235 files changed, 19614 insertions, 8457 deletions

diff --git a/Documentation/ABI/obsolete/sysfs-class-rfkill b/Documentation/ABI/obsolete/sysfs-class-rfkill
new file mode 100644
index 000000000000..4201d5b05515
--- /dev/null
+++ b/Documentation/ABI/obsolete/sysfs-class-rfkill
@@ -0,0 +1,29 @@
+rfkill - radio frequency (RF) connector kill switch support
+
+For details to this subsystem look at Documentation/rfkill.txt.
+
+What:           /sys/class/rfkill/rfkill[0-9]+/state
+Date:           09-Jul-2007
+KernelVersion   v2.6.22
+Contact:        linux-wireless@vger.kernel.org
+Description:    Current state of the transmitter.
+                This file is deprecated and sheduled to be removed in 2014,
+                because its not possible to express the 'soft and hard block'
+                state of the rfkill driver.
+Values:         A numeric value.
+                0: RFKILL_STATE_SOFT_BLOCKED
+                        transmitter is turned off by software
+                1: RFKILL_STATE_UNBLOCKED
+                        transmitter is (potentially) active
+                2: RFKILL_STATE_HARD_BLOCKED
+                        transmitter is forced off by something outside of
+                        the driver's control.
+
+What:           /sys/class/rfkill/rfkill[0-9]+/claim
+Date:           09-Jul-2007
+KernelVersion   v2.6.22
+Contact:        linux-wireless@vger.kernel.org
+Description:    This file is deprecated because there no longer is a way to
+                claim just control over a single rfkill instance.
+                This file is scheduled to be removed in 2012.
+Values:         0: Kernel handles events
diff --git a/Documentation/ABI/stable/sysfs-class-rfkill b/Documentation/ABI/stable/sysfs-class-rfkill
new file mode 100644
index 000000000000..097f522c33bb
--- /dev/null
+++ b/Documentation/ABI/stable/sysfs-class-rfkill
@@ -0,0 +1,67 @@
+rfkill - radio frequency (RF) connector kill switch support
+
+For details to this subsystem look at Documentation/rfkill.txt.
+
+For the deprecated /sys/class/rfkill/*/state and
+/sys/class/rfkill/*/claim knobs of this interface look in
+Documentation/ABI/obsolete/sysfs-class-rfkill.
+
+What:           /sys/class/rfkill
+Date:           09-Jul-2007
+KernelVersion:  v2.6.22
+Contact:        linux-wireless@vger.kernel.org,
+Description:    The rfkill class subsystem folder.
+                Each registered rfkill driver is represented by an rfkillX
+                subfolder (X being an integer > 0).
+
+
+What:           /sys/class/rfkill/rfkill[0-9]+/name
+Date:           09-Jul-2007
+KernelVersion   v2.6.22
+Contact:        linux-wireless@vger.kernel.org
+Description:    Name assigned by driver to this key (interface or driver name).
+Values:         arbitrary string.
+
+
+What:           /sys/class/rfkill/rfkill[0-9]+/type
+Date:           09-Jul-2007
+KernelVersion   v2.6.22
+Contact:        linux-wireless@vger.kernel.org
+Description:    Driver type string ("wlan", "bluetooth", etc).
+Values:         See include/linux/rfkill.h.
+
+
+What:           /sys/class/rfkill/rfkill[0-9]+/persistent
+Date:           09-Jul-2007
+KernelVersion   v2.6.22
+Contact:        linux-wireless@vger.kernel.org
+Description:    Whether the soft blocked state is initialised from non-volatile
+                storage at startup.
+Values:         A numeric value.
+                0: false
+                1: true
+
+
+What:           /sys/class/rfkill/rfkill[0-9]+/hard
+Date:           12-March-2010
+KernelVersion   v2.6.34
+Contact:        linux-wireless@vger.kernel.org
+Description:    Current hardblock state. This file is read only.
+Values:         A numeric value.
+                0: inactive
+                        The transmitter is (potentially) active.
+                1: active
+                        The transmitter is forced off by something outside of
+                        the driver's control.
+
+
+What:           /sys/class/rfkill/rfkill[0-9]+/soft
+Date:           12-March-2010
+KernelVersion   v2.6.34
+Contact:        linux-wireless@vger.kernel.org
+Description:    Current softblock state. This file is read and write.
+Values:         A numeric value.
+                0: inactive
+                        The transmitter is (potentially) active.
+                1: active
+                        The transmitter is turned off by software.
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 73ef30dbe612..5f460110c5ee 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -543,6 +543,24 @@ Who:	Eric Miao <eric.y.miao@gmail.com>
 
 ----------------------------
 
+What:   sysfs-class-rfkill state file
+When:   Feb 2014
+Files:  net/rfkill/core.c
+Why:    Documented as obsolete since Feb 2010. This file is limited to 3
+        states while the rfkill drivers can have 4 states.
+Who:    anybody or Florian Mickler <florian@mickler.org>
+
+----------------------------
+
+What:   sysfs-class-rfkill claim file
+When:   Feb 2012
+Files:  net/rfkill/core.c
+Why:    It is not possible to claim an rfkill driver since 2007. This is
+        Documented as obsolete since Feb 2010.
+Who:    anybody or Florian Mickler <florian@mickler.org>
+
+----------------------------
+
 What:   capifs
 When:   February 2011
 Files:  drivers/isdn/capi/capifs.*
@@ -550,3 +568,26 @@ Why:	udev fully replaces this special file system that only contains CAPI
         NCCI TTY device nodes. User space (pppdcapiplugin) works without
         noticing the difference.
 Who:    Jan Kiszka <jan.kiszka@web.de>
+
+----------------------------
+
+What:   iwlwifi 50XX module parameters
+When:   2.6.40
+Why:    The "..50" modules parameters were used to configure 5000 series and
+        up devices; different set of module parameters also available for 4965
+        with same functionalities. Consolidate both set into single place
+        in drivers/net/wireless/iwlwifi/iwl-agn.c
+
+Who:    Wey-Yi Guy <wey-yi.w.guy@intel.com>
+
+----------------------------
+
+What:   iwl4965 alias support
+When:   2.6.40
+Why:    Internal alias support has been present in module-init-tools for some
+        time, the MODULE_ALIAS("iwl4965") boilerplate aliases can be removed
+        with no impact.
+
+Who:    Wey-Yi Guy <wey-yi.w.guy@intel.com>
+
+----------------------------
diff --git a/Documentation/rfkill.txt b/Documentation/rfkill.txt
index b4860509c319..83668e5dd17f 100644
--- a/Documentation/rfkill.txt
+++ b/Documentation/rfkill.txt
@@ -99,37 +99,15 @@ system. Also, it is possible to switch all rfkill drivers (or all drivers of
 a specified type) into a state which also updates the default state for
 hotplugged devices.
 
-After an application opens /dev/rfkill, it can read the current state of
-all devices, and afterwards can poll the descriptor for hotplug or state
-change events.
-
-Applications must ignore operations (the "op" field) they do not handle,
-this allows the API to be extended in the future.
-
-Additionally, each rfkill device is registered in sysfs and there has the
-following attributes:
-
-        name: Name assigned by driver to this key (interface or driver name).
-        type: Driver type string ("wlan", "bluetooth", etc).
-        persistent: Whether the soft blocked state is initialised from
-                    non-volatile storage at startup.
-        state: Current state of the transmitter
-                0: RFKILL_STATE_SOFT_BLOCKED
-                        transmitter is turned off by software
-                1: RFKILL_STATE_UNBLOCKED
-                        transmitter is (potentially) active
-                2: RFKILL_STATE_HARD_BLOCKED
-                        transmitter is forced off by something outside of
-                        the driver's control.
-               This file is deprecated because it can only properly show
-               three of the four possible states, soft-and-hard-blocked is
-               missing.
-        claim: 0: Kernel handles events
-               This file is deprecated because there no longer is a way to
-               claim just control over a single rfkill instance.
-
-rfkill devices also issue uevents (with an action of "change"), with the
-following environment variables set:
+After an application opens /dev/rfkill, it can read the current state of all
+devices. Changes can be either obtained by either polling the descriptor for
+hotplug or state change events or by listening for uevents emitted by the
+rfkill core framework.
+
+Additionally, each rfkill device is registered in sysfs and emits uevents.
+
+rfkill devices issue uevents (with an action of "change"), with the following
+environment variables set:
 
 RFKILL_NAME
 RFKILL_STATE
@@ -137,3 +115,7 @@ RFKILL_TYPE
 
 The contents of these variables corresponds to the "name", "state" and
 "type" sysfs files explained above.
+
+
+For further details consult Documentation/ABI/stable/dev-rfkill and
+Documentation/ABI/stable/sysfs-class-rfkill.
diff --git a/drivers/net/ps3_gelic_wireless.c b/drivers/net/ps3_gelic_wireless.c
index 2663b2fdc0bb..f5fc0f78fc21 100644
--- a/drivers/net/ps3_gelic_wireless.c
+++ b/drivers/net/ps3_gelic_wireless.c
@@ -2279,26 +2279,25 @@ void gelic_wl_interrupt(struct net_device *netdev, u64 status)
 /*
  * driver helpers
  */
-#define IW_IOCTL(n) [(n) - SIOCSIWCOMMIT]
 static const iw_handler gelic_wl_wext_handler[] =
 {
-        IW_IOCTL(SIOCGIWNAME)           = gelic_wl_get_name,
-        IW_IOCTL(SIOCGIWRANGE)          = gelic_wl_get_range,
-        IW_IOCTL(SIOCSIWSCAN)           = gelic_wl_set_scan,
-        IW_IOCTL(SIOCGIWSCAN)           = gelic_wl_get_scan,
-        IW_IOCTL(SIOCSIWAUTH)           = gelic_wl_set_auth,
-        IW_IOCTL(SIOCGIWAUTH)           = gelic_wl_get_auth,
-        IW_IOCTL(SIOCSIWESSID)          = gelic_wl_set_essid,
-        IW_IOCTL(SIOCGIWESSID)          = gelic_wl_get_essid,
-        IW_IOCTL(SIOCSIWENCODE)         = gelic_wl_set_encode,
-        IW_IOCTL(SIOCGIWENCODE)         = gelic_wl_get_encode,
-        IW_IOCTL(SIOCSIWAP)             = gelic_wl_set_ap,
-        IW_IOCTL(SIOCGIWAP)             = gelic_wl_get_ap,
-        IW_IOCTL(SIOCSIWENCODEEXT)      = gelic_wl_set_encodeext,
-        IW_IOCTL(SIOCGIWENCODEEXT)      = gelic_wl_get_encodeext,
-        IW_IOCTL(SIOCSIWMODE)           = gelic_wl_set_mode,
-        IW_IOCTL(SIOCGIWMODE)           = gelic_wl_get_mode,
-        IW_IOCTL(SIOCGIWNICKN)          = gelic_wl_get_nick,
+        IW_HANDLER(SIOCGIWNAME, gelic_wl_get_name),
+        IW_HANDLER(SIOCGIWRANGE, gelic_wl_get_range),
+        IW_HANDLER(SIOCSIWSCAN, gelic_wl_set_scan),
+        IW_HANDLER(SIOCGIWSCAN, gelic_wl_get_scan),
+        IW_HANDLER(SIOCSIWAUTH, gelic_wl_set_auth),
+        IW_HANDLER(SIOCGIWAUTH, gelic_wl_get_auth),
+        IW_HANDLER(SIOCSIWESSID, gelic_wl_set_essid),
+        IW_HANDLER(SIOCGIWESSID, gelic_wl_get_essid),
+        IW_HANDLER(SIOCSIWENCODE, gelic_wl_set_encode),
+        IW_HANDLER(SIOCGIWENCODE, gelic_wl_get_encode),
+        IW_HANDLER(SIOCSIWAP, gelic_wl_set_ap),
+        IW_HANDLER(SIOCGIWAP, gelic_wl_get_ap),
+        IW_HANDLER(SIOCSIWENCODEEXT, gelic_wl_set_encodeext),
+        IW_HANDLER(SIOCGIWENCODEEXT, gelic_wl_get_encodeext),
+        IW_HANDLER(SIOCSIWMODE, gelic_wl_set_mode),
+        IW_HANDLER(SIOCGIWMODE, gelic_wl_get_mode),
+        IW_HANDLER(SIOCGIWNICKN, gelic_wl_get_nick),
 };
 
 static const struct iw_handler_def gelic_wl_wext_handler_def = {
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index dc5018a6d9ed..a441aad922c2 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -2876,7 +2876,7 @@ static struct net_device *_init_airo_card( unsigned short irq, int port,
         ai->wep_capable = (cap_rid.softCap & cpu_to_le16(0x02)) ? 1 : 0;
         ai->max_wep_idx = (cap_rid.softCap & cpu_to_le16(0x80)) ? 3 : 0;
 
-        airo_print_info(dev->name, "Firmware version %x.%x.%02x",
+        airo_print_info(dev->name, "Firmware version %x.%x.%02d",
                         ((le16_to_cpu(cap_rid.softVer) >> 8) & 0xF),
                         (le16_to_cpu(cap_rid.softVer) & 0xFF),
                         le16_to_cpu(cap_rid.softSubVer));
@@ -3193,19 +3193,26 @@ static void airo_print_status(const char *devname, u16 status)
 {
         u8 reason = status & 0xFF;
 
-        switch (status) {
+        switch (status & 0xFF00) {
         case STAT_NOBEACON:
-                airo_print_dbg(devname, "link lost (missed beacons)");
-                break;
-        case STAT_MAXRETRIES:
-        case STAT_MAXARL:
-                airo_print_dbg(devname, "link lost (max retries)");
-                break;
-        case STAT_FORCELOSS:
-                airo_print_dbg(devname, "link lost (local choice)");
-                break;
-        case STAT_TSFSYNC:
-                airo_print_dbg(devname, "link lost (TSF sync lost)");
+                switch (status) {
+                case STAT_NOBEACON:
+                        airo_print_dbg(devname, "link lost (missed beacons)");
+                        break;
+                case STAT_MAXRETRIES:
+                case STAT_MAXARL:
+                        airo_print_dbg(devname, "link lost (max retries)");
+                        break;
+                case STAT_FORCELOSS:
+                        airo_print_dbg(devname, "link lost (local choice)");
+                        break;
+                case STAT_TSFSYNC:
+                        airo_print_dbg(devname, "link lost (TSF sync lost)");
+                        break;
+                default:
+                        airo_print_dbg(devname, "unknow status %x\n", status);
+                        break;
+                }
                 break;
         case STAT_DEAUTH:
                 airo_print_dbg(devname, "deauthenticated (reason: %d)", reason);
@@ -3221,7 +3228,11 @@ static void airo_print_status(const char *devname, u16 status)
                 airo_print_dbg(devname, "authentication failed (reason: %d)",
                                reason);
                 break;
+        case STAT_ASSOC:
+        case STAT_REASSOC:
+                break;
         default:
+                airo_print_dbg(devname, "unknow status %x\n", status);
                 break;
         }
 }
diff --git a/drivers/net/wireless/ath/Kconfig b/drivers/net/wireless/ath/Kconfig
index 4e7a7fd695c8..0a75be027afa 100644
--- a/drivers/net/wireless/ath/Kconfig
+++ b/drivers/net/wireless/ath/Kconfig
@@ -3,7 +3,7 @@ menuconfig ATH_COMMON
         depends on CFG80211
         ---help---
           This will enable the support for the Atheros wireless drivers.
-          ath5k, ath9k and ar9170 drivers share some common code, this option
+          ath5k, ath9k, ath9k_htc and ar9170 drivers share some common code, this option
           enables the common ath.ko module which shares common helpers.
 
           For more information and documentation on this module you can visit:
diff --git a/drivers/net/wireless/ath/ar9170/cmd.h b/drivers/net/wireless/ath/ar9170/cmd.h
index 826c45e6b274..ec8134b4b949 100644
--- a/drivers/net/wireless/ath/ar9170/cmd.h
+++ b/drivers/net/wireless/ath/ar9170/cmd.h
@@ -79,7 +79,7 @@ __regwrite_out :							\
         if (__nreg) {                                                   \
                 if (IS_ACCEPTING_CMD(__ar))                             \
                         __err = ar->exec_cmd(__ar, AR9170_CMD_WREG,     \
-                                             8 * __nreg,                \
+                                             8 * __nreg,                \
                                              (u8 *) &__ar->cmdbuf[1],   \
                                              0, NULL);                  \
                 __nreg = 0;                                             \
diff --git a/drivers/net/wireless/ath/ar9170/eeprom.h b/drivers/net/wireless/ath/ar9170/eeprom.h
index d2c8cc83f1dd..6c4663883423 100644
--- a/drivers/net/wireless/ath/ar9170/eeprom.h
+++ b/drivers/net/wireless/ath/ar9170/eeprom.h
@@ -127,8 +127,8 @@ struct ar9170_eeprom {
         __le16  checksum;
         __le16  version;
         u8      operating_flags;
-#define AR9170_OPFLAG_5GHZ              1
-#define AR9170_OPFLAG_2GHZ              2
+#define AR9170_OPFLAG_5GHZ              1
+#define AR9170_OPFLAG_2GHZ              2
         u8      misc;
         __le16  reg_domain[2];
         u8      mac_address[6];
diff --git a/drivers/net/wireless/ath/ar9170/hw.h b/drivers/net/wireless/ath/ar9170/hw.h
index 0a1d4c28e68a..06f1f3c951a4 100644
--- a/drivers/net/wireless/ath/ar9170/hw.h
+++ b/drivers/net/wireless/ath/ar9170/hw.h
@@ -425,5 +425,6 @@ enum ar9170_txq {
 
 #define AR9170_TXQ_DEPTH        32
 #define AR9170_TX_MAX_PENDING   128
+#define AR9170_RX_STREAM_MAX_SIZE 65535
 
 #endif /* __AR9170_HW_H */
diff --git a/drivers/net/wireless/ath/ar9170/main.c b/drivers/net/wireless/ath/ar9170/main.c
index f4650fcdebc9..fed6695ec04e 100644
--- a/drivers/net/wireless/ath/ar9170/main.c
+++ b/drivers/net/wireless/ath/ar9170/main.c
@@ -235,7 +235,7 @@ static void __ar9170_dump_txqueue(struct ar9170 *ar,
                wiphy_name(ar->hw->wiphy), skb_queue_len(queue));
 
         skb_queue_walk(queue, skb) {
-                printk(KERN_DEBUG "index:%d => \n", i++);
+                printk(KERN_DEBUG "index:%d =>\n", i++);
                 ar9170_print_txheader(ar, skb);
         }
         if (i != skb_queue_len(queue))
@@ -280,7 +280,7 @@ static void ar9170_dump_tx_status_ampdu(struct ar9170 *ar)
         unsigned long flags;
 
         spin_lock_irqsave(&ar->tx_status_ampdu.lock, flags);
-        printk(KERN_DEBUG "%s: A-MPDU tx_status queue => \n",
+        printk(KERN_DEBUG "%s: A-MPDU tx_status queue =>\n",
                wiphy_name(ar->hw->wiphy));
         __ar9170_dump_txqueue(ar, &ar->tx_status_ampdu);
         spin_unlock_irqrestore(&ar->tx_status_ampdu.lock, flags);
@@ -307,7 +307,7 @@ static void ar9170_recycle_expired(struct ar9170 *ar,
                 if (time_is_before_jiffies(arinfo->timeout)) {
 #ifdef AR9170_QUEUE_DEBUG
                         printk(KERN_DEBUG "%s: [%ld > %ld] frame expired => "
-                               "recycle \n", wiphy_name(ar->hw->wiphy),
+                               "recycle\n", wiphy_name(ar->hw->wiphy),
                                jiffies, arinfo->timeout);
                         ar9170_print_txheader(ar, skb);
 #endif /* AR9170_QUEUE_DEBUG */
@@ -688,7 +688,8 @@ void ar9170_handle_command_response(struct ar9170 *ar, void *buf, u32 len)
 
         /* firmware debug */
         case 0xca:
-                printk(KERN_DEBUG "ar9170 FW: %.*s\n", len - 4, (char *)buf + 4);
+                printk(KERN_DEBUG "ar9170 FW: %.*s\n", len - 4,
+                                (char *)buf + 4);
                 break;
         case 0xcb:
                 len -= 4;
@@ -1727,7 +1728,7 @@ static void ar9170_tx(struct ar9170 *ar)
                         printk(KERN_DEBUG "%s: queue %d full\n",
                                wiphy_name(ar->hw->wiphy), i);
 
-                        printk(KERN_DEBUG "%s: stuck frames: ===> \n",
+                        printk(KERN_DEBUG "%s: stuck frames: ===>\n",
                                wiphy_name(ar->hw->wiphy));
                         ar9170_dump_txqueue(ar, &ar->tx_pending[i]);
                         ar9170_dump_txqueue(ar, &ar->tx_status[i]);
@@ -2515,7 +2516,7 @@ void *ar9170_alloc(size_t priv_size)
          * tends to split the streams into seperate rx descriptors.
          */
 
-        skb = __dev_alloc_skb(AR9170_MAX_RX_BUFFER_SIZE, GFP_KERNEL);
+        skb = __dev_alloc_skb(AR9170_RX_STREAM_MAX_SIZE, GFP_KERNEL);
         if (!skb)
                 goto err_nomem;
 
diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index 71fc960814f0..1fbf6b1f9a7e 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -48,6 +48,12 @@ enum ath_device_state {
         ATH_HW_INITIALIZED,
 };
 
+enum ath_bus_type {
+        ATH_PCI,
+        ATH_AHB,
+        ATH_USB,
+};
+
 struct reg_dmn_pair_mapping {
         u16 regDmnEnum;
         u16 reg_5ghz_ctl;
@@ -73,9 +79,10 @@ struct ath_ops {
 struct ath_common;
 
 struct ath_bus_ops {
-        void            (*read_cachesize)(struct ath_common *common, int *csz);
-        bool            (*eeprom_read)(struct ath_common *common, u32 off, u16 *data);
-        void            (*bt_coex_prep)(struct ath_common *common);
+        enum ath_bus_type ath_bus_type;
+        void (*read_cachesize)(struct ath_common *common, int *csz);
+        bool (*eeprom_read)(struct ath_common *common, u32 off, u16 *data);
+        void (*bt_coex_prep)(struct ath_common *common);
 };
 
 struct ath_common {
diff --git a/drivers/net/wireless/ath/ath5k/Makefile b/drivers/net/wireless/ath/ath5k/Makefile
index 090dc6d268a3..cc09595b781a 100644
--- a/drivers/net/wireless/ath/ath5k/Makefile
+++ b/drivers/net/wireless/ath/ath5k/Makefile
@@ -12,5 +12,6 @@ ath5k-y				+= attach.o
 ath5k-y                         += base.o
 ath5k-y                         += led.o
 ath5k-y                         += rfkill.o
+ath5k-y                         += ani.o
 ath5k-$(CONFIG_ATH5K_DEBUG)     += debug.o
 obj-$(CONFIG_ATH5K)             += ath5k.o
diff --git a/drivers/net/wireless/ath/ath5k/ani.c b/drivers/net/wireless/ath/ath5k/ani.c
new file mode 100644
index 000000000000..584a32859bdb
--- /dev/null
+++ b/drivers/net/wireless/ath/ath5k/ani.c
@@ -0,0 +1,744 @@
+/*
+ * Copyright (C) 2010 Bruno Randolf <br1@einfach.org>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "ath5k.h"
+#include "base.h"
+#include "reg.h"
+#include "debug.h"
+#include "ani.h"
+
+/**
+ * DOC: Basic ANI Operation
+ *
+ * Adaptive Noise Immunity (ANI) controls five noise immunity parameters
+ * depending on the amount of interference in the environment, increasing
+ * or reducing sensitivity as necessary.
+ *
+ * The parameters are:
+ *   - "noise immunity"
+ *   - "spur immunity"
+ *   - "firstep level"
+ *   - "OFDM weak signal detection"
+ *   - "CCK weak signal detection"
+ *
+ * Basically we look at the amount of ODFM and CCK timing errors we get and then
+ * raise or lower immunity accordingly by setting one or more of these
+ * parameters.
+ * Newer chipsets have PHY error counters in hardware which will generate a MIB
+ * interrupt when they overflow. Older hardware has too enable PHY error frames
+ * by setting a RX flag and then count every single PHY error. When a specified
+ * threshold of errors has been reached we will raise immunity.
+ * Also we regularly check the amount of errors and lower or raise immunity as
+ * necessary.
+ */
+
+
+/*** ANI parameter control ***/
+
+/**
+ * ath5k_ani_set_noise_immunity_level() - Set noise immunity level
+ *
+ * @level: level between 0 and @ATH5K_ANI_MAX_NOISE_IMM_LVL
+ */
+void
+ath5k_ani_set_noise_immunity_level(struct ath5k_hw *ah, int level)
+{
+        /* TODO:
+         * ANI documents suggest the following five levels to use, but the HAL
+         * and ath9k use only use the last two levels, making this
+         * essentially an on/off option. There *may* be a reason for this (???),
+         * so i stick with the HAL version for now...
+         */
+#if 0
+        const s8 hi[] = { -18, -18, -16, -14, -12 };
+        const s8 lo[] = { -52, -56, -60, -64, -70 };
+        const s8 sz[] = { -34, -41, -48, -55, -62 };
+        const s8 fr[] = { -70, -72, -75, -78, -80 };
+#else
+        const s8 sz[] = { -55, -62 };
+        const s8 lo[] = { -64, -70 };
+        const s8 hi[] = { -14, -12 };
+        const s8 fr[] = { -78, -80 };
+#endif
+        if (level < 0 || level > ARRAY_SIZE(sz)) {
+                ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI,
+                        "level out of range %d", level);
+                return;
+        }
+
+        AR5K_REG_WRITE_BITS(ah, AR5K_PHY_DESIRED_SIZE,
+                                AR5K_PHY_DESIRED_SIZE_TOT, sz[level]);
+        AR5K_REG_WRITE_BITS(ah, AR5K_PHY_AGCCOARSE,
+                                AR5K_PHY_AGCCOARSE_LO, lo[level]);
+        AR5K_REG_WRITE_BITS(ah, AR5K_PHY_AGCCOARSE,
+                                AR5K_PHY_AGCCOARSE_HI, hi[level]);
+        AR5K_REG_WRITE_BITS(ah, AR5K_PHY_SIG,
+                                AR5K_PHY_SIG_FIRPWR, fr[level]);
+
+        ah->ah_sc->ani_state.noise_imm_level = level;
+        ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI, "new level %d", level);
+}
+
+
+/**
+ * ath5k_ani_set_spur_immunity_level() - Set spur immunity level
+ *
+ * @level: level between 0 and @max_spur_level (the maximum level is dependent
+ *      on the chip revision).
+ */
+void
+ath5k_ani_set_spur_immunity_level(struct ath5k_hw *ah, int level)
+{
+        const int val[] = { 2, 4, 6, 8, 10, 12, 14, 16 };
+
+        if (level < 0 || level > ARRAY_SIZE(val) ||
+            level > ah->ah_sc->ani_state.max_spur_level) {
+                ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI,
+                        "level out of range %d", level);
+                return;
+        }
+
+        AR5K_REG_WRITE_BITS(ah, AR5K_PHY_OFDM_SELFCORR,
+                AR5K_PHY_OFDM_SELFCORR_CYPWR_THR1, val[level]);
+
+        ah->ah_sc->ani_state.spur_level = level;
+        ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI, "new level %d", level);
+}
+
+
+/**
+ * ath5k_ani_set_firstep_level() - Set "firstep" level
+ *
+ * @level: level between 0 and @ATH5K_ANI_MAX_FIRSTEP_LVL
+ */
+void
+ath5k_ani_set_firstep_level(struct ath5k_hw *ah, int level)
+{
+        const int val[] = { 0, 4, 8 };
+
+        if (level < 0 || level > ARRAY_SIZE(val)) {
+                ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI,
+                        "level out of range %d", level);
+                return;
+        }
+
+        AR5K_REG_WRITE_BITS(ah, AR5K_PHY_SIG,
+                                AR5K_PHY_SIG_FIRSTEP, val[level]);
+
+        ah->ah_sc->ani_state.firstep_level = level;
+        ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI, "new level %d", level);
+}
+
+
+/**
+ * ath5k_ani_set_ofdm_weak_signal_detection() - Control OFDM weak signal
+ *                                              detection
+ *
+ * @on: turn on or off
+ */
+void
+ath5k_ani_set_ofdm_weak_signal_detection(struct ath5k_hw *ah, bool on)
+{
+        const int m1l[] = { 127, 50 };
+        const int m2l[] = { 127, 40 };
+        const int m1[] = { 127, 0x4d };
+        const int m2[] = { 127, 0x40 };
+        const int m2cnt[] = { 31, 16 };
+        const int m2lcnt[] = { 63, 48 };
+
+        AR5K_REG_WRITE_BITS(ah, AR5K_PHY_WEAK_OFDM_LOW_THR,
+                                AR5K_PHY_WEAK_OFDM_LOW_THR_M1, m1l[on]);
+        AR5K_REG_WRITE_BITS(ah, AR5K_PHY_WEAK_OFDM_LOW_THR,
+                                AR5K_PHY_WEAK_OFDM_LOW_THR_M2, m2l[on]);
+        AR5K_REG_WRITE_BITS(ah, AR5K_PHY_WEAK_OFDM_HIGH_THR,
+                                AR5K_PHY_WEAK_OFDM_HIGH_THR_M1, m1[on]);
+        AR5K_REG_WRITE_BITS(ah, AR5K_PHY_WEAK_OFDM_HIGH_THR,
+                                AR5K_PHY_WEAK_OFDM_HIGH_THR_M2, m2[on]);
+        AR5K_REG_WRITE_BITS(ah, AR5K_PHY_WEAK_OFDM_HIGH_THR,
+                        AR5K_PHY_WEAK_OFDM_HIGH_THR_M2_COUNT, m2cnt[on]);
+        AR5K_REG_WRITE_BITS(ah, AR5K_PHY_WEAK_OFDM_LOW_THR,
+                        AR5K_PHY_WEAK_OFDM_LOW_THR_M2_COUNT, m2lcnt[on]);
+
+        if (on)
+                AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_WEAK_OFDM_LOW_THR,
+                                AR5K_PHY_WEAK_OFDM_LOW_THR_SELFCOR_EN);
+        else
+                AR5K_REG_DISABLE_BITS(ah, AR5K_PHY_WEAK_OFDM_LOW_THR,
+                                AR5K_PHY_WEAK_OFDM_LOW_THR_SELFCOR_EN);
+
+        ah->ah_sc->ani_state.ofdm_weak_sig = on;
+        ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI, "turned %s",
+                          on ? "on" : "off");
+}
+
+
+/**
+ * ath5k_ani_set_cck_weak_signal_detection() - control CCK weak signal detection
+ *
+ * @on: turn on or off
+ */
+void
+ath5k_ani_set_cck_weak_signal_detection(struct ath5k_hw *ah, bool on)
+{
+        const int val[] = { 8, 6 };
+        AR5K_REG_WRITE_BITS(ah, AR5K_PHY_CCK_CROSSCORR,
+                                AR5K_PHY_CCK_CROSSCORR_WEAK_SIG_THR, val[on]);
+        ah->ah_sc->ani_state.cck_weak_sig = on;
+        ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI, "turned %s",
+                          on ? "on" : "off");
+}
+
+
+/*** ANI algorithm ***/
+
+/**
+ * ath5k_ani_raise_immunity() - Increase noise immunity
+ *
+ * @ofdm_trigger: If this is true we are called because of too many OFDM errors,
+ *      the algorithm will tune more parameters then.
+ *
+ * Try to raise noise immunity (=decrease sensitivity) in several steps
+ * depending on the average RSSI of the beacons we received.
+ */
+static void
+ath5k_ani_raise_immunity(struct ath5k_hw *ah, struct ath5k_ani_state *as,
+                         bool ofdm_trigger)
+{
+        int rssi = ah->ah_beacon_rssi_avg.avg;
+
+        ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI, "raise immunity (%s)",
+                ofdm_trigger ? "ODFM" : "CCK");
+
+        /* first: raise noise immunity */
+        if (as->noise_imm_level < ATH5K_ANI_MAX_NOISE_IMM_LVL) {
+                ath5k_ani_set_noise_immunity_level(ah, as->noise_imm_level + 1);
+                return;
+        }
+
+        /* only OFDM: raise spur immunity level */
+        if (ofdm_trigger &&
+            as->spur_level < ah->ah_sc->ani_state.max_spur_level) {
+                ath5k_ani_set_spur_immunity_level(ah, as->spur_level + 1);
+                return;
+        }
+
+        /* AP mode */
+        if (ah->ah_sc->opmode == NL80211_IFTYPE_AP) {
+                if (as->firstep_level < ATH5K_ANI_MAX_FIRSTEP_LVL)
+                        ath5k_ani_set_firstep_level(ah, as->firstep_level + 1);
+                return;
+        }
+
+        /* STA and IBSS mode */
+
+        /* TODO: for IBSS mode it would be better to keep a beacon RSSI average
+         * per each neighbour node and use the minimum of these, to make sure we
+         * don't shut out a remote node by raising immunity too high. */
+
+        if (rssi > ATH5K_ANI_RSSI_THR_HIGH) {
+                ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI,
+                                  "beacon RSSI high");
+                /* only OFDM: beacon RSSI is high, we can disable ODFM weak
+                 * signal detection */
+                if (ofdm_trigger && as->ofdm_weak_sig == true) {
+                        ath5k_ani_set_ofdm_weak_signal_detection(ah, false);
+                        ath5k_ani_set_spur_immunity_level(ah, 0);
+                        return;
+                }
+                /* as a last resort or CCK: raise firstep level */
+                if (as->firstep_level < ATH5K_ANI_MAX_FIRSTEP_LVL) {
+                        ath5k_ani_set_firstep_level(ah, as->firstep_level + 1);
+                        return;
+                }
+        } else if (rssi > ATH5K_ANI_RSSI_THR_LOW) {
+                /* beacon RSSI in mid range, we need OFDM weak signal detect,
+                 * but can raise firstep level */
+                ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI,
+                                  "beacon RSSI mid");
+                if (ofdm_trigger && as->ofdm_weak_sig == false)
+                        ath5k_ani_set_ofdm_weak_signal_detection(ah, true);
+                if (as->firstep_level < ATH5K_ANI_MAX_FIRSTEP_LVL)
+                        ath5k_ani_set_firstep_level(ah, as->firstep_level + 1);
+                return;
+        } else if (ah->ah_current_channel->band == IEEE80211_BAND_2GHZ) {
+                /* beacon RSSI is low. in B/G mode turn of OFDM weak signal
+                 * detect and zero firstep level to maximize CCK sensitivity */
+                ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI,
+                                  "beacon RSSI low, 2GHz");
+                if (ofdm_trigger && as->ofdm_weak_sig == true)
+                        ath5k_ani_set_ofdm_weak_signal_detection(ah, false);
+                if (as->firstep_level > 0)
+                        ath5k_ani_set_firstep_level(ah, 0);
+                return;
+        }
+
+        /* TODO: why not?:
+        if (as->cck_weak_sig == true) {
+                ath5k_ani_set_cck_weak_signal_detection(ah, false);
+        }
+        */
+}
+
+
+/**
+ * ath5k_ani_lower_immunity() - Decrease noise immunity
+ *
+ * Try to lower noise immunity (=increase sensitivity) in several steps
+ * depending on the average RSSI of the beacons we received.
+ */
+static void
+ath5k_ani_lower_immunity(struct ath5k_hw *ah, struct ath5k_ani_state *as)
+{
+        int rssi = ah->ah_beacon_rssi_avg.avg;
+
+        ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI, "lower immunity");
+
+        if (ah->ah_sc->opmode == NL80211_IFTYPE_AP) {
+                /* AP mode */
+                if (as->firstep_level > 0) {
+                        ath5k_ani_set_firstep_level(ah, as->firstep_level - 1);
+                        return;
+                }
+        } else {
+                /* STA and IBSS mode (see TODO above) */
+                if (rssi > ATH5K_ANI_RSSI_THR_HIGH) {
+                        /* beacon signal is high, leave OFDM weak signal
+                         * detection off or it may oscillate
+                         * TODO: who said it's off??? */
+                } else if (rssi > ATH5K_ANI_RSSI_THR_LOW) {
+                        /* beacon RSSI is mid-range: turn on ODFM weak signal
+                         * detection and next, lower firstep level */
+                        if (as->ofdm_weak_sig == false) {
+                                ath5k_ani_set_ofdm_weak_signal_detection(ah,
+                                                                         true);
+                                return;
+                        }
+                        if (as->firstep_level > 0) {
+                                ath5k_ani_set_firstep_level(ah,
+                                                        as->firstep_level - 1);
+                                return;
+                        }
+                } else {
+                        /* beacon signal is low: only reduce firstep level */
+                        if (as->firstep_level > 0) {
+                                ath5k_ani_set_firstep_level(ah,
+                                                        as->firstep_level - 1);
+                                return;
+                        }
+                }
+        }
+
+        /* all modes */
+        if (as->spur_level > 0) {
+                ath5k_ani_set_spur_immunity_level(ah, as->spur_level - 1);
+                return;
+        }
+
+        /* finally, reduce noise immunity */
+        if (as->noise_imm_level > 0) {
+                ath5k_ani_set_noise_immunity_level(ah, as->noise_imm_level - 1);
+                return;
+        }
+}
+
+
+/**
+ * ath5k_hw_ani_get_listen_time() - Calculate time spent listening
+ *
+ * Return an approximation of the time spent "listening" in milliseconds (ms)
+ * since the last call of this function by deducting the cycles spent
+ * transmitting and receiving from the total cycle count.
+ * Save profile count values for debugging/statistics and because we might want
+ * to use them later.
+ *
+ * We assume no one else clears these registers!
+ */
+static int
+ath5k_hw_ani_get_listen_time(struct ath5k_hw *ah, struct ath5k_ani_state *as)
+{
+        int listen;
+
+        /* freeze */
+        ath5k_hw_reg_write(ah, AR5K_MIBC_FMC, AR5K_MIBC);
+        /* read */
+        as->pfc_cycles = ath5k_hw_reg_read(ah, AR5K_PROFCNT_CYCLE);
+        as->pfc_busy = ath5k_hw_reg_read(ah, AR5K_PROFCNT_RXCLR);
+        as->pfc_tx = ath5k_hw_reg_read(ah, AR5K_PROFCNT_TX);
+        as->pfc_rx = ath5k_hw_reg_read(ah, AR5K_PROFCNT_RX);
+        /* clear */
+        ath5k_hw_reg_write(ah, 0, AR5K_PROFCNT_TX);
+        ath5k_hw_reg_write(ah, 0, AR5K_PROFCNT_RX);
+        ath5k_hw_reg_write(ah, 0, AR5K_PROFCNT_RXCLR);
+        ath5k_hw_reg_write(ah, 0, AR5K_PROFCNT_CYCLE);
+        /* un-freeze */
+        ath5k_hw_reg_write(ah, 0, AR5K_MIBC);
+
+        /* TODO: where does 44000 come from? (11g clock rate?) */
+        listen = (as->pfc_cycles - as->pfc_rx - as->pfc_tx) / 44000;
+
+        if (as->pfc_cycles == 0 || listen < 0)
+                return 0;
+        return listen;
+}
+
+
+/**
+ * ath5k_ani_save_and_clear_phy_errors() - Clear and save PHY error counters
+ *
+ * Clear the PHY error counters as soon as possible, since this might be called
+ * from a MIB interrupt and we want to make sure we don't get interrupted again.
+ * Add the count of CCK and OFDM errors to our internal state, so it can be used
+ * by the algorithm later.
+ *
+ * Will be called from interrupt and tasklet context.
+ * Returns 0 if both counters are zero.
+ */
+static int
+ath5k_ani_save_and_clear_phy_errors(struct ath5k_hw *ah,
+                                    struct ath5k_ani_state *as)
+{
+        unsigned int ofdm_err, cck_err;
+
+        if (!ah->ah_capabilities.cap_has_phyerr_counters)
+                return 0;
+
+        ofdm_err = ath5k_hw_reg_read(ah, AR5K_PHYERR_CNT1);
+        cck_err = ath5k_hw_reg_read(ah, AR5K_PHYERR_CNT2);
+
+        /* reset counters first, we might be in a hurry (interrupt) */
+        ath5k_hw_reg_write(ah, ATH5K_PHYERR_CNT_MAX - ATH5K_ANI_OFDM_TRIG_HIGH,
+                           AR5K_PHYERR_CNT1);
+        ath5k_hw_reg_write(ah, ATH5K_PHYERR_CNT_MAX - ATH5K_ANI_CCK_TRIG_HIGH,
+                           AR5K_PHYERR_CNT2);
+
+        ofdm_err = ATH5K_ANI_OFDM_TRIG_HIGH - (ATH5K_PHYERR_CNT_MAX - ofdm_err);
+        cck_err = ATH5K_ANI_CCK_TRIG_HIGH - (ATH5K_PHYERR_CNT_MAX - cck_err);
+
+        /* sometimes both can be zero, especially when there is a superfluous
+         * second interrupt. detect that here and return an error. */
+        if (ofdm_err <= 0 && cck_err <= 0)
+                return 0;
+
+        /* avoid negative values should one of the registers overflow */
+        if (ofdm_err > 0) {
+                as->ofdm_errors += ofdm_err;
+                as->sum_ofdm_errors += ofdm_err;
+        }
+        if (cck_err > 0) {
+                as->cck_errors += cck_err;
+                as->sum_cck_errors += cck_err;
+        }
+        return 1;
+}
+
+
+/**
+ * ath5k_ani_period_restart() - Restart ANI period
+ *
+ * Just reset counters, so they are clear for the next "ani period".
+ */
+static void
+ath5k_ani_period_restart(struct ath5k_hw *ah, struct ath5k_ani_state *as)
+{
+        /* keep last values for debugging */
+        as->last_ofdm_errors = as->ofdm_errors;
+        as->last_cck_errors = as->cck_errors;
+        as->last_listen = as->listen_time;
+
+        as->ofdm_errors = 0;
+        as->cck_errors = 0;
+        as->listen_time = 0;
+}
+
+
+/**
+ * ath5k_ani_calibration() - The main ANI calibration function
+ *
+ * We count OFDM and CCK errors relative to the time where we did not send or
+ * receive ("listen" time) and raise or lower immunity accordingly.
+ * This is called regularly (every second) from the calibration timer, but also
+ * when an error threshold has been reached.
+ *
+ * In order to synchronize access from different contexts, this should be
+ * called only indirectly by scheduling the ANI tasklet!
+ */
+void
+ath5k_ani_calibration(struct ath5k_hw *ah)
+{
+        struct ath5k_ani_state *as = &ah->ah_sc->ani_state;
+        int listen, ofdm_high, ofdm_low, cck_high, cck_low;
+
+        if (as->ani_mode != ATH5K_ANI_MODE_AUTO)
+                return;
+
+        /* get listen time since last call and add it to the counter because we
+         * might not have restarted the "ani period" last time */
+        listen = ath5k_hw_ani_get_listen_time(ah, as);
+        as->listen_time += listen;
+
+        ath5k_ani_save_and_clear_phy_errors(ah, as);
+
+        ofdm_high = as->listen_time * ATH5K_ANI_OFDM_TRIG_HIGH / 1000;
+        cck_high = as->listen_time * ATH5K_ANI_CCK_TRIG_HIGH / 1000;
+        ofdm_low = as->listen_time * ATH5K_ANI_OFDM_TRIG_LOW / 1000;
+        cck_low = as->listen_time * ATH5K_ANI_CCK_TRIG_LOW / 1000;
+
+        ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI,
+                "listen %d (now %d)", as->listen_time, listen);
+        ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI,
+                "check high ofdm %d/%d cck %d/%d",
+                as->ofdm_errors, ofdm_high, as->cck_errors, cck_high);
+
+        if (as->ofdm_errors > ofdm_high || as->cck_errors > cck_high) {
+                /* too many PHY errors - we have to raise immunity */
+                bool ofdm_flag = as->ofdm_errors > ofdm_high ? true : false;
+                ath5k_ani_raise_immunity(ah, as, ofdm_flag);
+                ath5k_ani_period_restart(ah, as);
+
+        } else if (as->listen_time > 5 * ATH5K_ANI_LISTEN_PERIOD) {
+                /* If more than 5 (TODO: why 5?) periods have passed and we got
+                 * relatively little errors we can try to lower immunity */
+                ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI,
+                        "check low ofdm %d/%d cck %d/%d",
+                        as->ofdm_errors, ofdm_low, as->cck_errors, cck_low);
+
+                if (as->ofdm_errors <= ofdm_low && as->cck_errors <= cck_low)
+                        ath5k_ani_lower_immunity(ah, as);
+
+                ath5k_ani_period_restart(ah, as);
+        }
+}
+
+
+/*** INTERRUPT HANDLER ***/
+
+/**
+ * ath5k_ani_mib_intr() - Interrupt handler for ANI MIB counters
+ *
+ * Just read & reset the registers quickly, so they don't generate more
+ * interrupts, save the counters and schedule the tasklet to decide whether
+ * to raise immunity or not.
+ *
+ * We just need to handle PHY error counters, ath5k_hw_update_mib_counters()
+ * should take care of all "normal" MIB interrupts.
+ */
+void
+ath5k_ani_mib_intr(struct ath5k_hw *ah)
+{
+        struct ath5k_ani_state *as = &ah->ah_sc->ani_state;
+
+        /* nothing to do here if HW does not have PHY error counters - they
+         * can't be the reason for the MIB interrupt then */
+        if (!ah->ah_capabilities.cap_has_phyerr_counters)
+                return;
+
+        /* not in use but clear anyways */
+        ath5k_hw_reg_write(ah, 0, AR5K_OFDM_FIL_CNT);
+        ath5k_hw_reg_write(ah, 0, AR5K_CCK_FIL_CNT);
+
+        if (ah->ah_sc->ani_state.ani_mode != ATH5K_ANI_MODE_AUTO)
+                return;
+
+        /* if one of the errors triggered, we can get a superfluous second
+         * interrupt, even though we have already reset the register. the
+         * function detects that so we can return early */
+        if (ath5k_ani_save_and_clear_phy_errors(ah, as) == 0)
+                return;
+
+        if (as->ofdm_errors > ATH5K_ANI_OFDM_TRIG_HIGH ||
+            as->cck_errors > ATH5K_ANI_CCK_TRIG_HIGH)
+                tasklet_schedule(&ah->ah_sc->ani_tasklet);
+}
+
+
+/**
+ * ath5k_ani_phy_error_report() - Used by older HW to report PHY errors
+ *
+ * This is used by hardware without PHY error counters to report PHY errors
+ * on a frame-by-frame basis, instead of the interrupt.
+ */
+void
+ath5k_ani_phy_error_report(struct ath5k_hw *ah,
+                           enum ath5k_phy_error_code phyerr)
+{
+        struct ath5k_ani_state *as = &ah->ah_sc->ani_state;
+
+        if (phyerr == AR5K_RX_PHY_ERROR_OFDM_TIMING) {
+                as->ofdm_errors++;
+                if (as->ofdm_errors > ATH5K_ANI_OFDM_TRIG_HIGH)
+                        tasklet_schedule(&ah->ah_sc->ani_tasklet);
+        } else if (phyerr == AR5K_RX_PHY_ERROR_CCK_TIMING) {
+                as->cck_errors++;
+                if (as->cck_errors > ATH5K_ANI_CCK_TRIG_HIGH)
+                        tasklet_schedule(&ah->ah_sc->ani_tasklet);
+        }
+}
+
+
+/*** INIT ***/
+
+/**
+ * ath5k_enable_phy_err_counters() - Enable PHY error counters
+ *
+ * Enable PHY error counters for OFDM and CCK timing errors.
+ */
+static void
+ath5k_enable_phy_err_counters(struct ath5k_hw *ah)
+{
+        ath5k_hw_reg_write(ah, ATH5K_PHYERR_CNT_MAX - ATH5K_ANI_OFDM_TRIG_HIGH,
+                           AR5K_PHYERR_CNT1);
+        ath5k_hw_reg_write(ah, ATH5K_PHYERR_CNT_MAX - ATH5K_ANI_CCK_TRIG_HIGH,
+                           AR5K_PHYERR_CNT2);
+        ath5k_hw_reg_write(ah, AR5K_PHY_ERR_FIL_OFDM, AR5K_PHYERR_CNT1_MASK);
+        ath5k_hw_reg_write(ah, AR5K_PHY_ERR_FIL_CCK, AR5K_PHYERR_CNT2_MASK);
+
+        /* not in use */
+        ath5k_hw_reg_write(ah, 0, AR5K_OFDM_FIL_CNT);
+        ath5k_hw_reg_write(ah, 0, AR5K_CCK_FIL_CNT);
+}
+
+
+/**
+ * ath5k_disable_phy_err_counters() - Disable PHY error counters
+ *
+ * Disable PHY error counters for OFDM and CCK timing errors.
+ */
+static void
+ath5k_disable_phy_err_counters(struct ath5k_hw *ah)
+{
+        ath5k_hw_reg_write(ah, 0, AR5K_PHYERR_CNT1);
+        ath5k_hw_reg_write(ah, 0, AR5K_PHYERR_CNT2);
+        ath5k_hw_reg_write(ah, 0, AR5K_PHYERR_CNT1_MASK);
+        ath5k_hw_reg_write(ah, 0, AR5K_PHYERR_CNT2_MASK);
+
+        /* not in use */
+        ath5k_hw_reg_write(ah, 0, AR5K_OFDM_FIL_CNT);
+        ath5k_hw_reg_write(ah, 0, AR5K_CCK_FIL_CNT);
+}
+
+
+/**
+ * ath5k_ani_init() - Initialize ANI
+ * @mode: Which mode to use (auto, manual high, manual low, off)
+ *
+ * Initialize ANI according to mode.
+ */
+void
+ath5k_ani_init(struct ath5k_hw *ah, enum ath5k_ani_mode mode)
+{
+        /* ANI is only possible on 5212 and newer */
+        if (ah->ah_version < AR5K_AR5212)
+                return;
+
+        /* clear old state information */
+        memset(&ah->ah_sc->ani_state, 0, sizeof(ah->ah_sc->ani_state));
+
+        /* older hardware has more spur levels than newer */
+        if (ah->ah_mac_srev < AR5K_SREV_AR2414)
+                ah->ah_sc->ani_state.max_spur_level = 7;
+        else
+                ah->ah_sc->ani_state.max_spur_level = 2;
+
+        /* initial values for our ani parameters */
+        if (mode == ATH5K_ANI_MODE_OFF) {
+                ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI, "ANI off\n");
+        } else if  (mode == ATH5K_ANI_MODE_MANUAL_LOW) {
+                ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI,
+                        "ANI manual low -> high sensitivity\n");
+                ath5k_ani_set_noise_immunity_level(ah, 0);
+                ath5k_ani_set_spur_immunity_level(ah, 0);
+                ath5k_ani_set_firstep_level(ah, 0);
+                ath5k_ani_set_ofdm_weak_signal_detection(ah, true);
+                ath5k_ani_set_cck_weak_signal_detection(ah, true);
+        } else if (mode == ATH5K_ANI_MODE_MANUAL_HIGH) {
+                ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI,
+                        "ANI manual high -> low sensitivity\n");
+                ath5k_ani_set_noise_immunity_level(ah,
+                                        ATH5K_ANI_MAX_NOISE_IMM_LVL);
+                ath5k_ani_set_spur_immunity_level(ah,
+                                        ah->ah_sc->ani_state.max_spur_level);
+                ath5k_ani_set_firstep_level(ah, ATH5K_ANI_MAX_FIRSTEP_LVL);
+                ath5k_ani_set_ofdm_weak_signal_detection(ah, false);
+                ath5k_ani_set_cck_weak_signal_detection(ah, false);
+        } else if (mode == ATH5K_ANI_MODE_AUTO) {
+                ATH5K_DBG_UNLIMIT(ah->ah_sc, ATH5K_DEBUG_ANI, "ANI auto\n");
+                ath5k_ani_set_noise_immunity_level(ah, 0);
+                ath5k_ani_set_spur_immunity_level(ah, 0);
+                ath5k_ani_set_firstep_level(ah, 0);
+                ath5k_ani_set_ofdm_weak_signal_detection(ah, true);
+                ath5k_ani_set_cck_weak_signal_detection(ah, false);
+        }
+
+        /* newer hardware has PHY error counter registers which we can use to
+         * get OFDM and CCK error counts. older hardware has to set rxfilter and
+         * report every single PHY error by calling ath5k_ani_phy_error_report()
+         */
+        if (mode == ATH5K_ANI_MODE_AUTO) {
+                if (ah->ah_capabilities.cap_has_phyerr_counters)
+                        ath5k_enable_phy_err_counters(ah);
+                else
+                        ath5k_hw_set_rx_filter(ah, ath5k_hw_get_rx_filter(ah) |
+                                                   AR5K_RX_FILTER_PHYERR);
+        } else {
+                if (ah->ah_capabilities.cap_has_phyerr_counters)
+                        ath5k_disable_phy_err_counters(ah);
+                else
+                        ath5k_hw_set_rx_filter(ah, ath5k_hw_get_rx_filter(ah) &
+                                                   ~AR5K_RX_FILTER_PHYERR);
+        }
+
+        ah->ah_sc->ani_state.ani_mode = mode;
+}
+
+
+/*** DEBUG ***/
+
+#ifdef CONFIG_ATH5K_DEBUG
+
+void
+ath5k_ani_print_counters(struct ath5k_hw *ah)
+{
+        /* clears too */
+        printk(KERN_NOTICE "ACK fail\t%d\n",
+                ath5k_hw_reg_read(ah, AR5K_ACK_FAIL));
+        printk(KERN_NOTICE "RTS fail\t%d\n",
+                ath5k_hw_reg_read(ah, AR5K_RTS_FAIL));
+        printk(KERN_NOTICE "RTS success\t%d\n",
+                ath5k_hw_reg_read(ah, AR5K_RTS_OK));
+        printk(KERN_NOTICE "FCS error\t%d\n",
+                ath5k_hw_reg_read(ah, AR5K_FCS_FAIL));
+
+        /* no clear */
+        printk(KERN_NOTICE "tx\t%d\n",
+                ath5k_hw_reg_read(ah, AR5K_PROFCNT_TX));
+        printk(KERN_NOTICE "rx\t%d\n",
+                ath5k_hw_reg_read(ah, AR5K_PROFCNT_RX));
+        printk(KERN_NOTICE "busy\t%d\n",
+                ath5k_hw_reg_read(ah, AR5K_PROFCNT_RXCLR));
+        printk(KERN_NOTICE "cycles\t%d\n",
+                ath5k_hw_reg_read(ah, AR5K_PROFCNT_CYCLE));
+
+        printk(KERN_NOTICE "AR5K_PHYERR_CNT1\t%d\n",
+                ath5k_hw_reg_read(ah, AR5K_PHYERR_CNT1));
+        printk(KERN_NOTICE "AR5K_PHYERR_CNT2\t%d\n",
+                ath5k_hw_reg_read(ah, AR5K_PHYERR_CNT2));
+        printk(KERN_NOTICE "AR5K_OFDM_FIL_CNT\t%d\n",
+                ath5k_hw_reg_read(ah, AR5K_OFDM_FIL_CNT));
+        printk(KERN_NOTICE "AR5K_CCK_FIL_CNT\t%d\n",
+                ath5k_hw_reg_read(ah, AR5K_CCK_FIL_CNT));
+}
+
+#endif
diff --git a/drivers/net/wireless/ath/ath5k/ani.h b/drivers/net/wireless/ath/ath5k/ani.h
new file mode 100644
index 000000000000..55cf26d8522c
--- /dev/null
+++ b/drivers/net/wireless/ath/ath5k/ani.h
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2010 Bruno Randolf <br1@einfach.org>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef ANI_H
+#define ANI_H
+
+/* these thresholds are relative to the ATH5K_ANI_LISTEN_PERIOD */
+#define ATH5K_ANI_LISTEN_PERIOD         100
+#define ATH5K_ANI_OFDM_TRIG_HIGH        500
+#define ATH5K_ANI_OFDM_TRIG_LOW         200
+#define ATH5K_ANI_CCK_TRIG_HIGH         200
+#define ATH5K_ANI_CCK_TRIG_LOW          100
+
+/* average beacon RSSI thresholds */
+#define ATH5K_ANI_RSSI_THR_HIGH         40
+#define ATH5K_ANI_RSSI_THR_LOW          7
+
+/* maximum availabe levels */
+#define ATH5K_ANI_MAX_FIRSTEP_LVL       2
+#define ATH5K_ANI_MAX_NOISE_IMM_LVL     1
+
+
+/**
+ * enum ath5k_ani_mode - mode for ANI / noise sensitivity
+ *
+ * @ATH5K_ANI_MODE_OFF: Turn ANI off. This can be useful to just stop the ANI
+ *      algorithm after it has been on auto mode.
+ * ATH5K_ANI_MODE_MANUAL_LOW: Manually set all immunity parameters to low,
+ *      maximizing sensitivity. ANI will not run.
+ * ATH5K_ANI_MODE_MANUAL_HIGH: Manually set all immunity parameters to high,
+ *      minimizing sensitivity. ANI will not run.
+ * ATH5K_ANI_MODE_AUTO: Automatically control immunity parameters based on the
+ *      amount of OFDM and CCK frame errors (default).
+ */
+enum ath5k_ani_mode {
+        ATH5K_ANI_MODE_OFF              = 0,
+        ATH5K_ANI_MODE_MANUAL_LOW       = 1,
+        ATH5K_ANI_MODE_MANUAL_HIGH      = 2,
+        ATH5K_ANI_MODE_AUTO             = 3
+};
+
+
+/**
+ * struct ath5k_ani_state - ANI state and associated counters
+ *
+ * @max_spur_level: the maximum spur level is chip dependent
+ */
+struct ath5k_ani_state {
+        enum ath5k_ani_mode     ani_mode;
+
+        /* state */
+        int                     noise_imm_level;
+        int                     spur_level;
+        int                     firstep_level;
+        bool                    ofdm_weak_sig;
+        bool                    cck_weak_sig;
+
+        int                     max_spur_level;
+
+        /* used by the algorithm */
+        unsigned int            listen_time;
+        unsigned int            ofdm_errors;
+        unsigned int            cck_errors;
+
+        /* debug/statistics only: numbers from last ANI calibration */
+        unsigned int            pfc_tx;
+        unsigned int            pfc_rx;
+        unsigned int            pfc_busy;
+        unsigned int            pfc_cycles;
+        unsigned int            last_listen;
+        unsigned int            last_ofdm_errors;
+        unsigned int            last_cck_errors;
+        unsigned int            sum_ofdm_errors;
+        unsigned int            sum_cck_errors;
+};
+
+void ath5k_ani_init(struct ath5k_hw *ah, enum ath5k_ani_mode mode);
+void ath5k_ani_mib_intr(struct ath5k_hw *ah);
+void ath5k_ani_calibration(struct ath5k_hw *ah);
+void ath5k_ani_phy_error_report(struct ath5k_hw *ah,
+                                enum ath5k_phy_error_code phyerr);
+
+/* for manual control */
+void ath5k_ani_set_noise_immunity_level(struct ath5k_hw *ah, int level);
+void ath5k_ani_set_spur_immunity_level(struct ath5k_hw *ah, int level);
+void ath5k_ani_set_firstep_level(struct ath5k_hw *ah, int level);
+void ath5k_ani_set_ofdm_weak_signal_detection(struct ath5k_hw *ah, bool on);
+void ath5k_ani_set_cck_weak_signal_detection(struct ath5k_hw *ah, bool on);
+
+void ath5k_ani_print_counters(struct ath5k_hw *ah);
+
+#endif /* ANI_H */
diff --git a/drivers/net/wireless/ath/ath5k/ath5k.h b/drivers/net/wireless/ath/ath5k/ath5k.h
index ac67f02e26d8..2785946f659a 100644
--- a/drivers/net/wireless/ath/ath5k/ath5k.h
+++ b/drivers/net/wireless/ath/ath5k/ath5k.h
@@ -202,7 +202,8 @@
 #define AR5K_TUNE_MAX_TXPOWER                   63
 #define AR5K_TUNE_DEFAULT_TXPOWER               25
 #define AR5K_TUNE_TPC_TXPOWER                   false
-#define AR5K_TUNE_HWTXTRIES                     4
+#define ATH5K_TUNE_CALIBRATION_INTERVAL_FULL    10000   /* 10 sec */
+#define ATH5K_TUNE_CALIBRATION_INTERVAL_ANI     1000    /* 1 sec */
 
