +2146,18 @@ unlock:
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         BT_DBG("%s", hdev->name);
 }
 
-static inline void hci_qos_setup_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_qos_setup_complete_evt(struct hci_dev *hdev,
+                                       struct sk_buff *skb)
 {
         BT_DBG("%s", hdev->name);
 }
 
-static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_cmd_complete *ev = (void *) skb->data;
         __u16 opcode;
@@ -2384,7 +2378,7 @@ static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *sk
         }
 }
 
-static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_cmd_status *ev = (void *) skb->data;
         __u16 opcode;
@@ -2465,7 +2459,7 @@ static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
         }
 }
 
-static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_role_change *ev = (void *) skb->data;
         struct hci_conn *conn;
@@ -2491,7 +2485,7 @@ static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
         int i;
@@ -2502,7 +2496,7 @@ static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *s
         }
 
         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
-                        ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
+            ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
                 BT_DBG("%s bad parameters", hdev->name);
                 return;
         }
@@ -2557,8 +2551,7 @@ static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *s
         queue_work(hdev->workqueue, &hdev->tx_work);
 }
 
-static inline void hci_num_comp_blocks_evt(struct hci_dev *hdev,
-                                           struct sk_buff *skb)
+static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
         int i;
@@ -2569,13 +2562,13 @@ static inline void hci_num_comp_blocks_evt(struct hci_dev *hdev,
         }
 
         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
-                        ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
+            ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
                 BT_DBG("%s bad parameters", hdev->name);
                 return;
         }
 
         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
-                                                                ev->num_hndl);
+               ev->num_hndl);
 
         for (i = 0; i < ev->num_hndl; i++) {
                 struct hci_comp_blocks_info *info = &ev->handles[i];
@@ -2607,7 +2600,7 @@ static inline void hci_num_comp_blocks_evt(struct hci_dev *hdev,
         queue_work(hdev->workqueue, &hdev->tx_work);
 }
 
-static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_mode_change *ev = (void *) skb->data;
         struct hci_conn *conn;
@@ -2621,7 +2614,8 @@ static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb
                 conn->mode = ev->mode;
                 conn->interval = __le16_to_cpu(ev->interval);
 
-                if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags)) {
+                if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
+                                        &conn->flags)) {
                         if (conn->mode == HCI_CM_ACTIVE)
                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
                         else
@@ -2635,7 +2629,7 @@ static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_pin_code_req *ev = (void *) skb->data;
         struct hci_conn *conn;
@@ -2656,7 +2650,7 @@ static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff
 
         if (!test_bit(HCI_PAIRABLE, &hdev->dev_flags))
                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
-                                        sizeof(ev->bdaddr), &ev->bdaddr);
+                             sizeof(ev->bdaddr), &ev->bdaddr);
         else if (test_bit(HCI_MGMT, &hdev->dev_flags)) {
                 u8 secure;
 
@@ -2672,7 +2666,7 @@ unlock:
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_link_key_req *ev = (void *) skb->data;
         struct hci_cp_link_key_reply cp;
@@ -2689,15 +2683,15 @@ static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff
         key = hci_find_link_key(hdev, &ev->bdaddr);
         if (!key) {
                 BT_DBG("%s link key not found for %s", hdev->name,
-                                                        batostr(&ev->bdaddr));
+                       batostr(&ev->bdaddr));
                 goto not_found;
         }
 
         BT_DBG("%s found key type %u for %s", hdev->name, key->type,
-                                                        batostr(&ev->bdaddr));
+               batostr(&ev->bdaddr));
 
         if (!test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags) &&
-                                key->type == HCI_LK_DEBUG_COMBINATION) {
+            key->type == HCI_LK_DEBUG_COMBINATION) {
                 BT_DBG("%s ignoring debug key", hdev->name);
                 goto not_found;
         }
@@ -2705,16 +2699,15 @@ static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff
         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
         if (conn) {
                 if (key->type == HCI_LK_UNAUTH_COMBINATION &&
-                                conn->auth_type != 0xff &&
-                                (conn->auth_type & 0x01)) {
+                    conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
                         goto not_found;
                 }
 
                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
-                                conn->pending_sec_level == BT_SECURITY_HIGH) {
-                        BT_DBG("%s ignoring key unauthenticated for high \
-                                                        security", hdev->name);
+                    conn->pending_sec_level == BT_SECURITY_HIGH) {
+                        BT_DBG("%s ignoring key unauthenticated for high security",
+                               hdev->name);
                         goto not_found;
                 }
 
@@ -2723,7 +2716,7 @@ static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff
         }
 
         bacpy(&cp.bdaddr, &ev->bdaddr);
-        memcpy(cp.link_key, key->val, 16);
+        memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
 
         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
 
@@ -2736,7 +2729,7 @@ not_found:
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_link_key_notify *ev = (void *) skb->data;
         struct hci_conn *conn;
@@ -2760,12 +2753,12 @@ static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff
 
         if (test_bit(HCI_LINK_KEYS, &hdev->dev_flags))
                 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
-                                                        ev->key_type, pin_len);
+                                 ev->key_type, pin_len);
 
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_clock_offset *ev = (void *) skb->data;
         struct hci_conn *conn;
@@ -2788,7 +2781,7 @@ static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *sk
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
         struct hci_conn *conn;
@@ -2804,7 +2797,7 @@ static inline void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
         struct inquiry_entry *ie;
@@ -2822,7 +2815,8 @@ static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
+                                             struct sk_buff *skb)
 {
         struct inquiry_data data;
         int num_rsp = *((__u8 *) skb->data);
@@ -2881,7 +2875,8 @@ static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_remote_ext_features_evt(struct hci_dev *hdev,
+                                        struct sk_buff *skb)
 {
         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
         struct hci_conn *conn;
@@ -2929,7 +2924,8 @@ unlock:
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
+                                       struct sk_buff *skb)
 {
         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
         struct hci_conn *conn;
@@ -2984,19 +2980,20 @@ unlock:
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         BT_DBG("%s", hdev->name);
 }
 
-static inline void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_sniff_subrate *ev = (void *) skb->data;
 
         BT_DBG("%s status %d", hdev->name, ev->status);
 }
 
-static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
+                                            struct sk_buff *skb)
 {
         struct inquiry_data data;
         struct extended_inquiry_info *info = (void *) (skb->data + 1);
@@ -3087,7 +3084,7 @@ unlock:
         hci_dev_unlock(hdev);
 }
 
-static inline u8 hci_get_auth_req(struct hci_conn *conn)
+static u8 hci_get_auth_req(struct hci_conn *conn)
 {
         /* If remote requests dedicated bonding follow that lead */
         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) {
@@ -3106,7 +3103,7 @@ static inline u8 hci_get_auth_req(struct hci_conn *conn)
         return conn->auth_type;
 }
 
-static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_io_capa_request *ev = (void *) skb->data;
         struct hci_conn *conn;
@@ -3125,7 +3122,7 @@ static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff
                 goto unlock;
 
         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags) ||
-                        (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
+            (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
                 struct hci_cp_io_capability_reply cp;
 
                 bacpy(&cp.bdaddr, &ev->bdaddr);
@@ -3136,14 +3133,14 @@ static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff
                 conn->auth_type = hci_get_auth_req(conn);
                 cp.authentication = conn->auth_type;
 
-                if ((conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags)) &&
-                                hci_find_remote_oob_data(hdev, &conn->dst))
+                if (hci_find_remote_oob_data(hdev, &conn->dst) &&
+                    (conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags)))
                         cp.oob_data = 0x01;
                 else
                         cp.oob_data = 0x00;
 
                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
-                                                        sizeof(cp), &cp);
+                             sizeof(cp), &cp);
         } else {
                 struct hci_cp_io_capability_neg_reply cp;
 
@@ -3151,14 +3148,14 @@ static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff
                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
 
                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
-                                                        sizeof(cp), &cp);
+                             sizeof(cp), &cp);
         }
 
 unlock:
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
         struct hci_conn *conn;
@@ -3180,8 +3177,8 @@ unlock:
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
-                                                        struct sk_buff *skb)
+static void hci_user_confirm_request_evt(struct hci_dev *hdev,
+                                         struct sk_buff *skb)
 {
         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
         int loc_mitm, rem_mitm, confirm_hint = 0;
@@ -3209,13 +3206,13 @@ static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
         if (!conn->connect_cfm_cb && loc_mitm && conn->remote_cap == 0x03) {
                 BT_DBG("Rejecting request: remote device can't provide MITM");
                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
-                                        sizeof(ev->bdaddr), &ev->bdaddr);
+                             sizeof(ev->bdaddr), &ev->bdaddr);
                 goto unlock;
         }
 
         /* If no side requires MITM protection; auto-accept */
         if ((!loc_mitm || conn->remote_cap == 0x03) &&
-                                (!rem_mitm || conn->io_capability == 0x03)) {
+            (!rem_mitm || conn->io_capability == 0x03)) {
 
                 /* If we're not the initiators request authorization to
                  * proceed from user space (mgmt_user_confirm with
@@ -3227,7 +3224,7 @@ static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
                 }
 
                 BT_DBG("Auto-accept of user confirmation with %ums delay",
-                                                hdev->auto_accept_delay);
+                       hdev->auto_accept_delay);
 
                 if (hdev->auto_accept_delay > 0) {
                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
@@ -3236,7 +3233,7 @@ static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
                 }
 
                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
-                                                sizeof(ev->bdaddr), &ev->bdaddr);
+                             sizeof(ev->bdaddr), &ev->bdaddr);
                 goto unlock;
         }
 
@@ -3248,8 +3245,8 @@ unlock:
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_user_passkey_request_evt(struct hci_dev *hdev,
-                                                        struct sk_buff *skb)
+static void hci_user_passkey_request_evt(struct hci_dev *hdev,
+                                         struct sk_buff *skb)
 {
         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
 
@@ -3263,7 +3260,8 @@ static inline void hci_user_passkey_request_evt(struct hci_dev *hdev,
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_simple_pair_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
+                                         struct sk_buff *skb)
 {
         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
         struct hci_conn *conn;
@@ -3291,7 +3289,8 @@ unlock:
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_remote_host_features_evt(struct hci_dev *hdev,
+                                         struct sk_buff *skb)
 {
         struct hci_ev_remote_host_features *ev = (void *) skb->data;
         struct inquiry_entry *ie;
@@ -3307,8 +3306,8 @@ static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
-                                                   struct sk_buff *skb)
+static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
+                                            struct sk_buff *skb)
 {
         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
         struct oob_data *data;
@@ -3329,20 +3328,20 @@ static inline void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
                 memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
 
                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
-                                                                        &cp);
+                             &cp);
         } else {
                 struct hci_cp_remote_oob_data_neg_reply cp;
 
                 bacpy(&cp.bdaddr, &ev->bdaddr);
                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
-                                                                        &cp);
+                             &cp);
         }
 
 unlock:
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
         struct hci_conn *conn;
@@ -3351,6 +3350,19 @@ static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff
 
         hci_dev_lock(hdev);
 
+        if (ev->status) {
+                conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
+                if (!conn)
+                        goto unlock;
+
+                mgmt_connect_failed(hdev, &conn->dst, conn->type,
+                                    conn->dst_type, ev->status);
+                hci_proto_connect_cfm(conn, ev->status);
+                conn->state = BT_CLOSED;
+                hci_conn_del(conn);
+                goto unlock;
+        }
+
         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &ev->bdaddr);
         if (!conn) {
                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
@@ -3363,15 +3375,6 @@ static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff
                 conn->dst_type = ev->bdaddr_type;
         }
 
-        if (ev->status) {
-                mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
-                                                conn->dst_type, ev->status);
-                hci_proto_connect_cfm(conn, ev->status);
-                conn->state = BT_CLOSED;
-                hci_conn_del(conn);
-                goto unlock;
-        }
-
         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
                 mgmt_device_connected(hdev, &ev->bdaddr, conn->type,
                                       conn->dst_type, 0, NULL, 0, NULL);
@@ -3389,8 +3392,7 @@ unlock:
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_le_adv_report_evt(struct hci_dev *hdev,
-                                                struct sk_buff *skb)
+static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         u8 num_reports = skb->data[0];
         void *ptr = &skb->data[1];
@@ -3411,8 +3413,7 @@ static inline void hci_le_adv_report_evt(struct hci_dev *hdev,
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_le_ltk_request_evt(struct hci_dev *hdev,
-                                                struct sk_buff *skb)
+static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
         struct hci_cp_le_ltk_reply cp;
@@ -3455,7 +3456,7 @@ not_found:
         hci_dev_unlock(hdev);
 }
 
-static inline void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_le_meta *le_ev = (void *) skb->data;
 
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 5914623f426a..a7f04de03d79 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -24,25 +24,7 @@
 
 /* Bluetooth HCI sockets. */
 
-#include <linux/module.h>
-
-#include <linux/types.h>
-#include <linux/capability.h>
-#include <linux/errno.h>
-#include <linux/kernel.h>
-#include <linux/slab.h>
-#include <linux/poll.h>
-#include <linux/fcntl.h>
-#include <linux/init.h>
-#include <linux/skbuff.h>
-#include <linux/workqueue.h>
-#include <linux/interrupt.h>
-#include <linux/compat.h>
-#include <linux/socket.h>
-#include <linux/ioctl.h>
-#include <net/sock.h>
-
-#include <linux/uaccess.h>
+#include <linux/export.h>
 #include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
@@ -113,11 +95,12 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
                 flt = &hci_pi(sk)->filter;
 
                 if (!test_bit((bt_cb(skb)->pkt_type == HCI_VENDOR_PKT) ?
-                                0 : (bt_cb(skb)->pkt_type & HCI_FLT_TYPE_BITS), &flt->type_mask))
+                              0 : (bt_cb(skb)->pkt_type & HCI_FLT_TYPE_BITS),
+                              &flt->type_mask))
                         continue;
 
                 if (bt_cb(skb)->pkt_type == HCI_EVENT_PKT) {
-                        register int evt = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS);
+                        int evt = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS);
 
                         if (!hci_test_bit(evt, &flt->event_mask))
                                 continue;
@@ -240,7 +223,8 @@ void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb)
                         struct hci_mon_hdr *hdr;
 
                         /* Create a private copy with headroom */
-                        skb_copy = __pskb_copy(skb, HCI_MON_HDR_SIZE, GFP_ATOMIC);
+                        skb_copy = __pskb_copy(skb, HCI_MON_HDR_SIZE,
+                                               GFP_ATOMIC);
                         if (!skb_copy)
                                 continue;
 
@@ -495,7 +479,8 @@ static int hci_sock_blacklist_del(struct hci_dev *hdev, void __user *arg)
 }
 
 /* Ioctls that require bound socket */
-static inline int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, unsigned long arg)
+static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd,
+                                unsigned long arg)
 {
         struct hci_dev *hdev = hci_pi(sk)->hdev;
 
@@ -540,7 +525,8 @@ static inline int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, unsign
         }
 }
 
-static int hci_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+static int hci_sock_ioctl(struct socket *sock, unsigned int cmd,
+                          unsigned long arg)
 {
         struct sock *sk = sock->sk;
         void __user *argp = (void __user *) arg;
@@ -601,7 +587,8 @@ static int hci_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long a
         }
 }
 
-static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
+static int hci_sock_bind(struct socket *sock, struct sockaddr *addr,
+                         int addr_len)
 {
         struct sockaddr_hci haddr;
         struct sock *sk = sock->sk;
@@ -690,7 +677,8 @@ done:
         return err;
 }
 
-static int hci_sock_getname(struct socket *sock, struct sockaddr *addr, int *addr_len, int peer)
+static int hci_sock_getname(struct socket *sock, struct sockaddr *addr,
+                            int *addr_len, int peer)
 {
         struct sockaddr_hci *haddr = (struct sockaddr_hci *) addr;
         struct sock *sk = sock->sk;
@@ -711,13 +699,15 @@ static int hci_sock_getname(struct socket *sock, struct sockaddr *addr, int *add
         return 0;
 }
 
-static inline void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
+static void hci_sock_cmsg(struct sock *sk, struct msghdr *msg,
+                          struct sk_buff *skb)
 {
         __u32 mask = hci_pi(sk)->cmsg_mask;
 
         if (mask & HCI_CMSG_DIR) {
                 int incoming = bt_cb(skb)->incoming;
-                put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming), &incoming);
+                put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming),
+                         &incoming);
         }
 
         if (mask & HCI_CMSG_TSTAMP) {
@@ -747,7 +737,7 @@ static inline void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, struct sk_
 }
 
 static int hci_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
-                                struct msghdr *msg, size_t len, int flags)
+                            struct msghdr *msg, size_t len, int flags)
 {
         int noblock = flags & MSG_DONTWAIT;
         struct sock *sk = sock->sk;
@@ -857,8 +847,9 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                 u16 ocf = hci_opcode_ocf(opcode);
 
                 if (((ogf > HCI_SFLT_MAX_OGF) ||
-                                !hci_test_bit(ocf & HCI_FLT_OCF_BITS, &hci_sec_filter.ocf_mask[ogf])) &&
-                                        !capable(CAP_NET_RAW)) {
+                     !hci_test_bit(ocf & HCI_FLT_OCF_BITS,
+                                   &hci_sec_filter.ocf_mask[ogf])) &&
+                    !capable(CAP_NET_RAW)) {
                         err = -EPERM;
                         goto drop;
                 }
@@ -891,7 +882,8 @@ drop:
         goto done;
 }
 
-static int hci_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int len)
+static int hci_sock_setsockopt(struct socket *sock, int level, int optname,
+                               char __user *optval, unsigned int len)
 {
         struct hci_ufilter uf = { .opcode = 0 };
         struct sock *sk = sock->sk;
@@ -973,7 +965,8 @@ done:
         return err;
 }
 
-static int hci_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
+static int hci_sock_getsockopt(struct socket *sock, int level, int optname,
+                               char __user *optval, int __user *optlen)
 {
         struct hci_ufilter uf;
         struct sock *sk = sock->sk;
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 937f3187eafa..a20e61c3653d 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -1,10 +1,6 @@
 /* Bluetooth HCI driver model support. */
 
-#include <linux/kernel.h>
-#include <linux/slab.h>
-#include <linux/init.h>
 #include <linux/debugfs.h>
-#include <linux/seq_file.h>
 #include <linux/module.h>
 
 #include <net/bluetooth/bluetooth.h>
@@ -31,27 +27,30 @@ static inline char *link_typetostr(int type)
         }
 }
 
-static ssize_t show_link_type(struct device *dev, struct device_attribute *attr, char *buf)
+static ssize_t show_link_type(struct device *dev,
+                              struct device_attribute *attr, char *buf)
 {
         struct hci_conn *conn = to_hci_conn(dev);
         return sprintf(buf, "%s\n", link_typetostr(conn->type));
 }
 
-static ssize_t show_link_address(struct device *dev, struct device_attribute *attr, char *buf)
+static ssize_t show_link_address(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
 {
         struct hci_conn *conn = to_hci_conn(dev);
         return sprintf(buf, "%s\n", batostr(&conn->dst));
 }
 
-static ssize_t show_link_features(struct device *dev, struct device_attribute *attr, char *buf)
+static ssize_t show_link_features(struct device *dev,
+                                  struct device_attribute *attr, char *buf)
 {
         struct hci_conn *conn = to_hci_conn(dev);
 
         return sprintf(buf, "0x%02x%02x%02x%02x%02x%02x%02x%02x\n",
-                                conn->features[0], conn->features[1],
-                                conn->features[2], conn->features[3],
-                                conn->features[4], conn->features[5],
-                                conn->features[6], conn->features[7]);
+                       conn->features[0], conn->features[1],
+                       conn->features[2], conn->features[3],
+                       conn->features[4], conn->features[5],
+                       conn->features[6], conn->features[7]);
 }
 
 #define LINK_ATTR(_name, _mode, _show, _store) \
@@ -185,19 +184,22 @@ static inline char *host_typetostr(int type)
         }
 }
 
-static ssize_t show_bus(struct device *dev, struct device_attribute *attr, char *buf)
+static ssize_t show_bus(struct device *dev,
+                        struct device_attribute *attr, char *buf)
 {
         struct hci_dev *hdev = to_hci_dev(dev);
         return sprintf(buf, "%s\n", host_bustostr(hdev->bus));
 }
 
-static ssize_t show_type(struct device *dev, struct device_attribute *attr, char *buf)
+static ssize_t show_type(struct device *dev,
+                         struct device_attribute *attr, char *buf)
 {
         struct hci_dev *hdev = to_hci_dev(dev);
         return sprintf(buf, "%s\n", host_typetostr(hdev->dev_type));
 }
 
-static ssize_t show_name(struct device *dev, struct device_attribute *attr, char *buf)
+static ssize_t show_name(struct device *dev,
+                         struct device_attribute *attr, char *buf)
 {
         struct hci_dev *hdev = to_hci_dev(dev);
         char name[HCI_MAX_NAME_LENGTH + 1];
@@ -210,55 +212,64 @@ static ssize_t show_name(struct device *dev, struct device_attribute *attr, char
         return sprintf(buf, "%s\n", name);
 }
 
-static ssize_t show_class(struct device *dev, struct device_attribute *attr, char *buf)
+static ssize_t show_class(struct device *dev,
+                          struct device_attribute *attr, char *buf)
 {
         struct hci_dev *hdev = to_hci_dev(dev);
-        return sprintf(buf, "0x%.2x%.2x%.2x\n",
-                        hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
+        return sprintf(buf, "0x%.2x%.2x%.2x\n", hdev->dev_class[2],
+                       hdev->dev_class[1], hdev->dev_class[0]);
 }
 
-static ssize_t show_address(struct device *dev, struct device_attribute *attr, char *buf)
+static ssize_t show_address(struct device *dev,
+                            struct device_attribute *attr, char *buf)
 {
         struct hci_dev *hdev = to_hci_dev(dev);
         return sprintf(buf, "%s\n", batostr(&hdev->bdaddr));
 }
 
-static ssize_t show_features(struct device *dev, struct device_attribute *attr, char *buf)
+static ssize_t show_features(struct device *dev,
+                             struct device_attribute *attr, char *buf)
 {
         struct hci_dev *hdev = to_hci_dev(dev);
 
         return sprintf(buf, "0x%02x%02x%02x%02x%02x%02x%02x%02x\n",
-                                hdev->features[0], hdev->features[1],
-                                hdev->features[2], hdev->features[3],
-                                hdev->features[4], hdev->features[5],
-                                hdev->features[6], hdev->features[7]);
+                       hdev->features[0], hdev->features[1],
+                       hdev->features[2], hdev->features[3],
+                       hdev->features[4], hdev->features[5],
+                       hdev->features[6], hdev->features[7]);
 }
 
-static ssize_t show_manufacturer(struct device *dev, struct device_attribute *attr, char *buf)
+static ssize_t show_manufacturer(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
 {
         struct hci_dev *hdev = to_hci_dev(dev);
         return sprintf(buf, "%d\n", hdev->manufacturer);
 }
 
-static ssize_t show_hci_version(struct device *dev, struct device_attribute *attr, char *buf)
+static ssize_t show_hci_version(struct device *dev,
+                                struct device_attribute *attr, char *buf)
 {
         struct hci_dev *hdev = to_hci_dev(dev);
         return sprintf(buf, "%d\n", hdev->hci_ver);
 }
 
-static ssize_t show_hci_revision(struct device *dev, struct device_attribute *attr, char *buf)
+static ssize_t show_hci_revision(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
 {
         struct hci_dev *hdev = to_hci_dev(dev);
         return sprintf(buf, "%d\n", hdev->hci_rev);
 }
 
-static ssize_t show_idle_timeout(struct device *dev, struct device_attribute *attr, char *buf)
+static ssize_t show_idle_timeout(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
 {
         struct hci_dev *hdev = to_hci_dev(dev);
         return sprintf(buf, "%d\n", hdev->idle_timeout);
 }
 
-static ssize_t store_idle_timeout(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
+static ssize_t store_idle_timeout(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t count)
 {
         struct hci_dev *hdev = to_hci_dev(dev);
         unsigned int val;
@@ -276,13 +287,16 @@ static ssize_t store_idle_timeout(struct device *dev, struct device_attribute *a
         return count;
 }
 
-static ssize_t show_sniff_max_interval(struct device *dev, struct device_attribute *attr, char *buf)
+static ssize_t show_sniff_max_interval(struct device *dev,
+                                       struct device_attribute *attr, char *buf)
 {
         struct hci_dev *hdev = to_hci_dev(dev);
         return sprintf(buf, "%d\n", hdev->sniff_max_interval);
 }
 
-static ssize_t store_sniff_max_interval(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
+static ssize_t store_sniff_max_interval(struct device *dev,
+                                        struct device_attribute *attr,
+                                        const char *buf, size_t count)
 {
         struct hci_dev *hdev = to_hci_dev(dev);
         u16 val;
@@ -300,13 +314,16 @@ static ssize_t store_sniff_max_interval(struct device *dev, struct device_attrib
         return count;
 }
 
-static ssize_t show_sniff_min_interval(struct device *dev, struct device_attribute *attr, char *buf)
+static ssize_t show_sniff_min_interval(struct device *dev,
+                                       struct device_attribute *attr, char *buf)
 {
         struct hci_dev *hdev = to_hci_dev(dev);
         return sprintf(buf, "%d\n", hdev->sniff_min_interval);
 }
 
-static ssize_t store_sniff_min_interval(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
+static ssize_t store_sniff_min_interval(struct device *dev,
+                                        struct device_attribute *attr,
+                                        const char *buf, size_t count)
 {
         struct hci_dev *hdev = to_hci_dev(dev);
         u16 val;
@@ -335,11 +352,11 @@ static DEVICE_ATTR(hci_version, S_IRUGO, show_hci_version, NULL);
 static DEVICE_ATTR(hci_revision, S_IRUGO, show_hci_revision, NULL);
 
 static DEVICE_ATTR(idle_timeout, S_IRUGO | S_IWUSR,
-                                show_idle_timeout, store_idle_timeout);
+                   show_idle_timeout, store_idle_timeout);
 static DEVICE_ATTR(sniff_max_interval, S_IRUGO | S_IWUSR,
-                                show_sniff_max_interval, store_sniff_max_interval);
+                   show_sniff_max_interval, store_sniff_max_interval);
 static DEVICE_ATTR(sniff_min_interval, S_IRUGO | S_IWUSR,
-                                show_sniff_min_interval, store_sniff_min_interval);
+                   show_sniff_min_interval, store_sniff_min_interval);
 
 static struct attribute *bt_host_attrs[] = {
         &dev_attr_bus.attr,
@@ -455,8 +472,8 @@ static void print_bt_uuid(struct seq_file *f, u8 *uuid)
         memcpy(&data5, &uuid[14], 2);
 
         seq_printf(f, "%.8x-%.4x-%.4x-%.4x-%.8x%.4x\n",
-                                ntohl(data0), ntohs(data1), ntohs(data2),
-                                ntohs(data3), ntohl(data4), ntohs(data5));
+                   ntohl(data0), ntohs(data1), ntohs(data2), ntohs(data3),
+                   ntohl(data4), ntohs(data5));
 }
 
 static int uuids_show(struct seq_file *f, void *p)
@@ -513,7 +530,7 @@ static int auto_accept_delay_get(void *data, u64 *val)
 }
 
 DEFINE_SIMPLE_ATTRIBUTE(auto_accept_delay_fops, auto_accept_delay_get,
-                                        auto_accept_delay_set, "%llu\n");
+                        auto_accept_delay_set, "%llu\n");
 
 void hci_init_sysfs(struct hci_dev *hdev)
 {
@@ -547,15 +564,15 @@ int hci_add_sysfs(struct hci_dev *hdev)
                 return 0;
 
         debugfs_create_file("inquiry_cache", 0444, hdev->debugfs,
-                                                hdev, &inquiry_cache_fops);
+                            hdev, &inquiry_cache_fops);
 
         debugfs_create_file("blacklist", 0444, hdev->debugfs,
-                                                hdev, &blacklist_fops);
+                            hdev, &blacklist_fops);
 
         debugfs_create_file("uuids", 0444, hdev->debugfs, hdev, &uuids_fops);
 
         debugfs_create_file("auto_accept_delay", 0444, hdev->debugfs, hdev,
-                                                &auto_accept_delay_fops);
+                            &auto_accept_delay_fops);
         return 0;
 }
 
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 2c20d765b394..ccd985da6518 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -21,27 +21,8 @@
 */
 
 #include <linux/module.h>
-
-#include <linux/types.h>
-#include <linux/errno.h>
-#include <linux/kernel.h>
-#include <linux/sched.h>
-#include <linux/slab.h>
-#include <linux/poll.h>
-#include <linux/freezer.h>
-#include <linux/fcntl.h>
-#include <linux/skbuff.h>
-#include <linux/socket.h>
-#include <linux/ioctl.h>
 #include <linux/file.h>
-#include <linux/init.h>
-#include <linux/wait.h>
-#include <linux/mutex.h>
 #include <linux/kthread.h>
-#include <net/sock.h>
-
-#include <linux/input.h>
-#include <linux/hid.h>
 #include <linux/hidraw.h>
 
 #include <net/bluetooth/bluetooth.h>
@@ -244,7 +225,8 @@ static void hidp_input_report(struct hidp_session *session, struct sk_buff *skb)
 }
 
 static int __hidp_send_ctrl_message(struct hidp_session *session,
-                        unsigned char hdr, unsigned char *data, int size)
+                                    unsigned char hdr, unsigned char *data,
+                                    int size)
 {
         struct sk_buff *skb;
 
@@ -268,7 +250,7 @@ static int __hidp_send_ctrl_message(struct hidp_session *session,
         return 0;
 }
 
-static inline int hidp_send_ctrl_message(struct hidp_session *session,
+static int hidp_send_ctrl_message(struct hidp_session *session,
                         unsigned char hdr, unsigned char *data, int size)
 {
         int err;
@@ -471,7 +453,7 @@ static void hidp_set_timer(struct hidp_session *session)
                 mod_timer(&session->timer, jiffies + HZ * session->idle_to);
 }
 
-static inline void hidp_del_timer(struct hidp_session *session)
+static void hidp_del_timer(struct hidp_session *session)
 {
         if (session->idle_to > 0)
                 del_timer(&session->timer);
diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c
index 73a32d705c1f..18b3f6892a36 100644
--- a/net/bluetooth/hidp/sock.c
+++ b/net/bluetooth/hidp/sock.c
@@ -20,22 +20,8 @@
    SOFTWARE IS DISCLAIMED.
 */
 
-#include <linux/module.h>
-
-#include <linux/types.h>
-#include <linux/capability.h>
-#include <linux/errno.h>
-#include <linux/kernel.h>
-#include <linux/poll.h>
-#include <linux/fcntl.h>
-#include <linux/skbuff.h>
-#include <linux/socket.h>
-#include <linux/ioctl.h>
+#include <linux/export.h>
 #include <linux/file.h>
-#include <linux/init.h>
-#include <linux/compat.h>
-#include <linux/gfp.h>
-#include <net/sock.h>
 
 #include "hidp.h"
 
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 8394e3615ef6..4ca88247b7c2 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -30,32 +30,14 @@
 
 #include <linux/module.h>
 
-#include <linux/types.h>
-#include <linux/capability.h>
-#include <linux/errno.h>
-#include <linux/kernel.h>
-#include <linux/sched.h>
-#include <linux/slab.h>
-#include <linux/poll.h>
-#include <linux/fcntl.h>
-#include <linux/init.h>
-#include <linux/interrupt.h>
-#include <linux/socket.h>
-#include <linux/skbuff.h>
-#include <linux/list.h>
-#include <linux/device.h>
 #include <linux/debugfs.h>
-#include <linux/seq_file.h>
-#include <linux/uaccess.h>
 #include <linux/crc16.h>
-#include <net/sock.h>
-
-#include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 #include <net/bluetooth/l2cap.h>
 #include <net/bluetooth/smp.h>
+#include <net/bluetooth/a2mp.h>
 
 bool disable_ertm;
 
@@ -73,6 +55,9 @@ static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
 static void l2cap_send_disconn_req(struct l2cap_conn *conn,
                                    struct l2cap_chan *chan, int err);
 
+static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
+                    struct sk_buff_head *skbs, u8 event);
+
 /* ---- L2CAP channels ---- */
 
 static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn, u16 cid)
@@ -196,7 +181,7 @@ static void __l2cap_state_change(struct l2cap_chan *chan, int state)
                                                 state_to_string(state));
 
         chan->state = state;
-        chan->ops->state_change(chan->data, state);
+        chan->ops->state_change(chan, state);
 }
 
 static void l2cap_state_change(struct l2cap_chan *chan, int state)
@@ -224,6 +209,37 @@ static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
         release_sock(sk);
 }
 
+static void __set_retrans_timer(struct l2cap_chan *chan)
+{
+        if (!delayed_work_pending(&chan->monitor_timer) &&
+            chan->retrans_timeout) {
+                l2cap_set_timer(chan, &chan->retrans_timer,
+                                msecs_to_jiffies(chan->retrans_timeout));
+        }
+}
+
+static void __set_monitor_timer(struct l2cap_chan *chan)
+{
+        __clear_retrans_timer(chan);
+        if (chan->monitor_timeout) {
+                l2cap_set_timer(chan, &chan->monitor_timer,
+                                msecs_to_jiffies(chan->monitor_timeout));
+        }
+}
+
+static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head,
+                                               u16 seq)
+{
+        struct sk_buff *skb;
+
+        skb_queue_walk(head, skb) {
+                if (bt_cb(skb)->control.txseq == seq)
+                        return skb;
+        }
+
+        return NULL;
+}
+
 /* ---- L2CAP sequence number lists ---- */
 
 /* For ERTM, ordered lists of sequence numbers must be tracked for
@@ -366,7 +382,7 @@ static void l2cap_chan_timeout(struct work_struct *work)
 
         l2cap_chan_unlock(chan);
 
-        chan->ops->close(chan->data);
+        chan->ops->close(chan);
         mutex_unlock(&conn->chan_lock);
 
         l2cap_chan_put(chan);
@@ -392,6 +408,9 @@ struct l2cap_chan *l2cap_chan_create(void)
 
         atomic_set(&chan->refcnt, 1);
 
+        /* This flag is cleared in l2cap_chan_ready() */
+        set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
+
         BT_DBG("chan %p", chan);
 
         return chan;
@@ -430,7 +449,7 @@ static void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
         case L2CAP_CHAN_CONN_ORIENTED:
                 if (conn->hcon->type == LE_LINK) {
                         /* LE connection */
-                        chan->omtu = L2CAP_LE_DEFAULT_MTU;
+                        chan->omtu = L2CAP_DEFAULT_MTU;
                         chan->scid = L2CAP_CID_LE_DATA;
                         chan->dcid = L2CAP_CID_LE_DATA;
                 } else {
@@ -447,6 +466,13 @@ static void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
                 chan->omtu = L2CAP_DEFAULT_MTU;
                 break;
 
+        case L2CAP_CHAN_CONN_FIX_A2MP:
+                chan->scid = L2CAP_CID_A2MP;
+                chan->dcid = L2CAP_CID_A2MP;
+                chan->omtu = L2CAP_A2MP_DEFAULT_MTU;
+                chan->imtu = L2CAP_A2MP_DEFAULT_MTU;
+                break;
+
         default:
                 /* Raw socket can send/recv signalling messages only */
                 chan->scid = L2CAP_CID_SIGNALING;
@@ -466,18 +492,16 @@ static void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
         list_add(&chan->list, &conn->chan_l);
 }
 
-static void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
+void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
 {
         mutex_lock(&conn->chan_lock);
         __l2cap_chan_add(conn, chan);
         mutex_unlock(&conn->chan_lock);
 }
 
-static void l2cap_chan_del(struct l2cap_chan *chan, int err)
+void l2cap_chan_del(struct l2cap_chan *chan, int err)
 {
-        struct sock *sk = chan->sk;
         struct l2cap_conn *conn = chan->conn;
-        struct sock *parent = bt_sk(sk)->parent;
 
         __clear_chan_timer(chan);
 
@@ -490,34 +514,22 @@ static void l2cap_chan_del(struct l2cap_chan *chan, int err)
                 l2cap_chan_put(chan);
 
                 chan->conn = NULL;
-                hci_conn_put(conn->hcon);
-        }
-
-        lock_sock(sk);
-
-        __l2cap_state_change(chan, BT_CLOSED);
-        sock_set_flag(sk, SOCK_ZAPPED);
 
-        if (err)
-                __l2cap_chan_set_err(chan, err);
+                if (chan->chan_type != L2CAP_CHAN_CONN_FIX_A2MP)
+                        hci_conn_put(conn->hcon);
+        }
 
-        if (parent) {
-                bt_accept_unlink(sk);
-                parent->sk_data_ready(parent, 0);
-        } else
-                sk->sk_state_change(sk);
+        if (chan->ops->teardown)
+                chan->ops->teardown(chan, err);
 
-        release_sock(sk);
-
-        if (!(test_bit(CONF_OUTPUT_DONE, &chan->conf_state) &&
-                        test_bit(CONF_INPUT_DONE, &chan->conf_state)))
+        if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
                 return;
 
-        skb_queue_purge(&chan->tx_q);
-
-        if (chan->mode == L2CAP_MODE_ERTM) {
-                struct srej_list *l, *tmp;
+        switch(chan->mode) {
+        case L2CAP_MODE_BASIC:
+                break;
 
+        case L2CAP_MODE_ERTM:
                 __clear_retrans_timer(chan);
                 __clear_monitor_timer(chan);
                 __clear_ack_timer(chan);
@@ -526,30 +538,15 @@ static void l2cap_chan_del(struct l2cap_chan *chan, int err)
 
                 l2cap_seq_list_free(&chan->srej_list);
                 l2cap_seq_list_free(&chan->retrans_list);
-                list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
-                        list_del(&l->list);
-                        kfree(l);
-                }
-        }
-}
-
-static void l2cap_chan_cleanup_listen(struct sock *parent)
-{
-        struct sock *sk;
-
-        BT_DBG("parent %p", parent);
 
-        /* Close not yet accepted channels */
-        while ((sk = bt_accept_dequeue(parent, NULL))) {
-                struct l2cap_chan *chan = l2cap_pi(sk)->chan;
-
-                l2cap_chan_lock(chan);
-                __clear_chan_timer(chan);
-                l2cap_chan_close(chan, ECONNRESET);
-                l2cap_chan_unlock(chan);
+                /* fall through */
 
-                chan->ops->close(chan->data);
+        case L2CAP_MODE_STREAMING:
+                skb_queue_purge(&chan->tx_q);
+                break;
         }
+
+        return;
 }
 
 void l2cap_chan_close(struct l2cap_chan *chan, int reason)
@@ -562,12 +559,8 @@ void l2cap_chan_close(struct l2cap_chan *chan, int reason)
 
         switch (chan->state) {
         case BT_LISTEN:
-                lock_sock(sk);
-                l2cap_chan_cleanup_listen(sk);
-
-                __l2cap_state_change(chan, BT_CLOSED);
-                sock_set_flag(sk, SOCK_ZAPPED);
-                release_sock(sk);
+                if (chan->ops->teardown)
+                        chan->ops->teardown(chan, 0);
                 break;
 
         case BT_CONNECTED:
@@ -595,7 +588,7 @@ void l2cap_chan_close(struct l2cap_chan *chan, int reason)
                         rsp.scid   = cpu_to_le16(chan->dcid);
                         rsp.dcid   = cpu_to_le16(chan->scid);
                         rsp.result = cpu_to_le16(result);
-                        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
+                        rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
                         l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
                                                         sizeof(rsp), &rsp);
                 }
@@ -609,9 +602,8 @@ void l2cap_chan_close(struct l2cap_chan *chan, int reason)
                 break;
 
         default:
-                lock_sock(sk);
-                sock_set_flag(sk, SOCK_ZAPPED);
-                release_sock(sk);
+                if (chan->ops->teardown)
+                        chan->ops->teardown(chan, 0);
                 break;
         }
 }
@@ -627,7 +619,7 @@ static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
                 default:
                         return HCI_AT_NO_BONDING;
                 }
-        } else if (chan->psm == cpu_to_le16(0x0001)) {
+        } else if (chan->psm == __constant_cpu_to_le16(L2CAP_PSM_SDP)) {
                 if (chan->sec_level == BT_SECURITY_LOW)
                         chan->sec_level = BT_SECURITY_SDP;
 
@@ -773,9 +765,11 @@ static inline void __unpack_control(struct l2cap_chan *chan,
         if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
                 __unpack_extended_control(get_unaligned_le32(skb->data),
                                           &bt_cb(skb)->control);
+                skb_pull(skb, L2CAP_EXT_CTRL_SIZE);
         } else {
                 __unpack_enhanced_control(get_unaligned_le16(skb->data),
                                           &bt_cb(skb)->control);
+                skb_pull(skb, L2CAP_ENH_CTRL_SIZE);
         }
 }
 
@@ -830,66 +824,102 @@ static inline void __pack_control(struct l2cap_chan *chan,
         }
 }
 
-static inline void l2cap_send_sframe(struct l2cap_chan *chan, u32 control)
+static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)
 {
-        struct sk_buff *skb;
-        struct l2cap_hdr *lh;
-        struct l2cap_conn *conn = chan->conn;
-        int count, hlen;
-
-        if (chan->state != BT_CONNECTED)
-                return;
-
         if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                hlen = L2CAP_EXT_HDR_SIZE;
+                return L2CAP_EXT_HDR_SIZE;
         else
-                hlen = L2CAP_ENH_HDR_SIZE;
+                return L2CAP_ENH_HDR_SIZE;
+}
+
+static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,
+                                               u32 control)
+{
+        struct sk_buff *skb;
+        struct l2cap_hdr *lh;
+        int hlen = __ertm_hdr_size(chan);
 
         if (chan->fcs == L2CAP_FCS_CRC16)
                 hlen += L2CAP_FCS_SIZE;
 
-        BT_DBG("chan %p, control 0x%8.8x", chan, control);
-
-        count = min_t(unsigned int, conn->mtu, hlen);
-
-        control |= __set_sframe(chan);
+        skb = bt_skb_alloc(hlen, GFP_KERNEL);
 
-        if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
-                control |= __set_ctrl_final(chan);
-
-        if (test_and_clear_bit(CONN_SEND_PBIT, &chan->conn_state))
-                control |= __set_ctrl_poll(chan);
-
-        skb = bt_skb_alloc(count, GFP_ATOMIC);
         if (!skb)
-                return;
+                return ERR_PTR(-ENOMEM);
 
         lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
         lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
         lh->cid = cpu_to_le16(chan->dcid);
 
-        __put_control(chan, control, skb_put(skb, __ctrl_size(chan)));
+        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
+                put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
+        else
+                put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
 
         if (chan->fcs == L2CAP_FCS_CRC16) {
-                u16 fcs = crc16(0, (u8 *)lh, count - L2CAP_FCS_SIZE);
+                u16 fcs = crc16(0, (u8 *)skb->data, skb->len);
                 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
         }
 
         skb->priority = HCI_PRIO_MAX;
-        l2cap_do_send(chan, skb);
+        return skb;
 }
 
-static inline void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, u32 control)
+static void l2cap_send_sframe(struct l2cap_chan *chan,
+                              struct l2cap_ctrl *control)
 {
-        if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
-                control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
+        struct sk_buff *skb;
+        u32 control_field;
+
+        BT_DBG("chan %p, control %p", chan, control);
+
+        if (!control->sframe)
+                return;
+
+        if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&
+            !control->poll)
+                control->final = 1;
+
+        if (control->super == L2CAP_SUPER_RR)
+                clear_bit(CONN_RNR_SENT, &chan->conn_state);
+        else if (control->super == L2CAP_SUPER_RNR)
                 set_bit(CONN_RNR_SENT, &chan->conn_state);
-        } else
-                control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
 