 #define AR5K_INIT_CARR_SENSE_EN                 1
 
@@ -614,28 +615,6 @@ struct ath5k_rx_status {
 #define AR5K_BEACON_ENA         0x00800000 /*enable beacon xmit*/
 #define AR5K_BEACON_RESET_TSF   0x01000000 /*force a TSF reset*/
 
-#if 0
-/**
- * struct ath5k_beacon_state - Per-station beacon timer state.
- * @bs_interval: in TU's, can also include the above flags
- * @bs_cfp_max_duration: if non-zero hw is setup to coexist with a
- *      Point Coordination Function capable AP
- */
-struct ath5k_beacon_state {
-        u32     bs_next_beacon;
-        u32     bs_next_dtim;
-        u32     bs_interval;
-        u8      bs_dtim_period;
-        u8      bs_cfp_period;
-        u16     bs_cfp_max_duration;
-        u16     bs_cfp_du_remain;
-        u16     bs_tim_offset;
-        u16     bs_sleep_duration;
-        u16     bs_bmiss_threshold;
-        u32     bs_cfp_next;
-};
-#endif
-
 
 /*
  * TSF to TU conversion:
@@ -822,9 +801,9 @@ struct ath5k_athchan_2ghz {
  * @AR5K_INT_TXURN: received when we should increase the TX trigger threshold
  *      We currently do increments on interrupt by
  *      (AR5K_TUNE_MAX_TX_FIFO_THRES - current_trigger_level) / 2
- * @AR5K_INT_MIB: Indicates the Management Information Base counters should be
- *      checked. We should do this with ath5k_hw_update_mib_counters() but
- *      it seems we should also then do some noise immunity work.
+ * @AR5K_INT_MIB: Indicates the either Management Information Base counters or
+ *      one of the PHY error counters reached the maximum value and should be
+ *      read and cleared.
  * @AR5K_INT_RXPHY: RX PHY Error
  * @AR5K_INT_RXKCM: RX Key cache miss
  * @AR5K_INT_SWBA: SoftWare Beacon Alert - indicates its time to send a
@@ -912,10 +891,11 @@ enum ath5k_int {
         AR5K_INT_NOCARD = 0xffffffff
 };
 
-/* Software interrupts used for calibration */
-enum ath5k_software_interrupt {
-        AR5K_SWI_FULL_CALIBRATION = 0x01,
-        AR5K_SWI_SHORT_CALIBRATION = 0x02,
+/* mask which calibration is active at the moment */
+enum ath5k_calibration_mask {
+        AR5K_CALIBRATION_FULL = 0x01,
+        AR5K_CALIBRATION_SHORT = 0x02,
+        AR5K_CALIBRATION_ANI = 0x04,
 };
 
 /*
@@ -1004,6 +984,8 @@ struct ath5k_capabilities {
         struct {
                 u8      q_tx_num;
         } cap_queues;
+
+        bool cap_has_phyerr_counters;
 };
 
 /* size of noise floor history (keep it a power of two) */
@@ -1014,6 +996,15 @@ struct ath5k_nfcal_hist
         s16 nfval[ATH5K_NF_CAL_HIST_MAX];       /* last few noise floors */
 };
 
+/**
+ * struct avg_val - Helper structure for average calculation
+ * @avg: contains the actual average value
+ * @avg_weight: is used internally during calculation to prevent rounding errors
+ */
+struct ath5k_avg_val {
+        int avg;
+        int avg_weight;
+};
 
 /***************************************\
   HARDWARE ABSTRACTION LAYER STRUCTURE
@@ -1028,7 +1019,6 @@ struct ath5k_nfcal_hist
 
 /* TODO: Clean up and merge with ath5k_softc */
 struct ath5k_hw {
-        u32                     ah_magic;
         struct ath_common       common;
 
         struct ath5k_softc      *ah_sc;
@@ -1036,7 +1026,6 @@ struct ath5k_hw {
 
         enum ath5k_int          ah_imr;
 
-        enum nl80211_iftype     ah_op_mode;
         struct ieee80211_channel *ah_current_channel;
         bool                    ah_turbo;
         bool                    ah_calibration;
@@ -1049,7 +1038,6 @@ struct ath5k_hw {
         u32                     ah_phy;
         u32                     ah_mac_srev;
         u16                     ah_mac_version;
-        u16                     ah_mac_revision;
         u16                     ah_phy_revision;
         u16                     ah_radio_5ghz_revision;
         u16                     ah_radio_2ghz_revision;
@@ -1071,8 +1059,6 @@ struct ath5k_hw {
         u8                      ah_def_ant;
         bool                    ah_software_retry;
 
-        int                     ah_gpio_npins;
-
         struct ath5k_capabilities ah_capabilities;
 
         struct ath5k_txq_info   ah_txq[AR5K_NUM_TX_QUEUES];
@@ -1123,17 +1109,18 @@ struct ath5k_hw {
 
         struct ath5k_nfcal_hist ah_nfcal_hist;
 
+        /* average beacon RSSI in our BSS (used by ANI) */
+        struct ath5k_avg_val    ah_beacon_rssi_avg;
+
         /* noise floor from last periodic calibration */
         s32                     ah_noise_floor;
 
         /* Calibration timestamp */
-        unsigned long           ah_cal_tstamp;
-
-        /* Calibration interval (secs) */
-        u8                      ah_cal_intval;
+        unsigned long           ah_cal_next_full;
+        unsigned long           ah_cal_next_ani;
 
-        /* Software interrupt mask */
-        u8                      ah_swi_mask;
+        /* Calibration mask */
+        u8                      ah_cal_mask;
 
         /*
          * Function pointers
@@ -1141,9 +1128,9 @@ struct ath5k_hw {
         int (*ah_setup_rx_desc)(struct ath5k_hw *ah, struct ath5k_desc *desc,
                                 u32 size, unsigned int flags);
         int (*ah_setup_tx_desc)(struct ath5k_hw *, struct ath5k_desc *,
-                unsigned int, unsigned int, enum ath5k_pkt_type, unsigned int,
+                unsigned int, unsigned int, int, enum ath5k_pkt_type,
                 unsigned int, unsigned int, unsigned int, unsigned int,
-                unsigned int, unsigned int, unsigned int);
+                unsigned int, unsigned int, unsigned int, unsigned int);
         int (*ah_setup_mrr_tx_desc)(struct ath5k_hw *, struct ath5k_desc *,
                 unsigned int, unsigned int, unsigned int, unsigned int,
                 unsigned int, unsigned int);
@@ -1158,158 +1145,145 @@ struct ath5k_hw {
  */
 
 /* Attach/Detach Functions */
-extern int ath5k_hw_attach(struct ath5k_softc *sc);
-extern void ath5k_hw_detach(struct ath5k_hw *ah);
+int ath5k_hw_attach(struct ath5k_softc *sc);
+void ath5k_hw_detach(struct ath5k_hw *ah);
 
 /* LED functions */
-extern int ath5k_init_leds(struct ath5k_softc *sc);
-extern void ath5k_led_enable(struct ath5k_softc *sc);
-extern void ath5k_led_off(struct ath5k_softc *sc);
-extern void ath5k_unregister_leds(struct ath5k_softc *sc);
+int ath5k_init_leds(struct ath5k_softc *sc);
+void ath5k_led_enable(struct ath5k_softc *sc);
+void ath5k_led_off(struct ath5k_softc *sc);
+void ath5k_unregister_leds(struct ath5k_softc *sc);
 
 /* Reset Functions */
-extern int ath5k_hw_nic_wakeup(struct ath5k_hw *ah, int flags, bool initial);
-extern int ath5k_hw_on_hold(struct ath5k_hw *ah);
-extern int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode, struct ieee80211_channel *channel, bool change_channel);
+int ath5k_hw_nic_wakeup(struct ath5k_hw *ah, int flags, bool initial);
+int ath5k_hw_on_hold(struct ath5k_hw *ah);
+int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
+                   struct ieee80211_channel *channel, bool change_channel);
+int ath5k_hw_register_timeout(struct ath5k_hw *ah, u32 reg, u32 flag, u32 val,
+                              bool is_set);
 /* Power management functions */
-extern int ath5k_hw_set_power(struct ath5k_hw *ah, enum ath5k_power_mode mode, bool set_chip, u16 sleep_duration);
 
 /* DMA Related Functions */
-extern void ath5k_hw_start_rx_dma(struct ath5k_hw *ah);
-extern int ath5k_hw_stop_rx_dma(struct ath5k_hw *ah);
-extern u32 ath5k_hw_get_rxdp(struct ath5k_hw *ah);
-extern void ath5k_hw_set_rxdp(struct ath5k_hw *ah, u32 phys_addr);
-extern int ath5k_hw_start_tx_dma(struct ath5k_hw *ah, unsigned int queue);
-extern int ath5k_hw_stop_tx_dma(struct ath5k_hw *ah, unsigned int queue);
-extern u32 ath5k_hw_get_txdp(struct ath5k_hw *ah, unsigned int queue);
-extern int ath5k_hw_set_txdp(struct ath5k_hw *ah, unsigned int queue,
+void ath5k_hw_start_rx_dma(struct ath5k_hw *ah);
+int ath5k_hw_stop_rx_dma(struct ath5k_hw *ah);
+u32 ath5k_hw_get_rxdp(struct ath5k_hw *ah);
+void ath5k_hw_set_rxdp(struct ath5k_hw *ah, u32 phys_addr);
+int ath5k_hw_start_tx_dma(struct ath5k_hw *ah, unsigned int queue);
+int ath5k_hw_stop_tx_dma(struct ath5k_hw *ah, unsigned int queue);
+u32 ath5k_hw_get_txdp(struct ath5k_hw *ah, unsigned int queue);
+int ath5k_hw_set_txdp(struct ath5k_hw *ah, unsigned int queue,
                                 u32 phys_addr);
-extern int ath5k_hw_update_tx_triglevel(struct ath5k_hw *ah, bool increase);
+int ath5k_hw_update_tx_triglevel(struct ath5k_hw *ah, bool increase);
 /* Interrupt handling */
-extern bool ath5k_hw_is_intr_pending(struct ath5k_hw *ah);
-extern int ath5k_hw_get_isr(struct ath5k_hw *ah, enum ath5k_int *interrupt_mask);
-extern enum ath5k_int ath5k_hw_set_imr(struct ath5k_hw *ah, enum
-ath5k_int new_mask);
-extern void ath5k_hw_update_mib_counters(struct ath5k_hw *ah, struct ieee80211_low_level_stats *stats);
+bool ath5k_hw_is_intr_pending(struct ath5k_hw *ah);
+int ath5k_hw_get_isr(struct ath5k_hw *ah, enum ath5k_int *interrupt_mask);
+enum ath5k_int ath5k_hw_set_imr(struct ath5k_hw *ah, enum ath5k_int new_mask);
+void ath5k_hw_update_mib_counters(struct ath5k_hw *ah);
 
 /* EEPROM access functions */
-extern int ath5k_eeprom_init(struct ath5k_hw *ah);
-extern void ath5k_eeprom_detach(struct ath5k_hw *ah);
-extern int ath5k_eeprom_read_mac(struct ath5k_hw *ah, u8 *mac);
-extern bool ath5k_eeprom_is_hb63(struct ath5k_hw *ah);
+int ath5k_eeprom_init(struct ath5k_hw *ah);
+void ath5k_eeprom_detach(struct ath5k_hw *ah);
+int ath5k_eeprom_read_mac(struct ath5k_hw *ah, u8 *mac);
 
 /* Protocol Control Unit Functions */
-extern int ath5k_hw_set_opmode(struct ath5k_hw *ah);
-extern void ath5k_hw_set_coverage_class(struct ath5k_hw *ah, u8 coverage_class);
+extern int ath5k_hw_set_opmode(struct ath5k_hw *ah, enum nl80211_iftype opmode);
+void ath5k_hw_set_coverage_class(struct ath5k_hw *ah, u8 coverage_class);
 /* BSSID Functions */
-extern int ath5k_hw_set_lladdr(struct ath5k_hw *ah, const u8 *mac);
-extern void ath5k_hw_set_associd(struct ath5k_hw *ah);
-extern void ath5k_hw_set_bssid_mask(struct ath5k_hw *ah, const u8 *mask);
+int ath5k_hw_set_lladdr(struct ath5k_hw *ah, const u8 *mac);
+void ath5k_hw_set_associd(struct ath5k_hw *ah);
+void ath5k_hw_set_bssid_mask(struct ath5k_hw *ah, const u8 *mask);
 /* Receive start/stop functions */
-extern void ath5k_hw_start_rx_pcu(struct ath5k_hw *ah);
-extern void ath5k_hw_stop_rx_pcu(struct ath5k_hw *ah);
+void ath5k_hw_start_rx_pcu(struct ath5k_hw *ah);
+void ath5k_hw_stop_rx_pcu(struct ath5k_hw *ah);
 /* RX Filter functions */
-extern void ath5k_hw_set_mcast_filter(struct ath5k_hw *ah, u32 filter0, u32 filter1);
-extern int ath5k_hw_set_mcast_filter_idx(struct ath5k_hw *ah, u32 index);
-extern int ath5k_hw_clear_mcast_filter_idx(struct ath5k_hw *ah, u32 index);
-extern u32 ath5k_hw_get_rx_filter(struct ath5k_hw *ah);
-extern void ath5k_hw_set_rx_filter(struct ath5k_hw *ah, u32 filter);
+void ath5k_hw_set_mcast_filter(struct ath5k_hw *ah, u32 filter0, u32 filter1);
+u32 ath5k_hw_get_rx_filter(struct ath5k_hw *ah);
+void ath5k_hw_set_rx_filter(struct ath5k_hw *ah, u32 filter);
 /* Beacon control functions */
-extern u32 ath5k_hw_get_tsf32(struct ath5k_hw *ah);
-extern u64 ath5k_hw_get_tsf64(struct ath5k_hw *ah);
-extern void ath5k_hw_set_tsf64(struct ath5k_hw *ah, u64 tsf64);
-extern void ath5k_hw_reset_tsf(struct ath5k_hw *ah);
-extern void ath5k_hw_init_beacon(struct ath5k_hw *ah, u32 next_beacon, u32 interval);
-#if 0
-extern int ath5k_hw_set_beacon_timers(struct ath5k_hw *ah, const struct ath5k_beacon_state *state);
-extern void ath5k_hw_reset_beacon(struct ath5k_hw *ah);
-extern int ath5k_hw_beaconq_finish(struct ath5k_hw *ah, unsigned long phys_addr);
-#endif
+u64 ath5k_hw_get_tsf64(struct ath5k_hw *ah);
+void ath5k_hw_set_tsf64(struct ath5k_hw *ah, u64 tsf64);
+void ath5k_hw_reset_tsf(struct ath5k_hw *ah);
+void ath5k_hw_init_beacon(struct ath5k_hw *ah, u32 next_beacon, u32 interval);
 /* ACK bit rate */
 void ath5k_hw_set_ack_bitrate_high(struct ath5k_hw *ah, bool high);
-/* ACK/CTS Timeouts */
-extern int ath5k_hw_set_ack_timeout(struct ath5k_hw *ah, unsigned int timeout);
-extern unsigned int ath5k_hw_get_ack_timeout(struct ath5k_hw *ah);
-extern int ath5k_hw_set_cts_timeout(struct ath5k_hw *ah, unsigned int timeout);
-extern unsigned int ath5k_hw_get_cts_timeout(struct ath5k_hw *ah);
 /* Clock rate related functions */
 unsigned int ath5k_hw_htoclock(struct ath5k_hw *ah, unsigned int usec);
 unsigned int ath5k_hw_clocktoh(struct ath5k_hw *ah, unsigned int clock);
 unsigned int ath5k_hw_get_clockrate(struct ath5k_hw *ah);
 /* Key table (WEP) functions */
-extern int ath5k_hw_reset_key(struct ath5k_hw *ah, u16 entry);
-extern int ath5k_hw_is_key_valid(struct ath5k_hw *ah, u16 entry);
-extern int ath5k_hw_set_key(struct ath5k_hw *ah, u16 entry, const struct ieee80211_key_conf *key, const u8 *mac);
-extern int ath5k_hw_set_key_lladdr(struct ath5k_hw *ah, u16 entry, const u8 *mac);
+int ath5k_hw_reset_key(struct ath5k_hw *ah, u16 entry);
+int ath5k_hw_set_key(struct ath5k_hw *ah, u16 entry,
+                     const struct ieee80211_key_conf *key, const u8 *mac);
+int ath5k_hw_set_key_lladdr(struct ath5k_hw *ah, u16 entry, const u8 *mac);
 
 /* Queue Control Unit, DFS Control Unit Functions */
-extern int ath5k_hw_get_tx_queueprops(struct ath5k_hw *ah, int queue, struct ath5k_txq_info *queue_info);
-extern int ath5k_hw_set_tx_queueprops(struct ath5k_hw *ah, int queue,
-                                const struct ath5k_txq_info *queue_info);
-extern int ath5k_hw_setup_tx_queue(struct ath5k_hw *ah,
-                                enum ath5k_tx_queue queue_type,
-                                struct ath5k_txq_info *queue_info);
-extern u32 ath5k_hw_num_tx_pending(struct ath5k_hw *ah, unsigned int queue);
-extern void ath5k_hw_release_tx_queue(struct ath5k_hw *ah, unsigned int queue);
-extern int ath5k_hw_reset_tx_queue(struct ath5k_hw *ah, unsigned int queue);
-extern unsigned int ath5k_hw_get_slot_time(struct ath5k_hw *ah);
-extern int ath5k_hw_set_slot_time(struct ath5k_hw *ah, unsigned int slot_time);
+int ath5k_hw_get_tx_queueprops(struct ath5k_hw *ah, int queue,
+                               struct ath5k_txq_info *queue_info);
+int ath5k_hw_set_tx_queueprops(struct ath5k_hw *ah, int queue,
+                               const struct ath5k_txq_info *queue_info);
+int ath5k_hw_setup_tx_queue(struct ath5k_hw *ah,
+                            enum ath5k_tx_queue queue_type,
+                            struct ath5k_txq_info *queue_info);
+u32 ath5k_hw_num_tx_pending(struct ath5k_hw *ah, unsigned int queue);
+void ath5k_hw_release_tx_queue(struct ath5k_hw *ah, unsigned int queue);
+int ath5k_hw_reset_tx_queue(struct ath5k_hw *ah, unsigned int queue);
+int ath5k_hw_set_slot_time(struct ath5k_hw *ah, unsigned int slot_time);
 
 /* Hardware Descriptor Functions */
-extern int ath5k_hw_init_desc_functions(struct ath5k_hw *ah);
+int ath5k_hw_init_desc_functions(struct ath5k_hw *ah);
 
 /* GPIO Functions */
-extern void ath5k_hw_set_ledstate(struct ath5k_hw *ah, unsigned int state);
-extern int ath5k_hw_set_gpio_input(struct ath5k_hw *ah, u32 gpio);
-extern int ath5k_hw_set_gpio_output(struct ath5k_hw *ah, u32 gpio);
-extern u32 ath5k_hw_get_gpio(struct ath5k_hw *ah, u32 gpio);
-extern int ath5k_hw_set_gpio(struct ath5k_hw *ah, u32 gpio, u32 val);
-extern void ath5k_hw_set_gpio_intr(struct ath5k_hw *ah, unsigned int gpio, u32 interrupt_level);
+void ath5k_hw_set_ledstate(struct ath5k_hw *ah, unsigned int state);
+int ath5k_hw_set_gpio_input(struct ath5k_hw *ah, u32 gpio);
+int ath5k_hw_set_gpio_output(struct ath5k_hw *ah, u32 gpio);
+u32 ath5k_hw_get_gpio(struct ath5k_hw *ah, u32 gpio);
+int ath5k_hw_set_gpio(struct ath5k_hw *ah, u32 gpio, u32 val);
+void ath5k_hw_set_gpio_intr(struct ath5k_hw *ah, unsigned int gpio,
+                            u32 interrupt_level);
 
 /* rfkill Functions */
-extern void ath5k_rfkill_hw_start(struct ath5k_hw *ah);
-extern void ath5k_rfkill_hw_stop(struct ath5k_hw *ah);
+void ath5k_rfkill_hw_start(struct ath5k_hw *ah);
+void ath5k_rfkill_hw_stop(struct ath5k_hw *ah);
 
 /* Misc functions */
 int ath5k_hw_set_capabilities(struct ath5k_hw *ah);
-extern int ath5k_hw_get_capability(struct ath5k_hw *ah, enum ath5k_capability_type cap_type, u32 capability, u32 *result);
-extern int ath5k_hw_enable_pspoll(struct ath5k_hw *ah, u8 *bssid, u16 assoc_id);
-extern int ath5k_hw_disable_pspoll(struct ath5k_hw *ah);
+int ath5k_hw_get_capability(struct ath5k_hw *ah,
+                            enum ath5k_capability_type cap_type, u32 capability,
+                            u32 *result);
+int ath5k_hw_enable_pspoll(struct ath5k_hw *ah, u8 *bssid, u16 assoc_id);
+int ath5k_hw_disable_pspoll(struct ath5k_hw *ah);
 
 /* Initial register settings functions */
-extern int ath5k_hw_write_initvals(struct ath5k_hw *ah, u8 mode, bool change_channel);
+int ath5k_hw_write_initvals(struct ath5k_hw *ah, u8 mode, bool change_channel);
 
 /* Initialize RF */
-extern int ath5k_hw_rfregs_init(struct ath5k_hw *ah,
-                                struct ieee80211_channel *channel,
-                                unsigned int mode);
-extern int ath5k_hw_rfgain_init(struct ath5k_hw *ah, unsigned int freq);
-extern enum ath5k_rfgain ath5k_hw_gainf_calibrate(struct ath5k_hw *ah);
-extern int ath5k_hw_rfgain_opt_init(struct ath5k_hw *ah);
+int ath5k_hw_rfregs_init(struct ath5k_hw *ah,
+                         struct ieee80211_channel *channel,
+                         unsigned int mode);
+int ath5k_hw_rfgain_init(struct ath5k_hw *ah, unsigned int freq);
+enum ath5k_rfgain ath5k_hw_gainf_calibrate(struct ath5k_hw *ah);
+int ath5k_hw_rfgain_opt_init(struct ath5k_hw *ah);
 /* PHY/RF channel functions */
-extern bool ath5k_channel_ok(struct ath5k_hw *ah, u16 freq, unsigned int flags);
-extern int ath5k_hw_channel(struct ath5k_hw *ah, struct ieee80211_channel *channel);
+bool ath5k_channel_ok(struct ath5k_hw *ah, u16 freq, unsigned int flags);
+int ath5k_hw_channel(struct ath5k_hw *ah, struct ieee80211_channel *channel);
 /* PHY calibration */
 void ath5k_hw_init_nfcal_hist(struct ath5k_hw *ah);
-extern int ath5k_hw_phy_calibrate(struct ath5k_hw *ah, struct ieee80211_channel *channel);
-extern int ath5k_hw_noise_floor_calibration(struct ath5k_hw *ah, short freq);
-extern s16 ath5k_hw_get_noise_floor(struct ath5k_hw *ah);
-extern void ath5k_hw_calibration_poll(struct ath5k_hw *ah);
+int ath5k_hw_phy_calibrate(struct ath5k_hw *ah,
+                           struct ieee80211_channel *channel);
 /* Spur mitigation */
 bool ath5k_hw_chan_has_spur_noise(struct ath5k_hw *ah,
-                                struct ieee80211_channel *channel);
+                                  struct ieee80211_channel *channel);
 void ath5k_hw_set_spur_mitigation_filter(struct ath5k_hw *ah,
-                                struct ieee80211_channel *channel);
+                                         struct ieee80211_channel *channel);
 /* Misc PHY functions */
-extern u16 ath5k_hw_radio_revision(struct ath5k_hw *ah, unsigned int chan);
-extern int ath5k_hw_phy_disable(struct ath5k_hw *ah);
+u16 ath5k_hw_radio_revision(struct ath5k_hw *ah, unsigned int chan);
+int ath5k_hw_phy_disable(struct ath5k_hw *ah);
 /* Antenna control */
-extern void ath5k_hw_set_antenna_mode(struct ath5k_hw *ah, u8 ant_mode);
-extern void ath5k_hw_set_def_antenna(struct ath5k_hw *ah, u8 ant);
-extern unsigned int ath5k_hw_get_def_antenna(struct ath5k_hw *ah);
+void ath5k_hw_set_antenna_mode(struct ath5k_hw *ah, u8 ant_mode);
 /* TX power setup */
-extern int ath5k_hw_txpower(struct ath5k_hw *ah, struct ieee80211_channel *channel, u8 ee_mode, u8 txpower);
-extern int ath5k_hw_set_txpower_limit(struct ath5k_hw *ah, u8 txpower);
+int ath5k_hw_txpower(struct ath5k_hw *ah, struct ieee80211_channel *channel,
+                     u8 ee_mode, u8 txpower);
+int ath5k_hw_set_txpower_limit(struct ath5k_hw *ah, u8 txpower);
 
 /*
  * Functions used internaly
@@ -1335,29 +1309,6 @@ static inline void ath5k_hw_reg_write(struct ath5k_hw *ah, u32 val, u16 reg)
         iowrite32(val, ah->ah_iobase + reg);
 }
 
-#if defined(_ATH5K_RESET) || defined(_ATH5K_PHY)
-/*
- * Check if a register write has been completed
- */
-static int ath5k_hw_register_timeout(struct ath5k_hw *ah, u32 reg, u32 flag,
-                u32 val, bool is_set)
-{
-        int i;
-        u32 data;
-
-        for (i = AR5K_TUNE_REGISTER_TIMEOUT; i > 0; i--) {
-                data = ath5k_hw_reg_read(ah, reg);
-                if (is_set && (data & flag))
-                        break;
-                else if ((data & flag) == val)
-                        break;
-                udelay(15);
-        }
-
-        return (i <= 0) ? -EAGAIN : 0;
-}
-#endif
-
 static inline u32 ath5k_hw_bitswap(u32 val, unsigned int bits)
 {
         u32 retval = 0, bit, i;
@@ -1370,9 +1321,27 @@ static inline u32 ath5k_hw_bitswap(u32 val, unsigned int bits)
         return retval;
 }
 
-static inline int ath5k_pad_size(int hdrlen)
+#define AVG_SAMPLES     8
+#define AVG_FACTOR      1000
+
+/**
+ * ath5k_moving_average -  Exponentially weighted moving average
+ * @avg: average structure
+ * @val: current value
+ *
+ * This implementation make use of a struct ath5k_avg_val to prevent rounding
+ * errors.
+ */
+static inline struct ath5k_avg_val
+ath5k_moving_average(const struct ath5k_avg_val avg, const int val)
 {
-        return (hdrlen < 24) ? 0 : hdrlen & 3;
+        struct ath5k_avg_val new;
+        new.avg_weight = avg.avg_weight  ?
+                (((avg.avg_weight * ((AVG_SAMPLES) - 1)) +
+                        (val * (AVG_FACTOR))) / (AVG_SAMPLES)) :
+                (val * (AVG_FACTOR));
+        new.avg = new.avg_weight / (AVG_FACTOR);
+        return new;
 }
 
 #endif
diff --git a/drivers/net/wireless/ath/ath5k/attach.c b/drivers/net/wireless/ath/ath5k/attach.c
index 42284445b75e..dcf7c30f813f 100644
--- a/drivers/net/wireless/ath/ath5k/attach.c
+++ b/drivers/net/wireless/ath/ath5k/attach.c
@@ -113,7 +113,6 @@ int ath5k_hw_attach(struct ath5k_softc *sc)
         /*
          * HW information
          */
-        ah->ah_op_mode = NL80211_IFTYPE_STATION;
         ah->ah_radar.r_enabled = AR5K_TUNE_RADAR_ALERT;
         ah->ah_turbo = false;
         ah->ah_txpower.txp_tpc = AR5K_TUNE_TPC_TXPOWER;
@@ -123,6 +122,9 @@ int ath5k_hw_attach(struct ath5k_softc *sc)
         ah->ah_cw_min = AR5K_TUNE_CWMIN;
         ah->ah_limit_tx_retries = AR5K_INIT_TX_RETRY;
         ah->ah_software_retry = false;
+        ah->ah_ant_mode = AR5K_ANTMODE_DEFAULT;
+        ah->ah_noise_floor = -95;       /* until first NF calibration is run */
+        sc->ani_state.ani_mode = ATH5K_ANI_MODE_AUTO;
 
         /*
          * Find the mac version
@@ -148,7 +150,6 @@ int ath5k_hw_attach(struct ath5k_softc *sc)
         /* Get MAC, PHY and RADIO revisions */
         ah->ah_mac_srev = srev;
         ah->ah_mac_version = AR5K_REG_MS(srev, AR5K_SREV_VER);
-        ah->ah_mac_revision = AR5K_REG_MS(srev, AR5K_SREV_REV);
         ah->ah_phy_revision = ath5k_hw_reg_read(ah, AR5K_PHY_CHIP_ID) &
                         0xffffffff;
         ah->ah_radio_5ghz_revision = ath5k_hw_radio_revision(ah,
@@ -327,7 +328,7 @@ int ath5k_hw_attach(struct ath5k_softc *sc)
         /* Set BSSID to bcast address: ff:ff:ff:ff:ff:ff for now */
         memcpy(common->curbssid, ath_bcast_mac, ETH_ALEN);
         ath5k_hw_set_associd(ah);
-        ath5k_hw_set_opmode(ah);
+        ath5k_hw_set_opmode(ah, sc->opmode);
 
         ath5k_hw_rfgain_opt_init(ah);
 
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 8dce0077b023..c085a06f1e05 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -58,8 +58,8 @@
 #include "base.h"
 #include "reg.h"
 #include "debug.h"
+#include "ani.h"
 
-static u8 ath5k_calinterval = 10; /* Calibrate PHY every 10 secs (TODO: Fixme) */
 static int modparam_nohwcrypt;
 module_param_named(nohwcrypt, modparam_nohwcrypt, bool, S_IRUGO);
 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
@@ -198,7 +198,7 @@ static void __devexit	ath5k_pci_remove(struct pci_dev *pdev);
 static int              ath5k_pci_suspend(struct device *dev);
 static int              ath5k_pci_resume(struct device *dev);
 
-SIMPLE_DEV_PM_OPS(ath5k_pm_ops, ath5k_pci_suspend, ath5k_pci_resume);
+static SIMPLE_DEV_PM_OPS(ath5k_pm_ops, ath5k_pci_suspend, ath5k_pci_resume);
 #define ATH5K_PM_OPS    (&ath5k_pm_ops)
 #else
 #define ATH5K_PM_OPS    NULL
@@ -307,7 +307,7 @@ static int 	ath5k_rxbuf_setup(struct ath5k_softc *sc,
                                 struct ath5k_buf *bf);
 static int      ath5k_txbuf_setup(struct ath5k_softc *sc,
                                 struct ath5k_buf *bf,
-                                struct ath5k_txq *txq);
+                                struct ath5k_txq *txq, int padsize);
 static inline void ath5k_txbuf_free(struct ath5k_softc *sc,
                                 struct ath5k_buf *bf)
 {
@@ -364,6 +364,7 @@ static void 	ath5k_beacon_send(struct ath5k_softc *sc);
 static void     ath5k_beacon_config(struct ath5k_softc *sc);
 static void     ath5k_beacon_update_timers(struct ath5k_softc *sc, u64 bc_tsf);
 static void     ath5k_tasklet_beacon(unsigned long data);
+static void     ath5k_tasklet_ani(unsigned long data);
 
 static inline u64 ath5k_extend_tsf(struct ath5k_hw *ah, u32 rstamp)
 {
@@ -829,6 +830,7 @@ ath5k_attach(struct pci_dev *pdev, struct ieee80211_hw *hw)
         tasklet_init(&sc->restq, ath5k_tasklet_reset, (unsigned long)sc);
         tasklet_init(&sc->calib, ath5k_tasklet_calibrate, (unsigned long)sc);
         tasklet_init(&sc->beacontq, ath5k_tasklet_beacon, (unsigned long)sc);
+        tasklet_init(&sc->ani_tasklet, ath5k_tasklet_ani, (unsigned long)sc);
 
         ret = ath5k_eeprom_read_mac(ah, mac);
         if (ret) {
@@ -1137,8 +1139,6 @@ ath5k_mode_setup(struct ath5k_softc *sc)
         struct ath5k_hw *ah = sc->ah;
         u32 rfilt;
 
-        ah->ah_op_mode = sc->opmode;
-
         /* configure rx filter */
         rfilt = sc->filter_flags;
         ath5k_hw_set_rx_filter(ah, rfilt);
@@ -1147,8 +1147,9 @@ ath5k_mode_setup(struct ath5k_softc *sc)
                 ath5k_hw_set_bssid_mask(ah, sc->bssidmask);
 
         /* configure operational mode */
-        ath5k_hw_set_opmode(ah);
+        ath5k_hw_set_opmode(ah, sc->opmode);
 
+        ATH5K_DBG(sc, ATH5K_DEBUG_MODE, "mode setup opmode %d\n", sc->opmode);
         ATH5K_DBG(sc, ATH5K_DEBUG_MODE, "RX filter 0x%x\n", rfilt);
 }
 
@@ -1271,7 +1272,7 @@ static enum ath5k_pkt_type get_hw_packet_type(struct sk_buff *skb)
 
 static int
 ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf,
-                  struct ath5k_txq *txq)
+                  struct ath5k_txq *txq, int padsize)
 {
         struct ath5k_hw *ah = sc->ah;
         struct ath5k_desc *ds = bf->desc;
@@ -1323,7 +1324,7 @@ ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf,
                         sc->vif, pktlen, info));
         }
         ret = ah->ah_setup_tx_desc(ah, ds, pktlen,
-                ieee80211_get_hdrlen_from_skb(skb),
+                ieee80211_get_hdrlen_from_skb(skb), padsize,
                 get_hw_packet_type(skb),
                 (sc->power_level * 2),
                 hw_rate,
@@ -1806,6 +1807,86 @@ ath5k_check_ibss_tsf(struct ath5k_softc *sc, struct sk_buff *skb,
 }
 
 static void
+ath5k_update_beacon_rssi(struct ath5k_softc *sc, struct sk_buff *skb, int rssi)
+{
+        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
+        struct ath5k_hw *ah = sc->ah;
+        struct ath_common *common = ath5k_hw_common(ah);
+
+        /* only beacons from our BSSID */
+        if (!ieee80211_is_beacon(mgmt->frame_control) ||
+            memcmp(mgmt->bssid, common->curbssid, ETH_ALEN) != 0)
+                return;
+
+        ah->ah_beacon_rssi_avg = ath5k_moving_average(ah->ah_beacon_rssi_avg,
+                                                      rssi);
+
+        /* in IBSS mode we should keep RSSI statistics per neighbour */
+        /* le16_to_cpu(mgmt->u.beacon.capab_info) & WLAN_CAPABILITY_IBSS */
+}
+
+/*
+ * Compute padding position. skb must contains an IEEE 802.11 frame
+ */
+static int ath5k_common_padpos(struct sk_buff *skb)
+{
+        struct ieee80211_hdr * hdr = (struct ieee80211_hdr *)skb->data;
+        __le16 frame_control = hdr->frame_control;
+        int padpos = 24;
+
+        if (ieee80211_has_a4(frame_control)) {
+                padpos += ETH_ALEN;
+        }
+        if (ieee80211_is_data_qos(frame_control)) {
+                padpos += IEEE80211_QOS_CTL_LEN;
+        }
+
+        return padpos;
+}
+
+/*
+ * This function expects a 802.11 frame and returns the number of
+ * bytes added, or -1 if we don't have enought header room.
+ */
+
+static int ath5k_add_padding(struct sk_buff *skb)
+{
+        int padpos = ath5k_common_padpos(skb);
+        int padsize = padpos & 3;
+
+        if (padsize && skb->len>padpos) {
+
+                if (skb_headroom(skb) < padsize)
+                        return -1;
+
+                skb_push(skb, padsize);
+                memmove(skb->data, skb->data+padsize, padpos);
+                return padsize;
+        }
+
+        return 0;
+}
+
+/*
+ * This function expects a 802.11 frame and returns the number of
+ * bytes removed
+ */
+
+static int ath5k_remove_padding(struct sk_buff *skb)
+{
+        int padpos = ath5k_common_padpos(skb);
+        int padsize = padpos & 3;
+
+        if (padsize && skb->len>=padpos+padsize) {
+                memmove(skb->data + padsize, skb->data, padpos);
+                skb_pull(skb, padsize);
+                return padsize;
+        }
+
+        return 0;
+}
+
+static void
 ath5k_tasklet_rx(unsigned long data)
 {
         struct ieee80211_rx_status *rxs;
@@ -1818,8 +1899,6 @@ ath5k_tasklet_rx(unsigned long data)
         struct ath5k_buf *bf;
         struct ath5k_desc *ds;
         int ret;
-        int hdrlen;
-        int padsize;
         int rx_flag;
 
         spin_lock(&sc->rxbuflock);
@@ -1844,18 +1923,30 @@ ath5k_tasklet_rx(unsigned long data)
                         break;
                 else if (unlikely(ret)) {
                         ATH5K_ERR(sc, "error in processing rx descriptor\n");
+                        sc->stats.rxerr_proc++;
                         spin_unlock(&sc->rxbuflock);
                         return;
                 }
 
+                sc->stats.rx_all_count++;
+
                 if (unlikely(rs.rs_more)) {
                         ATH5K_WARN(sc, "unsupported jumbo\n");
+                        sc->stats.rxerr_jumbo++;
                         goto next;
                 }
 
                 if (unlikely(rs.rs_status)) {
-                        if (rs.rs_status & AR5K_RXERR_PHY)
+                        if (rs.rs_status & AR5K_RXERR_CRC)
+                                sc->stats.rxerr_crc++;
+                        if (rs.rs_status & AR5K_RXERR_FIFO)
+                                sc->stats.rxerr_fifo++;
+                        if (rs.rs_status & AR5K_RXERR_PHY) {
+                                sc->stats.rxerr_phy++;
+                                if (rs.rs_phyerr > 0 && rs.rs_phyerr < 32)
+                                        sc->stats.rxerr_phy_code[rs.rs_phyerr]++;
                                 goto next;
+                        }
                         if (rs.rs_status & AR5K_RXERR_DECRYPT) {
                                 /*
                                  * Decrypt error.  If the error occurred
@@ -1867,12 +1958,14 @@ ath5k_tasklet_rx(unsigned long data)
                                  *
                                  * XXX do key cache faulting
                                  */
+                                sc->stats.rxerr_decrypt++;
                                 if (rs.rs_keyix == AR5K_RXKEYIX_INVALID &&
                                     !(rs.rs_status & AR5K_RXERR_CRC))
                                         goto accept;
                         }
                         if (rs.rs_status & AR5K_RXERR_MIC) {
                                 rx_flag |= RX_FLAG_MMIC_ERROR;
+                                sc->stats.rxerr_mic++;
                                 goto accept;
                         }
 
@@ -1904,12 +1997,8 @@ accept:
                  * bytes and we can optimize this a bit. In addition, we must
                  * not try to remove padding from short control frames that do
                  * not have payload. */
-                hdrlen = ieee80211_get_hdrlen_from_skb(skb);
-                padsize = ath5k_pad_size(hdrlen);
-                if (padsize) {
-                        memmove(skb->data + padsize, skb->data, hdrlen);
-                        skb_pull(skb, padsize);
-                }
+                ath5k_remove_padding(skb);
+
                 rxs = IEEE80211_SKB_RXCB(skb);
 
                 /*
@@ -1942,6 +2031,12 @@ accept:
                 rxs->signal = rxs->noise + rs.rs_rssi;
 
                 rxs->antenna = rs.rs_antenna;
+
+                if (rs.rs_antenna > 0 && rs.rs_antenna < 5)
+                        sc->stats.antenna_rx[rs.rs_antenna]++;
+                else
+                        sc->stats.antenna_rx[0]++; /* invalid */
+
                 rxs->rate_idx = ath5k_hw_to_driver_rix(sc, rs.rs_rate);
                 rxs->flag |= ath5k_rx_decrypted(sc, ds, skb, &rs);
 
@@ -1951,6 +2046,8 @@ accept:
 
                 ath5k_debug_dump_skb(sc, skb, "RX  ", 0);
 
+                ath5k_update_beacon_rssi(sc, skb, rs.rs_rssi);
+
                 /* check beacons in IBSS mode */
                 if (sc->opmode == NL80211_IFTYPE_ADHOC)
                         ath5k_check_ibss_tsf(sc, skb, rxs);
@@ -1996,6 +2093,7 @@ ath5k_tx_processq(struct ath5k_softc *sc, struct ath5k_txq *txq)
                         break;
                 }
 
+                sc->stats.tx_all_count++;
                 skb = bf->skb;
                 info = IEEE80211_SKB_CB(skb);
                 bf->skb = NULL;
@@ -2021,14 +2119,31 @@ ath5k_tx_processq(struct ath5k_softc *sc, struct ath5k_txq *txq)
                 info->status.rates[ts.ts_final_idx].count++;
 
                 if (unlikely(ts.ts_status)) {
-                        sc->ll_stats.dot11ACKFailureCount++;
-                        if (ts.ts_status & AR5K_TXERR_FILT)
+                        sc->stats.ack_fail++;
+                        if (ts.ts_status & AR5K_TXERR_FILT) {
                                 info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
+                                sc->stats.txerr_filt++;
+                        }
+                        if (ts.ts_status & AR5K_TXERR_XRETRY)
+                                sc->stats.txerr_retry++;
+                        if (ts.ts_status & AR5K_TXERR_FIFO)
+                                sc->stats.txerr_fifo++;
                 } else {
                         info->flags |= IEEE80211_TX_STAT_ACK;
                         info->status.ack_signal = ts.ts_rssi;
                 }
 
+                /*
+                 * Remove MAC header padding before giving the frame
+                 * back to mac80211.
+                 */
+                ath5k_remove_padding(skb);
+
+                if (ts.ts_antenna > 0 && ts.ts_antenna < 5)
+                        sc->stats.antenna_tx[ts.ts_antenna]++;
+                else
+                        sc->stats.antenna_tx[0]++; /* invalid */
+
                 ieee80211_tx_status(sc->hw, skb);
 
                 spin_lock(&sc->txbuflock);
@@ -2072,6 +2187,7 @@ ath5k_beacon_setup(struct ath5k_softc *sc, struct ath5k_buf *bf)
         int ret = 0;
         u8 antenna;
         u32 flags;
+        const int padsize = 0;
 
         bf->skbaddr = pci_map_single(sc->pdev, skb->data, skb->len,
                         PCI_DMA_TODEVICE);
@@ -2119,7 +2235,7 @@ ath5k_beacon_setup(struct ath5k_softc *sc, struct ath5k_buf *bf)
          * from tx power (value is in dB units already) */
         ds->ds_data = bf->skbaddr;
         ret = ah->ah_setup_tx_desc(ah, ds, skb->len,
-                        ieee80211_get_hdrlen_from_skb(skb),
+                        ieee80211_get_hdrlen_from_skb(skb), padsize,
                         AR5K_PKT_TYPE_BEACON, (sc->power_level * 2),
                         ieee80211_get_tx_rate(sc->hw, info)->hw_value,
                         1, AR5K_TXKEYIX_INVALID,
@@ -2406,9 +2522,6 @@ ath5k_init(struct ath5k_softc *sc)
          */
         ath5k_stop_locked(sc);
 
-        /* Set PHY calibration interval */
-        ah->ah_cal_intval = ath5k_calinterval;
-
         /*
          * The basic interface to setting the hardware in a good
          * state is ``reset''.  On return the hardware is known to
@@ -2420,7 +2533,8 @@ ath5k_init(struct ath5k_softc *sc)
         sc->curband = &sc->sbands[sc->curchan->band];
         sc->imask = AR5K_INT_RXOK | AR5K_INT_RXERR | AR5K_INT_RXEOL |
                 AR5K_INT_RXORN | AR5K_INT_TXDESC | AR5K_INT_TXEOL |
-                AR5K_INT_FATAL | AR5K_INT_GLOBAL | AR5K_INT_SWI;
+                AR5K_INT_FATAL | AR5K_INT_GLOBAL | AR5K_INT_MIB;
+
         ret = ath5k_reset(sc, NULL);
         if (ret)
                 goto done;
@@ -2532,12 +2646,33 @@ ath5k_stop_hw(struct ath5k_softc *sc)
         tasklet_kill(&sc->restq);
         tasklet_kill(&sc->calib);
         tasklet_kill(&sc->beacontq);
+        tasklet_kill(&sc->ani_tasklet);
 
         ath5k_rfkill_hw_stop(sc->ah);
 
         return ret;
 }
 
+static void
+ath5k_intr_calibration_poll(struct ath5k_hw *ah)
+{
+        if (time_is_before_eq_jiffies(ah->ah_cal_next_ani) &&
+            !(ah->ah_cal_mask & AR5K_CALIBRATION_FULL)) {
+                /* run ANI only when full calibration is not active */
+                ah->ah_cal_next_ani = jiffies +
+                        msecs_to_jiffies(ATH5K_TUNE_CALIBRATION_INTERVAL_ANI);
+                tasklet_schedule(&ah->ah_sc->ani_tasklet);
+
+        } else if (time_is_before_eq_jiffies(ah->ah_cal_next_full)) {
+                ah->ah_cal_next_full = jiffies +
+                        msecs_to_jiffies(ATH5K_TUNE_CALIBRATION_INTERVAL_FULL);
+                tasklet_schedule(&ah->ah_sc->calib);
+        }
+        /* we could use SWI to generate enough interrupts to meet our
+         * calibration interval requirements, if necessary:
+         * AR5K_REG_ENABLE_BITS(ah, AR5K_CR, AR5K_CR_SWI); */
+}
+
 static irqreturn_t
 ath5k_intr(int irq, void *dev_id)
 {
@@ -2586,15 +2721,10 @@ ath5k_intr(int irq, void *dev_id)
                         if (status & AR5K_INT_BMISS) {
                                 /* TODO */
                         }
-                        if (status & AR5K_INT_SWI) {
-                                tasklet_schedule(&sc->calib);
-                        }
                         if (status & AR5K_INT_MIB) {
-                                /*
-                                 * These stats are also used for ANI i think
-                                 * so how about updating them more often ?
-                                 */
-                                ath5k_hw_update_mib_counters(ah, &sc->ll_stats);
+                                sc->stats.mib_intr++;
+                                ath5k_hw_update_mib_counters(ah);
+                                ath5k_ani_mib_intr(ah);
                         }
                         if (status & AR5K_INT_GPIO)
                                 tasklet_schedule(&sc->rf_kill.toggleq);
@@ -2605,7 +2735,7 @@ ath5k_intr(int irq, void *dev_id)
         if (unlikely(!counter))
                 ATH5K_WARN(sc, "too many interrupts, giving up for now\n");
 
-        ath5k_hw_calibration_poll(ah);
+        ath5k_intr_calibration_poll(ah);
 
         return IRQ_HANDLED;
 }
@@ -2629,8 +2759,7 @@ ath5k_tasklet_calibrate(unsigned long data)
         struct ath5k_hw *ah = sc->ah;
 
         /* Only full calibration for now */
-        if (ah->ah_swi_mask != AR5K_SWI_FULL_CALIBRATION)
-                return;
+        ah->ah_cal_mask |= AR5K_CALIBRATION_FULL;
 
         /* Stop queues so that calibration
          * doesn't interfere with tx */
@@ -2653,11 +2782,22 @@ ath5k_tasklet_calibrate(unsigned long data)
                         ieee80211_frequency_to_channel(
                                 sc->curchan->center_freq));
 
-        ah->ah_swi_mask = 0;
-
         /* Wake queues */
         ieee80211_wake_queues(sc->hw);
 
+        ah->ah_cal_mask &= ~AR5K_CALIBRATION_FULL;
+}
+
+
+static void
+ath5k_tasklet_ani(unsigned long data)
+{
+        struct ath5k_softc *sc = (void *)data;
+        struct ath5k_hw *ah = sc->ah;
+
+        ah->ah_cal_mask |= AR5K_CALIBRATION_ANI;
+        ath5k_ani_calibration(ah);
+        ah->ah_cal_mask &= ~AR5K_CALIBRATION_ANI;
 }
 
 
@@ -2679,7 +2819,6 @@ static int ath5k_tx_queue(struct ieee80211_hw *hw, struct sk_buff *skb,
         struct ath5k_softc *sc = hw->priv;
         struct ath5k_buf *bf;
         unsigned long flags;
-        int hdrlen;
         int padsize;
 
         ath5k_debug_dump_skb(sc, skb, "TX  ", 1);
@@ -2691,17 +2830,11 @@ static int ath5k_tx_queue(struct ieee80211_hw *hw, struct sk_buff *skb,
          * the hardware expects the header padded to 4 byte boundaries
          * if this is not the case we add the padding after the header
          */
-        hdrlen = ieee80211_get_hdrlen_from_skb(skb);
-        padsize = ath5k_pad_size(hdrlen);
-        if (padsize) {
-
-                if (skb_headroom(skb) < padsize) {
-                        ATH5K_ERR(sc, "tx hdrlen not %%4: %d not enough"
-                                  " headroom to pad %d\n", hdrlen, padsize);
-                        goto drop_packet;
-                }
-                skb_push(skb, padsize);
-                memmove(skb->data, skb->data+padsize, hdrlen);
+        padsize = ath5k_add_padding(skb);
+        if (padsize < 0) {
+                ATH5K_ERR(sc, "tx hdrlen not %%4: not enough"
+                          " headroom to pad");
+                goto drop_packet;
         }
 
         spin_lock_irqsave(&sc->txbuflock, flags);
@@ -2720,7 +2853,7 @@ static int ath5k_tx_queue(struct ieee80211_hw *hw, struct sk_buff *skb,
 
         bf->skb = skb;
 
-        if (ath5k_txbuf_setup(sc, bf, txq)) {
+        if (ath5k_txbuf_setup(sc, bf, txq, padsize)) {
                 bf->skb = NULL;
                 spin_lock_irqsave(&sc->txbuflock, flags);
                 list_add_tail(&bf->list, &sc->txbuf);
@@ -2767,6 +2900,8 @@ ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan)
                 goto err;
         }
 
+        ath5k_ani_init(ah, ah->ah_sc->ani_state.ani_mode);
+
         /*
          * Change channels and update the h/w rate map if we're switching;
          * e.g. 11a to 11b/g.
@@ -2835,6 +2970,8 @@ static int ath5k_add_interface(struct ieee80211_hw *hw,
                 goto end;
         }
 
+        ATH5K_DBG(sc, ATH5K_DEBUG_MODE, "add interface mode %d\n", sc->opmode);
+
         ath5k_hw_set_lladdr(sc->ah, vif->addr);
         ath5k_mode_setup(sc);
 
@@ -2905,7 +3042,7 @@ ath5k_config(struct ieee80211_hw *hw, u32 changed)
          * then we must allow the user to set how many tx antennas we
          * have available
          */
-        ath5k_hw_set_antenna_mode(ah, AR5K_ANTMODE_DEFAULT);
+        ath5k_hw_set_antenna_mode(ah, ah->ah_ant_mode);
 
 unlock:
         mutex_unlock(&sc->lock);
@@ -3123,12 +3260,14 @@ ath5k_get_stats(struct ieee80211_hw *hw,
                 struct ieee80211_low_level_stats *stats)
 {
         struct ath5k_softc *sc = hw->priv;
-        struct ath5k_hw *ah = sc->ah;
 
         /* Force update */
-        ath5k_hw_update_mib_counters(ah, &sc->ll_stats);
+        ath5k_hw_update_mib_counters(sc->ah);
 
-        memcpy(stats, &sc->ll_stats, sizeof(sc->ll_stats));
+        stats->dot11ACKFailureCount = sc->stats.ack_fail;
+        stats->dot11RTSFailureCount = sc->stats.rts_fail;
+        stats->dot11RTSSuccessCount = sc->stats.rts_ok;
+        stats->dot11FCSErrorCount = sc->stats.fcs_error;
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath5k/base.h b/drivers/net/wireless/ath/ath5k/base.h
index 7e1a88a5abdb..53a5651c57a2 100644
--- a/drivers/net/wireless/ath/ath5k/base.h
+++ b/drivers/net/wireless/ath/ath5k/base.h
@@ -50,6 +50,7 @@
 
 #include "ath5k.h"
 #include "debug.h"
+#include "ani.h"
 
 #include "../regd.h"
 #include "../ath.h"
@@ -105,6 +106,37 @@ struct ath5k_rfkill {
         struct tasklet_struct toggleq;
 };
 
+/* statistics */
+struct ath5k_statistics {
+        /* antenna use */
+        unsigned int antenna_rx[5];     /* frames count per antenna RX */
+        unsigned int antenna_tx[5];     /* frames count per antenna TX */
+
+        /* frame errors */
+        unsigned int rx_all_count;      /* all RX frames, including errors */
+        unsigned int tx_all_count;      /* all TX frames, including errors */
+        unsigned int rxerr_crc;
+        unsigned int rxerr_phy;
+        unsigned int rxerr_phy_code[32];
+        unsigned int rxerr_fifo;
+        unsigned int rxerr_decrypt;
+        unsigned int rxerr_mic;
+        unsigned int rxerr_proc;
+        unsigned int rxerr_jumbo;
+        unsigned int txerr_retry;
+        unsigned int txerr_fifo;
+        unsigned int txerr_filt;
+
+        /* MIB counters */
+        unsigned int ack_fail;
+        unsigned int rts_fail;
+        unsigned int rts_ok;
+        unsigned int fcs_error;
+        unsigned int beacons;
+
+        unsigned int mib_intr;
+};
+
 #if CHAN_DEBUG
 #define ATH_CHAN_MAX    (26+26+26+200+200)
 #else
@@ -117,7 +149,6 @@ struct ath5k_softc {
         struct pci_dev          *pdev;          /* for dma mapping */
         void __iomem            *iobase;        /* address of the device */
         struct mutex            lock;           /* dev-level lock */
-        struct ieee80211_low_level_stats ll_stats;
         struct ieee80211_hw     *hw;            /* IEEE 802.11 common */
         struct ieee80211_supported_band sbands[IEEE80211_NUM_BANDS];
         struct ieee80211_channel channels[ATH_CHAN_MAX];
@@ -191,6 +222,11 @@ struct ath5k_softc {
         int                     power_level;    /* Requested tx power in dbm */
         bool                    assoc;          /* associate state */
         bool                    enable_beacon;  /* true if beacons are on */
+
+        struct ath5k_statistics stats;
+
+        struct ath5k_ani_state  ani_state;
+        struct tasklet_struct   ani_tasklet;    /* ANI calibration */
 };
 
 #define ath5k_hw_hasbssidmask(_ah) \
diff --git a/drivers/net/wireless/ath/ath5k/caps.c b/drivers/net/wireless/ath/ath5k/caps.c
index 367a6c7d3cc7..74f007126f41 100644
--- a/drivers/net/wireless/ath/ath5k/caps.c
+++ b/drivers/net/wireless/ath/ath5k/caps.c
@@ -102,9 +102,6 @@ int ath5k_hw_set_capabilities(struct ath5k_hw *ah)
                 }
         }
 
-        /* GPIO */
-        ah->ah_gpio_npins = AR5K_NUM_GPIO;
-
         /* Set number of supported TX queues */
         if (ah->ah_version == AR5K_AR5210)
                 ah->ah_capabilities.cap_queues.q_tx_num =
@@ -112,6 +109,12 @@ int ath5k_hw_set_capabilities(struct ath5k_hw *ah)
         else
                 ah->ah_capabilities.cap_queues.q_tx_num = AR5K_NUM_TX_QUEUES;
 
+        /* newer hardware has PHY error counters */
+        if (ah->ah_mac_srev >= AR5K_SREV_AR5213A)
+                ah->ah_capabilities.cap_has_phyerr_counters = true;
+        else
+                ah->ah_capabilities.cap_has_phyerr_counters = false;
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/ath/ath5k/debug.c b/drivers/net/wireless/ath/ath5k/debug.c
index 747508c15d34..6fb5c5ffa5b1 100644
--- a/drivers/net/wireless/ath/ath5k/debug.c
+++ b/drivers/net/wireless/ath/ath5k/debug.c
@@ -69,6 +69,7 @@ module_param_named(debug, ath5k_debug, uint, 0);
 
 #include <linux/seq_file.h>
 #include "reg.h"
+#include "ani.h"
 
 static struct dentry *ath5k_global_debugfs;
 
@@ -307,6 +308,7 @@ static const struct {
         { ATH5K_DEBUG_DUMP_TX,  "dumptx",       "print transmit skb content" },
         { ATH5K_DEBUG_DUMPBANDS, "dumpbands",   "dump bands" },
         { ATH5K_DEBUG_TRACE,    "trace",        "trace function calls" },
+        { ATH5K_DEBUG_ANI,      "ani",          "adaptive noise immunity" },
         { ATH5K_DEBUG_ANY,      "all",          "show all debug levels" },
 };
 
@@ -364,6 +366,369 @@ static const struct file_operations fops_debug = {
 };
 
 
+/* debugfs: antenna */
+
+static ssize_t read_file_antenna(struct file *file, char __user *user_buf,
+                                   size_t count, loff_t *ppos)
+{
+        struct ath5k_softc *sc = file->private_data;
+        char buf[700];
+        unsigned int len = 0;
+        unsigned int i;
+        unsigned int v;
+
+        len += snprintf(buf+len, sizeof(buf)-len, "antenna mode\t%d\n",
+                sc->ah->ah_ant_mode);
+        len += snprintf(buf+len, sizeof(buf)-len, "default antenna\t%d\n",
+                sc->ah->ah_def_ant);
+        len += snprintf(buf+len, sizeof(buf)-len, "tx antenna\t%d\n",
+                sc->ah->ah_tx_ant);
+
+        len += snprintf(buf+len, sizeof(buf)-len, "\nANTENNA\t\tRX\tTX\n");
+        for (i = 1; i < ARRAY_SIZE(sc->stats.antenna_rx); i++) {
+                len += snprintf(buf+len, sizeof(buf)-len,
+                        "[antenna %d]\t%d\t%d\n",
+                        i, sc->stats.antenna_rx[i], sc->stats.antenna_tx[i]);
+        }
+        len += snprintf(buf+len, sizeof(buf)-len, "[invalid]\t%d\t%d\n",
+                        sc->stats.antenna_rx[0], sc->stats.antenna_tx[0]);
+
+        v = ath5k_hw_reg_read(sc->ah, AR5K_DEFAULT_ANTENNA);
+        len += snprintf(buf+len, sizeof(buf)-len,
+                        "\nAR5K_DEFAULT_ANTENNA\t0x%08x\n", v);
+
+        v = ath5k_hw_reg_read(sc->ah, AR5K_STA_ID1);
+        len += snprintf(buf+len, sizeof(buf)-len,
+                "AR5K_STA_ID1_DEFAULT_ANTENNA\t%d\n",
+                (v & AR5K_STA_ID1_DEFAULT_ANTENNA) != 0);
+        len += snprintf(buf+len, sizeof(buf)-len,
+                "AR5K_STA_ID1_DESC_ANTENNA\t%d\n",
+                (v & AR5K_STA_ID1_DESC_ANTENNA) != 0);
+        len += snprintf(buf+len, sizeof(buf)-len,
+                "AR5K_STA_ID1_RTS_DEF_ANTENNA\t%d\n",
+                (v & AR5K_STA_ID1_RTS_DEF_ANTENNA) != 0);
+        len += snprintf(buf+len, sizeof(buf)-len,
+                "AR5K_STA_ID1_SELFGEN_DEF_ANT\t%d\n",
+                (v & AR5K_STA_ID1_SELFGEN_DEF_ANT) != 0);
+
+        v = ath5k_hw_reg_read(sc->ah, AR5K_PHY_AGCCTL);
+        len += snprintf(buf+len, sizeof(buf)-len,
+                "\nAR5K_PHY_AGCCTL_OFDM_DIV_DIS\t%d\n",
+                (v & AR5K_PHY_AGCCTL_OFDM_DIV_DIS) != 0);
+
+        v = ath5k_hw_reg_read(sc->ah, AR5K_PHY_RESTART);
+        len += snprintf(buf+len, sizeof(buf)-len,
+                "AR5K_PHY_RESTART_DIV_GC\t\t%x\n",
+                (v & AR5K_PHY_RESTART_DIV_GC) >> AR5K_PHY_RESTART_DIV_GC_S);
+
+        v = ath5k_hw_reg_read(sc->ah, AR5K_PHY_FAST_ANT_DIV);
+        len += snprintf(buf+len, sizeof(buf)-len,
+                "AR5K_PHY_FAST_ANT_DIV_EN\t%d\n",
+                (v & AR5K_PHY_FAST_ANT_DIV_EN) != 0);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t write_file_antenna(struct file *file,
+                                 const char __user *userbuf,
+                                 size_t count, loff_t *ppos)
+{
+        struct ath5k_softc *sc = file->private_data;
+        unsigned int i;
+        char buf[20];
+
+        if (copy_from_user(buf, userbuf, min(count, sizeof(buf))))
+                return -EFAULT;
+
+        if (strncmp(buf, "diversity", 9) == 0) {
+                ath5k_hw_set_antenna_mode(sc->ah, AR5K_ANTMODE_DEFAULT);
+                printk(KERN_INFO "ath5k debug: enable diversity\n");
+        } else if (strncmp(buf, "fixed-a", 7) == 0) {
+                ath5k_hw_set_antenna_mode(sc->ah, AR5K_ANTMODE_FIXED_A);
+                printk(KERN_INFO "ath5k debugfs: fixed antenna A\n");
+        } else if (strncmp(buf, "fixed-b", 7) == 0) {
+                ath5k_hw_set_antenna_mode(sc->ah, AR5K_ANTMODE_FIXED_B);
+                printk(KERN_INFO "ath5k debug: fixed antenna B\n");
+        } else if (strncmp(buf, "clear", 5) == 0) {
+                for (i = 0; i < ARRAY_SIZE(sc->stats.antenna_rx); i++) {
+                        sc->stats.antenna_rx[i] = 0;
+                        sc->stats.antenna_tx[i] = 0;
+                }
+                printk(KERN_INFO "ath5k debug: cleared antenna stats\n");
+        }
+        return count;
+}
+
+static const struct file_operations fops_antenna = {
+        .read = read_file_antenna,
+        .write = write_file_antenna,
+        .open = ath5k_debugfs_open,
+        .owner = THIS_MODULE,
+};
+
+
+/* debugfs: frameerrors */
+
+static ssize_t read_file_frameerrors(struct file *file, char __user *user_buf,
+                                   size_t count, loff_t *ppos)
+{
+        struct ath5k_softc *sc = file->private_data;
+        struct ath5k_statistics *st = &sc->stats;
+        char buf[700];
+        unsigned int len = 0;
+        int i;
+
+        len += snprintf(buf+len, sizeof(buf)-len,
+                        "RX\n---------------------\n");
+        len += snprintf(buf+len, sizeof(buf)-len, "CRC\t%d\t(%d%%)\n",
+                        st->rxerr_crc,
+                        st->rx_all_count > 0 ?
+                                st->rxerr_crc*100/st->rx_all_count : 0);
+        len += snprintf(buf+len, sizeof(buf)-len, "PHY\t%d\t(%d%%)\n",
+                        st->rxerr_phy,
+                        st->rx_all_count > 0 ?
+                                st->rxerr_phy*100/st->rx_all_count : 0);
+        for (i = 0; i < 32; i++) {
+                if (st->rxerr_phy_code[i])
+                        len += snprintf(buf+len, sizeof(buf)-len,
+                                " phy_err[%d]\t%d\n",
+                                i, st->rxerr_phy_code[i]);
+        }
+
+        len += snprintf(buf+len, sizeof(buf)-len, "FIFO\t%d\t(%d%%)\n",
+                        st->rxerr_fifo,
+                        st->rx_all_count > 0 ?
+                                st->rxerr_fifo*100/st->rx_all_count : 0);
+        len += snprintf(buf+len, sizeof(buf)-len, "decrypt\t%d\t(%d%%)\n",
+                        st->rxerr_decrypt,
+                        st->rx_all_count > 0 ?
+                                st->rxerr_decrypt*100/st->rx_all_count : 0);
+        len += snprintf(buf+len, sizeof(buf)-len, "MIC\t%d\t(%d%%)\n",
+                        st->rxerr_mic,
+                        st->rx_all_count > 0 ?
+                                st->rxerr_mic*100/st->rx_all_count : 0);
+        len += snprintf(buf+len, sizeof(buf)-len, "process\t%d\t(%d%%)\n",
+                        st->rxerr_proc,
+                        st->rx_all_count > 0 ?
+                                st->rxerr_proc*100/st->rx_all_count : 0);
+        len += snprintf(buf+len, sizeof(buf)-len, "jumbo\t%d\t(%d%%)\n",
+                        st->rxerr_jumbo,
+                        st->rx_all_count > 0 ?
+                                st->rxerr_jumbo*100/st->rx_all_count : 0);
+        len += snprintf(buf+len, sizeof(buf)-len, "[RX all\t%d]\n",
+                        st->rx_all_count);
+
+        len += snprintf(buf+len, sizeof(buf)-len,
+                        "\nTX\n---------------------\n");
+        len += snprintf(buf+len, sizeof(buf)-len, "retry\t%d\t(%d%%)\n",
+                        st->txerr_retry,
+                        st->tx_all_count > 0 ?
+                                st->txerr_retry*100/st->tx_all_count : 0);
+        len += snprintf(buf+len, sizeof(buf)-len, "FIFO\t%d\t(%d%%)\n",
+                        st->txerr_fifo,
+                        st->tx_all_count > 0 ?
+                                st->txerr_fifo*100/st->tx_all_count : 0);
+        len += snprintf(buf+len, sizeof(buf)-len, "filter\t%d\t(%d%%)\n",
+                        st->txerr_filt,
+                        st->tx_all_count > 0 ?
+                                st->txerr_filt*100/st->tx_all_count : 0);
+        len += snprintf(buf+len, sizeof(buf)-len, "[TX all\t%d]\n",
+                        st->tx_all_count);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t write_file_frameerrors(struct file *file,
+                                 const char __user *userbuf,
+                                 size_t count, loff_t *ppos)
+{
+        struct ath5k_softc *sc = file->private_data;
+        struct ath5k_statistics *st = &sc->stats;
+        char buf[20];
+
+        if (copy_from_user(buf, userbuf, min(count, sizeof(buf))))
+                return -EFAULT;
+
+        if (strncmp(buf, "clear", 5) == 0) {
+                st->rxerr_crc = 0;
+                st->rxerr_phy = 0;
+                st->rxerr_fifo = 0;
+                st->rxerr_decrypt = 0;
+                st->rxerr_mic = 0;
+                st->rxerr_proc = 0;
+                st->rxerr_jumbo = 0;
+                st->rx_all_count = 0;
+                st->txerr_retry = 0;
+                st->txerr_fifo = 0;
+                st->txerr_filt = 0;
+                st->tx_all_count = 0;
+                printk(KERN_INFO "ath5k debug: cleared frameerrors stats\n");
+        }
+        return count;
+}
+
+static const struct file_operations fops_frameerrors = {
+        .read = read_file_frameerrors,
+        .write = write_file_frameerrors,
+        .open = ath5k_debugfs_open,
+        .owner = THIS_MODULE,
+};
+
+
+/* debugfs: ani */
+
+static ssize_t read_file_ani(struct file *file, char __user *user_buf,
+                                   size_t count, loff_t *ppos)
+{
+        struct ath5k_softc *sc = file->private_data;
+        struct ath5k_statistics *st = &sc->stats;
+        struct ath5k_ani_state *as = &sc->ani_state;
+
+        char buf[700];
+        unsigned int len = 0;
+
+        len += snprintf(buf+len, sizeof(buf)-len,
+                        "HW has PHY error counters:\t%s\n",
+                        sc->ah->ah_capabilities.cap_has_phyerr_counters ?
+                        "yes" : "no");
+        len += snprintf(buf+len, sizeof(buf)-len,
+                        "HW max spur immunity level:\t%d\n",
+                        as->max_spur_level);
+        len += snprintf(buf+len, sizeof(buf)-len,
+                "\nANI state\n--------------------------------------------\n");
+        len += snprintf(buf+len, sizeof(buf)-len, "operating mode:\t\t\t");
+        switch (as->ani_mode) {
+        case ATH5K_ANI_MODE_OFF:
+                len += snprintf(buf+len, sizeof(buf)-len, "OFF\n");
+                break;
+        case ATH5K_ANI_MODE_MANUAL_LOW:
+                len += snprintf(buf+len, sizeof(buf)-len,
+                        "MANUAL LOW\n");
+                break;
+        case ATH5K_ANI_MODE_MANUAL_HIGH:
+                len += snprintf(buf+len, sizeof(buf)-len,
+                        "MANUAL HIGH\n");
+                break;
+        case ATH5K_ANI_MODE_AUTO:
+                len += snprintf(buf+len, sizeof(buf)-len, "AUTO\n");
+                break;
+        default:
+                len += snprintf(buf+len, sizeof(buf)-len,
+                        "??? (not good)\n");
+                break;
+        }
+        len += snprintf(buf+len, sizeof(buf)-len,
+                        "noise immunity level:\t\t%d\n",
+                        as->noise_imm_level);
+        len += snprintf(buf+len, sizeof(buf)-len,
+                        "spur immunity level:\t\t%d\n",
+                        as->spur_level);
+        len += snprintf(buf+len, sizeof(buf)-len, "firstep level:\t\t\t%d\n",
+                        as->firstep_level);
+        len += snprintf(buf+len, sizeof(buf)-len,
+                        "OFDM weak signal detection:\t%s\n",
+                        as->ofdm_weak_sig ? "on" : "off");
+        len += snprintf(buf+len, sizeof(buf)-len,
+                        "CCK weak signal detection:\t%s\n",
+                        as->cck_weak_sig ? "on" : "off");
+
+        len += snprintf(buf+len, sizeof(buf)-len,
+                        "\nMIB INTERRUPTS:\t\t%u\n",
+                        st->mib_intr);
+        len += snprintf(buf+len, sizeof(buf)-len,
+                        "beacon RSSI average:\t%d\n",
+                        sc->ah->ah_beacon_rssi_avg.avg);
+        len += snprintf(buf+len, sizeof(buf)-len, "profcnt tx\t\t%u\t(%d%%)\n",
+                        as->pfc_tx,
+                        as->pfc_cycles > 0 ?
+                        as->pfc_tx*100/as->pfc_cycles : 0);
+        len += snprintf(buf+len, sizeof(buf)-len, "profcnt rx\t\t%u\t(%d%%)\n",
+                        as->pfc_rx,
+                        as->pfc_cycles > 0 ?
+                        as->pfc_rx*100/as->pfc_cycles : 0);
+        len += snprintf(buf+len, sizeof(buf)-len, "profcnt busy\t\t%u\t(%d%%)\n",
+                        as->pfc_busy,
+                        as->pfc_cycles > 0 ?
+                        as->pfc_busy*100/as->pfc_cycles : 0);
+        len += snprintf(buf+len, sizeof(buf)-len, "profcnt cycles\t\t%u\n",
+                        as->pfc_cycles);
+        len += snprintf(buf+len, sizeof(buf)-len,
+                        "listen time\t\t%d\tlast: %d\n",
+                        as->listen_time, as->last_listen);
+        len += snprintf(buf+len, sizeof(buf)-len,
+                        "OFDM errors\t\t%u\tlast: %u\tsum: %u\n",
+                        as->ofdm_errors, as->last_ofdm_errors,
+                        as->sum_ofdm_errors);
+        len += snprintf(buf+len, sizeof(buf)-len,
+                        "CCK errors\t\t%u\tlast: %u\tsum: %u\n",
+                        as->cck_errors, as->last_cck_errors,
+                        as->sum_cck_errors);
+        len += snprintf(buf+len, sizeof(buf)-len,
+                        "AR5K_PHYERR_CNT1\t%x\t(=%d)\n",
+                        ath5k_hw_reg_read(sc->ah, AR5K_PHYERR_CNT1),
+                        ATH5K_ANI_OFDM_TRIG_HIGH - (ATH5K_PHYERR_CNT_MAX -
+                        ath5k_hw_reg_read(sc->ah, AR5K_PHYERR_CNT1)));
+        len += snprintf(buf+len, sizeof(buf)-len,
+                        "AR5K_PHYERR_CNT2\t%x\t(=%d)\n",
+                        ath5k_hw_reg_read(sc->ah, AR5K_PHYERR_CNT2),
+                        ATH5K_ANI_CCK_TRIG_HIGH - (ATH5K_PHYERR_CNT_MAX -
+                        ath5k_hw_reg_read(sc->ah, AR5K_PHYERR_CNT2)));
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t write_file_ani(struct file *file,
+                                 const char __user *userbuf,
+                                 size_t count, loff_t *ppos)
+{
+        struct ath5k_softc *sc = file->private_data;
+        char buf[20];
+
+        if (copy_from_user(buf, userbuf, min(count, sizeof(buf))))
+                return -EFAULT;
+
+        if (strncmp(buf, "sens-low", 8) == 0) {
+                ath5k_ani_init(sc->ah, ATH5K_ANI_MODE_MANUAL_HIGH);
+        } else if (strncmp(buf, "sens-high", 9) == 0) {
+                ath5k_ani_init(sc->ah, ATH5K_ANI_MODE_MANUAL_LOW);
+        } else if (strncmp(buf, "ani-off", 7) == 0) {
+                ath5k_ani_init(sc->ah, ATH5K_ANI_MODE_OFF);
+        } else if (strncmp(buf, "ani-on", 6) == 0) {
+                ath5k_ani_init(sc->ah, ATH5K_ANI_MODE_AUTO);
+        } else if (strncmp(buf, "noise-low", 9) == 0) {
+                ath5k_ani_set_noise_immunity_level(sc->ah, 0);
+        } else if (strncmp(buf, "noise-high", 10) == 0) {
+                ath5k_ani_set_noise_immunity_level(sc->ah,
+                                                   ATH5K_ANI_MAX_NOISE_IMM_LVL);
+        } else if (strncmp(buf, "spur-low", 8) == 0) {
+                ath5k_ani_set_spur_immunity_level(sc->ah, 0);
+        } else if (strncmp(buf, "spur-high", 9) == 0) {
+                ath5k_ani_set_spur_immunity_level(sc->ah,
+                                                  sc->ani_state.max_spur_level);
+        } else if (strncmp(buf, "fir-low", 7) == 0) {
+                ath5k_ani_set_firstep_level(sc->ah, 0);
+        } else if (strncmp(buf, "fir-high", 8) == 0) {
+                ath5k_ani_set_firstep_level(sc->ah, ATH5K_ANI_MAX_FIRSTEP_LVL);
+        } else if (strncmp(buf, "ofdm-off", 8) == 0) {
+                ath5k_ani_set_ofdm_weak_signal_detection(sc->ah, false);
+        } else if (strncmp(buf, "ofdm-on", 7) == 0) {
+                ath5k_ani_set_ofdm_weak_signal_detection(sc->ah, true);
+        } else if (strncmp(buf, "cck-off", 7) == 0) {
+                ath5k_ani_set_cck_weak_signal_detection(sc->ah, false);
+        } else if (strncmp(buf, "cck-on", 6) == 0) {
+                ath5k_ani_set_cck_weak_signal_detection(sc->ah, true);
+        }
+        return count;
+}
+
+static const struct file_operations fops_ani = {
+        .read = read_file_ani,
+        .write = write_file_ani,
+        .open = ath5k_debugfs_open,
+        .owner = THIS_MODULE,
+};
+
+
 /* init */
 
 void
@@ -393,6 +758,20 @@ ath5k_debug_init_device(struct ath5k_softc *sc)
 
         sc->debug.debugfs_reset = debugfs_create_file("reset", S_IWUSR,
                                 sc->debug.debugfs_phydir, sc, &fops_reset);
+
+        sc->debug.debugfs_antenna = debugfs_create_file("antenna",
+                                S_IWUSR | S_IRUSR,
+                                sc->debug.debugfs_phydir, sc, &fops_antenna);
+
+        sc->debug.debugfs_frameerrors = debugfs_create_file("frameerrors",
+                                S_IWUSR | S_IRUSR,
+                                sc->debug.debugfs_phydir, sc,
+                                &fops_frameerrors);
+
+        sc->debug.debugfs_ani = debugfs_create_file("ani",
+                                S_IWUSR | S_IRUSR,
+                                sc->debug.debugfs_phydir, sc,
+                                &fops_ani);
 }
 
 void
@@ -408,6 +787,9 @@ ath5k_debug_finish_device(struct ath5k_softc *sc)
         debugfs_remove(sc->debug.debugfs_registers);
         debugfs_remove(sc->debug.debugfs_beacon);
         debugfs_remove(sc->debug.debugfs_reset);
+        debugfs_remove(sc->debug.debugfs_antenna);
+        debugfs_remove(sc->debug.debugfs_frameerrors);
+        debugfs_remove(sc->debug.debugfs_ani);
         debugfs_remove(sc->debug.debugfs_phydir);
 }
 
diff --git a/drivers/net/wireless/ath/ath5k/debug.h b/drivers/net/wireless/ath/ath5k/debug.h
index 66f69f04e55e..ddd5b3a99e8d 100644
--- a/drivers/net/wireless/ath/ath5k/debug.h
+++ b/drivers/net/wireless/ath/ath5k/debug.h
@@ -74,6 +74,9 @@ struct ath5k_dbg_info {
         struct dentry           *debugfs_registers;
         struct dentry           *debugfs_beacon;
         struct dentry           *debugfs_reset;
+        struct dentry           *debugfs_antenna;
+        struct dentry           *debugfs_frameerrors;
+        struct dentry           *debugfs_ani;
 };
 
 /**
@@ -113,6 +116,7 @@ enum ath5k_debug_level {
         ATH5K_DEBUG_DUMP_TX     = 0x00000200,
         ATH5K_DEBUG_DUMPBANDS   = 0x00000400,
         ATH5K_DEBUG_TRACE       = 0x00001000,
+        ATH5K_DEBUG_ANI         = 0x00002000,
         ATH5K_DEBUG_ANY         = 0xffffffff
 };
 
diff --git a/drivers/net/wireless/ath/ath5k/desc.c b/drivers/net/wireless/ath/ath5k/desc.c
index dc30a2b70a6b..7d7b646ab65a 100644
--- a/drivers/net/wireless/ath/ath5k/desc.c
+++ b/drivers/net/wireless/ath/ath5k/desc.c
@@ -35,7 +35,8 @@
  */
 static int
 ath5k_hw_setup_2word_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
-        unsigned int pkt_len, unsigned int hdr_len, enum ath5k_pkt_type type,
+        unsigned int pkt_len, unsigned int hdr_len, int padsize,
+        enum ath5k_pkt_type type,
         unsigned int tx_power, unsigned int tx_rate0, unsigned int tx_tries0,
         unsigned int key_index, unsigned int antenna_mode, unsigned int flags,
         unsigned int rtscts_rate, unsigned int rtscts_duration)
@@ -71,7 +72,7 @@ ath5k_hw_setup_2word_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
         /* Verify and set frame length */
 
         /* remove padding we might have added before */
-        frame_len = pkt_len - ath5k_pad_size(hdr_len) + FCS_LEN;
+        frame_len = pkt_len - padsize + FCS_LEN;
 
         if (frame_len & ~AR5K_2W_TX_DESC_CTL0_FRAME_LEN)
                 return -EINVAL;
@@ -100,7 +101,7 @@ ath5k_hw_setup_2word_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
                         AR5K_REG_SM(hdr_len, AR5K_2W_TX_DESC_CTL0_HEADER_LEN);
         }
 
-        /*Diferences between 5210-5211*/
+        /*Differences between 5210-5211*/
         if (ah->ah_version == AR5K_AR5210) {
                 switch (type) {
                 case AR5K_PKT_TYPE_BEACON:
@@ -165,6 +166,7 @@ ath5k_hw_setup_2word_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
  */
 static int ath5k_hw_setup_4word_tx_desc(struct ath5k_hw *ah,
         struct ath5k_desc *desc, unsigned int pkt_len, unsigned int hdr_len,
+        int padsize,
         enum ath5k_pkt_type type, unsigned int tx_power, unsigned int tx_rate0,
         unsigned int tx_tries0, unsigned int key_index,
         unsigned int antenna_mode, unsigned int flags,
@@ -206,7 +208,7 @@ static int ath5k_hw_setup_4word_tx_desc(struct ath5k_hw *ah,
         /* Verify and set frame length */
 
         /* remove padding we might have added before */
-        frame_len = pkt_len - ath5k_pad_size(hdr_len) + FCS_LEN;
+        frame_len = pkt_len - padsize + FCS_LEN;
 
         if (frame_len & ~AR5K_4W_TX_DESC_CTL0_FRAME_LEN)
                 return -EINVAL;
@@ -229,7 +231,7 @@ static int ath5k_hw_setup_4word_tx_desc(struct ath5k_hw *ah,
                 AR5K_REG_SM(antenna_mode, AR5K_4W_TX_DESC_CTL0_ANT_MODE_XMIT);
         tx_ctl->tx_control_1 |= AR5K_REG_SM(type,
                                         AR5K_4W_TX_DESC_CTL1_FRAME_TYPE);
-        tx_ctl->tx_control_2 = AR5K_REG_SM(tx_tries0 + AR5K_TUNE_HWTXTRIES,
+        tx_ctl->tx_control_2 = AR5K_REG_SM(tx_tries0,
                                         AR5K_4W_TX_DESC_CTL2_XMIT_TRIES0);
         tx_ctl->tx_control_3 = tx_rate0 & AR5K_4W_TX_DESC_CTL3_XMIT_RATE0;
 
@@ -643,6 +645,7 @@ static int ath5k_hw_proc_5212_rx_status(struct ath5k_hw *ah,
                         rs->rs_status |= AR5K_RXERR_PHY;
                         rs->rs_phyerr |= AR5K_REG_MS(rx_err->rx_error_1,
                                            AR5K_RX_DESC_ERROR1_PHY_ERROR_CODE);
+                        ath5k_ani_phy_error_report(ah, rs->rs_phyerr);
                 }
 
                 if (rx_status->rx_status_1 &
@@ -668,12 +671,6 @@ int ath5k_hw_init_desc_functions(struct ath5k_hw *ah)
                 ah->ah_version != AR5K_AR5212)
                         return -ENOTSUPP;
 
-        /* XXX: What is this magic value and where is it used ? */
-        if (ah->ah_version == AR5K_AR5212)
-                ah->ah_magic = AR5K_EEPROM_MAGIC_5212;
-        else if (ah->ah_version == AR5K_AR5211)
-                ah->ah_magic = AR5K_EEPROM_MAGIC_5211;
-
         if (ah->ah_version == AR5K_AR5212) {
                 ah->ah_setup_rx_desc = ath5k_hw_setup_rx_desc;
                 ah->ah_setup_tx_desc = ath5k_hw_setup_4word_tx_desc;
diff --git a/drivers/net/wireless/ath/ath5k/desc.h b/drivers/net/wireless/ath/ath5k/desc.h
index 56158c804e3e..64538fbe4167 100644
--- a/drivers/net/wireless/ath/ath5k/desc.h
+++ b/drivers/net/wireless/ath/ath5k/desc.h
@@ -112,15 +112,32 @@ struct ath5k_hw_rx_error {
 #define AR5K_RX_DESC_ERROR1_PHY_ERROR_CODE      0x0000ff00
 #define AR5K_RX_DESC_ERROR1_PHY_ERROR_CODE_S    8
 
-/* PHY Error codes */
-#define AR5K_DESC_RX_PHY_ERROR_NONE             0x00
-#define AR5K_DESC_RX_PHY_ERROR_TIMING           0x20
-#define AR5K_DESC_RX_PHY_ERROR_PARITY           0x40
-#define AR5K_DESC_RX_PHY_ERROR_RATE             0x60
-#define AR5K_DESC_RX_PHY_ERROR_LENGTH           0x80
-#define AR5K_DESC_RX_PHY_ERROR_64QAM            0xa0
-#define AR5K_DESC_RX_PHY_ERROR_SERVICE          0xc0
-#define AR5K_DESC_RX_PHY_ERROR_TRANSMITOVR      0xe0
+/**
+ * enum ath5k_phy_error_code - PHY Error codes
+ */
+enum ath5k_phy_error_code {
+        AR5K_RX_PHY_ERROR_UNDERRUN              = 0,    /* Transmit underrun */
+        AR5K_RX_PHY_ERROR_TIMING                = 1,    /* Timing error */
+        AR5K_RX_PHY_ERROR_PARITY                = 2,    /* Illegal parity */
+        AR5K_RX_PHY_ERROR_RATE                  = 3,    /* Illegal rate */
+        AR5K_RX_PHY_ERROR_LENGTH                = 4,    /* Illegal length */
+        AR5K_RX_PHY_ERROR_RADAR                 = 5,    /* Radar detect */
+        AR5K_RX_PHY_ERROR_SERVICE               = 6,    /* Illegal service */
+        AR5K_RX_PHY_ERROR_TOR                   = 7,    /* Transmit override receive */
+        /* these are specific to the 5212 */
+        AR5K_RX_PHY_ERROR_OFDM_TIMING           = 17,
+        AR5K_RX_PHY_ERROR_OFDM_SIGNAL_PARITY    = 18,
+        AR5K_RX_PHY_ERROR_OFDM_RATE_ILLEGAL     = 19,
+        AR5K_RX_PHY_ERROR_OFDM_LENGTH_ILLEGAL   = 20,
+        AR5K_RX_PHY_ERROR_OFDM_POWER_DROP       = 21,
+        AR5K_RX_PHY_ERROR_OFDM_SERVICE          = 22,
+        AR5K_RX_PHY_ERROR_OFDM_RESTART          = 23,
+        AR5K_RX_PHY_ERROR_CCK_TIMING            = 25,
+        AR5K_RX_PHY_ERROR_CCK_HEADER_CRC        = 26,
+        AR5K_RX_PHY_ERROR_CCK_RATE_ILLEGAL      = 27,
+        AR5K_RX_PHY_ERROR_CCK_SERVICE           = 30,
+        AR5K_RX_PHY_ERROR_CCK_RESTART           = 31,
+};
 
 /*
  * 5210/5211 hardware 2-word TX control descriptor
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
index 10b52262b232..a3cbfe4fc389 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.c
+++ b/drivers/net/wireless/ath/ath5k/eeprom.c
@@ -329,7 +329,8 @@ static int ath5k_eeprom_read_modes(struct ath5k_hw *ah, u32 *offset,
         ee->ee_x_gain[mode]             = (val >> 1) & 0xf;
         ee->ee_xpd[mode]                = val & 0x1;
 
-        if (ah->ah_ee_version >= AR5K_EEPROM_VERSION_4_0)
+        if (ah->ah_ee_version >= AR5K_EEPROM_VERSION_4_0 &&
+            mode != AR5K_EEPROM_MODE_11B)
                 ee->ee_fixed_bias[mode] = (val >> 13) & 0x1;
 
         if (ah->ah_ee_version >= AR5K_EEPROM_VERSION_3_3) {
@@ -339,6 +340,7 @@ static int ath5k_eeprom_read_modes(struct ath5k_hw *ah, u32 *offset,
                 if (mode == AR5K_EEPROM_MODE_11A)
                         ee->ee_xr_power[mode] = val & 0x3f;
                 else {
+                        /* b_DB_11[bg] and b_OB_11[bg] */
                         ee->ee_ob[mode][0] = val & 0x7;
                         ee->ee_db[mode][0] = (val >> 3) & 0x7;
                 }
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.h b/drivers/net/wireless/ath/ath5k/eeprom.h
index 473a483bb9c3..c4a6d5f26af4 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.h
+++ b/drivers/net/wireless/ath/ath5k/eeprom.h
@@ -24,9 +24,6 @@
                                                  * SERDES infos are present */
 #define AR5K_EEPROM_MAGIC               0x003d  /* EEPROM Magic number */
 #define AR5K_EEPROM_MAGIC_VALUE         0x5aa5  /* Default - found on EEPROM */
-#define AR5K_EEPROM_MAGIC_5212          0x0000145c /* 5212 */
-#define AR5K_EEPROM_MAGIC_5211          0x0000145b /* 5211 */
-#define AR5K_EEPROM_MAGIC_5210          0x0000145a /* 5210 */
 
 #define AR5K_EEPROM_IS_HB63             0x000b  /* Talon detect */
 
@@ -78,9 +75,9 @@
 #define AR5K_EEPROM_HDR_11A(_v)         (((_v) >> AR5K_EEPROM_MODE_11A) & 0x1)
 #define AR5K_EEPROM_HDR_11B(_v)         (((_v) >> AR5K_EEPROM_MODE_11B) & 0x1)
 #define AR5K_EEPROM_HDR_11G(_v)         (((_v) >> AR5K_EEPROM_MODE_11G) & 0x1)
-#define AR5K_EEPROM_HDR_T_2GHZ_DIS(_v)  (((_v) >> 3) & 0x1)     /* Disable turbo for 2Ghz (?) */
-#define AR5K_EEPROM_HDR_T_5GHZ_DBM(_v)  (((_v) >> 4) & 0x7f)    /* Max turbo power for a/XR mode (eeprom_init) */
-#define AR5K_EEPROM_HDR_DEVICE(_v)      (((_v) >> 11) & 0x7)
+#define AR5K_EEPROM_HDR_T_2GHZ_DIS(_v)  (((_v) >> 3) & 0x1)     /* Disable turbo for 2Ghz */
+#define AR5K_EEPROM_HDR_T_5GHZ_DBM(_v)  (((_v) >> 4) & 0x7f)    /* Max turbo power for < 2W power consumption */
+#define AR5K_EEPROM_HDR_DEVICE(_v)      (((_v) >> 11) & 0x7)    /* Device type (1 Cardbus, 2 PCI, 3 MiniPCI, 4 AP) */
 #define AR5K_EEPROM_HDR_RFKILL(_v)      (((_v) >> 14) & 0x1)    /* Device has RFKill support */
 #define AR5K_EEPROM_HDR_T_5GHZ_DIS(_v)  (((_v) >> 15) & 0x1)    /* Disable turbo for 5Ghz */
 
@@ -101,7 +98,7 @@
 
 #define AR5K_EEPROM_MISC1                       AR5K_EEPROM_INFO(5)
 #define AR5K_EEPROM_TARGET_PWRSTART(_v)         ((_v) & 0xfff)
-#define AR5K_EEPROM_HAS32KHZCRYSTAL(_v)         (((_v) >> 14) & 0x1)
+#define AR5K_EEPROM_HAS32KHZCRYSTAL(_v)         (((_v) >> 14) & 0x1)    /* has 32KHz crystal for sleep mode */
 #define AR5K_EEPROM_HAS32KHZCRYSTAL_OLD(_v)     (((_v) >> 15) & 0x1)
 
 #define AR5K_EEPROM_MISC2                       AR5K_EEPROM_INFO(6)
@@ -114,26 +111,27 @@
 
 #define AR5K_EEPROM_MISC4               AR5K_EEPROM_INFO(8)
 #define AR5K_EEPROM_CAL_DATA_START(_v)  (((_v) >> 4) & 0xfff)
-#define AR5K_EEPROM_MASK_R0(_v)         (((_v) >> 2) & 0x3)
-#define AR5K_EEPROM_MASK_R1(_v)         ((_v) & 0x3)
+#define AR5K_EEPROM_MASK_R0(_v)         (((_v) >> 2) & 0x3)     /* modes supported by radio 0 (bit 1: G, bit 2: A) */
+#define AR5K_EEPROM_MASK_R1(_v)         ((_v) & 0x3)            /* modes supported by radio 1 (bit 1: G, bit 2: A) */
 
 #define AR5K_EEPROM_MISC5               AR5K_EEPROM_INFO(9)
-#define AR5K_EEPROM_COMP_DIS(_v)        ((_v) & 0x1)
-#define AR5K_EEPROM_AES_DIS(_v)         (((_v) >> 1) & 0x1)
-#define AR5K_EEPROM_FF_DIS(_v)          (((_v) >> 2) & 0x1)
-#define AR5K_EEPROM_BURST_DIS(_v)       (((_v) >> 3) & 0x1)
-#define AR5K_EEPROM_MAX_QCU(_v)         (((_v) >> 4) & 0xf)
-#define AR5K_EEPROM_HEAVY_CLIP_EN(_v)   (((_v) >> 8) & 0x1)
-#define AR5K_EEPROM_KEY_CACHE_SIZE(_v)  (((_v) >> 12) & 0xf)
+#define AR5K_EEPROM_COMP_DIS(_v)        ((_v) & 0x1)            /* disable compression */
+#define AR5K_EEPROM_AES_DIS(_v)         (((_v) >> 1) & 0x1)     /* disable AES */
+#define AR5K_EEPROM_FF_DIS(_v)          (((_v) >> 2) & 0x1)     /* disable fast frames */
+#define AR5K_EEPROM_BURST_DIS(_v)       (((_v) >> 3) & 0x1)     /* disable bursting */
+#define AR5K_EEPROM_MAX_QCU(_v)         (((_v) >> 4) & 0xf)     /* max number of QCUs. defaults to 10 */
+#define AR5K_EEPROM_HEAVY_CLIP_EN(_v)   (((_v) >> 8) & 0x1)     /* enable heayy clipping */
+#define AR5K_EEPROM_KEY_CACHE_SIZE(_v)  (((_v) >> 12) & 0xf)    /* key cache size. defaults to 128 */
 
 #define AR5K_EEPROM_MISC6               AR5K_EEPROM_INFO(10)
-#define AR5K_EEPROM_TX_CHAIN_DIS        ((_v) & 0x8)
-#define AR5K_EEPROM_RX_CHAIN_DIS        (((_v) >> 3) & 0x8)
-#define AR5K_EEPROM_FCC_MID_EN          (((_v) >> 6) & 0x1)
-#define AR5K_EEPROM_JAP_U1EVEN_EN       (((_v) >> 7) & 0x1)
-#define AR5K_EEPROM_JAP_U2_EN           (((_v) >> 8) & 0x1)
-#define AR5K_EEPROM_JAP_U1ODD_EN        (((_v) >> 9) & 0x1)
-#define AR5K_EEPROM_JAP_11A_NEW_EN      (((_v) >> 10) & 0x1)
+#define AR5K_EEPROM_TX_CHAIN_DIS        ((_v) & 0x7)            /* MIMO chains disabled for TX bitmask */
+#define AR5K_EEPROM_RX_CHAIN_DIS        (((_v) >> 3) & 0x7)     /* MIMO chains disabled for RX bitmask */
+#define AR5K_EEPROM_FCC_MID_EN          (((_v) >> 6) & 0x1)     /* 5.47-5.7GHz supported */
+#define AR5K_EEPROM_JAP_U1EVEN_EN       (((_v) >> 7) & 0x1)     /* Japan UNII1 band (5.15-5.25GHz) on even channels (5180, 5200, 5220, 5240) supported */
+#define AR5K_EEPROM_JAP_U2_EN           (((_v) >> 8) & 0x1)     /* Japan UNII2 band (5.25-5.35GHz) supported */
+#define AR5K_EEPROM_JAP_MID_EN          (((_v) >> 9) & 0x1)     /* Japan band from 5.47-5.7GHz supported */
+#define AR5K_EEPROM_JAP_U1ODD_EN        (((_v) >> 10) & 0x1)    /* Japan UNII2 band (5.15-5.25GHz) on odd channels (5170, 5190, 5210, 5230) supported */
+#define AR5K_EEPROM_JAP_11A_NEW_EN      (((_v) >> 11) & 0x1)    /* Japan A mode enabled (using even channels) */
 
 /* calibration settings */
 #define AR5K_EEPROM_MODES_11A(_v)       AR5K_EEPROM_OFF(_v, 0x00c5, 0x00d4)
@@ -389,7 +387,49 @@ struct ath5k_edge_power {
         bool flag;
 };
 
-/* EEPROM calibration data */
+/**
+ * struct ath5k_eeprom_info - EEPROM calibration data
+ *
+ * @ee_regdomain: ath/regd.c takes care of COUNTRY_ERD and WORLDWIDE_ROAMING
+ *      flags
+ * @ee_ant_gain: Antenna gain in 0.5dB steps signed [5211 only?]
+ * @ee_cck_ofdm_gain_delta: difference in gainF to output the same power for
+ *      OFDM and CCK packets
+ * @ee_cck_ofdm_power_delta: power difference between OFDM (6Mbps) and CCK
+ *      (11Mbps) rate in G mode. 0.1dB steps
+ * @ee_scaled_cck_delta: for Japan Channel 14: 0.1dB resolution
+ *
+ * @ee_i_cal: Initial I coefficient to correct I/Q mismatch in the receive path
+ * @ee_q_cal: Initial Q coefficient to correct I/Q mismatch in the receive path
+ * @ee_fixed_bias: use ee_ob and ee_db settings or use automatic control
+ * @ee_switch_settling: RX/TX Switch settling time
+ * @ee_atn_tx_rx: Difference in attenuation between TX and RX in 1dB steps
+ * @ee_ant_control: Antenna Control Settings
+ * @ee_ob: Bias current for Output stage of PA
+ *      B/G mode: Index [0] is used for AR2112/5112, otherwise [1]
+ *      A mode: [0] 5.15-5.25 [1] 5.25-5.50 [2] 5.50-5.70 [3] 5.70-5.85 GHz
+ * @ee_db: Bias current for Output stage of PA. see @ee_ob
+ * @ee_tx_end2xlna_enable: Time difference from when BB finishes sending a frame
+ *      to when the external LNA is activated
+ * @ee_tx_end2xpa_disable: Time difference from when BB finishes sending a frame
+ *      to when the external PA switch is deactivated
+ * @ee_tx_frm2xpa_enable: Time difference from when MAC sends frame to when
+ *      external PA switch is activated
+ * @ee_thr_62: Clear Channel Assessment (CCA) sensitivity
+ *      (IEEE802.11a section 17.3.10.5 )
+ * @ee_xlna_gain: Total gain of the LNA (information only)
+ * @ee_xpd: Use external (1) or internal power detector
+ * @ee_x_gain: Gain for external power detector output (differences in EEMAP
+ *      versions!)
+ * @ee_i_gain: Initial gain value after reset
+ * @ee_margin_tx_rx: Margin in dB when final attenuation stage should be used
+ *
+ * @ee_false_detect: Backoff in Sensitivity (dB) on channels with spur signals
+ * @ee_noise_floor_thr: Noise floor threshold in 1dB steps
+ * @ee_adc_desired_size: Desired amplitude for ADC, used by AGC; in 0.5 dB steps
+ * @ee_pga_desired_size: Desired output of PGA (for BB gain) in 0.5 dB steps
+ * @ee_pd_gain_overlap: PD ADC curves need to overlap in 0.5dB steps (ee_map>=2)
+ */
 struct ath5k_eeprom_info {
 
         /* Header information */
diff --git a/drivers/net/wireless/ath/ath5k/pcu.c b/drivers/net/wireless/ath/ath5k/pcu.c
index aefe84f9c04b..710870ea179b 100644
--- a/drivers/net/wireless/ath/ath5k/pcu.c
+++ b/drivers/net/wireless/ath/ath5k/pcu.c
@@ -39,16 +39,16 @@
  * ath5k_hw_set_opmode - Set PCU operating mode
  *
  * @ah: The &struct ath5k_hw
+ * @op_mode: &enum nl80211_iftype operating mode
  *
  * Initialize PCU for the various operating modes (AP/STA etc)
- *
- * NOTE: ah->ah_op_mode must be set before calling this.
  */
-int ath5k_hw_set_opmode(struct ath5k_hw *ah)
+int ath5k_hw_set_opmode(struct ath5k_hw *ah, enum nl80211_iftype op_mode)
 {
         struct ath_common *common = ath5k_hw_common(ah);
         u32 pcu_reg, beacon_reg, low_id, high_id;
 
+        ATH5K_DBG(ah->ah_sc, ATH5K_DEBUG_MODE, "mode %d\n", op_mode);
 
         /* Preserve rest settings */
         pcu_reg = ath5k_hw_reg_read(ah, AR5K_STA_ID1) & 0xffff0000;
@@ -61,7 +61,7 @@ int ath5k_hw_set_opmode(struct ath5k_hw *ah)
 
         ATH5K_TRACE(ah->ah_sc);
 
-        switch (ah->ah_op_mode) {
+        switch (op_mode) {
         case NL80211_IFTYPE_ADHOC:
                 pcu_reg |= AR5K_STA_ID1_ADHOC | AR5K_STA_ID1_KEYSRCH_MODE;
                 beacon_reg |= AR5K_BCR_ADHOC;
@@ -113,39 +113,26 @@ int ath5k_hw_set_opmode(struct ath5k_hw *ah)
 }
 
 /**
- * ath5k_hw_update - Update mib counters (mac layer statistics)
+ * ath5k_hw_update - Update MIB counters (mac layer statistics)
  *
  * @ah: The &struct ath5k_hw
- * @stats: The &struct ieee80211_low_level_stats we use to track
- * statistics on the driver
  *
- * Reads MIB counters from PCU and updates sw statistics. Must be
- * called after a MIB interrupt.
+ * Reads MIB counters from PCU and updates sw statistics. Is called after a
+ * MIB interrupt, because one of these counters might have reached their maximum
+ * and triggered the MIB interrupt, to let us read and clear the counter.
+ *
+ * Is called in interrupt context!
  */
-void ath5k_hw_update_mib_counters(struct ath5k_hw *ah,
-                struct ieee80211_low_level_stats  *stats)
+void ath5k_hw_update_mib_counters(struct ath5k_hw *ah)
 {
-        ATH5K_TRACE(ah->ah_sc);
+        struct ath5k_statistics *stats = &ah->ah_sc->stats;
 
         /* Read-And-Clear */
-        stats->dot11ACKFailureCount += ath5k_hw_reg_read(ah, AR5K_ACK_FAIL);
-        stats->dot11RTSFailureCount += ath5k_hw_reg_read(ah, AR5K_RTS_FAIL);
-        stats->dot11RTSSuccessCount += ath5k_hw_reg_read(ah, AR5K_RTS_OK);
-        stats->dot11FCSErrorCount += ath5k_hw_reg_read(ah, AR5K_FCS_FAIL);
-
-        /* XXX: Should we use this to track beacon count ?
-         * -we read it anyway to clear the register */
-        ath5k_hw_reg_read(ah, AR5K_BEACON_CNT);
-
-        /* Reset profile count registers on 5212*/
-        if (ah->ah_version == AR5K_AR5212) {
-                ath5k_hw_reg_write(ah, 0, AR5K_PROFCNT_TX);
-                ath5k_hw_reg_write(ah, 0, AR5K_PROFCNT_RX);
-                ath5k_hw_reg_write(ah, 0, AR5K_PROFCNT_RXCLR);
-                ath5k_hw_reg_write(ah, 0, AR5K_PROFCNT_CYCLE);
-        }
-
-        /* TODO: Handle ANI stats */
+        stats->ack_fail += ath5k_hw_reg_read(ah, AR5K_ACK_FAIL);
+        stats->rts_fail += ath5k_hw_reg_read(ah, AR5K_RTS_FAIL);
+        stats->rts_ok += ath5k_hw_reg_read(ah, AR5K_RTS_OK);
+        stats->fcs_error += ath5k_hw_reg_read(ah, AR5K_FCS_FAIL);
+        stats->beacons += ath5k_hw_reg_read(ah, AR5K_BEACON_CNT);
 }
 
 /**
@@ -179,25 +166,12 @@ void ath5k_hw_set_ack_bitrate_high(struct ath5k_hw *ah, bool high)
 \******************/
 
 /**
- * ath5k_hw_het_ack_timeout - Get ACK timeout from PCU in usec
- *
- * @ah: The &struct ath5k_hw
- */
-unsigned int ath5k_hw_get_ack_timeout(struct ath5k_hw *ah)
-{
-        ATH5K_TRACE(ah->ah_sc);
-
-        return ath5k_hw_clocktoh(ah, AR5K_REG_MS(ath5k_hw_reg_read(ah,
-                        AR5K_TIME_OUT), AR5K_TIME_OUT_ACK));
-}
-
-/**
  * ath5k_hw_set_ack_timeout - Set ACK timeout on PCU
  *
  * @ah: The &struct ath5k_hw
  * @timeout: Timeout in usec
  */
-int ath5k_hw_set_ack_timeout(struct ath5k_hw *ah, unsigned int timeout)
+static int ath5k_hw_set_ack_timeout(struct ath5k_hw *ah, unsigned int timeout)
 {
         ATH5K_TRACE(ah->ah_sc);
         if (ath5k_hw_clocktoh(ah, AR5K_REG_MS(0xffffffff, AR5K_TIME_OUT_ACK))
@@ -211,24 +185,12 @@ int ath5k_hw_set_ack_timeout(struct ath5k_hw *ah, unsigned int timeout)
 }
 
 /**
- * ath5k_hw_get_cts_timeout - Get CTS timeout from PCU in usec
- *
- * @ah: The &struct ath5k_hw
- */
-unsigned int ath5k_hw_get_cts_timeout(struct ath5k_hw *ah)
-{
-        ATH5K_TRACE(ah->ah_sc);
-        return ath5k_hw_clocktoh(ah, AR5K_REG_MS(ath5k_hw_reg_read(ah,
-                        AR5K_TIME_OUT), AR5K_TIME_OUT_CTS));
-}
-
-/**
  * ath5k_hw_set_cts_timeout - Set CTS timeout on PCU
  *
  * @ah: The &struct ath5k_hw
  * @timeout: Timeout in usec
  */
-int ath5k_hw_set_cts_timeout(struct ath5k_hw *ah, unsigned int timeout)
+static int ath5k_hw_set_cts_timeout(struct ath5k_hw *ah, unsigned int timeout)
 {
         ATH5K_TRACE(ah->ah_sc);
         if (ath5k_hw_clocktoh(ah, AR5K_REG_MS(0xffffffff, AR5K_TIME_OUT_CTS))
@@ -290,7 +252,7 @@ unsigned int ath5k_hw_get_clockrate(struct ath5k_hw *ah)
  *
  * @ah: The &struct ath5k_hw
  */
-unsigned int ath5k_hw_get_default_slottime(struct ath5k_hw *ah)
+static unsigned int ath5k_hw_get_default_slottime(struct ath5k_hw *ah)
 {
         struct ieee80211_channel *channel = ah->ah_current_channel;
 
@@ -308,7 +270,7 @@ unsigned int ath5k_hw_get_default_slottime(struct ath5k_hw *ah)
  *
  * @ah: The &struct ath5k_hw
  */
-unsigned int ath5k_hw_get_default_sifs(struct ath5k_hw *ah)
+static unsigned int ath5k_hw_get_default_sifs(struct ath5k_hw *ah)
 {
         struct ieee80211_channel *channel = ah->ah_current_channel;
 
@@ -417,7 +379,6 @@ void ath5k_hw_set_bssid_mask(struct ath5k_hw *ah, const u8 *mask)
  * (ACK etc).
  *
  * NOTE: RX DMA should be already enabled using ath5k_hw_start_rx_dma
- * TODO: Init ANI here
  */
 void ath5k_hw_start_rx_pcu(struct ath5k_hw *ah)
 {
@@ -451,42 +412,6 @@ void ath5k_hw_set_mcast_filter(struct ath5k_hw *ah, u32 filter0, u32 filter1)
         ath5k_hw_reg_write(ah, filter1, AR5K_MCAST_FILTER1);
 }
 
-/*
- * Set multicast filter by index
- */
-int ath5k_hw_set_mcast_filter_idx(struct ath5k_hw *ah, u32 index)
-{
-
-        ATH5K_TRACE(ah->ah_sc);
-        if (index >= 64)
-                return -EINVAL;
-        else if (index >= 32)
-                AR5K_REG_ENABLE_BITS(ah, AR5K_MCAST_FILTER1,
-                                (1 << (index - 32)));
-        else
-                AR5K_REG_ENABLE_BITS(ah, AR5K_MCAST_FILTER0, (1 << index));
-
-        return 0;
-}
-
-/*
- * Clear Multicast filter by index
- */
-int ath5k_hw_clear_mcast_filter_idx(struct ath5k_hw *ah, u32 index)
-{
-
-        ATH5K_TRACE(ah->ah_sc);
-        if (index >= 64)
-                return -EINVAL;
-        else if (index >= 32)
-                AR5K_REG_DISABLE_BITS(ah, AR5K_MCAST_FILTER1,
-                                (1 << (index - 32)));
-        else
-                AR5K_REG_DISABLE_BITS(ah, AR5K_MCAST_FILTER0, (1 << index));
-
-        return 0;
-}
-
 /**
  * ath5k_hw_get_rx_filter - Get current rx filter
  *
@@ -572,19 +497,6 @@ void ath5k_hw_set_rx_filter(struct ath5k_hw *ah, u32 filter)
 \****************/
 
 /**
- * ath5k_hw_get_tsf32 - Get a 32bit TSF
- *
- * @ah: The &struct ath5k_hw
- *
- * Returns lower 32 bits of current TSF
- */
-u32 ath5k_hw_get_tsf32(struct ath5k_hw *ah)
-{
-        ATH5K_TRACE(ah->ah_sc);
-        return ath5k_hw_reg_read(ah, AR5K_TSF_L32);
-}
-
-/**
  * ath5k_hw_get_tsf64 - Get the full 64bit TSF
  *
  * @ah: The &struct ath5k_hw
@@ -651,7 +563,7 @@ void ath5k_hw_init_beacon(struct ath5k_hw *ah, u32 next_beacon, u32 interval)
         /*
          * Set the additional timers by mode
          */
-        switch (ah->ah_op_mode) {
+        switch (ah->ah_sc->opmode) {
         case NL80211_IFTYPE_MONITOR:
         case NL80211_IFTYPE_STATION:
                 /* In STA mode timer1 is used as next wakeup
@@ -688,8 +600,8 @@ void ath5k_hw_init_beacon(struct ath5k_hw *ah, u32 next_beacon, u32 interval)
          * Set the beacon register and enable all timers.
          */
         /* When in AP or Mesh Point mode zero timer0 to start TSF */
-        if (ah->ah_op_mode == NL80211_IFTYPE_AP ||
-            ah->ah_op_mode == NL80211_IFTYPE_MESH_POINT)
+        if (ah->ah_sc->opmode == NL80211_IFTYPE_AP ||
+            ah->ah_sc->opmode == NL80211_IFTYPE_MESH_POINT)
                 ath5k_hw_reg_write(ah, 0, AR5K_TIMER0);
 
         ath5k_hw_reg_write(ah, next_beacon, AR5K_TIMER0);
@@ -722,203 +634,6 @@ void ath5k_hw_init_beacon(struct ath5k_hw *ah, u32 next_beacon, u32 interval)
 
 }
 
-#if 0
-/*
- * Set beacon timers
- */
-int ath5k_hw_set_beacon_timers(struct ath5k_hw *ah,
-                const struct ath5k_beacon_state *state)
-{
-        u32 cfp_period, next_cfp, dtim, interval, next_beacon;
-
-        /*
-         * TODO: should be changed through *state
-         * review struct ath5k_beacon_state struct
-         *
-         * XXX: These are used for cfp period bellow, are they
-         * ok ? Is it O.K. for tsf here to be 0 or should we use
-         * get_tsf ?
-         */
-        u32 dtim_count = 0; /* XXX */
-        u32 cfp_count = 0; /* XXX */
-        u32 tsf = 0; /* XXX */
-
-        ATH5K_TRACE(ah->ah_sc);
-        /* Return on an invalid beacon state */
-        if (state->bs_interval < 1)
-                return -EINVAL;
-
-        interval = state->bs_interval;
-        dtim = state->bs_dtim_period;
-
-        /*
-         * PCF support?
-         */
-        if (state->bs_cfp_period > 0) {
-                /*
-                 * Enable PCF mode and set the CFP
-                 * (Contention Free Period) and timer registers
-                 */
-                cfp_period = state->bs_cfp_period * state->bs_dtim_period *
-                        state->bs_interval;
-                next_cfp = (cfp_count * state->bs_dtim_period + dtim_count) *
-                        state->bs_interval;
-
-                AR5K_REG_ENABLE_BITS(ah, AR5K_STA_ID1,
-                                AR5K_STA_ID1_DEFAULT_ANTENNA |
-                                AR5K_STA_ID1_PCF);
-                ath5k_hw_reg_write(ah, cfp_period, AR5K_CFP_PERIOD);
-                ath5k_hw_reg_write(ah, state->bs_cfp_max_duration,
-                                AR5K_CFP_DUR);
-                ath5k_hw_reg_write(ah, (tsf + (next_cfp == 0 ? cfp_period :
-                                                next_cfp)) << 3, AR5K_TIMER2);
-        } else {
-                /* Disable PCF mode */
-                AR5K_REG_DISABLE_BITS(ah, AR5K_STA_ID1,
-                                AR5K_STA_ID1_DEFAULT_ANTENNA |
-                                AR5K_STA_ID1_PCF);
-        }
-
-        /*
-         * Enable the beacon timer register
-         */
-        ath5k_hw_reg_write(ah, state->bs_next_beacon, AR5K_TIMER0);
-
-        /*
-         * Start the beacon timers
-         */
-        ath5k_hw_reg_write(ah, (ath5k_hw_reg_read(ah, AR5K_BEACON) &
-                ~(AR5K_BEACON_PERIOD | AR5K_BEACON_TIM)) |
-                AR5K_REG_SM(state->bs_tim_offset ? state->bs_tim_offset + 4 : 0,
-                AR5K_BEACON_TIM) | AR5K_REG_SM(state->bs_interval,
-                AR5K_BEACON_PERIOD), AR5K_BEACON);
-
-        /*
-         * Write new beacon miss threshold, if it appears to be valid
-         * XXX: Figure out right values for min <= bs_bmiss_threshold <= max
-         * and return if its not in range. We can test this by reading value and
-         * setting value to a largest value and seeing which values register.
-         */
-
-        AR5K_REG_WRITE_BITS(ah, AR5K_RSSI_THR, AR5K_RSSI_THR_BMISS,
-                        state->bs_bmiss_threshold);
-
-        /*
-         * Set sleep control register
-         * XXX: Didn't find this in 5210 code but since this register
-         * exists also in ar5k's 5210 headers i leave it as common code.
-         */
-        AR5K_REG_WRITE_BITS(ah, AR5K_SLEEP_CTL, AR5K_SLEEP_CTL_SLDUR,
-                        (state->bs_sleep_duration - 3) << 3);
-
-        /*
-         * Set enhanced sleep registers on 5212
-         */
-        if (ah->ah_version == AR5K_AR5212) {
-                if (state->bs_sleep_duration > state->bs_interval &&
-                                roundup(state->bs_sleep_duration, interval) ==
-                                state->bs_sleep_duration)
-                        interval = state->bs_sleep_duration;
-
-                if (state->bs_sleep_duration > dtim && (dtim == 0 ||
-                                roundup(state->bs_sleep_duration, dtim) ==
-                                state->bs_sleep_duration))
-                        dtim = state->bs_sleep_duration;
-
-                if (interval > dtim)
-                        return -EINVAL;
-
-                next_beacon = interval == dtim ? state->bs_next_dtim :
-                        state->bs_next_beacon;
-
-                ath5k_hw_reg_write(ah,
-                        AR5K_REG_SM((state->bs_next_dtim - 3) << 3,
-                        AR5K_SLEEP0_NEXT_DTIM) |
-                        AR5K_REG_SM(10, AR5K_SLEEP0_CABTO) |
-                        AR5K_SLEEP0_ENH_SLEEP_EN |
-                        AR5K_SLEEP0_ASSUME_DTIM, AR5K_SLEEP0);
-
-                ath5k_hw_reg_write(ah, AR5K_REG_SM((next_beacon - 3) << 3,
-                        AR5K_SLEEP1_NEXT_TIM) |
-                        AR5K_REG_SM(10, AR5K_SLEEP1_BEACON_TO), AR5K_SLEEP1);
-
-                ath5k_hw_reg_write(ah,
-                        AR5K_REG_SM(interval, AR5K_SLEEP2_TIM_PER) |
-                        AR5K_REG_SM(dtim, AR5K_SLEEP2_DTIM_PER), AR5K_SLEEP2);
-        }
-
-        return 0;
-}
-
-/*
- * Reset beacon timers
- */
-void ath5k_hw_reset_beacon(struct ath5k_hw *ah)
-{
-        ATH5K_TRACE(ah->ah_sc);
-        /*
-         * Disable beacon timer
-         */
-        ath5k_hw_reg_write(ah, 0, AR5K_TIMER0);
-
-        /*
-         * Disable some beacon register values
-         */
-        AR5K_REG_DISABLE_BITS(ah, AR5K_STA_ID1,
-                        AR5K_STA_ID1_DEFAULT_ANTENNA | AR5K_STA_ID1_PCF);
-        ath5k_hw_reg_write(ah, AR5K_BEACON_PERIOD, AR5K_BEACON);
-}
-
-/*
- * Wait for beacon queue to finish
- */
-int ath5k_hw_beaconq_finish(struct ath5k_hw *ah, unsigned long phys_addr)
-{
-        unsigned int i;
-        int ret;
-
-        ATH5K_TRACE(ah->ah_sc);
-
-        /* 5210 doesn't have QCU*/
-        if (ah->ah_version == AR5K_AR5210) {
-                /*
-                 * Wait for beaconn queue to finish by checking
-                 * Control Register and Beacon Status Register.
-                 */
-                for (i = AR5K_TUNE_BEACON_INTERVAL / 2; i > 0; i--) {
-                        if (!(ath5k_hw_reg_read(ah, AR5K_BSR) & AR5K_BSR_TXQ1F)
-                                        ||
-                            !(ath5k_hw_reg_read(ah, AR5K_CR) & AR5K_BSR_TXQ1F))
-                                break;
-                        udelay(10);
-                }
-
-                /* Timeout... */
-                if (i <= 0) {
-                        /*
-                         * Re-schedule the beacon queue
-                         */
-                        ath5k_hw_reg_write(ah, phys_addr, AR5K_NOQCU_TXDP1);
-                        ath5k_hw_reg_write(ah, AR5K_BCR_TQ1V | AR5K_BCR_BDMAE,
-                                        AR5K_BCR);
-
-                        return -EIO;
-                }
-                ret = 0;
-        } else {
-        /*5211/5212*/
-                ret = ath5k_hw_register_timeout(ah,
-                        AR5K_QUEUE_STATUS(AR5K_TX_QUEUE_ID_BEACON),
-                        AR5K_QCU_STS_FRMPENDCNT, 0, false);
-
-                if (AR5K_REG_READ_Q(ah, AR5K_QCU_TXE, AR5K_TX_QUEUE_ID_BEACON))
-                        return -EIO;
-        }
-
-        return ret;
-}
-#endif
-
 