-        control |= __set_reqseq(chan, chan->buffer_seq);
+        if (control->super != L2CAP_SUPER_SREJ) {
+                chan->last_acked_seq = control->reqseq;
+                __clear_ack_timer(chan);
+        }
 
-        l2cap_send_sframe(chan, control);
+        BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq,
+               control->final, control->poll, control->super);
+
+        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
+                control_field = __pack_extended_control(control);
+        else
+                control_field = __pack_enhanced_control(control);
+
+        skb = l2cap_create_sframe_pdu(chan, control_field);
+        if (!IS_ERR(skb))
+                l2cap_do_send(chan, skb);
+}
+
+static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)
+{
+        struct l2cap_ctrl control;
+
+        BT_DBG("chan %p, poll %d", chan, poll);
+
+        memset(&control, 0, sizeof(control));
+        control.sframe = 1;
+        control.poll = poll;
+
+        if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
+                control.super = L2CAP_SUPER_RNR;
+        else
+                control.super = L2CAP_SUPER_RR;
+
+        control.reqseq = chan->buffer_seq;
+        l2cap_send_sframe(chan, &control);
 }
 
 static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
@@ -914,25 +944,13 @@ static void l2cap_send_conn_req(struct l2cap_chan *chan)
 
 static void l2cap_chan_ready(struct l2cap_chan *chan)
 {
-        struct sock *sk = chan->sk;
-        struct sock *parent;
-
-        lock_sock(sk);
-
-        parent = bt_sk(sk)->parent;
-
-        BT_DBG("sk %p, parent %p", sk, parent);
-
+        /* This clears all conf flags, including CONF_NOT_COMPLETE */
         chan->conf_state = 0;
         __clear_chan_timer(chan);
 
-        __l2cap_state_change(chan, BT_CONNECTED);
-        sk->sk_state_change(sk);
-
-        if (parent)
-                parent->sk_data_ready(parent, 0);
+        chan->state = BT_CONNECTED;
 
-        release_sock(sk);
+        chan->ops->ready(chan);
 }
 
 static void l2cap_do_start(struct l2cap_chan *chan)
@@ -953,7 +971,7 @@ static void l2cap_do_start(struct l2cap_chan *chan)
                         l2cap_send_conn_req(chan);
         } else {
                 struct l2cap_info_req req;
-                req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
+                req.type = __constant_cpu_to_le16(L2CAP_IT_FEAT_MASK);
 
                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
                 conn->info_ident = l2cap_get_ident(conn);
@@ -995,6 +1013,11 @@ static void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *c
                 __clear_ack_timer(chan);
         }
 
+        if (chan->chan_type == L2CAP_CHAN_CONN_FIX_A2MP) {
+                __l2cap_state_change(chan, BT_DISCONN);
+                return;
+        }
+
         req.dcid = cpu_to_le16(chan->dcid);
         req.scid = cpu_to_le16(chan->scid);
         l2cap_send_cmd(conn, l2cap_get_ident(conn),
@@ -1053,20 +1076,20 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
                                 if (test_bit(BT_SK_DEFER_SETUP,
                                              &bt_sk(sk)->flags)) {
                                         struct sock *parent = bt_sk(sk)->parent;
-                                        rsp.result = cpu_to_le16(L2CAP_CR_PEND);
-                                        rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
+                                        rsp.result = __constant_cpu_to_le16(L2CAP_CR_PEND);
+                                        rsp.status = __constant_cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
                                         if (parent)
                                                 parent->sk_data_ready(parent, 0);
 
                                 } else {
                                         __l2cap_state_change(chan, BT_CONFIG);
-                                        rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
-                                        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
+                                        rsp.result = __constant_cpu_to_le16(L2CAP_CR_SUCCESS);
+                                        rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
                                 }
                                 release_sock(sk);
                         } else {
-                                rsp.result = cpu_to_le16(L2CAP_CR_PEND);
-                                rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
+                                rsp.result = __constant_cpu_to_le16(L2CAP_CR_PEND);
+                                rsp.status = __constant_cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
                         }
 
                         l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
@@ -1150,13 +1173,7 @@ static void l2cap_le_conn_ready(struct l2cap_conn *conn)
 
         lock_sock(parent);
 
-        /* Check for backlog size */
-        if (sk_acceptq_is_full(parent)) {
-                BT_DBG("backlog full %d", parent->sk_ack_backlog);
-                goto clean;
-        }
-
-        chan = pchan->ops->new_connection(pchan->data);
+        chan = pchan->ops->new_connection(pchan);
         if (!chan)
                 goto clean;
 
@@ -1171,10 +1188,7 @@ static void l2cap_le_conn_ready(struct l2cap_conn *conn)
 
         l2cap_chan_add(conn, chan);
 
-        __set_chan_timer(chan, sk->sk_sndtimeo);
-
-        __l2cap_state_change(chan, BT_CONNECTED);
-        parent->sk_data_ready(parent, 0);
+        l2cap_chan_ready(chan);
 
 clean:
         release_sock(parent);
@@ -1198,6 +1212,11 @@ static void l2cap_conn_ready(struct l2cap_conn *conn)
 
                 l2cap_chan_lock(chan);
 
+                if (chan->chan_type == L2CAP_CHAN_CONN_FIX_A2MP) {
+                        l2cap_chan_unlock(chan);
+                        continue;
+                }
+
                 if (conn->hcon->type == LE_LINK) {
                         if (smp_conn_security(conn, chan->sec_level))
                                 l2cap_chan_ready(chan);
@@ -1270,7 +1289,7 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
 
                 l2cap_chan_unlock(chan);
 
-                chan->ops->close(chan->data);
+                chan->ops->close(chan);
                 l2cap_chan_put(chan);
         }
 
@@ -1444,21 +1463,17 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
                 goto done;
         }
 
-        lock_sock(sk);
-
-        switch (sk->sk_state) {
+        switch (chan->state) {
         case BT_CONNECT:
         case BT_CONNECT2:
         case BT_CONFIG:
                 /* Already connecting */
                 err = 0;
-                release_sock(sk);
                 goto done;
 
         case BT_CONNECTED:
                 /* Already connected */
                 err = -EISCONN;
-                release_sock(sk);
                 goto done;
 
         case BT_OPEN:
@@ -1468,13 +1483,12 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
 
         default:
                 err = -EBADFD;
-                release_sock(sk);
                 goto done;
         }
 
         /* Set destination address and psm */
+        lock_sock(sk);
         bacpy(&bt_sk(sk)->dst, dst);
-
         release_sock(sk);
 
         chan->psm = psm;
@@ -1576,23 +1590,20 @@ int __l2cap_wait_ack(struct sock *sk)
 static void l2cap_monitor_timeout(struct work_struct *work)
 {
         struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
-                                                        monitor_timer.work);
+                                               monitor_timer.work);
 
         BT_DBG("chan %p", chan);
 
         l2cap_chan_lock(chan);
 
-        if (chan->retry_count >= chan->remote_max_tx) {
-                l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
+        if (!chan->conn) {
                 l2cap_chan_unlock(chan);
                 l2cap_chan_put(chan);
                 return;
         }
 
-        chan->retry_count++;
-        __set_monitor_timer(chan);
+        l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);
 
-        l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
         l2cap_chan_unlock(chan);
         l2cap_chan_put(chan);
 }
@@ -1600,234 +1611,293 @@ static void l2cap_monitor_timeout(struct work_struct *work)
 static void l2cap_retrans_timeout(struct work_struct *work)
 {
         struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
-                                                        retrans_timer.work);
+                                               retrans_timer.work);
 
         BT_DBG("chan %p", chan);
 
         l2cap_chan_lock(chan);
 
-        chan->retry_count = 1;
-        __set_monitor_timer(chan);
-
-        set_bit(CONN_WAIT_F, &chan->conn_state);
-
-        l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
+        if (!chan->conn) {
+                l2cap_chan_unlock(chan);
+                l2cap_chan_put(chan);
+                return;
+        }
 
+        l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);
         l2cap_chan_unlock(chan);
         l2cap_chan_put(chan);
 }
 
-static void l2cap_drop_acked_frames(struct l2cap_chan *chan)
+static void l2cap_streaming_send(struct l2cap_chan *chan,
+                                 struct sk_buff_head *skbs)
 {
         struct sk_buff *skb;
+        struct l2cap_ctrl *control;
 
-        while ((skb = skb_peek(&chan->tx_q)) &&
-                        chan->unacked_frames) {
-                if (bt_cb(skb)->control.txseq == chan->expected_ack_seq)
-                        break;
+        BT_DBG("chan %p, skbs %p", chan, skbs);
 
-                skb = skb_dequeue(&chan->tx_q);
-                kfree_skb(skb);
+        skb_queue_splice_tail_init(skbs, &chan->tx_q);
 
-                chan->unacked_frames--;
-        }
+        while (!skb_queue_empty(&chan->tx_q)) {
 
-        if (!chan->unacked_frames)
-                __clear_retrans_timer(chan);
-}
+                skb = skb_dequeue(&chan->tx_q);
 
-static void l2cap_streaming_send(struct l2cap_chan *chan)
-{
-        struct sk_buff *skb;
-        u32 control;
-        u16 fcs;
+                bt_cb(skb)->control.retries = 1;
+                control = &bt_cb(skb)->control;
 
-        while ((skb = skb_dequeue(&chan->tx_q))) {
-                control = __get_control(chan, skb->data + L2CAP_HDR_SIZE);
-                control |= __set_txseq(chan, chan->next_tx_seq);
-                control |= __set_ctrl_sar(chan, bt_cb(skb)->control.sar);
-                __put_control(chan, control, skb->data + L2CAP_HDR_SIZE);
+                control->reqseq = 0;
+                control->txseq = chan->next_tx_seq;
+
+                __pack_control(chan, control, skb);
 
                 if (chan->fcs == L2CAP_FCS_CRC16) {
-                        fcs = crc16(0, (u8 *)skb->data,
-                                                skb->len - L2CAP_FCS_SIZE);
-                        put_unaligned_le16(fcs,
-                                        skb->data + skb->len - L2CAP_FCS_SIZE);
+                        u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
+                        put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
                 }
 
                 l2cap_do_send(chan, skb);
 
+                BT_DBG("Sent txseq %d", (int)control->txseq);
+
                 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
+                chan->frames_sent++;
         }
 }
 
-static void l2cap_retransmit_one_frame(struct l2cap_chan *chan, u16 tx_seq)
+static int l2cap_ertm_send(struct l2cap_chan *chan)
 {
         struct sk_buff *skb, *tx_skb;
-        u16 fcs;
-        u32 control;
+        struct l2cap_ctrl *control;
+        int sent = 0;
 
-        skb = skb_peek(&chan->tx_q);
-        if (!skb)
-                return;
+        BT_DBG("chan %p", chan);
 
-        while (bt_cb(skb)->control.txseq != tx_seq) {
-                if (skb_queue_is_last(&chan->tx_q, skb))
-                        return;
+        if (chan->state != BT_CONNECTED)
+                return -ENOTCONN;
 
-                skb = skb_queue_next(&chan->tx_q, skb);
-        }
+        if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
+                return 0;
 
-        if (bt_cb(skb)->control.retries == chan->remote_max_tx &&
-            chan->remote_max_tx) {
-                l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
-                return;
-        }
+        while (chan->tx_send_head &&
+               chan->unacked_frames < chan->remote_tx_win &&
+               chan->tx_state == L2CAP_TX_STATE_XMIT) {
 
-        tx_skb = skb_clone(skb, GFP_ATOMIC);
-        bt_cb(skb)->control.retries++;
+                skb = chan->tx_send_head;
 
-        control = __get_control(chan, tx_skb->data + L2CAP_HDR_SIZE);
-        control &= __get_sar_mask(chan);
+                bt_cb(skb)->control.retries = 1;
+                control = &bt_cb(skb)->control;
 
-        if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
-                control |= __set_ctrl_final(chan);
+                if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
+                        control->final = 1;
 
-        control |= __set_reqseq(chan, chan->buffer_seq);
-        control |= __set_txseq(chan, tx_seq);
+                control->reqseq = chan->buffer_seq;
+                chan->last_acked_seq = chan->buffer_seq;
+                control->txseq = chan->next_tx_seq;
 
-        __put_control(chan, control, tx_skb->data + L2CAP_HDR_SIZE);
+                __pack_control(chan, control, skb);
 
-        if (chan->fcs == L2CAP_FCS_CRC16) {
-                fcs = crc16(0, (u8 *)tx_skb->data,
-                                                tx_skb->len - L2CAP_FCS_SIZE);
-                put_unaligned_le16(fcs,
-                                tx_skb->data + tx_skb->len - L2CAP_FCS_SIZE);
+                if (chan->fcs == L2CAP_FCS_CRC16) {
+                        u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
+                        put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
+                }
+
+                /* Clone after data has been modified. Data is assumed to be
+                   read-only (for locking purposes) on cloned sk_buffs.
+                 */
+                tx_skb = skb_clone(skb, GFP_KERNEL);
+
+                if (!tx_skb)
+                        break;
+
+                __set_retrans_timer(chan);
+
+                chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
+                chan->unacked_frames++;
+                chan->frames_sent++;
+                sent++;
+
+                if (skb_queue_is_last(&chan->tx_q, skb))
+                        chan->tx_send_head = NULL;
+                else
+                        chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
+
+                l2cap_do_send(chan, tx_skb);
+                BT_DBG("Sent txseq %d", (int)control->txseq);
         }
 
-        l2cap_do_send(chan, tx_skb);
+        BT_DBG("Sent %d, %d unacked, %d in ERTM queue", sent,
+               (int) chan->unacked_frames, skb_queue_len(&chan->tx_q));
+
+        return sent;
 }
 
-static int l2cap_ertm_send(struct l2cap_chan *chan)
+static void l2cap_ertm_resend(struct l2cap_chan *chan)
 {
-        struct sk_buff *skb, *tx_skb;
-        u16 fcs;
-        u32 control;
-        int nsent = 0;
+        struct l2cap_ctrl control;
+        struct sk_buff *skb;
+        struct sk_buff *tx_skb;
+        u16 seq;
 
-        if (chan->state != BT_CONNECTED)
-                return -ENOTCONN;
+        BT_DBG("chan %p", chan);
 
         if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
-                return 0;
+                return;
 
-        while ((skb = chan->tx_send_head) && (!l2cap_tx_window_full(chan))) {
+        while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {
+                seq = l2cap_seq_list_pop(&chan->retrans_list);
 
-                if (bt_cb(skb)->control.retries == chan->remote_max_tx &&
-                    chan->remote_max_tx) {
-                        l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
-                        break;
+                skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);
+                if (!skb) {
+                        BT_DBG("Error: Can't retransmit seq %d, frame missing",
+                                seq);
+                        continue;
                 }
 
-                tx_skb = skb_clone(skb, GFP_ATOMIC);
-
                 bt_cb(skb)->control.retries++;
+                control = bt_cb(skb)->control;
 
-                control = __get_control(chan, tx_skb->data + L2CAP_HDR_SIZE);
-                control &= __get_sar_mask(chan);
+                if (chan->max_tx != 0 &&
+                    bt_cb(skb)->control.retries > chan->max_tx) {
+                        BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
+                        l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
+                        l2cap_seq_list_clear(&chan->retrans_list);
+                        break;
+                }
 
+                control.reqseq = chan->buffer_seq;
                 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
-                        control |= __set_ctrl_final(chan);
+                        control.final = 1;
+                else
+                        control.final = 0;
 
-                control |= __set_reqseq(chan, chan->buffer_seq);
-                control |= __set_txseq(chan, chan->next_tx_seq);
-                control |= __set_ctrl_sar(chan, bt_cb(skb)->control.sar);
+                if (skb_cloned(skb)) {
+                        /* Cloned sk_buffs are read-only, so we need a
+                         * writeable copy
+                         */
+                        tx_skb = skb_copy(skb, GFP_ATOMIC);
+                } else {
+                        tx_skb = skb_clone(skb, GFP_ATOMIC);
+                }
 
-                __put_control(chan, control, tx_skb->data + L2CAP_HDR_SIZE);
+                if (!tx_skb) {
+                        l2cap_seq_list_clear(&chan->retrans_list);
+                        break;
+                }
+
+                /* Update skb contents */
+                if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
+                        put_unaligned_le32(__pack_extended_control(&control),
+                                           tx_skb->data + L2CAP_HDR_SIZE);
+                } else {
+                        put_unaligned_le16(__pack_enhanced_control(&control),
+                                           tx_skb->data + L2CAP_HDR_SIZE);
+                }
 
                 if (chan->fcs == L2CAP_FCS_CRC16) {
-                        fcs = crc16(0, (u8 *)skb->data,
-                                                tx_skb->len - L2CAP_FCS_SIZE);
-                        put_unaligned_le16(fcs, skb->data +
-                                                tx_skb->len - L2CAP_FCS_SIZE);
+                        u16 fcs = crc16(0, (u8 *) tx_skb->data, tx_skb->len);
+                        put_unaligned_le16(fcs, skb_put(tx_skb,
+                                                        L2CAP_FCS_SIZE));
                 }
 
                 l2cap_do_send(chan, tx_skb);
 
-                __set_retrans_timer(chan);
-
-                bt_cb(skb)->control.txseq = chan->next_tx_seq;
-
-                chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
-
-                if (bt_cb(skb)->control.retries == 1) {
-                        chan->unacked_frames++;
-
-                        if (!nsent++)
-                                __clear_ack_timer(chan);
-                }
-
-                chan->frames_sent++;
+                BT_DBG("Resent txseq %d", control.txseq);
 
-                if (skb_queue_is_last(&chan->tx_q, skb))
-                        chan->tx_send_head = NULL;
-                else
-                        chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
+                chan->last_acked_seq = chan->buffer_seq;
         }
-
-        return nsent;
 }
 
-static int l2cap_retransmit_frames(struct l2cap_chan *chan)
+static void l2cap_retransmit(struct l2cap_chan *chan,
+                             struct l2cap_ctrl *control)
 {
-        int ret;
-
-        if (!skb_queue_empty(&chan->tx_q))
-                chan->tx_send_head = chan->tx_q.next;
+        BT_DBG("chan %p, control %p", chan, control);
 
-        chan->next_tx_seq = chan->expected_ack_seq;
-        ret = l2cap_ertm_send(chan);
-        return ret;
+        l2cap_seq_list_append(&chan->retrans_list, control->reqseq);
+        l2cap_ertm_resend(chan);
 }
 
-static void __l2cap_send_ack(struct l2cap_chan *chan)
+static void l2cap_retransmit_all(struct l2cap_chan *chan,
+                                 struct l2cap_ctrl *control)
 {
-        u32 control = 0;
+        struct sk_buff *skb;
 
-        control |= __set_reqseq(chan, chan->buffer_seq);
+        BT_DBG("chan %p, control %p", chan, control);
 
-        if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
-                control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
-                set_bit(CONN_RNR_SENT, &chan->conn_state);
-                l2cap_send_sframe(chan, control);
-                return;
-        }
+        if (control->poll)
+                set_bit(CONN_SEND_FBIT, &chan->conn_state);
 
-        if (l2cap_ertm_send(chan) > 0)
+        l2cap_seq_list_clear(&chan->retrans_list);
+
+        if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
                 return;
 
-        control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
-        l2cap_send_sframe(chan, control);
+        if (chan->unacked_frames) {
+                skb_queue_walk(&chan->tx_q, skb) {
+                        if (bt_cb(skb)->control.txseq == control->reqseq ||
+                                skb == chan->tx_send_head)
+                                break;
+                }
+
+                skb_queue_walk_from(&chan->tx_q, skb) {
+                        if (skb == chan->tx_send_head)
+                                break;
+
+                        l2cap_seq_list_append(&chan->retrans_list,
+                                              bt_cb(skb)->control.txseq);
+                }
+
+                l2cap_ertm_resend(chan);
+        }
 }
 
 static void l2cap_send_ack(struct l2cap_chan *chan)
 {
-        __clear_ack_timer(chan);
-        __l2cap_send_ack(chan);
-}
+        struct l2cap_ctrl control;
+        u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
+                                         chan->last_acked_seq);
+        int threshold;
 
-static void l2cap_send_srejtail(struct l2cap_chan *chan)
-{
-        struct srej_list *tail;
-        u32 control;
+        BT_DBG("chan %p last_acked_seq %d buffer_seq %d",
+               chan, chan->last_acked_seq, chan->buffer_seq);
 
-        control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
-        control |= __set_ctrl_final(chan);
+        memset(&control, 0, sizeof(control));
+        control.sframe = 1;
 
-        tail = list_entry((&chan->srej_l)->prev, struct srej_list, list);
-        control |= __set_reqseq(chan, tail->tx_seq);
+        if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
+            chan->rx_state == L2CAP_RX_STATE_RECV) {
+                __clear_ack_timer(chan);
+                control.super = L2CAP_SUPER_RNR;
+                control.reqseq = chan->buffer_seq;
+                l2cap_send_sframe(chan, &control);
+        } else {
+                if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {
+                        l2cap_ertm_send(chan);
+                        /* If any i-frames were sent, they included an ack */
+                        if (chan->buffer_seq == chan->last_acked_seq)
+                                frames_to_ack = 0;
+                }
+
+                /* Ack now if the tx window is 3/4ths full.
+                 * Calculate without mul or div
+                 */
+                threshold = chan->tx_win;
+                threshold += threshold << 1;
+                threshold >>= 2;
+
+                BT_DBG("frames_to_ack %d, threshold %d", (int)frames_to_ack,
+                       threshold);
+
+                if (frames_to_ack >= threshold) {
+                        __clear_ack_timer(chan);
+                        control.super = L2CAP_SUPER_RR;
+                        control.reqseq = chan->buffer_seq;
+                        l2cap_send_sframe(chan, &control);
+                        frames_to_ack = 0;
+                }
 
-        l2cap_send_sframe(chan, control);
+                if (frames_to_ack)
+                        __set_ack_timer(chan);
+        }
 }
 
 static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
@@ -1956,10 +2026,7 @@ static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
         if (!conn)
                 return ERR_PTR(-ENOTCONN);
 
-        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
-                hlen = L2CAP_EXT_HDR_SIZE;
-        else
-                hlen = L2CAP_ENH_HDR_SIZE;
+        hlen = __ertm_hdr_size(chan);
 
         if (sdulen)
                 hlen += L2CAP_SDULEN_SIZE;
@@ -1979,7 +2046,11 @@ static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
         lh->cid = cpu_to_le16(chan->dcid);
         lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
 
-        __put_control(chan, 0, skb_put(skb, __ctrl_size(chan)));
+        /* Control header is populated later */
+        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
+                put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
+        else
+                put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
 
         if (sdulen)
                 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
@@ -1990,9 +2061,7 @@ static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
                 return ERR_PTR(err);
         }
 
-        if (chan->fcs == L2CAP_FCS_CRC16)
-                put_unaligned_le16(0, skb_put(skb, L2CAP_FCS_SIZE));
-
+        bt_cb(skb)->control.fcs = chan->fcs;
         bt_cb(skb)->control.retries = 0;
         return skb;
 }
@@ -2004,7 +2073,6 @@ static int l2cap_segment_sdu(struct l2cap_chan *chan,
         struct sk_buff *skb;
         u16 sdu_len;
         size_t pdu_len;
-        int err = 0;
         u8 sar;
 
         BT_DBG("chan %p, msg %p, len %d", chan, msg, (int)len);
@@ -2020,7 +2088,10 @@ static int l2cap_segment_sdu(struct l2cap_chan *chan,
         pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
 
         /* Adjust for largest possible L2CAP overhead. */
-        pdu_len -= L2CAP_EXT_HDR_SIZE + L2CAP_FCS_SIZE;
+        if (chan->fcs)
+                pdu_len -= L2CAP_FCS_SIZE;
+
+        pdu_len -= __ertm_hdr_size(chan);
 
         /* Remote device may have requested smaller PDUs */
         pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
@@ -2060,7 +2131,7 @@ static int l2cap_segment_sdu(struct l2cap_chan *chan,
                 }
         }
 
-        return err;
+        return 0;
 }
 
 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
@@ -2122,17 +2193,12 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
                 if (err)
                         break;
 
-                if (chan->mode == L2CAP_MODE_ERTM && chan->tx_send_head == NULL)
-                        chan->tx_send_head = seg_queue.next;
-                skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);
-
                 if (chan->mode == L2CAP_MODE_ERTM)
-                        err = l2cap_ertm_send(chan);
+                        l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);
                 else
-                        l2cap_streaming_send(chan);
+                        l2cap_streaming_send(chan, &seg_queue);
 
-                if (err >= 0)
-                        err = len;
+                err = len;
 
                 /* If the skbs were not queued for sending, they'll still be in
                  * seg_queue and need to be purged.
@@ -2148,6 +2214,296 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
         return err;
 }
 
+static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)
+{
+        struct l2cap_ctrl control;
+        u16 seq;
+
+        BT_DBG("chan %p, txseq %d", chan, txseq);
+
+        memset(&control, 0, sizeof(control));
+        control.sframe = 1;
+        control.super = L2CAP_SUPER_SREJ;
+
+        for (seq = chan->expected_tx_seq; seq != txseq;
+             seq = __next_seq(chan, seq)) {
+                if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {
+                        control.reqseq = seq;
+                        l2cap_send_sframe(chan, &control);
+                        l2cap_seq_list_append(&chan->srej_list, seq);
+                }
+        }
+
+        chan->expected_tx_seq = __next_seq(chan, txseq);
+}
+
+static void l2cap_send_srej_tail(struct l2cap_chan *chan)
+{
+        struct l2cap_ctrl control;
+
+        BT_DBG("chan %p", chan);
+
+        if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)
+                return;
+
+        memset(&control, 0, sizeof(control));
+        control.sframe = 1;
+        control.super = L2CAP_SUPER_SREJ;
+        control.reqseq = chan->srej_list.tail;
+        l2cap_send_sframe(chan, &control);
+}
+
+static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)
+{
+        struct l2cap_ctrl control;
+        u16 initial_head;
+        u16 seq;
+
+        BT_DBG("chan %p, txseq %d", chan, txseq);
+
+        memset(&control, 0, sizeof(control));
+        control.sframe = 1;
+        control.super = L2CAP_SUPER_SREJ;
+
+        /* Capture initial list head to allow only one pass through the list. */
+        initial_head = chan->srej_list.head;
+
+        do {
+                seq = l2cap_seq_list_pop(&chan->srej_list);
+                if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR)
+                        break;
+
+                control.reqseq = seq;
+                l2cap_send_sframe(chan, &control);
+                l2cap_seq_list_append(&chan->srej_list, seq);
+        } while (chan->srej_list.head != initial_head);
+}
+
+static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)
+{
+        struct sk_buff *acked_skb;
+        u16 ackseq;
+
+        BT_DBG("chan %p, reqseq %d", chan, reqseq);
+
+        if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)
+                return;
+
+        BT_DBG("expected_ack_seq %d, unacked_frames %d",
+               chan->expected_ack_seq, chan->unacked_frames);
+
+        for (ackseq = chan->expected_ack_seq; ackseq != reqseq;
+             ackseq = __next_seq(chan, ackseq)) {
+
+                acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);
+                if (acked_skb) {
+                        skb_unlink(acked_skb, &chan->tx_q);
+                        kfree_skb(acked_skb);
+                        chan->unacked_frames--;
+                }
+        }
+
+        chan->expected_ack_seq = reqseq;
+
+        if (chan->unacked_frames == 0)
+                __clear_retrans_timer(chan);
+
+        BT_DBG("unacked_frames %d", (int) chan->unacked_frames);
+}
+
+static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)
+{
+        BT_DBG("chan %p", chan);
+
+        chan->expected_tx_seq = chan->buffer_seq;
+        l2cap_seq_list_clear(&chan->srej_list);
+        skb_queue_purge(&chan->srej_q);
+        chan->rx_state = L2CAP_RX_STATE_RECV;
+}
+
+static void l2cap_tx_state_xmit(struct l2cap_chan *chan,
+                                struct l2cap_ctrl *control,
+                                struct sk_buff_head *skbs, u8 event)
+{
+        BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
+               event);
+
+        switch (event) {
+        case L2CAP_EV_DATA_REQUEST:
+                if (chan->tx_send_head == NULL)
+                        chan->tx_send_head = skb_peek(skbs);
+
+                skb_queue_splice_tail_init(skbs, &chan->tx_q);
+                l2cap_ertm_send(chan);
+                break;
+        case L2CAP_EV_LOCAL_BUSY_DETECTED:
+                BT_DBG("Enter LOCAL_BUSY");
+                set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
+
+                if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
+                        /* The SREJ_SENT state must be aborted if we are to
+                         * enter the LOCAL_BUSY state.
+                         */
+                        l2cap_abort_rx_srej_sent(chan);
+                }
+
+                l2cap_send_ack(chan);
+
+                break;
+        case L2CAP_EV_LOCAL_BUSY_CLEAR:
+                BT_DBG("Exit LOCAL_BUSY");
+                clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
+
+                if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
+                        struct l2cap_ctrl local_control;
+
+                        memset(&local_control, 0, sizeof(local_control));
+                        local_control.sframe = 1;
+                        local_control.super = L2CAP_SUPER_RR;
+                        local_control.poll = 1;
+                        local_control.reqseq = chan->buffer_seq;
+                        l2cap_send_sframe(chan, &local_control);
+
+                        chan->retry_count = 1;
+                        __set_monitor_timer(chan);
+                        chan->tx_state = L2CAP_TX_STATE_WAIT_F;
+                }
+                break;
+        case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
+                l2cap_process_reqseq(chan, control->reqseq);
+                break;
+        case L2CAP_EV_EXPLICIT_POLL:
+                l2cap_send_rr_or_rnr(chan, 1);
+                chan->retry_count = 1;
+                __set_monitor_timer(chan);
+                __clear_ack_timer(chan);
+                chan->tx_state = L2CAP_TX_STATE_WAIT_F;
+                break;
+        case L2CAP_EV_RETRANS_TO:
+                l2cap_send_rr_or_rnr(chan, 1);
+                chan->retry_count = 1;
+                __set_monitor_timer(chan);
+                chan->tx_state = L2CAP_TX_STATE_WAIT_F;
+                break;
+        case L2CAP_EV_RECV_FBIT:
+                /* Nothing to process */
+                break;
+        default:
+                break;
+        }
+}
+
+static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,
+                                  struct l2cap_ctrl *control,
+                                  struct sk_buff_head *skbs, u8 event)
+{
+        BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
+               event);
+
+        switch (event) {
+        case L2CAP_EV_DATA_REQUEST:
+                if (chan->tx_send_head == NULL)
+                        chan->tx_send_head = skb_peek(skbs);
+                /* Queue data, but don't send. */
+                skb_queue_splice_tail_init(skbs, &chan->tx_q);
+                break;
+        case L2CAP_EV_LOCAL_BUSY_DETECTED:
+                BT_DBG("Enter LOCAL_BUSY");
+                set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
+
+                if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
+                        /* The SREJ_SENT state must be aborted if we are to
+                         * enter the LOCAL_BUSY state.
+                         */
+                        l2cap_abort_rx_srej_sent(chan);
+                }
+
+                l2cap_send_ack(chan);
+
+                break;
+        case L2CAP_EV_LOCAL_BUSY_CLEAR:
+                BT_DBG("Exit LOCAL_BUSY");
+                clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
+
+                if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
+                        struct l2cap_ctrl local_control;
+                        memset(&local_control, 0, sizeof(local_control));
+                        local_control.sframe = 1;
+                        local_control.super = L2CAP_SUPER_RR;
+                        local_control.poll = 1;
+                        local_control.reqseq = chan->buffer_seq;
+                        l2cap_send_sframe(chan, &local_control);
+
+                        chan->retry_count = 1;
+                        __set_monitor_timer(chan);
+                        chan->tx_state = L2CAP_TX_STATE_WAIT_F;
+                }
+                break;
+        case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
+                l2cap_process_reqseq(chan, control->reqseq);
+
+                /* Fall through */
+
+        case L2CAP_EV_RECV_FBIT:
+                if (control && control->final) {
+                        __clear_monitor_timer(chan);
+                        if (chan->unacked_frames > 0)
+                                __set_retrans_timer(chan);
+                        chan->retry_count = 0;
+                        chan->tx_state = L2CAP_TX_STATE_XMIT;
+                        BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);
+                }
+                break;
+        case L2CAP_EV_EXPLICIT_POLL:
+                /* Ignore */
+                break;
+        case L2CAP_EV_MONITOR_TO:
+                if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {
+                        l2cap_send_rr_or_rnr(chan, 1);
+                        __set_monitor_timer(chan);
+                        chan->retry_count++;
+                } else {
+                        l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
+                }
+                break;
+        default:
+                break;
+        }
+}
+
+static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
+                     struct sk_buff_head *skbs, u8 event)
+{
+        BT_DBG("chan %p, control %p, skbs %p, event %d, state %d",
+               chan, control, skbs, event, chan->tx_state);
+
+        switch (chan->tx_state) {
+        case L2CAP_TX_STATE_XMIT:
+                l2cap_tx_state_xmit(chan, control, skbs, event);
+                break;
+        case L2CAP_TX_STATE_WAIT_F:
+                l2cap_tx_state_wait_f(chan, control, skbs, event);
+                break;
+        default:
+                /* Ignore event */
+                break;
+        }
+}
+
+static void l2cap_pass_to_tx(struct l2cap_chan *chan,
+                             struct l2cap_ctrl *control)
+{
+        BT_DBG("chan %p, control %p", chan, control);
+        l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);
+}
+
+static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,
+                                  struct l2cap_ctrl *control)
+{
+        BT_DBG("chan %p, control %p", chan, control);
+        l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);
+}
+
 /* Copy frame to all raw sockets on that connection */
 static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
 {
@@ -2170,7 +2526,7 @@ static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
                 if (!nskb)
                         continue;
 
-                if (chan->ops->recv(chan->data, nskb))
+                if (chan->ops->recv(chan, nskb))
                         kfree_skb(nskb);
         }
 
@@ -2200,9 +2556,9 @@ static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
         lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
 
         if (conn->hcon->type == LE_LINK)
-                lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
+                lh->cid = __constant_cpu_to_le16(L2CAP_CID_LE_SIGNALING);
         else
-                lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
+                lh->cid = __constant_cpu_to_le16(L2CAP_CID_SIGNALING);
 
         cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
         cmd->code  = code;
@@ -2314,8 +2670,8 @@ static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
                 efs.stype       = chan->local_stype;
                 efs.msdu        = cpu_to_le16(chan->local_msdu);
                 efs.sdu_itime   = cpu_to_le32(chan->local_sdu_itime);
-                efs.acc_lat     = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
-                efs.flush_to    = cpu_to_le32(L2CAP_DEFAULT_FLUSH_TO);
+                efs.acc_lat     = __constant_cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
+                efs.flush_to    = __constant_cpu_to_le32(L2CAP_DEFAULT_FLUSH_TO);
                 break;
 
         case L2CAP_MODE_STREAMING:
@@ -2338,20 +2694,24 @@ static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
 static void l2cap_ack_timeout(struct work_struct *work)
 {
         struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
-                                                        ack_timer.work);
+                                               ack_timer.work);
+        u16 frames_to_ack;
 
         BT_DBG("chan %p", chan);
 
         l2cap_chan_lock(chan);
 
-        __l2cap_send_ack(chan);
+        frames_to_ack = __seq_offset(chan, chan->buffer_seq,
+                                     chan->last_acked_seq);
 
-        l2cap_chan_unlock(chan);
+        if (frames_to_ack)
+                l2cap_send_rr_or_rnr(chan, 0);
 
+        l2cap_chan_unlock(chan);
         l2cap_chan_put(chan);
 }
 
-static inline int l2cap_ertm_init(struct l2cap_chan *chan)
+int l2cap_ertm_init(struct l2cap_chan *chan)
 {
         int err;
 
@@ -2360,7 +2720,6 @@ static inline int l2cap_ertm_init(struct l2cap_chan *chan)
         chan->expected_ack_seq = 0;
         chan->unacked_frames = 0;
         chan->buffer_seq = 0;
-        chan->num_acked = 0;
         chan->frames_sent = 0;
         chan->last_acked_seq = 0;
         chan->sdu = NULL;
@@ -2381,12 +2740,15 @@ static inline int l2cap_ertm_init(struct l2cap_chan *chan)
 
         skb_queue_head_init(&chan->srej_q);
 
-        INIT_LIST_HEAD(&chan->srej_l);
         err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
         if (err < 0)
                 return err;
 
-        return l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
+        err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
+        if (err < 0)
+                l2cap_seq_list_free(&chan->srej_list);
+
+        return err;
 }
 
 static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
@@ -2512,6 +2874,7 @@ done:
                 break;
 
         case L2CAP_MODE_STREAMING:
+                l2cap_txwin_setup(chan);
                 rfc.mode            = L2CAP_MODE_STREAMING;
                 rfc.txwin_size      = 0;
                 rfc.max_transmit    = 0;
@@ -2542,7 +2905,7 @@ done:
         }
 
         req->dcid  = cpu_to_le16(chan->dcid);
-        req->flags = cpu_to_le16(0);
+        req->flags = __constant_cpu_to_le16(0);
 
         return ptr - data;
 }
@@ -2762,7 +3125,7 @@ done:
         }
         rsp->scid   = cpu_to_le16(chan->dcid);
         rsp->result = cpu_to_le16(result);
-        rsp->flags  = cpu_to_le16(0x0000);
+        rsp->flags  = __constant_cpu_to_le16(0);
 
         return ptr - data;
 }
@@ -2861,7 +3224,7 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, voi
         }
 
         req->dcid   = cpu_to_le16(chan->dcid);
-        req->flags  = cpu_to_le16(0x0000);
+        req->flags  = __constant_cpu_to_le16(0);
 
         return ptr - data;
 }
@@ -2888,8 +3251,8 @@ void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
 
         rsp.scid   = cpu_to_le16(chan->dcid);
         rsp.dcid   = cpu_to_le16(chan->scid);
-        rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
-        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
+        rsp.result = __constant_cpu_to_le16(L2CAP_CR_SUCCESS);
+        rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
         l2cap_send_cmd(conn, chan->ident,
                                 L2CAP_CONN_RSP, sizeof(rsp), &rsp);
 
@@ -2927,8 +3290,8 @@ static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
          * did not send an RFC option.
          */
         rfc.mode = chan->mode;
-        rfc.retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
-        rfc.monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
+        rfc.retrans_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
+        rfc.monitor_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
         rfc.max_pdu_size = cpu_to_le16(chan->imtu);
 
         BT_ERR("Expected RFC option was not found, using defaults");
@@ -2991,7 +3354,7 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
         lock_sock(parent);
 
         /* Check if the ACL is secure enough (if not SDP) */
-        if (psm != cpu_to_le16(0x0001) &&
+        if (psm != __constant_cpu_to_le16(L2CAP_PSM_SDP) &&
                                 !hci_conn_check_link_mode(conn->hcon)) {
                 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
                 result = L2CAP_CR_SEC_BLOCK;
@@ -3000,25 +3363,16 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
 
         result = L2CAP_CR_NO_MEM;
 
-        /* Check for backlog size */
-        if (sk_acceptq_is_full(parent)) {
-                BT_DBG("backlog full %d", parent->sk_ack_backlog);
+        /* Check if we already have channel with that dcid */
+        if (__l2cap_get_chan_by_dcid(conn, scid))
                 goto response;
-        }
 
-        chan = pchan->ops->new_connection(pchan->data);
+        chan = pchan->ops->new_connection(pchan);
         if (!chan)
                 goto response;
 
         sk = chan->sk;
 
-        /* Check if we already have channel with that dcid */
-        if (__l2cap_get_chan_by_dcid(conn, scid)) {
-                sock_set_flag(sk, SOCK_ZAPPED);
-                chan->ops->close(chan->data);
-                goto response;
-        }
-
         hci_conn_hold(conn->hcon);
 
         bacpy(&bt_sk(sk)->src, conn->src);
@@ -3072,7 +3426,7 @@ sendresp:
 
         if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
                 struct l2cap_info_req info;
-                info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
+                info.type = __constant_cpu_to_le16(L2CAP_IT_FEAT_MASK);
 
                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
                 conn->info_ident = l2cap_get_ident(conn);
@@ -3194,7 +3548,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
         if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {
                 struct l2cap_cmd_rej_cid rej;
 
-                rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
+                rej.reason = __constant_cpu_to_le16(L2CAP_REJ_INVALID_CID);
                 rej.scid = cpu_to_le16(chan->scid);
                 rej.dcid = cpu_to_le16(chan->dcid);
 
@@ -3216,11 +3570,11 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
         memcpy(chan->conf_req + chan->conf_len, req->data, len);
         chan->conf_len += len;
 
-        if (flags & 0x0001) {
+        if (flags & L2CAP_CONF_FLAG_CONTINUATION) {
                 /* Incomplete config. Send empty response. */
                 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
                                 l2cap_build_conf_rsp(chan, rsp,
-                                        L2CAP_CONF_SUCCESS, 0x0001), rsp);
+                                        L2CAP_CONF_SUCCESS, flags), rsp);
                 goto unlock;
         }
 
@@ -3243,8 +3597,6 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
         if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
                 set_default_fcs(chan);
 
-                l2cap_state_change(chan, BT_CONNECTED);
-
                 if (chan->mode == L2CAP_MODE_ERTM ||
                     chan->mode == L2CAP_MODE_STREAMING)
                         err = l2cap_ertm_init(chan);
@@ -3276,7 +3628,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
 
                 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
                                         l2cap_build_conf_rsp(chan, rsp,
-                                        L2CAP_CONF_SUCCESS, 0x0000), rsp);
+                                        L2CAP_CONF_SUCCESS, flags), rsp);
         }
 
 unlock:
@@ -3367,7 +3719,7 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
                 goto done;
         }
 
-        if (flags & 0x01)
+        if (flags & L2CAP_CONF_FLAG_CONTINUATION)
                 goto done;
 
         set_bit(CONF_INPUT_DONE, &chan->conf_state);
@@ -3375,7 +3727,6 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
         if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
                 set_default_fcs(chan);
 
-                l2cap_state_change(chan, BT_CONNECTED);
                 if (chan->mode == L2CAP_MODE_ERTM ||
                     chan->mode == L2CAP_MODE_STREAMING)
                         err = l2cap_ertm_init(chan);
@@ -3429,7 +3780,7 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd
 
         l2cap_chan_unlock(chan);
 
-        chan->ops->close(chan->data);
+        chan->ops->close(chan);
         l2cap_chan_put(chan);
 
         mutex_unlock(&conn->chan_lock);
@@ -3463,7 +3814,7 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd
 
         l2cap_chan_unlock(chan);
 
-        chan->ops->close(chan->data);
+        chan->ops->close(chan);
         l2cap_chan_put(chan);
 
         mutex_unlock(&conn->chan_lock);
@@ -3484,8 +3835,8 @@ static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cm
                 u8 buf[8];
                 u32 feat_mask = l2cap_feat_mask;
                 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
-                rsp->type   = cpu_to_le16(L2CAP_IT_FEAT_MASK);
-                rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
+                rsp->type   = __constant_cpu_to_le16(L2CAP_IT_FEAT_MASK);
+                rsp->result = __constant_cpu_to_le16(L2CAP_IR_SUCCESS);
                 if (!disable_ertm)
                         feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
                                                          | L2CAP_FEAT_FCS;
@@ -3505,15 +3856,15 @@ static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cm
                 else
                         l2cap_fixed_chan[0] &= ~L2CAP_FC_A2MP;
 