 /*********************\
 * Key table functions *
@@ -971,19 +686,6 @@ int ath5k_hw_reset_key(struct ath5k_hw *ah, u16 entry)
         return 0;
 }
 
-/*
- * Check if a table entry is valid
- */
-int ath5k_hw_is_key_valid(struct ath5k_hw *ah, u16 entry)
-{
-        ATH5K_TRACE(ah->ah_sc);
-        AR5K_ASSERT_ENTRY(entry, AR5K_KEYTABLE_SIZE);
-
-        /* Check the validation flag at the end of the entry */
-        return ath5k_hw_reg_read(ah, AR5K_KEYTABLE_MAC1(entry)) &
-                AR5K_KEYTABLE_VALID;
-}
-
 static
 int ath5k_keycache_type(const struct ieee80211_key_conf *key)
 {
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index eff3323efb4b..b6704c93f808 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -20,8 +20,6 @@
  *
  */
 
-#define _ATH5K_PHY
-
 #include <linux/delay.h>
 
 #include "ath5k.h"
@@ -1104,28 +1102,6 @@ int ath5k_hw_channel(struct ath5k_hw *ah, struct ieee80211_channel *channel)
   PHY calibration
 \*****************/
 
-void
-ath5k_hw_calibration_poll(struct ath5k_hw *ah)
-{
-        /* Calibration interval in jiffies */
-        unsigned long cal_intval;
-
-        cal_intval = msecs_to_jiffies(ah->ah_cal_intval * 1000);
-
-        /* Initialize timestamp if needed */
-        if (!ah->ah_cal_tstamp)
-                ah->ah_cal_tstamp = jiffies;
-
-        /* For now we always do full calibration
-         * Mark software interrupt mask and fire software
-         * interrupt (bit gets auto-cleared) */
-        if (time_is_before_eq_jiffies(ah->ah_cal_tstamp + cal_intval)) {
-                ah->ah_cal_tstamp = jiffies;
-                ah->ah_swi_mask = AR5K_SWI_FULL_CALIBRATION;
-                AR5K_REG_ENABLE_BITS(ah, AR5K_CR, AR5K_CR_SWI);
-        }
-}
-
 static int sign_extend(int val, const int nbits)
 {
         int order = BIT(nbits-1);
@@ -1190,7 +1166,7 @@ static s16 ath5k_hw_get_median_noise_floor(struct ath5k_hw *ah)
  * The median of the values in the history is then loaded into the
  * hardware for its own use for RSSI and CCA measurements.
  */
-void ath5k_hw_update_noise_floor(struct ath5k_hw *ah)
+static void ath5k_hw_update_noise_floor(struct ath5k_hw *ah)
 {
         struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
         u32 val;
@@ -1399,7 +1375,11 @@ static int ath5k_hw_rf511x_calibrate(struct ath5k_hw *ah,
         }
 
         i_coffd = ((i_pwr >> 1) + (q_pwr >> 1)) >> 7;
-        q_coffd = q_pwr >> 7;
+
+        if (ah->ah_version == AR5K_AR5211)
+                q_coffd = q_pwr >> 6;
+        else
+                q_coffd = q_pwr >> 7;
 
         /* protect against divide by 0 and loss of sign bits */
         if (i_coffd == 0 || q_coffd < 2)
@@ -1768,7 +1748,7 @@ u16 ath5k_hw_radio_revision(struct ath5k_hw *ah, unsigned int chan)
 * Antenna control *
 \*****************/
 
-void /*TODO:Boundary check*/
+static void /*TODO:Boundary check*/
 ath5k_hw_set_def_antenna(struct ath5k_hw *ah, u8 ant)
 {
         ATH5K_TRACE(ah->ah_sc);
@@ -1777,16 +1757,6 @@ ath5k_hw_set_def_antenna(struct ath5k_hw *ah, u8 ant)
                 ath5k_hw_reg_write(ah, ant & 0x7, AR5K_DEFAULT_ANTENNA);
 }
 
-unsigned int ath5k_hw_get_def_antenna(struct ath5k_hw *ah)
-{
-        ATH5K_TRACE(ah->ah_sc);
-
-        if (ah->ah_version != AR5K_AR5210)
-                return ath5k_hw_reg_read(ah, AR5K_DEFAULT_ANTENNA) & 0x7;
-
-        return false; /*XXX: What do we return for 5210 ?*/
-}
-
 /*
  * Enable/disable fast rx antenna diversity
  */
@@ -1930,6 +1900,7 @@ ath5k_hw_set_antenna_mode(struct ath5k_hw *ah, u8 ant_mode)
 
         ah->ah_tx_ant = tx_ant;
         ah->ah_ant_mode = ant_mode;
+        ah->ah_def_ant = def_ant;
 
         sta_id1 |= use_def_for_tx ? AR5K_STA_ID1_DEFAULT_ANTENNA : 0;
         sta_id1 |= update_def_on_tx ? AR5K_STA_ID1_DESC_ANTENNA : 0;
@@ -2440,19 +2411,6 @@ ath5k_combine_linear_pcdac_curves(struct ath5k_hw *ah, s16* table_min,
                 pcdac_tmp = pcdac_high_pwr;
 
                 edge_flag = 0x40;
-#if 0
-                /* If both min and max power limits are in lower
-                 * power curve's range, only use the low power curve.
-                 * TODO: min/max levels are related to target
-                 * power values requested from driver/user
-                 * XXX: Is this really needed ? */
-                if (min_pwr < table_max[1] &&
-                max_pwr < table_max[1]) {
-                        edge_flag = 0;
-                        pcdac_tmp = pcdac_low_pwr;
-                        max_pwr_idx = (table_max[1] - table_min[1])/2;
-                }
-#endif
         } else {
                 pcdac_low_pwr = ah->ah_txpower.tmpL[1]; /* Zeroed */
                 pcdac_high_pwr = ah->ah_txpower.tmpL[0];
@@ -3143,5 +3101,3 @@ int ath5k_hw_set_txpower_limit(struct ath5k_hw *ah, u8 txpower)
 
         return ath5k_hw_txpower(ah, channel, ee_mode, txpower);
 }
-
-#undef _ATH5K_PHY
diff --git a/drivers/net/wireless/ath/ath5k/qcu.c b/drivers/net/wireless/ath/ath5k/qcu.c
index 9122a8556f45..f5831da33f7b 100644
--- a/drivers/net/wireless/ath/ath5k/qcu.c
+++ b/drivers/net/wireless/ath/ath5k/qcu.c
@@ -517,23 +517,6 @@ int ath5k_hw_reset_tx_queue(struct ath5k_hw *ah, unsigned int queue)
 }
 
 /*
- * Get slot time from DCU
- */
-unsigned int ath5k_hw_get_slot_time(struct ath5k_hw *ah)
-{
-        unsigned int slot_time_clock;
-
-        ATH5K_TRACE(ah->ah_sc);
-
-        if (ah->ah_version == AR5K_AR5210)
-                slot_time_clock = ath5k_hw_reg_read(ah, AR5K_SLOT_TIME);
-        else
-                slot_time_clock = ath5k_hw_reg_read(ah, AR5K_DCU_GBL_IFS_SLOT);
-
-        return ath5k_hw_clocktoh(ah, slot_time_clock & 0xffff);
-}
-
-/*
  * Set slot time on DCU
  */
 int ath5k_hw_set_slot_time(struct ath5k_hw *ah, unsigned int slot_time)
diff --git a/drivers/net/wireless/ath/ath5k/reg.h b/drivers/net/wireless/ath/ath5k/reg.h
index 1464f89b249c..45d62e915e4c 100644
--- a/drivers/net/wireless/ath/ath5k/reg.h
+++ b/drivers/net/wireless/ath/ath5k/reg.h
@@ -212,10 +212,10 @@
  * MIB control register
  */
 #define AR5K_MIBC               0x0040                  /* Register Address */
-#define AR5K_MIBC_COW           0x00000001      /* Warn test indicator */
+#define AR5K_MIBC_COW           0x00000001      /* Counter Overflow Warning */
 #define AR5K_MIBC_FMC           0x00000002      /* Freeze MIB Counters  */
-#define AR5K_MIBC_CMC           0x00000004      /* Clean MIB Counters  */
-#define AR5K_MIBC_MCS           0x00000008      /* MIB counter strobe */
+#define AR5K_MIBC_CMC           0x00000004      /* Clear MIB Counters  */
+#define AR5K_MIBC_MCS           0x00000008      /* MIB counter strobe, increment all */
 
 /*
  * Timeout prescale register
@@ -1516,7 +1516,14 @@
                                 AR5K_NAV_5210 : AR5K_NAV_5211)
 
 /*
- * RTS success register
+ * MIB counters:
+ *
+ * max value is 0xc000, if this is reached we get a MIB interrupt.
+ * they can be controlled via AR5K_MIBC and are cleared on read.
+ */
+
+/*
+ * RTS success (MIB counter)
  */
 #define AR5K_RTS_OK_5210        0x8090
 #define AR5K_RTS_OK_5211        0x8088
@@ -1524,7 +1531,7 @@
                                 AR5K_RTS_OK_5210 : AR5K_RTS_OK_5211)
 
 /*
- * RTS failure register
+ * RTS failure (MIB counter)
  */
 #define AR5K_RTS_FAIL_5210      0x8094
 #define AR5K_RTS_FAIL_5211      0x808c
@@ -1532,7 +1539,7 @@
                                 AR5K_RTS_FAIL_5210 : AR5K_RTS_FAIL_5211)
 
 /*
- * ACK failure register
+ * ACK failure (MIB counter)
  */
 #define AR5K_ACK_FAIL_5210      0x8098
 #define AR5K_ACK_FAIL_5211      0x8090
@@ -1540,7 +1547,7 @@
                                 AR5K_ACK_FAIL_5210 : AR5K_ACK_FAIL_5211)
 
 /*
- * FCS failure register
+ * FCS failure (MIB counter)
  */
 #define AR5K_FCS_FAIL_5210      0x809c
 #define AR5K_FCS_FAIL_5211      0x8094
@@ -1667,11 +1674,17 @@
 
 /*
  * Profile count registers
+ *
+ * These registers can be cleared and freezed with ATH5K_MIBC, but they do not
+ * generate a MIB interrupt.
+ * Instead of overflowing, they shift by one bit to the right. All registers
+ * shift together, i.e. when one reaches the max, all shift at the same time by
+ * one bit to the right. This way we should always get consistent values.
  */
 #define AR5K_PROFCNT_TX                 0x80ec  /* Tx count */
 #define AR5K_PROFCNT_RX                 0x80f0  /* Rx count */
-#define AR5K_PROFCNT_RXCLR              0x80f4  /* Clear Rx count */
-#define AR5K_PROFCNT_CYCLE              0x80f8  /* Cycle count (?) */
+#define AR5K_PROFCNT_RXCLR              0x80f4  /* Busy count */
+#define AR5K_PROFCNT_CYCLE              0x80f8  /* Cycle counter */
 
 /*
  * Quiet period control registers
@@ -1758,7 +1771,7 @@
 #define AR5K_CCK_FIL_CNT                0x8128
 
 /*
- * PHY Error Counters (?)
+ * PHY Error Counters (same masks as AR5K_PHY_ERR_FIL)
  */
 #define AR5K_PHYERR_CNT1                0x812c
 #define AR5K_PHYERR_CNT1_MASK           0x8130
@@ -1766,6 +1779,9 @@
 #define AR5K_PHYERR_CNT2                0x8134
 #define AR5K_PHYERR_CNT2_MASK           0x8138
 
+/* if the PHY Error Counters reach this maximum, we get MIB interrupts */
+#define ATH5K_PHYERR_CNT_MAX            0x00c00000
+
 /*
  * TSF Threshold register (?)
  */
@@ -1974,7 +1990,7 @@
 #define AR5K_PHY_SETTLING               0x9844                  /* Register Address */
 #define AR5K_PHY_SETTLING_AGC           0x0000007f      /* AGC settling time */
 #define AR5K_PHY_SETTLING_AGC_S         0
-#define AR5K_PHY_SETTLING_SWITCH        0x00003f80      /* Switch settlig time */
+#define AR5K_PHY_SETTLING_SWITCH        0x00003f80      /* Switch settling time */
 #define AR5K_PHY_SETTLING_SWITCH_S      7
 
 /*
diff --git a/drivers/net/wireless/ath/ath5k/reset.c b/drivers/net/wireless/ath/ath5k/reset.c
index cbf28e379843..44bbbf2a6edd 100644
--- a/drivers/net/wireless/ath/ath5k/reset.c
+++ b/drivers/net/wireless/ath/ath5k/reset.c
@@ -19,8 +19,6 @@
  *
  */
 
-#define _ATH5K_RESET
-
 /*****************************\
   Reset functions and helpers
 \*****************************/
@@ -34,6 +32,27 @@
 #include "base.h"
 #include "debug.h"
 
+/*
+ * Check if a register write has been completed
+ */
+int ath5k_hw_register_timeout(struct ath5k_hw *ah, u32 reg, u32 flag, u32 val,
+                              bool is_set)
+{
+        int i;
+        u32 data;
+
+        for (i = AR5K_TUNE_REGISTER_TIMEOUT; i > 0; i--) {
+                data = ath5k_hw_reg_read(ah, reg);
+                if (is_set && (data & flag))
+                        break;
+                else if ((data & flag) == val)
+                        break;
+                udelay(15);
+        }
+
+        return (i <= 0) ? -EAGAIN : 0;
+}
+
 /**
  * ath5k_hw_write_ofdm_timings - set OFDM timings on AR5212
  *
@@ -221,8 +240,8 @@ static int ath5k_hw_nic_reset(struct ath5k_hw *ah, u32 val)
 /*
  * Sleep control
  */
-int ath5k_hw_set_power(struct ath5k_hw *ah, enum ath5k_power_mode mode,
-                bool set_chip, u16 sleep_duration)
+static int ath5k_hw_set_power(struct ath5k_hw *ah, enum ath5k_power_mode mode,
+                              bool set_chip, u16 sleep_duration)
 {
         unsigned int i;
         u32 staid, data;
@@ -1017,11 +1036,6 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
         if (ret)
                 return ret;
 
-        /*
-         * Initialize operating mode
-         */
-        ah->ah_op_mode = op_mode;
-
         /* PHY access enable */
         if (ah->ah_mac_srev >= AR5K_SREV_AR5211)
                 ath5k_hw_reg_write(ah, AR5K_PHY_SHIFT_5GHZ, AR5K_PHY(0));
@@ -1192,7 +1206,7 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
         ath5k_hw_set_associd(ah);
 
         /* Set PCU config */
-        ath5k_hw_set_opmode(ah);
+        ath5k_hw_set_opmode(ah, op_mode);
 
         /* Clear any pending interrupts
          * PISR/SISR Not available on 5210 */
@@ -1378,7 +1392,7 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
          * external 32KHz crystal when sleeping if one
          * exists */
         if (ah->ah_version == AR5K_AR5212 &&
-            ah->ah_op_mode != NL80211_IFTYPE_AP)
+            op_mode != NL80211_IFTYPE_AP)
                 ath5k_hw_set_sleep_clock(ah, true);
 
         /*
@@ -1388,5 +1402,3 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum nl80211_iftype op_mode,
         ath5k_hw_reset_tsf(ah);
         return 0;
 }
-
-#undef _ATH5K_RESET
diff --git a/drivers/net/wireless/ath/ath9k/Kconfig b/drivers/net/wireless/ath/ath9k/Kconfig
index 5774cea23a3b..35f23bdc442f 100644
--- a/drivers/net/wireless/ath/ath9k/Kconfig
+++ b/drivers/net/wireless/ath/ath9k/Kconfig
@@ -32,3 +32,24 @@ config ATH9K_DEBUGFS
 
           Also required for changing debug message flags at run time.
 
+config ATH9K_HTC
+       tristate "Atheros HTC based wireless cards support"
+       depends on USB && MAC80211
+       select ATH9K_HW
+       select MAC80211_LEDS
+       select LEDS_CLASS
+       select NEW_LEDS
+       select ATH9K_COMMON
+       ---help---
+         Support for Atheros HTC based cards.
+         Chipsets supported: AR9271
+
+         For more information: http://wireless.kernel.org/en/users/Drivers/ath9k_htc
+
+         The built module will be ath9k_htc.
+
+config ATH9K_HTC_DEBUGFS
+        bool "Atheros ath9k_htc debugging"
+        depends on ATH9K_HTC && DEBUG_FS
+        ---help---
+          Say Y, if you need access to ath9k_htc's statistics.
diff --git a/drivers/net/wireless/ath/ath9k/Makefile b/drivers/net/wireless/ath/ath9k/Makefile
index 6b50d5eb9ec3..97133beda269 100644
--- a/drivers/net/wireless/ath/ath9k/Makefile
+++ b/drivers/net/wireless/ath/ath9k/Makefile
@@ -28,3 +28,13 @@ obj-$(CONFIG_ATH9K_HW) += ath9k_hw.o
 
 obj-$(CONFIG_ATH9K_COMMON) += ath9k_common.o
 ath9k_common-y:=        common.o
+
+ath9k_htc-y +=  htc_hst.o \
+                hif_usb.o \
+                wmi.o \
+                htc_drv_txrx.o \
+                htc_drv_main.o \
+                htc_drv_beacon.o \
+                htc_drv_init.o
+
+obj-$(CONFIG_ATH9K_HTC) += ath9k_htc.o
diff --git a/drivers/net/wireless/ath/ath9k/ahb.c b/drivers/net/wireless/ath/ath9k/ahb.c
index ca4994f13151..85fdd26039c8 100644
--- a/drivers/net/wireless/ath/ath9k/ahb.c
+++ b/drivers/net/wireless/ath/ath9k/ahb.c
@@ -47,6 +47,7 @@ static bool ath_ahb_eeprom_read(struct ath_common *common, u32 off, u16 *data)
 }
 
 static struct ath_bus_ops ath_ahb_bus_ops  = {
+        .ath_bus_type = ATH_AHB,
         .read_cachesize = ath_ahb_read_cachesize,
         .eeprom_read = ath_ahb_eeprom_read,
 };
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 83c7ea4c007f..bdcd257ca7a4 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -178,9 +178,6 @@ void ath_descdma_cleanup(struct ath_softc *sc, struct ath_descdma *dd,
 #define BAW_WITHIN(_start, _bawsz, _seqno) \
         ((((_seqno) - (_start)) & 4095) < (_bawsz))
 
-#define ATH_DS_BA_SEQ(_ds)         ((_ds)->ds_us.tx.ts_seqnum)
-#define ATH_DS_BA_BITMAP(_ds)      (&(_ds)->ds_us.tx.ba_low)
-#define ATH_DS_TX_BA(_ds)          ((_ds)->ds_us.tx.ts_flags & ATH9K_TX_BA)
 #define ATH_AN_2_TID(_an, _tidno)  (&(_an)->tid[(_tidno)])
 
 #define ATH_TX_COMPLETE_POLL_INT        1000
@@ -483,7 +480,6 @@ struct ath_softc {
         bool ps_enabled;
         bool ps_idle;
         unsigned long ps_usecount;
-        enum ath9k_int imask;
 
         struct ath_config config;
         struct ath_rx rx;
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index b4a31a43a62c..22375a754718 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -524,6 +524,7 @@ static void ath9k_beacon_init(struct ath_softc *sc,
 static void ath_beacon_config_ap(struct ath_softc *sc,
                                  struct ath_beacon_config *conf)
 {
+        struct ath_hw *ah = sc->sc_ah;
         u32 nexttbtt, intval;
 
         /* NB: the beacon interval is kept internally in TU's */
@@ -539,15 +540,15 @@ static void ath_beacon_config_ap(struct ath_softc *sc,
          * prepare beacon frames.
          */
         intval |= ATH9K_BEACON_ENA;
-        sc->imask |= ATH9K_INT_SWBA;
+        ah->imask |= ATH9K_INT_SWBA;
         ath_beaconq_config(sc);
 
         /* Set the computed AP beacon timers */
 
-        ath9k_hw_set_interrupts(sc->sc_ah, 0);
+        ath9k_hw_set_interrupts(ah, 0);
         ath9k_beacon_init(sc, nexttbtt, intval);
         sc->beacon.bmisscnt = 0;
-        ath9k_hw_set_interrupts(sc->sc_ah, sc->imask);
+        ath9k_hw_set_interrupts(ah, ah->imask);
 
         /* Clear the reset TSF flag, so that subsequent beacon updation
            will not reset the HW TSF. */
@@ -566,7 +567,8 @@ static void ath_beacon_config_ap(struct ath_softc *sc,
 static void ath_beacon_config_sta(struct ath_softc *sc,
                                   struct ath_beacon_config *conf)
 {
-        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_beacon_state bs;
         int dtimperiod, dtimcount, sleepduration;
         int cfpperiod, cfpcount;
@@ -605,7 +607,7 @@ static void ath_beacon_config_sta(struct ath_softc *sc,
          * Pull nexttbtt forward to reflect the current
          * TSF and calculate dtim+cfp state for the result.
          */
-        tsf = ath9k_hw_gettsf64(sc->sc_ah);
+        tsf = ath9k_hw_gettsf64(ah);
         tsftu = TSF_TO_TU(tsf>>32, tsf) + FUDGE;
 
         num_beacons = tsftu / intval + 1;
@@ -678,17 +680,18 @@ static void ath_beacon_config_sta(struct ath_softc *sc,
 
         /* Set the computed STA beacon timers */
 
-        ath9k_hw_set_interrupts(sc->sc_ah, 0);
-        ath9k_hw_set_sta_beacon_timers(sc->sc_ah, &bs);
-        sc->imask |= ATH9K_INT_BMISS;
-        ath9k_hw_set_interrupts(sc->sc_ah, sc->imask);
+        ath9k_hw_set_interrupts(ah, 0);
+        ath9k_hw_set_sta_beacon_timers(ah, &bs);
+        ah->imask |= ATH9K_INT_BMISS;
+        ath9k_hw_set_interrupts(ah, ah->imask);
 }
 
 static void ath_beacon_config_adhoc(struct ath_softc *sc,
                                     struct ath_beacon_config *conf,
                                     struct ieee80211_vif *vif)
 {
-        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         u64 tsf;
         u32 tsftu, intval, nexttbtt;
 
@@ -703,7 +706,7 @@ static void ath_beacon_config_adhoc(struct ath_softc *sc,
         else if (intval)
                 nexttbtt = roundup(nexttbtt, intval);
 
-        tsf = ath9k_hw_gettsf64(sc->sc_ah);
+        tsf = ath9k_hw_gettsf64(ah);
         tsftu = TSF_TO_TU((u32)(tsf>>32), (u32)tsf) + FUDGE;
         do {
                 nexttbtt += intval;
@@ -719,20 +722,20 @@ static void ath_beacon_config_adhoc(struct ath_softc *sc,
          * self-linked tx descriptor and let the hardware deal with things.
          */
         intval |= ATH9K_BEACON_ENA;
-        if (!(sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_VEOL))
-                sc->imask |= ATH9K_INT_SWBA;
+        if (!(ah->caps.hw_caps & ATH9K_HW_CAP_VEOL))
+                ah->imask |= ATH9K_INT_SWBA;
 
         ath_beaconq_config(sc);
 
         /* Set the computed ADHOC beacon timers */
 
-        ath9k_hw_set_interrupts(sc->sc_ah, 0);
+        ath9k_hw_set_interrupts(ah, 0);
         ath9k_beacon_init(sc, nexttbtt, intval);
         sc->beacon.bmisscnt = 0;
-        ath9k_hw_set_interrupts(sc->sc_ah, sc->imask);
+        ath9k_hw_set_interrupts(ah, ah->imask);
 
         /* FIXME: Handle properly when vif is NULL */
-        if (vif && sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_VEOL)
+        if (vif && ah->caps.hw_caps & ATH9K_HW_CAP_VEOL)
                 ath_beacon_start_adhoc(sc, vif);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/calib.c b/drivers/net/wireless/ath/ath9k/calib.c
index 238a5744d8e9..064f5b51dfcd 100644
--- a/drivers/net/wireless/ath/ath9k/calib.c
+++ b/drivers/net/wireless/ath/ath9k/calib.c
@@ -18,6 +18,7 @@
 
 /* We can tune this as we go by monitoring really low values */
 #define ATH9K_NF_TOO_LOW        -60
+#define AR9285_CLCAL_REDO_THRESH    1
 
 /* AR5416 may return very high value (like -31 dBm), in those cases the nf
  * is incorrect and we should use the static NF value. Later we can try to
@@ -101,9 +102,13 @@ static void ath9k_hw_do_getnf(struct ath_hw *ah,
                 nf = 0 - ((nf ^ 0x1ff) + 1);
         ath_print(common, ATH_DBG_CALIBRATE,
                   "NF calibrated [ctl] [chain 0] is %d\n", nf);
+
+        if (AR_SREV_9271(ah) && (nf >= -114))
+                nf = -116;
+
         nfarray[0] = nf;
 
-        if (!AR_SREV_9285(ah)) {
+        if (!AR_SREV_9285(ah) && !AR_SREV_9271(ah)) {
                 if (AR_SREV_9280_10_OR_LATER(ah))
                         nf = MS(REG_READ(ah, AR_PHY_CH1_CCA),
                                         AR9280_PHY_CH1_MINCCA_PWR);
@@ -139,9 +144,13 @@ static void ath9k_hw_do_getnf(struct ath_hw *ah,
                 nf = 0 - ((nf ^ 0x1ff) + 1);
         ath_print(common, ATH_DBG_CALIBRATE,
                   "NF calibrated [ext] [chain 0] is %d\n", nf);
+
+        if (AR_SREV_9271(ah) && (nf >= -114))
+                nf = -116;
+
         nfarray[3] = nf;
 
-        if (!AR_SREV_9285(ah)) {
+        if (!AR_SREV_9285(ah) && !AR_SREV_9271(ah)) {
                 if (AR_SREV_9280_10_OR_LATER(ah))
                         nf = MS(REG_READ(ah, AR_PHY_CH1_EXT_CCA),
                                         AR9280_PHY_CH1_EXT_MINCCA_PWR);
@@ -621,7 +630,7 @@ void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
         u8 chainmask, rx_chain_status;
 
         rx_chain_status = REG_READ(ah, AR_PHY_RX_CHAINMASK);
-        if (AR_SREV_9285(ah))
+        if (AR_SREV_9285(ah) || AR_SREV_9271(ah))
                 chainmask = 0x9;
         else if (AR_SREV_9280(ah) || AR_SREV_9287(ah)) {
                 if ((rx_chain_status & 0x2) || (rx_chain_status & 0x4))
@@ -715,7 +724,7 @@ void ath9k_init_nfcal_hist_buffer(struct ath_hw *ah)
 
         if (AR_SREV_9280(ah))
                 noise_floor = AR_PHY_CCA_MAX_AR9280_GOOD_VALUE;
-        else if (AR_SREV_9285(ah))
+        else if (AR_SREV_9285(ah) || AR_SREV_9271(ah))
                 noise_floor = AR_PHY_CCA_MAX_AR9285_GOOD_VALUE;
         else if (AR_SREV_9287(ah))
                 noise_floor = AR_PHY_CCA_MAX_AR9287_GOOD_VALUE;
@@ -1051,9 +1060,12 @@ bool ath9k_hw_calibrate(struct ath_hw *ah, struct ath9k_channel *chan,
         /* Do NF cal only at longer intervals */
         if (longcal) {
                 /* Do periodic PAOffset Cal */
-                if (AR_SREV_9271(ah))
-                        ath9k_hw_9271_pa_cal(ah, false);
-                else if (AR_SREV_9285_11_OR_LATER(ah)) {
+                if (AR_SREV_9271(ah)) {
+                        if (!ah->pacal_info.skipcount)
+                                ath9k_hw_9271_pa_cal(ah, false);
+                        else
+                                ah->pacal_info.skipcount--;
+                } else if (AR_SREV_9285_11_OR_LATER(ah)) {
                         if (!ah->pacal_info.skipcount)
                                 ath9k_hw_9285_pa_cal(ah, false);
                         else
@@ -1080,7 +1092,7 @@ bool ath9k_hw_calibrate(struct ath_hw *ah, struct ath9k_channel *chan,
 EXPORT_SYMBOL(ath9k_hw_calibrate);
 
 /* Carrier leakage Calibration fix */
-static bool ar9285_clc(struct ath_hw *ah, struct ath9k_channel *chan)
+static bool ar9285_cl_cal(struct ath_hw *ah, struct ath9k_channel *chan)
 {
         struct ath_common *common = ath9k_hw_common(ah);
 
@@ -1121,6 +1133,62 @@ static bool ar9285_clc(struct ath_hw *ah, struct ath9k_channel *chan)
         return true;
 }
 
+static bool ar9285_clc(struct ath_hw *ah, struct ath9k_channel *chan)
+{
+        int i;
+        u_int32_t txgain_max;
+        u_int32_t clc_gain, gain_mask = 0, clc_num = 0;
+        u_int32_t reg_clc_I0, reg_clc_Q0;
+        u_int32_t i0_num = 0;
+        u_int32_t q0_num = 0;
+        u_int32_t total_num = 0;
+        u_int32_t reg_rf2g5_org;
+        bool retv = true;
+
+        if (!(ar9285_cl_cal(ah, chan)))
+                return false;
+
+        txgain_max = MS(REG_READ(ah, AR_PHY_TX_PWRCTRL7),
+                        AR_PHY_TX_PWRCTRL_TX_GAIN_TAB_MAX);
+
+        for (i = 0; i < (txgain_max+1); i++) {
+                clc_gain = (REG_READ(ah, (AR_PHY_TX_GAIN_TBL1+(i<<2))) &
+                           AR_PHY_TX_GAIN_CLC) >> AR_PHY_TX_GAIN_CLC_S;
+                if (!(gain_mask & (1 << clc_gain))) {
+                        gain_mask |= (1 << clc_gain);
+                        clc_num++;
+                }
+        }
+
+        for (i = 0; i < clc_num; i++) {
+                reg_clc_I0 = (REG_READ(ah, (AR_PHY_CLC_TBL1 + (i << 2)))
+                              & AR_PHY_CLC_I0) >> AR_PHY_CLC_I0_S;
+                reg_clc_Q0 = (REG_READ(ah, (AR_PHY_CLC_TBL1 + (i << 2)))
+                              & AR_PHY_CLC_Q0) >> AR_PHY_CLC_Q0_S;
+                if (reg_clc_I0 == 0)
+                        i0_num++;
+
+                if (reg_clc_Q0 == 0)
+                        q0_num++;
+        }
+        total_num = i0_num + q0_num;
+        if (total_num > AR9285_CLCAL_REDO_THRESH) {
+                reg_rf2g5_org = REG_READ(ah, AR9285_RF2G5);
+                if (AR_SREV_9285E_20(ah)) {
+                        REG_WRITE(ah, AR9285_RF2G5,
+                                  (reg_rf2g5_org & AR9285_RF2G5_IC50TX) |
+                                  AR9285_RF2G5_IC50TX_XE_SET);
+                } else {
+                        REG_WRITE(ah, AR9285_RF2G5,
+                                  (reg_rf2g5_org & AR9285_RF2G5_IC50TX) |
+                                  AR9285_RF2G5_IC50TX_SET);
+                }
+                retv = ar9285_cl_cal(ah, chan);
+                REG_WRITE(ah, AR9285_RF2G5, reg_rf2g5_org);
+        }
+        return retv;
+}
+
 bool ath9k_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
 {
         struct ath_common *common = ath9k_hw_common(ah);
diff --git a/drivers/net/wireless/ath/ath9k/common.c b/drivers/net/wireless/ath/ath9k/common.c
index 4d775ae141db..09effdedc8c0 100644
--- a/drivers/net/wireless/ath/ath9k/common.c
+++ b/drivers/net/wireless/ath/ath9k/common.c
@@ -255,7 +255,8 @@ void ath9k_cmn_rx_skb_postprocess(struct ath_common *common,
 
         keyix = rx_stats->rs_keyix;
 
-        if (!(keyix == ATH9K_RXKEYIX_INVALID) && !decrypt_error) {
+        if (!(keyix == ATH9K_RXKEYIX_INVALID) && !decrypt_error &&
+            ieee80211_has_protected(fc)) {
                 rxs->flag |= RX_FLAG_DECRYPTED;
         } else if (ieee80211_has_protected(fc)
                    && !decrypt_error && skb->len >= hdrlen + 4) {
@@ -286,6 +287,345 @@ int ath9k_cmn_padpos(__le16 frame_control)
 }
 EXPORT_SYMBOL(ath9k_cmn_padpos);
 
+int ath9k_cmn_get_hw_crypto_keytype(struct sk_buff *skb)
+{
+        struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
+
+        if (tx_info->control.hw_key) {
+                if (tx_info->control.hw_key->alg == ALG_WEP)
+                        return ATH9K_KEY_TYPE_WEP;
+                else if (tx_info->control.hw_key->alg == ALG_TKIP)
+                        return ATH9K_KEY_TYPE_TKIP;
+                else if (tx_info->control.hw_key->alg == ALG_CCMP)
+                        return ATH9K_KEY_TYPE_AES;
+        }
+
+        return ATH9K_KEY_TYPE_CLEAR;
+}
+EXPORT_SYMBOL(ath9k_cmn_get_hw_crypto_keytype);
+
+static u32 ath9k_get_extchanmode(struct ieee80211_channel *chan,
+                                 enum nl80211_channel_type channel_type)
+{
+        u32 chanmode = 0;
+
+        switch (chan->band) {
+        case IEEE80211_BAND_2GHZ:
+                switch (channel_type) {
+                case NL80211_CHAN_NO_HT:
+                case NL80211_CHAN_HT20:
+                        chanmode = CHANNEL_G_HT20;
+                        break;
+                case NL80211_CHAN_HT40PLUS:
+                        chanmode = CHANNEL_G_HT40PLUS;
+                        break;
+                case NL80211_CHAN_HT40MINUS:
+                        chanmode = CHANNEL_G_HT40MINUS;
+                        break;
+                }
+                break;
+        case IEEE80211_BAND_5GHZ:
+                switch (channel_type) {
+                case NL80211_CHAN_NO_HT:
+                case NL80211_CHAN_HT20:
+                        chanmode = CHANNEL_A_HT20;
+                        break;
+                case NL80211_CHAN_HT40PLUS:
+                        chanmode = CHANNEL_A_HT40PLUS;
+                        break;
+                case NL80211_CHAN_HT40MINUS:
+                        chanmode = CHANNEL_A_HT40MINUS;
+                        break;
+                }
+                break;
+        default:
+                break;
+        }
+
+        return chanmode;
+}
+
+/*
+ * Update internal channel flags.
+ */
+void ath9k_cmn_update_ichannel(struct ieee80211_hw *hw,
+                               struct ath9k_channel *ichan)
+{
+        struct ieee80211_channel *chan = hw->conf.channel;
+        struct ieee80211_conf *conf = &hw->conf;
+
+        ichan->channel = chan->center_freq;
+        ichan->chan = chan;
+
+        if (chan->band == IEEE80211_BAND_2GHZ) {
+                ichan->chanmode = CHANNEL_G;
+                ichan->channelFlags = CHANNEL_2GHZ | CHANNEL_OFDM | CHANNEL_G;
+        } else {
+                ichan->chanmode = CHANNEL_A;
+                ichan->channelFlags = CHANNEL_5GHZ | CHANNEL_OFDM;
+        }
+
+        if (conf_is_ht(conf))
+                ichan->chanmode = ath9k_get_extchanmode(chan,
+                                                        conf->channel_type);
+}
+EXPORT_SYMBOL(ath9k_cmn_update_ichannel);
+
+/*
+ * Get the internal channel reference.
+ */
+struct ath9k_channel *ath9k_cmn_get_curchannel(struct ieee80211_hw *hw,
+                                               struct ath_hw *ah)
+{
+        struct ieee80211_channel *curchan = hw->conf.channel;
+        struct ath9k_channel *channel;
+        u8 chan_idx;
+
+        chan_idx = curchan->hw_value;
+        channel = &ah->channels[chan_idx];
+        ath9k_cmn_update_ichannel(hw, channel);
+
+        return channel;
+}
+EXPORT_SYMBOL(ath9k_cmn_get_curchannel);
+
+static int ath_setkey_tkip(struct ath_common *common, u16 keyix, const u8 *key,
+                           struct ath9k_keyval *hk, const u8 *addr,
+                           bool authenticator)
+{
+        struct ath_hw *ah = common->ah;
+        const u8 *key_rxmic;
+        const u8 *key_txmic;
+
+        key_txmic = key + NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY;
+        key_rxmic = key + NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY;
+
+        if (addr == NULL) {
+                /*
+                 * Group key installation - only two key cache entries are used
+                 * regardless of splitmic capability since group key is only
+                 * used either for TX or RX.
+                 */
+                if (authenticator) {
+                        memcpy(hk->kv_mic, key_txmic, sizeof(hk->kv_mic));
+                        memcpy(hk->kv_txmic, key_txmic, sizeof(hk->kv_mic));
+                } else {
+                        memcpy(hk->kv_mic, key_rxmic, sizeof(hk->kv_mic));
+                        memcpy(hk->kv_txmic, key_rxmic, sizeof(hk->kv_mic));
+                }
+                return ath9k_hw_set_keycache_entry(ah, keyix, hk, addr);
+        }
+        if (!common->splitmic) {
+                /* TX and RX keys share the same key cache entry. */
+                memcpy(hk->kv_mic, key_rxmic, sizeof(hk->kv_mic));
+                memcpy(hk->kv_txmic, key_txmic, sizeof(hk->kv_txmic));
+                return ath9k_hw_set_keycache_entry(ah, keyix, hk, addr);
+        }
+
+        /* Separate key cache entries for TX and RX */
+
+        /* TX key goes at first index, RX key at +32. */
+        memcpy(hk->kv_mic, key_txmic, sizeof(hk->kv_mic));
+        if (!ath9k_hw_set_keycache_entry(ah, keyix, hk, NULL)) {
+                /* TX MIC entry failed. No need to proceed further */
+                ath_print(common, ATH_DBG_FATAL,
+                          "Setting TX MIC Key Failed\n");
+                return 0;
+        }
+
+        memcpy(hk->kv_mic, key_rxmic, sizeof(hk->kv_mic));
+        /* XXX delete tx key on failure? */
+        return ath9k_hw_set_keycache_entry(ah, keyix + 32, hk, addr);
+}
+
+static int ath_reserve_key_cache_slot_tkip(struct ath_common *common)
+{
+        int i;
+
+        for (i = IEEE80211_WEP_NKID; i < common->keymax / 2; i++) {
+                if (test_bit(i, common->keymap) ||
+                    test_bit(i + 64, common->keymap))
+                        continue; /* At least one part of TKIP key allocated */
+                if (common->splitmic &&
+                    (test_bit(i + 32, common->keymap) ||
+                     test_bit(i + 64 + 32, common->keymap)))
+                        continue; /* At least one part of TKIP key allocated */
+
+                /* Found a free slot for a TKIP key */
+                return i;
+        }
+        return -1;
+}
+
+static int ath_reserve_key_cache_slot(struct ath_common *common)
+{
+        int i;
+
+        /* First, try to find slots that would not be available for TKIP. */
+        if (common->splitmic) {
+                for (i = IEEE80211_WEP_NKID; i < common->keymax / 4; i++) {
+                        if (!test_bit(i, common->keymap) &&
+                            (test_bit(i + 32, common->keymap) ||
+                             test_bit(i + 64, common->keymap) ||
+                             test_bit(i + 64 + 32, common->keymap)))
+                                return i;
+                        if (!test_bit(i + 32, common->keymap) &&
+                            (test_bit(i, common->keymap) ||
+                             test_bit(i + 64, common->keymap) ||
+                             test_bit(i + 64 + 32, common->keymap)))
+                                return i + 32;
+                        if (!test_bit(i + 64, common->keymap) &&
+                            (test_bit(i , common->keymap) ||
+                             test_bit(i + 32, common->keymap) ||
+                             test_bit(i + 64 + 32, common->keymap)))
+                                return i + 64;
+                        if (!test_bit(i + 64 + 32, common->keymap) &&
+                            (test_bit(i, common->keymap) ||
+                             test_bit(i + 32, common->keymap) ||
+                             test_bit(i + 64, common->keymap)))
+                                return i + 64 + 32;
+                }
+        } else {
+                for (i = IEEE80211_WEP_NKID; i < common->keymax / 2; i++) {
+                        if (!test_bit(i, common->keymap) &&
+                            test_bit(i + 64, common->keymap))
+                                return i;
+                        if (test_bit(i, common->keymap) &&
+                            !test_bit(i + 64, common->keymap))
+                                return i + 64;
+                }
+        }
+
+        /* No partially used TKIP slots, pick any available slot */
+        for (i = IEEE80211_WEP_NKID; i < common->keymax; i++) {
+                /* Do not allow slots that could be needed for TKIP group keys
+                 * to be used. This limitation could be removed if we know that
+                 * TKIP will not be used. */
+                if (i >= 64 && i < 64 + IEEE80211_WEP_NKID)
+                        continue;
+                if (common->splitmic) {
+                        if (i >= 32 && i < 32 + IEEE80211_WEP_NKID)
+                                continue;
+                        if (i >= 64 + 32 && i < 64 + 32 + IEEE80211_WEP_NKID)
+                                continue;
+                }
+
+                if (!test_bit(i, common->keymap))
+                        return i; /* Found a free slot for a key */
+        }
+
+        /* No free slot found */
+        return -1;
+}
+
+/*
+ * Configure encryption in the HW.
+ */
+int ath9k_cmn_key_config(struct ath_common *common,
+                         struct ieee80211_vif *vif,
+                         struct ieee80211_sta *sta,
+                         struct ieee80211_key_conf *key)
+{
+        struct ath_hw *ah = common->ah;
+        struct ath9k_keyval hk;
+        const u8 *mac = NULL;
+        int ret = 0;
+        int idx;
+
+        memset(&hk, 0, sizeof(hk));
+
+        switch (key->alg) {
+        case ALG_WEP:
+                hk.kv_type = ATH9K_CIPHER_WEP;
+                break;
+        case ALG_TKIP:
+                hk.kv_type = ATH9K_CIPHER_TKIP;
+                break;
+        case ALG_CCMP:
+                hk.kv_type = ATH9K_CIPHER_AES_CCM;
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        hk.kv_len = key->keylen;
+        memcpy(hk.kv_val, key->key, key->keylen);
+
+        if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
+                /* For now, use the default keys for broadcast keys. This may
+                 * need to change with virtual interfaces. */
+                idx = key->keyidx;
+        } else if (key->keyidx) {
+                if (WARN_ON(!sta))
+                        return -EOPNOTSUPP;
+                mac = sta->addr;
+
+                if (vif->type != NL80211_IFTYPE_AP) {
+                        /* Only keyidx 0 should be used with unicast key, but
+                         * allow this for client mode for now. */
+                        idx = key->keyidx;
+                } else
+                        return -EIO;
+        } else {
+                if (WARN_ON(!sta))
+                        return -EOPNOTSUPP;
+                mac = sta->addr;
+
+                if (key->alg == ALG_TKIP)
+                        idx = ath_reserve_key_cache_slot_tkip(common);
+                else
+                        idx = ath_reserve_key_cache_slot(common);
+                if (idx < 0)
+                        return -ENOSPC; /* no free key cache entries */
+        }
+
+        if (key->alg == ALG_TKIP)
+                ret = ath_setkey_tkip(common, idx, key->key, &hk, mac,
+                                      vif->type == NL80211_IFTYPE_AP);
+        else
+                ret = ath9k_hw_set_keycache_entry(ah, idx, &hk, mac);
+
+        if (!ret)
+                return -EIO;
+
+        set_bit(idx, common->keymap);
+        if (key->alg == ALG_TKIP) {
+                set_bit(idx + 64, common->keymap);
+                if (common->splitmic) {
+                        set_bit(idx + 32, common->keymap);
+                        set_bit(idx + 64 + 32, common->keymap);
+                }
+        }
+
+        return idx;
+}
+EXPORT_SYMBOL(ath9k_cmn_key_config);
+
+/*
+ * Delete Key.
+ */
+void ath9k_cmn_key_delete(struct ath_common *common,
+                          struct ieee80211_key_conf *key)
+{
+        struct ath_hw *ah = common->ah;
+
+        ath9k_hw_keyreset(ah, key->hw_key_idx);
+        if (key->hw_key_idx < IEEE80211_WEP_NKID)
+                return;
+
+        clear_bit(key->hw_key_idx, common->keymap);
+        if (key->alg != ALG_TKIP)
+                return;
+
+        clear_bit(key->hw_key_idx + 64, common->keymap);
+        if (common->splitmic) {
+                ath9k_hw_keyreset(ah, key->hw_key_idx + 32);
+                clear_bit(key->hw_key_idx + 32, common->keymap);
+                clear_bit(key->hw_key_idx + 64 + 32, common->keymap);
+        }
+}
+EXPORT_SYMBOL(ath9k_cmn_key_delete);
+
 static int __init ath9k_cmn_init(void)
 {
         return 0;
diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
index 042999c2fe9c..72a835d9e97f 100644
--- a/drivers/net/wireless/ath/ath9k/common.h
+++ b/drivers/net/wireless/ath/ath9k/common.h
@@ -23,6 +23,8 @@
 
 /* Common header for Atheros 802.11n base driver cores */
 
+#define IEEE80211_WEP_NKID 4
+
 #define WME_NUM_TID             16
 #define WME_BA_BMP_SIZE         64
 #define WME_MAX_BA              WME_BA_BMP_SIZE
@@ -125,3 +127,14 @@ void ath9k_cmn_rx_skb_postprocess(struct ath_common *common,
                                   bool decrypt_error);
 
 int ath9k_cmn_padpos(__le16 frame_control);
+int ath9k_cmn_get_hw_crypto_keytype(struct sk_buff *skb);
+void ath9k_cmn_update_ichannel(struct ieee80211_hw *hw,
+                               struct ath9k_channel *ichan);
+struct ath9k_channel *ath9k_cmn_get_curchannel(struct ieee80211_hw *hw,
+                                               struct ath_hw *ah);
+int ath9k_cmn_key_config(struct ath_common *common,
+                         struct ieee80211_vif *vif,
+                         struct ieee80211_sta *sta,
+                         struct ieee80211_key_conf *key);
+void ath9k_cmn_key_delete(struct ath_common *common,
+                          struct ieee80211_key_conf *key);
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 42d2a506845a..c7e895925393 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -556,10 +556,8 @@ static ssize_t read_file_xmit(struct file *file, char __user *user_buf,
 }
 
 void ath_debug_stat_tx(struct ath_softc *sc, struct ath_txq *txq,
-                       struct ath_buf *bf)
+                       struct ath_buf *bf, struct ath_tx_status *ts)
 {
-        struct ath_desc *ds = bf->bf_desc;
-
         if (bf_isampdu(bf)) {
                 if (bf_isxretried(bf))
                         TX_STAT_INC(txq->axq_qnum, a_xretries);
@@ -569,17 +567,17 @@ void ath_debug_stat_tx(struct ath_softc *sc, struct ath_txq *txq,
                 TX_STAT_INC(txq->axq_qnum, completed);
         }
 
-        if (ds->ds_txstat.ts_status & ATH9K_TXERR_FIFO)
+        if (ts->ts_status & ATH9K_TXERR_FIFO)
                 TX_STAT_INC(txq->axq_qnum, fifo_underrun);
-        if (ds->ds_txstat.ts_status & ATH9K_TXERR_XTXOP)
+        if (ts->ts_status & ATH9K_TXERR_XTXOP)
                 TX_STAT_INC(txq->axq_qnum, xtxop);
-        if (ds->ds_txstat.ts_status & ATH9K_TXERR_TIMER_EXPIRED)
+        if (ts->ts_status & ATH9K_TXERR_TIMER_EXPIRED)
                 TX_STAT_INC(txq->axq_qnum, timer_exp);
-        if (ds->ds_txstat.ts_flags & ATH9K_TX_DESC_CFG_ERR)
+        if (ts->ts_flags & ATH9K_TX_DESC_CFG_ERR)
                 TX_STAT_INC(txq->axq_qnum, desc_cfg_err);
-        if (ds->ds_txstat.ts_flags & ATH9K_TX_DATA_UNDERRUN)
+        if (ts->ts_flags & ATH9K_TX_DATA_UNDERRUN)
                 TX_STAT_INC(txq->axq_qnum, data_underrun);
-        if (ds->ds_txstat.ts_flags & ATH9K_TX_DELIM_UNDERRUN)
+        if (ts->ts_flags & ATH9K_TX_DELIM_UNDERRUN)
                 TX_STAT_INC(txq->axq_qnum, delim_underrun);
 }
 
@@ -662,30 +660,29 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
 #undef PHY_ERR
 }
 
-void ath_debug_stat_rx(struct ath_softc *sc, struct ath_buf *bf)
+void ath_debug_stat_rx(struct ath_softc *sc, struct ath_rx_status *rs)
 {
 #define RX_STAT_INC(c) sc->debug.stats.rxstats.c++
 #define RX_PHY_ERR_INC(c) sc->debug.stats.rxstats.phy_err_stats[c]++
 
-        struct ath_desc *ds = bf->bf_desc;
         u32 phyerr;
 
-        if (ds->ds_rxstat.rs_status & ATH9K_RXERR_CRC)
+        if (rs->rs_status & ATH9K_RXERR_CRC)
                 RX_STAT_INC(crc_err);
-        if (ds->ds_rxstat.rs_status & ATH9K_RXERR_DECRYPT)
+        if (rs->rs_status & ATH9K_RXERR_DECRYPT)
                 RX_STAT_INC(decrypt_crc_err);
-        if (ds->ds_rxstat.rs_status & ATH9K_RXERR_MIC)
+        if (rs->rs_status & ATH9K_RXERR_MIC)
                 RX_STAT_INC(mic_err);
-        if (ds->ds_rxstat.rs_status & ATH9K_RX_DELIM_CRC_PRE)
+        if (rs->rs_status & ATH9K_RX_DELIM_CRC_PRE)
                 RX_STAT_INC(pre_delim_crc_err);
-        if (ds->ds_rxstat.rs_status & ATH9K_RX_DELIM_CRC_POST)
+        if (rs->rs_status & ATH9K_RX_DELIM_CRC_POST)
                 RX_STAT_INC(post_delim_crc_err);
-        if (ds->ds_rxstat.rs_status & ATH9K_RX_DECRYPT_BUSY)
+        if (rs->rs_status & ATH9K_RX_DECRYPT_BUSY)
                 RX_STAT_INC(decrypt_busy_err);
 
-        if (ds->ds_rxstat.rs_status & ATH9K_RXERR_PHY) {
+        if (rs->rs_status & ATH9K_RXERR_PHY) {
                 RX_STAT_INC(phy_err);
-                phyerr = ds->ds_rxstat.rs_phyerr & 0x24;
+                phyerr = rs->rs_phyerr & 0x24;
                 RX_PHY_ERR_INC(phyerr);
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index 86780e68b31e..b2af9de755e6 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -167,8 +167,8 @@ void ath9k_debug_remove_root(void);
 void ath_debug_stat_interrupt(struct ath_softc *sc, enum ath9k_int status);
 void ath_debug_stat_rc(struct ath_softc *sc, int final_rate);
 void ath_debug_stat_tx(struct ath_softc *sc, struct ath_txq *txq,
-                       struct ath_buf *bf);
-void ath_debug_stat_rx(struct ath_softc *sc, struct ath_buf *bf);
+                       struct ath_buf *bf, struct ath_tx_status *ts);
+void ath_debug_stat_rx(struct ath_softc *sc, struct ath_rx_status *rs);
 void ath_debug_stat_retries(struct ath_softc *sc, int rix,
                             int xretries, int retries, u8 per);
 
@@ -204,12 +204,13 @@ static inline void ath_debug_stat_rc(struct ath_softc *sc,
 
 static inline void ath_debug_stat_tx(struct ath_softc *sc,
                                      struct ath_txq *txq,
-                                     struct ath_buf *bf)
+                                     struct ath_buf *bf,
+                                     struct ath_tx_status *ts)
 {
 }
 
 static inline void ath_debug_stat_rx(struct ath_softc *sc,
-                                     struct ath_buf *bf)
+                                     struct ath_rx_status *rs)
 {
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/gpio.c b/drivers/net/wireless/ath/ath9k/gpio.c
index deab8beb0680..1e4578d303dd 100644
--- a/drivers/net/wireless/ath/ath9k/gpio.c
+++ b/drivers/net/wireless/ath/ath9k/gpio.c
@@ -283,22 +283,17 @@ static void ath9k_gen_timer_start(struct ath_hw *ah,
                                   u32 timer_next,
                                   u32 timer_period)
 {
-        struct ath_common *common = ath9k_hw_common(ah);
-        struct ath_softc *sc = (struct ath_softc *) common->priv;
-
         ath9k_hw_gen_timer_start(ah, timer, timer_next, timer_period);
 
-        if ((sc->imask & ATH9K_INT_GENTIMER) == 0) {
+        if ((ah->imask & ATH9K_INT_GENTIMER) == 0) {
                 ath9k_hw_set_interrupts(ah, 0);
-                sc->imask |= ATH9K_INT_GENTIMER;
-                ath9k_hw_set_interrupts(ah, sc->imask);
+                ah->imask |= ATH9K_INT_GENTIMER;
+                ath9k_hw_set_interrupts(ah, ah->imask);
         }
 }
 
 static void ath9k_gen_timer_stop(struct ath_hw *ah, struct ath_gen_timer *timer)
 {
-        struct ath_common *common = ath9k_hw_common(ah);
-        struct ath_softc *sc = (struct ath_softc *) common->priv;
         struct ath_gen_timer_table *timer_table = &ah->hw_gen_timers;
 
         ath9k_hw_gen_timer_stop(ah, timer);
@@ -306,8 +301,8 @@ static void ath9k_gen_timer_stop(struct ath_hw *ah, struct ath_gen_timer *timer)
         /* if no timer is enabled, turn off interrupt mask */
         if (timer_table->timer_mask.val == 0) {
                 ath9k_hw_set_interrupts(ah, 0);
-                sc->imask &= ~ATH9K_INT_GENTIMER;
-                ath9k_hw_set_interrupts(ah, sc->imask);
+                ah->imask &= ~ATH9K_INT_GENTIMER;
+                ath9k_hw_set_interrupts(ah, ah->imask);
         }
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
new file mode 100644
index 000000000000..3afc747ccfbf
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -0,0 +1,965 @@
+/*
+ * Copyright (c) 2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "htc.h"
+
+#define ATH9K_FW_USB_DEV(devid, fw)                                     \
+        { USB_DEVICE(0x0cf3, devid), .driver_info = (unsigned long) fw }
+
+static struct usb_device_id ath9k_hif_usb_ids[] = {
+        ATH9K_FW_USB_DEV(0x9271, "ar9271.fw"),
+        ATH9K_FW_USB_DEV(0x1006, "ar9271.fw"),
+        { },
+};
+
+MODULE_DEVICE_TABLE(usb, ath9k_hif_usb_ids);
+
+static int __hif_usb_tx(struct hif_device_usb *hif_dev);
+
+static void hif_usb_regout_cb(struct urb *urb)
+{
+        struct cmd_buf *cmd = (struct cmd_buf *)urb->context;
+        struct hif_device_usb *hif_dev = cmd->hif_dev;
+
+        if (!hif_dev) {
+                usb_free_urb(urb);
+                if (cmd) {
+                        if (cmd->skb)
+                                dev_kfree_skb_any(cmd->skb);
+                        kfree(cmd);
+                }
+                return;
+        }
+
+        switch (urb->status) {
+        case 0:
+                break;
+        case -ENOENT:
+        case -ECONNRESET:
+                break;
+        case -ENODEV:
+        case -ESHUTDOWN:
+                return;
+        default:
+                break;
+        }
+
+        if (cmd) {
+                ath9k_htc_txcompletion_cb(cmd->hif_dev->htc_handle,
+                                          cmd->skb, 1);
+                kfree(cmd);
+                usb_free_urb(urb);
+        }
+}
+
+static int hif_usb_send_regout(struct hif_device_usb *hif_dev,
+                               struct sk_buff *skb)
+{
+        struct urb *urb;
+        struct cmd_buf *cmd;
+        int ret = 0;
+
+        urb = usb_alloc_urb(0, GFP_KERNEL);
+        if (urb == NULL)
+                return -ENOMEM;
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (cmd == NULL) {
+                usb_free_urb(urb);
+                return -ENOMEM;
+        }
+
+        cmd->skb = skb;
+        cmd->hif_dev = hif_dev;
+
+        usb_fill_int_urb(urb, hif_dev->udev,
+                         usb_sndintpipe(hif_dev->udev, USB_REG_OUT_PIPE),
+                         skb->data, skb->len,
+                         hif_usb_regout_cb, cmd, 1);
+
+        ret = usb_submit_urb(urb, GFP_KERNEL);
+        if (ret) {
+                usb_free_urb(urb);
+                kfree(cmd);
+        }
+
+        return ret;
+}
+
+static void hif_usb_tx_cb(struct urb *urb)
+{
+        struct tx_buf *tx_buf = (struct tx_buf *) urb->context;
+        struct hif_device_usb *hif_dev = tx_buf->hif_dev;
+        struct sk_buff *skb;
+        bool drop, flush;
+
+        if (!hif_dev)
+                return;
+
+        switch (urb->status) {
+        case 0:
+                break;
+        case -ENOENT:
+        case -ECONNRESET:
+                break;
+        case -ENODEV:
+        case -ESHUTDOWN:
+                return;
+        default:
+                break;
+        }
+
+        if (tx_buf) {
+                spin_lock(&hif_dev->tx.tx_lock);
+                drop = !!(hif_dev->tx.flags & HIF_USB_TX_STOP);
+                flush = !!(hif_dev->tx.flags & HIF_USB_TX_FLUSH);
+                spin_unlock(&hif_dev->tx.tx_lock);
+
+                while ((skb = __skb_dequeue(&tx_buf->skb_queue)) != NULL) {
+                        if (!drop && !flush) {
+                                ath9k_htc_txcompletion_cb(hif_dev->htc_handle,
+                                                          skb, 1);
+                                TX_STAT_INC(skb_completed);
+                        } else {
+                                dev_kfree_skb_any(skb);
+                        }
+                }
+
+                if (flush)
+                        return;
+
+                tx_buf->len = tx_buf->offset = 0;
+                __skb_queue_head_init(&tx_buf->skb_queue);
+
+                spin_lock(&hif_dev->tx.tx_lock);
+                list_del(&tx_buf->list);
+                list_add_tail(&tx_buf->list, &hif_dev->tx.tx_buf);
+                hif_dev->tx.tx_buf_cnt++;
+                if (!drop)
+                        __hif_usb_tx(hif_dev); /* Check for pending SKBs */
+                TX_STAT_INC(buf_completed);
+                spin_unlock(&hif_dev->tx.tx_lock);
+        }
+}
+
+/* TX lock has to be taken */
+static int __hif_usb_tx(struct hif_device_usb *hif_dev)
+{
+        struct tx_buf *tx_buf = NULL;
+        struct sk_buff *nskb = NULL;
+        int ret = 0, i;
+        u16 *hdr, tx_skb_cnt = 0;
+        u8 *buf;
+
+        if (hif_dev->tx.tx_skb_cnt == 0)
+                return 0;
+
+        /* Check if a free TX buffer is available */
+        if (list_empty(&hif_dev->tx.tx_buf))
+                return 0;
+
+        tx_buf = list_first_entry(&hif_dev->tx.tx_buf, struct tx_buf, list);
+        list_del(&tx_buf->list);
+        list_add_tail(&tx_buf->list, &hif_dev->tx.tx_pending);
+        hif_dev->tx.tx_buf_cnt--;
+
+        tx_skb_cnt = min_t(u16, hif_dev->tx.tx_skb_cnt, MAX_TX_AGGR_NUM);
+
+        for (i = 0; i < tx_skb_cnt; i++) {
+                nskb = __skb_dequeue(&hif_dev->tx.tx_skb_queue);
+
+                /* Should never be NULL */
+                BUG_ON(!nskb);
+
+                hif_dev->tx.tx_skb_cnt--;
+
+                buf = tx_buf->buf;
+                buf += tx_buf->offset;
+                hdr = (u16 *)buf;
+                *hdr++ = nskb->len;
+                *hdr++ = ATH_USB_TX_STREAM_MODE_TAG;
+                buf += 4;
+                memcpy(buf, nskb->data, nskb->len);
+                tx_buf->len = nskb->len + 4;
+
+                if (i < (tx_skb_cnt - 1))
+                        tx_buf->offset += (((tx_buf->len - 1) / 4) + 1) * 4;
+
+                if (i == (tx_skb_cnt - 1))
+                        tx_buf->len += tx_buf->offset;
+
+                __skb_queue_tail(&tx_buf->skb_queue, nskb);
+                TX_STAT_INC(skb_queued);
+        }
+
+        usb_fill_bulk_urb(tx_buf->urb, hif_dev->udev,
+                          usb_sndbulkpipe(hif_dev->udev, USB_WLAN_TX_PIPE),
+                          tx_buf->buf, tx_buf->len,
+                          hif_usb_tx_cb, tx_buf);
+
+        ret = usb_submit_urb(tx_buf->urb, GFP_ATOMIC);
+        if (ret) {
+                tx_buf->len = tx_buf->offset = 0;
+                __skb_queue_purge(&tx_buf->skb_queue);
+                __skb_queue_head_init(&tx_buf->skb_queue);
+                list_move_tail(&tx_buf->list, &hif_dev->tx.tx_buf);
+                hif_dev->tx.tx_buf_cnt++;
+        }
+
+        if (!ret)
+                TX_STAT_INC(buf_queued);
+
+        return ret;
+}
+
+static int hif_usb_send_tx(struct hif_device_usb *hif_dev, struct sk_buff *skb,
+                           struct ath9k_htc_tx_ctl *tx_ctl)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
+
+        if (hif_dev->tx.flags & HIF_USB_TX_STOP) {
+                spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
+                return -ENODEV;
+        }
+
+        /* Check if the max queue count has been reached */
+        if (hif_dev->tx.tx_skb_cnt > MAX_TX_BUF_NUM) {
+                spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
+                return -ENOMEM;
+        }
+
+        __skb_queue_tail(&hif_dev->tx.tx_skb_queue, skb);
+        hif_dev->tx.tx_skb_cnt++;
+
+        /* Send normal frames immediately */
+        if (!tx_ctl || (tx_ctl && (tx_ctl->type == ATH9K_HTC_NORMAL)))
+                __hif_usb_tx(hif_dev);
+
+        /* Check if AMPDUs have to be sent immediately */
+        if (tx_ctl && (tx_ctl->type == ATH9K_HTC_AMPDU) &&
+            (hif_dev->tx.tx_buf_cnt == MAX_TX_URB_NUM) &&
+            (hif_dev->tx.tx_skb_cnt < 2)) {
+                __hif_usb_tx(hif_dev);
+        }
+
+        spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
+
+        return 0;
+}
+
+static void hif_usb_start(void *hif_handle, u8 pipe_id)
+{
+        struct hif_device_usb *hif_dev = (struct hif_device_usb *)hif_handle;
+        unsigned long flags;
+
+        hif_dev->flags |= HIF_USB_START;
+
+        spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
+        hif_dev->tx.flags &= ~HIF_USB_TX_STOP;
+        spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
+}
+
+static void hif_usb_stop(void *hif_handle, u8 pipe_id)
+{
+        struct hif_device_usb *hif_dev = (struct hif_device_usb *)hif_handle;
+        unsigned long flags;
+
+        spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
+        __skb_queue_purge(&hif_dev->tx.tx_skb_queue);
+        hif_dev->tx.tx_skb_cnt = 0;
+        hif_dev->tx.flags |= HIF_USB_TX_STOP;
+        spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
+}
+
+static int hif_usb_send(void *hif_handle, u8 pipe_id, struct sk_buff *skb,
+                        struct ath9k_htc_tx_ctl *tx_ctl)
+{
+        struct hif_device_usb *hif_dev = (struct hif_device_usb *)hif_handle;
+        int ret = 0;
+
+        switch (pipe_id) {
+        case USB_WLAN_TX_PIPE:
+                ret = hif_usb_send_tx(hif_dev, skb, tx_ctl);
+                break;
+        case USB_REG_OUT_PIPE:
+                ret = hif_usb_send_regout(hif_dev, skb);
+                break;
+        default:
+                dev_err(&hif_dev->udev->dev,
+                        "ath9k_htc: Invalid TX pipe: %d\n", pipe_id);
+                ret = -EINVAL;
+                break;
+        }
+
+        return ret;
+}
+
+static struct ath9k_htc_hif hif_usb = {
+        .transport = ATH9K_HIF_USB,
+        .name = "ath9k_hif_usb",
+
+        .control_ul_pipe = USB_REG_OUT_PIPE,
+        .control_dl_pipe = USB_REG_IN_PIPE,
+
+        .start = hif_usb_start,
+        .stop = hif_usb_stop,
+        .send = hif_usb_send,
+};
+
+static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
+                                    struct sk_buff *skb)
+{
+        struct sk_buff *nskb, *skb_pool[8];
+        int index = 0, i = 0, chk_idx, len = skb->len;
+        int rx_remain_len = 0, rx_pkt_len = 0;
+        u16 pkt_len, pkt_tag, pool_index = 0;
+        u8 *ptr;
+
+        rx_remain_len = hif_dev->rx_remain_len;
+        rx_pkt_len = hif_dev->rx_transfer_len;
+
+        if (rx_remain_len != 0) {
+                struct sk_buff *remain_skb = hif_dev->remain_skb;
+
+                if (remain_skb) {
+                        ptr = (u8 *) remain_skb->data;
+
+                        index = rx_remain_len;
+                        rx_remain_len -= hif_dev->rx_pad_len;
+                        ptr += rx_pkt_len;
+
+                        memcpy(ptr, skb->data, rx_remain_len);
+
+                        rx_pkt_len += rx_remain_len;
+                        hif_dev->rx_remain_len = 0;
+                        skb_put(remain_skb, rx_pkt_len);
+
+                        skb_pool[pool_index++] = remain_skb;
+
+                } else {
+                        index = rx_remain_len;
+                }
+        }
+
+        while (index < len) {
+                ptr = (u8 *) skb->data;
+
+                pkt_len = ptr[index] + (ptr[index+1] << 8);
+                pkt_tag = ptr[index+2] + (ptr[index+3] << 8);
+
+                if (pkt_tag == ATH_USB_RX_STREAM_MODE_TAG) {
+                        u16 pad_len;
+
+                        pad_len = 4 - (pkt_len & 0x3);
+                        if (pad_len == 4)
+                                pad_len = 0;
+
+                        chk_idx = index;
+                        index = index + 4 + pkt_len + pad_len;
+
+                        if (index > MAX_RX_BUF_SIZE) {
+                                hif_dev->rx_remain_len = index - MAX_RX_BUF_SIZE;
+                                hif_dev->rx_transfer_len =
+                                        MAX_RX_BUF_SIZE - chk_idx - 4;
+                                hif_dev->rx_pad_len = pad_len;
+
+                                nskb = __dev_alloc_skb(pkt_len + 32,
+                                                       GFP_ATOMIC);
+                                if (!nskb) {
+                                        dev_err(&hif_dev->udev->dev,
+                                        "ath9k_htc: RX memory allocation"
+                                        " error\n");
+                                        goto err;
+                                }
+                                skb_reserve(nskb, 32);
+                                RX_STAT_INC(skb_allocated);
+
+                                memcpy(nskb->data, &(skb->data[chk_idx+4]),
+                                       hif_dev->rx_transfer_len);
+
+                                /* Record the buffer pointer */
+                                hif_dev->remain_skb = nskb;
+                        } else {
+                                nskb = __dev_alloc_skb(pkt_len + 32, GFP_ATOMIC);
+                                if (!nskb) {
+                                        dev_err(&hif_dev->udev->dev,
+                                        "ath9k_htc: RX memory allocation"
+                                        " error\n");
+                                        goto err;
+                                }
+                                skb_reserve(nskb, 32);
+                                RX_STAT_INC(skb_allocated);
+
+                                memcpy(nskb->data, &(skb->data[chk_idx+4]), pkt_len);
+                                skb_put(nskb, pkt_len);
+                                skb_pool[pool_index++] = nskb;
+                        }
+                } else {
+                        RX_STAT_INC(skb_dropped);
+                        return;
+                }
+        }
+
+err:
+        for (i = 0; i < pool_index; i++) {
+                ath9k_htc_rx_msg(hif_dev->htc_handle, skb_pool[i],
+                                 skb_pool[i]->len, USB_WLAN_RX_PIPE);
+                RX_STAT_INC(skb_completed);
+        }
+}
+
+static void ath9k_hif_usb_rx_cb(struct urb *urb)
+{
+        struct sk_buff *skb = (struct sk_buff *) urb->context;
+        struct hif_device_usb *hif_dev = (struct hif_device_usb *)
+                usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
+        int ret;
+
+        if (!skb)
+                return;
+
+        if (!hif_dev)
+                goto free;
+
+        switch (urb->status) {
+        case 0:
+                break;
+        case -ENOENT:
+        case -ECONNRESET:
+        case -ENODEV:
+        case -ESHUTDOWN:
+                goto free;
+        default:
+                goto resubmit;
+        }
+
+        if (likely(urb->actual_length != 0)) {
+                skb_put(skb, urb->actual_length);
+                ath9k_hif_usb_rx_stream(hif_dev, skb);
+        }
+
+resubmit:
+        skb_reset_tail_pointer(skb);
+        skb_trim(skb, 0);
+
+        usb_anchor_urb(urb, &hif_dev->rx_submitted);
+        ret = usb_submit_urb(urb, GFP_ATOMIC);
+        if (ret) {
+                usb_unanchor_urb(urb);
+                goto free;
+        }
+
+        return;
+free:
+        dev_kfree_skb_any(skb);
+}
+
+static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
+{
+        struct sk_buff *skb = (struct sk_buff *) urb->context;
+        struct sk_buff *nskb;
+        struct hif_device_usb *hif_dev = (struct hif_device_usb *)
+                usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
+        int ret;
+
+        if (!skb)
+                return;
+
+        if (!hif_dev)
+                goto free;
+
+        switch (urb->status) {
+        case 0:
+                break;
+        case -ENOENT:
+        case -ECONNRESET:
+        case -ENODEV:
+        case -ESHUTDOWN:
+                goto free;
+        default:
+                goto resubmit;
+        }
+
+        if (likely(urb->actual_length != 0)) {
+                skb_put(skb, urb->actual_length);
+
+                nskb = __dev_alloc_skb(MAX_REG_IN_BUF_SIZE, GFP_ATOMIC);
+                if (!nskb)
+                        goto resubmit;
+
+                usb_fill_int_urb(urb, hif_dev->udev,
+                                 usb_rcvintpipe(hif_dev->udev, USB_REG_IN_PIPE),
+                                 nskb->data, MAX_REG_IN_BUF_SIZE,
+                                 ath9k_hif_usb_reg_in_cb, nskb, 1);
+
+                ret = usb_submit_urb(urb, GFP_ATOMIC);
+                if (ret) {
+                        dev_kfree_skb_any(nskb);
+                        goto free;
+                }
+
+                ath9k_htc_rx_msg(hif_dev->htc_handle, skb,
+                                 skb->len, USB_REG_IN_PIPE);
+
+                return;
+        }
+
+resubmit:
+        skb_reset_tail_pointer(skb);
+        skb_trim(skb, 0);
+
+        ret = usb_submit_urb(urb, GFP_ATOMIC);
+        if (ret)
+                goto free;
+
+        return;
+free:
+        dev_kfree_skb_any(skb);
+        urb->context = NULL;
+}
+
+static void ath9k_hif_usb_dealloc_tx_urbs(struct hif_device_usb *hif_dev)
+{
+        unsigned long flags;
+        struct tx_buf *tx_buf = NULL, *tx_buf_tmp = NULL;
+
+        list_for_each_entry_safe(tx_buf, tx_buf_tmp, &hif_dev->tx.tx_buf, list) {
+                list_del(&tx_buf->list);
+                usb_free_urb(tx_buf->urb);
+                kfree(tx_buf->buf);
+                kfree(tx_buf);
+        }
+
+        spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
+        hif_dev->tx.flags |= HIF_USB_TX_FLUSH;
+        spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
+
+        list_for_each_entry_safe(tx_buf, tx_buf_tmp,
+                                 &hif_dev->tx.tx_pending, list) {
+                usb_kill_urb(tx_buf->urb);
+                list_del(&tx_buf->list);
+                usb_free_urb(tx_buf->urb);
+                kfree(tx_buf->buf);
+                kfree(tx_buf);
+        }
+
+        spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
+        hif_dev->tx.flags &= ~HIF_USB_TX_FLUSH;
+        spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
+}
+
+static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev)
+{
+        struct tx_buf *tx_buf;
+        int i;
+
+        INIT_LIST_HEAD(&hif_dev->tx.tx_buf);
+        INIT_LIST_HEAD(&hif_dev->tx.tx_pending);
+        spin_lock_init(&hif_dev->tx.tx_lock);
+        __skb_queue_head_init(&hif_dev->tx.tx_skb_queue);
+
+        for (i = 0; i < MAX_TX_URB_NUM; i++) {
+                tx_buf = kzalloc(sizeof(struct tx_buf), GFP_KERNEL);
+                if (!tx_buf)
+                        goto err;
+
+                tx_buf->buf = kzalloc(MAX_TX_BUF_SIZE, GFP_KERNEL);
+                if (!tx_buf->buf)
+                        goto err;
+
+                tx_buf->urb = usb_alloc_urb(0, GFP_KERNEL);
+                if (!tx_buf->urb)
+                        goto err;
+
+                tx_buf->hif_dev = hif_dev;
+                __skb_queue_head_init(&tx_buf->skb_queue);
+
+                list_add_tail(&tx_buf->list, &hif_dev->tx.tx_buf);
+        }
+
+        hif_dev->tx.tx_buf_cnt = MAX_TX_URB_NUM;
+
+        return 0;
+err:
+        ath9k_hif_usb_dealloc_tx_urbs(hif_dev);
+        return -ENOMEM;
+}
+
+static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev)
+{
+        usb_kill_anchored_urbs(&hif_dev->rx_submitted);
+}
+
+static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
+{
+        struct urb *urb = NULL;
+        struct sk_buff *skb = NULL;
+        int i, ret;
+
+        init_usb_anchor(&hif_dev->rx_submitted);
+
+        for (i = 0; i < MAX_RX_URB_NUM; i++) {
+
+                /* Allocate URB */
+                urb = usb_alloc_urb(0, GFP_KERNEL);
+                if (urb == NULL) {
+                        ret = -ENOMEM;
+                        goto err_urb;
+                }
+
+                /* Allocate buffer */
+                skb = __dev_alloc_skb(MAX_RX_BUF_SIZE, GFP_KERNEL);
+                if (!skb) {
+                        ret = -ENOMEM;
+                        goto err_skb;
+                }
+
+                usb_fill_bulk_urb(urb, hif_dev->udev,
+                                  usb_rcvbulkpipe(hif_dev->udev,
+                                                  USB_WLAN_RX_PIPE),
+                                  skb->data, MAX_RX_BUF_SIZE,
+                                  ath9k_hif_usb_rx_cb, skb);
+
+                /* Anchor URB */
+                usb_anchor_urb(urb, &hif_dev->rx_submitted);
+
+                /* Submit URB */
+                ret = usb_submit_urb(urb, GFP_KERNEL);
+                if (ret) {
+                        usb_unanchor_urb(urb);
+                        goto err_submit;
+                }
+        }
+
+        return 0;
+
+err_submit:
+        dev_kfree_skb_any(skb);
+err_skb:
+        usb_free_urb(urb);
+err_urb:
+        ath9k_hif_usb_dealloc_rx_urbs(hif_dev);
+        return ret;
+}
+
+static void ath9k_hif_usb_dealloc_reg_in_urb(struct hif_device_usb *hif_dev)
+{
+        if (hif_dev->reg_in_urb) {
+                usb_kill_urb(hif_dev->reg_in_urb);
+                if (hif_dev->reg_in_urb->context)
+                        dev_kfree_skb_any((void *)hif_dev->reg_in_urb->context);
+                usb_free_urb(hif_dev->reg_in_urb);
+                hif_dev->reg_in_urb = NULL;
+        }
+}
+
+static int ath9k_hif_usb_alloc_reg_in_urb(struct hif_device_usb *hif_dev)
+{
+        struct sk_buff *skb;
+
+        hif_dev->reg_in_urb = usb_alloc_urb(0, GFP_KERNEL);
+        if (hif_dev->reg_in_urb == NULL)
+                return -ENOMEM;
+
+        skb = __dev_alloc_skb(MAX_REG_IN_BUF_SIZE, GFP_KERNEL);
+        if (!skb)
+                goto err;
+
+        usb_fill_int_urb(hif_dev->reg_in_urb, hif_dev->udev,
+                         usb_rcvintpipe(hif_dev->udev, USB_REG_IN_PIPE),
+                         skb->data, MAX_REG_IN_BUF_SIZE,
+                         ath9k_hif_usb_reg_in_cb, skb, 1);
+
+        if (usb_submit_urb(hif_dev->reg_in_urb, GFP_KERNEL) != 0)
+                goto err;
+
+        return 0;
+
+err:
+        ath9k_hif_usb_dealloc_reg_in_urb(hif_dev);
+        return -ENOMEM;
+}
+
+static int ath9k_hif_usb_alloc_urbs(struct hif_device_usb *hif_dev)
+{
+        /* TX */
+        if (ath9k_hif_usb_alloc_tx_urbs(hif_dev) < 0)
+                goto err;
+
+        /* RX */
+        if (ath9k_hif_usb_alloc_rx_urbs(hif_dev) < 0)
+                goto err;
+
+        /* Register Read/Write */
+        if (ath9k_hif_usb_alloc_reg_in_urb(hif_dev) < 0)
+                goto err;
+
+        return 0;
+err:
+        return -ENOMEM;
+}
+
+static int ath9k_hif_usb_download_fw(struct hif_device_usb *hif_dev)
+{
+        int transfer, err;
+        const void *data = hif_dev->firmware->data;
+        size_t len = hif_dev->firmware->size;
+        u32 addr = AR9271_FIRMWARE;
+        u8 *buf = kzalloc(4096, GFP_KERNEL);
+
+        if (!buf)
+                return -ENOMEM;
+
+        while (len) {
+                transfer = min_t(int, len, 4096);
+                memcpy(buf, data, transfer);
+
+                err = usb_control_msg(hif_dev->udev,
+                                      usb_sndctrlpipe(hif_dev->udev, 0),
+                                      FIRMWARE_DOWNLOAD, 0x40 | USB_DIR_OUT,
+                                      addr >> 8, 0, buf, transfer, HZ);
+                if (err < 0) {
+                        kfree(buf);
+                        return err;
+                }
+
+                len -= transfer;
+                data += transfer;
+                addr += transfer;
+        }
+        kfree(buf);
+
+        /*
+         * Issue FW download complete command to firmware.
+         */
+        err = usb_control_msg(hif_dev->udev, usb_sndctrlpipe(hif_dev->udev, 0),
+                              FIRMWARE_DOWNLOAD_COMP,
+                              0x40 | USB_DIR_OUT,
+                              AR9271_FIRMWARE_TEXT >> 8, 0, NULL, 0, HZ);
+        if (err)
+                return -EIO;
+
+        dev_info(&hif_dev->udev->dev, "ath9k_htc: Transferred FW: %s, size: %ld\n",
+                 "ar9271.fw", (unsigned long) hif_dev->firmware->size);
+
+        return 0;
+}
+
+static int ath9k_hif_usb_dev_init(struct hif_device_usb *hif_dev,
+                                  const char *fw_name)
+{
+        int ret;
+
+        /* Request firmware */
+        ret = request_firmware(&hif_dev->firmware, fw_name, &hif_dev->udev->dev);
+        if (ret) {
+                dev_err(&hif_dev->udev->dev,
+                        "ath9k_htc: Firmware - %s not found\n", fw_name);
+                goto err_fw_req;
+        }
+
+        /* Download firmware */
+        ret = ath9k_hif_usb_download_fw(hif_dev);
+        if (ret) {
+                dev_err(&hif_dev->udev->dev,
+                        "ath9k_htc: Firmware - %s download failed\n", fw_name);
+                goto err_fw_download;
+        }
+
+        /* Alloc URBs */
+        ret = ath9k_hif_usb_alloc_urbs(hif_dev);
+        if (ret) {
+                dev_err(&hif_dev->udev->dev,
+                        "ath9k_htc: Unable to allocate URBs\n");
+                goto err_urb;
+        }
+
+        return 0;
+
+err_urb:
+        /* Nothing */
+err_fw_download:
+        release_firmware(hif_dev->firmware);
+err_fw_req:
+        hif_dev->firmware = NULL;
+        return ret;
+}
+
+static void ath9k_hif_usb_dealloc_urbs(struct hif_device_usb *hif_dev)
+{
+        ath9k_hif_usb_dealloc_reg_in_urb(hif_dev);
+        ath9k_hif_usb_dealloc_tx_urbs(hif_dev);
+        ath9k_hif_usb_dealloc_rx_urbs(hif_dev);
+}
+
+static void ath9k_hif_usb_dev_deinit(struct hif_device_usb *hif_dev)
+{
+        ath9k_hif_usb_dealloc_urbs(hif_dev);
+        if (hif_dev->firmware)
+                release_firmware(hif_dev->firmware);
+}
+
+static int ath9k_hif_usb_probe(struct usb_interface *interface,
+                               const struct usb_device_id *id)
+{
+        struct usb_device *udev = interface_to_usbdev(interface);
+        struct hif_device_usb *hif_dev;
+        const char *fw_name = (const char *) id->driver_info;
+        int ret = 0;
+
+        hif_dev = kzalloc(sizeof(struct hif_device_usb), GFP_KERNEL);
+        if (!hif_dev) {
+                ret = -ENOMEM;
+                goto err_alloc;
+        }
+
+        usb_get_dev(udev);
+        hif_dev->udev = udev;
+        hif_dev->interface = interface;
+        hif_dev->device_id = id->idProduct;
+#ifdef CONFIG_PM
+        udev->reset_resume = 1;
+#endif
+        usb_set_intfdata(interface, hif_dev);
+
+        ret = ath9k_hif_usb_dev_init(hif_dev, fw_name);
+        if (ret) {
+                ret = -EINVAL;
+                goto err_hif_init_usb;
+        }
+
+        hif_dev->htc_handle = ath9k_htc_hw_alloc(hif_dev);
+        if (hif_dev->htc_handle == NULL) {
+                ret = -ENOMEM;
+                goto err_htc_hw_alloc;
+        }
+
+        ret = ath9k_htc_hw_init(&hif_usb, hif_dev->htc_handle, hif_dev,
+                                &hif_dev->udev->dev, hif_dev->device_id,
+                                ATH9K_HIF_USB);
+        if (ret) {
+                ret = -EINVAL;
+                goto err_htc_hw_init;
+        }
+
+        dev_info(&hif_dev->udev->dev, "ath9k_htc: USB layer initialized\n");
+
+        return 0;
+
+err_htc_hw_init:
+        ath9k_htc_hw_free(hif_dev->htc_handle);
+err_htc_hw_alloc:
+        ath9k_hif_usb_dev_deinit(hif_dev);
+err_hif_init_usb:
+        usb_set_intfdata(interface, NULL);
+        kfree(hif_dev);
+        usb_put_dev(udev);
+err_alloc:
+        return ret;
+}
+
+static void ath9k_hif_usb_disconnect(struct usb_interface *interface)
+{
+        struct usb_device *udev = interface_to_usbdev(interface);
+        struct hif_device_usb *hif_dev =
+                (struct hif_device_usb *) usb_get_intfdata(interface);
+
+        if (hif_dev) {
+                ath9k_htc_hw_deinit(hif_dev->htc_handle, true);
+                ath9k_htc_hw_free(hif_dev->htc_handle);
+                ath9k_hif_usb_dev_deinit(hif_dev);
+                usb_set_intfdata(interface, NULL);
+        }
+
+        if (hif_dev->flags & HIF_USB_START)
+                usb_reset_device(udev);
+
+        kfree(hif_dev);
+        dev_info(&udev->dev, "ath9k_htc: USB layer deinitialized\n");
+        usb_put_dev(udev);
+}
+
+#ifdef CONFIG_PM
+static int ath9k_hif_usb_suspend(struct usb_interface *interface,
+                                 pm_message_t message)
+{
+        struct hif_device_usb *hif_dev =
+                (struct hif_device_usb *) usb_get_intfdata(interface);
+
+        ath9k_hif_usb_dealloc_urbs(hif_dev);
+
+        return 0;
+}
+
+static int ath9k_hif_usb_resume(struct usb_interface *interface)
+{
+        struct hif_device_usb *hif_dev =
+                (struct hif_device_usb *) usb_get_intfdata(interface);
+        int ret;
+
+        ret = ath9k_hif_usb_alloc_urbs(hif_dev);
+        if (ret)
+                return ret;
+
+        if (hif_dev->firmware) {
+                ret = ath9k_hif_usb_download_fw(hif_dev);
+                if (ret)
+                        goto fail_resume;
+        } else {
+                ath9k_hif_usb_dealloc_urbs(hif_dev);
+                return -EIO;
+        }
+
+        mdelay(100);
+
+        ret = ath9k_htc_resume(hif_dev->htc_handle);
+
+        if (ret)
+                goto fail_resume;
+
+        return 0;
+
+fail_resume:
+        ath9k_hif_usb_dealloc_urbs(hif_dev);
+
+        return ret;
+}
+#endif
+
+static struct usb_driver ath9k_hif_usb_driver = {
+        .name = "ath9k_hif_usb",
+        .probe = ath9k_hif_usb_probe,
+        .disconnect = ath9k_hif_usb_disconnect,
+#ifdef CONFIG_PM
+        .suspend = ath9k_hif_usb_suspend,
+        .resume = ath9k_hif_usb_resume,
+        .reset_resume = ath9k_hif_usb_resume,
+#endif
+        .id_table = ath9k_hif_usb_ids,
+        .soft_unbind = 1,
+};
+
+int ath9k_hif_usb_init(void)
+{
+        return usb_register(&ath9k_hif_usb_driver);
+}
+
+void ath9k_hif_usb_exit(void)
+{
+        usb_deregister(&ath9k_hif_usb_driver);
+}
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.h b/drivers/net/wireless/ath/ath9k/hif_usb.h
new file mode 100644
index 000000000000..ea9257bdc411
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.h
@@ -0,0 +1,102 @@
+/*
+ * Copyright (c) 2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef HTC_USB_H
+#define HTC_USB_H
+
+#define AR9271_FIRMWARE       0x501000
+#define AR9271_FIRMWARE_TEXT  0x903000
+
+#define FIRMWARE_DOWNLOAD       0x30
+#define FIRMWARE_DOWNLOAD_COMP  0x31
+
+#define ATH_USB_RX_STREAM_MODE_TAG 0x4e00
+#define ATH_USB_TX_STREAM_MODE_TAG 0x697e
+
+/* FIXME: Verify these numbers (with Windows) */
+#define MAX_TX_URB_NUM  8
+#define MAX_TX_BUF_NUM  1024
+#define MAX_TX_BUF_SIZE 32768
+#define MAX_TX_AGGR_NUM 20
+
+#define MAX_RX_URB_NUM  8
+#define MAX_RX_BUF_SIZE 16384
+
+#define MAX_REG_OUT_URB_NUM  1
+#define MAX_REG_OUT_BUF_NUM  8
+
+#define MAX_REG_IN_BUF_SIZE 64
+
+/* USB Endpoint definition */
+#define USB_WLAN_TX_PIPE  1
+#define USB_WLAN_RX_PIPE  2
+#define USB_REG_IN_PIPE   3
+#define USB_REG_OUT_PIPE  4
+
+#define HIF_USB_MAX_RXPIPES 2
+#define HIF_USB_MAX_TXPIPES 4
+
+struct tx_buf {
+        u8 *buf;
+        u16 len;
+        u16 offset;
+        struct urb *urb;
+        struct sk_buff_head skb_queue;
+        struct hif_device_usb *hif_dev;
+        struct list_head list;
+};
+
+#define HIF_USB_TX_STOP  BIT(0)
+#define HIF_USB_TX_FLUSH BIT(1)
+
+struct hif_usb_tx {
+        u8 flags;
+        u8 tx_buf_cnt;
+        u16 tx_skb_cnt;
+        struct sk_buff_head tx_skb_queue;
+        struct list_head tx_buf;
+        struct list_head tx_pending;
+        spinlock_t tx_lock;
+};
+
+struct cmd_buf {
+        struct sk_buff *skb;
+        struct hif_device_usb *hif_dev;
+};
+
+#define HIF_USB_START BIT(0)
+
+struct hif_device_usb {
+        u16 device_id;
+        struct usb_device *udev;
+        struct usb_interface *interface;
+        const struct firmware *firmware;
+        struct htc_target *htc_handle;
+        struct hif_usb_tx tx;
+        struct urb *reg_in_urb;
+        struct usb_anchor rx_submitted;
+        struct sk_buff *remain_skb;
+        int rx_remain_len;
+        int rx_pkt_len;
+        int rx_transfer_len;
+        int rx_pad_len;
+        u8 flags; /* HIF_USB_* */
+};
+
+int ath9k_hif_usb_init(void);
+void ath9k_hif_usb_exit(void);
+
+#endif /* HTC_USB_H */
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
new file mode 100644
index 000000000000..78213fc71b09
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -0,0 +1,462 @@
+/*
+ * Copyright (c) 2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef HTC_H
+#define HTC_H
+
+#include <linux/module.h>
+#include <linux/usb.h>
+#include <linux/firmware.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/leds.h>
+#include <net/mac80211.h>
+
+#include "common.h"
+#include "htc_hst.h"
+#include "hif_usb.h"
+#include "wmi.h"
+
+#define ATH_STA_SHORT_CALINTERVAL 1000    /* 1 second */
+#define ATH_ANI_POLLINTERVAL      100     /* 100 ms */
+#define ATH_LONG_CALINTERVAL      30000   /* 30 seconds */
+#define ATH_RESTART_CALINTERVAL   1200000 /* 20 minutes */
+
+#define ATH_DEFAULT_BMISS_LIMIT 10
+#define IEEE80211_MS_TO_TU(x)   (((x) * 1000) / 1024)
+#define TSF_TO_TU(_h, _l) \
+        ((((u32)(_h)) << 22) | (((u32)(_l)) >> 10))
+
+extern struct ieee80211_ops ath9k_htc_ops;
+extern int htc_modparam_nohwcrypt;
+
+enum htc_phymode {
+        HTC_MODE_AUTO           = 0,
+        HTC_MODE_11A            = 1,
+        HTC_MODE_11B            = 2,
+        HTC_MODE_11G            = 3,
+        HTC_MODE_FH             = 4,
+        HTC_MODE_TURBO_A        = 5,
+        HTC_MODE_TURBO_G        = 6,
+        HTC_MODE_11NA           = 7,
+        HTC_MODE_11NG           = 8
+};
+
+enum htc_opmode {
+        HTC_M_STA       = 1,
+        HTC_M_IBSS      = 0,
+        HTC_M_AHDEMO    = 3,
+        HTC_M_HOSTAP    = 6,
+        HTC_M_MONITOR   = 8,
+        HTC_M_WDS       = 2
+};
+
+#define ATH9K_HTC_HDRSPACE sizeof(struct htc_frame_hdr)
+#define ATH9K_HTC_AMPDU 1
+#define ATH9K_HTC_NORMAL 2
+
+#define ATH9K_HTC_TX_CTSONLY      0x1
+#define ATH9K_HTC_TX_RTSCTS       0x2
+#define ATH9K_HTC_TX_USE_MIN_RATE 0x100
+
+struct tx_frame_hdr {
+        u8 data_type;
+        u8 node_idx;
+        u8 vif_idx;
+        u8 tidno;
+        u32 flags; /* ATH9K_HTC_TX_* */
+        u8 key_type;
+        u8 keyix;
+        u8 reserved[26];
+} __packed;
+
+struct tx_mgmt_hdr {
+        u8 node_idx;
+        u8 vif_idx;
+        u8 tidno;
+        u8 flags;
+        u8 key_type;
+        u8 keyix;
+        u16 reserved;
+} __packed;
+
+struct tx_beacon_header {
+        u8 len_changed;
+        u8 vif_index;
+        u16 rev;
+} __packed;
+
+struct ath9k_htc_target_hw {
+        u32 flags;
+        u32 flags_ext;
+        u32 ampdu_limit;
+        u8 ampdu_subframes;
+        u8 tx_chainmask;
+        u8 tx_chainmask_legacy;
+        u8 rtscts_ratecode;
+        u8 protmode;
+} __packed;
+
+struct ath9k_htc_cap_target {
+        u32 flags;
+        u32 flags_ext;
+        u32 ampdu_limit;
+        u8 ampdu_subframes;
+        u8 tx_chainmask;
+        u8 tx_chainmask_legacy;
+        u8 rtscts_ratecode;
+        u8 protmode;
+} __packed;
+
+struct ath9k_htc_target_vif {
+        u8 index;
+        u8 des_bssid[ETH_ALEN];
+        enum htc_opmode opmode;
+        u8 myaddr[ETH_ALEN];
+        u8 bssid[ETH_ALEN];
+        u32 flags;
+        u32 flags_ext;
+        u16 ps_sta;
+        u16 rtsthreshold;
+        u8 ath_cap;
+        u8 node;
+        s8 mcast_rate;
+} __packed;
+
+#define ATH_HTC_STA_AUTH  0x0001
+#define ATH_HTC_STA_QOS   0x0002
+#define ATH_HTC_STA_ERP   0x0004
+#define ATH_HTC_STA_HT    0x0008
+
+/* FIXME: UAPSD variables */
+struct ath9k_htc_target_sta {
+        u16 associd;
+        u16 txpower;
+        u32 ucastkey;
+        u8 macaddr[ETH_ALEN];
+        u8 bssid[ETH_ALEN];
+        u8 sta_index;
+        u8 vif_index;
+        u8 vif_sta;
+        u16 flags; /* ATH_HTC_STA_* */
+        u16 htcap;
+        u8 valid;
+        u16 capinfo;
+        struct ath9k_htc_target_hw *hw;
+        struct ath9k_htc_target_vif *vif;
+        u16 txseqmgmt;
+        u8 is_vif_sta;
+        u16 maxampdu;
+        u16 iv16;
+        u32 iv32;
+} __packed;
+
+struct ath9k_htc_target_aggr {
+        u8 sta_index;
+        u8 tidno;
+        u8 aggr_enable;
+        u8 padding;
+} __packed;
+
+#define ATH_HTC_RATE_MAX 30
+
+#define WLAN_RC_DS_FLAG  0x01
+#define WLAN_RC_40_FLAG  0x02
+#define WLAN_RC_SGI_FLAG 0x04
+#define WLAN_RC_HT_FLAG  0x08
+
+struct ath9k_htc_rateset {
+        u8 rs_nrates;
+        u8 rs_rates[ATH_HTC_RATE_MAX];
+};
+
+struct ath9k_htc_rate {
+        struct ath9k_htc_rateset legacy_rates;
+        struct ath9k_htc_rateset ht_rates;
+} __packed;
+
+struct ath9k_htc_target_rate {
+        u8 sta_index;
+        u8 isnew;
+        u32 capflags;
+        struct ath9k_htc_rate rates;
+};
+
+struct ath9k_htc_target_stats {
+        u32 tx_shortretry;
+        u32 tx_longretry;
+        u32 tx_xretries;
+        u32 ht_txunaggr_xretry;
+        u32 ht_tx_xretries;
+} __packed;
+
+struct ath9k_htc_vif {
+        u8 index;
+};
+
+#define ATH9K_HTC_MAX_STA 8
+#define ATH9K_HTC_MAX_TID 8
+
+enum tid_aggr_state {
+        AGGR_STOP = 0,
+        AGGR_PROGRESS,
+        AGGR_START,
+        AGGR_OPERATIONAL
+};
+
+struct ath9k_htc_sta {
+        u8 index;
+        enum tid_aggr_state tid_state[ATH9K_HTC_MAX_TID];
+};
+
+struct ath9k_htc_aggr_work {
+        u16 tid;
+        u8 sta_addr[ETH_ALEN];
+        struct ieee80211_hw *hw;
+        struct ieee80211_vif *vif;
+        enum ieee80211_ampdu_mlme_action action;
+        struct mutex mutex;
+};
+
+#define ATH9K_HTC_RXBUF 256
+#define HTC_RX_FRAME_HEADER_SIZE 40
+
+struct ath9k_htc_rxbuf {
+        bool in_process;
+        struct sk_buff *skb;
+        struct ath_htc_rx_status rxstatus;
+        struct list_head list;
+};
+
+struct ath9k_htc_rx {
+        int last_rssi; /* FIXME: per-STA */
+        struct list_head rxbuf;
+        spinlock_t rxbuflock;
+};
+
+struct ath9k_htc_tx_ctl {
+        u8 type; /* ATH9K_HTC_* */
+};
+
+#ifdef CONFIG_ATH9K_HTC_DEBUGFS
+
+#define TX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c++)
+#define RX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.rx_stats.c++)
+
+struct ath_tx_stats {
+        u32 buf_queued;
+        u32 buf_completed;
+        u32 skb_queued;
+        u32 skb_completed;
+};
+
+struct ath_rx_stats {
+        u32 skb_allocated;
+        u32 skb_completed;
+        u32 skb_dropped;
+};
+
+struct ath9k_debug {
+        struct dentry *debugfs_phy;
+        struct dentry *debugfs_tgt_stats;
+        struct dentry *debugfs_xmit;
+        struct dentry *debugfs_recv;
+        struct ath_tx_stats tx_stats;
+        struct ath_rx_stats rx_stats;
+        u32 txrate;
+};
+
+#else
+
+#define TX_STAT_INC(c) do { } while (0)
+#define RX_STAT_INC(c) do { } while (0)
+
+#endif /* CONFIG_ATH9K_HTC_DEBUGFS */
+
+#define ATH_LED_PIN_DEF             1
+#define ATH_LED_PIN_9287            8
+#define ATH_LED_PIN_9271            15
+#define ATH_LED_ON_DURATION_IDLE    350 /* in msecs */
+#define ATH_LED_OFF_DURATION_IDLE   250 /* in msecs */
+
+enum ath_led_type {
+        ATH_LED_RADIO,
+        ATH_LED_ASSOC,
+        ATH_LED_TX,
+        ATH_LED_RX
+};
+
+struct ath_led {
+        struct ath9k_htc_priv *priv;
+        struct led_classdev led_cdev;
+        enum ath_led_type led_type;
+        struct delayed_work brightness_work;
+        char name[32];
+        bool registered;
+        int brightness;
+};
+
+struct htc_beacon_config {
+        u16 beacon_interval;
+        u16 listen_interval;
+        u16 dtim_period;
+        u16 bmiss_timeout;
+        u8 dtim_count;
+};
+
+#define OP_INVALID        BIT(0)
+#define OP_SCANNING       BIT(1)
+#define OP_FULL_RESET     BIT(2)
+#define OP_LED_ASSOCIATED BIT(3)
+#define OP_LED_ON         BIT(4)
+#define OP_PREAMBLE_SHORT BIT(5)
+#define OP_PROTECT_ENABLE BIT(6)
+#define OP_TXAGGR         BIT(7)
+#define OP_ASSOCIATED     BIT(8)
+#define OP_ENABLE_BEACON  BIT(9)
+#define OP_LED_DEINIT     BIT(10)
+
+struct ath9k_htc_priv {
+        struct device *dev;
+        struct ieee80211_hw *hw;
+        struct ath_hw *ah;
+        struct htc_target *htc;
+        struct wmi *wmi;
+
+        enum htc_endpoint_id wmi_cmd_ep;
+        enum htc_endpoint_id beacon_ep;
+        enum htc_endpoint_id cab_ep;
+        enum htc_endpoint_id uapsd_ep;
+        enum htc_endpoint_id mgmt_ep;
+        enum htc_endpoint_id data_be_ep;
+        enum htc_endpoint_id data_bk_ep;
+        enum htc_endpoint_id data_vi_ep;
+        enum htc_endpoint_id data_vo_ep;
+
+        u16 op_flags;
+        u16 curtxpow;
+        u16 txpowlimit;
+        u16 nvifs;
+        u16 nstations;
+        u16 seq_no;
+        u32 bmiss_cnt;
+
+        struct sk_buff *beacon;
+        spinlock_t beacon_lock;
+
+        bool tx_queues_stop;
+        spinlock_t tx_lock;
+
+        struct ieee80211_vif *vif;
+        struct htc_beacon_config cur_beacon_conf;
+        unsigned int rxfilter;
+        struct tasklet_struct wmi_tasklet;
+        struct tasklet_struct rx_tasklet;
+        struct ieee80211_supported_band sbands[IEEE80211_NUM_BANDS];
+        struct ath9k_htc_rx rx;
+        struct tasklet_struct tx_tasklet;
+        struct sk_buff_head tx_queue;
+        struct ath9k_htc_aggr_work aggr_work;
+        struct delayed_work ath9k_aggr_work;
+        struct delayed_work ath9k_ani_work;
+        struct work_struct ps_work;
+
+        struct mutex htc_pm_lock;
+        unsigned long ps_usecount;
+        bool ps_enabled;
+
+        struct ath_led radio_led;
+        struct ath_led assoc_led;
+        struct ath_led tx_led;
+        struct ath_led rx_led;
+        struct delayed_work ath9k_led_blink_work;
+        int led_on_duration;
+        int led_off_duration;
+        int led_on_cnt;
+        int led_off_cnt;
+        int hwq_map[ATH9K_WME_AC_VO+1];
+
+#ifdef CONFIG_ATH9K_HTC_DEBUGFS
+        struct ath9k_debug debug;
+#endif
+        struct ath9k_htc_target_rate tgt_rate;
+
+        struct mutex mutex;
+};
+
+static inline void ath_read_cachesize(struct ath_common *common, int *csz)
+{
+        common->bus_ops->read_cachesize(common, csz);
+}
+
+void ath9k_htc_beacon_config(struct ath9k_htc_priv *priv,
+                             struct ieee80211_vif *vif);
+void ath9k_htc_swba(struct ath9k_htc_priv *priv, u8 beacon_pending);
+void ath9k_htc_beacon_update(struct ath9k_htc_priv *priv,
+                             struct ieee80211_vif *vif);
+
+void ath9k_htc_rxep(void *priv, struct sk_buff *skb,
+                    enum htc_endpoint_id ep_id);
+void ath9k_htc_txep(void *priv, struct sk_buff *skb, enum htc_endpoint_id ep_id,
+                    bool txok);
+
+void ath9k_htc_station_work(struct work_struct *work);
+void ath9k_htc_aggr_work(struct work_struct *work);
+void ath9k_ani_work(struct work_struct *work);;
+
+int ath9k_tx_init(struct ath9k_htc_priv *priv);
+void ath9k_tx_tasklet(unsigned long data);
+int ath9k_htc_tx_start(struct ath9k_htc_priv *priv, struct sk_buff *skb);
+void ath9k_tx_cleanup(struct ath9k_htc_priv *priv);
+bool ath9k_htc_txq_setup(struct ath9k_htc_priv *priv,
+                         enum ath9k_tx_queue_subtype qtype);
+int get_hw_qnum(u16 queue, int *hwq_map);
+int ath_htc_txq_update(struct ath9k_htc_priv *priv, int qnum,
+                       struct ath9k_tx_queue_info *qinfo);
+
+int ath9k_rx_init(struct ath9k_htc_priv *priv);
+void ath9k_rx_cleanup(struct ath9k_htc_priv *priv);
+void ath9k_host_rx_init(struct ath9k_htc_priv *priv);
+void ath9k_rx_tasklet(unsigned long data);
+u32 ath9k_htc_calcrxfilter(struct ath9k_htc_priv *priv);
+
+void ath9k_htc_ps_wakeup(struct ath9k_htc_priv *priv);
+void ath9k_htc_ps_restore(struct ath9k_htc_priv *priv);
+void ath9k_ps_work(struct work_struct *work);
+
+void ath9k_start_rfkill_poll(struct ath9k_htc_priv *priv);
+void ath9k_init_leds(struct ath9k_htc_priv *priv);
+void ath9k_deinit_leds(struct ath9k_htc_priv *priv);
+
+int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev,
+                           u16 devid);
+void ath9k_htc_disconnect_device(struct htc_target *htc_handle, bool hotunplug);
+#ifdef CONFIG_PM
+int ath9k_htc_resume(struct htc_target *htc_handle);
+#endif
+#ifdef CONFIG_ATH9K_HTC_DEBUGFS
+int ath9k_htc_debug_create_root(void);
+void ath9k_htc_debug_remove_root(void);
+int ath9k_htc_init_debug(struct ath_hw *ah);
+void ath9k_htc_exit_debug(struct ath_hw *ah);
+#else
+static inline int ath9k_htc_debug_create_root(void) { return 0; };
+static inline void ath9k_htc_debug_remove_root(void) {};
+static inline int ath9k_htc_init_debug(struct ath_hw *ah) { return 0; };
+static inline void ath9k_htc_exit_debug(struct ath_hw *ah) {};
+#endif /* CONFIG_ATH9K_HTC_DEBUGFS */
+
+#endif /* HTC_H */
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
new file mode 100644
index 000000000000..5e21f4d92ff5
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
@@ -0,0 +1,277 @@
+/*
+ * Copyright (c) 2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "htc.h"
+
+#define FUDGE 2
+
+static void ath9k_htc_beacon_config_sta(struct ath9k_htc_priv *priv,
+                                        struct htc_beacon_config *bss_conf)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ath9k_beacon_state bs;
+        enum ath9k_int imask = 0;
+        int dtimperiod, dtimcount, sleepduration;
+        int cfpperiod, cfpcount, bmiss_timeout;
+        u32 nexttbtt = 0, intval, tsftu, htc_imask = 0;
+        u64 tsf;
+        int num_beacons, offset, dtim_dec_count, cfp_dec_count;
+        int ret;
+        u8 cmd_rsp;
+
+        memset(&bs, 0, sizeof(bs));
+
+        intval = bss_conf->beacon_interval & ATH9K_BEACON_PERIOD;
+        bmiss_timeout = (ATH_DEFAULT_BMISS_LIMIT * bss_conf->beacon_interval);
+
+        /*
+         * Setup dtim and cfp parameters according to
+         * last beacon we received (which may be none).
+         */
+        dtimperiod = bss_conf->dtim_period;
+        if (dtimperiod <= 0)            /* NB: 0 if not known */
+                dtimperiod = 1;
+        dtimcount = 1;
+        if (dtimcount >= dtimperiod)    /* NB: sanity check */
+                dtimcount = 0;
+        cfpperiod = 1;                  /* NB: no PCF support yet */
+        cfpcount = 0;
+
+        sleepduration = intval;
+        if (sleepduration <= 0)
+                sleepduration = intval;
+
+        /*
+         * Pull nexttbtt forward to reflect the current
+         * TSF and calculate dtim+cfp state for the result.
+         */
+        tsf = ath9k_hw_gettsf64(priv->ah);
+        tsftu = TSF_TO_TU(tsf>>32, tsf) + FUDGE;
+
+        num_beacons = tsftu / intval + 1;
+        offset = tsftu % intval;
+        nexttbtt = tsftu - offset;
+        if (offset)
+                nexttbtt += intval;
+
+        /* DTIM Beacon every dtimperiod Beacon */
+        dtim_dec_count = num_beacons % dtimperiod;
+        /* CFP every cfpperiod DTIM Beacon */
+        cfp_dec_count = (num_beacons / dtimperiod) % cfpperiod;
+        if (dtim_dec_count)
+                cfp_dec_count++;
+
+        dtimcount -= dtim_dec_count;
+        if (dtimcount < 0)
+                dtimcount += dtimperiod;
+
+        cfpcount -= cfp_dec_count;
+        if (cfpcount < 0)
+                cfpcount += cfpperiod;
+
+        bs.bs_intval = intval;
+        bs.bs_nexttbtt = nexttbtt;
+        bs.bs_dtimperiod = dtimperiod*intval;
+        bs.bs_nextdtim = bs.bs_nexttbtt + dtimcount*intval;
+        bs.bs_cfpperiod = cfpperiod*bs.bs_dtimperiod;
+        bs.bs_cfpnext = bs.bs_nextdtim + cfpcount*bs.bs_dtimperiod;
+        bs.bs_cfpmaxduration = 0;
+
+        /*
+         * Calculate the number of consecutive beacons to miss* before taking
+         * a BMISS interrupt. The configuration is specified in TU so we only
+         * need calculate based on the beacon interval.  Note that we clamp the
+         * result to at most 15 beacons.
+         */
+        if (sleepduration > intval) {
+                bs.bs_bmissthreshold = ATH_DEFAULT_BMISS_LIMIT / 2;
+        } else {
+                bs.bs_bmissthreshold = DIV_ROUND_UP(bmiss_timeout, intval);
+                if (bs.bs_bmissthreshold > 15)
+                        bs.bs_bmissthreshold = 15;
+                else if (bs.bs_bmissthreshold <= 0)
+                        bs.bs_bmissthreshold = 1;
+        }
+
+        /*
+         * Calculate sleep duration. The configuration is given in ms.
+         * We ensure a multiple of the beacon period is used. Also, if the sleep
+         * duration is greater than the DTIM period then it makes senses
+         * to make it a multiple of that.
+         *
+         * XXX fixed at 100ms
+         */
+
+        bs.bs_sleepduration = roundup(IEEE80211_MS_TO_TU(100), sleepduration);
+        if (bs.bs_sleepduration > bs.bs_dtimperiod)
+                bs.bs_sleepduration = bs.bs_dtimperiod;
+
+        /* TSF out of range threshold fixed at 1 second */
+        bs.bs_tsfoor_threshold = ATH9K_TSFOOR_THRESHOLD;
+
+        ath_print(common, ATH_DBG_BEACON, "tsf: %llu tsftu: %u\n", tsf, tsftu);
+        ath_print(common, ATH_DBG_BEACON,
+                  "bmiss: %u sleep: %u cfp-period: %u maxdur: %u next: %u\n",
+                  bs.bs_bmissthreshold, bs.bs_sleepduration,
+                  bs.bs_cfpperiod, bs.bs_cfpmaxduration, bs.bs_cfpnext);
+
+        /* Set the computed STA beacon timers */
+
+        WMI_CMD(WMI_DISABLE_INTR_CMDID);
+        ath9k_hw_set_sta_beacon_timers(priv->ah, &bs);
+        imask |= ATH9K_INT_BMISS;
+        htc_imask = cpu_to_be32(imask);
+        WMI_CMD_BUF(WMI_ENABLE_INTR_CMDID, &htc_imask);
+}
+
+static void ath9k_htc_beacon_config_adhoc(struct ath9k_htc_priv *priv,
+                                          struct htc_beacon_config *bss_conf)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        enum ath9k_int imask = 0;
+        u32 nexttbtt, intval, htc_imask = 0;
+        int ret;
+        u8 cmd_rsp;
+
+        intval = bss_conf->beacon_interval & ATH9K_BEACON_PERIOD;
+        nexttbtt = intval;
+        intval |= ATH9K_BEACON_ENA;
+        if (priv->op_flags & OP_ENABLE_BEACON)
+                imask |= ATH9K_INT_SWBA;
+
+        ath_print(common, ATH_DBG_BEACON,
+                  "IBSS Beacon config, intval: %d, imask: 0x%x\n",
+                  bss_conf->beacon_interval, imask);
+
+        WMI_CMD(WMI_DISABLE_INTR_CMDID);
+        ath9k_hw_beaconinit(priv->ah, nexttbtt, intval);
+        priv->bmiss_cnt = 0;
+        htc_imask = cpu_to_be32(imask);
+        WMI_CMD_BUF(WMI_ENABLE_INTR_CMDID, &htc_imask);
+}
+
+void ath9k_htc_beacon_update(struct ath9k_htc_priv *priv,
+                             struct ieee80211_vif *vif)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+
+        spin_lock_bh(&priv->beacon_lock);
+
+        if (priv->beacon)
+                dev_kfree_skb_any(priv->beacon);
+
+        priv->beacon = ieee80211_beacon_get(priv->hw, vif);
+        if (!priv->beacon)
+                ath_print(common, ATH_DBG_BEACON,
+                          "Unable to allocate beacon\n");
+
+        spin_unlock_bh(&priv->beacon_lock);
+}
+
+void ath9k_htc_swba(struct ath9k_htc_priv *priv, u8 beacon_pending)
+{
+        struct ath9k_htc_vif *avp = (void *)priv->vif->drv_priv;
+        struct tx_beacon_header beacon_hdr;
+        struct ath9k_htc_tx_ctl tx_ctl;
+        struct ieee80211_tx_info *info;
+        u8 *tx_fhdr;
+
+        memset(&beacon_hdr, 0, sizeof(struct tx_beacon_header));
+        memset(&tx_ctl, 0, sizeof(struct ath9k_htc_tx_ctl));
+
+        /* FIXME: Handle BMISS */
+        if (beacon_pending != 0) {
+                priv->bmiss_cnt++;
+                return;
+        }
+
+        spin_lock_bh(&priv->beacon_lock);
+
+        if (unlikely(priv->op_flags & OP_SCANNING)) {
+                spin_unlock_bh(&priv->beacon_lock);
+                return;
+        }
+
+        if (unlikely(priv->beacon == NULL)) {
+                spin_unlock_bh(&priv->beacon_lock);
+                return;
+        }
+
+        /* Free the old SKB first */
+        dev_kfree_skb_any(priv->beacon);
+
+        /* Get a new beacon */
+        priv->beacon = ieee80211_beacon_get(priv->hw, priv->vif);
+        if (!priv->beacon) {
+                spin_unlock_bh(&priv->beacon_lock);
+                return;
+        }
+
+        info = IEEE80211_SKB_CB(priv->beacon);
+        if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
+                struct ieee80211_hdr *hdr =
+                        (struct ieee80211_hdr *) priv->beacon->data;
+                priv->seq_no += 0x10;
+                hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
+                hdr->seq_ctrl |= cpu_to_le16(priv->seq_no);
+        }
+
+        tx_ctl.type = ATH9K_HTC_NORMAL;
+        beacon_hdr.vif_index = avp->index;
+        tx_fhdr = skb_push(priv->beacon, sizeof(beacon_hdr));
+        memcpy(tx_fhdr, (u8 *) &beacon_hdr, sizeof(beacon_hdr));
+
+        htc_send(priv->htc, priv->beacon, priv->beacon_ep, &tx_ctl);
+
+        spin_unlock_bh(&priv->beacon_lock);
+}
+
+
+void ath9k_htc_beacon_config(struct ath9k_htc_priv *priv,
+                             struct ieee80211_vif *vif)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        enum nl80211_iftype iftype;
+        struct htc_beacon_config *cur_conf = &priv->cur_beacon_conf;
+
+        if (vif) {
+                struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
+                iftype = vif->type;
+                cur_conf->beacon_interval = bss_conf->beacon_int;
+                cur_conf->dtim_period = bss_conf->dtim_period;
+                cur_conf->listen_interval = 1;
+                cur_conf->dtim_count = 1;
+                cur_conf->bmiss_timeout =
+                        ATH_DEFAULT_BMISS_LIMIT * cur_conf->beacon_interval;
+        } else
+                iftype = priv->ah->opmode;
+
+        if (cur_conf->beacon_interval == 0)
+                cur_conf->beacon_interval = 100;
+
+        switch (iftype) {
+        case NL80211_IFTYPE_STATION:
+                ath9k_htc_beacon_config_sta(priv, cur_conf);
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                ath9k_htc_beacon_config_adhoc(priv, cur_conf);
+                break;
+        default:
+                ath_print(common, ATH_DBG_CONFIG,
+                          "Unsupported beaconing mode\n");
+                return;
+        }
+}
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
new file mode 100644
index 000000000000..aed53573c547
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -0,0 +1,723 @@
+/*
+ * Copyright (c) 2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "htc.h"
+
+MODULE_AUTHOR("Atheros Communications");
+MODULE_LICENSE("Dual BSD/GPL");
+MODULE_DESCRIPTION("Atheros driver 802.11n HTC based wireless devices");
+
+static unsigned int ath9k_debug = ATH_DBG_DEFAULT;
+module_param_named(debug, ath9k_debug, uint, 0);
+MODULE_PARM_DESC(debug, "Debugging mask");
+
+int htc_modparam_nohwcrypt;
+module_param_named(nohwcrypt, htc_modparam_nohwcrypt, int, 0444);
+MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption");
+
+#define CHAN2G(_freq, _idx)  { \
+        .center_freq = (_freq), \
+        .hw_value = (_idx), \
+        .max_power = 20, \
+}
+
+static struct ieee80211_channel ath9k_2ghz_channels[] = {
+        CHAN2G(2412, 0), /* Channel 1 */
+        CHAN2G(2417, 1), /* Channel 2 */
+        CHAN2G(2422, 2), /* Channel 3 */
+        CHAN2G(2427, 3), /* Channel 4 */
+        CHAN2G(2432, 4), /* Channel 5 */
+        CHAN2G(2437, 5), /* Channel 6 */
+        CHAN2G(2442, 6), /* Channel 7 */
+        CHAN2G(2447, 7), /* Channel 8 */
+        CHAN2G(2452, 8), /* Channel 9 */
+        CHAN2G(2457, 9), /* Channel 10 */
+        CHAN2G(2462, 10), /* Channel 11 */
+        CHAN2G(2467, 11), /* Channel 12 */
+        CHAN2G(2472, 12), /* Channel 13 */
+        CHAN2G(2484, 13), /* Channel 14 */
+};
+
+/* Atheros hardware rate code addition for short premble */
+#define SHPCHECK(__hw_rate, __flags) \
+        ((__flags & IEEE80211_RATE_SHORT_PREAMBLE) ? (__hw_rate | 0x04) : 0)
+
+#define RATE(_bitrate, _hw_rate, _flags) {              \
+        .bitrate        = (_bitrate),                   \
+        .flags          = (_flags),                     \
+        .hw_value       = (_hw_rate),                   \
+        .hw_value_short = (SHPCHECK(_hw_rate, _flags))  \
+}
+
+static struct ieee80211_rate ath9k_legacy_rates[] = {
+        RATE(10, 0x1b, 0),
+        RATE(20, 0x1a, IEEE80211_RATE_SHORT_PREAMBLE), /* shortp : 0x1e */
+        RATE(55, 0x19, IEEE80211_RATE_SHORT_PREAMBLE), /* shortp: 0x1d */
+        RATE(110, 0x18, IEEE80211_RATE_SHORT_PREAMBLE), /* short: 0x1c */
+        RATE(60, 0x0b, 0),
+        RATE(90, 0x0f, 0),
+        RATE(120, 0x0a, 0),
+        RATE(180, 0x0e, 0),
+        RATE(240, 0x09, 0),
+        RATE(360, 0x0d, 0),
+        RATE(480, 0x08, 0),
+        RATE(540, 0x0c, 0),
+};
+
+static int ath9k_htc_wait_for_target(struct ath9k_htc_priv *priv)
+{
+        int time_left;
+
+        /* Firmware can take up to 50ms to get ready, to be safe use 1 second */
+        time_left = wait_for_completion_timeout(&priv->htc->target_wait, HZ);
+        if (!time_left) {
+                dev_err(priv->dev, "ath9k_htc: Target is unresponsive\n");
+                return -ETIMEDOUT;
+        }
+
+        return 0;
+}
+
+static void ath9k_deinit_priv(struct ath9k_htc_priv *priv)
+{
+        ath9k_htc_exit_debug(priv->ah);
+        ath9k_hw_deinit(priv->ah);
+        tasklet_kill(&priv->wmi_tasklet);
+        tasklet_kill(&priv->rx_tasklet);
+        tasklet_kill(&priv->tx_tasklet);
+        kfree(priv->ah);
+        priv->ah = NULL;
+}
+
+static void ath9k_deinit_device(struct ath9k_htc_priv *priv)
+{
+        struct ieee80211_hw *hw = priv->hw;
+
+        wiphy_rfkill_stop_polling(hw->wiphy);
+        ath9k_deinit_leds(priv);
+        ieee80211_unregister_hw(hw);
+        ath9k_rx_cleanup(priv);
+        ath9k_tx_cleanup(priv);
+        ath9k_deinit_priv(priv);
+}
+
+static inline int ath9k_htc_connect_svc(struct ath9k_htc_priv *priv,
+                                        u16 service_id,
+                                        void (*tx) (void *,
+                                                    struct sk_buff *,
+                                                    enum htc_endpoint_id,
+                                                    bool txok),
+                                        enum htc_endpoint_id *ep_id)
+{
+        struct htc_service_connreq req;
+
+        memset(&req, 0, sizeof(struct htc_service_connreq));
+
+        req.service_id = service_id;
+        req.ep_callbacks.priv = priv;
+        req.ep_callbacks.rx = ath9k_htc_rxep;
+        req.ep_callbacks.tx = tx;
+
+        return htc_connect_service(priv->htc, &req, ep_id);
+}
+
+static int ath9k_init_htc_services(struct ath9k_htc_priv *priv)
+{
+        int ret;
+
+        /* WMI CMD*/
+        ret = ath9k_wmi_connect(priv->htc, priv->wmi, &priv->wmi_cmd_ep);
+        if (ret)
+                goto err;
+
+        /* Beacon */
+        ret = ath9k_htc_connect_svc(priv, WMI_BEACON_SVC, NULL,
+                                    &priv->beacon_ep);
+        if (ret)
+                goto err;
+
+        /* CAB */
+        ret = ath9k_htc_connect_svc(priv, WMI_CAB_SVC, ath9k_htc_txep,
+                                    &priv->cab_ep);
+        if (ret)
+                goto err;
+
+
+        /* UAPSD */
+        ret = ath9k_htc_connect_svc(priv, WMI_UAPSD_SVC, ath9k_htc_txep,
+                                    &priv->uapsd_ep);
+        if (ret)
+                goto err;
+
+        /* MGMT */