-                rsp->type   = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
-                rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
+                rsp->type   = __constant_cpu_to_le16(L2CAP_IT_FIXED_CHAN);
+                rsp->result = __constant_cpu_to_le16(L2CAP_IR_SUCCESS);
                 memcpy(rsp->data, l2cap_fixed_chan, sizeof(l2cap_fixed_chan));
                 l2cap_send_cmd(conn, cmd->ident,
                                         L2CAP_INFO_RSP, sizeof(buf), buf);
         } else {
                 struct l2cap_info_rsp rsp;
                 rsp.type   = cpu_to_le16(type);
-                rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
+                rsp.result = __constant_cpu_to_le16(L2CAP_IR_NOTSUPP);
                 l2cap_send_cmd(conn, cmd->ident,
                                         L2CAP_INFO_RSP, sizeof(rsp), &rsp);
         }
@@ -3553,7 +3904,7 @@ static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cm
 
                 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
                         struct l2cap_info_req req;
-                        req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
+                        req.type = __constant_cpu_to_le16(L2CAP_IT_FIXED_CHAN);
 
                         conn->info_ident = l2cap_get_ident(conn);
 
@@ -3788,9 +4139,9 @@ static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
 
         err = l2cap_check_conn_param(min, max, latency, to_multiplier);
         if (err)
-                rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
+                rsp.result = __constant_cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
         else
-                rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
+                rsp.result = __constant_cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
 
         l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
                                                         sizeof(rsp), &rsp);
@@ -3938,7 +4289,7 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn,
                         BT_ERR("Wrong link type (%d)", err);
 
                         /* FIXME: Map err to a valid reason */
-                        rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
+                        rej.reason = __constant_cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
                         l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
                 }
 
@@ -3970,65 +4321,38 @@ static int l2cap_check_fcs(struct l2cap_chan *chan,  struct sk_buff *skb)
         return 0;
 }
 
-static inline void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
+static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
 {
-        u32 control = 0;
+        struct l2cap_ctrl control;
 
-        chan->frames_sent = 0;
+        BT_DBG("chan %p", chan);
 
-        control |= __set_reqseq(chan, chan->buffer_seq);
+        memset(&control, 0, sizeof(control));
+        control.sframe = 1;
+        control.final = 1;
+        control.reqseq = chan->buffer_seq;
+        set_bit(CONN_SEND_FBIT, &chan->conn_state);
 
         if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
-                control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
-                l2cap_send_sframe(chan, control);
-                set_bit(CONN_RNR_SENT, &chan->conn_state);
+                control.super = L2CAP_SUPER_RNR;
+                l2cap_send_sframe(chan, &control);
         }
 
-        if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
-                l2cap_retransmit_frames(chan);
+        if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
+            chan->unacked_frames > 0)
+                __set_retrans_timer(chan);
 
+        /* Send pending iframes */
         l2cap_ertm_send(chan);
 
         if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
-                        chan->frames_sent == 0) {
-                control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
-                l2cap_send_sframe(chan, control);
-        }
-}
-
-static int l2cap_add_to_srej_queue(struct l2cap_chan *chan, struct sk_buff *skb, u16 tx_seq, u8 sar)
-{
-        struct sk_buff *next_skb;
-        int tx_seq_offset, next_tx_seq_offset;
-
-        bt_cb(skb)->control.txseq = tx_seq;
-        bt_cb(skb)->control.sar = sar;
-
-        next_skb = skb_peek(&chan->srej_q);
-
-        tx_seq_offset = __seq_offset(chan, tx_seq, chan->buffer_seq);
-
-        while (next_skb) {
-                if (bt_cb(next_skb)->control.txseq == tx_seq)
-                        return -EINVAL;
-
-                next_tx_seq_offset = __seq_offset(chan,
-                        bt_cb(next_skb)->control.txseq, chan->buffer_seq);
-
-                if (next_tx_seq_offset > tx_seq_offset) {
-                        __skb_queue_before(&chan->srej_q, next_skb, skb);
-                        return 0;
-                }
-
-                if (skb_queue_is_last(&chan->srej_q, next_skb))
-                        next_skb = NULL;
-                else
-                        next_skb = skb_queue_next(&chan->srej_q, next_skb);
+            test_bit(CONN_SEND_FBIT, &chan->conn_state)) {
+                /* F-bit wasn't sent in an s-frame or i-frame yet, so
+                 * send it now.
+                 */
+                control.super = L2CAP_SUPER_RR;
+                l2cap_send_sframe(chan, &control);
         }
-
-        __skb_queue_tail(&chan->srej_q, skb);
-
-        return 0;
 }
 
 static void append_skb_frag(struct sk_buff *skb,
@@ -4050,16 +4374,17 @@ static void append_skb_frag(struct sk_buff *skb,
         skb->truesize += new_frag->truesize;
 }
 
-static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb, u32 control)
+static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
+                                struct l2cap_ctrl *control)
 {
         int err = -EINVAL;
 
-        switch (__get_ctrl_sar(chan, control)) {
+        switch (control->sar) {
         case L2CAP_SAR_UNSEGMENTED:
                 if (chan->sdu)
                         break;
 
-                err = chan->ops->recv(chan->data, skb);
+                err = chan->ops->recv(chan, skb);
                 break;
 
         case L2CAP_SAR_START:
@@ -4109,7 +4434,7 @@ static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb, u3
                 if (chan->sdu->len != chan->sdu_len)
                         break;
 
-                err = chan->ops->recv(chan->data, chan->sdu);
+                err = chan->ops->recv(chan, chan->sdu);
 
                 if (!err) {
                         /* Reassembly complete */
@@ -4131,448 +4456,609 @@ static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb, u3
         return err;
 }
 
-static void l2cap_ertm_enter_local_busy(struct l2cap_chan *chan)
+void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
 {
-        BT_DBG("chan %p, Enter local busy", chan);
+        u8 event;
 
-        set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
-        l2cap_seq_list_clear(&chan->srej_list);
+        if (chan->mode != L2CAP_MODE_ERTM)
+                return;
 
-        __set_ack_timer(chan);
+        event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR;
+        l2cap_tx(chan, NULL, NULL, event);
 }
 
-static void l2cap_ertm_exit_local_busy(struct l2cap_chan *chan)
+static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)
 {
-        u32 control;
-
-        if (!test_bit(CONN_RNR_SENT, &chan->conn_state))
-                goto done;
+        int err = 0;
+        /* Pass sequential frames to l2cap_reassemble_sdu()
+         * until a gap is encountered.
+         */
 
-        control = __set_reqseq(chan, chan->buffer_seq);
-        control |= __set_ctrl_poll(chan);
-        control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
-        l2cap_send_sframe(chan, control);
-        chan->retry_count = 1;
+        BT_DBG("chan %p", chan);
 
-        __clear_retrans_timer(chan);
-        __set_monitor_timer(chan);
+        while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
+                struct sk_buff *skb;
+                BT_DBG("Searching for skb with txseq %d (queue len %d)",
+                       chan->buffer_seq, skb_queue_len(&chan->srej_q));
 
-        set_bit(CONN_WAIT_F, &chan->conn_state);
+                skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);
 
-done:
-        clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
-        clear_bit(CONN_RNR_SENT, &chan->conn_state);
+                if (!skb)
+                        break;
 
-        BT_DBG("chan %p, Exit local busy", chan);
-}
+                skb_unlink(skb, &chan->srej_q);
+                chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
+                err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->control);
+                if (err)
+                        break;
+        }
 
-void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
-{
-        if (chan->mode == L2CAP_MODE_ERTM) {
-                if (busy)
-                        l2cap_ertm_enter_local_busy(chan);
-                else
-                        l2cap_ertm_exit_local_busy(chan);
+        if (skb_queue_empty(&chan->srej_q)) {
+                chan->rx_state = L2CAP_RX_STATE_RECV;
+                l2cap_send_ack(chan);
         }
+
+        return err;
 }
 
-static void l2cap_check_srej_gap(struct l2cap_chan *chan, u16 tx_seq)
+static void l2cap_handle_srej(struct l2cap_chan *chan,
+                              struct l2cap_ctrl *control)
 {
         struct sk_buff *skb;
-        u32 control;
 
-        while ((skb = skb_peek(&chan->srej_q)) &&
-                        !test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
-                int err;
+        BT_DBG("chan %p, control %p", chan, control);
 
-                if (bt_cb(skb)->control.txseq != tx_seq)
-                        break;
+        if (control->reqseq == chan->next_tx_seq) {
+                BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
+                l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
+                return;
+        }
 
-                skb = skb_dequeue(&chan->srej_q);
-                control = __set_ctrl_sar(chan, bt_cb(skb)->control.sar);
-                err = l2cap_reassemble_sdu(chan, skb, control);
+        skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
 
-                if (err < 0) {
-                        l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
-                        break;
-                }
+        if (skb == NULL) {
+                BT_DBG("Seq %d not available for retransmission",
+                       control->reqseq);
+                return;
+        }
 
-                chan->buffer_seq_srej = __next_seq(chan, chan->buffer_seq_srej);
-                tx_seq = __next_seq(chan, tx_seq);
+        if (chan->max_tx != 0 && bt_cb(skb)->control.retries >= chan->max_tx) {
+                BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
+                l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
+                return;
         }
-}
 
-static void l2cap_resend_srejframe(struct l2cap_chan *chan, u16 tx_seq)
-{
-        struct srej_list *l, *tmp;
-        u32 control;
+        clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
 
-        list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
-                if (l->tx_seq == tx_seq) {
-                        list_del(&l->list);
-                        kfree(l);
-                        return;
+        if (control->poll) {
+                l2cap_pass_to_tx(chan, control);
+
+                set_bit(CONN_SEND_FBIT, &chan->conn_state);
+                l2cap_retransmit(chan, control);
+                l2cap_ertm_send(chan);
+
+                if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
+                        set_bit(CONN_SREJ_ACT, &chan->conn_state);
+                        chan->srej_save_reqseq = control->reqseq;
+                }
+        } else {
+                l2cap_pass_to_tx_fbit(chan, control);
+
+                if (control->final) {
+                        if (chan->srej_save_reqseq != control->reqseq ||
+                            !test_and_clear_bit(CONN_SREJ_ACT,
+                                                &chan->conn_state))
+                                l2cap_retransmit(chan, control);
+                } else {
+                        l2cap_retransmit(chan, control);
+                        if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
+                                set_bit(CONN_SREJ_ACT, &chan->conn_state);
+                                chan->srej_save_reqseq = control->reqseq;
+                        }
                 }
-                control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
-                control |= __set_reqseq(chan, l->tx_seq);
-                l2cap_send_sframe(chan, control);
-                list_del(&l->list);
-                list_add_tail(&l->list, &chan->srej_l);
         }
 }
 
-static int l2cap_send_srejframe(struct l2cap_chan *chan, u16 tx_seq)
+static void l2cap_handle_rej(struct l2cap_chan *chan,
+                             struct l2cap_ctrl *control)
 {
-        struct srej_list *new;
-        u32 control;
-
-        while (tx_seq != chan->expected_tx_seq) {
-                control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
-                control |= __set_reqseq(chan, chan->expected_tx_seq);
-                l2cap_seq_list_append(&chan->srej_list, chan->expected_tx_seq);
-                l2cap_send_sframe(chan, control);
+        struct sk_buff *skb;
 
-                new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC);
-                if (!new)
-                        return -ENOMEM;
+        BT_DBG("chan %p, control %p", chan, control);
 
-                new->tx_seq = chan->expected_tx_seq;
+        if (control->reqseq == chan->next_tx_seq) {
+                BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
+                l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
+                return;
+        }
 
-                chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
+        skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
 
-                list_add_tail(&new->list, &chan->srej_l);
+        if (chan->max_tx && skb &&
+            bt_cb(skb)->control.retries >= chan->max_tx) {
+                BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
+                l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
+                return;
         }
 
-        chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
+        clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
 
-        return 0;
+        l2cap_pass_to_tx(chan, control);
+
+        if (control->final) {
+                if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
+                        l2cap_retransmit_all(chan, control);
+        } else {
+                l2cap_retransmit_all(chan, control);
+                l2cap_ertm_send(chan);
+                if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)
+                        set_bit(CONN_REJ_ACT, &chan->conn_state);
+        }
 }
 
-static inline int l2cap_data_channel_iframe(struct l2cap_chan *chan, u32 rx_control, struct sk_buff *skb)
+static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)
 {
-        u16 tx_seq = __get_txseq(chan, rx_control);
-        u16 req_seq = __get_reqseq(chan, rx_control);
-        u8 sar = __get_ctrl_sar(chan, rx_control);
-        int tx_seq_offset, expected_tx_seq_offset;
-        int num_to_ack = (chan->tx_win/6) + 1;
-        int err = 0;
+        BT_DBG("chan %p, txseq %d", chan, txseq);
 
-        BT_DBG("chan %p len %d tx_seq %d rx_control 0x%8.8x", chan, skb->len,
-                                                        tx_seq, rx_control);
+        BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,
+               chan->expected_tx_seq);
 
-        if (__is_ctrl_final(chan, rx_control) &&
-                        test_bit(CONN_WAIT_F, &chan->conn_state)) {
-                __clear_monitor_timer(chan);
-                if (chan->unacked_frames > 0)
-                        __set_retrans_timer(chan);
-                clear_bit(CONN_WAIT_F, &chan->conn_state);
-        }
+        if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
+                if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
+                                                                chan->tx_win) {
+                        /* See notes below regarding "double poll" and
+                         * invalid packets.
+                         */
+                        if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
+                                BT_DBG("Invalid/Ignore - after SREJ");
+                                return L2CAP_TXSEQ_INVALID_IGNORE;
+                        } else {
+                                BT_DBG("Invalid - in window after SREJ sent");
+                                return L2CAP_TXSEQ_INVALID;
+                        }
+                }
 
-        chan->expected_ack_seq = req_seq;
-        l2cap_drop_acked_frames(chan);
+                if (chan->srej_list.head == txseq) {
+                        BT_DBG("Expected SREJ");
+                        return L2CAP_TXSEQ_EXPECTED_SREJ;
+                }
 
-        tx_seq_offset = __seq_offset(chan, tx_seq, chan->buffer_seq);
+                if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {
+                        BT_DBG("Duplicate SREJ - txseq already stored");
+                        return L2CAP_TXSEQ_DUPLICATE_SREJ;
+                }
 
-        /* invalid tx_seq */
-        if (tx_seq_offset >= chan->tx_win) {
-                l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
-                goto drop;
+                if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {
+                        BT_DBG("Unexpected SREJ - not requested");
+                        return L2CAP_TXSEQ_UNEXPECTED_SREJ;
+                }
         }
 
-        if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
-                if (!test_bit(CONN_RNR_SENT, &chan->conn_state))
-                        l2cap_send_ack(chan);
-                goto drop;
+        if (chan->expected_tx_seq == txseq) {
+                if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
+                    chan->tx_win) {
+                        BT_DBG("Invalid - txseq outside tx window");
+                        return L2CAP_TXSEQ_INVALID;
+                } else {
+                        BT_DBG("Expected");
+                        return L2CAP_TXSEQ_EXPECTED;
+                }
         }
 
-        if (tx_seq == chan->expected_tx_seq)
-                goto expected;
+        if (__seq_offset(chan, txseq, chan->last_acked_seq) <
+                __seq_offset(chan, chan->expected_tx_seq,
+                             chan->last_acked_seq)){
+                BT_DBG("Duplicate - expected_tx_seq later than txseq");
+                return L2CAP_TXSEQ_DUPLICATE;
+        }
+
+        if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {
+                /* A source of invalid packets is a "double poll" condition,
+                 * where delays cause us to send multiple poll packets.  If
+                 * the remote stack receives and processes both polls,
+                 * sequence numbers can wrap around in such a way that a
+                 * resent frame has a sequence number that looks like new data
+                 * with a sequence gap.  This would trigger an erroneous SREJ
+                 * request.
+                 *
+                 * Fortunately, this is impossible with a tx window that's
+                 * less than half of the maximum sequence number, which allows
+                 * invalid frames to be safely ignored.
+                 *
+                 * With tx window sizes greater than half of the tx window
+                 * maximum, the frame is invalid and cannot be ignored.  This
+                 * causes a disconnect.
+                 */
 
-        if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
-                struct srej_list *first;
+                if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
+                        BT_DBG("Invalid/Ignore - txseq outside tx window");
+                        return L2CAP_TXSEQ_INVALID_IGNORE;
+                } else {
+                        BT_DBG("Invalid - txseq outside tx window");
+                        return L2CAP_TXSEQ_INVALID;
+                }
+        } else {
+                BT_DBG("Unexpected - txseq indicates missing frames");
+                return L2CAP_TXSEQ_UNEXPECTED;
+        }
+}
+
+static int l2cap_rx_state_recv(struct l2cap_chan *chan,
+                               struct l2cap_ctrl *control,
+                               struct sk_buff *skb, u8 event)
+{
+        int err = 0;
+        bool skb_in_use = 0;
 
-                first = list_first_entry(&chan->srej_l,
-                                struct srej_list, list);
-                if (tx_seq == first->tx_seq) {
-                        l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
-                        l2cap_check_srej_gap(chan, tx_seq);
+        BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
+               event);
 
-                        list_del(&first->list);
-                        kfree(first);
+        switch (event) {
+        case L2CAP_EV_RECV_IFRAME:
+                switch (l2cap_classify_txseq(chan, control->txseq)) {
+                case L2CAP_TXSEQ_EXPECTED:
+                        l2cap_pass_to_tx(chan, control);
 
-                        if (list_empty(&chan->srej_l)) {
-                                chan->buffer_seq = chan->buffer_seq_srej;
-                                clear_bit(CONN_SREJ_SENT, &chan->conn_state);
-                                l2cap_send_ack(chan);
-                                BT_DBG("chan %p, Exit SREJ_SENT", chan);
+                        if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
+                                BT_DBG("Busy, discarding expected seq %d",
+                                       control->txseq);
+                                break;
                         }
-                } else {
-                        struct srej_list *l;
 
-                        /* duplicated tx_seq */
-                        if (l2cap_add_to_srej_queue(chan, skb, tx_seq, sar) < 0)
-                                goto drop;
+                        chan->expected_tx_seq = __next_seq(chan,
+                                                           control->txseq);
+
+                        chan->buffer_seq = chan->expected_tx_seq;
+                        skb_in_use = 1;
+
+                        err = l2cap_reassemble_sdu(chan, skb, control);
+                        if (err)
+                                break;
 
-                        list_for_each_entry(l, &chan->srej_l, list) {
-                                if (l->tx_seq == tx_seq) {
-                                        l2cap_resend_srejframe(chan, tx_seq);
-                                        return 0;
+                        if (control->final) {
+                                if (!test_and_clear_bit(CONN_REJ_ACT,
+                                                        &chan->conn_state)) {
+                                        control->final = 0;
+                                        l2cap_retransmit_all(chan, control);
+                                        l2cap_ertm_send(chan);
                                 }
                         }
 
-                        err = l2cap_send_srejframe(chan, tx_seq);
-                        if (err < 0) {
-                                l2cap_send_disconn_req(chan->conn, chan, -err);
-                                return err;
+                        if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
+                                l2cap_send_ack(chan);
+                        break;
+                case L2CAP_TXSEQ_UNEXPECTED:
+                        l2cap_pass_to_tx(chan, control);
+
+                        /* Can't issue SREJ frames in the local busy state.
+                         * Drop this frame, it will be seen as missing
+                         * when local busy is exited.
+                         */
+                        if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
+                                BT_DBG("Busy, discarding unexpected seq %d",
+                                       control->txseq);
+                                break;
                         }
-                }
-        } else {
-                expected_tx_seq_offset = __seq_offset(chan,
-                                chan->expected_tx_seq, chan->buffer_seq);
 
-                /* duplicated tx_seq */
-                if (tx_seq_offset < expected_tx_seq_offset)
-                        goto drop;
+                        /* There was a gap in the sequence, so an SREJ
+                         * must be sent for each missing frame.  The
+                         * current frame is stored for later use.
+                         */
+                        skb_queue_tail(&chan->srej_q, skb);
+                        skb_in_use = 1;
+                        BT_DBG("Queued %p (queue len %d)", skb,
+                               skb_queue_len(&chan->srej_q));
 
-                set_bit(CONN_SREJ_SENT, &chan->conn_state);
-
-                BT_DBG("chan %p, Enter SREJ", chan);
+                        clear_bit(CONN_SREJ_ACT, &chan->conn_state);
+                        l2cap_seq_list_clear(&chan->srej_list);
+                        l2cap_send_srej(chan, control->txseq);
 
-                INIT_LIST_HEAD(&chan->srej_l);
-                chan->buffer_seq_srej = chan->buffer_seq;
+                        chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;
+                        break;
+                case L2CAP_TXSEQ_DUPLICATE:
+                        l2cap_pass_to_tx(chan, control);
+                        break;
+                case L2CAP_TXSEQ_INVALID_IGNORE:
+                        break;
+                case L2CAP_TXSEQ_INVALID:
+                default:
+                        l2cap_send_disconn_req(chan->conn, chan,
+                                               ECONNRESET);
+                        break;
+                }
+                break;
+        case L2CAP_EV_RECV_RR:
+                l2cap_pass_to_tx(chan, control);
+                if (control->final) {
+                        clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
 
-                __skb_queue_head_init(&chan->srej_q);
-                l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
+                        if (!test_and_clear_bit(CONN_REJ_ACT,
+                                                &chan->conn_state)) {
+                                control->final = 0;
+                                l2cap_retransmit_all(chan, control);
+                        }
 
-                /* Set P-bit only if there are some I-frames to ack. */
-                if (__clear_ack_timer(chan))
-                        set_bit(CONN_SEND_PBIT, &chan->conn_state);
+                        l2cap_ertm_send(chan);
+                } else if (control->poll) {
+                        l2cap_send_i_or_rr_or_rnr(chan);
+                } else {
+                        if (test_and_clear_bit(CONN_REMOTE_BUSY,
+                                               &chan->conn_state) &&
+                            chan->unacked_frames)
+                                __set_retrans_timer(chan);
 
-                err = l2cap_send_srejframe(chan, tx_seq);
-                if (err < 0) {
-                        l2cap_send_disconn_req(chan->conn, chan, -err);
-                        return err;
+                        l2cap_ertm_send(chan);
                 }
+                break;
+        case L2CAP_EV_RECV_RNR:
+                set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
+                l2cap_pass_to_tx(chan, control);
+                if (control && control->poll) {
+                        set_bit(CONN_SEND_FBIT, &chan->conn_state);
+                        l2cap_send_rr_or_rnr(chan, 0);
+                }
+                __clear_retrans_timer(chan);
+                l2cap_seq_list_clear(&chan->retrans_list);
+                break;
+        case L2CAP_EV_RECV_REJ:
+                l2cap_handle_rej(chan, control);
+                break;
+        case L2CAP_EV_RECV_SREJ:
+                l2cap_handle_srej(chan, control);
+                break;
+        default:
+                break;
         }
-        return 0;
-
-expected:
-        chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
-
-        if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
-                bt_cb(skb)->control.txseq = tx_seq;
-                bt_cb(skb)->control.sar = sar;
-                __skb_queue_tail(&chan->srej_q, skb);
-                return 0;
-        }
-
-        err = l2cap_reassemble_sdu(chan, skb, rx_control);
-        chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
 
-        if (err < 0) {
-                l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
-                return err;
+        if (skb && !skb_in_use) {
+                BT_DBG("Freeing %p", skb);
+                kfree_skb(skb);
         }
 
-        if (__is_ctrl_final(chan, rx_control)) {
-                if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
-                        l2cap_retransmit_frames(chan);
-        }
+        return err;
+}
 
+static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
+                                    struct l2cap_ctrl *control,
+                                    struct sk_buff *skb, u8 event)
+{
+        int err = 0;
+        u16 txseq = control->txseq;
+        bool skb_in_use = 0;
+
+        BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
+               event);
+
+        switch (event) {
+        case L2CAP_EV_RECV_IFRAME:
+                switch (l2cap_classify_txseq(chan, txseq)) {
+                case L2CAP_TXSEQ_EXPECTED:
+                        /* Keep frame for reassembly later */
+                        l2cap_pass_to_tx(chan, control);
+                        skb_queue_tail(&chan->srej_q, skb);
+                        skb_in_use = 1;
+                        BT_DBG("Queued %p (queue len %d)", skb,
+                               skb_queue_len(&chan->srej_q));
+
+                        chan->expected_tx_seq = __next_seq(chan, txseq);
+                        break;
+                case L2CAP_TXSEQ_EXPECTED_SREJ:
+                        l2cap_seq_list_pop(&chan->srej_list);
 
-        chan->num_acked = (chan->num_acked + 1) % num_to_ack;
-        if (chan->num_acked == num_to_ack - 1)
-                l2cap_send_ack(chan);
-        else
-                __set_ack_timer(chan);
+                        l2cap_pass_to_tx(chan, control);
+                        skb_queue_tail(&chan->srej_q, skb);
+                        skb_in_use = 1;
+                        BT_DBG("Queued %p (queue len %d)", skb,
+                               skb_queue_len(&chan->srej_q));
 
-        return 0;
+                        err = l2cap_rx_queued_iframes(chan);
+                        if (err)
+                                break;
 
-drop:
-        kfree_skb(skb);
-        return 0;
-}
+                        break;
+                case L2CAP_TXSEQ_UNEXPECTED:
+                        /* Got a frame that can't be reassembled yet.
+                         * Save it for later, and send SREJs to cover
+                         * the missing frames.
+                         */
+                        skb_queue_tail(&chan->srej_q, skb);
+                        skb_in_use = 1;
+                        BT_DBG("Queued %p (queue len %d)", skb,
+                               skb_queue_len(&chan->srej_q));
+
+                        l2cap_pass_to_tx(chan, control);
+                        l2cap_send_srej(chan, control->txseq);
+                        break;
+                case L2CAP_TXSEQ_UNEXPECTED_SREJ:
+                        /* This frame was requested with an SREJ, but
+                         * some expected retransmitted frames are
+                         * missing.  Request retransmission of missing
+                         * SREJ'd frames.
+                         */
+                        skb_queue_tail(&chan->srej_q, skb);
+                        skb_in_use = 1;
+                        BT_DBG("Queued %p (queue len %d)", skb,
+                               skb_queue_len(&chan->srej_q));
+
+                        l2cap_pass_to_tx(chan, control);
+                        l2cap_send_srej_list(chan, control->txseq);
+                        break;
+                case L2CAP_TXSEQ_DUPLICATE_SREJ:
+                        /* We've already queued this frame.  Drop this copy. */
+                        l2cap_pass_to_tx(chan, control);
+                        break;
+                case L2CAP_TXSEQ_DUPLICATE:
+                        /* Expecting a later sequence number, so this frame
+                         * was already received.  Ignore it completely.
+                         */
+                        break;
+                case L2CAP_TXSEQ_INVALID_IGNORE:
+                        break;
+                case L2CAP_TXSEQ_INVALID:
+                default:
+                        l2cap_send_disconn_req(chan->conn, chan,
+                                               ECONNRESET);
+                        break;
+                }
+                break;
+        case L2CAP_EV_RECV_RR:
+                l2cap_pass_to_tx(chan, control);
+                if (control->final) {
+                        clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
 
-static inline void l2cap_data_channel_rrframe(struct l2cap_chan *chan, u32 rx_control)
-{
-        BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan,
-                                __get_reqseq(chan, rx_control), rx_control);
+                        if (!test_and_clear_bit(CONN_REJ_ACT,
+                                                &chan->conn_state)) {
+                                control->final = 0;
+                                l2cap_retransmit_all(chan, control);
+                        }
 
-        chan->expected_ack_seq = __get_reqseq(chan, rx_control);
-        l2cap_drop_acked_frames(chan);
+                        l2cap_ertm_send(chan);
+                } else if (control->poll) {
+                        if (test_and_clear_bit(CONN_REMOTE_BUSY,
+                                               &chan->conn_state) &&
+                            chan->unacked_frames) {
+                                __set_retrans_timer(chan);
+                        }
 
-        if (__is_ctrl_poll(chan, rx_control)) {
-                set_bit(CONN_SEND_FBIT, &chan->conn_state);
-                if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
-                        if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
-                                        (chan->unacked_frames > 0))
+                        set_bit(CONN_SEND_FBIT, &chan->conn_state);
+                        l2cap_send_srej_tail(chan);
+                } else {
+                        if (test_and_clear_bit(CONN_REMOTE_BUSY,
+                                               &chan->conn_state) &&
+                            chan->unacked_frames)
                                 __set_retrans_timer(chan);
 
-                        clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
-                        l2cap_send_srejtail(chan);
+                        l2cap_send_ack(chan);
+                }
+                break;
+        case L2CAP_EV_RECV_RNR:
+                set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
+                l2cap_pass_to_tx(chan, control);
+                if (control->poll) {
+                        l2cap_send_srej_tail(chan);
                 } else {
-                        l2cap_send_i_or_rr_or_rnr(chan);
+                        struct l2cap_ctrl rr_control;
+                        memset(&rr_control, 0, sizeof(rr_control));
+                        rr_control.sframe = 1;
+                        rr_control.super = L2CAP_SUPER_RR;
+                        rr_control.reqseq = chan->buffer_seq;
+                        l2cap_send_sframe(chan, &rr_control);
                 }
 
-        } else if (__is_ctrl_final(chan, rx_control)) {
-                clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
-
-                if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
-                        l2cap_retransmit_frames(chan);
-
-        } else {
-                if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
-                                (chan->unacked_frames > 0))
-                        __set_retrans_timer(chan);
+                break;
+        case L2CAP_EV_RECV_REJ:
+                l2cap_handle_rej(chan, control);
+                break;
+        case L2CAP_EV_RECV_SREJ:
+                l2cap_handle_srej(chan, control);
+                break;
+        }
 
-                clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
-                if (test_bit(CONN_SREJ_SENT, &chan->conn_state))
-                        l2cap_send_ack(chan);
-                else
-                        l2cap_ertm_send(chan);
+        if (skb && !skb_in_use) {
+                BT_DBG("Freeing %p", skb);
+                kfree_skb(skb);
         }
+
+        return err;
 }
 
-static inline void l2cap_data_channel_rejframe(struct l2cap_chan *chan, u32 rx_control)
+static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)
 {
-        u16 tx_seq = __get_reqseq(chan, rx_control);
-
-        BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
-
-        clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
-
-        chan->expected_ack_seq = tx_seq;
-        l2cap_drop_acked_frames(chan);
-
-        if (__is_ctrl_final(chan, rx_control)) {
-                if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
-                        l2cap_retransmit_frames(chan);
-        } else {
-                l2cap_retransmit_frames(chan);
+        /* Make sure reqseq is for a packet that has been sent but not acked */
+        u16 unacked;
 
-                if (test_bit(CONN_WAIT_F, &chan->conn_state))
-                        set_bit(CONN_REJ_ACT, &chan->conn_state);
-        }
+        unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);
+        return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;
 }
-static inline void l2cap_data_channel_srejframe(struct l2cap_chan *chan, u32 rx_control)
-{
-        u16 tx_seq = __get_reqseq(chan, rx_control);
-
-        BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
-
-        clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
 
-        if (__is_ctrl_poll(chan, rx_control)) {
-                chan->expected_ack_seq = tx_seq;
-                l2cap_drop_acked_frames(chan);
-
-                set_bit(CONN_SEND_FBIT, &chan->conn_state);
-                l2cap_retransmit_one_frame(chan, tx_seq);
+static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
+                    struct sk_buff *skb, u8 event)
+{
+        int err = 0;
 
-                l2cap_ertm_send(chan);
+        BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,
+               control, skb, event, chan->rx_state);
 
-                if (test_bit(CONN_WAIT_F, &chan->conn_state)) {
-                        chan->srej_save_reqseq = tx_seq;
-                        set_bit(CONN_SREJ_ACT, &chan->conn_state);
+        if (__valid_reqseq(chan, control->reqseq)) {
+                switch (chan->rx_state) {
+                case L2CAP_RX_STATE_RECV:
+                        err = l2cap_rx_state_recv(chan, control, skb, event);
+                        break;
+                case L2CAP_RX_STATE_SREJ_SENT:
+                        err = l2cap_rx_state_srej_sent(chan, control, skb,
+                                                       event);
+                        break;
+                default:
+                        /* shut it down */
+                        break;
                 }
-        } else if (__is_ctrl_final(chan, rx_control)) {
-                if (test_bit(CONN_SREJ_ACT, &chan->conn_state) &&
-                                chan->srej_save_reqseq == tx_seq)
-                        clear_bit(CONN_SREJ_ACT, &chan->conn_state);
-                else
-                        l2cap_retransmit_one_frame(chan, tx_seq);
         } else {
-                l2cap_retransmit_one_frame(chan, tx_seq);
-                if (test_bit(CONN_WAIT_F, &chan->conn_state)) {
-                        chan->srej_save_reqseq = tx_seq;
-                        set_bit(CONN_SREJ_ACT, &chan->conn_state);
-                }
+                BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d",
+                       control->reqseq, chan->next_tx_seq,
+                       chan->expected_ack_seq);
+                l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
         }
+
+        return err;
 }
 
-static inline void l2cap_data_channel_rnrframe(struct l2cap_chan *chan, u32 rx_control)
+static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
+                           struct sk_buff *skb)
 {
-        u16 tx_seq = __get_reqseq(chan, rx_control);
+        int err = 0;
 
-        BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
+        BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,
+               chan->rx_state);
 
-        set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
-        chan->expected_ack_seq = tx_seq;
-        l2cap_drop_acked_frames(chan);
+        if (l2cap_classify_txseq(chan, control->txseq) ==
+            L2CAP_TXSEQ_EXPECTED) {
+                l2cap_pass_to_tx(chan, control);
 
-        if (__is_ctrl_poll(chan, rx_control))
-                set_bit(CONN_SEND_FBIT, &chan->conn_state);
+                BT_DBG("buffer_seq %d->%d", chan->buffer_seq,
+                       __next_seq(chan, chan->buffer_seq));
 
-        if (!test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
-                __clear_retrans_timer(chan);
-                if (__is_ctrl_poll(chan, rx_control))
-                        l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_FINAL);
-                return;
-        }
+                chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
 
-        if (__is_ctrl_poll(chan, rx_control)) {
-                l2cap_send_srejtail(chan);
+                l2cap_reassemble_sdu(chan, skb, control);
         } else {
-                rx_control = __set_ctrl_super(chan, L2CAP_SUPER_RR);
-                l2cap_send_sframe(chan, rx_control);
-        }
-}
-
-static inline int l2cap_data_channel_sframe(struct l2cap_chan *chan, u32 rx_control, struct sk_buff *skb)
-{
-        BT_DBG("chan %p rx_control 0x%8.8x len %d", chan, rx_control, skb->len);
+                if (chan->sdu) {
+                        kfree_skb(chan->sdu);
+                        chan->sdu = NULL;
+                }
+                chan->sdu_last_frag = NULL;
+                chan->sdu_len = 0;
 
-        if (__is_ctrl_final(chan, rx_control) &&
-                        test_bit(CONN_WAIT_F, &chan->conn_state)) {
-                __clear_monitor_timer(chan);
-                if (chan->unacked_frames > 0)
-                        __set_retrans_timer(chan);
-                clear_bit(CONN_WAIT_F, &chan->conn_state);
+                if (skb) {
+                        BT_DBG("Freeing %p", skb);
+                        kfree_skb(skb);
+                }
         }
 
-        switch (__get_ctrl_super(chan, rx_control)) {
-        case L2CAP_SUPER_RR:
-                l2cap_data_channel_rrframe(chan, rx_control);
-                break;
+        chan->last_acked_seq = control->txseq;
+        chan->expected_tx_seq = __next_seq(chan, control->txseq);
 
-        case L2CAP_SUPER_REJ:
-                l2cap_data_channel_rejframe(chan, rx_control);
-                break;
-
-        case L2CAP_SUPER_SREJ:
-                l2cap_data_channel_srejframe(chan, rx_control);
-                break;
-
-        case L2CAP_SUPER_RNR:
-                l2cap_data_channel_rnrframe(chan, rx_control);
-                break;
-        }
-
-        kfree_skb(skb);
-        return 0;
+        return err;
 }
 
-static int l2cap_ertm_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
+static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
 {
-        u32 control;
-        u16 req_seq;
-        int len, next_tx_seq_offset, req_seq_offset;
+        struct l2cap_ctrl *control = &bt_cb(skb)->control;
+        u16 len;
+        u8 event;
 
         __unpack_control(chan, skb);
 
-        control = __get_control(chan, skb->data);
-        skb_pull(skb, __ctrl_size(chan));
         len = skb->len;
 
         /*
          * We can just drop the corrupted I-frame here.
          * Receiver will miss it and start proper recovery
-         * procedures and ask retransmission.
+         * procedures and ask for retransmission.
          */
         if (l2cap_check_fcs(chan, skb))
                 goto drop;
 
-        if (__is_sar_start(chan, control) && !__is_sframe(chan, control))
+        if (!control->sframe && control->sar == L2CAP_SAR_START)
                 len -= L2CAP_SDULEN_SIZE;
 
         if (chan->fcs == L2CAP_FCS_CRC16)
@@ -4583,34 +5069,57 @@ static int l2cap_ertm_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
                 goto drop;
         }
 
-        req_seq = __get_reqseq(chan, control);
-
-        req_seq_offset = __seq_offset(chan, req_seq, chan->expected_ack_seq);
-
-        next_tx_seq_offset = __seq_offset(chan, chan->next_tx_seq,
-                                                chan->expected_ack_seq);
+        if (!control->sframe) {
+                int err;
 
-        /* check for invalid req-seq */
-        if (req_seq_offset > next_tx_seq_offset) {
-                l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
-                goto drop;
-        }
+                BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d",
+                       control->sar, control->reqseq, control->final,
+                       control->txseq);
 
-        if (!__is_sframe(chan, control)) {
-                if (len < 0) {
-                        l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
+                /* Validate F-bit - F=0 always valid, F=1 only
+                 * valid in TX WAIT_F
+                 */
+                if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)
                         goto drop;
+
+                if (chan->mode != L2CAP_MODE_STREAMING) {
+                        event = L2CAP_EV_RECV_IFRAME;
+                        err = l2cap_rx(chan, control, skb, event);
+                } else {
+                        err = l2cap_stream_rx(chan, control, skb);
                 }
 
-                l2cap_data_channel_iframe(chan, control, skb);
+                if (err)
+                        l2cap_send_disconn_req(chan->conn, chan,
+                                               ECONNRESET);
         } else {
+                const u8 rx_func_to_event[4] = {
+                        L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ,
+                        L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ
+                };
+
+                /* Only I-frames are expected in streaming mode */
+                if (chan->mode == L2CAP_MODE_STREAMING)
+                        goto drop;
+
+                BT_DBG("sframe reqseq %d, final %d, poll %d, super %d",
+                       control->reqseq, control->final, control->poll,
+                       control->super);
+
                 if (len != 0) {
                         BT_ERR("%d", len);
                         l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
                         goto drop;
                 }
 
-                l2cap_data_channel_sframe(chan, control, skb);
+                /* Validate F and P bits */
+                if (control->final && (control->poll ||
+                                       chan->tx_state != L2CAP_TX_STATE_WAIT_F))
+                        goto drop;
+
+                event = rx_func_to_event[control->super];
+                if (l2cap_rx(chan, control, skb, event))
+                        l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
         }
 
         return 0;
@@ -4620,19 +5129,27 @@ drop:
         return 0;
 }
 
-static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb)
+static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,
+                               struct sk_buff *skb)
 {
         struct l2cap_chan *chan;
-        u32 control;
-        u16 tx_seq;
-        int len;
 
         chan = l2cap_get_chan_by_scid(conn, cid);
         if (!chan) {
-                BT_DBG("unknown cid 0x%4.4x", cid);
-                /* Drop packet and return */
-                kfree_skb(skb);
-                return 0;
+                if (cid == L2CAP_CID_A2MP) {
+                        chan = a2mp_channel_create(conn, skb);
+                        if (!chan) {
+                                kfree_skb(skb);
+                                return;
+                        }
+
+                        l2cap_chan_lock(chan);
+                } else {
+                        BT_DBG("unknown cid 0x%4.4x", cid);
+                        /* Drop packet and return */
+                        kfree_skb(skb);
+                        return;
+                }
         }
 
         BT_DBG("chan %p, len %d", chan, skb->len);
@@ -4650,49 +5167,13 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
                 if (chan->imtu < skb->len)
                         goto drop;
 
-                if (!chan->ops->recv(chan->data, skb))
+                if (!chan->ops->recv(chan, skb))
                         goto done;
                 break;
 
         case L2CAP_MODE_ERTM:
-                l2cap_ertm_data_rcv(chan, skb);
-
-                goto done;
-
         case L2CAP_MODE_STREAMING:
-                control = __get_control(chan, skb->data);
-                skb_pull(skb, __ctrl_size(chan));
-                len = skb->len;
-
-                if (l2cap_check_fcs(chan, skb))
-                        goto drop;
-
-                if (__is_sar_start(chan, control))
-                        len -= L2CAP_SDULEN_SIZE;
-
-                if (chan->fcs == L2CAP_FCS_CRC16)
-                        len -= L2CAP_FCS_SIZE;
-
-                if (len > chan->mps || len < 0 || __is_sframe(chan, control))
-                        goto drop;
-
-                tx_seq = __get_txseq(chan, control);
-
-                if (chan->expected_tx_seq != tx_seq) {
-                        /* Frame(s) missing - must discard partial SDU */
-                        kfree_skb(chan->sdu);
-                        chan->sdu = NULL;
-                        chan->sdu_last_frag = NULL;
-                        chan->sdu_len = 0;
-
-                        /* TODO: Notify userland of missing data */
-                }
-
-                chan->expected_tx_seq = __next_seq(chan, tx_seq);
-
-                if (l2cap_reassemble_sdu(chan, skb, control) == -EMSGSIZE)
-                        l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
-
+                l2cap_data_rcv(chan, skb);
                 goto done;
 
         default:
@@ -4705,11 +5186,10 @@ drop:
 
 done:
         l2cap_chan_unlock(chan);
-
-        return 0;
 }
 
-static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb)
+static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm,
+                                  struct sk_buff *skb)
 {
         struct l2cap_chan *chan;
 
@@ -4725,17 +5205,15 @@ static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, str
         if (chan->imtu < skb->len)
                 goto drop;
 
-        if (!chan->ops->recv(chan->data, skb))
-                return 0;
+        if (!chan->ops->recv(chan, skb))
+                return;
 
 drop:
         kfree_skb(skb);
-
-        return 0;
 }
 
-static inline int l2cap_att_channel(struct l2cap_conn *conn, u16 cid,
-                                    struct sk_buff *skb)
+static void l2cap_att_channel(struct l2cap_conn *conn, u16 cid,
+                              struct sk_buff *skb)
 {
         struct l2cap_chan *chan;
 
@@ -4751,13 +5229,11 @@ static inline int l2cap_att_channel(struct l2cap_conn *conn, u16 cid,
         if (chan->imtu < skb->len)
                 goto drop;
 
-        if (!chan->ops->recv(chan->data, skb))
-                return 0;
+        if (!chan->ops->recv(chan, skb))
+                return;
 
 drop:
         kfree_skb(skb);
-
-        return 0;
 }
 
 static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
@@ -4785,7 +5261,7 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
 
         case L2CAP_CID_CONN_LESS:
                 psm = get_unaligned((__le16 *) skb->data);
-                skb_pull(skb, 2);
+                skb_pull(skb, L2CAP_PSMLEN_SIZE);
                 l2cap_conless_channel(conn, psm, skb);
                 break;
 
@@ -4979,6 +5455,17 @@ int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                         rsp.status = cpu_to_le16(stat);
                         l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
                                                         sizeof(rsp), &rsp);
+
+                        if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&
+                            res == L2CAP_CR_SUCCESS) {
+                                char buf[128];
+                                set_bit(CONF_REQ_SENT, &chan->conf_state);
+                                l2cap_send_cmd(conn, l2cap_get_ident(conn),
+                                               L2CAP_CONF_REQ,
+                                               l2cap_build_conf_req(chan, buf),
+                                               buf);
+                                chan->num_conf_req++;
+                        }
                 }
 
                 l2cap_chan_unlock(chan);
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 3bb1611b9d48..a4bb27e8427e 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -27,7 +27,6 @@
 
 /* Bluetooth L2CAP sockets. */
 
-#include <linux/security.h>
 #include <linux/export.h>
 
 #include <net/bluetooth/bluetooth.h>
@@ -89,8 +88,8 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
         if (err < 0)
                 goto done;
 
-        if (__le16_to_cpu(la.l2_psm) == 0x0001 ||
-                                __le16_to_cpu(la.l2_psm) == 0x0003)
+        if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
+            __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
                 chan->sec_level = BT_SECURITY_SDP;
 
         bacpy(&bt_sk(sk)->src, &la.l2_bdaddr);
@@ -446,6 +445,22 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, ch
         return err;
 }
 
+static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
+{
+        switch (chan->scid) {
+        case L2CAP_CID_LE_DATA:
+                if (mtu < L2CAP_LE_MIN_MTU)
+                        return false;
+                break;
+
+        default:
+                if (mtu < L2CAP_DEFAULT_MIN_MTU)
+                        return false;
+        }
+
+        return true;
+}
+
 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
 {
         struct sock *sk = sock->sk;
@@ -484,6 +499,11 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __us
                         break;
                 }
 
+                if (!l2cap_valid_mtu(chan, opts.imtu)) {
+                        err = -EINVAL;
+                        break;
+                }
+
                 chan->mode = opts.mode;
                 switch (chan->mode) {
                 case L2CAP_MODE_BASIC:
@@ -873,9 +893,34 @@ static int l2cap_sock_release(struct socket *sock)
         return err;
 }
 
-static struct l2cap_chan *l2cap_sock_new_connection_cb(void *data)
+static void l2cap_sock_cleanup_listen(struct sock *parent)
 {
-        struct sock *sk, *parent = data;
+        struct sock *sk;
+
+        BT_DBG("parent %p", parent);
+
+        /* Close not yet accepted channels */
+        while ((sk = bt_accept_dequeue(parent, NULL))) {
+                struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+
+                l2cap_chan_lock(chan);
+                __clear_chan_timer(chan);
+                l2cap_chan_close(chan, ECONNRESET);
+                l2cap_chan_unlock(chan);
+
+                l2cap_sock_kill(sk);
+        }
+}
+
+static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
+{
+        struct sock *sk, *parent = chan->data;
+
+        /* Check for backlog size */
+        if (sk_acceptq_is_full(parent)) {
+                BT_DBG("backlog full %d", parent->sk_ack_backlog);
+                return NULL;
+        }
 
         sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
                                                                 GFP_ATOMIC);
@@ -889,10 +934,10 @@ static struct l2cap_chan *l2cap_sock_new_connection_cb(void *data)
         return l2cap_pi(sk)->chan;
 }
 
-static int l2cap_sock_recv_cb(void *data, struct sk_buff *skb)
+static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
 {
         int err;
-        struct sock *sk = data;
+        struct sock *sk = chan->data;
         struct l2cap_pinfo *pi = l2cap_pi(sk);
 
         lock_sock(sk);
@@ -925,16 +970,57 @@ done:
         return err;
 }
 
-static void l2cap_sock_close_cb(void *data)
+static void l2cap_sock_close_cb(struct l2cap_chan *chan)
 {
-        struct sock *sk = data;
+        struct sock *sk = chan->data;
 
         l2cap_sock_kill(sk);
 }
 
-static void l2cap_sock_state_change_cb(void *data, int state)
+static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
 {
-        struct sock *sk = data;
+        struct sock *sk = chan->data;
+        struct sock *parent;
+
+        lock_sock(sk);
+
+        parent = bt_sk(sk)->parent;
+
+        sock_set_flag(sk, SOCK_ZAPPED);
+
+        switch (chan->state) {
+        case BT_OPEN:
+        case BT_BOUND:
+        case BT_CLOSED:
+                break;
+        case BT_LISTEN:
+                l2cap_sock_cleanup_listen(sk);
+                sk->sk_state = BT_CLOSED;
+                chan->state = BT_CLOSED;
+
+                break;
+        default:
+                sk->sk_state = BT_CLOSED;
+                chan->state = BT_CLOSED;
+
+                sk->sk_err = err;
+
+                if (parent) {
+                        bt_accept_unlink(sk);
+                        parent->sk_data_ready(parent, 0);
+                } else {
+                        sk->sk_state_change(sk);
+                }
+
+                break;
+        }
+
+        release_sock(sk);
+}
+
+static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state)
+{
+        struct sock *sk = chan->data;
 
         sk->sk_state = state;
 }
@@ -955,12 +1041,34 @@ static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
         return skb;
 }
 
+static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
+{
+        struct sock *sk = chan->data;
+        struct sock *parent;
+
+        lock_sock(sk);
+
+        parent = bt_sk(sk)->parent;
+
+        BT_DBG("sk %p, parent %p", sk, parent);
+
+        sk->sk_state = BT_CONNECTED;
+        sk->sk_state_change(sk);
+
+        if (parent)
+                parent->sk_data_ready(parent, 0);
+
+        release_sock(sk);
+}
+
 static struct l2cap_ops l2cap_chan_ops = {
         .name           = "L2CAP Socket Interface",
         .new_connection = l2cap_sock_new_connection_cb,
         .recv           = l2cap_sock_recv_cb,
         .close          = l2cap_sock_close_cb,
+        .teardown       = l2cap_sock_teardown_cb,
         .state_change   = l2cap_sock_state_change_cb,
+        .ready          = l2cap_sock_ready_cb,
         .alloc_skb      = l2cap_sock_alloc_skb_cb,
 };
 
diff --git a/net/bluetooth/lib.c b/net/bluetooth/lib.c
index 506628876f36..e1c97527e16c 100644
--- a/net/bluetooth/lib.c
+++ b/net/bluetooth/lib.c
@@ -26,12 +26,7 @@
 
 #define pr_fmt(fmt) "Bluetooth: " fmt
 
-#include <linux/module.h>
-
-#include <linux/kernel.h>
-#include <linux/stddef.h>
-#include <linux/string.h>
-#include <asm/errno.h>
+#include <linux/export.h>
 
 #include <net/bluetooth/bluetooth.h>
 
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 991d5b667674..c72307cc25fc 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -24,8 +24,6 @@
 
 /* Bluetooth HCI Management interface */
 
-#include <linux/kernel.h>
-#include <linux/uaccess.h>
 #include <linux/module.h>
 #include <asm/unaligned.h>
 
@@ -714,7 +712,8 @@ static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
 }
 
 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
-                                 void (*cb)(struct pending_cmd *cmd, void *data),
+                                 void (*cb)(struct pending_cmd *cmd,
+                                            void *data),
                                  void *data)
 {
         struct list_head *p, *n;
@@ -871,7 +870,7 @@ static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
         }
 
         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
-                        mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
+            mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
                                  MGMT_STATUS_BUSY);
                 goto failed;
@@ -978,7 +977,7 @@ static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
         }
 
         if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
-                        mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
+            mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
                 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
                                  MGMT_STATUS_BUSY);
                 goto failed;
@@ -1001,7 +1000,7 @@ static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
                 scan = 0;
 
                 if (test_bit(HCI_ISCAN, &hdev->flags) &&
-                                                hdev->discov_timeout > 0)
+                    hdev->discov_timeout > 0)
                         cancel_delayed_work(&hdev->discov_off);
         }
 
@@ -1056,7 +1055,7 @@ static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
                 bool changed = false;
 
                 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
-                                                        &hdev->dev_flags)) {
+                                          &hdev->dev_flags)) {
                         change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
                         changed = true;
                 }
@@ -1317,7 +1316,7 @@ static bool enable_service_cache(struct hci_dev *hdev)
 }
 
 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
-                                                                u16 len)
+                       u16 len)
 {
         struct mgmt_cp_remove_uuid *cp = data;
         struct pending_cmd *cmd;
@@ -1442,7 +1441,7 @@ unlock:
 }
 
 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
-                                                                u16 len)
+                          u16 len)
 {
         struct mgmt_cp_load_link_keys *cp = data;
         u16 key_count, expected_len;
@@ -1454,13 +1453,13 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
                                         sizeof(struct mgmt_link_key_info);
         if (expected_len != len) {
                 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
-                                                        len, expected_len);
+                       len, expected_len);
                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
                                   MGMT_STATUS_INVALID_PARAMS);
         }
 
         BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
-                                                                key_count);
+               key_count);
 
         hci_dev_lock(hdev);
 
@@ -1535,10 +1534,10 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
         if (cp->disconnect) {
                 if (cp->addr.type == BDADDR_BREDR)
                         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
-                                                        &cp->addr.bdaddr);
+                                                       &cp->addr.bdaddr);
                 else
                         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
-                                                        &cp->addr.bdaddr);
+                                                       &cp->addr.bdaddr);
         } else {
                 conn = NULL;
         }
@@ -1594,7 +1593,8 @@ static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
         }
 
         if (cp->addr.type == BDADDR_BREDR)
-                conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
+                conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
+                                               &cp->addr.bdaddr);
         else
                 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
 
@@ -1813,7 +1813,7 @@ static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
         hdev->io_capability = cp->io_capability;
 
         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
-                                                        hdev->io_capability);
+               hdev->io_capability);
 
         hci_dev_unlock(hdev);
 
@@ -1821,7 +1821,7 @@ static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
                             0);
 }
 
-static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
+static struct pending_cmd *find_pairing(struct hci_conn *conn)
 {
         struct hci_dev *hdev = conn->hdev;
         struct pending_cmd *cmd;
@@ -1927,8 +1927,15 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
         rp.addr.type = cp->addr.type;
 
         if (IS_ERR(conn)) {
+                int status;
+
+                if (PTR_ERR(conn) == -EBUSY)
+                        status = MGMT_STATUS_BUSY;
+                else
+                        status = MGMT_STATUS_CONNECT_FAILED;
+
                 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
-                                   MGMT_STATUS_CONNECT_FAILED, &rp,
+                                   status, &rp,
                                    sizeof(rp));
                 goto unlock;
         }
@@ -1959,7 +1966,7 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
         cmd->user_data = conn;
 
         if (conn->state == BT_CONNECTED &&
-                                hci_conn_security(conn, sec_level, auth_type))
+            hci_conn_security(conn, sec_level, auth_type))
                 pairing_complete(cmd, 0);
 
         err = 0;
@@ -2256,7 +2263,7 @@ unlock:
 }
 
 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
-                                                void *data, u16 len)
+                                  void *data, u16 len)
 {
         struct mgmt_cp_remove_remote_oob_data *cp = data;
         u8 status;
@@ -2425,7 +2432,7 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
 
         case DISCOVERY_RESOLVING:
                 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
-                                                        NAME_PENDING);
+                                                     NAME_PENDING);
                 if (!e) {
                         mgmt_pending_remove(cmd);
                         err = cmd_complete(sk, hdev->id,
@@ -2647,7 +2654,7 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
                                         sizeof(struct mgmt_ltk_info);
         if (expected_len != len) {
                 BT_ERR("load_keys: expected %u bytes, got %u bytes",
-                                                        len, expected_len);
+                       len, expected_len);
                 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
                                   EINVAL);
         }
@@ -2772,7 +2779,7 @@ int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
         }
 
         if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
-                                        mgmt_handlers[opcode].func == NULL) {
+            mgmt_handlers[opcode].func == NULL) {
                 BT_DBG("Unknown op %u", opcode);
                 err = cmd_status(sk, index, opcode,
                                  MGMT_STATUS_UNKNOWN_COMMAND);
@@ -2780,7 +2787,7 @@ int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
         }
 
         if ((hdev && opcode < MGMT_OP_READ_INFO) ||
-                        (!hdev && opcode >= MGMT_OP_READ_INFO)) {
+            (!hdev && opcode >= MGMT_OP_READ_INFO)) {
                 err = cmd_status(sk, index, opcode,
                                  MGMT_STATUS_INVALID_INDEX);
                 goto done;
@@ -2789,7 +2796,7 @@ int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
         handler = &mgmt_handlers[opcode];
 
         if ((handler->var_len && len < handler->data_len) ||
-                        (!handler->var_len && len != handler->data_len)) {
+            (!handler->var_len && len != handler->data_len)) {
                 err = cmd_status(sk, index, opcode,
                                  MGMT_STATUS_INVALID_PARAMS);
                 goto done;
@@ -2973,7 +2980,7 @@ int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
         ev.key.addr.type = BDADDR_BREDR;
         ev.key.type = key->type;
-        memcpy(ev.key.val, key->val, 16);
+        memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
         ev.key.pin_len = key->pin_len;
 
         return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
@@ -3108,7 +3115,7 @@ int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
         mgmt_pending_remove(cmd);
 
         mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
-                                                                        hdev);
+                             hdev);
         return err;
 }
 
@@ -3198,7 +3205,7 @@ int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
 }
 
 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                                u8 link_type, u8 addr_type)
+                              u8 link_type, u8 addr_type)
 {
         struct mgmt_ev_user_passkey_request ev;
 
@@ -3212,8 +3219,8 @@ int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
 }
 
 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                        u8 link_type, u8 addr_type, u8 status,
-                                        u8 opcode)
+                                      u8 link_type, u8 addr_type, u8 status,
+                                      u8 opcode)
 {
         struct pending_cmd *cmd;
         struct mgmt_rp_user_confirm_reply rp;
@@ -3244,7 +3251,8 @@ int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
                                          u8 link_type, u8 addr_type, u8 status)
 {
         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
-                                          status, MGMT_OP_USER_CONFIRM_NEG_REPLY);
+                                          status,
+                                          MGMT_OP_USER_CONFIRM_NEG_REPLY);
 }
 
 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
@@ -3258,7 +3266,8 @@ int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
                                          u8 link_type, u8 addr_type, u8 status)
 {
         return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
-                                          status, MGMT_OP_USER_PASSKEY_NEG_REPLY);
+                                          status,
+                                          MGMT_OP_USER_PASSKEY_NEG_REPLY);
 }
 
 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 8a602388f1e7..c75107ef8920 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -26,22 +26,8 @@
  */
 
 #include <linux/module.h>
-#include <linux/errno.h>
-#include <linux/kernel.h>
-#include <linux/sched.h>
-#include <linux/signal.h>
-#include <linux/init.h>
-#include <linux/wait.h>
-#include <linux/device.h>
 #include <linux/debugfs.h>
-#include <linux/seq_file.h>
-#include <linux/net.h>
-#include <linux/mutex.h>
 #include <linux/kthread.h>
-#include <linux/slab.h>
-
-#include <net/sock.h>
-#include <linux/uaccess.h>
 #include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
@@ -115,14 +101,14 @@ static void rfcomm_session_del(struct rfcomm_session *s);
 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
 #define __get_rpn_parity(line)    (((line) >> 3) & 0x7)
 
-static inline void rfcomm_schedule(void)
+static void rfcomm_schedule(void)
 {
         if (!rfcomm_thread)
                 return;
         wake_up_process(rfcomm_thread);
 }
 
-static inline void rfcomm_session_put(struct rfcomm_session *s)
+static void rfcomm_session_put(struct rfcomm_session *s)
 {
         if (atomic_dec_and_test(&s->refcnt))
                 rfcomm_session_del(s);
@@ -227,7 +213,7 @@ static int rfcomm_l2sock_create(struct socket **sock)
         return err;
 }
 
-static inline int rfcomm_check_security(struct rfcomm_dlc *d)
+static int rfcomm_check_security(struct rfcomm_dlc *d)
 {
         struct sock *sk = d->session->sock->sk;
         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
@@ -1750,7 +1736,7 @@ static void rfcomm_process_connect(struct rfcomm_session *s)
 /* Send data queued for the DLC.
  * Return number of frames left in the queue.
  */
-static inline int rfcomm_process_tx(struct rfcomm_dlc *d)
+static int rfcomm_process_tx(struct rfcomm_dlc *d)
 {
         struct sk_buff *skb;
         int err;
@@ -1798,7 +1784,7 @@ static inline int rfcomm_process_tx(struct rfcomm_dlc *d)
         return skb_queue_len(&d->tx_queue);
 }
 
-static inline void rfcomm_process_dlcs(struct rfcomm_session *s)
+static void rfcomm_process_dlcs(struct rfcomm_session *s)
 {
         struct rfcomm_dlc *d;
         struct list_head *p, *n;
@@ -1858,7 +1844,7 @@ static inline void rfcomm_process_dlcs(struct rfcomm_session *s)
         }
 }
 
-static inline void rfcomm_process_rx(struct rfcomm_session *s)
+static void rfcomm_process_rx(struct rfcomm_session *s)
 {
         struct socket *sock = s->sock;
         struct sock *sk = sock->sk;
@@ -1883,7 +1869,7 @@ static inline void rfcomm_process_rx(struct rfcomm_session *s)
         }
 }
 
-static inline void rfcomm_accept_connection(struct rfcomm_session *s)
+static void rfcomm_accept_connection(struct rfcomm_session *s)
 {
         struct socket *sock = s->sock, *nsock;
         int err;
@@ -1917,7 +1903,7 @@ static inline void rfcomm_accept_connection(struct rfcomm_session *s)
                 sock_release(nsock);
 }
 
-static inline void rfcomm_check_connection(struct rfcomm_session *s)
+static void rfcomm_check_connection(struct rfcomm_session *s)
 {
         struct sock *sk = s->sock->sk;
 
@@ -1941,7 +1927,7 @@ static inline void rfcomm_check_connection(struct rfcomm_session *s)
         }
 }
 
-static inline void rfcomm_process_sessions(void)
+static void rfcomm_process_sessions(void)
 {
         struct list_head *p, *n;
 
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index e8707debb864..7e1e59645c05 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -25,27 +25,8 @@
  * RFCOMM sockets.
  */
 
-#include <linux/module.h>
-
-#include <linux/types.h>
-#include <linux/errno.h>
-#include <linux/kernel.h>
-#include <linux/sched.h>
-#include <linux/slab.h>
-#include <linux/poll.h>
-#include <linux/fcntl.h>
-#include <linux/init.h>
-#include <linux/interrupt.h>
-#include <linux/socket.h>
-#include <linux/skbuff.h>
-#include <linux/list.h>
-#include <linux/device.h>
+#include <linux/export.h>
 #include <linux/debugfs.h>
-#include <linux/seq_file.h>
-#include <linux/security.h>
-#include <net/sock.h>
-
-#include <linux/uaccess.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index d1820ff14aee..cb960773c002 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -31,11 +31,6 @@
 #include <linux/tty_driver.h>
 #include <linux/tty_flip.h>
 
-#include <linux/capability.h>
-#include <linux/slab.h>
-#include <linux/skbuff.h>
-#include <linux/workqueue.h>
-
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 #include <net/bluetooth/rfcomm.h>
@@ -132,7 +127,7 @@ static struct rfcomm_dev *__rfcomm_dev_get(int id)
         return NULL;
 }
 
-static inline struct rfcomm_dev *rfcomm_dev_get(int id)
+static struct rfcomm_dev *rfcomm_dev_get(int id)
 {
         struct rfcomm_dev *dev;
 
@@ -345,7 +340,7 @@ static void rfcomm_wfree(struct sk_buff *skb)
         tty_port_put(&dev->port);
 }
 
-static inline void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *dev)
+static void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *dev)
 {
         tty_port_get(&dev->port);
         atomic_add(skb->truesize, &dev->wmem_alloc);
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index cbdd313659a7..40bbe25dcff7 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -25,26 +25,8 @@
 /* Bluetooth SCO sockets. */
 
 #include <linux/module.h>
-
-#include <linux/types.h>
-#include <linux/errno.h>
-#include <linux/kernel.h>
-#include <linux/sched.h>
-#include <linux/slab.h>
-#include <linux/poll.h>
-#include <linux/fcntl.h>
-#include <linux/init.h>
-#include <linux/interrupt.h>
-#include <linux/socket.h>
-#include <linux/skbuff.h>
-#include <linux/device.h>
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
-#include <linux/list.h>
-#include <linux/security.h>
-#include <net/sock.h>
-
-#include <linux/uaccess.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
@@ -123,7 +105,7 @@ static struct sco_conn *sco_conn_add(struct hci_conn *hcon)
         return conn;
 }
 
-static inline struct sock *sco_chan_get(struct sco_conn *conn)
+static struct sock *sco_chan_get(struct sco_conn *conn)
 {
         struct sock *sk = NULL;
         sco_conn_lock(conn);
@@ -157,7 +139,8 @@ static int sco_conn_del(struct hci_conn *hcon, int err)
         return 0;
 }
 
-static inline int sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent)
+static int sco_chan_add(struct sco_conn *conn, struct sock *sk,
+                        struct sock *parent)
 {
         int err = 0;
 
@@ -228,7 +211,7 @@ done:
         return err;
 }
 
-static inline int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
+static int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
 {
         struct sco_conn *conn = sco_pi(sk)->conn;
         struct sk_buff *skb;
@@ -254,7 +237,7 @@ static inline int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
         return len;
 }
 
-static inline void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
+static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
 {
         struct sock *sk = sco_chan_get(conn);
 
@@ -523,7 +506,7 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen
                 goto done;
 
         err = bt_sock_wait_state(sk, BT_CONNECTED,
-                        sock_sndtimeo(sk, flags & O_NONBLOCK));
+                                 sock_sndtimeo(sk, flags & O_NONBLOCK));
 
 done:
         release_sock(sk);
@@ -788,7 +771,7 @@ static int sco_sock_shutdown(struct socket *sock, int how)
 
                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
                         err = bt_sock_wait_state(sk, BT_CLOSED,
-                                                        sk->sk_lingertime);
+                                                 sk->sk_lingertime);
         }
         release_sock(sk);
         return err;
@@ -878,7 +861,7 @@ static void sco_conn_ready(struct sco_conn *conn)
                 bh_lock_sock(parent);
 
                 sk = sco_sock_alloc(sock_net(parent), NULL,
-                                BTPROTO_SCO, GFP_ATOMIC);
+                                    BTPROTO_SCO, GFP_ATOMIC);
                 if (!sk) {
                         bh_unlock_sock(parent);
                         goto done;
@@ -907,7 +890,7 @@ done:
 /* ----- SCO interface with lower layer (HCI) ----- */
 int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
 {
-        register struct sock *sk;
+        struct sock *sk;
         struct hlist_node *node;
         int lm = 0;
 
@@ -920,7 +903,7 @@ int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
                         continue;
 
                 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr) ||
-                                !bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
+                    !bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
                         lm |= HCI_LM_ACCEPT;
                         break;
                 }
@@ -981,7 +964,7 @@ static int sco_debugfs_show(struct seq_file *f, void *p)
 
         sk_for_each(sk, node, &sco_sk_list.head) {
                 seq_printf(f, "%s %s %d\n", batostr(&bt_sk(sk)->src),
-                                batostr(&bt_sk(sk)->dst), sk->sk_state);
+                           batostr(&bt_sk(sk)->dst), sk->sk_state);
         }
 
         read_unlock(&sco_sk_list.lock);
@@ -1044,8 +1027,8 @@ int __init sco_init(void)
         }
 
         if (bt_debugfs) {
-                sco_debugfs = debugfs_create_file("sco", 0444,
-                                        bt_debugfs, NULL, &sco_debugfs_fops);
+                sco_debugfs = debugfs_create_file("sco", 0444, bt_debugfs,
+                                                  NULL, &sco_debugfs_fops);
                 if (!sco_debugfs)
                         BT_ERR("Failed to create SCO debug file");
         }
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 37df4e9b3896..16ef0dc85a0a 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -20,14 +20,15 @@
    SOFTWARE IS DISCLAIMED.
 */
 
+#include <linux/crypto.h>
+#include <linux/scatterlist.h>
+#include <crypto/b128ops.h>
+
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 #include <net/bluetooth/l2cap.h>
 #include <net/bluetooth/mgmt.h>
 #include <net/bluetooth/smp.h>
-#include <linux/crypto.h>
-#include <linux/scatterlist.h>
-#include <crypto/b128ops.h>
 
 #define SMP_TIMEOUT     msecs_to_jiffies(30000)
 
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index fdf9e61d0651..72607174ea5a 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -417,72 +417,6 @@ static struct attribute_group netstat_group = {
         .name  = "statistics",
         .attrs  = netstat_attrs,
 };
-
-#ifdef CONFIG_WIRELESS_EXT_SYSFS
-/* helper function that does all the locking etc for wireless stats */
-static ssize_t wireless_show(struct device *d, char *buf,
-                             ssize_t (*format)(const struct iw_statistics *,
-                                               char *))
-{
-        struct net_device *dev = to_net_dev(d);
-        const struct iw_statistics *iw;
-        ssize_t ret = -EINVAL;
-
-        if (!rtnl_trylock())
-                return restart_syscall();
-        if (dev_isalive(dev)) {
-                iw = get_wireless_stats(dev);
-                if (iw)
-                        ret = (*format)(iw, buf);
-        }
-        rtnl_unlock();
-
-        return ret;
-}
-
-/* show function template for wireless fields */
-#define WIRELESS_SHOW(name, field, format_string)                       \
-static ssize_t format_iw_##name(const struct iw_statistics *iw, char *buf) \
-{                                                                       \
-        return sprintf(buf, format_string, iw->field);                  \
-}                                                                       \
-static ssize_t show_iw_##name(struct device *d,                         \
-                              struct device_attribute *attr, char *buf) \
-{                                                                       \
-        return wireless_show(d, buf, format_iw_##name);                 \
-}                                                                       \
-static DEVICE_ATTR(name, S_IRUGO, show_iw_##name, NULL)
-
-WIRELESS_SHOW(status, status, fmt_hex);
-WIRELESS_SHOW(link, qual.qual, fmt_dec);
-WIRELESS_SHOW(level, qual.level, fmt_dec);
-WIRELESS_SHOW(noise, qual.noise, fmt_dec);
-WIRELESS_SHOW(nwid, discard.nwid, fmt_dec);
-WIRELESS_SHOW(crypt, discard.code, fmt_dec);
-WIRELESS_SHOW(fragment, discard.fragment, fmt_dec);
-WIRELESS_SHOW(misc, discard.misc, fmt_dec);
-WIRELESS_SHOW(retries, discard.retries, fmt_dec);
-WIRELESS_SHOW(beacon, miss.beacon, fmt_dec);
-
-static struct attribute *wireless_attrs[] = {
-        &dev_attr_status.attr,
-        &dev_attr_link.attr,
-        &dev_attr_level.attr,
-        &dev_attr_noise.attr,
-        &dev_attr_nwid.attr,
-        &dev_attr_crypt.attr,
-        &dev_attr_fragment.attr,
-        &dev_attr_retries.attr,
-        &dev_attr_misc.attr,
-        &dev_attr_beacon.attr,
-        NULL
-};
-
-static struct attribute_group wireless_group = {
-        .name = "wireless",
-        .attrs = wireless_attrs,
-};
-#endif
 #endif /* CONFIG_SYSFS */
 
 #ifdef CONFIG_RPS
@@ -1463,14 +1397,6 @@ int netdev_register_kobject(struct net_device *net)
                 groups++;
 
         *groups++ = &netstat_group;
-#ifdef CONFIG_WIRELESS_EXT_SYSFS
-        if (net->ieee80211_ptr)
-                *groups++ = &wireless_group;
-#ifdef CONFIG_WIRELESS_EXT
-        else if (net->wireless_handlers)
-                *groups++ = &wireless_group;
-#endif
-#endif
 #endif /* CONFIG_SYSFS */
 
         error = device_add(dev);
diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index 3e9d931bba35..2b1470bac178 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -9,7 +9,6 @@ mac80211-y := \
         scan.o offchannel.o \
         ht.o agg-tx.o agg-rx.o \
         ibss.o \
-        work.o \
         iface.o \
         rate.o \
         michael.o \
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index c649188314cc..32ef11d69798 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -74,18 +74,15 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
 
         RCU_INIT_POINTER(sta->ampdu_mlme.tid_rx[tid], NULL);
 
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG
-               "Rx BA session stop requested for %pM tid %u %s reason: %d\n",
-               sta->sta.addr, tid,
-               initiator == WLAN_BACK_RECIPIENT ? "recipient" : "inititator",
-               (int)reason);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
+        ht_vdbg("Rx BA session stop requested for %pM tid %u %s reason: %d\n",
+                sta->sta.addr, tid,
+                initiator == WLAN_BACK_RECIPIENT ? "recipient" : "inititator",
+                (int)reason);
 
         if (drv_ampdu_action(local, sta->sdata, IEEE80211_AMPDU_RX_STOP,
                              &sta->sta, tid, NULL, 0))
-                printk(KERN_DEBUG "HW problem - can not stop rx "
-                                "aggregation for tid %d\n", tid);
+                pr_debug("HW problem - can not stop rx aggregation for tid %d\n",
+                         tid);
 
         /* check if this is a self generated aggregation halt */
         if (initiator == WLAN_BACK_RECIPIENT && tx)
@@ -160,9 +157,8 @@ static void sta_rx_agg_session_timer_expired(unsigned long data)
         }
         rcu_read_unlock();
 
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
-#endif
+        ht_vdbg("rx session timer expired on tid %d\n", (u16)*ptid);
+
         set_bit(*ptid, sta->ampdu_mlme.tid_rx_timer_expired);
         ieee80211_queue_work(&sta->local->hw, &sta->ampdu_mlme.work);
 }
@@ -249,10 +245,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
         status = WLAN_STATUS_REQUEST_DECLINED;
 
         if (test_sta_flag(sta, WLAN_STA_BLOCK_BA)) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Suspend in progress. "
-                       "Denying ADDBA request\n");
-#endif
+                ht_vdbg("Suspend in progress - Denying ADDBA request\n");
                 goto end_no_lock;
         }
 
@@ -324,10 +317,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
 
         ret = drv_ampdu_action(local, sta->sdata, IEEE80211_AMPDU_RX_START,
                                &sta->sta, tid, &start_seq_num, 0);
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Rx A-MPDU request on tid %d result %d\n", tid, ret);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
-
+        ht_vdbg("Rx A-MPDU request on tid %d result %d\n", tid, ret);
         if (ret) {
                 kfree(tid_agg_rx->reorder_buf);
                 kfree(tid_agg_rx->reorder_time);
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 7cf07158805c..da07f01cfe4d 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -184,10 +184,8 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
 
         spin_unlock_bh(&sta->lock);
 
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n",
-               sta->sta.addr, tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
+        ht_vdbg("Tx BA session stop requested for %pM tid %u\n",
+                sta->sta.addr, tid);
 
         del_timer_sync(&tid_tx->addba_resp_timer);
         del_timer_sync(&tid_tx->session_timer);
@@ -253,17 +251,12 @@ static void sta_addba_resp_timer_expired(unsigned long data)
         if (!tid_tx ||
             test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state)) {
                 rcu_read_unlock();
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "timer expired on tid %d but we are not "
-                                "(or no longer) expecting addBA response there\n",
+                ht_vdbg("timer expired on tid %d but we are not (or no longer) expecting addBA response there\n",
                         tid);
-#endif
                 return;
         }
 
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "addBA response timer expired on tid %d\n", tid);
-#endif
+        ht_vdbg("addBA response timer expired on tid %d\n", tid);
 
         ieee80211_stop_tx_ba_session(&sta->sta, tid);
         rcu_read_unlock();
@@ -372,10 +365,7 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
         ret = drv_ampdu_action(local, sdata, IEEE80211_AMPDU_TX_START,
                                &sta->sta, tid, &start_seq_num, 0);
         if (ret) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "BA request denied - HW unavailable for"
-                                        " tid %d\n", tid);
-#endif
+                ht_vdbg("BA request denied - HW unavailable for tid %d\n", tid);
                 spin_lock_bh(&sta->lock);
                 ieee80211_agg_splice_packets(sdata, tid_tx, tid);
                 ieee80211_assign_tid_tx(sta, tid, NULL);
@@ -388,9 +378,7 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
 
         /* activate the timer for the recipient's addBA response */
         mod_timer(&tid_tx->addba_resp_timer, jiffies + ADDBA_RESP_INTERVAL);
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "activated addBA response timer on tid %d\n", tid);
-#endif
+        ht_vdbg("activated addBA response timer on tid %d\n", tid);
 
         spin_lock_bh(&sta->lock);
         sta->ampdu_mlme.last_addba_req_time[tid] = jiffies;
@@ -437,9 +425,7 @@ static void sta_tx_agg_session_timer_expired(unsigned long data)
 
         rcu_read_unlock();
 
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "tx session timer expired on tid %d\n", (u16)*ptid);
-#endif
+        ht_vdbg("tx session timer expired on tid %d\n", (u16)*ptid);
 
         ieee80211_stop_tx_ba_session(&sta->sta, *ptid);
 }
@@ -463,10 +449,8 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
             (local->hw.flags & IEEE80211_HW_TX_AMPDU_SETUP_IN_HW))
                 return -EINVAL;
 
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Open BA session requested for %pM tid %u\n",
-               pubsta->addr, tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
+        ht_vdbg("Open BA session requested for %pM tid %u\n",
+                pubsta->addr, tid);
 
         if (sdata->vif.type != NL80211_IFTYPE_STATION &&
             sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
@@ -476,10 +460,7 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
                 return -EINVAL;
 
         if (test_sta_flag(sta, WLAN_STA_BLOCK_BA)) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "BA sessions blocked. "
-                       "Denying BA session request\n");
-#endif
+                ht_vdbg("BA sessions blocked - Denying BA session request\n");
                 return -EINVAL;
         }
 
@@ -497,10 +478,8 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
          */
         if (sta->sdata->vif.type == NL80211_IFTYPE_ADHOC &&
             !sta->sta.ht_cap.ht_supported) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "BA request denied - IBSS STA %pM"
-                       "does not advertise HT support\n", pubsta->addr);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
+                ht_vdbg("BA request denied - IBSS STA %pM does not advertise HT support\n",
+                        pubsta->addr);
                 return -EINVAL;
         }
 
@@ -520,12 +499,8 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
         if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_BURST_RETRIES &&
             time_before(jiffies, sta->ampdu_mlme.last_addba_req_time[tid] +
                         HT_AGG_RETRIES_PERIOD)) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "BA request denied - "
-                       "waiting a grace period after %d failed requests "
-                       "on tid %u\n",
-                       sta->ampdu_mlme.addba_req_num[tid], tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
+                ht_vdbg("BA request denied - waiting a grace period after %d failed requests on tid %u\n",
+                        sta->ampdu_mlme.addba_req_num[tid], tid);
                 ret = -EBUSY;
                 goto err_unlock_sta;
         }
@@ -533,10 +508,8 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
         tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
         /* check if the TID is not in aggregation flow already */
         if (tid_tx || sta->ampdu_mlme.tid_start_tx[tid]) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "BA request denied - session is not "
-                                 "idle on tid %u\n", tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
+                ht_vdbg("BA request denied - session is not idle on tid %u\n",
+                        tid);
                 ret = -EAGAIN;
                 goto err_unlock_sta;
         }
@@ -591,9 +564,7 @@ static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
 
         tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Aggregation is on for tid %d\n", tid);
-#endif
+        ht_vdbg("Aggregation is on for tid %d\n", tid);
 
         drv_ampdu_action(local, sta->sdata,
                          IEEE80211_AMPDU_TX_OPERATIONAL,
@@ -627,10 +598,7 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid)
         trace_api_start_tx_ba_cb(sdata, ra, tid);
 
         if (tid >= STA_TID_NUM) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
-                                tid, STA_TID_NUM);
-#endif
+                ht_vdbg("Bad TID value: tid = %d (>= %d)\n", tid, STA_TID_NUM);
                 return;
         }
 
@@ -638,9 +606,7 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid)
         sta = sta_info_get_bss(sdata, ra);
         if (!sta) {
                 mutex_unlock(&local->sta_mtx);
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Could not find station: %pM\n", ra);
-#endif
+                ht_vdbg("Could not find station: %pM\n", ra);
                 return;
         }
 
@@ -648,9 +614,7 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid)
         tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 
         if (WARN_ON(!tid_tx)) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "addBA was not requested!\n");
-#endif
+                ht_vdbg("addBA was not requested!\n");
                 goto unlock;
         }
 
@@ -750,25 +714,17 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
         trace_api_stop_tx_ba_cb(sdata, ra, tid);
 
         if (tid >= STA_TID_NUM) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
-                                tid, STA_TID_NUM);
-#endif
+                ht_vdbg("Bad TID value: tid = %d (>= %d)\n", tid, STA_TID_NUM);
                 return;
         }
 
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Stopping Tx BA session for %pM tid %d\n",
-               ra, tid);
-#endif /* CONFIG_MAC80211_HT_DEBUG */
+        ht_vdbg("Stopping Tx BA session for %pM tid %d\n", ra, tid);
 
         mutex_lock(&local->sta_mtx);
 
         sta = sta_info_get_bss(sdata, ra);
         if (!sta) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "Could not find station: %pM\n", ra);
-#endif
+                ht_vdbg("Could not find station: %pM\n", ra);
                 goto unlock;
         }
 
@@ -777,9 +733,7 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
         tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 
         if (!tid_tx || !test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "unexpected callback to A-MPDU stop\n");
-#endif
+                ht_vdbg("unexpected callback to A-MPDU stop\n");
                 goto unlock_sta;
         }
 
@@ -855,17 +809,13 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
                 goto out;
 
         if (mgmt->u.action.u.addba_resp.dialog_token != tid_tx->dialog_token) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
-#endif
+                ht_vdbg("wrong addBA response token, tid %d\n", tid);
                 goto out;
         }
 
         del_timer_sync(&tid_tx->addba_resp_timer);
 
-#ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "switched off addBA timer for tid %d\n", tid);
-#endif
+        ht_vdbg("switched off addBA timer for tid %d\n", tid);
 
         /*
          * addba_resp_timer may have fired before we got here, and
@@ -874,11 +824,8 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
          */
         if (test_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state) ||
             test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                printk(KERN_DEBUG
-                       "got addBA resp for tid %d but we already gave up\n",
-                       tid);
-#endif
+                ht_vdbg("got addBA resp for tid %d but we already gave up\n",
+                        tid);
                 goto out;
         }
 
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 7d5108a867ad..85ac364f4636 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -674,6 +674,48 @@ static int ieee80211_get_station(struct wiphy *wiphy, struct net_device *dev,
         return ret;
 }
 
+static int ieee80211_set_channel(struct wiphy *wiphy,
+                                 struct net_device *netdev,
+                                 struct ieee80211_channel *chan,
+                                 enum nl80211_channel_type channel_type)
+{
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_sub_if_data *sdata = NULL;
+
+        if (netdev)
+                sdata = IEEE80211_DEV_TO_SUB_IF(netdev);
+
+        switch (ieee80211_get_channel_mode(local, NULL)) {
+        case CHAN_MODE_HOPPING:
+                return -EBUSY;
+        case CHAN_MODE_FIXED:
+                if (local->oper_channel != chan)
+                        return -EBUSY;
+                if (!sdata && local->_oper_channel_type == channel_type)
+                        return 0;
+                break;
+        case CHAN_MODE_UNDEFINED:
+                break;
+        }
+
+        if (!ieee80211_set_channel_type(local, sdata, channel_type))
+                return -EBUSY;
+
+        local->oper_channel = chan;
+
+        /* auto-detects changes */
+        ieee80211_hw_config(local, 0);
+
+        return 0;
+}
+
+static int ieee80211_set_monitor_channel(struct wiphy *wiphy,
+                                         struct ieee80211_channel *chan,
+                                         enum nl80211_channel_type channel_type)
+{
+        return ieee80211_set_channel(wiphy, NULL, chan, channel_type);
+}
+
 static int ieee80211_set_probe_resp(struct ieee80211_sub_if_data *sdata,
                                     const u8 *resp, size_t resp_len)
 {
@@ -788,6 +830,11 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
         if (old)
                 return -EALREADY;
 
+        err = ieee80211_set_channel(wiphy, dev, params->channel,
+                                    params->channel_type);
+        if (err)
+                return err;
+
         /*
          * Apply control port protocol, this allows us to
          * not encrypt dynamic WEP control frames.
@@ -1558,6 +1605,12 @@ static int ieee80211_join_mesh(struct wiphy *wiphy, struct net_device *dev,
         err = copy_mesh_setup(ifmsh, setup);
         if (err)
                 return err;
+
+        err = ieee80211_set_channel(wiphy, dev, setup->channel,
+                                    setup->channel_type);
+        if (err)
+                return err;
+
         ieee80211_start_mesh(sdata);
 
         return 0;
@@ -1677,55 +1730,6 @@ static int ieee80211_set_txq_params(struct wiphy *wiphy,
         return 0;
 }
 
-static int ieee80211_set_channel(struct wiphy *wiphy,
-                                 struct net_device *netdev,
-                                 struct ieee80211_channel *chan,
-                                 enum nl80211_channel_type channel_type)
-{
-        struct ieee80211_local *local = wiphy_priv(wiphy);
-        struct ieee80211_sub_if_data *sdata = NULL;
-        struct ieee80211_channel *old_oper;
-        enum nl80211_channel_type old_oper_type;
-        enum nl80211_channel_type old_vif_oper_type= NL80211_CHAN_NO_HT;
-
-        if (netdev)
-                sdata = IEEE80211_DEV_TO_SUB_IF(netdev);
-
-        switch (ieee80211_get_channel_mode(local, NULL)) {
-        case CHAN_MODE_HOPPING:
-                return -EBUSY;
-        case CHAN_MODE_FIXED:
-                if (local->oper_channel != chan)
-                        return -EBUSY;
-                if (!sdata && local->_oper_channel_type == channel_type)
-                        return 0;
-                break;
-        case CHAN_MODE_UNDEFINED:
-                break;
-        }
-
-        if (sdata)
-                old_vif_oper_type = sdata->vif.bss_conf.channel_type;
-        old_oper_type = local->_oper_channel_type;
-
-        if (!ieee80211_set_channel_type(local, sdata, channel_type))
-                return -EBUSY;
-
-        old_oper = local->oper_channel;
-        local->oper_channel = chan;
-
-        /* Update driver if changes were actually made. */
-        if ((old_oper != local->oper_channel) ||
-            (old_oper_type != local->_oper_channel_type))
-                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
-
-        if (sdata && sdata->vif.type != NL80211_IFTYPE_MONITOR &&
-            old_vif_oper_type != sdata->vif.bss_conf.channel_type)
-                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_HT);
-
-        return 0;
-}
-
 #ifdef CONFIG_PM
 static int ieee80211_suspend(struct wiphy *wiphy,
                              struct cfg80211_wowlan *wowlan)
@@ -2111,35 +2115,171 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,
         return 0;
 }
 