+        ret = ath9k_htc_connect_svc(priv, WMI_MGMT_SVC, ath9k_htc_txep,
+                                    &priv->mgmt_ep);
+        if (ret)
+                goto err;
+
+        /* DATA BE */
+        ret = ath9k_htc_connect_svc(priv, WMI_DATA_BE_SVC, ath9k_htc_txep,
+                                    &priv->data_be_ep);
+        if (ret)
+                goto err;
+
+        /* DATA BK */
+        ret = ath9k_htc_connect_svc(priv, WMI_DATA_BK_SVC, ath9k_htc_txep,
+                                    &priv->data_bk_ep);
+        if (ret)
+                goto err;
+
+        /* DATA VI */
+        ret = ath9k_htc_connect_svc(priv, WMI_DATA_VI_SVC, ath9k_htc_txep,
+                                    &priv->data_vi_ep);
+        if (ret)
+                goto err;
+
+        /* DATA VO */
+        ret = ath9k_htc_connect_svc(priv, WMI_DATA_VO_SVC, ath9k_htc_txep,
+                                    &priv->data_vo_ep);
+        if (ret)
+                goto err;
+
+        ret = htc_init(priv->htc);
+        if (ret)
+                goto err;
+
+        return 0;
+
+err:
+        dev_err(priv->dev, "ath9k_htc: Unable to initialize HTC services\n");
+        return ret;
+}
+
+static int ath9k_reg_notifier(struct wiphy *wiphy,
+                              struct regulatory_request *request)
+{
+        struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
+        struct ath9k_htc_priv *priv = hw->priv;
+
+        return ath_reg_notifier_apply(wiphy, request,
+                                      ath9k_hw_regulatory(priv->ah));
+}
+
+static unsigned int ath9k_ioread32(void *hw_priv, u32 reg_offset)
+{
+        struct ath_hw *ah = (struct ath_hw *) hw_priv;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) common->priv;
+        __be32 val, reg = cpu_to_be32(reg_offset);
+        int r;
+
+        r = ath9k_wmi_cmd(priv->wmi, WMI_REG_READ_CMDID,
+                          (u8 *) &reg, sizeof(reg),
+                          (u8 *) &val, sizeof(val),
+                          100);
+        if (unlikely(r)) {
+                ath_print(common, ATH_DBG_WMI,
+                          "REGISTER READ FAILED: (0x%04x, %d)\n",
+                           reg_offset, r);
+                return -EIO;
+        }
+
+        return be32_to_cpu(val);
+}
+
+static void ath9k_iowrite32(void *hw_priv, u32 val, u32 reg_offset)
+{
+        struct ath_hw *ah = (struct ath_hw *) hw_priv;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) common->priv;
+        __be32 buf[2] = {
+                cpu_to_be32(reg_offset),
+                cpu_to_be32(val),
+        };
+        int r;
+
+        r = ath9k_wmi_cmd(priv->wmi, WMI_REG_WRITE_CMDID,
+                          (u8 *) &buf, sizeof(buf),
+                          (u8 *) &val, sizeof(val),
+                          100);
+        if (unlikely(r)) {
+                ath_print(common, ATH_DBG_WMI,
+                          "REGISTER WRITE FAILED:(0x%04x, %d)\n",
+                          reg_offset, r);
+        }
+}
+
+static const struct ath_ops ath9k_common_ops = {
+        .read = ath9k_ioread32,
+        .write = ath9k_iowrite32,
+};
+
+static void ath_usb_read_cachesize(struct ath_common *common, int *csz)
+{
+        *csz = L1_CACHE_BYTES >> 2;
+}
+
+static bool ath_usb_eeprom_read(struct ath_common *common, u32 off, u16 *data)
+{
+        struct ath_hw *ah = (struct ath_hw *) common->ah;
+
+        (void)REG_READ(ah, AR5416_EEPROM_OFFSET + (off << AR5416_EEPROM_S));
+
+        if (!ath9k_hw_wait(ah,
+                           AR_EEPROM_STATUS_DATA,
+                           AR_EEPROM_STATUS_DATA_BUSY |
+                           AR_EEPROM_STATUS_DATA_PROT_ACCESS, 0,
+                           AH_WAIT_TIMEOUT))
+                return false;
+
+        *data = MS(REG_READ(ah, AR_EEPROM_STATUS_DATA),
+                   AR_EEPROM_STATUS_DATA_VAL);
+
+        return true;
+}
+
+static const struct ath_bus_ops ath9k_usb_bus_ops = {
+        .ath_bus_type = ATH_USB,
+        .read_cachesize = ath_usb_read_cachesize,
+        .eeprom_read = ath_usb_eeprom_read,
+};
+
+static void setup_ht_cap(struct ath9k_htc_priv *priv,
+                         struct ieee80211_sta_ht_cap *ht_info)
+{
+        ht_info->ht_supported = true;
+        ht_info->cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
+                       IEEE80211_HT_CAP_SM_PS |
+                       IEEE80211_HT_CAP_SGI_40 |
+                       IEEE80211_HT_CAP_DSSSCCK40;
+
+        ht_info->ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
+        ht_info->ampdu_density = IEEE80211_HT_MPDU_DENSITY_8;
+
+        memset(&ht_info->mcs, 0, sizeof(ht_info->mcs));
+        ht_info->mcs.rx_mask[0] = 0xff;
+        ht_info->mcs.tx_params |= IEEE80211_HT_MCS_TX_DEFINED;
+}
+
+static int ath9k_init_queues(struct ath9k_htc_priv *priv)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(priv->hwq_map); i++)
+                priv->hwq_map[i] = -1;
+
+        if (!ath9k_htc_txq_setup(priv, ATH9K_WME_AC_BE)) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to setup xmit queue for BE traffic\n");
+                goto err;
+        }
+
+        if (!ath9k_htc_txq_setup(priv, ATH9K_WME_AC_BK)) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to setup xmit queue for BK traffic\n");
+                goto err;
+        }
+        if (!ath9k_htc_txq_setup(priv, ATH9K_WME_AC_VI)) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to setup xmit queue for VI traffic\n");
+                goto err;
+        }
+        if (!ath9k_htc_txq_setup(priv, ATH9K_WME_AC_VO)) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to setup xmit queue for VO traffic\n");
+                goto err;
+        }
+
+        return 0;
+
+err:
+        return -EINVAL;
+}
+
+static void ath9k_init_crypto(struct ath9k_htc_priv *priv)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        int i = 0;
+
+        /* Get the hardware key cache size. */
+        common->keymax = priv->ah->caps.keycache_size;
+        if (common->keymax > ATH_KEYMAX) {
+                ath_print(common, ATH_DBG_ANY,
+                          "Warning, using only %u entries in %u key cache\n",
+                          ATH_KEYMAX, common->keymax);
+                common->keymax = ATH_KEYMAX;
+        }
+
+        /*
+         * Reset the key cache since some parts do not
+         * reset the contents on initial power up.
+         */
+        for (i = 0; i < common->keymax; i++)
+                ath9k_hw_keyreset(priv->ah, (u16) i);
+
+        if (ath9k_hw_getcapability(priv->ah, ATH9K_CAP_CIPHER,
+                                   ATH9K_CIPHER_TKIP, NULL)) {
+                /*
+                 * Whether we should enable h/w TKIP MIC.
+                 * XXX: if we don't support WME TKIP MIC, then we wouldn't
+                 * report WMM capable, so it's always safe to turn on
+                 * TKIP MIC in this case.
+                 */
+                ath9k_hw_setcapability(priv->ah, ATH9K_CAP_TKIP_MIC, 0, 1, NULL);
+        }
+
+        /*
+         * Check whether the separate key cache entries
+         * are required to handle both tx+rx MIC keys.
+         * With split mic keys the number of stations is limited
+         * to 27 otherwise 59.
+         */
+        if (ath9k_hw_getcapability(priv->ah, ATH9K_CAP_CIPHER,
+                                   ATH9K_CIPHER_TKIP, NULL)
+            && ath9k_hw_getcapability(priv->ah, ATH9K_CAP_CIPHER,
+                                      ATH9K_CIPHER_MIC, NULL)
+            && ath9k_hw_getcapability(priv->ah, ATH9K_CAP_TKIP_SPLIT,
+                                      0, NULL))
+                common->splitmic = 1;
+
+        /* turn on mcast key search if possible */
+        if (!ath9k_hw_getcapability(priv->ah, ATH9K_CAP_MCAST_KEYSRCH, 0, NULL))
+                (void)ath9k_hw_setcapability(priv->ah, ATH9K_CAP_MCAST_KEYSRCH,
+                                             1, 1, NULL);
+}
+
+static void ath9k_init_channels_rates(struct ath9k_htc_priv *priv)
+{
+        if (test_bit(ATH9K_MODE_11G, priv->ah->caps.wireless_modes)) {
+                priv->sbands[IEEE80211_BAND_2GHZ].channels =
+                        ath9k_2ghz_channels;
+                priv->sbands[IEEE80211_BAND_2GHZ].band = IEEE80211_BAND_2GHZ;
+                priv->sbands[IEEE80211_BAND_2GHZ].n_channels =
+                        ARRAY_SIZE(ath9k_2ghz_channels);
+                priv->sbands[IEEE80211_BAND_2GHZ].bitrates = ath9k_legacy_rates;
+                priv->sbands[IEEE80211_BAND_2GHZ].n_bitrates =
+                        ARRAY_SIZE(ath9k_legacy_rates);
+        }
+}
+
+static void ath9k_init_misc(struct ath9k_htc_priv *priv)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+
+        common->tx_chainmask = priv->ah->caps.tx_chainmask;
+        common->rx_chainmask = priv->ah->caps.rx_chainmask;
+
+        if (priv->ah->caps.hw_caps & ATH9K_HW_CAP_BSSIDMASK)
+                memcpy(common->bssidmask, ath_bcast_mac, ETH_ALEN);
+
+        priv->op_flags |= OP_TXAGGR;
+        priv->ah->opmode = NL80211_IFTYPE_STATION;
+}
+
+static int ath9k_init_priv(struct ath9k_htc_priv *priv, u16 devid)
+{
+        struct ath_hw *ah = NULL;
+        struct ath_common *common;
+        int ret = 0, csz = 0;
+
+        priv->op_flags |= OP_INVALID;
+
+        ah = kzalloc(sizeof(struct ath_hw), GFP_KERNEL);
+        if (!ah)
+                return -ENOMEM;
+
+        ah->hw_version.devid = devid;
+        ah->hw_version.subsysid = 0; /* FIXME */
+        priv->ah = ah;
+
+        common = ath9k_hw_common(ah);
+        common->ops = &ath9k_common_ops;
+        common->bus_ops = &ath9k_usb_bus_ops;
+        common->ah = ah;
+        common->hw = priv->hw;
+        common->priv = priv;
+        common->debug_mask = ath9k_debug;
+
+        spin_lock_init(&priv->wmi->wmi_lock);
+        spin_lock_init(&priv->beacon_lock);
+        spin_lock_init(&priv->tx_lock);
+        mutex_init(&priv->mutex);
+        mutex_init(&priv->aggr_work.mutex);
+        mutex_init(&priv->htc_pm_lock);
+        tasklet_init(&priv->wmi_tasklet, ath9k_wmi_tasklet,
+                     (unsigned long)priv);
+        tasklet_init(&priv->rx_tasklet, ath9k_rx_tasklet,
+                     (unsigned long)priv);
+        tasklet_init(&priv->tx_tasklet, ath9k_tx_tasklet, (unsigned long)priv);
+        INIT_DELAYED_WORK(&priv->ath9k_aggr_work, ath9k_htc_aggr_work);
+        INIT_DELAYED_WORK(&priv->ath9k_ani_work, ath9k_ani_work);
+        INIT_WORK(&priv->ps_work, ath9k_ps_work);
+
+        /*
+         * Cache line size is used to size and align various
+         * structures used to communicate with the hardware.
+         */
+        ath_read_cachesize(common, &csz);
+        common->cachelsz = csz << 2; /* convert to bytes */
+
+        ret = ath9k_hw_init(ah);
+        if (ret) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to initialize hardware; "
+                          "initialization status: %d\n", ret);
+                goto err_hw;
+        }
+
+        ret = ath9k_htc_init_debug(ah);
+        if (ret) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to create debugfs files\n");
+                goto err_debug;
+        }
+
+        ret = ath9k_init_queues(priv);
+        if (ret)
+                goto err_queues;
+
+        ath9k_init_crypto(priv);
+        ath9k_init_channels_rates(priv);
+        ath9k_init_misc(priv);
+
+        return 0;
+
+err_queues:
+        ath9k_htc_exit_debug(ah);
+err_debug:
+        ath9k_hw_deinit(ah);
+err_hw:
+
+        kfree(ah);
+        priv->ah = NULL;
+
+        return ret;
+}
+
+static void ath9k_set_hw_capab(struct ath9k_htc_priv *priv,
+                               struct ieee80211_hw *hw)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+
+        hw->flags = IEEE80211_HW_SIGNAL_DBM |
+                IEEE80211_HW_AMPDU_AGGREGATION |
+                IEEE80211_HW_SPECTRUM_MGMT |
+                IEEE80211_HW_HAS_RATE_CONTROL |
+                IEEE80211_HW_RX_INCLUDES_FCS |
+                IEEE80211_HW_SUPPORTS_PS |
+                IEEE80211_HW_PS_NULLFUNC_STACK;
+
+        hw->wiphy->interface_modes =
+                BIT(NL80211_IFTYPE_STATION) |
+                BIT(NL80211_IFTYPE_ADHOC);
+
+        hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
+
+        hw->queues = 4;
+        hw->channel_change_time = 5000;
+        hw->max_listen_interval = 10;
+        hw->vif_data_size = sizeof(struct ath9k_htc_vif);
+        hw->sta_data_size = sizeof(struct ath9k_htc_sta);
+
+        /* tx_frame_hdr is larger than tx_mgmt_hdr anyway */
+        hw->extra_tx_headroom = sizeof(struct tx_frame_hdr) +
+                sizeof(struct htc_frame_hdr) + 4;
+
+        if (test_bit(ATH9K_MODE_11G, priv->ah->caps.wireless_modes))
+                hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
+                        &priv->sbands[IEEE80211_BAND_2GHZ];
+
+        if (priv->ah->caps.hw_caps & ATH9K_HW_CAP_HT) {
+                if (test_bit(ATH9K_MODE_11G, priv->ah->caps.wireless_modes))
+                        setup_ht_cap(priv,
+                                     &priv->sbands[IEEE80211_BAND_2GHZ].ht_cap);
+        }
+
+        SET_IEEE80211_PERM_ADDR(hw, common->macaddr);
+}
+
+static int ath9k_init_device(struct ath9k_htc_priv *priv, u16 devid)
+{
+        struct ieee80211_hw *hw = priv->hw;
+        struct ath_common *common;
+        struct ath_hw *ah;
+        int error = 0;
+        struct ath_regulatory *reg;
+
+        /* Bring up device */
+        error = ath9k_init_priv(priv, devid);
+        if (error != 0)
+                goto err_init;
+
+        ah = priv->ah;
+        common = ath9k_hw_common(ah);
+        ath9k_set_hw_capab(priv, hw);
+
+        /* Initialize regulatory */
+        error = ath_regd_init(&common->regulatory, priv->hw->wiphy,
+                              ath9k_reg_notifier);
+        if (error)
+                goto err_regd;
+
+        reg = &common->regulatory;
+
+        /* Setup TX */
+        error = ath9k_tx_init(priv);
+        if (error != 0)
+                goto err_tx;
+
+        /* Setup RX */
+        error = ath9k_rx_init(priv);
+        if (error != 0)
+                goto err_rx;
+
+        /* Register with mac80211 */
+        error = ieee80211_register_hw(hw);
+        if (error)
+                goto err_register;
+
+        /* Handle world regulatory */
+        if (!ath_is_world_regd(reg)) {
+                error = regulatory_hint(hw->wiphy, reg->alpha2);
+                if (error)
+                        goto err_world;
+        }
+
+        ath9k_init_leds(priv);
+        ath9k_start_rfkill_poll(priv);
+
+        return 0;
+
+err_world:
+        ieee80211_unregister_hw(hw);
+err_register:
+        ath9k_rx_cleanup(priv);
+err_rx:
+        ath9k_tx_cleanup(priv);
+err_tx:
+        /* Nothing */
+err_regd:
+        ath9k_deinit_priv(priv);
+err_init:
+        return error;
+}
+
+int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev,
+                           u16 devid)
+{
+        struct ieee80211_hw *hw;
+        struct ath9k_htc_priv *priv;
+        int ret;
+
+        hw = ieee80211_alloc_hw(sizeof(struct ath9k_htc_priv), &ath9k_htc_ops);
+        if (!hw)
+                return -ENOMEM;
+
+        priv = hw->priv;
+        priv->hw = hw;
+        priv->htc = htc_handle;
+        priv->dev = dev;
+        htc_handle->drv_priv = priv;
+        SET_IEEE80211_DEV(hw, priv->dev);
+
+        ret = ath9k_htc_wait_for_target(priv);
+        if (ret)
+                goto err_free;
+
+        priv->wmi = ath9k_init_wmi(priv);
+        if (!priv->wmi) {
+                ret = -EINVAL;
+                goto err_free;
+        }
+
+        ret = ath9k_init_htc_services(priv);
+        if (ret)
+                goto err_init;
+
+        ret = ath9k_init_device(priv, devid);
+        if (ret)
+                goto err_init;
+
+        return 0;
+
+err_init:
+        ath9k_deinit_wmi(priv);
+err_free:
+        ieee80211_free_hw(hw);
+        return ret;
+}
+
+void ath9k_htc_disconnect_device(struct htc_target *htc_handle, bool hotunplug)
+{
+        if (htc_handle->drv_priv) {
+                ath9k_deinit_device(htc_handle->drv_priv);
+                ath9k_deinit_wmi(htc_handle->drv_priv);
+                ieee80211_free_hw(htc_handle->drv_priv->hw);
+        }
+}
+
+#ifdef CONFIG_PM
+int ath9k_htc_resume(struct htc_target *htc_handle)
+{
+        int ret;
+
+        ret = ath9k_htc_wait_for_target(htc_handle->drv_priv);
+        if (ret)
+                return ret;
+
+        ret = ath9k_init_htc_services(htc_handle->drv_priv);
+        return ret;
+}
+#endif
+
+static int __init ath9k_htc_init(void)
+{
+        int error;
+
+        error = ath9k_htc_debug_create_root();
+        if (error < 0) {
+                printk(KERN_ERR
+                        "ath9k_htc: Unable to create debugfs root: %d\n",
+                        error);
+                goto err_dbg;
+        }
+
+        error = ath9k_hif_usb_init();
+        if (error < 0) {
+                printk(KERN_ERR
+                        "ath9k_htc: No USB devices found,"
+                        " driver not installed.\n");
+                error = -ENODEV;
+                goto err_usb;
+        }
+
+        return 0;
+
+err_usb:
+        ath9k_htc_debug_remove_root();
+err_dbg:
+        return error;
+}
+module_init(ath9k_htc_init);
+
+static void __exit ath9k_htc_exit(void)
+{
+        ath9k_hif_usb_exit();
+        ath9k_htc_debug_remove_root();
+        printk(KERN_INFO "ath9k_htc: Driver unloaded\n");
+}
+module_exit(ath9k_htc_exit);
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
new file mode 100644
index 000000000000..eb7722b2cfcc
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -0,0 +1,1733 @@
+/*
+ * Copyright (c) 2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "htc.h"
+
+#ifdef CONFIG_ATH9K_HTC_DEBUGFS
+static struct dentry *ath9k_debugfs_root;
+#endif
+
+/*************/
+/* Utilities */
+/*************/
+
+static void ath_update_txpow(struct ath9k_htc_priv *priv)
+{
+        struct ath_hw *ah = priv->ah;
+        u32 txpow;
+
+        if (priv->curtxpow != priv->txpowlimit) {
+                ath9k_hw_set_txpowerlimit(ah, priv->txpowlimit);
+                /* read back in case value is clamped */
+                ath9k_hw_getcapability(ah, ATH9K_CAP_TXPOW, 1, &txpow);
+                priv->curtxpow = txpow;
+        }
+}
+
+/* HACK Alert: Use 11NG for 2.4, use 11NA for 5 */
+static enum htc_phymode ath9k_htc_get_curmode(struct ath9k_htc_priv *priv,
+                                              struct ath9k_channel *ichan)
+{
+        enum htc_phymode mode;
+
+        mode = HTC_MODE_AUTO;
+
+        switch (ichan->chanmode) {
+        case CHANNEL_G:
+        case CHANNEL_G_HT20:
+        case CHANNEL_G_HT40PLUS:
+        case CHANNEL_G_HT40MINUS:
+                mode = HTC_MODE_11NG;
+                break;
+        case CHANNEL_A:
+        case CHANNEL_A_HT20:
+        case CHANNEL_A_HT40PLUS:
+        case CHANNEL_A_HT40MINUS:
+                mode = HTC_MODE_11NA;
+                break;
+        default:
+                break;
+        }
+
+        return mode;
+}
+
+static bool ath9k_htc_setpower(struct ath9k_htc_priv *priv,
+                               enum ath9k_power_mode mode)
+{
+        bool ret;
+
+        mutex_lock(&priv->htc_pm_lock);
+        ret = ath9k_hw_setpower(priv->ah, mode);
+        mutex_unlock(&priv->htc_pm_lock);
+
+        return ret;
+}
+
+void ath9k_htc_ps_wakeup(struct ath9k_htc_priv *priv)
+{
+        mutex_lock(&priv->htc_pm_lock);
+        if (++priv->ps_usecount != 1)
+                goto unlock;
+        ath9k_hw_setpower(priv->ah, ATH9K_PM_AWAKE);
+
+unlock:
+        mutex_unlock(&priv->htc_pm_lock);
+}
+
+void ath9k_htc_ps_restore(struct ath9k_htc_priv *priv)
+{
+        mutex_lock(&priv->htc_pm_lock);
+        if (--priv->ps_usecount != 0)
+                goto unlock;
+
+        if (priv->ps_enabled)
+                ath9k_hw_setpower(priv->ah, ATH9K_PM_NETWORK_SLEEP);
+unlock:
+        mutex_unlock(&priv->htc_pm_lock);
+}
+
+void ath9k_ps_work(struct work_struct *work)
+{
+        struct ath9k_htc_priv *priv =
+                container_of(work, struct ath9k_htc_priv,
+                             ps_work);
+        ath9k_htc_setpower(priv, ATH9K_PM_AWAKE);
+
+        /* The chip wakes up after receiving the first beacon
+           while network sleep is enabled. For the driver to
+           be in sync with the hw, set the chip to awake and
+           only then set it to sleep.
+         */
+        ath9k_htc_setpower(priv, ATH9K_PM_NETWORK_SLEEP);
+}
+
+static int ath9k_htc_set_channel(struct ath9k_htc_priv *priv,
+                                 struct ieee80211_hw *hw,
+                                 struct ath9k_channel *hchan)
+{
+        struct ath_hw *ah = priv->ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ieee80211_conf *conf = &common->hw->conf;
+        bool fastcc = true;
+        struct ieee80211_channel *channel = hw->conf.channel;
+        enum htc_phymode mode;
+        u16 htc_mode;
+        u8 cmd_rsp;
+        int ret;
+
+        if (priv->op_flags & OP_INVALID)
+                return -EIO;
+
+        if (priv->op_flags & OP_FULL_RESET)
+                fastcc = false;
+
+        /* Fiddle around with fastcc later on, for now just use full reset */
+        fastcc = false;
+        ath9k_htc_ps_wakeup(priv);
+        htc_stop(priv->htc);
+        WMI_CMD(WMI_DISABLE_INTR_CMDID);
+        WMI_CMD(WMI_DRAIN_TXQ_ALL_CMDID);
+        WMI_CMD(WMI_STOP_RECV_CMDID);
+
+        ath_print(common, ATH_DBG_CONFIG,
+                  "(%u MHz) -> (%u MHz), HT: %d, HT40: %d\n",
+                  priv->ah->curchan->channel,
+                  channel->center_freq, conf_is_ht(conf), conf_is_ht40(conf));
+
+        ret = ath9k_hw_reset(ah, hchan, fastcc);
+        if (ret) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to reset channel (%u Mhz) "
+                          "reset status %d\n", channel->center_freq, ret);
+                ath9k_htc_ps_restore(priv);
+                goto err;
+        }
+
+        ath_update_txpow(priv);
+
+        WMI_CMD(WMI_START_RECV_CMDID);
+        if (ret)
+                goto err;
+
+        ath9k_host_rx_init(priv);
+
+        mode = ath9k_htc_get_curmode(priv, hchan);
+        htc_mode = cpu_to_be16(mode);
+        WMI_CMD_BUF(WMI_SET_MODE_CMDID, &htc_mode);
+        if (ret)
+                goto err;
+
+        WMI_CMD(WMI_ENABLE_INTR_CMDID);
+        if (ret)
+                goto err;
+
+        htc_start(priv->htc);
+
+        priv->op_flags &= ~OP_FULL_RESET;
+err:
+        ath9k_htc_ps_restore(priv);
+        return ret;
+}
+
+static int ath9k_htc_add_monitor_interface(struct ath9k_htc_priv *priv)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ath9k_htc_target_vif hvif;
+        int ret = 0;
+        u8 cmd_rsp;
+
+        if (priv->nvifs > 0)
+                return -ENOBUFS;
+
+        memset(&hvif, 0, sizeof(struct ath9k_htc_target_vif));
+        memcpy(&hvif.myaddr, common->macaddr, ETH_ALEN);
+
+        hvif.opmode = cpu_to_be32(HTC_M_MONITOR);
+        priv->ah->opmode = NL80211_IFTYPE_MONITOR;
+        hvif.index = priv->nvifs;
+
+        WMI_CMD_BUF(WMI_VAP_CREATE_CMDID, &hvif);
+        if (ret)
+                return ret;
+
+        priv->nvifs++;
+        return 0;
+}
+
+static int ath9k_htc_remove_monitor_interface(struct ath9k_htc_priv *priv)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ath9k_htc_target_vif hvif;
+        int ret = 0;
+        u8 cmd_rsp;
+
+        memset(&hvif, 0, sizeof(struct ath9k_htc_target_vif));
+        memcpy(&hvif.myaddr, common->macaddr, ETH_ALEN);
+        hvif.index = 0; /* Should do for now */
+        WMI_CMD_BUF(WMI_VAP_REMOVE_CMDID, &hvif);
+        priv->nvifs--;
+
+        return ret;
+}
+
+static int ath9k_htc_add_station(struct ath9k_htc_priv *priv,
+                                 struct ieee80211_vif *vif,
+                                 struct ieee80211_sta *sta)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ath9k_htc_target_sta tsta;
+        struct ath9k_htc_vif *avp = (struct ath9k_htc_vif *) vif->drv_priv;
+        struct ath9k_htc_sta *ista;
+        int ret;
+        u8 cmd_rsp;
+
+        if (priv->nstations >= ATH9K_HTC_MAX_STA)
+                return -ENOBUFS;
+
+        memset(&tsta, 0, sizeof(struct ath9k_htc_target_sta));
+
+        if (sta) {
+                ista = (struct ath9k_htc_sta *) sta->drv_priv;
+                memcpy(&tsta.macaddr, sta->addr, ETH_ALEN);
+                memcpy(&tsta.bssid, common->curbssid, ETH_ALEN);
+                tsta.associd = common->curaid;
+                tsta.is_vif_sta = 0;
+                tsta.valid = true;
+                ista->index = priv->nstations;
+        } else {
+                memcpy(&tsta.macaddr, vif->addr, ETH_ALEN);
+                tsta.is_vif_sta = 1;
+        }
+
+        tsta.sta_index = priv->nstations;
+        tsta.vif_index = avp->index;
+        tsta.maxampdu = 0xffff;
+        if (sta && sta->ht_cap.ht_supported)
+                tsta.flags = cpu_to_be16(ATH_HTC_STA_HT);
+
+        WMI_CMD_BUF(WMI_NODE_CREATE_CMDID, &tsta);
+        if (ret) {
+                if (sta)
+                        ath_print(common, ATH_DBG_FATAL,
+                          "Unable to add station entry for: %pM\n", sta->addr);
+                return ret;
+        }
+
+        if (sta)
+                ath_print(common, ATH_DBG_CONFIG,
+                          "Added a station entry for: %pM (idx: %d)\n",
+                          sta->addr, tsta.sta_index);
+
+        priv->nstations++;
+        return 0;
+}
+
+static int ath9k_htc_remove_station(struct ath9k_htc_priv *priv,
+                                    struct ieee80211_vif *vif,
+                                    struct ieee80211_sta *sta)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ath9k_htc_sta *ista;
+        int ret;
+        u8 cmd_rsp, sta_idx;
+
+        if (sta) {
+                ista = (struct ath9k_htc_sta *) sta->drv_priv;
+                sta_idx = ista->index;
+        } else {
+                sta_idx = 0;
+        }
+
+        WMI_CMD_BUF(WMI_NODE_REMOVE_CMDID, &sta_idx);
+        if (ret) {
+                if (sta)
+                        ath_print(common, ATH_DBG_FATAL,
+                          "Unable to remove station entry for: %pM\n",
+                          sta->addr);
+                return ret;
+        }
+
+        if (sta)
+                ath_print(common, ATH_DBG_CONFIG,
+                          "Removed a station entry for: %pM (idx: %d)\n",
+                          sta->addr, sta_idx);
+
+        priv->nstations--;
+        return 0;
+}
+
+static int ath9k_htc_update_cap_target(struct ath9k_htc_priv *priv)
+{
+        struct ath9k_htc_cap_target tcap;
+        int ret;
+        u8 cmd_rsp;
+
+        memset(&tcap, 0, sizeof(struct ath9k_htc_cap_target));
+
+        /* FIXME: Values are hardcoded */
+        tcap.flags = 0x240c40;
+        tcap.flags_ext = 0x80601000;
+        tcap.ampdu_limit = 0xffff0000;
+        tcap.ampdu_subframes = 20;
+        tcap.tx_chainmask_legacy = 1;
+        tcap.protmode = 1;
+        tcap.tx_chainmask = 1;
+
+        WMI_CMD_BUF(WMI_TARGET_IC_UPDATE_CMDID, &tcap);
+
+        return ret;
+}
+
+static int ath9k_htc_init_rate(struct ath9k_htc_priv *priv,
+                                 struct ieee80211_vif *vif,
+                                 struct ieee80211_sta *sta)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ath9k_htc_sta *ista = (struct ath9k_htc_sta *) sta->drv_priv;
+        struct ieee80211_supported_band *sband;
+        struct ath9k_htc_target_rate trate;
+        u32 caps = 0;
+        u8 cmd_rsp;
+        int i, j, ret;
+
+        memset(&trate, 0, sizeof(trate));
+
+        /* Only 2GHz is supported */
+        sband = priv->hw->wiphy->bands[IEEE80211_BAND_2GHZ];
+
+        for (i = 0, j = 0; i < sband->n_bitrates; i++) {
+                if (sta->supp_rates[sband->band] & BIT(i)) {
+                        priv->tgt_rate.rates.legacy_rates.rs_rates[j]
+                                = (sband->bitrates[i].bitrate * 2) / 10;
+                        j++;
+                }
+        }
+        priv->tgt_rate.rates.legacy_rates.rs_nrates = j;
+
+        if (sta->ht_cap.ht_supported) {
+                for (i = 0, j = 0; i < 77; i++) {
+                        if (sta->ht_cap.mcs.rx_mask[i/8] & (1<<(i%8)))
+                                priv->tgt_rate.rates.ht_rates.rs_rates[j++] = i;
+                        if (j == ATH_HTC_RATE_MAX)
+                                break;
+                }
+                priv->tgt_rate.rates.ht_rates.rs_nrates = j;
+
+                caps = WLAN_RC_HT_FLAG;
+                if (sta->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)
+                        caps |= WLAN_RC_40_FLAG;
+                if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
+                        caps |= WLAN_RC_SGI_FLAG;
+
+        }
+
+        priv->tgt_rate.sta_index = ista->index;
+        priv->tgt_rate.isnew = 1;
+        trate = priv->tgt_rate;
+        priv->tgt_rate.capflags = caps;
+        trate.capflags = cpu_to_be32(caps);
+
+        WMI_CMD_BUF(WMI_RC_RATE_UPDATE_CMDID, &trate);
+        if (ret) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to initialize Rate information on target\n");
+                return ret;
+        }
+
+        ath_print(common, ATH_DBG_CONFIG,
+                  "Updated target STA: %pM (caps: 0x%x)\n", sta->addr, caps);
+        return 0;
+}
+
+static bool check_rc_update(struct ieee80211_hw *hw, bool *cw40)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+        struct ieee80211_conf *conf = &hw->conf;
+
+        if (!conf_is_ht(conf))
+                return false;
+
+        if (!(priv->op_flags & OP_ASSOCIATED) ||
+            (priv->op_flags & OP_SCANNING))
+                return false;
+
+        if (conf_is_ht40(conf)) {
+                if (priv->ah->curchan->chanmode &
+                        (CHANNEL_HT40PLUS | CHANNEL_HT40MINUS)) {
+                        return false;
+                } else {
+                        *cw40 = true;
+                        return true;
+                }
+        } else {  /* ht20 */
+                if (priv->ah->curchan->chanmode & CHANNEL_HT20)
+                        return false;
+                else
+                        return true;
+        }
+}
+
+static void ath9k_htc_rc_update(struct ath9k_htc_priv *priv, bool is_cw40)
+{
+        struct ath9k_htc_target_rate trate;
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        int ret;
+        u8 cmd_rsp;
+
+        memset(&trate, 0, sizeof(trate));
+
+        trate = priv->tgt_rate;
+
+        if (is_cw40)
+                priv->tgt_rate.capflags |= WLAN_RC_40_FLAG;
+        else
+                priv->tgt_rate.capflags &= ~WLAN_RC_40_FLAG;
+
+        trate.capflags = cpu_to_be32(priv->tgt_rate.capflags);
+
+        WMI_CMD_BUF(WMI_RC_RATE_UPDATE_CMDID, &trate);
+        if (ret) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to update Rate information on target\n");
+                return;
+        }
+
+        ath_print(common, ATH_DBG_CONFIG, "Rate control updated with "
+                  "caps:0x%x on target\n", priv->tgt_rate.capflags);
+}
+
+static int ath9k_htc_aggr_oper(struct ath9k_htc_priv *priv,
+                               struct ieee80211_vif *vif,
+                               u8 *sta_addr, u8 tid, bool oper)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ath9k_htc_target_aggr aggr;
+        struct ieee80211_sta *sta = NULL;
+        struct ath9k_htc_sta *ista = (struct ath9k_htc_sta *) sta->drv_priv;
+        int ret = 0;
+        u8 cmd_rsp;
+
+        if (tid > ATH9K_HTC_MAX_TID)
+                return -EINVAL;
+
+        memset(&aggr, 0, sizeof(struct ath9k_htc_target_aggr));
+
+        rcu_read_lock();
+
+        /* Check if we are able to retrieve the station */
+        sta = ieee80211_find_sta(vif, sta_addr);
+        if (!sta) {
+                rcu_read_unlock();
+                return -EINVAL;
+        }
+
+        ista = (struct ath9k_htc_sta *) sta->drv_priv;
+
+        if (oper)
+                ista->tid_state[tid] = AGGR_START;
+        else
+                ista->tid_state[tid] = AGGR_STOP;
+
+        aggr.sta_index = ista->index;
+
+        rcu_read_unlock();
+
+        aggr.tidno = tid;
+        aggr.aggr_enable = oper;
+
+        WMI_CMD_BUF(WMI_TX_AGGR_ENABLE_CMDID, &aggr);
+        if (ret)
+                ath_print(common, ATH_DBG_CONFIG,
+                          "Unable to %s TX aggregation for (%pM, %d)\n",
+                          (oper) ? "start" : "stop", sta->addr, tid);
+        else
+                ath_print(common, ATH_DBG_CONFIG,
+                          "%s aggregation for (%pM, %d)\n",
+                          (oper) ? "Starting" : "Stopping", sta->addr, tid);
+
+        return ret;
+}
+
+void ath9k_htc_aggr_work(struct work_struct *work)
+{
+        int ret = 0;
+        struct ath9k_htc_priv *priv =
+                container_of(work, struct ath9k_htc_priv,
+                             ath9k_aggr_work.work);
+        struct ath9k_htc_aggr_work *wk = &priv->aggr_work;
+
+        mutex_lock(&wk->mutex);
+
+        switch (wk->action) {
+        case IEEE80211_AMPDU_TX_START:
+                ret = ath9k_htc_aggr_oper(priv, wk->vif, wk->sta_addr,
+                                          wk->tid, true);
+                if (!ret)
+                        ieee80211_start_tx_ba_cb(wk->vif, wk->sta_addr,
+                                                 wk->tid);
+                break;
+        case IEEE80211_AMPDU_TX_STOP:
+                ath9k_htc_aggr_oper(priv, wk->vif, wk->sta_addr,
+                                    wk->tid, false);
+                ieee80211_stop_tx_ba_cb(wk->vif, wk->sta_addr, wk->tid);
+                break;
+        default:
+                ath_print(ath9k_hw_common(priv->ah), ATH_DBG_FATAL,
+                          "Unknown AMPDU action\n");
+        }
+
+        mutex_unlock(&wk->mutex);
+}
+
+/*********/
+/* DEBUG */
+/*********/
+
+#ifdef CONFIG_ATH9K_HTC_DEBUGFS
+
+static int ath9k_debugfs_open(struct inode *inode, struct file *file)
+{
+        file->private_data = inode->i_private;
+        return 0;
+}
+
+static ssize_t read_file_tgt_stats(struct file *file, char __user *user_buf,
+                                   size_t count, loff_t *ppos)
+{
+        struct ath9k_htc_priv *priv =
+                (struct ath9k_htc_priv *) file->private_data;
+        struct ath9k_htc_target_stats cmd_rsp;
+        char buf[512];
+        unsigned int len = 0;
+        int ret = 0;
+
+        memset(&cmd_rsp, 0, sizeof(cmd_rsp));
+
+        WMI_CMD(WMI_TGT_STATS_CMDID);
+        if (ret)
+                return -EINVAL;
+
+
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%19s : %10u\n", "TX Short Retries",
+                        be32_to_cpu(cmd_rsp.tx_shortretry));
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%19s : %10u\n", "TX Long Retries",
+                        be32_to_cpu(cmd_rsp.tx_longretry));
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%19s : %10u\n", "TX Xretries",
+                        be32_to_cpu(cmd_rsp.tx_xretries));
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%19s : %10u\n", "TX Unaggr. Xretries",
+                        be32_to_cpu(cmd_rsp.ht_txunaggr_xretry));
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%19s : %10u\n", "TX Xretries (HT)",
+                        be32_to_cpu(cmd_rsp.ht_tx_xretries));
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%19s : %10u\n", "TX Rate", priv->debug.txrate);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static const struct file_operations fops_tgt_stats = {
+        .read = read_file_tgt_stats,
+        .open = ath9k_debugfs_open,
+        .owner = THIS_MODULE
+};
+
+static ssize_t read_file_xmit(struct file *file, char __user *user_buf,
+                              size_t count, loff_t *ppos)
+{
+        struct ath9k_htc_priv *priv =
+                (struct ath9k_htc_priv *) file->private_data;
+        char buf[512];
+        unsigned int len = 0;
+
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "Buffers queued",
+                        priv->debug.tx_stats.buf_queued);
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "Buffers completed",
+                        priv->debug.tx_stats.buf_completed);
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "SKBs queued",
+                        priv->debug.tx_stats.skb_queued);
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "SKBs completed",
+                        priv->debug.tx_stats.skb_completed);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static const struct file_operations fops_xmit = {
+        .read = read_file_xmit,
+        .open = ath9k_debugfs_open,
+        .owner = THIS_MODULE
+};
+
+static ssize_t read_file_recv(struct file *file, char __user *user_buf,
+                              size_t count, loff_t *ppos)
+{
+        struct ath9k_htc_priv *priv =
+                (struct ath9k_htc_priv *) file->private_data;
+        char buf[512];
+        unsigned int len = 0;
+
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "SKBs allocated",
+                        priv->debug.rx_stats.skb_allocated);
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "SKBs completed",
+                        priv->debug.rx_stats.skb_completed);
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "SKBs Dropped",
+                        priv->debug.rx_stats.skb_dropped);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static const struct file_operations fops_recv = {
+        .read = read_file_recv,
+        .open = ath9k_debugfs_open,
+        .owner = THIS_MODULE
+};
+
+int ath9k_htc_init_debug(struct ath_hw *ah)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) common->priv;
+
+        if (!ath9k_debugfs_root)
+                return -ENOENT;
+
+        priv->debug.debugfs_phy = debugfs_create_dir(wiphy_name(priv->hw->wiphy),
+                                                     ath9k_debugfs_root);
+        if (!priv->debug.debugfs_phy)
+                goto err;
+
+        priv->debug.debugfs_tgt_stats = debugfs_create_file("tgt_stats", S_IRUSR,
+                                                    priv->debug.debugfs_phy,
+                                                    priv, &fops_tgt_stats);
+        if (!priv->debug.debugfs_tgt_stats)
+                goto err;
+
+
+        priv->debug.debugfs_xmit = debugfs_create_file("xmit", S_IRUSR,
+                                                       priv->debug.debugfs_phy,
+                                                       priv, &fops_xmit);
+        if (!priv->debug.debugfs_xmit)
+                goto err;
+
+        priv->debug.debugfs_recv = debugfs_create_file("recv", S_IRUSR,
+                                                       priv->debug.debugfs_phy,
+                                                       priv, &fops_recv);
+        if (!priv->debug.debugfs_recv)
+                goto err;
+
+        return 0;
+
+err:
+        ath9k_htc_exit_debug(ah);
+        return -ENOMEM;
+}
+
+void ath9k_htc_exit_debug(struct ath_hw *ah)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) common->priv;
+
+        debugfs_remove(priv->debug.debugfs_recv);
+        debugfs_remove(priv->debug.debugfs_xmit);
+        debugfs_remove(priv->debug.debugfs_tgt_stats);
+        debugfs_remove(priv->debug.debugfs_phy);
+}
+
+int ath9k_htc_debug_create_root(void)
+{
+        ath9k_debugfs_root = debugfs_create_dir(KBUILD_MODNAME, NULL);
+        if (!ath9k_debugfs_root)
+                return -ENOENT;
+
+        return 0;
+}
+
+void ath9k_htc_debug_remove_root(void)
+{
+        debugfs_remove(ath9k_debugfs_root);
+        ath9k_debugfs_root = NULL;
+}
+
+#endif /* CONFIG_ATH9K_HTC_DEBUGFS */
+
+/*******/
+/* ANI */
+/*******/
+
+static void ath_start_ani(struct ath9k_htc_priv *priv)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        unsigned long timestamp = jiffies_to_msecs(jiffies);
+
+        common->ani.longcal_timer = timestamp;
+        common->ani.shortcal_timer = timestamp;
+        common->ani.checkani_timer = timestamp;
+
+        ieee80211_queue_delayed_work(common->hw, &priv->ath9k_ani_work,
+                                     msecs_to_jiffies(ATH_ANI_POLLINTERVAL));
+}
+
+void ath9k_ani_work(struct work_struct *work)
+{
+        struct ath9k_htc_priv *priv =
+                container_of(work, struct ath9k_htc_priv,
+                             ath9k_ani_work.work);
+        struct ath_hw *ah = priv->ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        bool longcal = false;
+        bool shortcal = false;
+        bool aniflag = false;
+        unsigned int timestamp = jiffies_to_msecs(jiffies);
+        u32 cal_interval, short_cal_interval;
+
+        short_cal_interval = ATH_STA_SHORT_CALINTERVAL;
+
+        /* Only calibrate if awake */
+        if (ah->power_mode != ATH9K_PM_AWAKE)
+                goto set_timer;
+
+        /* Long calibration runs independently of short calibration. */
+        if ((timestamp - common->ani.longcal_timer) >= ATH_LONG_CALINTERVAL) {
+                longcal = true;
+                ath_print(common, ATH_DBG_ANI, "longcal @%lu\n", jiffies);
+                common->ani.longcal_timer = timestamp;
+        }
+
+        /* Short calibration applies only while caldone is false */
+        if (!common->ani.caldone) {
+                if ((timestamp - common->ani.shortcal_timer) >=
+                    short_cal_interval) {
+                        shortcal = true;
+                        ath_print(common, ATH_DBG_ANI,
+                                  "shortcal @%lu\n", jiffies);
+                        common->ani.shortcal_timer = timestamp;
+                        common->ani.resetcal_timer = timestamp;
+                }
+        } else {
+                if ((timestamp - common->ani.resetcal_timer) >=
+                    ATH_RESTART_CALINTERVAL) {
+                        common->ani.caldone = ath9k_hw_reset_calvalid(ah);
+                        if (common->ani.caldone)
+                                common->ani.resetcal_timer = timestamp;
+                }
+        }
+
+        /* Verify whether we must check ANI */
+        if ((timestamp - common->ani.checkani_timer) >= ATH_ANI_POLLINTERVAL) {
+                aniflag = true;
+                common->ani.checkani_timer = timestamp;
+        }
+
+        /* Skip all processing if there's nothing to do. */
+        if (longcal || shortcal || aniflag) {
+
+                ath9k_htc_ps_wakeup(priv);
+
+                /* Call ANI routine if necessary */
+                if (aniflag)
+                        ath9k_hw_ani_monitor(ah, ah->curchan);
+
+                /* Perform calibration if necessary */
+                if (longcal || shortcal) {
+                        common->ani.caldone =
+                                ath9k_hw_calibrate(ah, ah->curchan,
+                                                   common->rx_chainmask,
+                                                   longcal);
+
+                        if (longcal)
+                                common->ani.noise_floor =
+                                        ath9k_hw_getchan_noise(ah, ah->curchan);
+
+                        ath_print(common, ATH_DBG_ANI,
+                                  " calibrate chan %u/%x nf: %d\n",
+                                  ah->curchan->channel,
+                                  ah->curchan->channelFlags,
+                                  common->ani.noise_floor);
+                }
+
+                ath9k_htc_ps_restore(priv);
+        }
+
+set_timer:
+        /*
+        * Set timer interval based on previous results.
+        * The interval must be the shortest necessary to satisfy ANI,
+        * short calibration and long calibration.
+        */
+        cal_interval = ATH_LONG_CALINTERVAL;
+        if (priv->ah->config.enable_ani)
+                cal_interval = min(cal_interval, (u32)ATH_ANI_POLLINTERVAL);
+        if (!common->ani.caldone)
+                cal_interval = min(cal_interval, (u32)short_cal_interval);
+
+        ieee80211_queue_delayed_work(common->hw, &priv->ath9k_ani_work,
+                                     msecs_to_jiffies(cal_interval));
+}
+
+/*******/
+/* LED */
+/*******/
+
+static void ath9k_led_blink_work(struct work_struct *work)
+{
+        struct ath9k_htc_priv *priv = container_of(work, struct ath9k_htc_priv,
+                                                   ath9k_led_blink_work.work);
+
+        if (!(priv->op_flags & OP_LED_ASSOCIATED))
+                return;
+
+        if ((priv->led_on_duration == ATH_LED_ON_DURATION_IDLE) ||
+            (priv->led_off_duration == ATH_LED_OFF_DURATION_IDLE))
+                ath9k_hw_set_gpio(priv->ah, priv->ah->led_pin, 0);
+        else
+                ath9k_hw_set_gpio(priv->ah, priv->ah->led_pin,
+                                  (priv->op_flags & OP_LED_ON) ? 1 : 0);
+
+        ieee80211_queue_delayed_work(priv->hw,
+                                     &priv->ath9k_led_blink_work,
+                                     (priv->op_flags & OP_LED_ON) ?
+                                     msecs_to_jiffies(priv->led_off_duration) :
+                                     msecs_to_jiffies(priv->led_on_duration));
+
+        priv->led_on_duration = priv->led_on_cnt ?
+                max((ATH_LED_ON_DURATION_IDLE - priv->led_on_cnt), 25) :
+                ATH_LED_ON_DURATION_IDLE;
+        priv->led_off_duration = priv->led_off_cnt ?
+                max((ATH_LED_OFF_DURATION_IDLE - priv->led_off_cnt), 10) :
+                ATH_LED_OFF_DURATION_IDLE;
+        priv->led_on_cnt = priv->led_off_cnt = 0;
+
+        if (priv->op_flags & OP_LED_ON)
+                priv->op_flags &= ~OP_LED_ON;
+        else
+                priv->op_flags |= OP_LED_ON;
+}
+
+static void ath9k_led_brightness_work(struct work_struct *work)
+{
+        struct ath_led *led = container_of(work, struct ath_led,
+                                           brightness_work.work);
+        struct ath9k_htc_priv *priv = led->priv;
+
+        switch (led->brightness) {
+        case LED_OFF:
+                if (led->led_type == ATH_LED_ASSOC ||
+                    led->led_type == ATH_LED_RADIO) {
+                        ath9k_hw_set_gpio(priv->ah, priv->ah->led_pin,
+                                          (led->led_type == ATH_LED_RADIO));
+                        priv->op_flags &= ~OP_LED_ASSOCIATED;
+                        if (led->led_type == ATH_LED_RADIO)
+                                priv->op_flags &= ~OP_LED_ON;
+                } else {
+                        priv->led_off_cnt++;
+                }
+                break;
+        case LED_FULL:
+                if (led->led_type == ATH_LED_ASSOC) {
+                        priv->op_flags |= OP_LED_ASSOCIATED;
+                        ieee80211_queue_delayed_work(priv->hw,
+                                             &priv->ath9k_led_blink_work, 0);
+                } else if (led->led_type == ATH_LED_RADIO) {
+                        ath9k_hw_set_gpio(priv->ah, priv->ah->led_pin, 0);
+                        priv->op_flags |= OP_LED_ON;
+                } else {
+                        priv->led_on_cnt++;
+                }
+                break;
+        default:
+                break;
+        }
+}
+
+static void ath9k_led_brightness(struct led_classdev *led_cdev,
+                                 enum led_brightness brightness)
+{
+        struct ath_led *led = container_of(led_cdev, struct ath_led, led_cdev);
+        struct ath9k_htc_priv *priv = led->priv;
+
+        led->brightness = brightness;
+        if (!(priv->op_flags & OP_LED_DEINIT))
+                ieee80211_queue_delayed_work(priv->hw,
+                                             &led->brightness_work, 0);
+}
+
+static void ath9k_led_stop_brightness(struct ath9k_htc_priv *priv)
+{
+        cancel_delayed_work_sync(&priv->radio_led.brightness_work);
+        cancel_delayed_work_sync(&priv->assoc_led.brightness_work);
+        cancel_delayed_work_sync(&priv->tx_led.brightness_work);
+        cancel_delayed_work_sync(&priv->rx_led.brightness_work);
+}
+
+static int ath9k_register_led(struct ath9k_htc_priv *priv, struct ath_led *led,
+                              char *trigger)
+{
+        int ret;
+
+        led->priv = priv;
+        led->led_cdev.name = led->name;
+        led->led_cdev.default_trigger = trigger;
+        led->led_cdev.brightness_set = ath9k_led_brightness;
+
+        ret = led_classdev_register(wiphy_dev(priv->hw->wiphy), &led->led_cdev);
+        if (ret)
+                ath_print(ath9k_hw_common(priv->ah), ATH_DBG_FATAL,
+                          "Failed to register led:%s", led->name);
+        else
+                led->registered = 1;
+
+        INIT_DELAYED_WORK(&led->brightness_work, ath9k_led_brightness_work);
+
+        return ret;
+}
+
+static void ath9k_unregister_led(struct ath_led *led)
+{
+        if (led->registered) {
+                led_classdev_unregister(&led->led_cdev);
+                led->registered = 0;
+        }
+}
+
+void ath9k_deinit_leds(struct ath9k_htc_priv *priv)
+{
+        priv->op_flags |= OP_LED_DEINIT;
+        ath9k_unregister_led(&priv->assoc_led);
+        priv->op_flags &= ~OP_LED_ASSOCIATED;
+        ath9k_unregister_led(&priv->tx_led);
+        ath9k_unregister_led(&priv->rx_led);
+        ath9k_unregister_led(&priv->radio_led);
+        ath9k_hw_set_gpio(priv->ah, priv->ah->led_pin, 1);
+}
+
+void ath9k_init_leds(struct ath9k_htc_priv *priv)
+{
+        char *trigger;
+        int ret;
+
+        if (AR_SREV_9287(priv->ah))
+                priv->ah->led_pin = ATH_LED_PIN_9287;
+        else if (AR_SREV_9271(priv->ah))
+                priv->ah->led_pin = ATH_LED_PIN_9271;
+        else
+                priv->ah->led_pin = ATH_LED_PIN_DEF;
+
+        /* Configure gpio 1 for output */
+        ath9k_hw_cfg_output(priv->ah, priv->ah->led_pin,
+                            AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
+        /* LED off, active low */
+        ath9k_hw_set_gpio(priv->ah, priv->ah->led_pin, 1);
+
+        INIT_DELAYED_WORK(&priv->ath9k_led_blink_work, ath9k_led_blink_work);
+
+        trigger = ieee80211_get_radio_led_name(priv->hw);
+        snprintf(priv->radio_led.name, sizeof(priv->radio_led.name),
+                "ath9k-%s::radio", wiphy_name(priv->hw->wiphy));
+        ret = ath9k_register_led(priv, &priv->radio_led, trigger);
+        priv->radio_led.led_type = ATH_LED_RADIO;
+        if (ret)
+                goto fail;
+
+        trigger = ieee80211_get_assoc_led_name(priv->hw);
+        snprintf(priv->assoc_led.name, sizeof(priv->assoc_led.name),
+                "ath9k-%s::assoc", wiphy_name(priv->hw->wiphy));
+        ret = ath9k_register_led(priv, &priv->assoc_led, trigger);
+        priv->assoc_led.led_type = ATH_LED_ASSOC;
+        if (ret)
+                goto fail;
+
+        trigger = ieee80211_get_tx_led_name(priv->hw);
+        snprintf(priv->tx_led.name, sizeof(priv->tx_led.name),
+                "ath9k-%s::tx", wiphy_name(priv->hw->wiphy));
+        ret = ath9k_register_led(priv, &priv->tx_led, trigger);
+        priv->tx_led.led_type = ATH_LED_TX;
+        if (ret)
+                goto fail;
+
+        trigger = ieee80211_get_rx_led_name(priv->hw);
+        snprintf(priv->rx_led.name, sizeof(priv->rx_led.name),
+                "ath9k-%s::rx", wiphy_name(priv->hw->wiphy));
+        ret = ath9k_register_led(priv, &priv->rx_led, trigger);
+        priv->rx_led.led_type = ATH_LED_RX;
+        if (ret)
+                goto fail;
+
+        priv->op_flags &= ~OP_LED_DEINIT;
+
+        return;
+
+fail:
+        cancel_delayed_work_sync(&priv->ath9k_led_blink_work);
+        ath9k_deinit_leds(priv);
+}
+
+/*******************/
+/*      Rfkill     */
+/*******************/
+
+static bool ath_is_rfkill_set(struct ath9k_htc_priv *priv)
+{
+        return ath9k_hw_gpio_get(priv->ah, priv->ah->rfkill_gpio) ==
+                priv->ah->rfkill_polarity;
+}
+
+static void ath9k_htc_rfkill_poll_state(struct ieee80211_hw *hw)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+        bool blocked = !!ath_is_rfkill_set(priv);
+
+        wiphy_rfkill_set_hw_state(hw->wiphy, blocked);
+}
+
+void ath9k_start_rfkill_poll(struct ath9k_htc_priv *priv)
+{
+        if (priv->ah->caps.hw_caps & ATH9K_HW_CAP_RFSILENT)
+                wiphy_rfkill_start_polling(priv->hw->wiphy);
+}
+
+/**********************/
+/* mac80211 Callbacks */
+/**********************/
+
+static int ath9k_htc_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr;
+        struct ath9k_htc_priv *priv = hw->priv;
+        int padpos, padsize, ret;
+
+        hdr = (struct ieee80211_hdr *) skb->data;
+
+        /* Add the padding after the header if this is not already done */
+        padpos = ath9k_cmn_padpos(hdr->frame_control);
+        padsize = padpos & 3;
+        if (padsize && skb->len > padpos) {
+                if (skb_headroom(skb) < padsize)
+                        return -1;
+                skb_push(skb, padsize);
+                memmove(skb->data, skb->data + padsize, padpos);
+        }
+
+        ret = ath9k_htc_tx_start(priv, skb);
+        if (ret != 0) {
+                if (ret == -ENOMEM) {
+                        ath_print(ath9k_hw_common(priv->ah), ATH_DBG_XMIT,
+                                  "Stopping TX queues\n");
+                        ieee80211_stop_queues(hw);
+                        spin_lock_bh(&priv->tx_lock);
+                        priv->tx_queues_stop = true;
+                        spin_unlock_bh(&priv->tx_lock);
+                } else {
+                        ath_print(ath9k_hw_common(priv->ah), ATH_DBG_XMIT,
+                                  "Tx failed");
+                }
+                goto fail_tx;
+        }
+
+        return 0;
+
+fail_tx:
+        dev_kfree_skb_any(skb);
+        return 0;
+}
+
+static int ath9k_htc_start(struct ieee80211_hw *hw)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+        struct ath_hw *ah = priv->ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ieee80211_channel *curchan = hw->conf.channel;
+        struct ath9k_channel *init_channel;
+        int ret = 0;
+        enum htc_phymode mode;
+        u16 htc_mode;
+        u8 cmd_rsp;
+
+        ath_print(common, ATH_DBG_CONFIG,
+                  "Starting driver with initial channel: %d MHz\n",
+                  curchan->center_freq);
+
+        mutex_lock(&priv->mutex);
+
+        /* setup initial channel */
+        init_channel = ath9k_cmn_get_curchannel(hw, ah);
+
+        /* Reset SERDES registers */
+        ath9k_hw_configpcipowersave(ah, 0, 0);
+
+        ath9k_hw_htc_resetinit(ah);
+        ret = ath9k_hw_reset(ah, init_channel, false);
+        if (ret) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to reset hardware; reset status %d "
+                          "(freq %u MHz)\n", ret, curchan->center_freq);
+                goto mutex_unlock;
+        }
+
+        ath_update_txpow(priv);
+
+        mode = ath9k_htc_get_curmode(priv, init_channel);
+        htc_mode = cpu_to_be16(mode);
+        WMI_CMD_BUF(WMI_SET_MODE_CMDID, &htc_mode);
+        if (ret)
+                goto mutex_unlock;
+
+        WMI_CMD(WMI_ATH_INIT_CMDID);
+        if (ret)
+                goto mutex_unlock;
+
+        WMI_CMD(WMI_START_RECV_CMDID);
+        if (ret)
+                goto mutex_unlock;
+
+        ath9k_host_rx_init(priv);
+
+        priv->op_flags &= ~OP_INVALID;
+        htc_start(priv->htc);
+
+        spin_lock_bh(&priv->tx_lock);
+        priv->tx_queues_stop = false;
+        spin_unlock_bh(&priv->tx_lock);
+
+        ieee80211_wake_queues(hw);
+
+mutex_unlock:
+        mutex_unlock(&priv->mutex);
+        return ret;
+}
+
+static void ath9k_htc_stop(struct ieee80211_hw *hw)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+        struct ath_hw *ah = priv->ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        int ret = 0;
+        u8 cmd_rsp;
+
+        mutex_lock(&priv->mutex);
+
+        if (priv->op_flags & OP_INVALID) {
+                ath_print(common, ATH_DBG_ANY, "Device not present\n");
+                mutex_unlock(&priv->mutex);
+                return;
+        }
+
+        ath9k_htc_ps_wakeup(priv);
+        htc_stop(priv->htc);
+        WMI_CMD(WMI_DISABLE_INTR_CMDID);
+        WMI_CMD(WMI_DRAIN_TXQ_ALL_CMDID);
+        WMI_CMD(WMI_STOP_RECV_CMDID);
+        ath9k_hw_phy_disable(ah);
+        ath9k_hw_disable(ah);
+        ath9k_hw_configpcipowersave(ah, 1, 1);
+        ath9k_htc_ps_restore(priv);
+        ath9k_htc_setpower(priv, ATH9K_PM_FULL_SLEEP);
+
+        cancel_work_sync(&priv->ps_work);
+        cancel_delayed_work_sync(&priv->ath9k_ani_work);
+        cancel_delayed_work_sync(&priv->ath9k_aggr_work);
+        cancel_delayed_work_sync(&priv->ath9k_led_blink_work);
+        ath9k_led_stop_brightness(priv);
+        skb_queue_purge(&priv->tx_queue);
+
+        /* Remove monitor interface here */
+        if (ah->opmode == NL80211_IFTYPE_MONITOR) {
+                if (ath9k_htc_remove_monitor_interface(priv))
+                        ath_print(common, ATH_DBG_FATAL,
+                                  "Unable to remove monitor interface\n");
+                else
+                        ath_print(common, ATH_DBG_CONFIG,
+                                  "Monitor interface removed\n");
+        }
+
+        priv->op_flags |= OP_INVALID;
+        mutex_unlock(&priv->mutex);
+
+        ath_print(common, ATH_DBG_CONFIG, "Driver halt\n");
+}
+
+static int ath9k_htc_add_interface(struct ieee80211_hw *hw,
+                                   struct ieee80211_vif *vif)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+        struct ath9k_htc_vif *avp = (void *)vif->drv_priv;
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ath9k_htc_target_vif hvif;
+        int ret = 0;
+        u8 cmd_rsp;
+
+        mutex_lock(&priv->mutex);
+
+        /* Only one interface for now */
+        if (priv->nvifs > 0) {
+                ret = -ENOBUFS;
+                goto out;
+        }
+
+        ath9k_htc_ps_wakeup(priv);
+        memset(&hvif, 0, sizeof(struct ath9k_htc_target_vif));
+        memcpy(&hvif.myaddr, vif->addr, ETH_ALEN);
+
+        switch (vif->type) {
+        case NL80211_IFTYPE_STATION:
+                hvif.opmode = cpu_to_be32(HTC_M_STA);
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                hvif.opmode = cpu_to_be32(HTC_M_IBSS);
+                break;
+        default:
+                ath_print(common, ATH_DBG_FATAL,
+                        "Interface type %d not yet supported\n", vif->type);
+                ret = -EOPNOTSUPP;
+                goto out;
+        }
+
+        ath_print(common, ATH_DBG_CONFIG,
+                  "Attach a VIF of type: %d\n", vif->type);
+
+        priv->ah->opmode = vif->type;
+
+        /* Index starts from zero on the target */
+        avp->index = hvif.index = priv->nvifs;
+        hvif.rtsthreshold = cpu_to_be16(2304);
+        WMI_CMD_BUF(WMI_VAP_CREATE_CMDID, &hvif);
+        if (ret)
+                goto out;
+
+        priv->nvifs++;
+
+        /*
+         * We need a node in target to tx mgmt frames
+         * before association.
+         */
+        ret = ath9k_htc_add_station(priv, vif, NULL);
+        if (ret)
+                goto out;
+
+        ret = ath9k_htc_update_cap_target(priv);
+        if (ret)
+                ath_print(common, ATH_DBG_CONFIG, "Failed to update"
+                          " capability in target \n");
+
+        priv->vif = vif;
+out:
+        ath9k_htc_ps_restore(priv);
+        mutex_unlock(&priv->mutex);
+        return ret;
+}
+
+static void ath9k_htc_remove_interface(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ath9k_htc_vif *avp = (void *)vif->drv_priv;
+        struct ath9k_htc_target_vif hvif;
+        int ret = 0;
+        u8 cmd_rsp;
+
+        ath_print(common, ATH_DBG_CONFIG, "Detach Interface\n");
+
+        mutex_lock(&priv->mutex);
+
+        memset(&hvif, 0, sizeof(struct ath9k_htc_target_vif));
+        memcpy(&hvif.myaddr, vif->addr, ETH_ALEN);
+        hvif.index = avp->index;
+        WMI_CMD_BUF(WMI_VAP_REMOVE_CMDID, &hvif);
+        priv->nvifs--;
+
+        ath9k_htc_remove_station(priv, vif, NULL);
+
+        if (vif->type == NL80211_IFTYPE_ADHOC) {
+                spin_lock_bh(&priv->beacon_lock);
+                if (priv->beacon)
+                        dev_kfree_skb_any(priv->beacon);
+                priv->beacon = NULL;
+                spin_unlock_bh(&priv->beacon_lock);
+        }
+
+        priv->vif = NULL;
+