-static int ieee80211_remain_on_channel_hw(struct ieee80211_local *local,
-                                          struct net_device *dev,
-                                          struct ieee80211_channel *chan,
-                                          enum nl80211_channel_type chantype,
-                                          unsigned int duration, u64 *cookie)
+static int ieee80211_start_roc_work(struct ieee80211_local *local,
+                                    struct ieee80211_sub_if_data *sdata,
+                                    struct ieee80211_channel *channel,
+                                    enum nl80211_channel_type channel_type,
+                                    unsigned int duration, u64 *cookie,
+                                    struct sk_buff *txskb)
 {
+        struct ieee80211_roc_work *roc, *tmp;
+        bool queued = false;
         int ret;
-        u32 random_cookie;
 
         lockdep_assert_held(&local->mtx);
 
-        if (local->hw_roc_cookie)
-                return -EBUSY;
-        /* must be nonzero */
-        random_cookie = random32() | 1;
-
-        *cookie = random_cookie;
-        local->hw_roc_dev = dev;
-        local->hw_roc_cookie = random_cookie;
-        local->hw_roc_channel = chan;
-        local->hw_roc_channel_type = chantype;
-        local->hw_roc_duration = duration;
-        ret = drv_remain_on_channel(local, chan, chantype, duration);
+        roc = kzalloc(sizeof(*roc), GFP_KERNEL);
+        if (!roc)
+                return -ENOMEM;
+
+        roc->chan = channel;
+        roc->chan_type = channel_type;
+        roc->duration = duration;
+        roc->req_duration = duration;
+        roc->frame = txskb;
+        roc->mgmt_tx_cookie = (unsigned long)txskb;
+        roc->sdata = sdata;
+        INIT_DELAYED_WORK(&roc->work, ieee80211_sw_roc_work);
+        INIT_LIST_HEAD(&roc->dependents);
+
+        /* if there's one pending or we're scanning, queue this one */
+        if (!list_empty(&local->roc_list) || local->scanning)
+                goto out_check_combine;
+
+        /* if not HW assist, just queue & schedule work */
+        if (!local->ops->remain_on_channel) {
+                ieee80211_queue_delayed_work(&local->hw, &roc->work, 0);
+                goto out_queue;
+        }
+
+        /* otherwise actually kick it off here (for error handling) */
+
+        /*
+         * If the duration is zero, then the driver
+         * wouldn't actually do anything. Set it to
+         * 10 for now.
+         *
+         * TODO: cancel the off-channel operation
+         *       when we get the SKB's TX status and
+         *       the wait time was zero before.
+         */
+        if (!duration)
+                duration = 10;
+
+        ret = drv_remain_on_channel(local, channel, channel_type, duration);
         if (ret) {
-                local->hw_roc_channel = NULL;
-                local->hw_roc_cookie = 0;
+                kfree(roc);
+                return ret;
         }
 
-        return ret;
+        roc->started = true;
+        goto out_queue;
+
+ out_check_combine:
+        list_for_each_entry(tmp, &local->roc_list, list) {
+                if (tmp->chan != channel || tmp->chan_type != channel_type)
+                        continue;
+
+                /*
+                 * Extend this ROC if possible:
+                 *
+                 * If it hasn't started yet, just increase the duration
+                 * and add the new one to the list of dependents.
+                 */
+                if (!tmp->started) {
+                        list_add_tail(&roc->list, &tmp->dependents);
+                        tmp->duration = max(tmp->duration, roc->duration);
+                        queued = true;
+                        break;
+                }
+
+                /* If it has already started, it's more difficult ... */
+                if (local->ops->remain_on_channel) {
+                        unsigned long j = jiffies;
+
+                        /*
+                         * In the offloaded ROC case, if it hasn't begun, add
+                         * this new one to the dependent list to be handled
+                         * when the the master one begins. If it has begun,
+                         * check that there's still a minimum time left and
+                         * if so, start this one, transmitting the frame, but
+                         * add it to the list directly after this one with a
+                         * a reduced time so we'll ask the driver to execute
+                         * it right after finishing the previous one, in the
+                         * hope that it'll also be executed right afterwards,
+                         * effectively extending the old one.
+                         * If there's no minimum time left, just add it to the
+                         * normal list.
+                         */
+                        if (!tmp->hw_begun) {
+                                list_add_tail(&roc->list, &tmp->dependents);
+                                queued = true;
+                                break;
+                        }
+
+                        if (time_before(j + IEEE80211_ROC_MIN_LEFT,
+                                        tmp->hw_start_time +
+                                        msecs_to_jiffies(tmp->duration))) {
+                                int new_dur;
+
+                                ieee80211_handle_roc_started(roc);
+
+                                new_dur = roc->duration -
+                                          jiffies_to_msecs(tmp->hw_start_time +
+                                                           msecs_to_jiffies(
+                                                                tmp->duration) -
+                                                           j);
+
+                                if (new_dur > 0) {
+                                        /* add right after tmp */
+                                        list_add(&roc->list, &tmp->list);
+                                } else {
+                                        list_add_tail(&roc->list,
+                                                      &tmp->dependents);
+                                }
+                                queued = true;
+                        }
+                } else if (del_timer_sync(&tmp->work.timer)) {
+                        unsigned long new_end;
+
+                        /*
+                         * In the software ROC case, cancel the timer, if
+                         * that fails then the finish work is already
+                         * queued/pending and thus we queue the new ROC
+                         * normally, if that succeeds then we can extend
+                         * the timer duration and TX the frame (if any.)
+                         */
+
+                        list_add_tail(&roc->list, &tmp->dependents);
+                        queued = true;
+
+                        new_end = jiffies + msecs_to_jiffies(roc->duration);
+
+                        /* ok, it was started & we canceled timer */
+                        if (time_after(new_end, tmp->work.timer.expires))
+                                mod_timer(&tmp->work.timer, new_end);
+                        else
+                                add_timer(&tmp->work.timer);
+
+                        ieee80211_handle_roc_started(roc);
+                }
+                break;
+        }
+
+ out_queue:
+        if (!queued)
+                list_add_tail(&roc->list, &local->roc_list);
+
+        /*
+         * cookie is either the roc (for normal roc)
+         * or the SKB (for mgmt TX)
+         */
+        if (txskb)
+                *cookie = (unsigned long)txskb;
+        else
+                *cookie = (unsigned long)roc;
+
+        return 0;
 }
 
 static int ieee80211_remain_on_channel(struct wiphy *wiphy,
@@ -2151,42 +2291,64 @@ static int ieee80211_remain_on_channel(struct wiphy *wiphy,
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
+        int ret;
 
-        if (local->ops->remain_on_channel) {
-                int ret;
-
-                mutex_lock(&local->mtx);
-                ret = ieee80211_remain_on_channel_hw(local, dev,
-                                                     chan, channel_type,
-                                                     duration, cookie);
-                local->hw_roc_for_tx = false;
-                mutex_unlock(&local->mtx);
-
-                return ret;
-        }
+        mutex_lock(&local->mtx);
+        ret = ieee80211_start_roc_work(local, sdata, chan, channel_type,
+                                       duration, cookie, NULL);
+        mutex_unlock(&local->mtx);
 
-        return ieee80211_wk_remain_on_channel(sdata, chan, channel_type,
-                                              duration, cookie);
+        return ret;
 }
 
-static int ieee80211_cancel_remain_on_channel_hw(struct ieee80211_local *local,
-                                                 u64 cookie)
+static int ieee80211_cancel_roc(struct ieee80211_local *local,
+                                u64 cookie, bool mgmt_tx)
 {
+        struct ieee80211_roc_work *roc, *tmp, *found = NULL;
         int ret;
 
-        lockdep_assert_held(&local->mtx);
+        mutex_lock(&local->mtx);
+        list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
+                if (!mgmt_tx && (unsigned long)roc != cookie)
+                        continue;
+                else if (mgmt_tx && roc->mgmt_tx_cookie != cookie)
+                        continue;
+
+                found = roc;
+                break;
+        }
 
-        if (local->hw_roc_cookie != cookie)
+        if (!found) {
+                mutex_unlock(&local->mtx);
                 return -ENOENT;
+        }
 
-        ret = drv_cancel_remain_on_channel(local);
-        if (ret)
-                return ret;
+        if (local->ops->remain_on_channel) {
+                if (found->started) {
+                        ret = drv_cancel_remain_on_channel(local);
+                        if (WARN_ON_ONCE(ret)) {
+                                mutex_unlock(&local->mtx);
+                                return ret;
+                        }
+                }
 
-        local->hw_roc_cookie = 0;
-        local->hw_roc_channel = NULL;
+                list_del(&found->list);
 
-        ieee80211_recalc_idle(local);
+                ieee80211_run_deferred_scan(local);
+                ieee80211_start_next_roc(local);
+                mutex_unlock(&local->mtx);
+
+                ieee80211_roc_notify_destroy(found);
+        } else {
+                /* work may be pending so use it all the time */
+                found->abort = true;
+                ieee80211_queue_delayed_work(&local->hw, &found->work, 0);
+
+                mutex_unlock(&local->mtx);
+
+                /* work will clean up etc */
+                flush_delayed_work(&found->work);
+        }
 
         return 0;
 }
@@ -2198,39 +2360,7 @@ static int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
 
-        if (local->ops->cancel_remain_on_channel) {
-                int ret;
-
-                mutex_lock(&local->mtx);
-                ret = ieee80211_cancel_remain_on_channel_hw(local, cookie);
-                mutex_unlock(&local->mtx);
-
-                return ret;
-        }
-
-        return ieee80211_wk_cancel_remain_on_channel(sdata, cookie);
-}
-
-static enum work_done_result
-ieee80211_offchan_tx_done(struct ieee80211_work *wk, struct sk_buff *skb)
-{
-        /*
-         * Use the data embedded in the work struct for reporting
-         * here so if the driver mangled the SKB before dropping
-         * it (which is the only way we really should get here)
-         * then we don't report mangled data.
-         *
-         * If there was no wait time, then by the time we get here
-         * the driver will likely not have reported the status yet,
-         * so in that case userspace will have to deal with it.
-         */
-
-        if (wk->offchan_tx.wait && !wk->offchan_tx.status)
-                cfg80211_mgmt_tx_status(wk->sdata->dev,
-                                        (unsigned long) wk->offchan_tx.frame,
-                                        wk->data, wk->data_len, false, GFP_KERNEL);
-
-        return WORK_DONE_DESTROY;
+        return ieee80211_cancel_roc(local, cookie, false);
 }
 
 static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
@@ -2244,10 +2374,10 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct sta_info *sta;
-        struct ieee80211_work *wk;
         const struct ieee80211_mgmt *mgmt = (void *)buf;
+        bool need_offchan = false;
         u32 flags;
-        bool is_offchan = false;
+        int ret;
 
         if (dont_wait_for_ack)
                 flags = IEEE80211_TX_CTL_NO_ACK;
@@ -2255,33 +2385,28 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
                 flags = IEEE80211_TX_INTFL_NL80211_FRAME_TX |
                         IEEE80211_TX_CTL_REQ_TX_STATUS;
 
-        /* Check that we are on the requested channel for transmission */
-        if (chan != local->tmp_channel &&
-            chan != local->oper_channel)
-                is_offchan = true;
-        if (channel_type_valid &&
-            (channel_type != local->tmp_channel_type &&
-             channel_type != local->_oper_channel_type))
-                is_offchan = true;
-
-        if (chan == local->hw_roc_channel) {
-                /* TODO: check channel type? */
-                is_offchan = false;
-                flags |= IEEE80211_TX_CTL_TX_OFFCHAN;
-        }
-
         if (no_cck)
                 flags |= IEEE80211_TX_CTL_NO_CCK_RATE;
 
-        if (is_offchan && !offchan)
-                return -EBUSY;
-
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_ADHOC:
+                if (!sdata->vif.bss_conf.ibss_joined)
+                        need_offchan = true;
+                /* fall through */
+#ifdef CONFIG_MAC80211_MESH
+        case NL80211_IFTYPE_MESH_POINT:
+                if (ieee80211_vif_is_mesh(&sdata->vif) &&
+                    !sdata->u.mesh.mesh_id_len)
+                        need_offchan = true;
+                /* fall through */
+#endif
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_AP_VLAN:
         case NL80211_IFTYPE_P2P_GO:
-        case NL80211_IFTYPE_MESH_POINT:
+                if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
+                    !ieee80211_vif_is_mesh(&sdata->vif) &&
+                    !rcu_access_pointer(sdata->bss->beacon))
+                        need_offchan = true;
                 if (!ieee80211_is_action(mgmt->frame_control) ||
                     mgmt->u.action.category == WLAN_CATEGORY_PUBLIC)
                         break;
@@ -2293,103 +2418,60 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
                 break;
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_P2P_CLIENT:
+                if (!sdata->u.mgd.associated)
+                        need_offchan = true;
                 break;
         default:
                 return -EOPNOTSUPP;
         }
 
+        mutex_lock(&local->mtx);
+
+        /* Check if the operating channel is the requested channel */
+        if (!need_offchan) {
+                need_offchan = chan != local->oper_channel;
+                if (channel_type_valid &&
+                    channel_type != local->_oper_channel_type)
+                        need_offchan = true;
+        }
+
+        if (need_offchan && !offchan) {
+                ret = -EBUSY;
+                goto out_unlock;
+        }
+
         skb = dev_alloc_skb(local->hw.extra_tx_headroom + len);
-        if (!skb)
-                return -ENOMEM;
+        if (!skb) {
+                ret = -ENOMEM;
+                goto out_unlock;
+        }
         skb_reserve(skb, local->hw.extra_tx_headroom);
 
         memcpy(skb_put(skb, len), buf, len);
 
         IEEE80211_SKB_CB(skb)->flags = flags;
 
-        if (flags & IEEE80211_TX_CTL_TX_OFFCHAN)
-                IEEE80211_SKB_CB(skb)->hw_queue =
-                        local->hw.offchannel_tx_hw_queue;
-
         skb->dev = sdata->dev;
 
-        *cookie = (unsigned long) skb;
-
-        if (is_offchan && local->ops->remain_on_channel) {
-                unsigned int duration;
-                int ret;
-
-                mutex_lock(&local->mtx);
-                /*
-                 * If the duration is zero, then the driver
-                 * wouldn't actually do anything. Set it to
-                 * 100 for now.
-                 *
-                 * TODO: cancel the off-channel operation
-                 *       when we get the SKB's TX status and
-                 *       the wait time was zero before.
-                 */
-                duration = 100;
-                if (wait)
-                        duration = wait;
-                ret = ieee80211_remain_on_channel_hw(local, dev, chan,
-                                                     channel_type,
-                                                     duration, cookie);
-                if (ret) {
-                        kfree_skb(skb);
-                        mutex_unlock(&local->mtx);
-                        return ret;
-                }
-
-                local->hw_roc_for_tx = true;
-                local->hw_roc_duration = wait;
-
-                /*
-                 * queue up frame for transmission after
-                 * ieee80211_ready_on_channel call
-                 */
+        if (!need_offchan) {
+                ieee80211_tx_skb(sdata, skb);
+                ret = 0;
+                goto out_unlock;
+        }
 
-                /* modify cookie to prevent API mismatches */
-                *cookie ^= 2;
-                IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_TX_OFFCHAN;
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_TX_OFFCHAN;
+        if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
                 IEEE80211_SKB_CB(skb)->hw_queue =
                         local->hw.offchannel_tx_hw_queue;
-                local->hw_roc_skb = skb;
-                local->hw_roc_skb_for_status = skb;
-                mutex_unlock(&local->mtx);
-
-                return 0;
-        }
-
-        /*
-         * Can transmit right away if the channel was the
-         * right one and there's no wait involved... If a
-         * wait is involved, we might otherwise not be on
-         * the right channel for long enough!
-         */
-        if (!is_offchan && !wait && !sdata->vif.bss_conf.idle) {
-                ieee80211_tx_skb(sdata, skb);
-                return 0;
-        }
 
-        wk = kzalloc(sizeof(*wk) + len, GFP_KERNEL);
-        if (!wk) {
+        /* This will handle all kinds of coalescing and immediate TX */
+        ret = ieee80211_start_roc_work(local, sdata, chan, channel_type,
+                                       wait, cookie, skb);
+        if (ret)
                 kfree_skb(skb);
-                return -ENOMEM;
-        }
-
-        wk->type = IEEE80211_WORK_OFFCHANNEL_TX;
-        wk->chan = chan;
-        wk->chan_type = channel_type;
-        wk->sdata = sdata;
-        wk->done = ieee80211_offchan_tx_done;
-        wk->offchan_tx.frame = skb;
-        wk->offchan_tx.wait = wait;
-        wk->data_len = len;
-        memcpy(wk->data, buf, len);
-
-        ieee80211_add_work(wk);
-        return 0;
+ out_unlock:
+        mutex_unlock(&local->mtx);
+        return ret;
 }
 
 static int ieee80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
@@ -2398,45 +2480,8 @@ static int ieee80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_work *wk;
-        int ret = -ENOENT;
-
-        mutex_lock(&local->mtx);
-
-        if (local->ops->cancel_remain_on_channel) {
-                cookie ^= 2;
-                ret = ieee80211_cancel_remain_on_channel_hw(local, cookie);
-
-                if (ret == 0) {
-                        kfree_skb(local->hw_roc_skb);
-                        local->hw_roc_skb = NULL;
-                        local->hw_roc_skb_for_status = NULL;
-                }
-
-                mutex_unlock(&local->mtx);
 
-                return ret;
-        }
-
-        list_for_each_entry(wk, &local->work_list, list) {
-                if (wk->sdata != sdata)
-                        continue;
-
-                if (wk->type != IEEE80211_WORK_OFFCHANNEL_TX)
-                        continue;
-
-                if (cookie != (unsigned long) wk->offchan_tx.frame)
-                        continue;
-
-                wk->timeout = jiffies;
-
-                ieee80211_queue_work(&local->hw, &local->work_work);
-                ret = 0;
-                break;
-        }
-        mutex_unlock(&local->mtx);
-
-        return ret;
+        return ieee80211_cancel_roc(local, cookie, true);
 }
 
 static void ieee80211_mgmt_frame_register(struct wiphy *wiphy,
@@ -2680,7 +2725,7 @@ static int ieee80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
                 return -EINVAL;
 
 #ifdef CONFIG_MAC80211_VERBOSE_TDLS_DEBUG
-        printk(KERN_DEBUG "TDLS mgmt action %d peer %pM\n", action_code, peer);
+        pr_debug("TDLS mgmt action %d peer %pM\n", action_code, peer);
 #endif
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom +
@@ -2791,7 +2836,7 @@ static int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
                 return -EINVAL;
 
 #ifdef CONFIG_MAC80211_VERBOSE_TDLS_DEBUG
-        printk(KERN_DEBUG "TDLS oper %d peer %pM\n", oper, peer);
+        pr_debug("TDLS oper %d peer %pM\n", oper, peer);
 #endif
 
         switch (oper) {
@@ -2936,7 +2981,7 @@ struct cfg80211_ops mac80211_config_ops = {
 #endif
         .change_bss = ieee80211_change_bss,
         .set_txq_params = ieee80211_set_txq_params,
-        .set_channel = ieee80211_set_channel,
+        .set_monitor_channel = ieee80211_set_monitor_channel,
         .suspend = ieee80211_suspend,
         .resume = ieee80211_resume,
         .scan = ieee80211_scan,
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index c76cf7230c7d..f0f87e5a1d35 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -41,6 +41,10 @@ __ieee80211_get_channel_mode(struct ieee80211_local *local,
                         if (!sdata->u.ap.beacon)
                                 continue;
                         break;
+                case NL80211_IFTYPE_MESH_POINT:
+                        if (!sdata->wdev.mesh_id_len)
+                                continue;
+                        break;
                 default:
                         break;
                 }
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 7ed433c66d68..d4272ff43f71 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -607,6 +607,7 @@ static void add_mesh_config(struct ieee80211_sub_if_data *sdata)
         MESHPARAMS_ADD(min_discovery_timeout);
         MESHPARAMS_ADD(dot11MeshHWMPRootMode);
         MESHPARAMS_ADD(dot11MeshHWMPRannInterval);
+        MESHPARAMS_ADD(dot11MeshForwarding);
         MESHPARAMS_ADD(dot11MeshGateAnnouncementProtocol);
         MESHPARAMS_ADD(rssi_threshold);
         MESHPARAMS_ADD(ht_opmode);
@@ -685,6 +686,6 @@ void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)
 
         sprintf(buf, "netdev:%s", sdata->name);
         if (!debugfs_rename(dir->d_parent, dir, dir->d_parent, buf))
-                printk(KERN_ERR "mac80211: debugfs: failed to rename debugfs "
+                pr_err("mac80211: debugfs: failed to rename debugfs "
                        "dir to %s\n", buf);
 }
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 33d9d0c3e3d0..725cb4be229d 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -82,8 +82,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 
         local->oper_channel = chan;
         channel_type = ifibss->channel_type;
-        if (channel_type > NL80211_CHAN_HT20 &&
-            !cfg80211_can_beacon_sec_chan(local->hw.wiphy, chan, channel_type))
+        if (!cfg80211_can_beacon_sec_chan(local->hw.wiphy, chan, channel_type))
                 channel_type = NL80211_CHAN_HT20;
         if (!ieee80211_set_channel_type(local, sdata, channel_type)) {
                 /* can only fail due to HT40+/- mismatch */
@@ -281,11 +280,8 @@ static struct sta_info *ieee80211_ibss_finish_sta(struct sta_info *sta,
         if (sta_info_insert_rcu(sta))
                 return sta_info_get(sdata, addr);
         if (auth) {
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-                printk(KERN_DEBUG "TX Auth SA=%pM DA=%pM BSSID=%pM"
-                       "(auth_transaction=1)\n", sdata->vif.addr,
-                       sdata->u.ibss.bssid, addr);
-#endif
+                ibss_vdbg("TX Auth SA=%pM DA=%pM BSSID=%pM (auth_transaction=1)\n",
+                          sdata->vif.addr, sdata->u.ibss.bssid, addr);
                 ieee80211_send_auth(sdata, 1, WLAN_AUTH_OPEN, NULL, 0,
                                     addr, sdata->u.ibss.bssid, NULL, 0, 0);
         }
@@ -355,11 +351,9 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
 
         if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1)
                 return;
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-        printk(KERN_DEBUG "%s: RX Auth SA=%pM DA=%pM BSSID=%pM."
-               "(auth_transaction=%d)\n",
-               sdata->name, mgmt->sa, mgmt->da, mgmt->bssid, auth_transaction);
-#endif
+        ibss_vdbg("%s: RX Auth SA=%pM DA=%pM BSSID=%pM (auth_transaction=%d)\n",
+                  sdata->name, mgmt->sa, mgmt->da, mgmt->bssid,
+                  auth_transaction);
         sta_info_destroy_addr(sdata, mgmt->sa);
         ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa, 0, false);
         rcu_read_unlock();
@@ -422,15 +416,10 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                                         ieee80211_mandatory_rates(local, band);
 
                                 if (sta->sta.supp_rates[band] != prev_rates) {
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-                                        printk(KERN_DEBUG
-                                                "%s: updated supp_rates set "
-                                                "for %pM based on beacon"
-                                                "/probe_resp (0x%x -> 0x%x)\n",
-                                                sdata->name, sta->sta.addr,
-                                                prev_rates,
-                                                sta->sta.supp_rates[band]);
-#endif
+                                        ibss_vdbg("%s: updated supp_rates set for %pM based on beacon/probe_resp (0x%x -> 0x%x)\n",
+                                                  sdata->name, sta->sta.addr,
+                                                  prev_rates,
+                                                  sta->sta.supp_rates[band]);
                                         rates_updated = true;
                                 }
                         } else {
@@ -545,22 +534,16 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 rx_timestamp = drv_get_tsf(local, sdata);
         }
 
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-        printk(KERN_DEBUG "RX beacon SA=%pM BSSID="
-               "%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
-               mgmt->sa, mgmt->bssid,
-               (unsigned long long)rx_timestamp,
-               (unsigned long long)beacon_timestamp,
-               (unsigned long long)(rx_timestamp - beacon_timestamp),
-               jiffies);
-#endif
+        ibss_vdbg("RX beacon SA=%pM BSSID=%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
+                  mgmt->sa, mgmt->bssid,
+                  (unsigned long long)rx_timestamp,
+                  (unsigned long long)beacon_timestamp,
+                  (unsigned long long)(rx_timestamp - beacon_timestamp),
+                  jiffies);
 
         if (beacon_timestamp > rx_timestamp) {
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-                printk(KERN_DEBUG "%s: beacon TSF higher than "
-                       "local TSF - IBSS merge with BSSID %pM\n",
-                       sdata->name, mgmt->bssid);
-#endif
+                ibss_vdbg("%s: beacon TSF higher than local TSF - IBSS merge with BSSID %pM\n",
+                          sdata->name, mgmt->bssid);
                 ieee80211_sta_join_ibss(sdata, bss);
                 supp_rates = ieee80211_sta_get_rates(local, elems, band, NULL);
                 ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa,
@@ -662,8 +645,8 @@ static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
         if (ifibss->fixed_channel)
                 return;
 
-        printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
-               "IBSS networks with same SSID (merge)\n", sdata->name);
+        pr_debug("%s: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge)\n",
+                 sdata->name);
 
         ieee80211_request_internal_scan(sdata,
                         ifibss->ssid, ifibss->ssid_len, NULL);
@@ -691,8 +674,8 @@ static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
                 bssid[0] |= 0x02;
         }
 
-        printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %pM\n",
-               sdata->name, bssid);
+        pr_debug("%s: Creating new IBSS network, BSSID %pM\n",
+                 sdata->name, bssid);
 
         capability = WLAN_CAPABILITY_IBSS;
 
@@ -723,10 +706,8 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
         lockdep_assert_held(&ifibss->mtx);
 
         active_ibss = ieee80211_sta_active_ibss(sdata);
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-        printk(KERN_DEBUG "%s: sta_find_ibss (active_ibss=%d)\n",
-               sdata->name, active_ibss);
-#endif /* CONFIG_MAC80211_IBSS_DEBUG */
+        ibss_vdbg("%s: sta_find_ibss (active_ibss=%d)\n",
+                  sdata->name, active_ibss);
 
         if (active_ibss)
                 return;
@@ -749,29 +730,23 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                 struct ieee80211_bss *bss;
 
                 bss = (void *)cbss->priv;
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-                printk(KERN_DEBUG "   sta_find_ibss: selected %pM current "
-                       "%pM\n", cbss->bssid, ifibss->bssid);
-#endif /* CONFIG_MAC80211_IBSS_DEBUG */
-
-                printk(KERN_DEBUG "%s: Selected IBSS BSSID %pM"
-                       " based on configured SSID\n",
-                       sdata->name, cbss->bssid);
+                ibss_vdbg("   sta_find_ibss: selected %pM current %pM\n",
+                          cbss->bssid, ifibss->bssid);
+                pr_debug("%s: Selected IBSS BSSID %pM based on configured SSID\n",
+                         sdata->name, cbss->bssid);
 
                 ieee80211_sta_join_ibss(sdata, bss);
                 ieee80211_rx_bss_put(local, bss);
                 return;
         }
 
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-        printk(KERN_DEBUG "   did not try to join ibss\n");
-#endif /* CONFIG_MAC80211_IBSS_DEBUG */
+        ibss_vdbg("   did not try to join ibss\n");
 
         /* Selected IBSS not found in current scan results - try to scan */
         if (time_after(jiffies, ifibss->last_scan_completed +
                                         IEEE80211_SCAN_INTERVAL)) {
-                printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
-                       "join\n", sdata->name);
+                pr_debug("%s: Trigger new scan to find an IBSS to join\n",
+                         sdata->name);
 
                 ieee80211_request_internal_scan(sdata,
                                 ifibss->ssid, ifibss->ssid_len,
@@ -785,9 +760,9 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                                 ieee80211_sta_create_ibss(sdata);
                                 return;
                         }
-                        printk(KERN_DEBUG "%s: IBSS not allowed on"
-                               " %d MHz\n", sdata->name,
-                               local->hw.conf.channel->center_freq);
+                        pr_debug("%s: IBSS not allowed on %d MHz\n",
+                                 sdata->name,
+                                 local->hw.conf.channel->center_freq);
 
                         /* No IBSS found - decrease scan interval and continue
                          * scanning. */
@@ -822,12 +797,9 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
 
         tx_last_beacon = drv_tx_last_beacon(local);
 
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-        printk(KERN_DEBUG "%s: RX ProbeReq SA=%pM DA=%pM BSSID=%pM"
-               " (tx_last_beacon=%d)\n",
-               sdata->name, mgmt->sa, mgmt->da,
-               mgmt->bssid, tx_last_beacon);
-#endif /* CONFIG_MAC80211_IBSS_DEBUG */
+        ibss_vdbg("%s: RX ProbeReq SA=%pM DA=%pM BSSID=%pM (tx_last_beacon=%d)\n",
+                  sdata->name, mgmt->sa, mgmt->da,
+                  mgmt->bssid, tx_last_beacon);
 
         if (!tx_last_beacon && is_multicast_ether_addr(mgmt->da))
                 return;
@@ -840,11 +812,8 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
         pos = mgmt->u.probe_req.variable;
         if (pos[0] != WLAN_EID_SSID ||
             pos + 2 + pos[1] > end) {
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-                printk(KERN_DEBUG "%s: Invalid SSID IE in ProbeReq "
-                       "from %pM\n",
-                       sdata->name, mgmt->sa);
-#endif
+                ibss_vdbg("%s: Invalid SSID IE in ProbeReq from %pM\n",
+                          sdata->name, mgmt->sa);
                 return;
         }
         if (pos[1] != 0 &&
@@ -861,10 +830,7 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
 
         resp = (struct ieee80211_mgmt *) skb->data;
         memcpy(resp->da, mgmt->sa, ETH_ALEN);
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-        printk(KERN_DEBUG "%s: Sending ProbeResp to %pM\n",
-               sdata->name, resp->da);
-#endif /* CONFIG_MAC80211_IBSS_DEBUG */
+        ibss_vdbg("%s: Sending ProbeResp to %pM\n", sdata->name, resp->da);
         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
         ieee80211_tx_skb(sdata, skb);
 }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 3f3cd50fff16..e6cbf5b68c89 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -317,55 +317,30 @@ struct mesh_preq_queue {
         u8 flags;
 };
 
-enum ieee80211_work_type {
-        IEEE80211_WORK_ABORT,
-        IEEE80211_WORK_REMAIN_ON_CHANNEL,
-        IEEE80211_WORK_OFFCHANNEL_TX,
-};
-
-/**
- * enum work_done_result - indicates what to do after work was done
- *
- * @WORK_DONE_DESTROY: This work item is no longer needed, destroy.
- * @WORK_DONE_REQUEUE: This work item was reset to be reused, and
- *      should be requeued.
- */
-enum work_done_result {
-        WORK_DONE_DESTROY,
-        WORK_DONE_REQUEUE,
-};
+#if HZ/100 == 0
+#define IEEE80211_ROC_MIN_LEFT  1
+#else
+#define IEEE80211_ROC_MIN_LEFT  (HZ/100)
+#endif
 
-struct ieee80211_work {
+struct ieee80211_roc_work {
         struct list_head list;
+        struct list_head dependents;
 
-        struct rcu_head rcu_head;
+        struct delayed_work work;
 
         struct ieee80211_sub_if_data *sdata;
 
-        enum work_done_result (*done)(struct ieee80211_work *wk,
-                                      struct sk_buff *skb);
-
         struct ieee80211_channel *chan;
         enum nl80211_channel_type chan_type;
 
-        unsigned long timeout;
-        enum ieee80211_work_type type;
+        bool started, abort, hw_begun, notified;
 
-        bool started;
+        unsigned long hw_start_time;
 
-        union {
-                struct {
-                        u32 duration;
-                } remain;
-                struct {
-                        struct sk_buff *frame;
-                        u32 wait;
-                        bool status;
-                } offchan_tx;
-        };
-
-        size_t data_len;
-        u8 data[];
+        u32 duration, req_duration;
+        struct sk_buff *frame;
+        u64 mgmt_tx_cookie;
 };
 
 /* flags used in struct ieee80211_if_managed.flags */
@@ -399,7 +374,6 @@ struct ieee80211_mgd_auth_data {
 struct ieee80211_mgd_assoc_data {
         struct cfg80211_bss *bss;
         const u8 *supp_rates;
-        const u8 *ht_operation_ie;
 
         unsigned long timeout;
         int tries;
@@ -414,6 +388,8 @@ struct ieee80211_mgd_assoc_data {
         bool sent_assoc;
         bool synced;
 
+        u8 ap_ht_param;
+
         size_t ie_len;
         u8 ie[];
 };
@@ -847,13 +823,6 @@ struct ieee80211_local {
         const struct ieee80211_ops *ops;
 
         /*
-         * work stuff, potentially off-channel (in the future)
-         */
-        struct list_head work_list;
-        struct timer_list work_timer;
-        struct work_struct work_work;
-
-        /*
          * private workqueue to mac80211. mac80211 makes this accessible
          * via ieee80211_queue_work()
          */
@@ -1087,14 +1056,12 @@ struct ieee80211_local {
         } debugfs;
 #endif
 
-        struct ieee80211_channel *hw_roc_channel;
-        struct net_device *hw_roc_dev;
-        struct sk_buff *hw_roc_skb, *hw_roc_skb_for_status;
+        /*
+         * Remain-on-channel support
+         */
+        struct list_head roc_list;
         struct work_struct hw_roc_start, hw_roc_done;
-        enum nl80211_channel_type hw_roc_channel_type;
-        unsigned int hw_roc_duration;
-        u32 hw_roc_cookie;
-        bool hw_roc_for_tx;
+        unsigned long hw_roc_start_time;
 
         struct idr ack_status_frames;
         spinlock_t ack_status_lock;
@@ -1290,7 +1257,12 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
                                     bool offchannel_ps_enable);
 void ieee80211_offchannel_return(struct ieee80211_local *local,
                                  bool offchannel_ps_disable);
-void ieee80211_hw_roc_setup(struct ieee80211_local *local);
+void ieee80211_roc_setup(struct ieee80211_local *local);
+void ieee80211_start_next_roc(struct ieee80211_local *local);
+void ieee80211_roc_purge(struct ieee80211_sub_if_data *sdata);
+void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc);
+void ieee80211_sw_roc_work(struct work_struct *work);
+void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc);
 
 /* interface handling */
 int ieee80211_iface_init(void);
@@ -1500,18 +1472,6 @@ u8 *ieee80211_ie_build_ht_oper(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
                                enum nl80211_channel_type channel_type,
                                u16 prot_mode);
 
-/* internal work items */
-void ieee80211_work_init(struct ieee80211_local *local);
-void ieee80211_add_work(struct ieee80211_work *wk);
-void free_work(struct ieee80211_work *wk);
-void ieee80211_work_purge(struct ieee80211_sub_if_data *sdata);
-int ieee80211_wk_remain_on_channel(struct ieee80211_sub_if_data *sdata,
-                                   struct ieee80211_channel *chan,
-                                   enum nl80211_channel_type channel_type,
-                                   unsigned int duration, u64 *cookie);
-int ieee80211_wk_cancel_remain_on_channel(
-        struct ieee80211_sub_if_data *sdata, u64 cookie);
-
 /* channel management */
 enum ieee80211_chan_mode {
         CHAN_MODE_UNDEFINED,
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 8664111d0566..87aeb4f21ffd 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -58,7 +58,7 @@ static int ieee80211_change_mtu(struct net_device *dev, int new_mtu)
         }
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: setting MTU %d\n", dev->name, new_mtu);
+        pr_debug("%s: setting MTU %d\n", dev->name, new_mtu);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
         dev->mtu = new_mtu;
         return 0;
@@ -528,10 +528,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
          */
         netif_tx_stop_all_queues(sdata->dev);
 
-        /*
-         * Purge work for this interface.
-         */
-        ieee80211_work_purge(sdata);
+        ieee80211_roc_purge(sdata);
 
         /*
          * Remove all stations associated with this interface.
@@ -637,18 +634,6 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 ieee80211_configure_filter(local);
                 break;
         default:
-                mutex_lock(&local->mtx);
-                if (local->hw_roc_dev == sdata->dev &&
-                    local->hw_roc_channel) {
-                        /* ignore return value since this is racy */
-                        drv_cancel_remain_on_channel(local);
-                        ieee80211_queue_work(&local->hw, &local->hw_roc_done);
-                }
-                mutex_unlock(&local->mtx);
-
-                flush_work(&local->hw_roc_start);
-                flush_work(&local->hw_roc_done);
-
                 flush_work(&sdata->work);
                 /*
                  * When we get here, the interface is marked down.
@@ -1238,7 +1223,7 @@ static void ieee80211_assign_perm_addr(struct ieee80211_local *local,
 
                 if (__ffs64(mask) + hweight64(mask) != fls64(mask)) {
                         /* not a contiguous mask ... not handled now! */
-                        printk(KERN_DEBUG "not contiguous\n");
+                        pr_debug("not contiguous\n");
                         break;
                 }
 
@@ -1364,6 +1349,8 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                         sdata->u.mgd.use_4addr = params->use_4addr;
         }
 
+        ndev->features |= local->hw.netdev_features;
+
         ret = register_netdevice(ndev);
         if (ret)
                 goto fail;
@@ -1454,9 +1441,9 @@ u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
 {
         struct ieee80211_sub_if_data *sdata;
         int count = 0;
-        bool working = false, scanning = false, hw_roc = false;
-        struct ieee80211_work *wk;
+        bool working = false, scanning = false;
         unsigned int led_trig_start = 0, led_trig_stop = 0;
+        struct ieee80211_roc_work *roc;
 
 #ifdef CONFIG_PROVE_LOCKING
         WARN_ON(debug_locks && !lockdep_rtnl_is_held() &&
@@ -1491,9 +1478,11 @@ u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
                 count++;
         }
 
-        list_for_each_entry(wk, &local->work_list, list) {
-                working = true;
-                wk->sdata->vif.bss_conf.idle = false;
+        if (!local->ops->remain_on_channel) {
+                list_for_each_entry(roc, &local->roc_list, list) {
+                        working = true;
+                        roc->sdata->vif.bss_conf.idle = false;
+                }
         }
 
         if (local->scan_sdata &&
@@ -1502,9 +1491,6 @@ u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
                 local->scan_sdata->vif.bss_conf.idle = false;
         }
 
-        if (local->hw_roc_channel)
-                hw_roc = true;
-
         list_for_each_entry(sdata, &local->interfaces, list) {
                 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
                     sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
@@ -1516,7 +1502,7 @@ u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_IDLE);
         }
 
-        if (working || scanning || hw_roc)
+        if (working || scanning)
                 led_trig_start |= IEEE80211_TPT_LEDTRIG_FL_WORK;
         else
                 led_trig_stop |= IEEE80211_TPT_LEDTRIG_FL_WORK;
@@ -1528,8 +1514,6 @@ u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
 
         ieee80211_mod_tpt_led_trig(local, led_trig_start, led_trig_stop);
 
-        if (hw_roc)
-                return ieee80211_idle_off(local, "hw remain-on-channel");
         if (working)
                 return ieee80211_idle_off(local, "working");
         if (scanning)
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index f5548e953259..d81c178c7712 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -625,8 +625,6 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 
         INIT_DELAYED_WORK(&local->scan_work, ieee80211_scan_work);
 
-        ieee80211_work_init(local);
-
         INIT_WORK(&local->restart_work, ieee80211_restart_work);
 
         INIT_WORK(&local->reconfig_filter, ieee80211_reconfig_filter);
@@ -669,7 +667,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 
         ieee80211_led_names(local);
 
-        ieee80211_hw_roc_setup(local);
+        ieee80211_roc_setup(local);
 
         return &local->hw;
 }
@@ -682,6 +680,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         enum ieee80211_band band;
         int channels, max_bitrates;
         bool supp_ht;
+        netdev_features_t feature_whitelist;
         static const u32 cipher_suites[] = {
                 /* keep WEP first, it may be removed below */
                 WLAN_CIPHER_SUITE_WEP40,
@@ -708,6 +707,12 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         if ((hw->flags & IEEE80211_HW_SCAN_WHILE_IDLE) && !local->ops->hw_scan)
                 return -EINVAL;
 
+        /* Only HW csum features are currently compatible with mac80211 */
+        feature_whitelist = NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+                            NETIF_F_HW_CSUM;
+        if (WARN_ON(hw->netdev_features & ~feature_whitelist))
+                return -EINVAL;
+
         if (hw->max_report_rates == 0)
                 hw->max_report_rates = hw->max_rates;
 
@@ -1009,12 +1014,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 
         rtnl_unlock();
 
-        /*
-         * Now all work items will be gone, but the
-         * timer might still be armed, so delete it
-         */
-        del_timer_sync(&local->work_timer);
-
         cancel_work_sync(&local->restart_work);
         cancel_work_sync(&local->reconfig_filter);
 
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 2913113c5833..7cf19509fb68 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -524,8 +524,7 @@ static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata,
         bool free_plinks;
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: running mesh housekeeping\n",
-               sdata->name);
+        pr_debug("%s: running mesh housekeeping\n", sdata->name);
 #endif
 
         ieee80211_sta_expire(sdata, IEEE80211_MESH_PEER_INACTIVITY_LIMIT);
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 9b59658e8650..fa7c58035246 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -15,7 +15,7 @@
 
 #ifdef CONFIG_MAC80211_VERBOSE_MHWMP_DEBUG
 #define mhwmp_dbg(fmt, args...) \
-        printk(KERN_DEBUG "Mesh HWMP (%s): " fmt "\n", sdata->name, ##args)
+        pr_debug("Mesh HWMP (%s): " fmt "\n", sdata->name, ##args)
 #else
 #define mhwmp_dbg(fmt, args...)   do { (void)(0); } while (0)
 #endif
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index b39224d8255c..572f706fd65b 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -19,7 +19,7 @@
 #include "mesh.h"
 
 #ifdef CONFIG_MAC80211_VERBOSE_MPATH_DEBUG
-#define mpath_dbg(fmt, args...) printk(KERN_DEBUG fmt, ##args)
+#define mpath_dbg(fmt, args...) pr_debug(fmt, ##args)
 #else
 #define mpath_dbg(fmt, args...) do { (void)(0); } while (0)
 #endif
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 60ef235c9d9b..be4fad128c34 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -14,7 +14,7 @@
 #include "mesh.h"
 
 #ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG
-#define mpl_dbg(fmt, args...)   printk(KERN_DEBUG fmt, ##args)
+#define mpl_dbg(fmt, args...)   pr_debug(fmt, ##args)
 #else
 #define mpl_dbg(fmt, args...)   do { (void)(0); } while (0)
 #endif
diff --git a/net/mac80211/mesh_sync.c b/net/mac80211/mesh_sync.c
index 38d30e8ce6dc..0ccdad49f987 100644
--- a/net/mac80211/mesh_sync.c
+++ b/net/mac80211/mesh_sync.c
@@ -14,7 +14,7 @@
 
 #ifdef CONFIG_MAC80211_VERBOSE_MESH_SYNC_DEBUG
 #define msync_dbg(fmt, args...) \
-        printk(KERN_DEBUG "Mesh sync (%s): " fmt "\n", sdata->name, ##args)
+        pr_debug("Mesh sync (%s): " fmt "\n", sdata->name, ##args)
 #else
 #define msync_dbg(fmt, args...)   do { (void)(0); } while (0)
 #endif
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 66e4fcdd1c6b..079038d26a14 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -258,12 +258,11 @@ static int ieee80211_compatible_rates(const u8 *supp_rates, int supp_rates_len,
 }
 
 static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
-                                struct sk_buff *skb, const u8 *ht_oper_ie,
+                                struct sk_buff *skb, u8 ap_ht_param,
                                 struct ieee80211_supported_band *sband,
                                 struct ieee80211_channel *channel,
                                 enum ieee80211_smps_mode smps)
 {
-        struct ieee80211_ht_operation *ht_oper;
         u8 *pos;
         u32 flags = channel->flags;
         u16 cap;
@@ -271,21 +270,13 @@ static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
 
         BUILD_BUG_ON(sizeof(ht_cap) != sizeof(sband->ht_cap));
 
-        if (!ht_oper_ie)
-                return;
-
-        if (ht_oper_ie[1] < sizeof(struct ieee80211_ht_operation))
-                return;
-
         memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
         ieee80211_apply_htcap_overrides(sdata, &ht_cap);
 
-        ht_oper = (struct ieee80211_ht_operation *)(ht_oper_ie + 2);
-
         /* determine capability flags */
         cap = ht_cap.cap;
 
-        switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
+        switch (ap_ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
         case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
                 if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
                         cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
@@ -509,7 +500,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
         }
 
         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_11N))
-                ieee80211_add_ht_ie(sdata, skb, assoc_data->ht_operation_ie,
+                ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
                                     sband, local->oper_channel, ifmgd->ap_smps);
 
         /* if present, add any custom non-vendor IEs that go after HT */
@@ -939,11 +930,6 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
                 return;
         }
 
-        if (!list_empty(&local->work_list)) {
-                local->ps_sdata = NULL;
-                goto change;
-        }
-
         list_for_each_entry(sdata, &local->interfaces, list) {
                 if (!ieee80211_sdata_running(sdata))
                         continue;
@@ -1016,7 +1002,6 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
                 local->ps_sdata = NULL;
         }
 
- change:
         ieee80211_change_ps(local);
 }
 
@@ -1587,6 +1572,8 @@ static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
                 net_dbg_ratelimited("%s: detected beacon loss from AP - sending probe request\n",
                                     sdata->name);
 #endif
+        ieee80211_cqm_rssi_notify(&sdata->vif,
+                NL80211_CQM_RSSI_BEACON_LOSS_EVENT, GFP_KERNEL);
 
         /*
          * The driver/our work has already reported this event or the
@@ -1669,8 +1656,7 @@ static void __ieee80211_connection_loss(struct ieee80211_sub_if_data *sdata)
 
         memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
 
-        printk(KERN_DEBUG "%s: Connection to AP %pM lost.\n",
-               sdata->name, bssid);
+        pr_debug("%s: Connection to AP %pM lost\n", sdata->name, bssid);
 
         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
@@ -1804,9 +1790,10 @@ ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
                 return RX_MGMT_NONE;
 
         if (status_code != WLAN_STATUS_SUCCESS) {
-                printk(KERN_DEBUG "%s: %pM denied authentication (status %d)\n",
-                       sdata->name, mgmt->sa, status_code);
-                goto out;
+                pr_debug("%s: %pM denied authentication (status %d)\n",
+                         sdata->name, mgmt->sa, status_code);
+                ieee80211_destroy_auth_data(sdata, false);
+                return RX_MGMT_CFG80211_RX_AUTH;
         }
 
         switch (ifmgd->auth_data->algorithm) {
@@ -1827,8 +1814,7 @@ ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
                 return RX_MGMT_NONE;
         }
 
-        printk(KERN_DEBUG "%s: authenticated\n", sdata->name);
- out:
+        pr_debug("%s: authenticated\n", sdata->name);
         ifmgd->auth_data->done = true;
         ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
         run_again(ifmgd, ifmgd->auth_data->timeout);
@@ -1841,8 +1827,7 @@ ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
                 goto out_err;
         }
         if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
-                printk(KERN_DEBUG "%s: failed moving %pM to auth\n",
-                       sdata->name, bssid);
+                pr_debug("%s: failed moving %pM to auth\n", sdata->name, bssid);
                 goto out_err;
         }
         mutex_unlock(&sdata->local->sta_mtx);
@@ -1876,8 +1861,8 @@ ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
 
         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
 
-        printk(KERN_DEBUG "%s: deauthenticated from %pM (Reason: %u)\n",
-                        sdata->name, bssid, reason_code);
+        pr_debug("%s: deauthenticated from %pM (Reason: %u)\n",
+                 sdata->name, bssid, reason_code);
 
         ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
 
@@ -1907,8 +1892,8 @@ ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
 
         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 
-        printk(KERN_DEBUG "%s: disassociated from %pM (Reason: %u)\n",
-                        sdata->name, mgmt->sa, reason_code);
+        pr_debug("%s: disassociated from %pM (Reason: %u)\n",
+                 sdata->name, mgmt->sa, reason_code);
 
         ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
 
@@ -2000,17 +1985,15 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
 
         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
-                printk(KERN_DEBUG
-                       "%s: invalid AID value 0x%x; bits 15:14 not set\n",
-                       sdata->name, aid);
+                pr_debug("%s: invalid AID value 0x%x; bits 15:14 not set\n",
+                         sdata->name, aid);
         aid &= ~(BIT(15) | BIT(14));
 
         ifmgd->broken_ap = false;
 
         if (aid == 0 || aid > IEEE80211_MAX_AID) {
-                printk(KERN_DEBUG
-                       "%s: invalid AID value %d (out of range), turn off PS\n",
-                       sdata->name, aid);
+                pr_debug("%s: invalid AID value %d (out of range), turn off PS\n",
+                         sdata->name, aid);
                 aid = 0;
                 ifmgd->broken_ap = true;
         }
@@ -2019,8 +2002,8 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
 
         if (!elems.supp_rates) {
-                printk(KERN_DEBUG "%s: no SuppRates element in AssocResp\n",
-                       sdata->name);
+                pr_debug("%s: no SuppRates element in AssocResp\n",
+                         sdata->name);
                 return false;
         }
 
@@ -2060,9 +2043,8 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
         if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
                 err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
         if (err) {
-                printk(KERN_DEBUG
-                       "%s: failed to move station %pM to desired state\n",
-                       sdata->name, sta->sta.addr);
+                pr_debug("%s: failed to move station %pM to desired state\n",
+                         sdata->name, sta->sta.addr);
                 WARN_ON(__sta_info_destroy(sta));
                 mutex_unlock(&sdata->local->sta_mtx);
                 return false;
@@ -2145,10 +2127,9 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
 
-        printk(KERN_DEBUG "%s: RX %sssocResp from %pM (capab=0x%x "
-               "status=%d aid=%d)\n",
-               sdata->name, reassoc ? "Rea" : "A", mgmt->sa,
-               capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
+        pr_debug("%s: RX %sssocResp from %pM (capab=0x%x status=%d aid=%d)\n",
+                 sdata->name, reassoc ? "Rea" : "A", mgmt->sa,
+                 capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
 
         pos = mgmt->u.assoc_resp.variable;
         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
@@ -2159,9 +2140,8 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                 u32 tu, ms;
                 tu = get_unaligned_le32(elems.timeout_int + 1);
                 ms = tu * 1024 / 1000;
-                printk(KERN_DEBUG "%s: %pM rejected association temporarily; "
-                       "comeback duration %u TU (%u ms)\n",
-                       sdata->name, mgmt->sa, tu, ms);
+                pr_debug("%s: %pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
+                         sdata->name, mgmt->sa, tu, ms);
                 assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
                 if (ms > IEEE80211_ASSOC_TIMEOUT)
                         run_again(ifmgd, assoc_data->timeout);
@@ -2171,11 +2151,11 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         *bss = assoc_data->bss;
 
         if (status_code != WLAN_STATUS_SUCCESS) {
-                printk(KERN_DEBUG "%s: %pM denied association (code=%d)\n",
-                       sdata->name, mgmt->sa, status_code);
+                pr_debug("%s: %pM denied association (code=%d)\n",
+                         sdata->name, mgmt->sa, status_code);
                 ieee80211_destroy_assoc_data(sdata, false);
         } else {
-                printk(KERN_DEBUG "%s: associated\n", sdata->name);
+                pr_debug("%s: associated\n", sdata->name);
 
                 if (!ieee80211_assoc_success(sdata, *bss, mgmt, len)) {
                         /* oops -- internal error -- send timeout for now */
@@ -2283,7 +2263,7 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
         if (ifmgd->auth_data && !ifmgd->auth_data->bss->proberesp_ies &&
             ether_addr_equal(mgmt->bssid, ifmgd->auth_data->bss->bssid)) {
                 /* got probe response, continue with auth */
-                printk(KERN_DEBUG "%s: direct probe responded\n", sdata->name);
+                pr_debug("%s: direct probe responded\n", sdata->name);
                 ifmgd->auth_data->tries = 0;
                 ifmgd->auth_data->timeout = jiffies;
                 run_again(ifmgd, ifmgd->auth_data->timeout);
@@ -2645,8 +2625,8 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
         auth_data->tries++;
 
         if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
-                printk(KERN_DEBUG "%s: authentication with %pM timed out\n",
-                       sdata->name, auth_data->bss->bssid);
+                pr_debug("%s: authentication with %pM timed out\n",
+                         sdata->name, auth_data->bss->bssid);
 
                 /*
                  * Most likely AP is not in the range so remove the
@@ -2658,9 +2638,9 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
         }
 
         if (auth_data->bss->proberesp_ies) {
-                printk(KERN_DEBUG "%s: send auth to %pM (try %d/%d)\n",
-                       sdata->name, auth_data->bss->bssid, auth_data->tries,
-                       IEEE80211_AUTH_MAX_TRIES);
+                pr_debug("%s: send auth to %pM (try %d/%d)\n",
+                         sdata->name, auth_data->bss->bssid, auth_data->tries,
+                         IEEE80211_AUTH_MAX_TRIES);
 
                 auth_data->expected_transaction = 2;
                 ieee80211_send_auth(sdata, 1, auth_data->algorithm,
@@ -2670,9 +2650,9 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
         } else {
                 const u8 *ssidie;
 
-                printk(KERN_DEBUG "%s: direct probe to %pM (try %d/%i)\n",
-                       sdata->name, auth_data->bss->bssid, auth_data->tries,
-                       IEEE80211_AUTH_MAX_TRIES);
+                pr_debug("%s: direct probe to %pM (try %d/%i)\n",
+                         sdata->name, auth_data->bss->bssid, auth_data->tries,
+                         IEEE80211_AUTH_MAX_TRIES);
 
                 ssidie = ieee80211_bss_get_ie(auth_data->bss, WLAN_EID_SSID);
                 if (!ssidie)
@@ -2700,8 +2680,8 @@ static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
 
         assoc_data->tries++;
         if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
-                printk(KERN_DEBUG "%s: association with %pM timed out\n",
-                       sdata->name, assoc_data->bss->bssid);
+                pr_debug("%s: association with %pM timed out\n",
+                         sdata->name, assoc_data->bss->bssid);
 
                 /*
                  * Most likely AP is not in the range so remove the
@@ -2712,9 +2692,9 @@ static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
                 return -ETIMEDOUT;
         }
 
-        printk(KERN_DEBUG "%s: associate with %pM (try %d/%d)\n",
-               sdata->name, assoc_data->bss->bssid, assoc_data->tries,
-               IEEE80211_ASSOC_MAX_TRIES);
+        pr_debug("%s: associate with %pM (try %d/%d)\n",
+                 sdata->name, assoc_data->bss->bssid, assoc_data->tries,
+                 IEEE80211_ASSOC_MAX_TRIES);
         ieee80211_send_assoc(sdata);
 
         assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
@@ -3085,13 +3065,10 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
                          * since we look at probe response/beacon data here
                          * it should be OK.
                          */
-                        printk(KERN_DEBUG
-                               "%s: Wrong control channel: center-freq: %d"
-                               " ht-cfreq: %d ht->primary_chan: %d"
-                               " band: %d. Disabling HT.\n",
-                               sdata->name, cbss->channel->center_freq,
-                               ht_cfreq, ht_oper->primary_chan,
-                               cbss->channel->band);
+                        pr_debug("%s: Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
+                                 sdata->name, cbss->channel->center_freq,
+                                 ht_cfreq, ht_oper->primary_chan,
+                                 cbss->channel->band);
                         ht_oper = NULL;
                 }
         }
@@ -3115,9 +3092,8 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
         if (!ieee80211_set_channel_type(local, sdata, channel_type)) {
                 /* can only fail due to HT40+/- mismatch */
                 channel_type = NL80211_CHAN_HT20;
-                printk(KERN_DEBUG
-                       "%s: disabling 40 MHz due to multi-vif mismatch\n",
-                       sdata->name);
+                pr_debug("%s: disabling 40 MHz due to multi-vif mismatch\n",
+                         sdata->name);
                 ifmgd->flags |= IEEE80211_STA_DISABLE_40MHZ;
                 WARN_ON(!ieee80211_set_channel_type(local, sdata,
                                                     channel_type));
@@ -3146,9 +3122,8 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
                  * we can connect -- with a warning.
                  */
                 if (!basic_rates && min_rate_index >= 0) {
-                        printk(KERN_DEBUG
-                               "%s: No basic rates, using min rate instead.\n",
-                               sdata->name);
+                        pr_debug("%s: No basic rates, using min rate instead\n",
+                                 sdata->name);
                         basic_rates = BIT(min_rate_index);
                 }
 
@@ -3174,9 +3149,8 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
                 err = sta_info_insert(sta);
                 sta = NULL;
                 if (err) {
-                        printk(KERN_DEBUG
-                               "%s: failed to insert STA entry for the AP (error %d)\n",
-                               sdata->name, err);
+                        pr_debug("%s: failed to insert STA entry for the AP (error %d)\n",
+                                 sdata->name, err);
                         return err;
                 }
         } else
@@ -3254,8 +3228,7 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
         if (ifmgd->associated)
                 ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
 
-        printk(KERN_DEBUG "%s: authenticate with %pM\n",
-               sdata->name, req->bss->bssid);
+        pr_debug("%s: authenticate with %pM\n", sdata->name, req->bss->bssid);
 
         err = ieee80211_prep_connection(sdata, req->bss, false);
         if (err)
@@ -3290,7 +3263,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_bss *bss = (void *)req->bss->priv;
         struct ieee80211_mgd_assoc_data *assoc_data;
         struct ieee80211_supported_band *sband;
-        const u8 *ssidie;
+        const u8 *ssidie, *ht_ie;
         int i, err;
 
         ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
@@ -3338,11 +3311,15 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
          * We can set this to true for non-11n hardware, that'll be checked
          * separately along with the peer capabilities.
          */
-        for (i = 0; i < req->crypto.n_ciphers_pairwise; i++)
+        for (i = 0; i < req->crypto.n_ciphers_pairwise; i++) {
                 if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
-                    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104)
+                    req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
                         ifmgd->flags |= IEEE80211_STA_DISABLE_11N;
+                        netdev_info(sdata->dev,
+                                    "disabling HT due to WEP/TKIP use\n");
+                }
+        }
 
         if (req->flags & ASSOC_REQ_DISABLE_HT)
                 ifmgd->flags |= IEEE80211_STA_DISABLE_11N;
@@ -3350,8 +3327,11 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         /* Also disable HT if we don't support it or the AP doesn't use WMM */
         sband = local->hw.wiphy->bands[req->bss->channel->band];
         if (!sband->ht_cap.ht_supported ||
-            local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used)
+            local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used) {
                 ifmgd->flags |= IEEE80211_STA_DISABLE_11N;
+                netdev_info(sdata->dev,
+                            "disabling HT as WMM/QoS is not supported\n");
+        }
 
         memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
         memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
@@ -3377,8 +3357,13 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                           (local->hw.queues >= IEEE80211_NUM_ACS);
         assoc_data->supp_rates = bss->supp_rates;
         assoc_data->supp_rates_len = bss->supp_rates_len;
-        assoc_data->ht_operation_ie =
-                ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
+
+        ht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
+        if (ht_ie && ht_ie[1] >= sizeof(struct ieee80211_ht_operation))
+                assoc_data->ap_ht_param =
+                        ((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
+        else
+                ifmgd->flags |= IEEE80211_STA_DISABLE_11N;
 
         if (bss->wmm_used && bss->uapsd_supported &&
             (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)) {
@@ -3425,8 +3410,8 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                  * Wait up to one beacon interval ...
                  * should this be more if we miss one?
                  */
-                printk(KERN_DEBUG "%s: waiting for beacon from %pM\n",
-                       sdata->name, ifmgd->bssid);
+                pr_debug("%s: waiting for beacon from %pM\n",
+                         sdata->name, ifmgd->bssid);
                 assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
         } else {
                 assoc_data->have_beacon = true;
@@ -3445,8 +3430,8 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                                 corrupt_type = "beacon";
                 } else if (bss->corrupt_data & IEEE80211_BSS_CORRUPT_PROBE_RESP)
                         corrupt_type = "probe response";
-                printk(KERN_DEBUG "%s: associating with AP with corrupt %s\n",
-                       sdata->name, corrupt_type);
+                pr_debug("%s: associating with AP with corrupt %s\n",
+                         sdata->name, corrupt_type);
         }
 
         err = 0;
@@ -3475,9 +3460,8 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
                 return 0;
         }
 
-        printk(KERN_DEBUG
-               "%s: deauthenticating from %pM by local choice (reason=%d)\n",
-               sdata->name, req->bssid, req->reason_code);
+        pr_debug("%s: deauthenticating from %pM by local choice (reason=%d)\n",
+                 sdata->name, req->bssid, req->reason_code);
 
         if (ifmgd->associated &&
             ether_addr_equal(ifmgd->associated->bssid, req->bssid))
@@ -3519,8 +3503,8 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
                 return -ENOLINK;
         }
 
-        printk(KERN_DEBUG "%s: disassociating from %pM by local choice (reason=%d)\n",
-               sdata->name, req->bss->bssid, req->reason_code);
+        pr_debug("%s: disassociating from %pM by local choice (reason=%d)\n",
+                 sdata->name, req->bss->bssid, req->reason_code);
 
         memcpy(bssid, req->bss->bssid, ETH_ALEN);
         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
@@ -3561,10 +3545,3 @@ void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
         cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, gfp);
 }
 EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
-
-unsigned char ieee80211_get_operstate(struct ieee80211_vif *vif)
-{
-        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
-        return sdata->dev->operstate;
-}
-EXPORT_SYMBOL(ieee80211_get_operstate);
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index 935aa4b6deee..abb226dc4753 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -16,6 +16,7 @@
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
 #include "driver-trace.h"
+#include "driver-ops.h"
 
 /*
  * Tell our hardware to disable PS.
@@ -181,34 +182,58 @@ void ieee80211_offchannel_return(struct ieee80211_local *local,
         mutex_unlock(&local->iflist_mtx);
 }
 
+void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc)
+{
+        if (roc->notified)
+                return;
+
+        if (roc->mgmt_tx_cookie) {
+                if (!WARN_ON(!roc->frame)) {
+                        ieee80211_tx_skb(roc->sdata, roc->frame);
+                        roc->frame = NULL;
+                }
+        } else {
+                cfg80211_ready_on_channel(roc->sdata->dev, (unsigned long)roc,
+                                          roc->chan, roc->chan_type,
+                                          roc->req_duration, GFP_KERNEL);
+        }
+
+        roc->notified = true;
+}
+
 static void ieee80211_hw_roc_start(struct work_struct *work)
 {
         struct ieee80211_local *local =
                 container_of(work, struct ieee80211_local, hw_roc_start);
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_roc_work *roc, *dep, *tmp;
 
         mutex_lock(&local->mtx);
 
-        if (!local->hw_roc_channel) {
-                mutex_unlock(&local->mtx);
-                return;
-        }
+        if (list_empty(&local->roc_list))
+                goto out_unlock;
 
-        if (local->hw_roc_skb) {
-                sdata = IEEE80211_DEV_TO_SUB_IF(local->hw_roc_dev);
-                ieee80211_tx_skb(sdata, local->hw_roc_skb);
-                local->hw_roc_skb = NULL;
-        } else {
-                cfg80211_ready_on_channel(local->hw_roc_dev,
-                                          local->hw_roc_cookie,
-                                          local->hw_roc_channel,
-                                          local->hw_roc_channel_type,
-                                          local->hw_roc_duration,
-                                          GFP_KERNEL);
-        }
+        roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work,
+                               list);
+
+        if (!roc->started)
+                goto out_unlock;
 
-        ieee80211_recalc_idle(local);
+        roc->hw_begun = true;
+        roc->hw_start_time = local->hw_roc_start_time;
 
+        ieee80211_handle_roc_started(roc);
+        list_for_each_entry_safe(dep, tmp, &roc->dependents, list) {
+                ieee80211_handle_roc_started(dep);
+
+                if (dep->duration > roc->duration) {
+                        u32 dur = dep->duration;
+                        dep->duration = dur - roc->duration;
+                        roc->duration = dur;
+                        list_del(&dep->list);
+                        list_add(&dep->list, &roc->list);
+                }
+        }
+ out_unlock:
         mutex_unlock(&local->mtx);
 }
 
@@ -216,52 +241,179 @@ void ieee80211_ready_on_channel(struct ieee80211_hw *hw)
 {
         struct ieee80211_local *local = hw_to_local(hw);
 
+        local->hw_roc_start_time = jiffies;
+
         trace_api_ready_on_channel(local);
 
         ieee80211_queue_work(hw, &local->hw_roc_start);
 }
 EXPORT_SYMBOL_GPL(ieee80211_ready_on_channel);
 
-static void ieee80211_hw_roc_done(struct work_struct *work)
+void ieee80211_start_next_roc(struct ieee80211_local *local)
 {
-        struct ieee80211_local *local =
-                container_of(work, struct ieee80211_local, hw_roc_done);
+        struct ieee80211_roc_work *roc;
 
-        mutex_lock(&local->mtx);
+        lockdep_assert_held(&local->mtx);
 
-        if (!local->hw_roc_channel) {
-                mutex_unlock(&local->mtx);
+        if (list_empty(&local->roc_list)) {
+                ieee80211_run_deferred_scan(local);
                 return;
         }
 
-        /* was never transmitted */
-        if (local->hw_roc_skb) {
-                u64 cookie;
+        roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work,
+                               list);
 
-                cookie = local->hw_roc_cookie ^ 2;
+        if (local->ops->remain_on_channel) {
+                int ret, duration = roc->duration;
 
-                cfg80211_mgmt_tx_status(local->hw_roc_dev, cookie,
-                                        local->hw_roc_skb->data,
-                                        local->hw_roc_skb->len, false,
-                                        GFP_KERNEL);
+                /* XXX: duplicated, see ieee80211_start_roc_work() */
+                if (!duration)
+                        duration = 10;
 
-                kfree_skb(local->hw_roc_skb);
-                local->hw_roc_skb = NULL;
-                local->hw_roc_skb_for_status = NULL;
+                ret = drv_remain_on_channel(local, roc->chan,
+                                            roc->chan_type,
+                                            duration);
+
+                roc->started = true;
+
+                if (ret) {
+                        wiphy_warn(local->hw.wiphy,
+                                   "failed to start next HW ROC (%d)\n", ret);
+                        /*
+                         * queue the work struct again to avoid recursion
+                         * when multiple failures occur
+                         */
+                        ieee80211_remain_on_channel_expired(&local->hw);
+                }
+        } else {
+                /* delay it a bit */
+                ieee80211_queue_delayed_work(&local->hw, &roc->work,
+                                             round_jiffies_relative(HZ/2));
+        }
+}
+
+void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc)
+{
+        struct ieee80211_roc_work *dep, *tmp;
+
+        /* was never transmitted */
+        if (roc->frame) {
+                cfg80211_mgmt_tx_status(roc->sdata->dev,
+                                        (unsigned long)roc->frame,
+                                        roc->frame->data, roc->frame->len,
+                                        false, GFP_KERNEL);
+                kfree_skb(roc->frame);
         }
 
-        if (!local->hw_roc_for_tx)
-                cfg80211_remain_on_channel_expired(local->hw_roc_dev,
-                                                   local->hw_roc_cookie,
-                                                   local->hw_roc_channel,
-                                                   local->hw_roc_channel_type,
+        if (!roc->mgmt_tx_cookie)
+                cfg80211_remain_on_channel_expired(roc->sdata->dev,
+                                                   (unsigned long)roc,
+                                                   roc->chan, roc->chan_type,
                                                    GFP_KERNEL);
 
-        local->hw_roc_channel = NULL;
-        local->hw_roc_cookie = 0;
+        list_for_each_entry_safe(dep, tmp, &roc->dependents, list)
+                ieee80211_roc_notify_destroy(dep);
+
+        kfree(roc);
+}
+
+void ieee80211_sw_roc_work(struct work_struct *work)
+{
+        struct ieee80211_roc_work *roc =
+                container_of(work, struct ieee80211_roc_work, work.work);
+        struct ieee80211_sub_if_data *sdata = roc->sdata;
+        struct ieee80211_local *local = sdata->local;
+
+        mutex_lock(&local->mtx);
+
+        if (roc->abort)
+                goto finish;
+
+        if (WARN_ON(list_empty(&local->roc_list)))
+                goto out_unlock;
+
+        if (WARN_ON(roc != list_first_entry(&local->roc_list,
+                                            struct ieee80211_roc_work,
+                                            list)))
+                goto out_unlock;
+
+        if (!roc->started) {
+                struct ieee80211_roc_work *dep;
+
+                /* start this ROC */
 
-        ieee80211_recalc_idle(local);
+                /* switch channel etc */
+                ieee80211_recalc_idle(local);
 
+                local->tmp_channel = roc->chan;
+                local->tmp_channel_type = roc->chan_type;
+                ieee80211_hw_config(local, 0);
+
+                /* tell userspace or send frame */
+                ieee80211_handle_roc_started(roc);
+                list_for_each_entry(dep, &roc->dependents, list)
+                        ieee80211_handle_roc_started(dep);
+
+                /* if it was pure TX, just finish right away */
+                if (!roc->duration)
+                        goto finish;
+
+                roc->started = true;
+                ieee80211_queue_delayed_work(&local->hw, &roc->work,
+                                             msecs_to_jiffies(roc->duration));
+        } else {
+                /* finish this ROC */
+ finish:
+                list_del(&roc->list);
+                ieee80211_roc_notify_destroy(roc);
+
+                if (roc->started) {
+                        drv_flush(local, false);
+
+                        local->tmp_channel = NULL;
+                        ieee80211_hw_config(local, 0);
+
+                        ieee80211_offchannel_return(local, true);
+                }
+
+                ieee80211_recalc_idle(local);
+
+                ieee80211_start_next_roc(local);
+                ieee80211_run_deferred_scan(local);
+        }
+
+ out_unlock:
+        mutex_unlock(&local->mtx);
+}
+
+static void ieee80211_hw_roc_done(struct work_struct *work)
+{
+        struct ieee80211_local *local =
+                container_of(work, struct ieee80211_local, hw_roc_done);
+        struct ieee80211_roc_work *roc;
+
+        mutex_lock(&local->mtx);
+
+        if (list_empty(&local->roc_list))
+                goto out_unlock;
+
+        roc = list_first_entry(&local->roc_list, struct ieee80211_roc_work,
+                               list);
+
+        if (!roc->started)
+                goto out_unlock;
+
+        list_del(&roc->list);
+
+        ieee80211_roc_notify_destroy(roc);
+
+        /* if there's another roc, start it now */
+        ieee80211_start_next_roc(local);
+
+        /* or scan maybe */
+        ieee80211_run_deferred_scan(local);
+
+ out_unlock:
         mutex_unlock(&local->mtx);
 }
 
@@ -275,8 +427,48 @@ void ieee80211_remain_on_channel_expired(struct ieee80211_hw *hw)
 }
 EXPORT_SYMBOL_GPL(ieee80211_remain_on_channel_expired);
 
-void ieee80211_hw_roc_setup(struct ieee80211_local *local)
+void ieee80211_roc_setup(struct ieee80211_local *local)
 {
         INIT_WORK(&local->hw_roc_start, ieee80211_hw_roc_start);
         INIT_WORK(&local->hw_roc_done, ieee80211_hw_roc_done);
+        INIT_LIST_HEAD(&local->roc_list);
+}
+
+void ieee80211_roc_purge(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_roc_work *roc, *tmp;
+        LIST_HEAD(tmp_list);
+
+        mutex_lock(&local->mtx);
+        list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
+                if (roc->sdata != sdata)
+                        continue;
+
+                if (roc->started && local->ops->remain_on_channel) {
+                        /* can race, so ignore return value */
+                        drv_cancel_remain_on_channel(local);
+                }
+
+                list_move_tail(&roc->list, &tmp_list);
+                roc->abort = true;
+        }
+
+        ieee80211_start_next_roc(local);
+        ieee80211_run_deferred_scan(local);
+        mutex_unlock(&local->mtx);
+
+        list_for_each_entry_safe(roc, tmp, &tmp_list, list) {
+                if (local->ops->remain_on_channel) {
+                        list_del(&roc->list);
+                        ieee80211_roc_notify_destroy(roc);
+                } else {
+                        ieee80211_queue_delayed_work(&local->hw, &roc->work, 0);
+
+                        /* work will clean up etc */
+                        flush_delayed_work(&roc->work);
+                }
+        }
+
+        WARN_ON_ONCE(!list_empty(&tmp_list));
 }
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index af1c4e26e965..98c128be3827 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -77,6 +77,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
                 int err = drv_suspend(local, wowlan);
                 if (err < 0) {
                         local->quiescing = false;
+                        local->wowlan = false;
                         return err;
                 } else if (err > 0) {
                         WARN_ON(err != 1);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 7bcecf73aafb..6fd2cb0838c4 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1137,22 +1137,22 @@ static void ap_sta_ps_start(struct sta_info *sta)
         if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
                 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-        printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
-               sdata->name, sta->sta.addr, sta->sta.aid);
+        pr_debug("%s: STA %pM aid %d enters power save mode\n",
+                 sdata->name, sta->sta.addr, sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 }
 
 static void ap_sta_ps_end(struct sta_info *sta)
 {
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-        printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
-               sta->sdata->name, sta->sta.addr, sta->sta.aid);
+        pr_debug("%s: STA %pM aid %d exits power save mode\n",
+                 sta->sdata->name, sta->sta.addr, sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 
         if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-                printk(KERN_DEBUG "%s: STA %pM aid %d driver-ps-blocked\n",
-                       sta->sdata->name, sta->sta.addr, sta->sta.aid);
+                pr_debug("%s: STA %pM aid %d driver-ps-blocked\n",
+                         sta->sdata->name, sta->sta.addr, sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
                 return;
         }
@@ -1387,12 +1387,10 @@ ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                 struct ieee80211_hdr *hdr =
                         (struct ieee80211_hdr *) entry->skb_list.next->data;
-                printk(KERN_DEBUG "%s: RX reassembly removed oldest "
-                       "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
-                       "addr1=%pM addr2=%pM\n",
-                       sdata->name, idx,
-                       jiffies - entry->first_frag_time, entry->seq,
-                       entry->last_frag, hdr->addr1, hdr->addr2);
+                pr_debug("%s: RX reassembly removed oldest fragment entry (idx=%d age=%lu seq=%d last_frag=%d addr1=%pM addr2=%pM\n",
+                         sdata->name, idx,
+                         jiffies - entry->first_frag_time, entry->seq,
+                         entry->last_frag, hdr->addr1, hdr->addr2);
 #endif
                 __skb_queue_purge(&entry->skb_list);
         }
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 169da0742c81..379f178eab5f 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -323,7 +323,7 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,
         ieee80211_mlme_notify_scan_completed(local);
         ieee80211_ibss_notify_scan_completed(local);
         ieee80211_mesh_notify_scan_completed(local);
-        ieee80211_queue_work(&local->hw, &local->work_work);
+        ieee80211_start_next_roc(local);
 }
 
 void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
@@ -376,7 +376,7 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
 static bool ieee80211_can_scan(struct ieee80211_local *local,
                                struct ieee80211_sub_if_data *sdata)
 {
-        if (!list_empty(&local->work_list))
+        if (!list_empty(&local->roc_list))
                 return false;
 
         if (sdata->vif.type == NL80211_IFTYPE_STATION &&
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index de455f8bbb91..77dcf2f89d42 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -333,9 +333,8 @@ static int sta_info_insert_drv_state(struct ieee80211_local *local,
         }
 
         if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
-                printk(KERN_DEBUG
-                       "%s: failed to move IBSS STA %pM to state %d (%d) - keeping it anyway.\n",
-                       sdata->name, sta->sta.addr, state + 1, err);
+                pr_debug("%s: failed to move IBSS STA %pM to state %d (%d) - keeping it anyway\n",
+                         sdata->name, sta->sta.addr, state + 1, err);
                 err = 0;
         }
 
@@ -619,8 +618,7 @@ static bool sta_info_cleanup_expire_buffered_ac(struct ieee80211_local *local,
 
                 local->total_ps_buffered--;
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-                printk(KERN_DEBUG "Buffered frame expired (STA %pM)\n",
-                       sta->sta.addr);
+                pr_debug("Buffered frame expired (STA %pM)\n", sta->sta.addr);
 #endif
                 dev_kfree_skb(skb);
         }
@@ -889,10 +887,8 @@ void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
                         continue;
 
                 if (time_after(jiffies, sta->last_rx + exp_time)) {
-#ifdef CONFIG_MAC80211_IBSS_DEBUG
-                        printk(KERN_DEBUG "%s: expiring inactive STA %pM\n",
-                               sdata->name, sta->sta.addr);
-#endif
+                        ibss_vdbg("%s: expiring inactive STA %pM\n",
+                                  sdata->name, sta->sta.addr);
                         WARN_ON(__sta_info_destroy(sta));
                 }
         }
@@ -991,9 +987,8 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
         sta_info_recalc_tim(sta);
 
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-        printk(KERN_DEBUG "%s: STA %pM aid %d sending %d filtered/%d PS frames "
-               "since STA not sleeping anymore\n", sdata->name,
-               sta->sta.addr, sta->sta.aid, filtered, buffered);
+        pr_debug("%s: STA %pM aid %d sending %d filtered/%d PS frames since STA not sleeping anymore\n",
+                 sdata->name, sta->sta.addr, sta->sta.aid, filtered, buffered);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 }
 
@@ -1385,8 +1380,8 @@ int sta_info_move_state(struct sta_info *sta,
         }
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: moving STA %pM to state %d\n",
-                sta->sdata->name, sta->sta.addr, new_state);
+        pr_debug("%s: moving STA %pM to state %d\n",
+                 sta->sdata->name, sta->sta.addr, new_state);
 #endif
 
         /*
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 28cfa981cfb1..6b4f42527887 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -520,36 +520,16 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
 
         if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX) {
                 u64 cookie = (unsigned long)skb;
+                acked = info->flags & IEEE80211_TX_STAT_ACK;
 
                 if (ieee80211_is_nullfunc(hdr->frame_control) ||
-                    ieee80211_is_qos_nullfunc(hdr->frame_control)) {
-                        acked = info->flags & IEEE80211_TX_STAT_ACK;
-
+                    ieee80211_is_qos_nullfunc(hdr->frame_control))
                         cfg80211_probe_status(skb->dev, hdr->addr1,
                                               cookie, acked, GFP_ATOMIC);
-                } else {
-                        struct ieee80211_work *wk;
-
-                        rcu_read_lock();
-                        list_for_each_entry_rcu(wk, &local->work_list, list) {
-                                if (wk->type != IEEE80211_WORK_OFFCHANNEL_TX)
-                                        continue;
-                                if (wk->offchan_tx.frame != skb)
-                                        continue;
-                                wk->offchan_tx.status = true;
-                                break;
-                        }
-                        rcu_read_unlock();
-                        if (local->hw_roc_skb_for_status == skb) {
-                                cookie = local->hw_roc_cookie ^ 2;
-                                local->hw_roc_skb_for_status = NULL;
-                        }
-
+                else
                         cfg80211_mgmt_tx_status(
                                 skb->dev, cookie, skb->data, skb->len,
-                                !!(info->flags & IEEE80211_TX_STAT_ACK),
-                                GFP_ATOMIC);
-                }
+                                acked, GFP_ATOMIC);
         }
 
         if (unlikely(info->ack_frame_id)) {
@@ -589,7 +569,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         /* send frame to monitor interfaces now */
         rtap_len = ieee80211_tx_radiotap_len(info);
         if (WARN_ON_ONCE(skb_headroom(skb) < rtap_len)) {
-                printk(KERN_ERR "ieee80211_tx_status: headroom too small\n");
+                pr_err("ieee80211_tx_status: headroom too small\n");
                 dev_kfree_skb(skb);
                 return;
         }
diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
index 51077a956a83..68be47ca208f 100644
--- a/net/mac80211/tkip.c
+++ b/net/mac80211/tkip.c
@@ -263,12 +263,11 @@ int ieee80211_tkip_decrypt_data(struct crypto_cipher *tfm,
 #ifdef CONFIG_MAC80211_TKIP_DEBUG
         {
                 int i;
-                printk(KERN_DEBUG "TKIP decrypt: data(len=%zd)", payload_len);
+                pr_debug("TKIP decrypt: data(len=%zd)", payload_len);
                 for (i = 0; i < payload_len; i++)
                         printk(" %02x", payload[i]);
                 printk("\n");
-                printk(KERN_DEBUG "TKIP decrypt: iv16=%04x iv32=%08x\n",
-                       iv16, iv32);
+                pr_debug("TKIP decrypt: iv16=%04x iv32=%08x\n", iv16, iv32);
         }
 #endif
 
@@ -283,11 +282,10 @@ int ieee80211_tkip_decrypt_data(struct crypto_cipher *tfm,
              (iv32 == key->u.tkip.rx[queue].iv32 &&
               iv16 <= key->u.tkip.rx[queue].iv16))) {
 #ifdef CONFIG_MAC80211_TKIP_DEBUG
-                printk(KERN_DEBUG "TKIP replay detected for RX frame from "
-                       "%pM (RX IV (%04x,%02x) <= prev. IV (%04x,%02x)\n",
-                       ta,
-                       iv32, iv16, key->u.tkip.rx[queue].iv32,
-                       key->u.tkip.rx[queue].iv16);
+                pr_debug("TKIP replay detected for RX frame from %pM (RX IV (%04x,%02x) <= prev. IV (%04x,%02x)\n",
+                         ta, iv32, iv16,
+                         key->u.tkip.rx[queue].iv32,
+                         key->u.tkip.rx[queue].iv16);
 #endif
                 return TKIP_DECRYPT_REPLAY;
         }
@@ -306,13 +304,12 @@ int ieee80211_tkip_decrypt_data(struct crypto_cipher *tfm,
                 {
                         int i;
                         u8 key_offset = NL80211_TKIP_DATA_OFFSET_ENCR_KEY;
-                        printk(KERN_DEBUG "TKIP decrypt: Phase1 TA=%pM"
-                               " TK=", ta);
+                        pr_debug("TKIP decrypt: Phase1 TA=%pM TK=", ta);
                         for (i = 0; i < 16; i++)
                                 printk("%02x ",
                                        key->conf.key[key_offset + i]);
                         printk("\n");
-                        printk(KERN_DEBUG "TKIP decrypt: P1K=");
+                        pr_debug("TKIP decrypt: P1K=");
                         for (i = 0; i < 5; i++)
                                 printk("%04x ", key->u.tkip.rx[queue].p1k[i]);
                         printk("\n");
@@ -336,7 +333,7 @@ int ieee80211_tkip_decrypt_data(struct crypto_cipher *tfm,
 #ifdef CONFIG_MAC80211_TKIP_DEBUG
         {
                 int i;
-                printk(KERN_DEBUG "TKIP decrypt: Phase2 rc4key=");
+                pr_debug("TKIP decrypt: Phase2 rc4key=");
                 for (i = 0; i < 16; i++)
                         printk("%02x ", rc4key[i]);
                 printk("\n");
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index e453212fa17f..af25c4e7ec5c 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -297,9 +297,8 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
                 if (unlikely(!assoc &&
                              ieee80211_is_data(hdr->frame_control))) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-                        printk(KERN_DEBUG "%s: dropped data frame to not "
-                               "associated station %pM\n",
-                               tx->sdata->name, hdr->addr1);
+                        pr_debug("%s: dropped data frame to not associated station %pM\n",
+                                 tx->sdata->name, hdr->addr1);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
                         I802_DEBUG_INC(tx->local->tx_handlers_drop_not_assoc);
                         return TX_DROP;
@@ -467,8 +466,8 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                 }
 
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
-                printk(KERN_DEBUG "STA %pM aid %d: PS buffer for AC %d\n",
-                       sta->sta.addr, sta->sta.aid, ac);
+                pr_debug("STA %pM aid %d: PS buffer for AC %d\n",
+                         sta->sta.addr, sta->sta.aid, ac);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
                 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
                         purge_old_ps_buffers(tx->local);
@@ -502,9 +501,8 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
         }
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         else if (unlikely(test_sta_flag(sta, WLAN_STA_PS_STA))) {
-                printk(KERN_DEBUG
-                       "%s: STA %pM in PS mode, but polling/in SP -> send frame\n",
-                       tx->sdata->name, sta->sta.addr);
+                pr_debug("%s: STA %pM in PS mode, but polling/in SP -> send frame\n",
+                         tx->sdata->name, sta->sta.addr);
         }
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 8dd4712620ff..1df4019f294b 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -804,7 +804,7 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_tx_queue_params qparam;
         int ac;
-        bool use_11b;
+        bool use_11b, enable_qos;
         int aCWmin, aCWmax;
 
         if (!local->ops->conf_tx)
@@ -818,6 +818,13 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
         use_11b = (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ) &&
                  !(sdata->flags & IEEE80211_SDATA_OPERATING_GMODE);
 
+        /*
+         * By default disable QoS in STA mode for old access points, which do
+         * not support 802.11e. New APs will provide proper queue parameters,
+         * that we will configure later.
+         */
+        enable_qos = (sdata->vif.type != NL80211_IFTYPE_STATION);
+
         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
                 /* Set defaults according to 802.11-2007 Table 7-37 */
                 aCWmax = 1023;
@@ -826,38 +833,47 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
                 else
                         aCWmin = 15;
 