+        mutex_unlock(&priv->mutex);
+}
+
+static int ath9k_htc_config(struct ieee80211_hw *hw, u32 changed)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ieee80211_conf *conf = &hw->conf;
+
+        mutex_lock(&priv->mutex);
+
+        if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
+                struct ieee80211_channel *curchan = hw->conf.channel;
+                int pos = curchan->hw_value;
+                bool is_cw40 = false;
+
+                ath_print(common, ATH_DBG_CONFIG, "Set channel: %d MHz\n",
+                          curchan->center_freq);
+
+                if (check_rc_update(hw, &is_cw40))
+                        ath9k_htc_rc_update(priv, is_cw40);
+
+                ath9k_cmn_update_ichannel(hw, &priv->ah->channels[pos]);
+
+                if (ath9k_htc_set_channel(priv, hw, &priv->ah->channels[pos]) < 0) {
+                        ath_print(common, ATH_DBG_FATAL,
+                                  "Unable to set channel\n");
+                        mutex_unlock(&priv->mutex);
+                        return -EINVAL;
+                }
+
+        }
+        if (changed & IEEE80211_CONF_CHANGE_PS) {
+                if (conf->flags & IEEE80211_CONF_PS) {
+                        ath9k_htc_setpower(priv, ATH9K_PM_NETWORK_SLEEP);
+                        priv->ps_enabled = true;
+                } else {
+                        priv->ps_enabled = false;
+                        cancel_work_sync(&priv->ps_work);
+                        ath9k_htc_setpower(priv, ATH9K_PM_AWAKE);
+                }
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_MONITOR) {
+                if (conf->flags & IEEE80211_CONF_MONITOR) {
+                        if (ath9k_htc_add_monitor_interface(priv))
+                                ath_print(common, ATH_DBG_FATAL,
+                                          "Failed to set monitor mode\n");
+                        else
+                                ath_print(common, ATH_DBG_CONFIG,
+                                          "HW opmode set to Monitor mode\n");
+                }
+        }
+
+        mutex_unlock(&priv->mutex);
+
+        return 0;
+}
+
+#define SUPPORTED_FILTERS                       \
+        (FIF_PROMISC_IN_BSS |                   \
+        FIF_ALLMULTI |                          \
+        FIF_CONTROL |                           \
+        FIF_PSPOLL |                            \
+        FIF_OTHER_BSS |                         \
+        FIF_BCN_PRBRESP_PROMISC |               \
+        FIF_FCSFAIL)
+
+static void ath9k_htc_configure_filter(struct ieee80211_hw *hw,
+                                       unsigned int changed_flags,
+                                       unsigned int *total_flags,
+                                       u64 multicast)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+        u32 rfilt;
+
+        mutex_lock(&priv->mutex);
+
+        ath9k_htc_ps_wakeup(priv);
+        changed_flags &= SUPPORTED_FILTERS;
+        *total_flags &= SUPPORTED_FILTERS;
+
+        priv->rxfilter = *total_flags;
+        rfilt = ath9k_htc_calcrxfilter(priv);
+        ath9k_hw_setrxfilter(priv->ah, rfilt);
+
+        ath_print(ath9k_hw_common(priv->ah), ATH_DBG_CONFIG,
+                  "Set HW RX filter: 0x%x\n", rfilt);
+
+        ath9k_htc_ps_restore(priv);
+        mutex_unlock(&priv->mutex);
+}
+
+static void ath9k_htc_sta_notify(struct ieee80211_hw *hw,
+                                 struct ieee80211_vif *vif,
+                                 enum sta_notify_cmd cmd,
+                                 struct ieee80211_sta *sta)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+        int ret;
+
+        switch (cmd) {
+        case STA_NOTIFY_ADD:
+                ret = ath9k_htc_add_station(priv, vif, sta);
+                if (!ret)
+                        ath9k_htc_init_rate(priv, vif, sta);
+                break;
+        case STA_NOTIFY_REMOVE:
+                ath9k_htc_remove_station(priv, vif, sta);
+                break;
+        default:
+                break;
+        }
+}
+
+static int ath9k_htc_conf_tx(struct ieee80211_hw *hw, u16 queue,
+                             const struct ieee80211_tx_queue_params *params)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ath9k_tx_queue_info qi;
+        int ret = 0, qnum;
+
+        if (queue >= WME_NUM_AC)
+                return 0;
+
+        mutex_lock(&priv->mutex);
+
+        memset(&qi, 0, sizeof(struct ath9k_tx_queue_info));
+
+        qi.tqi_aifs = params->aifs;
+        qi.tqi_cwmin = params->cw_min;
+        qi.tqi_cwmax = params->cw_max;
+        qi.tqi_burstTime = params->txop;
+
+        qnum = get_hw_qnum(queue, priv->hwq_map);
+
+        ath_print(common, ATH_DBG_CONFIG,
+                  "Configure tx [queue/hwq] [%d/%d],  "
+                  "aifs: %d, cw_min: %d, cw_max: %d, txop: %d\n",
+                  queue, qnum, params->aifs, params->cw_min,
+                  params->cw_max, params->txop);
+
+        ret = ath_htc_txq_update(priv, qnum, &qi);
+        if (ret)
+                ath_print(common, ATH_DBG_FATAL, "TXQ Update failed\n");
+
+        mutex_unlock(&priv->mutex);
+
+        return ret;
+}
+
+static int ath9k_htc_set_key(struct ieee80211_hw *hw,
+                             enum set_key_cmd cmd,
+                             struct ieee80211_vif *vif,
+                             struct ieee80211_sta *sta,
+                             struct ieee80211_key_conf *key)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        int ret = 0;
+
+        if (htc_modparam_nohwcrypt)
+                return -ENOSPC;
+
+        mutex_lock(&priv->mutex);
+        ath_print(common, ATH_DBG_CONFIG, "Set HW Key\n");
+        ath9k_htc_ps_wakeup(priv);
+
+        switch (cmd) {
+        case SET_KEY:
+                ret = ath9k_cmn_key_config(common, vif, sta, key);
+                if (ret >= 0) {
+                        key->hw_key_idx = ret;
+                        /* push IV and Michael MIC generation to stack */
+                        key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
+                        if (key->alg == ALG_TKIP)
+                                key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
+                        if (priv->ah->sw_mgmt_crypto && key->alg == ALG_CCMP)
+                                key->flags |= IEEE80211_KEY_FLAG_SW_MGMT;
+                        ret = 0;
+                }
+                break;
+        case DISABLE_KEY:
+                ath9k_cmn_key_delete(common, key);
+                break;
+        default:
+                ret = -EINVAL;
+        }
+
+        ath9k_htc_ps_restore(priv);
+        mutex_unlock(&priv->mutex);
+
+        return ret;
+}
+
+static void ath9k_htc_bss_info_changed(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif,
+                                       struct ieee80211_bss_conf *bss_conf,
+                                       u32 changed)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+        struct ath_hw *ah = priv->ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        mutex_lock(&priv->mutex);
+        ath9k_htc_ps_wakeup(priv);
+
+        if (changed & BSS_CHANGED_ASSOC) {
+                common->curaid = bss_conf->assoc ?
+                                 bss_conf->aid : 0;
+                ath_print(common, ATH_DBG_CONFIG, "BSS Changed ASSOC %d\n",
+                        bss_conf->assoc);
+
+                if (bss_conf->assoc) {
+                        priv->op_flags |= OP_ASSOCIATED;
+                        ath_start_ani(priv);
+                } else {
+                        priv->op_flags &= ~OP_ASSOCIATED;
+                        cancel_work_sync(&priv->ps_work);
+                        cancel_delayed_work_sync(&priv->ath9k_ani_work);
+                }
+        }
+
+        if (changed & BSS_CHANGED_BSSID) {
+                /* Set BSSID */
+                memcpy(common->curbssid, bss_conf->bssid, ETH_ALEN);
+                ath9k_hw_write_associd(ah);
+
+                ath_print(common, ATH_DBG_CONFIG,
+                          "BSSID: %pM aid: 0x%x\n",
+                          common->curbssid, common->curaid);
+        }
+
+        if ((changed & BSS_CHANGED_BEACON_INT) ||
+            (changed & BSS_CHANGED_BEACON) ||
+            ((changed & BSS_CHANGED_BEACON_ENABLED) &&
+            bss_conf->enable_beacon)) {
+                priv->op_flags |= OP_ENABLE_BEACON;
+                ath9k_htc_beacon_config(priv, vif);
+        }
+
+        if (changed & BSS_CHANGED_BEACON)
+                ath9k_htc_beacon_update(priv, vif);
+
+        if ((changed & BSS_CHANGED_BEACON_ENABLED) &&
+            !bss_conf->enable_beacon) {
+                priv->op_flags &= ~OP_ENABLE_BEACON;
+                ath9k_htc_beacon_config(priv, vif);
+        }
+
+        if (changed & BSS_CHANGED_ERP_PREAMBLE) {
+                ath_print(common, ATH_DBG_CONFIG, "BSS Changed PREAMBLE %d\n",
+                          bss_conf->use_short_preamble);
+                if (bss_conf->use_short_preamble)
+                        priv->op_flags |= OP_PREAMBLE_SHORT;
+                else
+                        priv->op_flags &= ~OP_PREAMBLE_SHORT;
+        }
+
+        if (changed & BSS_CHANGED_ERP_CTS_PROT) {
+                ath_print(common, ATH_DBG_CONFIG, "BSS Changed CTS PROT %d\n",
+                          bss_conf->use_cts_prot);
+                if (bss_conf->use_cts_prot &&
+                    hw->conf.channel->band != IEEE80211_BAND_5GHZ)
+                        priv->op_flags |= OP_PROTECT_ENABLE;
+                else
+                        priv->op_flags &= ~OP_PROTECT_ENABLE;
+        }
+
+        if (changed & BSS_CHANGED_ERP_SLOT) {
+                if (bss_conf->use_short_slot)
+                        ah->slottime = 9;
+                else
+                        ah->slottime = 20;
+
+                ath9k_hw_init_global_settings(ah);
+        }
+
+        ath9k_htc_ps_restore(priv);
+        mutex_unlock(&priv->mutex);
+}
+
+static u64 ath9k_htc_get_tsf(struct ieee80211_hw *hw)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+        u64 tsf;
+
+        mutex_lock(&priv->mutex);
+        tsf = ath9k_hw_gettsf64(priv->ah);
+        mutex_unlock(&priv->mutex);
+
+        return tsf;
+}
+
+static void ath9k_htc_set_tsf(struct ieee80211_hw *hw, u64 tsf)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+
+        mutex_lock(&priv->mutex);
+        ath9k_hw_settsf64(priv->ah, tsf);
+        mutex_unlock(&priv->mutex);
+}
+
+static void ath9k_htc_reset_tsf(struct ieee80211_hw *hw)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+
+        ath9k_htc_ps_wakeup(priv);
+        mutex_lock(&priv->mutex);
+        ath9k_hw_reset_tsf(priv->ah);
+        mutex_unlock(&priv->mutex);
+        ath9k_htc_ps_restore(priv);
+}
+
+static int ath9k_htc_ampdu_action(struct ieee80211_hw *hw,
+                                  struct ieee80211_vif *vif,
+                                  enum ieee80211_ampdu_mlme_action action,
+                                  struct ieee80211_sta *sta,
+                                  u16 tid, u16 *ssn)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+        struct ath9k_htc_aggr_work *work = &priv->aggr_work;
+        struct ath9k_htc_sta *ista;
+
+        switch (action) {
+        case IEEE80211_AMPDU_RX_START:
+                break;
+        case IEEE80211_AMPDU_RX_STOP:
+                break;
+        case IEEE80211_AMPDU_TX_START:
+        case IEEE80211_AMPDU_TX_STOP:
+                if (!(priv->op_flags & OP_TXAGGR))
+                        return -ENOTSUPP;
+                memcpy(work->sta_addr, sta->addr, ETH_ALEN);
+                work->hw = hw;
+                work->vif = vif;
+                work->action = action;
+                work->tid = tid;
+                ieee80211_queue_delayed_work(hw, &priv->ath9k_aggr_work, 0);
+                break;
+        case IEEE80211_AMPDU_TX_OPERATIONAL:
+                ista = (struct ath9k_htc_sta *) sta->drv_priv;
+                ista->tid_state[tid] = AGGR_OPERATIONAL;
+                break;
+        default:
+                ath_print(ath9k_hw_common(priv->ah), ATH_DBG_FATAL,
+                          "Unknown AMPDU action\n");
+        }
+
+        return 0;
+}
+
+static void ath9k_htc_sw_scan_start(struct ieee80211_hw *hw)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+
+        mutex_lock(&priv->mutex);
+        spin_lock_bh(&priv->beacon_lock);
+        priv->op_flags |= OP_SCANNING;
+        spin_unlock_bh(&priv->beacon_lock);
+        cancel_work_sync(&priv->ps_work);
+        cancel_delayed_work_sync(&priv->ath9k_ani_work);
+        mutex_unlock(&priv->mutex);
+}
+
+static void ath9k_htc_sw_scan_complete(struct ieee80211_hw *hw)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+
+        ath9k_htc_ps_wakeup(priv);
+        mutex_lock(&priv->mutex);
+        spin_lock_bh(&priv->beacon_lock);
+        priv->op_flags &= ~OP_SCANNING;
+        spin_unlock_bh(&priv->beacon_lock);
+        priv->op_flags |= OP_FULL_RESET;
+        if (priv->op_flags & OP_ASSOCIATED)
+                ath9k_htc_beacon_config(priv, NULL);
+        ath_start_ani(priv);
+        mutex_unlock(&priv->mutex);
+        ath9k_htc_ps_restore(priv);
+}
+
+static int ath9k_htc_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
+{
+        return 0;
+}
+
+static void ath9k_htc_set_coverage_class(struct ieee80211_hw *hw,
+                                         u8 coverage_class)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+
+        mutex_lock(&priv->mutex);
+        priv->ah->coverage_class = coverage_class;
+        ath9k_hw_init_global_settings(priv->ah);
+        mutex_unlock(&priv->mutex);
+}
+
+struct ieee80211_ops ath9k_htc_ops = {
+        .tx                 = ath9k_htc_tx,
+        .start              = ath9k_htc_start,
+        .stop               = ath9k_htc_stop,
+        .add_interface      = ath9k_htc_add_interface,
+        .remove_interface   = ath9k_htc_remove_interface,
+        .config             = ath9k_htc_config,
+        .configure_filter   = ath9k_htc_configure_filter,
+        .sta_notify         = ath9k_htc_sta_notify,
+        .conf_tx            = ath9k_htc_conf_tx,
+        .bss_info_changed   = ath9k_htc_bss_info_changed,
+        .set_key            = ath9k_htc_set_key,
+        .get_tsf            = ath9k_htc_get_tsf,
+        .set_tsf            = ath9k_htc_set_tsf,
+        .reset_tsf          = ath9k_htc_reset_tsf,
+        .ampdu_action       = ath9k_htc_ampdu_action,
+        .sw_scan_start      = ath9k_htc_sw_scan_start,
+        .sw_scan_complete   = ath9k_htc_sw_scan_complete,
+        .set_rts_threshold  = ath9k_htc_set_rts_threshold,
+        .rfkill_poll        = ath9k_htc_rfkill_poll_state,
+        .set_coverage_class = ath9k_htc_set_coverage_class,
+};
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
new file mode 100644
index 000000000000..0a7cb30af5b4
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -0,0 +1,704 @@
+/*
+ * Copyright (c) 2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "htc.h"
+
+/******/
+/* TX */
+/******/
+
+int get_hw_qnum(u16 queue, int *hwq_map)
+{
+        switch (queue) {
+        case 0:
+                return hwq_map[ATH9K_WME_AC_VO];
+        case 1:
+                return hwq_map[ATH9K_WME_AC_VI];
+        case 2:
+                return hwq_map[ATH9K_WME_AC_BE];
+        case 3:
+                return hwq_map[ATH9K_WME_AC_BK];
+        default:
+                return hwq_map[ATH9K_WME_AC_BE];
+        }
+}
+
+int ath_htc_txq_update(struct ath9k_htc_priv *priv, int qnum,
+                       struct ath9k_tx_queue_info *qinfo)
+{
+        struct ath_hw *ah = priv->ah;
+        int error = 0;
+        struct ath9k_tx_queue_info qi;
+
+        ath9k_hw_get_txq_props(ah, qnum, &qi);
+
+        qi.tqi_aifs = qinfo->tqi_aifs;
+        qi.tqi_cwmin = qinfo->tqi_cwmin / 2; /* XXX */
+        qi.tqi_cwmax = qinfo->tqi_cwmax;
+        qi.tqi_burstTime = qinfo->tqi_burstTime;
+        qi.tqi_readyTime = qinfo->tqi_readyTime;
+
+        if (!ath9k_hw_set_txq_props(ah, qnum, &qi)) {
+                ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
+                          "Unable to update hardware queue %u!\n", qnum);
+                error = -EIO;
+        } else {
+                ath9k_hw_resettxqueue(ah, qnum);
+        }
+
+        return error;
+}
+
+int ath9k_htc_tx_start(struct ath9k_htc_priv *priv, struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr;
+        struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_sta *sta = tx_info->control.sta;
+        struct ath9k_htc_sta *ista;
+        struct ath9k_htc_vif *avp;
+        struct ath9k_htc_tx_ctl tx_ctl;
+        enum htc_endpoint_id epid;
+        u16 qnum, hw_qnum;
+        __le16 fc;
+        u8 *tx_fhdr;
+        u8 sta_idx;
+
+        hdr = (struct ieee80211_hdr *) skb->data;
+        fc = hdr->frame_control;
+
+        avp = (struct ath9k_htc_vif *) tx_info->control.vif->drv_priv;
+        if (sta) {
+                ista = (struct ath9k_htc_sta *) sta->drv_priv;
+                sta_idx = ista->index;
+        } else {
+                sta_idx = 0;
+        }
+
+        memset(&tx_ctl, 0, sizeof(struct ath9k_htc_tx_ctl));
+
+        if (ieee80211_is_data(fc)) {
+                struct tx_frame_hdr tx_hdr;
+                u8 *qc;
+
+                memset(&tx_hdr, 0, sizeof(struct tx_frame_hdr));
+
+                tx_hdr.node_idx = sta_idx;
+                tx_hdr.vif_idx = avp->index;
+
+                if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
+                        tx_ctl.type = ATH9K_HTC_AMPDU;
+                        tx_hdr.data_type = ATH9K_HTC_AMPDU;
+                } else {
+                        tx_ctl.type = ATH9K_HTC_NORMAL;
+                        tx_hdr.data_type = ATH9K_HTC_NORMAL;
+                }
+
+                if (ieee80211_is_data(fc)) {
+                        qc = ieee80211_get_qos_ctl(hdr);
+                        tx_hdr.tidno = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
+                }
+
+                /* Check for RTS protection */
+                if (priv->hw->wiphy->rts_threshold != (u32) -1)
+                        if (skb->len > priv->hw->wiphy->rts_threshold)
+                                tx_hdr.flags |= ATH9K_HTC_TX_RTSCTS;
+
+                /* CTS-to-self */
+                if (!(tx_hdr.flags & ATH9K_HTC_TX_RTSCTS) &&
+                    (priv->op_flags & OP_PROTECT_ENABLE))
+                        tx_hdr.flags |= ATH9K_HTC_TX_CTSONLY;
+
+                tx_hdr.key_type = ath9k_cmn_get_hw_crypto_keytype(skb);
+                if (tx_hdr.key_type == ATH9K_KEY_TYPE_CLEAR)
+                        tx_hdr.keyix = (u8) ATH9K_TXKEYIX_INVALID;
+                else
+                        tx_hdr.keyix = tx_info->control.hw_key->hw_key_idx;
+
+                tx_fhdr = skb_push(skb, sizeof(tx_hdr));
+                memcpy(tx_fhdr, (u8 *) &tx_hdr, sizeof(tx_hdr));
+
+                qnum = skb_get_queue_mapping(skb);
+                hw_qnum = get_hw_qnum(qnum, priv->hwq_map);
+
+                switch (hw_qnum) {
+                case 0:
+                        epid = priv->data_be_ep;
+                        break;
+                case 2:
+                        epid = priv->data_vi_ep;
+                        break;
+                case 3:
+                        epid = priv->data_vo_ep;
+                        break;
+                case 1:
+                default:
+                        epid = priv->data_bk_ep;
+                        break;
+                }
+        } else {
+                struct tx_mgmt_hdr mgmt_hdr;
+
+                memset(&mgmt_hdr, 0, sizeof(struct tx_mgmt_hdr));
+
+                tx_ctl.type = ATH9K_HTC_NORMAL;
+
+                mgmt_hdr.node_idx = sta_idx;
+                mgmt_hdr.vif_idx = avp->index;
+                mgmt_hdr.tidno = 0;
+                mgmt_hdr.flags = 0;
+
+                mgmt_hdr.key_type = ath9k_cmn_get_hw_crypto_keytype(skb);
+                if (mgmt_hdr.key_type == ATH9K_KEY_TYPE_CLEAR)
+                        mgmt_hdr.keyix = (u8) ATH9K_TXKEYIX_INVALID;
+                else
+                        mgmt_hdr.keyix = tx_info->control.hw_key->hw_key_idx;
+
+                tx_fhdr = skb_push(skb, sizeof(mgmt_hdr));
+                memcpy(tx_fhdr, (u8 *) &mgmt_hdr, sizeof(mgmt_hdr));
+                epid = priv->mgmt_ep;
+        }
+
+        return htc_send(priv->htc, skb, epid, &tx_ctl);
+}
+
+void ath9k_tx_tasklet(unsigned long data)
+{
+        struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *)data;
+        struct ieee80211_sta *sta;
+        struct ieee80211_hdr *hdr;
+        struct ieee80211_tx_info *tx_info;
+        struct sk_buff *skb = NULL;
+        __le16 fc;
+
+        while ((skb = skb_dequeue(&priv->tx_queue)) != NULL) {
+
+                hdr = (struct ieee80211_hdr *) skb->data;
+                fc = hdr->frame_control;
+                tx_info = IEEE80211_SKB_CB(skb);
+
+                memset(&tx_info->status, 0, sizeof(tx_info->status));
+
+                rcu_read_lock();
+
+                sta = ieee80211_find_sta(priv->vif, hdr->addr1);
+                if (!sta) {
+                        rcu_read_unlock();
+                        ieee80211_tx_status(priv->hw, skb);
+                        continue;
+                }
+
+                /* Check if we need to start aggregation */
+
+                if (sta && conf_is_ht(&priv->hw->conf) &&
+                    (priv->op_flags & OP_TXAGGR)
+                    && !(skb->protocol == cpu_to_be16(ETH_P_PAE))) {
+                        if (ieee80211_is_data_qos(fc)) {
+                                u8 *qc, tid;
+                                struct ath9k_htc_sta *ista;
+
+                                qc = ieee80211_get_qos_ctl(hdr);
+                                tid = qc[0] & 0xf;
+                                ista = (struct ath9k_htc_sta *)sta->drv_priv;
+
+                                if ((tid < ATH9K_HTC_MAX_TID) &&
+                                    ista->tid_state[tid] == AGGR_STOP) {
+                                        ieee80211_start_tx_ba_session(sta, tid);
+                                        ista->tid_state[tid] = AGGR_PROGRESS;
+                                }
+                        }
+                }
+
+                rcu_read_unlock();
+
+                /* Send status to mac80211 */
+                ieee80211_tx_status(priv->hw, skb);
+        }
+
+        /* Wake TX queues if needed */
+        spin_lock_bh(&priv->tx_lock);
+        if (priv->tx_queues_stop) {
+                priv->tx_queues_stop = false;
+                spin_unlock_bh(&priv->tx_lock);
+                ath_print(ath9k_hw_common(priv->ah), ATH_DBG_XMIT,
+                          "Waking up TX queues\n");
+                ieee80211_wake_queues(priv->hw);
+                return;
+        }
+        spin_unlock_bh(&priv->tx_lock);
+}
+
+void ath9k_htc_txep(void *drv_priv, struct sk_buff *skb,
+                    enum htc_endpoint_id ep_id, bool txok)
+{
+        struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) drv_priv;
+        struct ieee80211_tx_info *tx_info;
+
+        if (!skb)
+                return;
+
+        if (ep_id == priv->mgmt_ep)
+                skb_pull(skb, sizeof(struct tx_mgmt_hdr));
+        else
+                /* TODO: Check for cab/uapsd/data */
+                skb_pull(skb, sizeof(struct tx_frame_hdr));
+
+        tx_info = IEEE80211_SKB_CB(skb);
+
+        if (txok)
+                tx_info->flags |= IEEE80211_TX_STAT_ACK;
+
+        skb_queue_tail(&priv->tx_queue, skb);
+        tasklet_schedule(&priv->tx_tasklet);
+}
+
+int ath9k_tx_init(struct ath9k_htc_priv *priv)
+{
+        skb_queue_head_init(&priv->tx_queue);
+        return 0;
+}
+
+void ath9k_tx_cleanup(struct ath9k_htc_priv *priv)
+{
+
+}
+
+bool ath9k_htc_txq_setup(struct ath9k_htc_priv *priv,
+                         enum ath9k_tx_queue_subtype subtype)
+{
+        struct ath_hw *ah = priv->ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_tx_queue_info qi;
+        int qnum;
+
+        memset(&qi, 0, sizeof(qi));
+
+        qi.tqi_subtype = subtype;
+        qi.tqi_aifs = ATH9K_TXQ_USEDEFAULT;
+        qi.tqi_cwmin = ATH9K_TXQ_USEDEFAULT;
+        qi.tqi_cwmax = ATH9K_TXQ_USEDEFAULT;
+        qi.tqi_physCompBuf = 0;
+        qi.tqi_qflags = TXQ_FLAG_TXEOLINT_ENABLE | TXQ_FLAG_TXDESCINT_ENABLE;
+
+        qnum = ath9k_hw_setuptxqueue(priv->ah, ATH9K_TX_QUEUE_DATA, &qi);
+        if (qnum == -1)
+                return false;
+
+        if (qnum >= ARRAY_SIZE(priv->hwq_map)) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "qnum %u out of range, max %u!\n",
+                          qnum, (unsigned int)ARRAY_SIZE(priv->hwq_map));
+                ath9k_hw_releasetxqueue(ah, qnum);
+                return false;
+        }
+
+        priv->hwq_map[subtype] = qnum;
+        return true;
+}
+
+/******/
+/* RX */
+/******/
+
+/*
+ * Calculate the RX filter to be set in the HW.
+ */
+u32 ath9k_htc_calcrxfilter(struct ath9k_htc_priv *priv)
+{
+#define RX_FILTER_PRESERVE (ATH9K_RX_FILTER_PHYERR | ATH9K_RX_FILTER_PHYRADAR)
+
+        struct ath_hw *ah = priv->ah;
+        u32 rfilt;
+
+        rfilt = (ath9k_hw_getrxfilter(ah) & RX_FILTER_PRESERVE)
+                | ATH9K_RX_FILTER_UCAST | ATH9K_RX_FILTER_BCAST
+                | ATH9K_RX_FILTER_MCAST;
+
+        /* If not a STA, enable processing of Probe Requests */
+        if (ah->opmode != NL80211_IFTYPE_STATION)
+                rfilt |= ATH9K_RX_FILTER_PROBEREQ;
+
+        /*
+         * Set promiscuous mode when FIF_PROMISC_IN_BSS is enabled for station
+         * mode interface or when in monitor mode. AP mode does not need this
+         * since it receives all in-BSS frames anyway.
+         */
+        if (((ah->opmode != NL80211_IFTYPE_AP) &&
+             (priv->rxfilter & FIF_PROMISC_IN_BSS)) ||
+            (ah->opmode == NL80211_IFTYPE_MONITOR))
+                rfilt |= ATH9K_RX_FILTER_PROM;
+
+        if (priv->rxfilter & FIF_CONTROL)
+                rfilt |= ATH9K_RX_FILTER_CONTROL;
+
+        if ((ah->opmode == NL80211_IFTYPE_STATION) &&
+            !(priv->rxfilter & FIF_BCN_PRBRESP_PROMISC))
+                rfilt |= ATH9K_RX_FILTER_MYBEACON;
+        else
+                rfilt |= ATH9K_RX_FILTER_BEACON;
+
+        if (conf_is_ht(&priv->hw->conf))
+                rfilt |= ATH9K_RX_FILTER_COMP_BAR;
+
+        return rfilt;
+
+#undef RX_FILTER_PRESERVE
+}
+
+/*
+ * Recv initialization for opmode change.
+ */
+static void ath9k_htc_opmode_init(struct ath9k_htc_priv *priv)
+{
+        struct ath_hw *ah = priv->ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        u32 rfilt, mfilt[2];
+
+        /* configure rx filter */
+        rfilt = ath9k_htc_calcrxfilter(priv);
+        ath9k_hw_setrxfilter(ah, rfilt);
+
+        /* configure bssid mask */
+        if (ah->caps.hw_caps & ATH9K_HW_CAP_BSSIDMASK)
+                ath_hw_setbssidmask(common);
+
+        /* configure operational mode */
+        ath9k_hw_setopmode(ah);
+
+        /* Handle any link-level address change. */
+        ath9k_hw_setmac(ah, common->macaddr);
+
+        /* calculate and install multicast filter */
+        mfilt[0] = mfilt[1] = ~0;
+        ath9k_hw_setmcastfilter(ah, mfilt[0], mfilt[1]);
+}
+
+void ath9k_host_rx_init(struct ath9k_htc_priv *priv)
+{
+        ath9k_hw_rxena(priv->ah);
+        ath9k_htc_opmode_init(priv);
+        ath9k_hw_startpcureceive(priv->ah);
+        priv->rx.last_rssi = ATH_RSSI_DUMMY_MARKER;
+}
+
+static void ath9k_process_rate(struct ieee80211_hw *hw,
+                               struct ieee80211_rx_status *rxs,
+                               u8 rx_rate, u8 rs_flags)
+{
+        struct ieee80211_supported_band *sband;
+        enum ieee80211_band band;
+        unsigned int i = 0;
+
+        if (rx_rate & 0x80) {
+                /* HT rate */
+                rxs->flag |= RX_FLAG_HT;
+                if (rs_flags & ATH9K_RX_2040)
+                        rxs->flag |= RX_FLAG_40MHZ;
+                if (rs_flags & ATH9K_RX_GI)
+                        rxs->flag |= RX_FLAG_SHORT_GI;
+                rxs->rate_idx = rx_rate & 0x7f;
+                return;
+        }
+
+        band = hw->conf.channel->band;
+        sband = hw->wiphy->bands[band];
+
+        for (i = 0; i < sband->n_bitrates; i++) {
+                if (sband->bitrates[i].hw_value == rx_rate) {
+                        rxs->rate_idx = i;
+                        return;
+                }
+                if (sband->bitrates[i].hw_value_short == rx_rate) {
+                        rxs->rate_idx = i;
+                        rxs->flag |= RX_FLAG_SHORTPRE;
+                        return;
+                }
+        }
+
+}
+
+static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
+                             struct ath9k_htc_rxbuf *rxbuf,
+                             struct ieee80211_rx_status *rx_status)
+
+{
+        struct ieee80211_hdr *hdr;
+        struct ieee80211_hw *hw = priv->hw;
+        struct sk_buff *skb = rxbuf->skb;
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        int hdrlen, padpos, padsize;
+        int last_rssi = ATH_RSSI_DUMMY_MARKER;
+        __le16 fc;
+
+        hdr = (struct ieee80211_hdr *)skb->data;
+        fc = hdr->frame_control;
+        hdrlen = ieee80211_get_hdrlen_from_skb(skb);
+
+        padpos = ath9k_cmn_padpos(fc);
+
+        padsize = padpos & 3;
+        if (padsize && skb->len >= padpos+padsize+FCS_LEN) {
+                memmove(skb->data + padsize, skb->data, padpos);
+                skb_pull(skb, padsize);
+        }
+
+        memset(rx_status, 0, sizeof(struct ieee80211_rx_status));
+
+        if (rxbuf->rxstatus.rs_status != 0) {
+                if (rxbuf->rxstatus.rs_status & ATH9K_RXERR_CRC)
+                        rx_status->flag |= RX_FLAG_FAILED_FCS_CRC;
+                if (rxbuf->rxstatus.rs_status & ATH9K_RXERR_PHY)
+                        goto rx_next;
+
+                if (rxbuf->rxstatus.rs_status & ATH9K_RXERR_DECRYPT) {
+                        /* FIXME */
+                } else if (rxbuf->rxstatus.rs_status & ATH9K_RXERR_MIC) {
+                        if (ieee80211_is_ctl(fc))
+                                /*
+                                 * Sometimes, we get invalid
+                                 * MIC failures on valid control frames.
+                                 * Remove these mic errors.
+                                 */
+                                rxbuf->rxstatus.rs_status &= ~ATH9K_RXERR_MIC;
+                        else
+                                rx_status->flag |= RX_FLAG_MMIC_ERROR;
+                }
+
+                /*
+                 * Reject error frames with the exception of
+                 * decryption and MIC failures. For monitor mode,
+                 * we also ignore the CRC error.
+                 */
+                if (priv->ah->opmode == NL80211_IFTYPE_MONITOR) {
+                        if (rxbuf->rxstatus.rs_status &
+                            ~(ATH9K_RXERR_DECRYPT | ATH9K_RXERR_MIC |
+                              ATH9K_RXERR_CRC))
+                                goto rx_next;
+                } else {
+                        if (rxbuf->rxstatus.rs_status &
+                            ~(ATH9K_RXERR_DECRYPT | ATH9K_RXERR_MIC)) {
+                                goto rx_next;
+                        }
+                }
+        }
+
+        if (!(rxbuf->rxstatus.rs_status & ATH9K_RXERR_DECRYPT)) {
+                u8 keyix;
+                keyix = rxbuf->rxstatus.rs_keyix;
+                if (keyix != ATH9K_RXKEYIX_INVALID) {
+                        rx_status->flag |= RX_FLAG_DECRYPTED;
+                } else if (ieee80211_has_protected(fc) &&
+                           skb->len >= hdrlen + 4) {
+                        keyix = skb->data[hdrlen + 3] >> 6;
+                        if (test_bit(keyix, common->keymap))
+                                rx_status->flag |= RX_FLAG_DECRYPTED;
+                }
+        }
+
+        ath9k_process_rate(hw, rx_status, rxbuf->rxstatus.rs_rate,
+                           rxbuf->rxstatus.rs_flags);
+
+        if (priv->op_flags & OP_ASSOCIATED) {
+                if (rxbuf->rxstatus.rs_rssi != ATH9K_RSSI_BAD &&
+                    !rxbuf->rxstatus.rs_moreaggr)
+                        ATH_RSSI_LPF(priv->rx.last_rssi,
+                                     rxbuf->rxstatus.rs_rssi);
+
+                last_rssi = priv->rx.last_rssi;
+
+                if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
+                        rxbuf->rxstatus.rs_rssi = ATH_EP_RND(last_rssi,
+                                                             ATH_RSSI_EP_MULTIPLIER);
+
+                if (rxbuf->rxstatus.rs_rssi < 0)
+                        rxbuf->rxstatus.rs_rssi = 0;
+
+                if (ieee80211_is_beacon(fc))
+                        priv->ah->stats.avgbrssi = rxbuf->rxstatus.rs_rssi;
+        }
+
+        rx_status->mactime = rxbuf->rxstatus.rs_tstamp;
+        rx_status->band = hw->conf.channel->band;
+        rx_status->freq = hw->conf.channel->center_freq;
+        rx_status->signal =  rxbuf->rxstatus.rs_rssi + ATH_DEFAULT_NOISE_FLOOR;
+        rx_status->antenna = rxbuf->rxstatus.rs_antenna;
+        rx_status->flag |= RX_FLAG_TSFT;
+
+        return true;
+
+rx_next:
+        return false;
+}
+
+/*
+ * FIXME: Handle FLUSH later on.
+ */
+void ath9k_rx_tasklet(unsigned long data)
+{
+        struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *)data;
+        struct ath9k_htc_rxbuf *rxbuf = NULL, *tmp_buf = NULL;
+        struct ieee80211_rx_status rx_status;
+        struct sk_buff *skb;
+        unsigned long flags;
+        struct ieee80211_hdr *hdr;
+
+        do {
+                spin_lock_irqsave(&priv->rx.rxbuflock, flags);
+                list_for_each_entry(tmp_buf, &priv->rx.rxbuf, list) {
+                        if (tmp_buf->in_process) {
+                                rxbuf = tmp_buf;
+                                break;
+                        }
+                }
+
+                if (rxbuf == NULL) {
+                        spin_unlock_irqrestore(&priv->rx.rxbuflock, flags);
+                        break;
+                }
+
+                if (!rxbuf->skb)
+                        goto requeue;
+
+                if (!ath9k_rx_prepare(priv, rxbuf, &rx_status)) {
+                        dev_kfree_skb_any(rxbuf->skb);
+                        goto requeue;
+                }
+
+                memcpy(IEEE80211_SKB_RXCB(rxbuf->skb), &rx_status,
+                       sizeof(struct ieee80211_rx_status));
+                skb = rxbuf->skb;
+                hdr = (struct ieee80211_hdr *) skb->data;
+
+                if (ieee80211_is_beacon(hdr->frame_control) && priv->ps_enabled)
+                                ieee80211_queue_work(priv->hw, &priv->ps_work);
+
+                spin_unlock_irqrestore(&priv->rx.rxbuflock, flags);
+
+                ieee80211_rx(priv->hw, skb);
+
+                spin_lock_irqsave(&priv->rx.rxbuflock, flags);
+requeue:
+                rxbuf->in_process = false;
+                rxbuf->skb = NULL;
+                list_move_tail(&rxbuf->list, &priv->rx.rxbuf);
+                rxbuf = NULL;
+                spin_unlock_irqrestore(&priv->rx.rxbuflock, flags);
+        } while (1);
+
+}
+
+void ath9k_htc_rxep(void *drv_priv, struct sk_buff *skb,
+                    enum htc_endpoint_id ep_id)
+{
+        struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *)drv_priv;
+        struct ath_hw *ah = priv->ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_htc_rxbuf *rxbuf = NULL, *tmp_buf = NULL;
+        struct ath_htc_rx_status *rxstatus;
+        u32 len = 0;
+
+        spin_lock(&priv->rx.rxbuflock);
+        list_for_each_entry(tmp_buf, &priv->rx.rxbuf, list) {
+                if (!tmp_buf->in_process) {
+                        rxbuf = tmp_buf;
+                        break;
+                }
+        }
+        spin_unlock(&priv->rx.rxbuflock);
+
+        if (rxbuf == NULL) {
+                ath_print(common, ATH_DBG_ANY,
+                          "No free RX buffer\n");
+                goto err;
+        }
+
+        len = skb->len;
+        if (len <= HTC_RX_FRAME_HEADER_SIZE) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Corrupted RX frame, dropping\n");
+                goto err;
+        }
+
+        rxstatus = (struct ath_htc_rx_status *)skb->data;
+
+        rxstatus->rs_tstamp = be64_to_cpu(rxstatus->rs_tstamp);
+        rxstatus->rs_datalen = be16_to_cpu(rxstatus->rs_datalen);
+        rxstatus->evm0 = be32_to_cpu(rxstatus->evm0);
+        rxstatus->evm1 = be32_to_cpu(rxstatus->evm1);
+        rxstatus->evm2 = be32_to_cpu(rxstatus->evm2);
+
+        if (rxstatus->rs_datalen - (len - HTC_RX_FRAME_HEADER_SIZE) != 0) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Corrupted RX data len, dropping "
+                          "(epid: %d, dlen: %d, skblen: %d)\n",
+                          ep_id, rxstatus->rs_datalen, len);
+                goto err;
+        }
+
+        spin_lock(&priv->rx.rxbuflock);
+        memcpy(&rxbuf->rxstatus, rxstatus, HTC_RX_FRAME_HEADER_SIZE);
+        skb_pull(skb, HTC_RX_FRAME_HEADER_SIZE);
+        rxbuf->skb = skb;
+        rxbuf->in_process = true;
+        spin_unlock(&priv->rx.rxbuflock);
+
+        tasklet_schedule(&priv->rx_tasklet);
+        return;
+err:
+        dev_kfree_skb_any(skb);
+        return;
+}
+
+/* FIXME: Locking for cleanup/init */
+
+void ath9k_rx_cleanup(struct ath9k_htc_priv *priv)
+{
+        struct ath9k_htc_rxbuf *rxbuf, *tbuf;
+
+        list_for_each_entry_safe(rxbuf, tbuf, &priv->rx.rxbuf, list) {
+                list_del(&rxbuf->list);
+                if (rxbuf->skb)
+                        dev_kfree_skb_any(rxbuf->skb);
+                kfree(rxbuf);
+        }
+}
+
+int ath9k_rx_init(struct ath9k_htc_priv *priv)
+{
+        struct ath_hw *ah = priv->ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_htc_rxbuf *rxbuf;
+        int i = 0;
+
+        INIT_LIST_HEAD(&priv->rx.rxbuf);
+        spin_lock_init(&priv->rx.rxbuflock);
+
+        for (i = 0; i < ATH9K_HTC_RXBUF; i++) {
+                rxbuf = kzalloc(sizeof(struct ath9k_htc_rxbuf), GFP_KERNEL);
+                if (rxbuf == NULL) {
+                        ath_print(common, ATH_DBG_FATAL,
+                                  "Unable to allocate RX buffers\n");
+                        goto err;
+                }
+                list_add_tail(&rxbuf->list, &priv->rx.rxbuf);
+        }
+
+        return 0;
+
+err:
+        ath9k_rx_cleanup(priv);
+        return -ENOMEM;
+}
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
new file mode 100644
index 000000000000..30f608bfc567
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -0,0 +1,463 @@
+/*
+ * Copyright (c) 2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "htc.h"
+
+static int htc_issue_send(struct htc_target *target, struct sk_buff* skb,
+                          u16 len, u8 flags, u8 epid,
+                          struct ath9k_htc_tx_ctl *tx_ctl)
+{
+        struct htc_frame_hdr *hdr;
+        struct htc_endpoint *endpoint = &target->endpoint[epid];
+        int status;
+
+        hdr = (struct htc_frame_hdr *)
+                skb_push(skb, sizeof(struct htc_frame_hdr));
+        hdr->endpoint_id = epid;
+        hdr->flags = flags;
+        hdr->payload_len = cpu_to_be16(len);
+
+        status = target->hif->send(target->hif_dev, endpoint->ul_pipeid, skb,
+                                   tx_ctl);
+        return status;
+}
+
+static struct htc_endpoint *get_next_avail_ep(struct htc_endpoint *endpoint)
+{
+        enum htc_endpoint_id avail_epid;
+
+        for (avail_epid = ENDPOINT_MAX; avail_epid > ENDPOINT0; avail_epid--)
+                if (endpoint[avail_epid].service_id == 0)
+                        return &endpoint[avail_epid];
+        return NULL;
+}
+
+static u8 service_to_ulpipe(u16 service_id)
+{
+        switch (service_id) {
+        case WMI_CONTROL_SVC:
+                return 4;
+        case WMI_BEACON_SVC:
+        case WMI_CAB_SVC:
+        case WMI_UAPSD_SVC:
+        case WMI_MGMT_SVC:
+        case WMI_DATA_VO_SVC:
+        case WMI_DATA_VI_SVC:
+        case WMI_DATA_BE_SVC:
+        case WMI_DATA_BK_SVC:
+                return 1;
+        default:
+                return 0;
+        }
+}
+
+static u8 service_to_dlpipe(u16 service_id)
+{
+        switch (service_id) {
+        case WMI_CONTROL_SVC:
+                return 3;
+        case WMI_BEACON_SVC:
+        case WMI_CAB_SVC:
+        case WMI_UAPSD_SVC:
+        case WMI_MGMT_SVC:
+        case WMI_DATA_VO_SVC:
+        case WMI_DATA_VI_SVC:
+        case WMI_DATA_BE_SVC:
+        case WMI_DATA_BK_SVC:
+                return 2;
+        default:
+                return 0;
+        }
+}
+
+static void htc_process_target_rdy(struct htc_target *target,
+                                   void *buf)
+{
+        struct htc_endpoint *endpoint;
+        struct htc_ready_msg *htc_ready_msg = (struct htc_ready_msg *) buf;
+
+        target->credits = be16_to_cpu(htc_ready_msg->credits);
+        target->credit_size = be16_to_cpu(htc_ready_msg->credit_size);
+
+        endpoint = &target->endpoint[ENDPOINT0];
+        endpoint->service_id = HTC_CTRL_RSVD_SVC;
+        endpoint->max_msglen = HTC_MAX_CONTROL_MESSAGE_LENGTH;
+        complete(&target->target_wait);
+}
+
+static void htc_process_conn_rsp(struct htc_target *target,
+                                 struct htc_frame_hdr *htc_hdr)
+{
+        struct htc_conn_svc_rspmsg *svc_rspmsg;
+        struct htc_endpoint *endpoint, *tmp_endpoint = NULL;
+        u16 service_id;
+        u16 max_msglen;
+        enum htc_endpoint_id epid, tepid;
+
+        svc_rspmsg = (struct htc_conn_svc_rspmsg *)
+                ((void *) htc_hdr + sizeof(struct htc_frame_hdr));
+
+        if (svc_rspmsg->status == HTC_SERVICE_SUCCESS) {
+                epid = svc_rspmsg->endpoint_id;
+                service_id = be16_to_cpu(svc_rspmsg->service_id);
+                max_msglen = be16_to_cpu(svc_rspmsg->max_msg_len);
+                endpoint = &target->endpoint[epid];
+
+                for (tepid = ENDPOINT_MAX; tepid > ENDPOINT0; tepid--) {
+                        tmp_endpoint = &target->endpoint[tepid];
+                        if (tmp_endpoint->service_id == service_id) {
+                                tmp_endpoint->service_id = 0;
+                                break;
+                        }
+                }
+
+                if (!tmp_endpoint)
+                        return;
+
+                endpoint->service_id = service_id;
+                endpoint->max_txqdepth = tmp_endpoint->max_txqdepth;
+                endpoint->ep_callbacks = tmp_endpoint->ep_callbacks;
+                endpoint->ul_pipeid = tmp_endpoint->ul_pipeid;
+                endpoint->dl_pipeid = tmp_endpoint->dl_pipeid;
+                endpoint->max_msglen = max_msglen;
+                target->conn_rsp_epid = epid;
+                complete(&target->cmd_wait);
+        } else {
+                target->conn_rsp_epid = ENDPOINT_UNUSED;
+        }
+}
+
+static int htc_config_pipe_credits(struct htc_target *target)
+{
+        struct sk_buff *skb;
+        struct htc_config_pipe_msg *cp_msg;
+        int ret, time_left;
+
+        skb = dev_alloc_skb(50 + sizeof(struct htc_frame_hdr));
+        if (!skb) {
+                dev_err(target->dev, "failed to allocate send buffer\n");
+                return -ENOMEM;
+        }
+        skb_reserve(skb, sizeof(struct htc_frame_hdr));
+
+        cp_msg = (struct htc_config_pipe_msg *)
+                skb_put(skb, sizeof(struct htc_config_pipe_msg));
+
+        cp_msg->message_id = cpu_to_be16(HTC_MSG_CONFIG_PIPE_ID);
+        cp_msg->pipe_id = USB_WLAN_TX_PIPE;
+        cp_msg->credits = 28;
+
+        target->htc_flags |= HTC_OP_CONFIG_PIPE_CREDITS;
+
+        ret = htc_issue_send(target, skb, skb->len, 0, ENDPOINT0, NULL);
+        if (ret)
+                goto err;
+
+        time_left = wait_for_completion_timeout(&target->cmd_wait, HZ);
+        if (!time_left) {
+                dev_err(target->dev, "HTC credit config timeout\n");
+                return -ETIMEDOUT;
+        }
+
+        return 0;
+err:
+        dev_kfree_skb(skb);
+        return -EINVAL;
+}
+
+static int htc_setup_complete(struct htc_target *target)
+{
+        struct sk_buff *skb;
+        struct htc_comp_msg *comp_msg;
+        int ret = 0, time_left;
+
+        skb = dev_alloc_skb(50 + sizeof(struct htc_frame_hdr));
+        if (!skb) {
+                dev_err(target->dev, "failed to allocate send buffer\n");
+                return -ENOMEM;
+        }
+        skb_reserve(skb, sizeof(struct htc_frame_hdr));
+
+        comp_msg = (struct htc_comp_msg *)
+                skb_put(skb, sizeof(struct htc_comp_msg));
+        comp_msg->msg_id = cpu_to_be16(HTC_MSG_SETUP_COMPLETE_ID);
+
+        target->htc_flags |= HTC_OP_START_WAIT;
+
+        ret = htc_issue_send(target, skb, skb->len, 0, ENDPOINT0, NULL);
+        if (ret)
+                goto err;
+
+        time_left = wait_for_completion_timeout(&target->cmd_wait, HZ);
+        if (!time_left) {
+                dev_err(target->dev, "HTC start timeout\n");
+                return -ETIMEDOUT;
+        }
+
+        return 0;
+
+err:
+        dev_kfree_skb(skb);
+        return -EINVAL;
+}
+
+/* HTC APIs */
+
+int htc_init(struct htc_target *target)
+{
+        int ret;
+
+        ret = htc_config_pipe_credits(target);
+        if (ret)
+                return ret;
+
+        return htc_setup_complete(target);
+}
+
+int htc_connect_service(struct htc_target *target,
+                     struct htc_service_connreq *service_connreq,
+                     enum htc_endpoint_id *conn_rsp_epid)
+{
+        struct sk_buff *skb;
+        struct htc_endpoint *endpoint;
+        struct htc_conn_svc_msg *conn_msg;
+        int ret, time_left;
+
+        /* Find an available endpoint */
+        endpoint = get_next_avail_ep(target->endpoint);
+        if (!endpoint) {
+                dev_err(target->dev, "Endpoint is not available for"
+                        "service %d\n", service_connreq->service_id);
+                return -EINVAL;
+        }
+
+        endpoint->service_id = service_connreq->service_id;
+        endpoint->max_txqdepth = service_connreq->max_send_qdepth;
+        endpoint->ul_pipeid = service_to_ulpipe(service_connreq->service_id);
+        endpoint->dl_pipeid = service_to_dlpipe(service_connreq->service_id);
+        endpoint->ep_callbacks = service_connreq->ep_callbacks;
+
+        skb = dev_alloc_skb(sizeof(struct htc_conn_svc_msg) +
+                            sizeof(struct htc_frame_hdr));
+        if (!skb) {
+                dev_err(target->dev, "Failed to allocate buf to send"
+                        "service connect req\n");
+                return -ENOMEM;
+        }
+
+        skb_reserve(skb, sizeof(struct htc_frame_hdr));
+
+        conn_msg = (struct htc_conn_svc_msg *)
+                        skb_put(skb, sizeof(struct htc_conn_svc_msg));
+        conn_msg->service_id = cpu_to_be16(service_connreq->service_id);
+        conn_msg->msg_id = cpu_to_be16(HTC_MSG_CONNECT_SERVICE_ID);
+        conn_msg->con_flags = cpu_to_be16(service_connreq->con_flags);
+        conn_msg->dl_pipeid = endpoint->dl_pipeid;
+        conn_msg->ul_pipeid = endpoint->ul_pipeid;
+
+        ret = htc_issue_send(target, skb, skb->len, 0, ENDPOINT0, NULL);
+        if (ret)
+                goto err;
+
+        time_left = wait_for_completion_timeout(&target->cmd_wait, HZ);
+        if (!time_left) {
+                dev_err(target->dev, "Service connection timeout for: %d\n",
+                        service_connreq->service_id);
+                return -ETIMEDOUT;
+        }
+
+        *conn_rsp_epid = target->conn_rsp_epid;
+        return 0;
+err:
+        dev_kfree_skb(skb);
+        return ret;
+}
+
+int htc_send(struct htc_target *target, struct sk_buff *skb,
+             enum htc_endpoint_id epid, struct ath9k_htc_tx_ctl *tx_ctl)
+{
+        return htc_issue_send(target, skb, skb->len, 0, epid, tx_ctl);
+}
+
+void htc_stop(struct htc_target *target)
+{
+        enum htc_endpoint_id epid;
+        struct htc_endpoint *endpoint;
+
+        for (epid = ENDPOINT0; epid <= ENDPOINT_MAX; epid++) {
+                endpoint = &target->endpoint[epid];
+                if (endpoint->service_id != 0)
+                        target->hif->stop(target->hif_dev, endpoint->ul_pipeid);
+        }
+}
+
+void htc_start(struct htc_target *target)
+{
+        enum htc_endpoint_id epid;
+        struct htc_endpoint *endpoint;
+
+        for (epid = ENDPOINT0; epid <= ENDPOINT_MAX; epid++) {
+                endpoint = &target->endpoint[epid];
+                if (endpoint->service_id != 0)
+                        target->hif->start(target->hif_dev,
+                                           endpoint->ul_pipeid);
+        }
+}
+
+void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle,
+                               struct sk_buff *skb, bool txok)
+{
+        struct htc_endpoint *endpoint;
+        struct htc_frame_hdr *htc_hdr;
+
+        if (htc_handle->htc_flags & HTC_OP_CONFIG_PIPE_CREDITS) {
+                complete(&htc_handle->cmd_wait);
+                htc_handle->htc_flags &= ~HTC_OP_CONFIG_PIPE_CREDITS;
+        }
+
+        if (htc_handle->htc_flags & HTC_OP_START_WAIT) {
+                complete(&htc_handle->cmd_wait);
+                htc_handle->htc_flags &= ~HTC_OP_START_WAIT;
+        }
+
+        if (skb) {
+                htc_hdr = (struct htc_frame_hdr *) skb->data;
+                endpoint = &htc_handle->endpoint[htc_hdr->endpoint_id];
+                skb_pull(skb, sizeof(struct htc_frame_hdr));
+
+                if (endpoint->ep_callbacks.tx) {
+                        endpoint->ep_callbacks.tx(htc_handle->drv_priv, skb,
+                                                  htc_hdr->endpoint_id, txok);
+                }
+        }
+}
+
+/*
+ * HTC Messages are handled directly here and the obtained SKB
+ * is freed.
+ *
+ * Sevice messages (Data, WMI) passed to the corresponding
+ * endpoint RX handlers, which have to free the SKB.
+ */
+void ath9k_htc_rx_msg(struct htc_target *htc_handle,
+                      struct sk_buff *skb, u32 len, u8 pipe_id)
+{
+        struct htc_frame_hdr *htc_hdr;
+        enum htc_endpoint_id epid;
+        struct htc_endpoint *endpoint;
+        u16 *msg_id;
+
+        if (!htc_handle || !skb)
+                return;
+
+        htc_hdr = (struct htc_frame_hdr *) skb->data;
+        epid = htc_hdr->endpoint_id;
+
+        if (epid >= ENDPOINT_MAX) {
+                dev_kfree_skb_any(skb);
+                return;
+        }
+
+        if (epid == ENDPOINT0) {
+
+                /* Handle trailer */
+                if (htc_hdr->flags & HTC_FLAGS_RECV_TRAILER) {
+                        if (be32_to_cpu(*(u32 *) skb->data) == 0x00C60000)
+                                /* Move past the Watchdog pattern */
+                                htc_hdr = (struct htc_frame_hdr *)(skb->data + 4);
+                }
+
+                /* Get the message ID */
+                msg_id = (u16 *) ((void *) htc_hdr +
+                                           sizeof(struct htc_frame_hdr));
+
+                /* Now process HTC messages */
+                switch (be16_to_cpu(*msg_id)) {
+                case HTC_MSG_READY_ID:
+                        htc_process_target_rdy(htc_handle, htc_hdr);
+                        break;
+                case HTC_MSG_CONNECT_SERVICE_RESPONSE_ID:
+                        htc_process_conn_rsp(htc_handle, htc_hdr);
+                        break;
+                default:
+                        break;
+                }
+
+                dev_kfree_skb_any(skb);
+
+        } else {
+                if (htc_hdr->flags & HTC_FLAGS_RECV_TRAILER)
+                        skb_trim(skb, len - htc_hdr->control[0]);
+
+                skb_pull(skb, sizeof(struct htc_frame_hdr));
+
+                endpoint = &htc_handle->endpoint[epid];
+                if (endpoint->ep_callbacks.rx)
+                        endpoint->ep_callbacks.rx(endpoint->ep_callbacks.priv,
+                                                  skb, epid);
+        }
+}
+
+struct htc_target *ath9k_htc_hw_alloc(void *hif_handle)
+{
+        struct htc_target *target;
+
+        target = kzalloc(sizeof(struct htc_target), GFP_KERNEL);
+        if (!target)
+                printk(KERN_ERR "Unable to allocate memory for"
+                        "target device\n");
+
+        return target;
+}
+
+void ath9k_htc_hw_free(struct htc_target *htc)
+{
+        kfree(htc);
+}
+
+int ath9k_htc_hw_init(struct ath9k_htc_hif *hif, struct htc_target *target,
+                      void *hif_handle, struct device *dev, u16 devid,
+                      enum ath9k_hif_transports transport)
+{
+        struct htc_endpoint *endpoint;
+        int err = 0;
+
+        init_completion(&target->target_wait);
+        init_completion(&target->cmd_wait);
+
+        target->hif = hif;
+        target->hif_dev = hif_handle;
+        target->dev = dev;
+
+        /* Assign control endpoint pipe IDs */
+        endpoint = &target->endpoint[ENDPOINT0];
+        endpoint->ul_pipeid = hif->control_ul_pipe;
+        endpoint->dl_pipeid = hif->control_dl_pipe;
+
+        err = ath9k_htc_probe_device(target, dev, devid);
+        if (err) {
+                printk(KERN_ERR "Failed to initialize the device\n");
+                return -ENODEV;
+        }
+
+        return 0;
+}
+
+void ath9k_htc_hw_deinit(struct htc_target *target, bool hot_unplug)
+{
+        if (target)
+                ath9k_htc_disconnect_device(target, hot_unplug);
+}
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.h b/drivers/net/wireless/ath/ath9k/htc_hst.h
new file mode 100644
index 000000000000..cd7048ffd239
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.h
@@ -0,0 +1,246 @@
+/*
+ * Copyright (c) 2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef HTC_HST_H
+#define HTC_HST_H
+
+struct ath9k_htc_priv;
+struct htc_target;
+struct ath9k_htc_tx_ctl;
+
+enum ath9k_hif_transports {
+        ATH9K_HIF_USB,
+};
+
+struct ath9k_htc_hif {
+        struct list_head list;
+        const enum ath9k_hif_transports transport;
+        const char *name;
+
+        u8 control_dl_pipe;
+        u8 control_ul_pipe;
+
+        void (*start) (void *hif_handle, u8 pipe);
+        void (*stop) (void *hif_handle, u8 pipe);
+        int (*send) (void *hif_handle, u8 pipe, struct sk_buff *buf,
+                     struct ath9k_htc_tx_ctl *tx_ctl);
+};
+
+enum htc_endpoint_id {
+        ENDPOINT_UNUSED = -1,
+        ENDPOINT0 = 0,
+        ENDPOINT1 = 1,
+        ENDPOINT2 = 2,
+        ENDPOINT3 = 3,
+        ENDPOINT4 = 4,
+        ENDPOINT5 = 5,
+        ENDPOINT6 = 6,
+        ENDPOINT7 = 7,
+        ENDPOINT8 = 8,
+        ENDPOINT_MAX = 22
+};
+
+/* Htc frame hdr flags */
+#define HTC_FLAGS_RECV_TRAILER (1 << 1)
+
+struct htc_frame_hdr {
+        u8 endpoint_id;
+        u8 flags;
+        u16 payload_len;
+        u8 control[4];
+} __packed;
+
+struct htc_ready_msg {
+        u16 message_id;
+        u16 credits;
+        u16 credit_size;
+        u8 max_endpoints;
+        u8 pad;
+} __packed;
+
+struct htc_config_pipe_msg {
+        u16 message_id;
+        u8 pipe_id;
+        u8 credits;
+} __packed;
+
+struct htc_packet {
+        void *pktcontext;
+        u8 *buf;
+        u8 *buf_payload;
+        u32 buflen;
+        u32 payload_len;
+
+        int endpoint;
+        int status;
+
+        void *context;
+        u32 reserved;
+};
+
+struct htc_ep_callbacks {
+        void *priv;
+        void (*tx) (void *, struct sk_buff *, enum htc_endpoint_id, bool txok);
+        void (*rx) (void *, struct sk_buff *, enum htc_endpoint_id);
+};
+
+#define HTC_TX_QUEUE_SIZE 256
+
+struct htc_txq {
+        struct sk_buff *buf[HTC_TX_QUEUE_SIZE];
+        u32 txqdepth;
+        u16 txbuf_cnt;
+        u16 txq_head;
+        u16 txq_tail;
+};
+
+struct htc_endpoint {
+        u16 service_id;
+
+        struct htc_ep_callbacks ep_callbacks;
+        struct htc_txq htc_txq;
+        u32 max_txqdepth;
+        int max_msglen;
+
+        u8 ul_pipeid;
+        u8 dl_pipeid;
+};
+
+#define HTC_MAX_CONTROL_MESSAGE_LENGTH 255
+#define HTC_CONTROL_BUFFER_SIZE \
+        (HTC_MAX_CONTROL_MESSAGE_LENGTH + sizeof(struct htc_frame_hdr))
+
+#define NUM_CONTROL_BUFFERS 8
+#define HST_ENDPOINT_MAX 8
+
+struct htc_control_buf {
+        struct htc_packet htc_pkt;
+        u8 buf[HTC_CONTROL_BUFFER_SIZE];
+};
+
+#define HTC_OP_START_WAIT           BIT(0)
+#define HTC_OP_CONFIG_PIPE_CREDITS  BIT(1)
+
+struct htc_target {
+        void *hif_dev;
+        struct ath9k_htc_priv *drv_priv;
+        struct device *dev;
+        struct ath9k_htc_hif *hif;
+        struct htc_endpoint endpoint[HST_ENDPOINT_MAX];
+        struct completion target_wait;
+        struct completion cmd_wait;
+        struct list_head list;
+        enum htc_endpoint_id conn_rsp_epid;
+        u16 credits;
+        u16 credit_size;
+        u8 htc_flags;
+};
+
+enum htc_msg_id {
+        HTC_MSG_READY_ID = 1,
+        HTC_MSG_CONNECT_SERVICE_ID,
+        HTC_MSG_CONNECT_SERVICE_RESPONSE_ID,
+        HTC_MSG_SETUP_COMPLETE_ID,
+        HTC_MSG_CONFIG_PIPE_ID,
+        HTC_MSG_CONFIG_PIPE_RESPONSE_ID,
+};
+
+struct htc_service_connreq {
+        u16 service_id;
+        u16 con_flags;
+        u32 max_send_qdepth;
+        struct htc_ep_callbacks ep_callbacks;
+};
+
+/* Current service IDs */
+
+enum htc_service_group_ids{
+        RSVD_SERVICE_GROUP = 0,
+        WMI_SERVICE_GROUP = 1,
+
+        HTC_SERVICE_GROUP_LAST = 255
+};
+
+#define MAKE_SERVICE_ID(group, index)           \
+        (int)(((int)group << 8) | (int)(index))
+
+/* NOTE: service ID of 0x0000 is reserved and should never be used */
+#define HTC_CTRL_RSVD_SVC MAKE_SERVICE_ID(RSVD_SERVICE_GROUP, 1)
+#define HTC_LOOPBACK_RSVD_SVC MAKE_SERVICE_ID(RSVD_SERVICE_GROUP, 2)
+
+#define WMI_CONTROL_SVC   MAKE_SERVICE_ID(WMI_SERVICE_GROUP, 0)
+#define WMI_BEACON_SVC    MAKE_SERVICE_ID(WMI_SERVICE_GROUP, 1)
+#define WMI_CAB_SVC       MAKE_SERVICE_ID(WMI_SERVICE_GROUP, 2)
+#define WMI_UAPSD_SVC     MAKE_SERVICE_ID(WMI_SERVICE_GROUP, 3)
+#define WMI_MGMT_SVC      MAKE_SERVICE_ID(WMI_SERVICE_GROUP, 4)
+#define WMI_DATA_VO_SVC   MAKE_SERVICE_ID(WMI_SERVICE_GROUP, 5)
+#define WMI_DATA_VI_SVC   MAKE_SERVICE_ID(WMI_SERVICE_GROUP, 6)
+#define WMI_DATA_BE_SVC   MAKE_SERVICE_ID(WMI_SERVICE_GROUP, 7)
+#define WMI_DATA_BK_SVC   MAKE_SERVICE_ID(WMI_SERVICE_GROUP, 8)
+
+struct htc_conn_svc_msg {
+        u16 msg_id;
+        u16 service_id;
+        u16 con_flags;
+        u8 dl_pipeid;
+        u8 ul_pipeid;
+        u8 svc_meta_len;
+        u8 pad;
+} __packed;
+
+/* connect response status codes */
+#define HTC_SERVICE_SUCCESS      0
+#define HTC_SERVICE_NOT_FOUND    1
+#define HTC_SERVICE_FAILED       2
+#define HTC_SERVICE_NO_RESOURCES 3
+#define HTC_SERVICE_NO_MORE_EP   4
+
+struct htc_conn_svc_rspmsg {
+        u16 msg_id;
+        u16 service_id;
+        u8 status;
+        u8 endpoint_id;
+        u16 max_msg_len;
+        u8 svc_meta_len;
+        u8 pad;
+} __packed;
+
+struct htc_comp_msg {
+        u16 msg_id;
+} __packed;
+
+int htc_init(struct htc_target *target);
+int htc_connect_service(struct htc_target *target,
+                          struct htc_service_connreq *service_connreq,
+                          enum htc_endpoint_id *conn_rsp_eid);
+int htc_send(struct htc_target *target, struct sk_buff *skb,
+             enum htc_endpoint_id eid, struct ath9k_htc_tx_ctl *tx_ctl);
+void htc_stop(struct htc_target *target);
+void htc_start(struct htc_target *target);
+
+void ath9k_htc_rx_msg(struct htc_target *htc_handle,
+                      struct sk_buff *skb, u32 len, u8 pipe_id);
+void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle,
+                               struct sk_buff *skb, bool txok);
+
+struct htc_target *ath9k_htc_hw_alloc(void *hif_handle);
+void ath9k_htc_hw_free(struct htc_target *htc);
+int ath9k_htc_hw_init(struct ath9k_htc_hif *hif, struct htc_target *target,
+                      void *hif_handle, struct device *dev, u16 devid,
+                      enum ath9k_hif_transports transport);
+void ath9k_htc_hw_deinit(struct htc_target *target, bool hot_unplug);
+
+#endif /* HTC_HST_H */
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 2e767cf22f1e..88f8bfdbded4 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -499,8 +499,10 @@ static int ath9k_hw_post_init(struct ath_hw *ah)
 {
         int ecode;
 