-                switch (ac) {
-                case IEEE80211_AC_BK:
-                        qparam.cw_max = aCWmax;
-                        qparam.cw_min = aCWmin;
-                        qparam.txop = 0;
-                        qparam.aifs = 7;
-                        break;
-                default: /* never happens but let's not leave undefined */
-                case IEEE80211_AC_BE:
+                if (enable_qos) {
+                        switch (ac) {
+                        case IEEE80211_AC_BK:
+                                qparam.cw_max = aCWmax;
+                                qparam.cw_min = aCWmin;
+                                qparam.txop = 0;
+                                qparam.aifs = 7;
+                                break;
+                        /* never happens but let's not leave undefined */
+                        default:
+                        case IEEE80211_AC_BE:
+                                qparam.cw_max = aCWmax;
+                                qparam.cw_min = aCWmin;
+                                qparam.txop = 0;
+                                qparam.aifs = 3;
+                                break;
+                        case IEEE80211_AC_VI:
+                                qparam.cw_max = aCWmin;
+                                qparam.cw_min = (aCWmin + 1) / 2 - 1;
+                                if (use_11b)
+                                        qparam.txop = 6016/32;
+                                else
+                                        qparam.txop = 3008/32;
+                                qparam.aifs = 2;
+                                break;
+                        case IEEE80211_AC_VO:
+                                qparam.cw_max = (aCWmin + 1) / 2 - 1;
+                                qparam.cw_min = (aCWmin + 1) / 4 - 1;
+                                if (use_11b)
+                                        qparam.txop = 3264/32;
+                                else
+                                        qparam.txop = 1504/32;
+                                qparam.aifs = 2;
+                                break;
+                        }
+                } else {
+                        /* Confiure old 802.11b/g medium access rules. */
                         qparam.cw_max = aCWmax;
                         qparam.cw_min = aCWmin;
                         qparam.txop = 0;
-                        qparam.aifs = 3;
-                        break;
-                case IEEE80211_AC_VI:
-                        qparam.cw_max = aCWmin;
-                        qparam.cw_min = (aCWmin + 1) / 2 - 1;
-                        if (use_11b)
-                                qparam.txop = 6016/32;
-                        else
-                                qparam.txop = 3008/32;
-                        qparam.aifs = 2;
-                        break;
-                case IEEE80211_AC_VO:
-                        qparam.cw_max = (aCWmin + 1) / 2 - 1;
-                        qparam.cw_min = (aCWmin + 1) / 4 - 1;
-                        if (use_11b)
-                                qparam.txop = 3264/32;
-                        else
-                                qparam.txop = 1504/32;
                         qparam.aifs = 2;
-                        break;
                 }
 
                 qparam.uapsd = false;
@@ -866,12 +882,8 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
                 drv_conf_tx(local, sdata, ac, &qparam);
         }
 
-        /* after reinitialize QoS TX queues setting to default,
-         * disable QoS at all */
-
         if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
-                sdata->vif.bss_conf.qos =
-                        sdata->vif.type != NL80211_IFTYPE_STATION;
+                sdata->vif.bss_conf.qos = enable_qos;
                 if (bss_notify)
                         ieee80211_bss_info_change_notify(sdata,
                                                          BSS_CHANGED_QOS);
@@ -1267,14 +1279,19 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         /* add STAs back */
         mutex_lock(&local->sta_mtx);
         list_for_each_entry(sta, &local->sta_list, list) {
-                if (sta->uploaded) {
-                        enum ieee80211_sta_state state;
+                enum ieee80211_sta_state state;
 
-                        for (state = IEEE80211_STA_NOTEXIST;
-                             state < sta->sta_state; state++)
-                                WARN_ON(drv_sta_state(local, sta->sdata, sta,
-                                                      state, state + 1));
-                }
+                if (!sta->uploaded)
+                        continue;
+
+                /* AP-mode stations will be added later */
+                if (sta->sdata->vif.type == NL80211_IFTYPE_AP)
+                        continue;
+
+                for (state = IEEE80211_STA_NOTEXIST;
+                     state < sta->sta_state; state++)
+                        WARN_ON(drv_sta_state(local, sta->sdata, sta, state,
+                                              state + 1));
         }
         mutex_unlock(&local->sta_mtx);
 
@@ -1371,6 +1388,24 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 }
         }
 
+        /* APs are now beaconing, add back stations */
+        mutex_lock(&local->sta_mtx);
+        list_for_each_entry(sta, &local->sta_list, list) {
+                enum ieee80211_sta_state state;
+
+                if (!sta->uploaded)
+                        continue;
+
+                if (sta->sdata->vif.type != NL80211_IFTYPE_AP)
+                        continue;
+
+                for (state = IEEE80211_STA_NOTEXIST;
+                     state < sta->sta_state; state++)
+                        WARN_ON(drv_sta_state(local, sta->sdata, sta, state,
+                                              state + 1));
+        }
+        mutex_unlock(&local->sta_mtx);
+
         /* add back keys */
         list_for_each_entry(sdata, &local->interfaces, list)
                 if (ieee80211_sdata_running(sdata))
diff --git a/net/mac80211/work.c b/net/mac80211/work.c
deleted file mode 100644
index b2650a9d45ff..000000000000
--- a/net/mac80211/work.c
+++ /dev/null
@@ -1,370 +0,0 @@
-/*
- * mac80211 work implementation
- *
- * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
- * Copyright 2004, Instant802 Networks, Inc.
- * Copyright 2005, Devicescape Software, Inc.
- * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
- * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
- * Copyright 2009, Johannes Berg <johannes@sipsolutions.net>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/delay.h>
-#include <linux/if_ether.h>
-#include <linux/skbuff.h>
-#include <linux/if_arp.h>
-#include <linux/etherdevice.h>
-#include <linux/crc32.h>
-#include <linux/slab.h>
-#include <net/mac80211.h>
-#include <asm/unaligned.h>
-
-#include "ieee80211_i.h"
-#include "rate.h"
-#include "driver-ops.h"
-
-enum work_action {
-        WORK_ACT_NONE,
-        WORK_ACT_TIMEOUT,
-};
-
-
-/* utils */
-static inline void ASSERT_WORK_MTX(struct ieee80211_local *local)
-{
-        lockdep_assert_held(&local->mtx);
-}
-
-/*
- * We can have multiple work items (and connection probing)
- * scheduling this timer, but we need to take care to only
- * reschedule it when it should fire _earlier_ than it was
- * asked for before, or if it's not pending right now. This
- * function ensures that. Note that it then is required to
- * run this function for all timeouts after the first one
- * has happened -- the work that runs from this timer will
- * do that.
- */
-static void run_again(struct ieee80211_local *local,
-                      unsigned long timeout)
-{
-        ASSERT_WORK_MTX(local);
-
-        if (!timer_pending(&local->work_timer) ||
-            time_before(timeout, local->work_timer.expires))
-                mod_timer(&local->work_timer, timeout);
-}
-
-void free_work(struct ieee80211_work *wk)
-{
-        kfree_rcu(wk, rcu_head);
-}
-
-static enum work_action __must_check
-ieee80211_remain_on_channel_timeout(struct ieee80211_work *wk)
-{
-        /*
-         * First time we run, do nothing -- the generic code will
-         * have switched to the right channel etc.
-         */
-        if (!wk->started) {
-                wk->timeout = jiffies + msecs_to_jiffies(wk->remain.duration);
-
-                cfg80211_ready_on_channel(wk->sdata->dev, (unsigned long) wk,
-                                          wk->chan, wk->chan_type,
-                                          wk->remain.duration, GFP_KERNEL);
-
-                return WORK_ACT_NONE;
-        }
-
-        return WORK_ACT_TIMEOUT;
-}
-
-static enum work_action __must_check
-ieee80211_offchannel_tx(struct ieee80211_work *wk)
-{
-        if (!wk->started) {
-                wk->timeout = jiffies + msecs_to_jiffies(wk->offchan_tx.wait);
-
-                /*
-                 * After this, offchan_tx.frame remains but now is no
-                 * longer a valid pointer -- we still need it as the
-                 * cookie for canceling this work/status matching.
-                 */
-                ieee80211_tx_skb(wk->sdata, wk->offchan_tx.frame);
-
-                return WORK_ACT_NONE;
-        }
-
-        return WORK_ACT_TIMEOUT;
-}
-
-static void ieee80211_work_timer(unsigned long data)
-{
-        struct ieee80211_local *local = (void *) data;
-
-        if (local->quiescing)
-                return;
-
-        ieee80211_queue_work(&local->hw, &local->work_work);
-}
-
-static void ieee80211_work_work(struct work_struct *work)
-{
-        struct ieee80211_local *local =
-                container_of(work, struct ieee80211_local, work_work);
-        struct ieee80211_work *wk, *tmp;
-        LIST_HEAD(free_work);
-        enum work_action rma;
-        bool remain_off_channel = false;
-
-        /*
-         * ieee80211_queue_work() should have picked up most cases,
-         * here we'll pick the rest.
-         */
-        if (WARN(local->suspended, "work scheduled while going to suspend\n"))
-                return;
-
-        mutex_lock(&local->mtx);
-
-        if (local->scanning) {
-                mutex_unlock(&local->mtx);
-                return;
-        }
-
-        ieee80211_recalc_idle(local);
-
-        list_for_each_entry_safe(wk, tmp, &local->work_list, list) {
-                bool started = wk->started;
-
-                /* mark work as started if it's on the current off-channel */
-                if (!started && local->tmp_channel &&
-                    wk->chan == local->tmp_channel &&
-                    wk->chan_type == local->tmp_channel_type) {
-                        started = true;
-                        wk->timeout = jiffies;
-                }
-
-                if (!started && !local->tmp_channel) {
-                        ieee80211_offchannel_stop_vifs(local, true);
-
-                        local->tmp_channel = wk->chan;
-                        local->tmp_channel_type = wk->chan_type;
-
-                        ieee80211_hw_config(local, 0);
-
-                        started = true;
-                        wk->timeout = jiffies;
-                }
-
-                /* don't try to work with items that aren't started */
-                if (!started)
-                        continue;
-
-                if (time_is_after_jiffies(wk->timeout)) {
-                        /*
-                         * This work item isn't supposed to be worked on
-                         * right now, but take care to adjust the timer
-                         * properly.
-                         */
-                        run_again(local, wk->timeout);
-                        continue;
-                }
-
-                switch (wk->type) {
-                default:
-                        WARN_ON(1);
-                        /* nothing */
-                        rma = WORK_ACT_NONE;
-                        break;
-                case IEEE80211_WORK_ABORT:
-                        rma = WORK_ACT_TIMEOUT;
-                        break;
-                case IEEE80211_WORK_REMAIN_ON_CHANNEL:
-                        rma = ieee80211_remain_on_channel_timeout(wk);
-                        break;
-                case IEEE80211_WORK_OFFCHANNEL_TX:
-                        rma = ieee80211_offchannel_tx(wk);
-                        break;
-                }
-
-                wk->started = started;
-
-                switch (rma) {
-                case WORK_ACT_NONE:
-                        /* might have changed the timeout */
-                        run_again(local, wk->timeout);
-                        break;
-                case WORK_ACT_TIMEOUT:
-                        list_del_rcu(&wk->list);
-                        synchronize_rcu();
-                        list_add(&wk->list, &free_work);
-                        break;
-                default:
-                        WARN(1, "unexpected: %d", rma);
-                }
-        }
-
-        list_for_each_entry(wk, &local->work_list, list) {
-                if (!wk->started)
-                        continue;
-                if (wk->chan != local->tmp_channel ||
-                    wk->chan_type != local->tmp_channel_type)
-                        continue;
-                remain_off_channel = true;
-        }
-
-        if (!remain_off_channel && local->tmp_channel) {
-                local->tmp_channel = NULL;
-                ieee80211_hw_config(local, 0);
-
-                ieee80211_offchannel_return(local, true);
-
-                /* give connection some time to breathe */
-                run_again(local, jiffies + HZ/2);
-        }
-
-        ieee80211_recalc_idle(local);
-        ieee80211_run_deferred_scan(local);
-
-        mutex_unlock(&local->mtx);
-
-        list_for_each_entry_safe(wk, tmp, &free_work, list) {
-                wk->done(wk, NULL);
-                list_del(&wk->list);
-                kfree(wk);
-        }
-}
-
-void ieee80211_add_work(struct ieee80211_work *wk)
-{
-        struct ieee80211_local *local;
-
-        if (WARN_ON(!wk->chan))
-                return;
-
-        if (WARN_ON(!wk->sdata))
-                return;
-
-        if (WARN_ON(!wk->done))
-                return;
-
-        if (WARN_ON(!ieee80211_sdata_running(wk->sdata)))
-                return;
-
-        wk->started = false;
-
-        local = wk->sdata->local;
-        mutex_lock(&local->mtx);
-        list_add_tail(&wk->list, &local->work_list);
-        mutex_unlock(&local->mtx);
-
-        ieee80211_queue_work(&local->hw, &local->work_work);
-}
-
-void ieee80211_work_init(struct ieee80211_local *local)
-{
-        INIT_LIST_HEAD(&local->work_list);
-        setup_timer(&local->work_timer, ieee80211_work_timer,
-                    (unsigned long)local);
-        INIT_WORK(&local->work_work, ieee80211_work_work);
-}
-
-void ieee80211_work_purge(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_work *wk;
-        bool cleanup = false;
-
-        mutex_lock(&local->mtx);
-        list_for_each_entry(wk, &local->work_list, list) {
-                if (wk->sdata != sdata)
-                        continue;
-                cleanup = true;
-                wk->type = IEEE80211_WORK_ABORT;
-                wk->started = true;
-                wk->timeout = jiffies;
-        }
-        mutex_unlock(&local->mtx);
-
-        /* run cleanups etc. */
-        if (cleanup)
-                ieee80211_work_work(&local->work_work);
-
-        mutex_lock(&local->mtx);
-        list_for_each_entry(wk, &local->work_list, list) {
-                if (wk->sdata != sdata)
-                        continue;
-                WARN_ON(1);
-                break;
-        }
-        mutex_unlock(&local->mtx);
-}
-
-static enum work_done_result ieee80211_remain_done(struct ieee80211_work *wk,
-                                                   struct sk_buff *skb)
-{
-        /*
-         * We are done serving the remain-on-channel command.
-         */
-        cfg80211_remain_on_channel_expired(wk->sdata->dev, (unsigned long) wk,
-                                           wk->chan, wk->chan_type,
-                                           GFP_KERNEL);
-
-        return WORK_DONE_DESTROY;
-}
-
-int ieee80211_wk_remain_on_channel(struct ieee80211_sub_if_data *sdata,
-                                   struct ieee80211_channel *chan,
-                                   enum nl80211_channel_type channel_type,
-                                   unsigned int duration, u64 *cookie)
-{
-        struct ieee80211_work *wk;
-
-        wk = kzalloc(sizeof(*wk), GFP_KERNEL);
-        if (!wk)
-                return -ENOMEM;
-
-        wk->type = IEEE80211_WORK_REMAIN_ON_CHANNEL;
-        wk->chan = chan;
-        wk->chan_type = channel_type;
-        wk->sdata = sdata;
-        wk->done = ieee80211_remain_done;
-
-        wk->remain.duration = duration;
-
-        *cookie = (unsigned long) wk;
-
-        ieee80211_add_work(wk);
-
-        return 0;
-}
-
-int ieee80211_wk_cancel_remain_on_channel(struct ieee80211_sub_if_data *sdata,
-                                          u64 cookie)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_work *wk, *tmp;
-        bool found = false;
-
-        mutex_lock(&local->mtx);
-        list_for_each_entry_safe(wk, tmp, &local->work_list, list) {
-                if ((unsigned long) wk == cookie) {
-                        wk->timeout = jiffies;
-                        found = true;
-                        break;
-                }
-        }
-        mutex_unlock(&local->mtx);
-
-        if (!found)
-                return -ENOENT;
-
-        ieee80211_queue_work(&local->hw, &local->work_work);
-
-        return 0;
-}
diff --git a/net/nfc/core.c b/net/nfc/core.c
index 9f6ce011d35d..4177bb5104b9 100644
--- a/net/nfc/core.c
+++ b/net/nfc/core.c
@@ -121,14 +121,14 @@ error:
  * The device remains polling for targets until a target is found or
  * the nfc_stop_poll function is called.
  */
-int nfc_start_poll(struct nfc_dev *dev, u32 protocols)
+int nfc_start_poll(struct nfc_dev *dev, u32 im_protocols, u32 tm_protocols)
 {
         int rc;
 
-        pr_debug("dev_name=%s protocols=0x%x\n",
-                 dev_name(&dev->dev), protocols);
+        pr_debug("dev_name %s initiator protocols 0x%x target protocols 0x%x\n",
+                 dev_name(&dev->dev), im_protocols, tm_protocols);
 
-        if (!protocols)
+        if (!im_protocols && !tm_protocols)
                 return -EINVAL;
 
         device_lock(&dev->dev);
@@ -143,9 +143,11 @@ int nfc_start_poll(struct nfc_dev *dev, u32 protocols)
                 goto error;
         }
 
-        rc = dev->ops->start_poll(dev, protocols);
-        if (!rc)
+        rc = dev->ops->start_poll(dev, im_protocols, tm_protocols);
+        if (!rc) {
                 dev->polling = true;
+                dev->rf_mode = NFC_RF_NONE;
+        }
 
 error:
         device_unlock(&dev->dev);
@@ -235,8 +237,10 @@ int nfc_dep_link_up(struct nfc_dev *dev, int target_index, u8 comm_mode)
         }
 
         rc = dev->ops->dep_link_up(dev, target, comm_mode, gb, gb_len);
-        if (!rc)
+        if (!rc) {
                 dev->active_target = target;
+                dev->rf_mode = NFC_RF_INITIATOR;
+        }
 
 error:
         device_unlock(&dev->dev);
@@ -264,11 +268,6 @@ int nfc_dep_link_down(struct nfc_dev *dev)
                 goto error;
         }
 
-        if (dev->dep_rf_mode == NFC_RF_TARGET) {
-                rc = -EOPNOTSUPP;
-                goto error;
-        }
-
         rc = dev->ops->dep_link_down(dev);
         if (!rc) {
                 dev->dep_link_up = false;
@@ -286,7 +285,6 @@ int nfc_dep_link_is_up(struct nfc_dev *dev, u32 target_idx,
                        u8 comm_mode, u8 rf_mode)
 {
         dev->dep_link_up = true;
-        dev->dep_rf_mode = rf_mode;
 
         nfc_llcp_mac_is_up(dev, target_idx, comm_mode, rf_mode);
 
@@ -330,6 +328,7 @@ int nfc_activate_target(struct nfc_dev *dev, u32 target_idx, u32 protocol)
         rc = dev->ops->activate_target(dev, target, protocol);
         if (!rc) {
                 dev->active_target = target;
+                dev->rf_mode = NFC_RF_INITIATOR;
 
                 if (dev->ops->check_presence)
                         mod_timer(&dev->check_pres_timer, jiffies +
@@ -409,27 +408,30 @@ int nfc_data_exchange(struct nfc_dev *dev, u32 target_idx, struct sk_buff *skb,
                 goto error;
         }
 
-        if (dev->active_target == NULL) {
-                rc = -ENOTCONN;
-                kfree_skb(skb);
-                goto error;
-        }
+        if (dev->rf_mode == NFC_RF_INITIATOR && dev->active_target != NULL) {
+                if (dev->active_target->idx != target_idx) {
+                        rc = -EADDRNOTAVAIL;
+                        kfree_skb(skb);
+                        goto error;
+                }
 
-        if (dev->active_target->idx != target_idx) {
-                rc = -EADDRNOTAVAIL;
+                if (dev->ops->check_presence)
+                        del_timer_sync(&dev->check_pres_timer);
+
+                rc = dev->ops->im_transceive(dev, dev->active_target, skb, cb,
+                                             cb_context);
+
+                if (!rc && dev->ops->check_presence)
+                        mod_timer(&dev->check_pres_timer, jiffies +
+                                  msecs_to_jiffies(NFC_CHECK_PRES_FREQ_MS));
+        } else if (dev->rf_mode == NFC_RF_TARGET && dev->ops->tm_send != NULL) {
+                rc = dev->ops->tm_send(dev, skb);
+        } else {
+                rc = -ENOTCONN;
                 kfree_skb(skb);
                 goto error;
         }
 
-        if (dev->ops->check_presence)
-                del_timer_sync(&dev->check_pres_timer);
-
-        rc = dev->ops->data_exchange(dev, dev->active_target, skb, cb,
-                                     cb_context);
-
-        if (!rc && dev->ops->check_presence)
-                mod_timer(&dev->check_pres_timer, jiffies +
-                          msecs_to_jiffies(NFC_CHECK_PRES_FREQ_MS));
 
 error:
         device_unlock(&dev->dev);
@@ -447,6 +449,63 @@ int nfc_set_remote_general_bytes(struct nfc_dev *dev, u8 *gb, u8 gb_len)
 }
 EXPORT_SYMBOL(nfc_set_remote_general_bytes);
 
+u8 *nfc_get_local_general_bytes(struct nfc_dev *dev, size_t *gb_len)
+{
+        pr_debug("dev_name=%s\n", dev_name(&dev->dev));
+
+        return nfc_llcp_general_bytes(dev, gb_len);
+}
+EXPORT_SYMBOL(nfc_get_local_general_bytes);
+
+int nfc_tm_data_received(struct nfc_dev *dev, struct sk_buff *skb)
+{
+        /* Only LLCP target mode for now */
+        if (dev->dep_link_up == false) {
+                kfree_skb(skb);
+                return -ENOLINK;
+        }
+
+        return nfc_llcp_data_received(dev, skb);
+}
+EXPORT_SYMBOL(nfc_tm_data_received);
+
+int nfc_tm_activated(struct nfc_dev *dev, u32 protocol, u8 comm_mode,
+                     u8 *gb, size_t gb_len)
+{
+        int rc;
+
+        device_lock(&dev->dev);
+
+        dev->polling = false;
+
+        if (gb != NULL) {
+                rc = nfc_set_remote_general_bytes(dev, gb, gb_len);
+                if (rc < 0)
+                        goto out;
+        }
+
+        dev->rf_mode = NFC_RF_TARGET;
+
+        if (protocol == NFC_PROTO_NFC_DEP_MASK)
+                nfc_dep_link_is_up(dev, 0, comm_mode, NFC_RF_TARGET);
+
+        rc = nfc_genl_tm_activated(dev, protocol);
+
+out:
+        device_unlock(&dev->dev);
+
+        return rc;
+}
+EXPORT_SYMBOL(nfc_tm_activated);
+
+int nfc_tm_deactivated(struct nfc_dev *dev)
+{
+        dev->dep_link_up = false;
+
+        return nfc_genl_tm_deactivated(dev);
+}
+EXPORT_SYMBOL(nfc_tm_deactivated);
+
 /**
  * nfc_alloc_send_skb - allocate a skb for data exchange responses
  *
@@ -678,7 +737,7 @@ struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
         struct nfc_dev *dev;
 
         if (!ops->start_poll || !ops->stop_poll || !ops->activate_target ||
-            !ops->deactivate_target || !ops->data_exchange)
+            !ops->deactivate_target || !ops->im_transceive)
                 return NULL;
 
         if (!supported_protocols)
diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c
index e1a640d2b588..a8b0b71e8f86 100644
--- a/net/nfc/hci/core.c
+++ b/net/nfc/hci/core.c
@@ -481,12 +481,13 @@ static int hci_dev_down(struct nfc_dev *nfc_dev)
         return 0;
 }
 
-static int hci_start_poll(struct nfc_dev *nfc_dev, u32 protocols)
+static int hci_start_poll(struct nfc_dev *nfc_dev,
+                          u32 im_protocols, u32 tm_protocols)
 {
         struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
 
         if (hdev->ops->start_poll)
-                return hdev->ops->start_poll(hdev, protocols);
+                return hdev->ops->start_poll(hdev, im_protocols, tm_protocols);
         else
                 return nfc_hci_send_event(hdev, NFC_HCI_RF_READER_A_GATE,
                                        NFC_HCI_EVT_READER_REQUESTED, NULL, 0);
@@ -511,9 +512,9 @@ static void hci_deactivate_target(struct nfc_dev *nfc_dev,
 {
 }
 
-static int hci_data_exchange(struct nfc_dev *nfc_dev, struct nfc_target *target,
-                             struct sk_buff *skb, data_exchange_cb_t cb,
-                             void *cb_context)
+static int hci_transceive(struct nfc_dev *nfc_dev, struct nfc_target *target,
+                          struct sk_buff *skb, data_exchange_cb_t cb,
+                          void *cb_context)
 {
         struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
         int r;
@@ -579,7 +580,7 @@ static struct nfc_ops hci_nfc_ops = {
         .stop_poll = hci_stop_poll,
         .activate_target = hci_activate_target,
         .deactivate_target = hci_deactivate_target,
-        .data_exchange = hci_data_exchange,
+        .im_transceive = hci_transceive,
         .check_presence = hci_check_presence,
 };
 
diff --git a/net/nfc/hci/shdlc.c b/net/nfc/hci/shdlc.c
index 5665dc6d893a..6b836e6242b7 100644
--- a/net/nfc/hci/shdlc.c
+++ b/net/nfc/hci/shdlc.c
@@ -765,14 +765,16 @@ static int nfc_shdlc_xmit(struct nfc_hci_dev *hdev, struct sk_buff *skb)
         return 0;
 }
 
-static int nfc_shdlc_start_poll(struct nfc_hci_dev *hdev, u32 protocols)
+static int nfc_shdlc_start_poll(struct nfc_hci_dev *hdev,
+                                u32 im_protocols, u32 tm_protocols)
 {
         struct nfc_shdlc *shdlc = nfc_hci_get_clientdata(hdev);
 
         pr_debug("\n");
 
         if (shdlc->ops->start_poll)
-                return shdlc->ops->start_poll(shdlc, protocols);
+                return shdlc->ops->start_poll(shdlc,
+                                              im_protocols, tm_protocols);
 
         return 0;
 }
diff --git a/net/nfc/llcp/commands.c b/net/nfc/llcp/commands.c
index bf8ae4f0b90c..b982b5b890d7 100644
--- a/net/nfc/llcp/commands.c
+++ b/net/nfc/llcp/commands.c
@@ -51,7 +51,7 @@ static u8 llcp_tlv8(u8 *tlv, u8 type)
         return tlv[2];
 }
 
-static u8 llcp_tlv16(u8 *tlv, u8 type)
+static u16 llcp_tlv16(u8 *tlv, u8 type)
 {
         if (tlv[0] != type || tlv[1] != llcp_tlv_length[tlv[0]])
                 return 0;
@@ -67,7 +67,7 @@ static u8 llcp_tlv_version(u8 *tlv)
 
 static u16 llcp_tlv_miux(u8 *tlv)
 {
-        return llcp_tlv16(tlv, LLCP_TLV_MIUX) & 0x7f;
+        return llcp_tlv16(tlv, LLCP_TLV_MIUX) & 0x7ff;
 }
 
 static u16 llcp_tlv_wks(u8 *tlv)
@@ -117,8 +117,8 @@ u8 *nfc_llcp_build_tlv(u8 type, u8 *value, u8 value_length, u8 *tlv_length)
         return tlv;
 }
 
-int nfc_llcp_parse_tlv(struct nfc_llcp_local *local,
-                       u8 *tlv_array, u16 tlv_array_len)
+int nfc_llcp_parse_gb_tlv(struct nfc_llcp_local *local,
+                          u8 *tlv_array, u16 tlv_array_len)
 {
         u8 *tlv = tlv_array, type, length, offset = 0;
 
@@ -149,8 +149,45 @@ int nfc_llcp_parse_tlv(struct nfc_llcp_local *local,
                 case LLCP_TLV_OPT:
                         local->remote_opt = llcp_tlv_opt(tlv);
                         break;
+                default:
+                        pr_err("Invalid gt tlv value 0x%x\n", type);
+                        break;
+                }
+
+                offset += length + 2;
+                tlv += length + 2;
+        }
+
+        pr_debug("version 0x%x miu %d lto %d opt 0x%x wks 0x%x\n",
+                 local->remote_version, local->remote_miu,
+                 local->remote_lto, local->remote_opt,
+                 local->remote_wks);
+
+        return 0;
+}
+
+int nfc_llcp_parse_connection_tlv(struct nfc_llcp_sock *sock,
+                                  u8 *tlv_array, u16 tlv_array_len)
+{
+        u8 *tlv = tlv_array, type, length, offset = 0;
+
+        pr_debug("TLV array length %d\n", tlv_array_len);
+
+        if (sock == NULL)
+                return -ENOTCONN;
+
+        while (offset < tlv_array_len) {
+                type = tlv[0];
+                length = tlv[1];
+
+                pr_debug("type 0x%x length %d\n", type, length);
+
+                switch (type) {
+                case LLCP_TLV_MIUX:
+                        sock->miu = llcp_tlv_miux(tlv) + 128;
+                        break;
                 case LLCP_TLV_RW:
-                        local->remote_rw = llcp_tlv_rw(tlv);
+                        sock->rw = llcp_tlv_rw(tlv);
                         break;
                 case LLCP_TLV_SN:
                         break;
@@ -163,10 +200,7 @@ int nfc_llcp_parse_tlv(struct nfc_llcp_local *local,
                 tlv += length + 2;
         }
 
-        pr_debug("version 0x%x miu %d lto %d opt 0x%x wks 0x%x rw %d\n",
-                 local->remote_version, local->remote_miu,
-                 local->remote_lto, local->remote_opt,
-                 local->remote_wks, local->remote_rw);
+        pr_debug("sock %p rw %d miu %d\n", sock, sock->rw, sock->miu);
 
         return 0;
 }
@@ -474,7 +508,7 @@ int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
 
         while (remaining_len > 0) {
 
-                frag_len = min_t(size_t, local->remote_miu, remaining_len);
+                frag_len = min_t(size_t, sock->miu, remaining_len);
 
                 pr_debug("Fragment %zd bytes remaining %zd",
                          frag_len, remaining_len);
diff --git a/net/nfc/llcp/llcp.c b/net/nfc/llcp/llcp.c
index 42994fac26d6..5d503eeb15a1 100644
--- a/net/nfc/llcp/llcp.c
+++ b/net/nfc/llcp/llcp.c
@@ -31,47 +31,41 @@ static u8 llcp_magic[3] = {0x46, 0x66, 0x6d};
 
 static struct list_head llcp_devices;
 
-static void nfc_llcp_socket_release(struct nfc_llcp_local *local)
+void nfc_llcp_sock_link(struct llcp_sock_list *l, struct sock *sk)
 {
-        struct nfc_llcp_sock *parent, *s, *n;
-        struct sock *sk, *parent_sk;
-        int i;
-
-        mutex_lock(&local->socket_lock);
-
-        for (i = 0; i < LLCP_MAX_SAP; i++) {
-                parent = local->sockets[i];
-                if (parent == NULL)
-                        continue;
-
-                /* Release all child sockets */
-                list_for_each_entry_safe(s, n, &parent->list, list) {
-                        list_del_init(&s->list);
-                        sk = &s->sk;
-
-                        lock_sock(sk);
-
-                        if (sk->sk_state == LLCP_CONNECTED)
-                                nfc_put_device(s->dev);
+        write_lock(&l->lock);
+        sk_add_node(sk, &l->head);
+        write_unlock(&l->lock);
+}
 
-                        sk->sk_state = LLCP_CLOSED;
+void nfc_llcp_sock_unlink(struct llcp_sock_list *l, struct sock *sk)
+{
+        write_lock(&l->lock);
+        sk_del_node_init(sk);
+        write_unlock(&l->lock);
+}
 
-                        release_sock(sk);
+static void nfc_llcp_socket_release(struct nfc_llcp_local *local)
+{
+        struct sock *sk;
+        struct hlist_node *node, *tmp;
+        struct nfc_llcp_sock *llcp_sock;
 
-                        sock_orphan(sk);
+        write_lock(&local->sockets.lock);
 
-                        s->local = NULL;
-                }
+        sk_for_each_safe(sk, node, tmp, &local->sockets.head) {
+                llcp_sock = nfc_llcp_sock(sk);
 
-                parent_sk = &parent->sk;
+                lock_sock(sk);
 
-                lock_sock(parent_sk);
+                if (sk->sk_state == LLCP_CONNECTED)
+                        nfc_put_device(llcp_sock->dev);
 
-                if (parent_sk->sk_state == LLCP_LISTEN) {
+                if (sk->sk_state == LLCP_LISTEN) {
                         struct nfc_llcp_sock *lsk, *n;
                         struct sock *accept_sk;
 
-                        list_for_each_entry_safe(lsk, n, &parent->accept_queue,
+                        list_for_each_entry_safe(lsk, n, &llcp_sock->accept_queue,
                                                  accept_queue) {
                                 accept_sk = &lsk->sk;
                                 lock_sock(accept_sk);
@@ -83,24 +77,53 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local)
                                 release_sock(accept_sk);
 
                                 sock_orphan(accept_sk);
-
-                                lsk->local = NULL;
                         }
                 }
 
-                if (parent_sk->sk_state == LLCP_CONNECTED)
-                        nfc_put_device(parent->dev);
-
-                parent_sk->sk_state = LLCP_CLOSED;
+                sk->sk_state = LLCP_CLOSED;
 
-                release_sock(parent_sk);
+                release_sock(sk);
 
-                sock_orphan(parent_sk);
+                sock_orphan(sk);
 
-                parent->local = NULL;
+                sk_del_node_init(sk);
         }
 
-        mutex_unlock(&local->socket_lock);
+        write_unlock(&local->sockets.lock);
+}
+
+struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local)
+{
+        kref_get(&local->ref);
+
+        return local;
+}
+
+static void local_release(struct kref *ref)
+{
+        struct nfc_llcp_local *local;
+
+        local = container_of(ref, struct nfc_llcp_local, ref);
+
+        list_del(&local->list);
+        nfc_llcp_socket_release(local);
+        del_timer_sync(&local->link_timer);
+        skb_queue_purge(&local->tx_queue);
+        destroy_workqueue(local->tx_wq);
+        destroy_workqueue(local->rx_wq);
+        destroy_workqueue(local->timeout_wq);
+        kfree_skb(local->rx_pending);
+        kfree(local);
+}
+
+int nfc_llcp_local_put(struct nfc_llcp_local *local)
+{
+        WARN_ON(local == NULL);
+
+        if (local == NULL)
+                return 0;
+
+        return kref_put(&local->ref, local_release);
 }
 
 static void nfc_llcp_clear_sdp(struct nfc_llcp_local *local)
@@ -384,31 +407,9 @@ int nfc_llcp_set_remote_gb(struct nfc_dev *dev, u8 *gb, u8 gb_len)
                 return -EINVAL;
         }
 
-        return nfc_llcp_parse_tlv(local,
-                                  &local->remote_gb[3],
-                                  local->remote_gb_len - 3);
-}
-
-static void nfc_llcp_tx_work(struct work_struct *work)
-{
-        struct nfc_llcp_local *local = container_of(work, struct nfc_llcp_local,
-                                                    tx_work);
-        struct sk_buff *skb;
-
-        skb = skb_dequeue(&local->tx_queue);
-        if (skb != NULL) {
-                pr_debug("Sending pending skb\n");
-                print_hex_dump(KERN_DEBUG, "LLCP Tx: ", DUMP_PREFIX_OFFSET,
-                               16, 1, skb->data, skb->len, true);
-
-                nfc_data_exchange(local->dev, local->target_idx,
-                                  skb, nfc_llcp_recv, local);
-        } else {
-                nfc_llcp_send_symm(local->dev);
-        }
-
-        mod_timer(&local->link_timer,
-                  jiffies + msecs_to_jiffies(local->remote_lto));
+        return nfc_llcp_parse_gb_tlv(local,
+                                     &local->remote_gb[3],
+                                     local->remote_gb_len - 3);
 }
 
 static u8 nfc_llcp_dsap(struct sk_buff *pdu)
@@ -443,46 +444,146 @@ static void nfc_llcp_set_nrns(struct nfc_llcp_sock *sock, struct sk_buff *pdu)
         sock->recv_ack_n = (sock->recv_n - 1) % 16;
 }
 
+static void nfc_llcp_tx_work(struct work_struct *work)
+{
+        struct nfc_llcp_local *local = container_of(work, struct nfc_llcp_local,
+                                                    tx_work);
+        struct sk_buff *skb;
+        struct sock *sk;
+        struct nfc_llcp_sock *llcp_sock;
+
+        skb = skb_dequeue(&local->tx_queue);
+        if (skb != NULL) {
+                sk = skb->sk;
+                llcp_sock = nfc_llcp_sock(sk);
+                if (llcp_sock != NULL) {
+                        int ret;
+
+                        pr_debug("Sending pending skb\n");
+                        print_hex_dump(KERN_DEBUG, "LLCP Tx: ",
+                                       DUMP_PREFIX_OFFSET, 16, 1,
+                                       skb->data, skb->len, true);
+
+                        ret = nfc_data_exchange(local->dev, local->target_idx,
+                                                skb, nfc_llcp_recv, local);
+
+                        if (!ret && nfc_llcp_ptype(skb) == LLCP_PDU_I) {
+                                skb = skb_get(skb);
+                                skb_queue_tail(&llcp_sock->tx_pending_queue,
+                                               skb);
+                        }
+                } else {
+                        nfc_llcp_send_symm(local->dev);
+                }
+        } else {
+                nfc_llcp_send_symm(local->dev);
+        }
+
+        mod_timer(&local->link_timer,
+                  jiffies + msecs_to_jiffies(2 * local->remote_lto));
+}
+
+static struct nfc_llcp_sock *nfc_llcp_connecting_sock_get(struct nfc_llcp_local *local,
+                                                          u8 ssap)
+{
+        struct sock *sk;
+        struct nfc_llcp_sock *llcp_sock;
+        struct hlist_node *node;
+
+        read_lock(&local->connecting_sockets.lock);
+
+        sk_for_each(sk, node, &local->connecting_sockets.head) {
+                llcp_sock = nfc_llcp_sock(sk);
+
+                if (llcp_sock->ssap == ssap) {
+                        sock_hold(&llcp_sock->sk);
+                        goto out;
+                }
+        }
+
+        llcp_sock = NULL;
+
+out:
+        read_unlock(&local->connecting_sockets.lock);
+
+        return llcp_sock;
+}
+
 static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local,
                                                u8 ssap, u8 dsap)
 {
-        struct nfc_llcp_sock *sock, *llcp_sock, *n;
+        struct sock *sk;
+        struct hlist_node *node;
+        struct nfc_llcp_sock *llcp_sock;
 
         pr_debug("ssap dsap %d %d\n", ssap, dsap);
 
         if (ssap == 0 && dsap == 0)
                 return NULL;
 
-        mutex_lock(&local->socket_lock);
-        sock = local->sockets[ssap];
-        if (sock == NULL) {
-                mutex_unlock(&local->socket_lock);
-                return NULL;
-        }
+        read_lock(&local->sockets.lock);
 
-        pr_debug("root dsap %d (%d)\n", sock->dsap, dsap);
+        llcp_sock = NULL;
 
-        if (sock->dsap == dsap) {
-                sock_hold(&sock->sk);
-                mutex_unlock(&local->socket_lock);
-                return sock;
+        sk_for_each(sk, node, &local->sockets.head) {
+                llcp_sock = nfc_llcp_sock(sk);
+
+                if (llcp_sock->ssap == ssap &&
+                    llcp_sock->dsap == dsap)
+                        break;
         }
 
-        list_for_each_entry_safe(llcp_sock, n, &sock->list, list) {
-                pr_debug("llcp_sock %p sk %p dsap %d\n", llcp_sock,
-                         &llcp_sock->sk, llcp_sock->dsap);
-                if (llcp_sock->dsap == dsap) {
-                        sock_hold(&llcp_sock->sk);
-                        mutex_unlock(&local->socket_lock);
-                        return llcp_sock;
-                }
+        read_unlock(&local->sockets.lock);
+
+        if (llcp_sock == NULL)
+                return NULL;
+
+        sock_hold(&llcp_sock->sk);
+
+        return llcp_sock;
+}
+
+static struct nfc_llcp_sock *nfc_llcp_sock_get_sn(struct nfc_llcp_local *local,
+                                                  u8 *sn, size_t sn_len)
+{
+        struct sock *sk;
+        struct hlist_node *node;
+        struct nfc_llcp_sock *llcp_sock;
+
+        pr_debug("sn %zd\n", sn_len);
+
+        if (sn == NULL || sn_len == 0)
+                return NULL;
+
+        read_lock(&local->sockets.lock);
+
+        llcp_sock = NULL;
+
+        sk_for_each(sk, node, &local->sockets.head) {
+                llcp_sock = nfc_llcp_sock(sk);
+
+                if (llcp_sock->sk.sk_state != LLCP_LISTEN)
+                        continue;
+
+                if (llcp_sock->service_name == NULL ||
+                    llcp_sock->service_name_len == 0)
+                        continue;
+
+                if (llcp_sock->service_name_len != sn_len)
+                        continue;
+
+                if (memcmp(sn, llcp_sock->service_name, sn_len) == 0)
+                        break;
         }
 
-        pr_err("Could not find socket for %d %d\n", ssap, dsap);
+        read_unlock(&local->sockets.lock);
 
-        mutex_unlock(&local->socket_lock);
+        if (llcp_sock == NULL)
+                return NULL;
 
-        return NULL;
+        sock_hold(&llcp_sock->sk);
+
+        return llcp_sock;
 }
 
 static void nfc_llcp_sock_put(struct nfc_llcp_sock *sock)
@@ -518,35 +619,19 @@ static void nfc_llcp_recv_connect(struct nfc_llcp_local *local,
 {
         struct sock *new_sk, *parent;
         struct nfc_llcp_sock *sock, *new_sock;
-        u8 dsap, ssap, bound_sap, reason;
+        u8 dsap, ssap, reason;
 
         dsap = nfc_llcp_dsap(skb);
         ssap = nfc_llcp_ssap(skb);
 
         pr_debug("%d %d\n", dsap, ssap);
 
-        nfc_llcp_parse_tlv(local, &skb->data[LLCP_HEADER_SIZE],
-                           skb->len - LLCP_HEADER_SIZE);
-
         if (dsap != LLCP_SAP_SDP) {
-                bound_sap = dsap;
-
-                mutex_lock(&local->socket_lock);
-                sock = local->sockets[dsap];
-                if (sock == NULL) {
-                        mutex_unlock(&local->socket_lock);
+                sock = nfc_llcp_sock_get(local, dsap, LLCP_SAP_SDP);
+                if (sock == NULL || sock->sk.sk_state != LLCP_LISTEN) {
                         reason = LLCP_DM_NOBOUND;
                         goto fail;
                 }
-
-                sock_hold(&sock->sk);
-                mutex_unlock(&local->socket_lock);
-
-                lock_sock(&sock->sk);
-
-                if (sock->dsap == LLCP_SAP_SDP &&
-                    sock->sk.sk_state == LLCP_LISTEN)
-                        goto enqueue;
         } else {
                 u8 *sn;
                 size_t sn_len;
@@ -559,40 +644,15 @@ static void nfc_llcp_recv_connect(struct nfc_llcp_local *local,
 
                 pr_debug("Service name length %zu\n", sn_len);
 
-                mutex_lock(&local->socket_lock);
-                for (bound_sap = 0; bound_sap < LLCP_LOCAL_SAP_OFFSET;
-                     bound_sap++) {
-                        sock = local->sockets[bound_sap];
-                        if (sock == NULL)
-                                continue;
-
-                        if (sock->service_name == NULL ||
-                            sock->service_name_len == 0)
-                                        continue;
-
-                        if (sock->service_name_len != sn_len)
-                                continue;
-
-                        if (sock->dsap == LLCP_SAP_SDP &&
-                            sock->sk.sk_state == LLCP_LISTEN &&
-                            !memcmp(sn, sock->service_name, sn_len)) {
-                                pr_debug("Found service name at SAP %d\n",
-                                         bound_sap);
-                                sock_hold(&sock->sk);
-                                mutex_unlock(&local->socket_lock);
-
-                                lock_sock(&sock->sk);
-
-                                goto enqueue;
-                        }
+                sock = nfc_llcp_sock_get_sn(local, sn, sn_len);
+                if (sock == NULL) {
+                        reason = LLCP_DM_NOBOUND;
+                        goto fail;
                 }
-                mutex_unlock(&local->socket_lock);
         }
 
-        reason = LLCP_DM_NOBOUND;
-        goto fail;
+        lock_sock(&sock->sk);
 
-enqueue:
         parent = &sock->sk;
 
         if (sk_acceptq_is_full(parent)) {
@@ -612,15 +672,19 @@ enqueue:
 
         new_sock = nfc_llcp_sock(new_sk);
         new_sock->dev = local->dev;
-        new_sock->local = local;
+        new_sock->local = nfc_llcp_local_get(local);
+        new_sock->miu = local->remote_miu;
         new_sock->nfc_protocol = sock->nfc_protocol;
-        new_sock->ssap = bound_sap;
+        new_sock->ssap = sock->ssap;
         new_sock->dsap = ssap;
         new_sock->parent = parent;
 
+        nfc_llcp_parse_connection_tlv(new_sock, &skb->data[LLCP_HEADER_SIZE],
+                                      skb->len - LLCP_HEADER_SIZE);
+
         pr_debug("new sock %p sk %p\n", new_sock, &new_sock->sk);
 
-        list_add_tail(&new_sock->list, &sock->list);
+        nfc_llcp_sock_link(&local->sockets, new_sk);
 
         nfc_llcp_accept_enqueue(&sock->sk, new_sk);
 
@@ -654,12 +718,12 @@ int nfc_llcp_queue_i_frames(struct nfc_llcp_sock *sock)
 
         pr_debug("Remote ready %d tx queue len %d remote rw %d",
                  sock->remote_ready, skb_queue_len(&sock->tx_pending_queue),
-                 local->remote_rw);
+                 sock->rw);
 
         /* Try to queue some I frames for transmission */
         while (sock->remote_ready &&
-               skb_queue_len(&sock->tx_pending_queue) < local->remote_rw) {
-                struct sk_buff *pdu, *pending_pdu;
+               skb_queue_len(&sock->tx_pending_queue) < sock->rw) {
+                struct sk_buff *pdu;
 
                 pdu = skb_dequeue(&sock->tx_queue);
                 if (pdu == NULL)
@@ -668,10 +732,7 @@ int nfc_llcp_queue_i_frames(struct nfc_llcp_sock *sock)
                 /* Update N(S)/N(R) */
                 nfc_llcp_set_nrns(sock, pdu);
 
-                pending_pdu = skb_clone(pdu, GFP_KERNEL);
-
                 skb_queue_tail(&local->tx_queue, pdu);
-                skb_queue_tail(&sock->tx_pending_queue, pending_pdu);
                 nr_frames++;
         }
 
@@ -728,11 +789,21 @@ static void nfc_llcp_recv_hdlc(struct nfc_llcp_local *local,
 
                 llcp_sock->send_ack_n = nr;
 
-                skb_queue_walk_safe(&llcp_sock->tx_pending_queue, s, tmp)
-                        if (nfc_llcp_ns(s) <= nr) {
-                                skb_unlink(s, &llcp_sock->tx_pending_queue);
-                                kfree_skb(s);
-                        }
+                /* Remove and free all skbs until ns == nr */
+                skb_queue_walk_safe(&llcp_sock->tx_pending_queue, s, tmp) {
+                        skb_unlink(s, &llcp_sock->tx_pending_queue);
+                        kfree_skb(s);
+
+                        if (nfc_llcp_ns(s) == nr)
+                                break;
+                }
+
+                /* Re-queue the remaining skbs for transmission */
+                skb_queue_reverse_walk_safe(&llcp_sock->tx_pending_queue,
+                                            s, tmp) {
+                        skb_unlink(s, &llcp_sock->tx_pending_queue);
+                        skb_queue_head(&local->tx_queue, s);
+                }
         }
 
         if (ptype == LLCP_PDU_RR)
@@ -740,7 +811,7 @@ static void nfc_llcp_recv_hdlc(struct nfc_llcp_local *local,
         else if (ptype == LLCP_PDU_RNR)
                 llcp_sock->remote_ready = false;
 
-        if (nfc_llcp_queue_i_frames(llcp_sock) == 0)
+        if (nfc_llcp_queue_i_frames(llcp_sock) == 0 && ptype == LLCP_PDU_I)
                 nfc_llcp_send_rr(llcp_sock);
 
         release_sock(sk);
@@ -791,11 +862,7 @@ static void nfc_llcp_recv_cc(struct nfc_llcp_local *local, struct sk_buff *skb)
         dsap = nfc_llcp_dsap(skb);
         ssap = nfc_llcp_ssap(skb);
 
-        llcp_sock = nfc_llcp_sock_get(local, dsap, ssap);
-
-        if (llcp_sock == NULL)
-                llcp_sock = nfc_llcp_sock_get(local, dsap, LLCP_SAP_SDP);
-
+        llcp_sock = nfc_llcp_connecting_sock_get(local, dsap);
         if (llcp_sock == NULL) {
                 pr_err("Invalid CC\n");
                 nfc_llcp_send_dm(local, dsap, ssap, LLCP_DM_NOCONN);
@@ -803,11 +870,15 @@ static void nfc_llcp_recv_cc(struct nfc_llcp_local *local, struct sk_buff *skb)
                 return;
         }
 
-        llcp_sock->dsap = ssap;
         sk = &llcp_sock->sk;
 
-        nfc_llcp_parse_tlv(local, &skb->data[LLCP_HEADER_SIZE],
-                           skb->len - LLCP_HEADER_SIZE);
+        /* Unlink from connecting and link to the client array */
+        nfc_llcp_sock_unlink(&local->connecting_sockets, sk);
+        nfc_llcp_sock_link(&local->sockets, sk);
+        llcp_sock->dsap = ssap;
+
+        nfc_llcp_parse_connection_tlv(llcp_sock, &skb->data[LLCP_HEADER_SIZE],
+                                      skb->len - LLCP_HEADER_SIZE);
 
         sk->sk_state = LLCP_CONNECTED;
         sk->sk_state_change(sk);
@@ -891,6 +962,21 @@ void nfc_llcp_recv(void *data, struct sk_buff *skb, int err)
         return;
 }
 
+int nfc_llcp_data_received(struct nfc_dev *dev, struct sk_buff *skb)
+{
+        struct nfc_llcp_local *local;
+
+        local = nfc_llcp_find_local(dev);
+        if (local == NULL)
+                return -ENODEV;
+
+        local->rx_pending = skb_get(skb);
+        del_timer(&local->link_timer);
+        queue_work(local->rx_wq, &local->rx_work);
+
+        return 0;
+}
+
 void nfc_llcp_mac_is_down(struct nfc_dev *dev)
 {
         struct nfc_llcp_local *local;
@@ -943,8 +1029,8 @@ int nfc_llcp_register_device(struct nfc_dev *ndev)
 
         local->dev = ndev;
         INIT_LIST_HEAD(&local->list);
+        kref_init(&local->ref);
         mutex_init(&local->sdp_lock);
-        mutex_init(&local->socket_lock);
         init_timer(&local->link_timer);
         local->link_timer.data = (unsigned long) local;
         local->link_timer.function = nfc_llcp_symm_timer;
@@ -984,11 +1070,13 @@ int nfc_llcp_register_device(struct nfc_dev *ndev)
                 goto err_rx_wq;
         }
 
+        local->sockets.lock = __RW_LOCK_UNLOCKED(local->sockets.lock);
+        local->connecting_sockets.lock = __RW_LOCK_UNLOCKED(local->connecting_sockets.lock);
+
         nfc_llcp_build_gb(local);
 
         local->remote_miu = LLCP_DEFAULT_MIU;
         local->remote_lto = LLCP_DEFAULT_LTO;
-        local->remote_rw = LLCP_DEFAULT_RW;
 
         list_add(&llcp_devices, &local->list);
 
@@ -1015,14 +1103,7 @@ void nfc_llcp_unregister_device(struct nfc_dev *dev)
                 return;
         }
 
-        list_del(&local->list);
-        nfc_llcp_socket_release(local);
-        del_timer_sync(&local->link_timer);
-        skb_queue_purge(&local->tx_queue);
-        destroy_workqueue(local->tx_wq);
-        destroy_workqueue(local->rx_wq);
-        kfree_skb(local->rx_pending);
-        kfree(local);
+        nfc_llcp_local_put(local);
 }
 
 int __init nfc_llcp_init(void)
diff --git a/net/nfc/llcp/llcp.h b/net/nfc/llcp/llcp.h
index 50680ce5ae43..7286c86982ff 100644
--- a/net/nfc/llcp/llcp.h
+++ b/net/nfc/llcp/llcp.h
@@ -40,12 +40,18 @@ enum llcp_state {
 
 struct nfc_llcp_sock;
 
+struct llcp_sock_list {
+        struct hlist_head head;
+        rwlock_t          lock;
+};
+
 struct nfc_llcp_local {
         struct list_head list;
         struct nfc_dev *dev;
 
+        struct kref ref;
+
         struct mutex sdp_lock;
-        struct mutex socket_lock;
 
         struct timer_list link_timer;
         struct sk_buff_head tx_queue;
@@ -77,24 +83,26 @@ struct nfc_llcp_local {
         u16 remote_lto;
         u8  remote_opt;
         u16 remote_wks;
-        u8  remote_rw;
 
         /* sockets array */
-        struct nfc_llcp_sock *sockets[LLCP_MAX_SAP];
+        struct llcp_sock_list sockets;
+        struct llcp_sock_list connecting_sockets;
 };
 
 struct nfc_llcp_sock {
         struct sock sk;
-        struct list_head list;
         struct nfc_dev *dev;
         struct nfc_llcp_local *local;
         u32 target_idx;
         u32 nfc_protocol;
 
+        /* Link parameters */
         u8 ssap;
         u8 dsap;
         char *service_name;
         size_t service_name_len;
+        u8 rw;
+        u16 miu;
 
         /* Link variables */
         u8 send_n;
@@ -164,7 +172,11 @@ struct nfc_llcp_sock {
 #define LLCP_DM_REJ     0x03
 
 
+void nfc_llcp_sock_link(struct llcp_sock_list *l, struct sock *s);
+void nfc_llcp_sock_unlink(struct llcp_sock_list *l, struct sock *s);
 struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev);
+struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local);
+int nfc_llcp_local_put(struct nfc_llcp_local *local);
 u8 nfc_llcp_get_sdp_ssap(struct nfc_llcp_local *local,
                          struct nfc_llcp_sock *sock);
 u8 nfc_llcp_get_local_ssap(struct nfc_llcp_local *local);
@@ -179,8 +191,10 @@ void nfc_llcp_accept_enqueue(struct sock *parent, struct sock *sk);
 struct sock *nfc_llcp_accept_dequeue(struct sock *sk, struct socket *newsock);
 
 /* TLV API */
-int nfc_llcp_parse_tlv(struct nfc_llcp_local *local,
-                       u8 *tlv_array, u16 tlv_array_len);
+int nfc_llcp_parse_gb_tlv(struct nfc_llcp_local *local,
+                          u8 *tlv_array, u16 tlv_array_len);
+int nfc_llcp_parse_connection_tlv(struct nfc_llcp_sock *sock,
+                                  u8 *tlv_array, u16 tlv_array_len);
 
 /* Commands API */
 void nfc_llcp_recv(void *data, struct sk_buff *skb, int err);
diff --git a/net/nfc/llcp/sock.c b/net/nfc/llcp/sock.c
index 17a707db40eb..2c0b317344b7 100644
--- a/net/nfc/llcp/sock.c
+++ b/net/nfc/llcp/sock.c
@@ -111,7 +111,7 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
         }
 
         llcp_sock->dev = dev;
-        llcp_sock->local = local;
+        llcp_sock->local = nfc_llcp_local_get(local);
         llcp_sock->nfc_protocol = llcp_addr.nfc_protocol;
         llcp_sock->service_name_len = min_t(unsigned int,
                                             llcp_addr.service_name_len,
@@ -124,7 +124,7 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
         if (llcp_sock->ssap == LLCP_MAX_SAP)
                 goto put_dev;
 
-        local->sockets[llcp_sock->ssap] = llcp_sock;
+        nfc_llcp_sock_link(&local->sockets, sk);
 
         pr_debug("Socket bound to SAP %d\n", llcp_sock->ssap);
 
@@ -382,15 +382,6 @@ static int llcp_sock_release(struct socket *sock)
                 goto out;
         }
 
-        mutex_lock(&local->socket_lock);
-
-        if (llcp_sock == local->sockets[llcp_sock->ssap])
-                local->sockets[llcp_sock->ssap] = NULL;
-        else
-                list_del_init(&llcp_sock->list);
-
-        mutex_unlock(&local->socket_lock);
-
         lock_sock(sk);
 
         /* Send a DISC */
@@ -415,14 +406,12 @@ static int llcp_sock_release(struct socket *sock)
                 }
         }
 
-        /* Freeing the SAP */
-        if ((sk->sk_state == LLCP_CONNECTED
-             && llcp_sock->ssap > LLCP_LOCAL_SAP_OFFSET) ||
-            sk->sk_state == LLCP_BOUND || sk->sk_state == LLCP_LISTEN)
-                nfc_llcp_put_ssap(llcp_sock->local, llcp_sock->ssap);
+        nfc_llcp_put_ssap(llcp_sock->local, llcp_sock->ssap);
 
         release_sock(sk);
 
+        nfc_llcp_sock_unlink(&local->sockets, sk);
+
 out:
         sock_orphan(sk);
         sock_put(sk);
@@ -490,7 +479,8 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
         }
 
         llcp_sock->dev = dev;
-        llcp_sock->local = local;
+        llcp_sock->local = nfc_llcp_local_get(local);
+        llcp_sock->miu = llcp_sock->local->remote_miu;
         llcp_sock->ssap = nfc_llcp_get_local_ssap(local);
         if (llcp_sock->ssap == LLCP_SAP_MAX) {
                 ret = -ENOMEM;
@@ -508,21 +498,26 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
                                           llcp_sock->service_name_len,
                                           GFP_KERNEL);
 
-        local->sockets[llcp_sock->ssap] = llcp_sock;
+        nfc_llcp_sock_link(&local->connecting_sockets, sk);
 
         ret = nfc_llcp_send_connect(llcp_sock);
         if (ret)
-                goto put_dev;
+                goto sock_unlink;
 
         ret = sock_wait_state(sk, LLCP_CONNECTED,
                               sock_sndtimeo(sk, flags & O_NONBLOCK));
         if (ret)
-                goto put_dev;
+                goto sock_unlink;
 
         release_sock(sk);
 
         return 0;
 
+sock_unlink:
+        nfc_llcp_put_ssap(local, llcp_sock->ssap);
+
+        nfc_llcp_sock_unlink(&local->connecting_sockets, sk);
+
 put_dev:
         nfc_put_device(dev);
 
@@ -687,13 +682,14 @@ struct sock *nfc_llcp_sock_alloc(struct socket *sock, int type, gfp_t gfp)
 
         llcp_sock->ssap = 0;
         llcp_sock->dsap = LLCP_SAP_SDP;
+        llcp_sock->rw = LLCP_DEFAULT_RW;
+        llcp_sock->miu = LLCP_DEFAULT_MIU;
         llcp_sock->send_n = llcp_sock->send_ack_n = 0;
         llcp_sock->recv_n = llcp_sock->recv_ack_n = 0;
         llcp_sock->remote_ready = 1;
         skb_queue_head_init(&llcp_sock->tx_queue);
         skb_queue_head_init(&llcp_sock->tx_pending_queue);
         skb_queue_head_init(&llcp_sock->tx_backlog_queue);
-        INIT_LIST_HEAD(&llcp_sock->list);
         INIT_LIST_HEAD(&llcp_sock->accept_queue);
 
         if (sock != NULL)
@@ -704,8 +700,6 @@ struct sock *nfc_llcp_sock_alloc(struct socket *sock, int type, gfp_t gfp)
 
 void nfc_llcp_sock_free(struct nfc_llcp_sock *sock)
 {
-        struct nfc_llcp_local *local = sock->local;
-
         kfree(sock->service_name);
 
         skb_queue_purge(&sock->tx_queue);
@@ -714,12 +708,9 @@ void nfc_llcp_sock_free(struct nfc_llcp_sock *sock)
 
         list_del_init(&sock->accept_queue);
 
-        if (local != NULL && sock == local->sockets[sock->ssap])
-                local->sockets[sock->ssap] = NULL;
-        else
-                list_del_init(&sock->list);
-
         sock->parent = NULL;
+
+        nfc_llcp_local_put(sock->local);
 }
 
 static int llcp_sock_create(struct net *net, struct socket *sock,
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index d560e6f13072..766a02b1dfa1 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -387,7 +387,8 @@ static int nci_dev_down(struct nfc_dev *nfc_dev)
         return nci_close_device(ndev);
 }
 
-static int nci_start_poll(struct nfc_dev *nfc_dev, __u32 protocols)
+static int nci_start_poll(struct nfc_dev *nfc_dev,
+                          __u32 im_protocols, __u32 tm_protocols)
 {
         struct nci_dev *ndev = nfc_get_drvdata(nfc_dev);
         int rc;
@@ -413,11 +414,11 @@ static int nci_start_poll(struct nfc_dev *nfc_dev, __u32 protocols)
                         return -EBUSY;
         }
 
-        rc = nci_request(ndev, nci_rf_discover_req, protocols,
+        rc = nci_request(ndev, nci_rf_discover_req, im_protocols,
                          msecs_to_jiffies(NCI_RF_DISC_TIMEOUT));
 
         if (!rc)
-                ndev->poll_prots = protocols;
+                ndev->poll_prots = im_protocols;
 
         return rc;
 }
@@ -521,9 +522,9 @@ static void nci_deactivate_target(struct nfc_dev *nfc_dev,
         }
 }
 
-static int nci_data_exchange(struct nfc_dev *nfc_dev, struct nfc_target *target,
-                             struct sk_buff *skb,
-                             data_exchange_cb_t cb, void *cb_context)
+static int nci_transceive(struct nfc_dev *nfc_dev, struct nfc_target *target,
+                          struct sk_buff *skb,
+                          data_exchange_cb_t cb, void *cb_context)
 {
         struct nci_dev *ndev = nfc_get_drvdata(nfc_dev);
         int rc;
@@ -556,7 +557,7 @@ static struct nfc_ops nci_nfc_ops = {
         .stop_poll = nci_stop_poll,
         .activate_target = nci_activate_target,
         .deactivate_target = nci_deactivate_target,
-        .data_exchange = nci_data_exchange,
+        .im_transceive = nci_transceive,
 };
 
 /* ---- Interface to NCI drivers ---- */
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index 581d419083aa..03c31db38f12 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -49,6 +49,8 @@ static const struct nla_policy nfc_genl_policy[NFC_ATTR_MAX + 1] = {
         [NFC_ATTR_COMM_MODE] = { .type = NLA_U8 },
         [NFC_ATTR_RF_MODE] = { .type = NLA_U8 },
         [NFC_ATTR_DEVICE_POWERED] = { .type = NLA_U8 },
+        [NFC_ATTR_IM_PROTOCOLS] = { .type = NLA_U32 },
+        [NFC_ATTR_TM_PROTOCOLS] = { .type = NLA_U32 },
 };
 
 static int nfc_genl_send_target(struct sk_buff *msg, struct nfc_target *target,
@@ -219,6 +221,68 @@ free_msg:
         return -EMSGSIZE;
 }
 
+int nfc_genl_tm_activated(struct nfc_dev *dev, u32 protocol)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
+
+        hdr = genlmsg_put(msg, 0, 0, &nfc_genl_family, 0,
+                          NFC_EVENT_TM_ACTIVATED);
+        if (!hdr)
+                goto free_msg;
+
+        if (nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx))
+                goto nla_put_failure;
+        if (nla_put_u32(msg, NFC_ATTR_TM_PROTOCOLS, protocol))
+                goto nla_put_failure;
+
+        genlmsg_end(msg, hdr);
+
+        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+
+        return 0;
+
+nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+free_msg:
+        nlmsg_free(msg);
+        return -EMSGSIZE;
+}
+
+int nfc_genl_tm_deactivated(struct nfc_dev *dev)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
+
+        hdr = genlmsg_put(msg, 0, 0, &nfc_genl_family, 0,
+                          NFC_EVENT_TM_DEACTIVATED);
+        if (!hdr)
+                goto free_msg;
+
+        if (nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx))
+                goto nla_put_failure;
+
+        genlmsg_end(msg, hdr);
+
+        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+
+        return 0;
+
+nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+free_msg:
+        nlmsg_free(msg);
+        return -EMSGSIZE;
+}
+
 int nfc_genl_device_added(struct nfc_dev *dev)
 {
         struct sk_buff *msg;
@@ -519,16 +583,25 @@ static int nfc_genl_start_poll(struct sk_buff *skb, struct genl_info *info)
         struct nfc_dev *dev;
         int rc;
         u32 idx;
-        u32 protocols;
+        u32 im_protocols = 0, tm_protocols = 0;
 
         pr_debug("Poll start\n");
 
         if (!info->attrs[NFC_ATTR_DEVICE_INDEX] ||
-            !info->attrs[NFC_ATTR_PROTOCOLS])
+            ((!info->attrs[NFC_ATTR_IM_PROTOCOLS] &&
+              !info->attrs[NFC_ATTR_PROTOCOLS]) &&
+             !info->attrs[NFC_ATTR_TM_PROTOCOLS]))
                 return -EINVAL;
 
         idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);
-        protocols = nla_get_u32(info->attrs[NFC_ATTR_PROTOCOLS]);
+
+        if (info->attrs[NFC_ATTR_TM_PROTOCOLS])
+                tm_protocols = nla_get_u32(info->attrs[NFC_ATTR_TM_PROTOCOLS]);
+
+        if (info->attrs[NFC_ATTR_IM_PROTOCOLS])
+                im_protocols = nla_get_u32(info->attrs[NFC_ATTR_IM_PROTOCOLS]);
+        else if (info->attrs[NFC_ATTR_PROTOCOLS])
+                im_protocols = nla_get_u32(info->attrs[NFC_ATTR_PROTOCOLS]);
 
         dev = nfc_get_device(idx);
         if (!dev)
@@ -536,7 +609,7 @@ static int nfc_genl_start_poll(struct sk_buff *skb, struct genl_info *info)
 
         mutex_lock(&dev->genl_data.genl_data_mutex);
 
-        rc = nfc_start_poll(dev, protocols);
+        rc = nfc_start_poll(dev, im_protocols, tm_protocols);
         if (!rc)
                 dev->genl_data.poll_req_pid = info->snd_pid;
 
diff --git a/net/nfc/nfc.h b/net/nfc/nfc.h
index 3dd4232ae664..c5e42b79a418 100644
--- a/net/nfc/nfc.h
+++ b/net/nfc/nfc.h
@@ -55,6 +55,7 @@ int nfc_llcp_register_device(struct nfc_dev *dev);
 void nfc_llcp_unregister_device(struct nfc_dev *dev);
 int nfc_llcp_set_remote_gb(struct nfc_dev *dev, u8 *gb, u8 gb_len);
 u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len);
+int nfc_llcp_data_received(struct nfc_dev *dev, struct sk_buff *skb);
 int __init nfc_llcp_init(void);
 void nfc_llcp_exit(void);
 
@@ -90,6 +91,12 @@ static inline u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *gb_len)
         return NULL;
 }
 
+static inline int nfc_llcp_data_received(struct nfc_dev *dev,
+                                         struct sk_buff *skb)
+{
+        return 0;
+}
+
 static inline int nfc_llcp_init(void)
 {
         return 0;
@@ -128,6 +135,9 @@ int nfc_genl_dep_link_up_event(struct nfc_dev *dev, u32 target_idx,
                                u8 comm_mode, u8 rf_mode);
 int nfc_genl_dep_link_down_event(struct nfc_dev *dev);
 
+int nfc_genl_tm_activated(struct nfc_dev *dev, u32 protocol);
+int nfc_genl_tm_deactivated(struct nfc_dev *dev);
+
 struct nfc_dev *nfc_get_device(unsigned int idx);
 
 static inline void nfc_put_device(struct nfc_dev *dev)
@@ -158,7 +168,7 @@ int nfc_dev_up(struct nfc_dev *dev);
 
 int nfc_dev_down(struct nfc_dev *dev);
 
-int nfc_start_poll(struct nfc_dev *dev, u32 protocols);
+int nfc_start_poll(struct nfc_dev *dev, u32 im_protocols, u32 tm_protocols);
 
 int nfc_stop_poll(struct nfc_dev *dev);
 
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index f974961754ca..752b72360ebc 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -325,7 +325,7 @@ static void __rfkill_switch_all(const enum rfkill_type type, bool blocked)
 
         rfkill_global_states[type].cur = blocked;
         list_for_each_entry(rfkill, &rfkill_list, node) {
-                if (rfkill->type != type)
+                if (rfkill->type != type && type != RFKILL_TYPE_ALL)
                         continue;
 
                 rfkill_set_block(rfkill, blocked);
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index 2e4444fedbe0..4d2b1ec6516f 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -114,24 +114,10 @@ config CFG80211_WEXT
         bool "cfg80211 wireless extensions compatibility"
         depends on CFG80211
         select WEXT_CORE
-        default y
         help
           Enable this option if you need old userspace for wireless
           extensions with cfg80211-based drivers.
 
-config WIRELESS_EXT_SYSFS
-        bool "Wireless extensions sysfs files"
-        depends on WEXT_CORE && SYSFS
-        help
-          This option enables the deprecated wireless statistics
-          files in /sys/class/net/*/wireless/. The same information
-          is available via the ioctls as well.
-
-          Say N. If you know you have ancient tools requiring it,
-          like very old versions of hal (prior to 0.5.12 release),
-          say Y and update the tools as soon as possible as this
-          option will be removed soon.
-
 config LIB80211
         tristate "Common routines for IEEE802.11 drivers"
         default n
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index 884801ac4dd0..c1999e45a07c 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -60,7 +60,7 @@ bool cfg80211_can_beacon_sec_chan(struct wiphy *wiphy,
                 diff = -20;
                 break;
         default:
-                return false;
+                return true;
         }
 
         sec_chan = ieee80211_get_channel(wiphy, chan->center_freq + diff);
@@ -78,60 +78,17 @@ bool cfg80211_can_beacon_sec_chan(struct wiphy *wiphy,
 }
 EXPORT_SYMBOL(cfg80211_can_beacon_sec_chan);
 
-int cfg80211_set_freq(struct cfg80211_registered_device *rdev,
-                      struct wireless_dev *wdev, int freq,
-                      enum nl80211_channel_type channel_type)
+int cfg80211_set_monitor_channel(struct cfg80211_registered_device *rdev,
+                                 int freq, enum nl80211_channel_type chantype)
 {
         struct ieee80211_channel *chan;
-        int result;
-
-        if (wdev && wdev->iftype == NL80211_IFTYPE_MONITOR)
-                wdev = NULL;
-
-        if (wdev) {
-                ASSERT_WDEV_LOCK(wdev);
-
-                if (!netif_running(wdev->netdev))
-                        return -ENETDOWN;
-        }
 
-        if (!rdev->ops->set_channel)
+        if (!rdev->ops->set_monitor_channel)
                 return -EOPNOTSUPP;
 
-        chan = rdev_freq_to_chan(rdev, freq, channel_type);
+        chan = rdev_freq_to_chan(rdev, freq, chantype);
         if (!chan)
                 return -EINVAL;
 
-        /* Both channels should be able to initiate communication */
-        if (wdev && (wdev->iftype == NL80211_IFTYPE_ADHOC ||
-                     wdev->iftype == NL80211_IFTYPE_AP ||
-                     wdev->iftype == NL80211_IFTYPE_AP_VLAN ||
-                     wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
-                     wdev->iftype == NL80211_IFTYPE_P2P_GO)) {
-                switch (channel_type) {
-                case NL80211_CHAN_HT40PLUS:
-                case NL80211_CHAN_HT40MINUS:
-                        if (!cfg80211_can_beacon_sec_chan(&rdev->wiphy, chan,
-                                                          channel_type)) {
-                                printk(KERN_DEBUG
-                                       "cfg80211: Secondary channel not "
-                                       "allowed to initiate communication\n");
-                                return -EINVAL;
-                        }
-                        break;
-                default:
-                        break;
-                }
-        }
-
-        result = rdev->ops->set_channel(&rdev->wiphy,
-                                        wdev ? wdev->netdev : NULL,
-                                        chan, channel_type);
-        if (result)
-                return result;
-
-        if (wdev)
-                wdev->channel = chan;
-
-        return 0;
+        return rdev->ops->set_monitor_channel(&rdev->wiphy, chan, chantype);
 }
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 8523f3878677..9348a47562a4 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -303,14 +303,17 @@ extern const struct mesh_config default_mesh_config;
 extern const struct mesh_setup default_mesh_setup;
 int __cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
                          struct net_device *dev,
-                         const struct mesh_setup *setup,
+                         struct mesh_setup *setup,
                          const struct mesh_config *conf);
 int cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
                        struct net_device *dev,
-                       const struct mesh_setup *setup,
+                       struct mesh_setup *setup,
                        const struct mesh_config *conf);
 int cfg80211_leave_mesh(struct cfg80211_registered_device *rdev,
                         struct net_device *dev);
+int cfg80211_set_mesh_freq(struct cfg80211_registered_device *rdev,
+                           struct wireless_dev *wdev, int freq,
+                           enum nl80211_channel_type channel_type);
 
 /* MLME */
 int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
@@ -441,9 +444,8 @@ cfg80211_can_add_interface(struct cfg80211_registered_device *rdev,
 struct ieee80211_channel *
 rdev_freq_to_chan(struct cfg80211_registered_device *rdev,
                   int freq, enum nl80211_channel_type channel_type);
-int cfg80211_set_freq(struct cfg80211_registered_device *rdev,
-                      struct wireless_dev *wdev, int freq,
-                      enum nl80211_channel_type channel_type);
+int cfg80211_set_monitor_channel(struct cfg80211_registered_device *rdev,
+                                 int freq, enum nl80211_channel_type chantype);
 
 int ieee80211_get_ratemask(struct ieee80211_supported_band *sband,
                            const u8 *rates, unsigned int n_rates,
diff --git a/net/wireless/mesh.c b/net/wireless/mesh.c
index 2749cb86b462..b44c736bf9cf 100644
--- a/net/wireless/mesh.c
+++ b/net/wireless/mesh.c
@@ -65,6 +65,9 @@ const struct mesh_config default_mesh_config = {
 };
 
 const struct mesh_setup default_mesh_setup = {
+        /* cfg80211_join_mesh() will pick a channel if needed */
+        .channel = NULL,
+        .channel_type = NL80211_CHAN_NO_HT,
         .sync_method = IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET,
         .path_sel_proto = IEEE80211_PATH_PROTOCOL_HWMP,
         .path_metric = IEEE80211_PATH_METRIC_AIRTIME,
@@ -75,7 +78,7 @@ const struct mesh_setup default_mesh_setup = {
 
 int __cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
                          struct net_device *dev,
-                         const struct mesh_setup *setup,
+                         struct mesh_setup *setup,
                          const struct mesh_config *conf)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
@@ -101,6 +104,51 @@ int __cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
         if (!rdev->ops->join_mesh)
                 return -EOPNOTSUPP;
 
+        if (!setup->channel) {
+                /* if no channel explicitly given, use preset channel */
+                setup->channel = wdev->preset_chan;
+                setup->channel_type = wdev->preset_chantype;
+        }
+
+        if (!setup->channel) {
+                /* if we don't have that either, use the first usable channel */
+                enum ieee80211_band band;
+
+                for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                        struct ieee80211_supported_band *sband;
+                        struct ieee80211_channel *chan;
+                        int i;
+
+                        sband = rdev->wiphy.bands[band];
+                        if (!sband)
+                                continue;
+
+                        for (i = 0; i < sband->n_channels; i++) {
+                                chan = &sband->channels[i];
+                                if (chan->flags & (IEEE80211_CHAN_NO_IBSS |
+                                                   IEEE80211_CHAN_PASSIVE_SCAN |
+                                                   IEEE80211_CHAN_DISABLED |
+                                                   IEEE80211_CHAN_RADAR))
+                                        continue;
+                                setup->channel = chan;
+                                break;
+                        }
+
+                        if (setup->channel)
+                                break;
+                }
+
+                /* no usable channel ... */
+                if (!setup->channel)
+                        return -EINVAL;
+
+                setup->channel_type = NL80211_CHAN_NO_HT;
+        }
+
+        if (!cfg80211_can_beacon_sec_chan(&rdev->wiphy, setup->channel,
+                                          setup->channel_type))
+                return -EINVAL;
+
         err = rdev->ops->join_mesh(&rdev->wiphy, dev, conf, setup);
         if (!err) {
                 memcpy(wdev->ssid, setup->mesh_id, setup->mesh_id_len);
@@ -112,7 +160,7 @@ int __cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
 
 int cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
                        struct net_device *dev,
-                       const struct mesh_setup *setup,
+                       struct mesh_setup *setup,
                        const struct mesh_config *conf)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
@@ -125,6 +173,45 @@ int cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
         return err;
 }
 
+int cfg80211_set_mesh_freq(struct cfg80211_registered_device *rdev,
+                           struct wireless_dev *wdev, int freq,
+                           enum nl80211_channel_type channel_type)
+{
+        struct ieee80211_channel *channel;
+
+        channel = rdev_freq_to_chan(rdev, freq, channel_type);
+        if (!channel || !cfg80211_can_beacon_sec_chan(&rdev->wiphy,
+                                                      channel,
+                                                      channel_type)) {
+                return -EINVAL;
+        }
+
+        /*
+         * Workaround for libertas (only!), it puts the interface
+         * into mesh mode but doesn't implement join_mesh. Instead,
+         * it is configured via sysfs and then joins the mesh when
+         * you set the channel. Note that the libertas mesh isn't
+         * compatible with 802.11 mesh.
+         */
+        if (rdev->ops->libertas_set_mesh_channel) {
+                if (channel_type != NL80211_CHAN_NO_HT)
+                        return -EINVAL;
+
+                if (!netif_running(wdev->netdev))
+                        return -ENETDOWN;
+                return rdev->ops->libertas_set_mesh_channel(&rdev->wiphy,
+                                                            wdev->netdev,
+                                                            channel);
+        }
+
+        if (wdev->mesh_id_len)
+                return -EBUSY;
+
+        wdev->preset_chan = channel;
+        wdev->preset_chantype = channel_type;
+        return 0;
+}
+
 void cfg80211_notify_new_peer_candidate(struct net_device *dev,
                 const u8 *macaddr, const u8* ie, u8 ie_len, gfp_t gfp)
 {
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index eb90988bbd36..da4406f11929 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -947,8 +947,6 @@ void cfg80211_ch_switch_notify(struct net_device *dev, int freq,
         if (WARN_ON(!chan))
                 goto out;
 
-        wdev->channel = chan;
-
         nl80211_ch_switch_notify(rdev, dev, freq, type, GFP_KERNEL);
 out:
         wdev_unlock(wdev);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 206465dc0cab..7ae54b82291f 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -921,7 +921,12 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
                         goto nla_put_failure;
         }
-        CMD(set_channel, SET_CHANNEL);
+        if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
+            dev->ops->join_mesh) {
+                i++;
+                if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
+                        goto nla_put_failure;
+        }
         CMD(set_wds_peer, SET_WDS_PEER);
         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
                 CMD(tdls_mgmt, TDLS_MGMT);
@@ -1162,18 +1167,22 @@ static int parse_txq_params(struct nlattr *tb[],
 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
 {
         /*
-         * You can only set the channel explicitly for AP, mesh
-         * and WDS type interfaces; all others have their channel
-         * managed via their respective "establish a connection"
-         * command (connect, join, ...)
+         * You can only set the channel explicitly for WDS interfaces,
+         * all others have their channel managed via their respective
+         * "establish a connection" command (connect, join, ...)
+         *
+         * For AP/GO and mesh mode, the channel can be set with the
+         * channel userspace API, but is only stored and passed to the
+         * low-level driver when the AP starts or the mesh is joined.
+         * This is for backward compatibility, userspace can also give
+         * the channel in the start-ap or join-mesh commands instead.
          *
          * Monitors are special as they are normally slaved to
-         * whatever else is going on, so they behave as though
-         * you tried setting the wiphy channel itself.
+         * whatever else is going on, so they have their own special
+         * operation to set the monitor channel if possible.
          */
         return !wdev ||
                 wdev->iftype == NL80211_IFTYPE_AP ||
-                wdev->iftype == NL80211_IFTYPE_WDS ||
                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
@@ -1204,9 +1213,14 @@ static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
                                  struct wireless_dev *wdev,
                                  struct genl_info *info)
 {
+        struct ieee80211_channel *channel;
         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
         u32 freq;
         int result;
+        enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
+
+        if (wdev)
+                iftype = wdev->iftype;
 
         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
                 return -EINVAL;
@@ -1221,12 +1235,32 @@ static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 
         mutex_lock(&rdev->devlist_mtx);
-        if (wdev) {
-                wdev_lock(wdev);
-                result = cfg80211_set_freq(rdev, wdev, freq, channel_type);
-                wdev_unlock(wdev);
-        } else {
-                result = cfg80211_set_freq(rdev, NULL, freq, channel_type);
+        switch (iftype) {
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_P2P_GO:
+                if (wdev->beacon_interval) {
+                        result = -EBUSY;
+                        break;
+                }
+                channel = rdev_freq_to_chan(rdev, freq, channel_type);
+                if (!channel || !cfg80211_can_beacon_sec_chan(&rdev->wiphy,
+                                                              channel,
+                                                              channel_type)) {
+                        result = -EINVAL;
+                        break;
+                }
+                wdev->preset_chan = channel;
+                wdev->preset_chantype = channel_type;
+                result = 0;
+                break;
+        case NL80211_IFTYPE_MESH_POINT:
+                result = cfg80211_set_mesh_freq(rdev, wdev, freq, channel_type);
+                break;
+        case NL80211_IFTYPE_MONITOR:
+                result = cfg80211_set_monitor_channel(rdev, freq, channel_type);
+                break;
+        default:
+                result = -EINVAL;
         }
         mutex_unlock(&rdev->devlist_mtx);
 
@@ -1310,8 +1344,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                 result = 0;
 
                 mutex_lock(&rdev->mtx);
-        } else if (netif_running(netdev) &&
-                   nl80211_can_set_dev_channel(netdev->ieee80211_ptr))
+        } else if (nl80211_can_set_dev_channel(netdev->ieee80211_ptr))
                 wdev = netdev->ieee80211_ptr;
         else
                 wdev = NULL;
@@ -2299,6 +2332,29 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
         }
 
+        if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
+                enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
+
+                if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
+                    !nl80211_valid_channel_type(info, &channel_type))
+                        return -EINVAL;
+
+                params.channel = rdev_freq_to_chan(rdev,
+                        nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
+                        channel_type);
+                if (!params.channel)
+                        return -EINVAL;
+                params.channel_type = channel_type;
+        } else if (wdev->preset_chan) {
+                params.channel = wdev->preset_chan;
+                params.channel_type = wdev->preset_chantype;
+        } else
+                return -EINVAL;
+
+        if (!cfg80211_can_beacon_sec_chan(&rdev->wiphy, params.channel,
+                                          params.channel_type))
+                return -EINVAL;
+
         err = rdev->ops->start_ap(&rdev->wiphy, dev, &params);
         if (!err)
                 wdev->beacon_interval = params.beacon_interval;
@@ -5489,18 +5545,18 @@ static int nl80211_remain_on_channel(struct sk_buff *skb,
 
         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
 
+        if (!rdev->ops->remain_on_channel ||
+            !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
+                return -EOPNOTSUPP;
+
         /*
-         * We should be on that channel for at least one jiffie,
-         * and more than 5 seconds seems excessive.
+         * We should be on that channel for at least a minimum amount of
+         * time (10ms) but no longer than the driver supports.
          */
-        if (!duration || !msecs_to_jiffies(duration) ||
+        if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
             duration > rdev->wiphy.max_remain_on_channel_duration)
                 return -EINVAL;
 
-        if (!rdev->ops->remain_on_channel ||
-            !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
-                return -EOPNOTSUPP;
-
         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
             !nl80211_valid_channel_type(info, &channel_type))
                 return -EINVAL;
@@ -5771,6 +5827,15 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
                         return -EINVAL;
                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
+
+                /*
+                 * We should wait on the channel for at least a minimum amount
+                 * of time (10ms) but no longer than the driver supports.
+                 */
+                if (wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
+                    wait > rdev->wiphy.max_remain_on_channel_duration)
+                        return -EINVAL;
+
         }
 
         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
@@ -6032,6 +6097,24 @@ static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
                         return err;
         }
 
+        if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
+                enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
+
+                if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
+                    !nl80211_valid_channel_type(info, &channel_type))
+                        return -EINVAL;
+
+                setup.channel = rdev_freq_to_chan(rdev,
+                        nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
+                        channel_type);
+                if (!setup.channel)
+                        return -EINVAL;
+                setup.channel_type = channel_type;
+        } else {
+                /* cfg80211_join_mesh() will sort it out */
+                setup.channel = NULL;
+        }
+
         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
 }
 
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index 6a6181a673ca..bc879833b21f 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -796,7 +796,15 @@ static int cfg80211_wext_siwfreq(struct net_device *dev,
         case NL80211_IFTYPE_ADHOC:
                 return cfg80211_ibss_wext_siwfreq(dev, info, wextfreq, extra);
         case NL80211_IFTYPE_MONITOR:
-        case NL80211_IFTYPE_WDS:
+                freq = cfg80211_wext_freq(wdev->wiphy, wextfreq);
+                if (freq < 0)
+                        return freq;
+                if (freq == 0)
+                        return -EINVAL;
+                mutex_lock(&rdev->devlist_mtx);
+                err = cfg80211_set_monitor_channel(rdev, freq, NL80211_CHAN_NO_HT);
+                mutex_unlock(&rdev->devlist_mtx);
+                return err;
         case NL80211_IFTYPE_MESH_POINT:
                 freq = cfg80211_wext_freq(wdev->wiphy, wextfreq);
                 if (freq < 0)
@@ -804,9 +812,8 @@ static int cfg80211_wext_siwfreq(struct net_device *dev,
                 if (freq == 0)
                         return -EINVAL;
                 mutex_lock(&rdev->devlist_mtx);
-                wdev_lock(wdev);
-                err = cfg80211_set_freq(rdev, wdev, freq, NL80211_CHAN_NO_HT);
-                wdev_unlock(wdev);
+                err = cfg80211_set_mesh_freq(rdev, wdev, freq,
+                                             NL80211_CHAN_NO_HT);
                 mutex_unlock(&rdev->devlist_mtx);
                 return err;
         default:
@@ -839,11 +846,7 @@ static int cfg80211_wext_giwfreq(struct net_device *dev,
                 freq->e = 6;
                 return 0;
         default:
-                if (!wdev->channel)
-                        return -EINVAL;
-                freq->m = wdev->channel->center_freq;
-                freq->e = 6;
-                return 0;
+                return -EINVAL;
         }
 }
 
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
index 7decbd357d51..1f773f668d1a 100644
--- a/net/wireless/wext-sme.c
+++ b/net/wireless/wext-sme.c
@@ -111,9 +111,15 @@ int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
 
         wdev->wext.connect.channel = chan;
 
-        /* SSID is not set, we just want to switch channel */
+        /*
+         * SSID is not set, we just want to switch monitor channel,
+         * this is really just backward compatibility, if the SSID
+         * is set then we use the channel to select the BSS to use
+         * to connect to instead. If we were connected on another
+         * channel we disconnected above and reconnect below.
+         */
         if (chan && !wdev->wext.connect.ssid_len) {
-                err = cfg80211_set_freq(rdev, wdev, freq, NL80211_CHAN_NO_HT);
+                err = cfg80211_set_monitor_channel(rdev, freq, NL80211_CHAN_NO_HT);
                 goto out;
         }