-        if (!ath9k_hw_chip_test(ah))
-                return -ENODEV;
+        if (!AR_SREV_9271(ah)) {
+                if (!ath9k_hw_chip_test(ah))
+                        return -ENODEV;
+        }
 
         ecode = ath9k_hw_rf_claim(ah);
         if (ecode != 0)
@@ -545,7 +547,6 @@ static bool ath9k_hw_devid_supported(u16 devid)
         case AR9285_DEVID_PCIE:
         case AR5416_DEVID_AR9287_PCI:
         case AR5416_DEVID_AR9287_PCIE:
-        case AR9271_USB:
         case AR2427_DEVID_PCIE:
                 return true;
         default:
@@ -603,9 +604,23 @@ static void ath9k_hw_init_mode_regs(struct ath_hw *ah)
                                ARRAY_SIZE(ar9271Modes_9271), 6);
                 INIT_INI_ARRAY(&ah->iniCommon, ar9271Common_9271,
                                ARRAY_SIZE(ar9271Common_9271), 2);
+                INIT_INI_ARRAY(&ah->iniCommon_normal_cck_fir_coeff_9271,
+                               ar9271Common_normal_cck_fir_coeff_9271,
+                               ARRAY_SIZE(ar9271Common_normal_cck_fir_coeff_9271), 2);
+                INIT_INI_ARRAY(&ah->iniCommon_japan_2484_cck_fir_coeff_9271,
+                               ar9271Common_japan_2484_cck_fir_coeff_9271,
+                               ARRAY_SIZE(ar9271Common_japan_2484_cck_fir_coeff_9271), 2);
                 INIT_INI_ARRAY(&ah->iniModes_9271_1_0_only,
                                ar9271Modes_9271_1_0_only,
                                ARRAY_SIZE(ar9271Modes_9271_1_0_only), 6);
+                INIT_INI_ARRAY(&ah->iniModes_9271_ANI_reg, ar9271Modes_9271_ANI_reg,
+                               ARRAY_SIZE(ar9271Modes_9271_ANI_reg), 6);
+                INIT_INI_ARRAY(&ah->iniModes_high_power_tx_gain_9271,
+                               ar9271Modes_high_power_tx_gain_9271,
+                               ARRAY_SIZE(ar9271Modes_high_power_tx_gain_9271), 6);
+                INIT_INI_ARRAY(&ah->iniModes_normal_power_tx_gain_9271,
+                               ar9271Modes_normal_power_tx_gain_9271,
+                               ARRAY_SIZE(ar9271Modes_normal_power_tx_gain_9271), 6);
                 return;
         }
 
@@ -800,15 +815,30 @@ static void ath9k_hw_init_mode_gain_regs(struct ath_hw *ah)
 
                 /* txgain table */
                 if (txgain_type == AR5416_EEP_TXGAIN_HIGH_POWER) {
-                        INIT_INI_ARRAY(&ah->iniModesTxGain,
-                        ar9285Modes_high_power_tx_gain_9285_1_2,
-                        ARRAY_SIZE(ar9285Modes_high_power_tx_gain_9285_1_2), 6);
+                        if (AR_SREV_9285E_20(ah)) {
+                                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                ar9285Modes_XE2_0_high_power,
+                                ARRAY_SIZE(
+                                  ar9285Modes_XE2_0_high_power), 6);
+                        } else {
+                                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                ar9285Modes_high_power_tx_gain_9285_1_2,
+                                ARRAY_SIZE(
+                                  ar9285Modes_high_power_tx_gain_9285_1_2), 6);
+                        }
                 } else {
-                        INIT_INI_ARRAY(&ah->iniModesTxGain,
-                        ar9285Modes_original_tx_gain_9285_1_2,
-                        ARRAY_SIZE(ar9285Modes_original_tx_gain_9285_1_2), 6);
+                        if (AR_SREV_9285E_20(ah)) {
+                                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                ar9285Modes_XE2_0_normal_power,
+                                ARRAY_SIZE(
+                                  ar9285Modes_XE2_0_normal_power), 6);
+                        } else {
+                                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                ar9285Modes_original_tx_gain_9285_1_2,
+                                ARRAY_SIZE(
+                                  ar9285Modes_original_tx_gain_9285_1_2), 6);
+                        }
                 }
-
         }
 }
 
@@ -839,11 +869,13 @@ int ath9k_hw_init(struct ath_hw *ah)
         struct ath_common *common = ath9k_hw_common(ah);
         int r = 0;
 
-        if (!ath9k_hw_devid_supported(ah->hw_version.devid)) {
-                ath_print(common, ATH_DBG_FATAL,
-                          "Unsupported device ID: 0x%0x\n",
-                          ah->hw_version.devid);
-                return -EOPNOTSUPP;
+        if (common->bus_ops->ath_bus_type != ATH_USB) {
+                if (!ath9k_hw_devid_supported(ah->hw_version.devid)) {
+                        ath_print(common, ATH_DBG_FATAL,
+                                  "Unsupported device ID: 0x%0x\n",
+                                  ah->hw_version.devid);
+                        return -EOPNOTSUPP;
+                }
         }
 
         ath9k_hw_init_defaults(ah);
@@ -990,22 +1022,6 @@ static void ath9k_hw_init_qos(struct ath_hw *ah)
         REG_WRITE(ah, AR_TXOP_12_15, 0xFFFFFFFF);
 }
 
-static void ath9k_hw_change_target_baud(struct ath_hw *ah, u32 freq, u32 baud)
-{
-        u32 lcr;
-        u32 baud_divider = freq * 1000 * 1000 / 16 / baud;
-
-        lcr = REG_READ(ah , 0x5100c);
-        lcr |= 0x80;
-
-        REG_WRITE(ah, 0x5100c, lcr);
-        REG_WRITE(ah, 0x51004, (baud_divider >> 8));
-        REG_WRITE(ah, 0x51000, (baud_divider & 0xff));
-
-        lcr &= ~0x80;
-        REG_WRITE(ah, 0x5100c, lcr);
-}
-
 static void ath9k_hw_init_pll(struct ath_hw *ah,
                               struct ath9k_channel *chan)
 {
@@ -1071,22 +1087,8 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
 
         /* Switch the core clock for ar9271 to 117Mhz */
         if (AR_SREV_9271(ah)) {
-                if ((pll == 0x142c) || (pll == 0x2850) ) {
-                        udelay(500);
-                        /* set CLKOBS to output AHB clock */
-                        REG_WRITE(ah, 0x7020, 0xe);
-                        /*
-                         * 0x304: 117Mhz, ahb_ratio: 1x1
-                         * 0x306: 40Mhz, ahb_ratio: 1x1
-                         */
-                        REG_WRITE(ah, 0x50040, 0x304);
-                        /*
-                         * makes adjustments for the baud dividor to keep the
-                         * targetted baud rate based on the used core clock.
-                         */
-                        ath9k_hw_change_target_baud(ah, AR9271_CORE_CLOCK,
-                                                    AR9271_TARGET_BAUD_RATE);
-                }
+                udelay(500);
+                REG_WRITE(ah, 0x50040, 0x304);
         }
 
         udelay(RTC_PLL_SETTLE_DELAY);
@@ -1134,24 +1136,25 @@ static void ath9k_hw_init_chain_masks(struct ath_hw *ah)
 static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
                                           enum nl80211_iftype opmode)
 {
-        ah->mask_reg = AR_IMR_TXERR |
+        u32 imr_reg = AR_IMR_TXERR |
                 AR_IMR_TXURN |
                 AR_IMR_RXERR |
                 AR_IMR_RXORN |
                 AR_IMR_BCNMISC;
 
         if (ah->config.rx_intr_mitigation)
-                ah->mask_reg |= AR_IMR_RXINTM | AR_IMR_RXMINTR;
+                imr_reg |= AR_IMR_RXINTM | AR_IMR_RXMINTR;
         else
-                ah->mask_reg |= AR_IMR_RXOK;
+                imr_reg |= AR_IMR_RXOK;
 
-        ah->mask_reg |= AR_IMR_TXOK;
+        imr_reg |= AR_IMR_TXOK;
 
         if (opmode == NL80211_IFTYPE_AP)
-                ah->mask_reg |= AR_IMR_MIB;
+                imr_reg |= AR_IMR_MIB;
 
-        REG_WRITE(ah, AR_IMR, ah->mask_reg);
-        REG_WRITE(ah, AR_IMR_S2, REG_READ(ah, AR_IMR_S2) | AR_IMR_S2_GTT);
+        REG_WRITE(ah, AR_IMR, imr_reg);
+        ah->imrs2_reg |= AR_IMR_S2_GTT;
+        REG_WRITE(ah, AR_IMR_S2, ah->imrs2_reg);
 
         if (!AR_SREV_9100(ah)) {
                 REG_WRITE(ah, AR_INTR_SYNC_CAUSE, 0xFFFFFFFF);
@@ -1240,7 +1243,7 @@ void ath9k_hw_deinit(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
 
-        if (common->state <= ATH_HW_INITIALIZED)
+        if (common->state < ATH_HW_INITIALIZED)
                 goto free_hw;
 
         if (!AR_SREV_9100(ah))
@@ -1251,8 +1254,6 @@ void ath9k_hw_deinit(struct ath_hw *ah)
 free_hw:
         if (!AR_SREV_9280_10_OR_LATER(ah))
                 ath9k_hw_rf_free_ext_banks(ah);
-        kfree(ah);
-        ah = NULL;
 }
 EXPORT_SYMBOL(ath9k_hw_deinit);
 
@@ -1265,26 +1266,6 @@ static void ath9k_hw_override_ini(struct ath_hw *ah,
 {
         u32 val;
 
-        if (AR_SREV_9271(ah)) {
-                /*
-                 * Enable spectral scan to solution for issues with stuck
-                 * beacons on AR9271 1.0. The beacon stuck issue is not seeon on
-                 * AR9271 1.1
-                 */
-                if (AR_SREV_9271_10(ah)) {
-                        val = REG_READ(ah, AR_PHY_SPECTRAL_SCAN) |
-                              AR_PHY_SPECTRAL_SCAN_ENABLE;
-                        REG_WRITE(ah, AR_PHY_SPECTRAL_SCAN, val);
-                }
-                else if (AR_SREV_9271_11(ah))
-                        /*
-                         * change AR_PHY_RF_CTL3 setting to fix MAC issue
-                         * present on AR9271 1.1
-                         */
-                        REG_WRITE(ah, AR_PHY_RF_CTL3, 0x3a020001);
-                return;
-        }
-
         /*
          * Set the RX_ABORT and RX_DIS and clear if off only after
          * RXE is set for MAC. This prevents frames with corrupted
@@ -1293,8 +1274,10 @@ static void ath9k_hw_override_ini(struct ath_hw *ah,
         REG_SET_BIT(ah, AR_DIAG_SW, (AR_DIAG_RX_DIS | AR_DIAG_RX_ABORT));
 
         if (AR_SREV_9280_10_OR_LATER(ah)) {
-                val = REG_READ(ah, AR_PCU_MISC_MODE2) &
-                               (~AR_PCU_MISC_MODE2_HWWAR1);
+                val = REG_READ(ah, AR_PCU_MISC_MODE2);
+
+                if (!AR_SREV_9271(ah))
+                        val &= ~AR_PCU_MISC_MODE2_HWWAR1;
 
                 if (AR_SREV_9287_10_OR_LATER(ah))
                         val = val & (~AR_PCU_MISC_MODE2_HWWAR2);
@@ -1438,7 +1421,10 @@ static int ath9k_hw_process_ini(struct ath_hw *ah,
                 return -EINVAL;
         }
 
+        /* Set correct baseband to analog shift setting to access analog chips */
         REG_WRITE(ah, AR_PHY(0), 0x00000007);
+
+        /* Write ADDAC shifts */
         REG_WRITE(ah, AR_PHY_ADC_SERIAL_CTL, AR_PHY_SEL_EXTERNAL_RADIO);
         ah->eep_ops->set_addac(ah, chan);
 
@@ -1450,9 +1436,11 @@ static int ath9k_hw_process_ini(struct ath_hw *ah,
                         sizeof(u32) * ah->iniAddac.ia_rows *
                         ah->iniAddac.ia_columns;
 
+                /* For AR5416 2.0/2.1 */
                 memcpy(ah->addac5416_21,
                        ah->iniAddac.ia_array, addacSize);
 
+                /* override CLKDRV value at [row, column] = [31, 1] */
                 (ah->addac5416_21)[31 * ah->iniAddac.ia_columns + 1] = 0;
 
                 temp.ia_array = ah->addac5416_21;
@@ -1484,6 +1472,11 @@ static int ath9k_hw_process_ini(struct ath_hw *ah,
             AR_SREV_9287_10_OR_LATER(ah))
                 REG_WRITE_ARRAY(&ah->iniModesTxGain, modesIndex, regWrites);
 
+        if (AR_SREV_9271_10(ah))
+                REG_WRITE_ARRAY(&ah->iniModes_9271_1_0_only,
+                                modesIndex, regWrites);
+
+        /* Write common array parameters */
         for (i = 0; i < ah->iniCommon.ia_rows; i++) {
                 u32 reg = INI_RA(&ah->iniCommon, i, 0);
                 u32 val = INI_RA(&ah->iniCommon, i, 1);
@@ -1498,11 +1491,16 @@ static int ath9k_hw_process_ini(struct ath_hw *ah,
                 DO_DELAY(regWrites);
         }
 
-        ath9k_hw_write_regs(ah, freqIndex, regWrites);
+        if (AR_SREV_9271(ah)) {
+                if (ah->eep_ops->get_eeprom(ah, EEP_TXGAIN_TYPE) == 1)
+                        REG_WRITE_ARRAY(&ah->iniModes_high_power_tx_gain_9271,
+                                        modesIndex, regWrites);
+                else
+                        REG_WRITE_ARRAY(&ah->iniModes_normal_power_tx_gain_9271,
+                                        modesIndex, regWrites);
+        }
 
-        if (AR_SREV_9271_10(ah))
-                REG_WRITE_ARRAY(&ah->iniModes_9271_1_0_only,
-                                modesIndex, regWrites);
+        ath9k_hw_write_regs(ah, freqIndex, regWrites);
 
         if (AR_SREV_9280_20(ah) && IS_CHAN_A_5MHZ_SPACED(chan)) {
                 REG_WRITE_ARRAY(&ah->iniModesAdditional, modesIndex,
@@ -1516,6 +1514,7 @@ static int ath9k_hw_process_ini(struct ath_hw *ah,
         if (OLC_FOR_AR9280_20_LATER)
                 ath9k_olc_init(ah);
 
+        /* Set TX power */
         ah->eep_ops->set_txpower(ah, chan,
                                  ath9k_regd_get_ctl(regulatory, chan),
                                  channel->max_antenna_gain * 2,
@@ -1523,6 +1522,7 @@ static int ath9k_hw_process_ini(struct ath_hw *ah,
                                  min((u32) MAX_RATE_POWER,
                                  (u32) regulatory->power_limit));
 
+        /* Write analog registers */
         if (!ath9k_hw_set_rf_regs(ah, chan, freqIndex)) {
                 ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
                           "ar5416SetRfRegs failed\n");
@@ -1965,6 +1965,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 
         ath9k_hw_mark_phy_inactive(ah);
 
+        /* Only required on the first reset */
         if (AR_SREV_9271(ah) && ah->htc_reset_init) {
                 REG_WRITE(ah,
                           AR9271_RESET_POWER_DOWN_CONTROL,
@@ -1977,6 +1978,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                 return -EINVAL;
         }
 
+        /* Only required on the first reset */
         if (AR_SREV_9271(ah) && ah->htc_reset_init) {
                 ah->htc_reset_init = false;
                 REG_WRITE(ah,
@@ -2437,7 +2439,7 @@ static void ath9k_set_power_sleep(struct ath_hw *ah, int setChip)
                 if (!AR_SREV_9100(ah))
                         REG_WRITE(ah, AR_RC, AR_RC_AHB | AR_RC_HOSTIF);
 
-                if(!AR_SREV_5416(ah))
+                if (!AR_SREV_5416(ah) && !AR_SREV_9271(ah))
                         REG_CLR_BIT(ah, (AR_RTC_RESET),
                                     AR_RTC_RESET_EN);
         }
@@ -2853,7 +2855,7 @@ EXPORT_SYMBOL(ath9k_hw_getisr);
 
 enum ath9k_int ath9k_hw_set_interrupts(struct ath_hw *ah, enum ath9k_int ints)
 {
-        u32 omask = ah->mask_reg;
+        enum ath9k_int omask = ah->imask;
         u32 mask, mask2;
         struct ath9k_hw_capabilities *pCap = &ah->caps;
         struct ath_common *common = ath9k_hw_common(ah);
@@ -2920,15 +2922,11 @@ enum ath9k_int ath9k_hw_set_interrupts(struct ath_hw *ah, enum ath9k_int ints)
 
         ath_print(common, ATH_DBG_INTERRUPT, "new IMR 0x%x\n", mask);
         REG_WRITE(ah, AR_IMR, mask);
-        mask = REG_READ(ah, AR_IMR_S2) & ~(AR_IMR_S2_TIM |
-                                           AR_IMR_S2_DTIM |
-                                           AR_IMR_S2_DTIMSYNC |
-                                           AR_IMR_S2_CABEND |
-                                           AR_IMR_S2_CABTO |
-                                           AR_IMR_S2_TSFOOR |
-                                           AR_IMR_S2_GTT | AR_IMR_S2_CST);
-        REG_WRITE(ah, AR_IMR_S2, mask | mask2);
-        ah->mask_reg = ints;
+        ah->imrs2_reg &= ~(AR_IMR_S2_TIM | AR_IMR_S2_DTIM | AR_IMR_S2_DTIMSYNC |
+                           AR_IMR_S2_CABEND | AR_IMR_S2_CABTO |
+                           AR_IMR_S2_TSFOOR | AR_IMR_S2_GTT | AR_IMR_S2_CST);
+        ah->imrs2_reg |= mask2;
+        REG_WRITE(ah, AR_IMR_S2, ah->imrs2_reg);
 
         if (!(pCap->hw_caps & ATH9K_HW_CAP_AUTOSLEEP)) {
                 if (ints & ATH9K_INT_TIM_TIMER)
@@ -3218,7 +3216,9 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
         else
                 pCap->tx_triglevel_max = MAX_TX_FIFO_THRESHOLD;
 
-        if (AR_SREV_9285_10_OR_LATER(ah))
+        if (AR_SREV_9271(ah))
+                pCap->num_gpio_pins = AR9271_NUM_GPIO;
+        else if (AR_SREV_9285_10_OR_LATER(ah))
                 pCap->num_gpio_pins = AR9285_NUM_GPIO;
         else if (AR_SREV_9280_10_OR_LATER(ah))
                 pCap->num_gpio_pins = AR928X_NUM_GPIO;
@@ -3245,8 +3245,10 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                 pCap->hw_caps |= ATH9K_HW_CAP_RFSILENT;
         }
 #endif
-
-        pCap->hw_caps &= ~ATH9K_HW_CAP_AUTOSLEEP;
+        if (AR_SREV_9271(ah))
+                pCap->hw_caps |= ATH9K_HW_CAP_AUTOSLEEP;
+        else
+                pCap->hw_caps &= ~ATH9K_HW_CAP_AUTOSLEEP;
 
         if (AR_SREV_9280(ah) || AR_SREV_9285(ah))
                 pCap->hw_caps &= ~ATH9K_HW_CAP_4KB_SPLITTRANS;
@@ -3454,7 +3456,9 @@ u32 ath9k_hw_gpio_get(struct ath_hw *ah, u32 gpio)
         if (gpio >= ah->caps.num_gpio_pins)
                 return 0xffffffff;
 
-        if (AR_SREV_9287_10_OR_LATER(ah))
+        if (AR_SREV_9271(ah))
+                return MS_REG_READ(AR9271, gpio) != 0;
+        else if (AR_SREV_9287_10_OR_LATER(ah))
                 return MS_REG_READ(AR9287, gpio) != 0;
         else if (AR_SREV_9285_10_OR_LATER(ah))
                 return MS_REG_READ(AR9285, gpio) != 0;
@@ -3483,6 +3487,9 @@ EXPORT_SYMBOL(ath9k_hw_cfg_output);
 
 void ath9k_hw_set_gpio(struct ath_hw *ah, u32 gpio, u32 val)
 {
+        if (AR_SREV_9271(ah))
+                val = ~val;
+
         REG_RMW(ah, AR_GPIO_IN_OUT, ((val & 1) << gpio),
                 AR_GPIO_BIT(gpio));
 }
@@ -3867,6 +3874,16 @@ void ath_gen_timer_isr(struct ath_hw *ah)
 }
 EXPORT_SYMBOL(ath_gen_timer_isr);
 
+/********/
+/* HTC  */
+/********/
+
+void ath9k_hw_htc_resetinit(struct ath_hw *ah)
+{
+        ah->htc_reset_init = true;
+}
+EXPORT_SYMBOL(ath9k_hw_htc_resetinit);
+
 static struct {
         u32 version;
         const char * name;
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index dbbf7ca5f97d..b02a97c72c64 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -44,8 +44,6 @@
 
 #define AR5416_AR9100_DEVID     0x000b
 
-#define AR9271_USB             0x9271
-
 #define AR_SUBVENDOR_ID_NOG     0x0e11
 #define AR_SUBVENDOR_ID_NEW_A   0x7065
 #define AR5416_MAGIC            0x19641014
@@ -478,7 +476,8 @@ struct ath_hw {
         struct ath9k_tx_queue_info txq[ATH9K_NUM_TX_QUEUES];
 
         int16_t curchan_rad_index;
-        u32 mask_reg;
+        enum ath9k_int imask;
+        u32 imrs2_reg;
         u32 txok_interrupt_mask;
         u32 txerr_interrupt_mask;
         u32 txdesc_interrupt_mask;
@@ -598,6 +597,11 @@ struct ath_hw {
         struct ar5416IniArray iniModes_9271_1_0_only;
         struct ar5416IniArray iniCckfirNormal;
         struct ar5416IniArray iniCckfirJapan2484;
+        struct ar5416IniArray iniCommon_normal_cck_fir_coeff_9271;
+        struct ar5416IniArray iniCommon_japan_2484_cck_fir_coeff_9271;
+        struct ar5416IniArray iniModes_9271_ANI_reg;
+        struct ar5416IniArray iniModes_high_power_tx_gain_9271;
+        struct ar5416IniArray iniModes_normal_power_tx_gain_9271;
 
         u32 intr_gen_timer_trigger;
         u32 intr_gen_timer_thresh;
@@ -701,6 +705,9 @@ u32 ath9k_hw_gettsf32(struct ath_hw *ah);
 
 void ath9k_hw_name(struct ath_hw *ah, char *hw_name, size_t len);
 
+/* HTC */
+void ath9k_hw_htc_resetinit(struct ath_hw *ah);
+
 #define ATH_PCIE_CAP_LINK_CTRL  0x70
 #define ATH_PCIE_CAP_LINK_L0S   1
 #define ATH_PCIE_CAP_LINK_L1    2
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 623c2f884987..6063f5463708 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -758,6 +758,9 @@ static void ath9k_deinit_softc(struct ath_softc *sc)
 
         tasklet_kill(&sc->intr_tq);
         tasklet_kill(&sc->bcon_tasklet);
+
+        kfree(sc->sc_ah);
+        sc->sc_ah = NULL;
 }
 
 void ath9k_deinit_device(struct ath_softc *sc)
diff --git a/drivers/net/wireless/ath/ath9k/initvals.h b/drivers/net/wireless/ath/ath9k/initvals.h
index 8a3bf3ab998d..455e9d3b3f13 100644
--- a/drivers/net/wireless/ath/ath9k/initvals.h
+++ b/drivers/net/wireless/ath/ath9k/initvals.h
@@ -4184,7 +4184,7 @@ static const u_int32_t ar9285Modes_9285_1_2[][6] = {
     { 0x00009a44, 0x00000000, 0x00000000, 0x000581a8, 0x000581a8, 0x00000000 },
     { 0x00009a48, 0x00000000, 0x00000000, 0x00058284, 0x00058284, 0x00000000 },
     { 0x00009a4c, 0x00000000, 0x00000000, 0x00058288, 0x00058288, 0x00000000 },
-    { 0x00009a50, 0x00000000, 0x00000000, 0x00058220, 0x00058220, 0x00000000 },
+    { 0x00009a50, 0x00000000, 0x00000000, 0x00058224, 0x00058224, 0x00000000 },
     { 0x00009a54, 0x00000000, 0x00000000, 0x00058290, 0x00058290, 0x00000000 },
     { 0x00009a58, 0x00000000, 0x00000000, 0x00058300, 0x00058300, 0x00000000 },
     { 0x00009a5c, 0x00000000, 0x00000000, 0x00058304, 0x00058304, 0x00000000 },
@@ -4198,8 +4198,8 @@ static const u_int32_t ar9285Modes_9285_1_2[][6] = {
     { 0x00009a7c, 0x00000000, 0x00000000, 0x0006870c, 0x0006870c, 0x00000000 },
     { 0x00009a80, 0x00000000, 0x00000000, 0x00068780, 0x00068780, 0x00000000 },
     { 0x00009a84, 0x00000000, 0x00000000, 0x00068784, 0x00068784, 0x00000000 },
-    { 0x00009a88, 0x00000000, 0x00000000, 0x00078b04, 0x00078b04, 0x00000000 },
-    { 0x00009a8c, 0x00000000, 0x00000000, 0x00078b08, 0x00078b08, 0x00000000 },
+    { 0x00009a88, 0x00000000, 0x00000000, 0x00078b00, 0x00078b00, 0x00000000 },
+    { 0x00009a8c, 0x00000000, 0x00000000, 0x00078b04, 0x00078b04, 0x00000000 },
     { 0x00009a90, 0x00000000, 0x00000000, 0x00078b08, 0x00078b08, 0x00000000 },
     { 0x00009a94, 0x00000000, 0x00000000, 0x00078b0c, 0x00078b0c, 0x00000000 },
     { 0x00009a98, 0x00000000, 0x00000000, 0x00078b80, 0x00078b80, 0x00000000 },
@@ -4312,7 +4312,7 @@ static const u_int32_t ar9285Modes_9285_1_2[][6] = {
     { 0x0000aa44, 0x00000000, 0x00000000, 0x000581a8, 0x000581a8, 0x00000000 },
     { 0x0000aa48, 0x00000000, 0x00000000, 0x00058284, 0x00058284, 0x00000000 },
     { 0x0000aa4c, 0x00000000, 0x00000000, 0x00058288, 0x00058288, 0x00000000 },
-    { 0x0000aa50, 0x00000000, 0x00000000, 0x00058220, 0x00058220, 0x00000000 },
+    { 0x0000aa50, 0x00000000, 0x00000000, 0x00058224, 0x00058224, 0x00000000 },
     { 0x0000aa54, 0x00000000, 0x00000000, 0x00058290, 0x00058290, 0x00000000 },
     { 0x0000aa58, 0x00000000, 0x00000000, 0x00058300, 0x00058300, 0x00000000 },
     { 0x0000aa5c, 0x00000000, 0x00000000, 0x00058304, 0x00058304, 0x00000000 },
@@ -4326,8 +4326,8 @@ static const u_int32_t ar9285Modes_9285_1_2[][6] = {
     { 0x0000aa7c, 0x00000000, 0x00000000, 0x0006870c, 0x0006870c, 0x00000000 },
     { 0x0000aa80, 0x00000000, 0x00000000, 0x00068780, 0x00068780, 0x00000000 },
     { 0x0000aa84, 0x00000000, 0x00000000, 0x00068784, 0x00068784, 0x00000000 },
-    { 0x0000aa88, 0x00000000, 0x00000000, 0x00078b04, 0x00078b04, 0x00000000 },
-    { 0x0000aa8c, 0x00000000, 0x00000000, 0x00078b08, 0x00078b08, 0x00000000 },
+    { 0x0000aa88, 0x00000000, 0x00000000, 0x00078b00, 0x00078b00, 0x00000000 },
+    { 0x0000aa8c, 0x00000000, 0x00000000, 0x00078b04, 0x00078b04, 0x00000000 },
     { 0x0000aa90, 0x00000000, 0x00000000, 0x00078b08, 0x00078b08, 0x00000000 },
     { 0x0000aa94, 0x00000000, 0x00000000, 0x00078b0c, 0x00078b0c, 0x00000000 },
     { 0x0000aa98, 0x00000000, 0x00000000, 0x00078b80, 0x00078b80, 0x00000000 },
@@ -4731,17 +4731,12 @@ static const u_int32_t ar9285Common_9285_1_2[][2] = {
     { 0x00007808, 0x54214514 },
     { 0x0000780c, 0x02025830 },
     { 0x00007810, 0x71c0d388 },
-    { 0x00007814, 0x924934a8 },
     { 0x0000781c, 0x00000000 },
     { 0x00007824, 0x00d86fff },
-    { 0x00007828, 0x26d2491b },
     { 0x0000782c, 0x6e36d97b },
-    { 0x00007830, 0xedb6d96e },
     { 0x00007834, 0x71400087 },
-    { 0x0000783c, 0x0001fffe },
-    { 0x00007840, 0xffeb1a20 },
     { 0x00007844, 0x000c0db6 },
-    { 0x00007848, 0x6db61b6f },
+    { 0x00007848, 0x6db6246f },
     { 0x0000784c, 0x6d9b66db },
     { 0x00007850, 0x6d8c6dba },
     { 0x00007854, 0x00040000 },
@@ -4777,7 +4772,12 @@ static const u_int32_t ar9285Modes_high_power_tx_gain_9285_1_2[][6] = {
     { 0x0000a34c, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
     { 0x0000a350, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
     { 0x0000a354, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x00007814, 0x924934a8, 0x924934a8, 0x924934a8, 0x924934a8, 0x924934a8 },
+    { 0x00007828, 0x26d2491b, 0x26d2491b, 0x26d2491b, 0x26d2491b, 0x26d2491b },
+    { 0x00007830, 0xedb6d96e, 0xedb6d96e, 0xedb6d96e, 0xedb6d96e, 0xedb6d96e },
     { 0x00007838, 0xfac68803, 0xfac68803, 0xfac68803, 0xfac68803, 0xfac68803 },
+    { 0x0000783c, 0x0001fffe, 0x0001fffe, 0x0001fffe, 0x0001fffe, 0x0001fffe },
+    { 0x00007840, 0xffeb1a20, 0xffeb1a20, 0xffeb1a20, 0xffeb1a20, 0xffeb1a20 },
     { 0x0000786c, 0x08609ebe, 0x08609ebe, 0x08609ebe, 0x08609ebe, 0x08609ebe },
     { 0x00007820, 0x00000c00, 0x00000c00, 0x00000c00, 0x00000c00, 0x00000c00 },
     { 0x0000a274, 0x0a22a652, 0x0a22a652, 0x0a216652, 0x0a216652, 0x0a22a652 },
@@ -4813,7 +4813,12 @@ static const u_int32_t ar9285Modes_original_tx_gain_9285_1_2[][6] = {
     { 0x0000a34c, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
     { 0x0000a350, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
     { 0x0000a354, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x00007814, 0x924934a8, 0x924934a8, 0x924934a8, 0x924934a8, 0x924934a8 },
+    { 0x00007828, 0x26d2491b, 0x26d2491b, 0x26d2491b, 0x26d2491b, 0x26d2491b },
+    { 0x00007830, 0xedb6d96e, 0xedb6d96e, 0xedb6d96e, 0xedb6d96e, 0xedb6d96e },
     { 0x00007838, 0xfac68801, 0xfac68801, 0xfac68801, 0xfac68801, 0xfac68801 },
+    { 0x0000783c, 0x0001fffe, 0x0001fffe, 0x0001fffe, 0x0001fffe, 0x0001fffe },
+    { 0x00007840, 0xffeb1a20, 0xffeb1a20, 0xffeb1a20, 0xffeb1a20, 0xffeb1a20 },
     { 0x0000786c, 0x48609eb4, 0x48609eb4, 0x48609eb4, 0x48609eb4, 0x48609eb4 },
     { 0x00007820, 0x00000c04, 0x00000c04, 0x00000c04, 0x00000c04, 0x00000c04 },
     { 0x0000a274, 0x0a21c652, 0x0a21c652, 0x0a21a652, 0x0a21a652, 0x0a22a652 },
@@ -4825,6 +4830,86 @@ static const u_int32_t ar9285Modes_original_tx_gain_9285_1_2[][6] = {
     { 0x0000a3e0, 0x0000039c, 0x0000039c, 0x0000039c, 0x0000039c, 0x0000039c },
 };
 
+static const u_int32_t ar9285Modes_XE2_0_normal_power[][6] = {
+    { 0x0000a300, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
+    { 0x0000a304, 0x00000000, 0x00000000, 0x00009200, 0x00009200, 0x00000000 },
+    { 0x0000a308, 0x00000000, 0x00000000, 0x00010208, 0x00010208, 0x00000000 },
+    { 0x0000a30c, 0x00000000, 0x00000000, 0x00019608, 0x00019608, 0x00000000 },
+    { 0x0000a310, 0x00000000, 0x00000000, 0x00022618, 0x00022618, 0x00000000 },
+    { 0x0000a314, 0x00000000, 0x00000000, 0x0002a6c9, 0x0002a6c9, 0x00000000 },
+    { 0x0000a318, 0x00000000, 0x00000000, 0x00031710, 0x00031710, 0x00000000 },
+    { 0x0000a31c, 0x00000000, 0x00000000, 0x00035718, 0x00035718, 0x00000000 },
+    { 0x0000a320, 0x00000000, 0x00000000, 0x00038758, 0x00038758, 0x00000000 },
+    { 0x0000a324, 0x00000000, 0x00000000, 0x0003c75a, 0x0003c75a, 0x00000000 },
+    { 0x0000a328, 0x00000000, 0x00000000, 0x0004075c, 0x0004075c, 0x00000000 },
+    { 0x0000a32c, 0x00000000, 0x00000000, 0x0004475e, 0x0004475e, 0x00000000 },
+    { 0x0000a330, 0x00000000, 0x00000000, 0x0004679f, 0x0004679f, 0x00000000 },
+    { 0x0000a334, 0x00000000, 0x00000000, 0x000487df, 0x000487df, 0x00000000 },
+    { 0x0000a338, 0x0003891e, 0x0003891e, 0x0003891e, 0x0003891e, 0x00000000 },
+    { 0x0000a33c, 0x0003a95e, 0x0003a95e, 0x0003a95e, 0x0003a95e, 0x00000000 },
+    { 0x0000a340, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x0000a344, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x0000a348, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x0000a34c, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x0000a350, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x0000a354, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x00007814, 0x92497ca8, 0x92497ca8, 0x92497ca8, 0x92497ca8, 0x92497ca8 },
+    { 0x00007828, 0x4ad2491b, 0x4ad2491b, 0x2ad2491b, 0x4ad2491b, 0x4ad2491b },
+    { 0x00007830, 0xedb6da6e, 0xedb6da6e, 0xedb6da6e, 0xedb6da6e, 0xedb6dbae },
+    { 0x00007838, 0xdac71441, 0xdac71441, 0xdac71441, 0xdac71441, 0xdac71441 },
+    { 0x0000783c, 0x2481f6fe, 0x2481f6fe, 0x2481f6fe, 0x2481f6fe, 0x2481f6fe },
+    { 0x00007840, 0xba5f638c, 0xba5f638c, 0xba5f638c, 0xba5f638c, 0xba5f638c },
+    { 0x0000786c, 0x48609eb4, 0x48609eb4, 0x48609eb4, 0x48609eb4, 0x48609eb4 },
+    { 0x00007820, 0x00000c04, 0x00000c04, 0x00000c04, 0x00000c04, 0x00000c04 },
+    { 0x0000a274, 0x0a21c652, 0x0a21c652, 0x0a21a652, 0x0a21a652, 0x0a22a652 },
+    { 0x0000a278, 0x39ce739c, 0x39ce739c, 0x39ce739c, 0x39ce739c, 0x39ce739c },
+    { 0x0000a27c, 0x050e039c, 0x050e039c, 0x050e039c, 0x050e039c, 0x050e039c },
+    { 0x0000a394, 0x39ce739c, 0x39ce739c, 0x39ce739c, 0x39ce739c, 0x39ce739c },
+    { 0x0000a398, 0x0000039c, 0x0000039c, 0x0000039c, 0x0000039c, 0x0000039c },
+    { 0x0000a3dc, 0x39ce739c, 0x39ce739c, 0x39ce739c, 0x39ce739c, 0x39ce739c },
+    { 0x0000a3e0, 0x0000039c, 0x0000039c, 0x0000039c, 0x0000039c, 0x0000039c },
+};
+
+static const u_int32_t ar9285Modes_XE2_0_high_power[][6] = {
+    { 0x0000a300, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
+    { 0x0000a304, 0x00000000, 0x00000000, 0x00006200, 0x00006200, 0x00000000 },
+    { 0x0000a308, 0x00000000, 0x00000000, 0x00008201, 0x00008201, 0x00000000 },
+    { 0x0000a30c, 0x00000000, 0x00000000, 0x0000b240, 0x0000b240, 0x00000000 },
+    { 0x0000a310, 0x00000000, 0x00000000, 0x0000d241, 0x0000d241, 0x00000000 },
+    { 0x0000a314, 0x00000000, 0x00000000, 0x0000f600, 0x0000f600, 0x00000000 },
+    { 0x0000a318, 0x00000000, 0x00000000, 0x00012800, 0x00012800, 0x00000000 },
+    { 0x0000a31c, 0x00000000, 0x00000000, 0x00016802, 0x00016802, 0x00000000 },
+    { 0x0000a320, 0x00000000, 0x00000000, 0x0001b805, 0x0001b805, 0x00000000 },
+    { 0x0000a324, 0x00000000, 0x00000000, 0x00021a80, 0x00021a80, 0x00000000 },
+    { 0x0000a328, 0x00000000, 0x00000000, 0x00028b00, 0x00028b00, 0x00000000 },
+    { 0x0000a32c, 0x00000000, 0x00000000, 0x0002ab40, 0x0002ab40, 0x00000000 },
+    { 0x0000a330, 0x00000000, 0x00000000, 0x0002cd80, 0x0002cd80, 0x00000000 },
+    { 0x0000a334, 0x00000000, 0x00000000, 0x00033d82, 0x00033d82, 0x00000000 },
+    { 0x0000a338, 0x0003891e, 0x0003891e, 0x0003891e, 0x0003891e, 0x00000000 },
+    { 0x0000a33c, 0x0003a95e, 0x0003a95e, 0x0003a95e, 0x0003a95e, 0x00000000 },
+    { 0x0000a340, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x0000a344, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x0000a348, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x0000a34c, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x0000a350, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x0000a354, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x00007814, 0x92497ca8, 0x92497ca8, 0x92497ca8, 0x92497ca8, 0x92497ca8 },
+    { 0x00007828, 0x4ad2491b, 0x4ad2491b, 0x2ad2491b, 0x4ad2491b, 0x4ad2491b },
+    { 0x00007830, 0xedb6da6e, 0xedb6da6e, 0xedb6da6e, 0xedb6da6e, 0xedb6da6e },
+    { 0x00007838, 0xdac71443, 0xdac71443, 0xdac71443, 0xdac71443, 0xdac71443 },
+    { 0x0000783c, 0x2481f6fe, 0x2481f6fe, 0x2481f6fe, 0x2481f6fe, 0x2481f6fe },
+    { 0x00007840, 0xba5f638c, 0xba5f638c, 0xba5f638c, 0xba5f638c, 0xba5f638c },
+    { 0x0000786c, 0x08609ebe, 0x08609ebe, 0x08609ebe, 0x08609ebe, 0x08609ebe },
+    { 0x00007820, 0x00000c00, 0x00000c00, 0x00000c00, 0x00000c00, 0x00000c00 },
+    { 0x0000a274, 0x0a22a652, 0x0a22a652, 0x0a216652, 0x0a216652, 0x0a22a652 },
+    { 0x0000a278, 0x0e739ce7, 0x0e739ce7, 0x0e739ce7, 0x0e739ce7, 0x0e739ce7 },
+    { 0x0000a27c, 0x050380e7, 0x050380e7, 0x050380e7, 0x050380e7, 0x050380e7 },
+    { 0x0000a394, 0x0e739ce7, 0x0e739ce7, 0x0e739ce7, 0x0e739ce7, 0x0e739ce7 },
+    { 0x0000a398, 0x000000e7, 0x000000e7, 0x000000e7, 0x000000e7, 0x000000e7 },
+    { 0x0000a3dc, 0x0e739ce7, 0x0e739ce7, 0x0e739ce7, 0x0e739ce7, 0x0e739ce7 },
+    { 0x0000a3e0, 0x000000e7, 0x000000e7, 0x000000e7, 0x000000e7, 0x000000e7 },
+};
+
 static const u_int32_t ar9285PciePhy_clkreq_always_on_L1_9285_1_2[][2] = {
     {0x00004040,  0x9248fd00 },
     {0x00004040,  0x24924924 },
@@ -6441,7 +6526,7 @@ static const u_int32_t ar9271Modes_9271[][6] = {
     { 0x00009a44, 0x00000000, 0x00000000, 0x000581a8, 0x000581a8, 0x00000000 },
     { 0x00009a48, 0x00000000, 0x00000000, 0x00058284, 0x00058284, 0x00000000 },
     { 0x00009a4c, 0x00000000, 0x00000000, 0x00058288, 0x00058288, 0x00000000 },
-    { 0x00009a50, 0x00000000, 0x00000000, 0x00058220, 0x00058220, 0x00000000 },
+    { 0x00009a50, 0x00000000, 0x00000000, 0x00058224, 0x00058224, 0x00000000 },
     { 0x00009a54, 0x00000000, 0x00000000, 0x00058290, 0x00058290, 0x00000000 },
     { 0x00009a58, 0x00000000, 0x00000000, 0x00058300, 0x00058300, 0x00000000 },
     { 0x00009a5c, 0x00000000, 0x00000000, 0x00058304, 0x00058304, 0x00000000 },
@@ -6455,8 +6540,8 @@ static const u_int32_t ar9271Modes_9271[][6] = {
     { 0x00009a7c, 0x00000000, 0x00000000, 0x0006870c, 0x0006870c, 0x00000000 },
     { 0x00009a80, 0x00000000, 0x00000000, 0x00068780, 0x00068780, 0x00000000 },
     { 0x00009a84, 0x00000000, 0x00000000, 0x00068784, 0x00068784, 0x00000000 },
-    { 0x00009a88, 0x00000000, 0x00000000, 0x00078b04, 0x00078b04, 0x00000000 },
-    { 0x00009a8c, 0x00000000, 0x00000000, 0x00078b08, 0x00078b08, 0x00000000 },
+    { 0x00009a88, 0x00000000, 0x00000000, 0x00078b00, 0x00078b00, 0x00000000 },
+    { 0x00009a8c, 0x00000000, 0x00000000, 0x00078b04, 0x00078b04, 0x00000000 },
     { 0x00009a90, 0x00000000, 0x00000000, 0x00078b08, 0x00078b08, 0x00000000 },
     { 0x00009a94, 0x00000000, 0x00000000, 0x00078b0c, 0x00078b0c, 0x00000000 },
     { 0x00009a98, 0x00000000, 0x00000000, 0x00078b80, 0x00078b80, 0x00000000 },
@@ -6569,7 +6654,7 @@ static const u_int32_t ar9271Modes_9271[][6] = {
     { 0x0000aa44, 0x00000000, 0x00000000, 0x000581a8, 0x000581a8, 0x00000000 },
     { 0x0000aa48, 0x00000000, 0x00000000, 0x00058284, 0x00058284, 0x00000000 },
     { 0x0000aa4c, 0x00000000, 0x00000000, 0x00058288, 0x00058288, 0x00000000 },
-    { 0x0000aa50, 0x00000000, 0x00000000, 0x00058220, 0x00058220, 0x00000000 },
+    { 0x0000aa50, 0x00000000, 0x00000000, 0x00058224, 0x00058224, 0x00000000 },
     { 0x0000aa54, 0x00000000, 0x00000000, 0x00058290, 0x00058290, 0x00000000 },
     { 0x0000aa58, 0x00000000, 0x00000000, 0x00058300, 0x00058300, 0x00000000 },
     { 0x0000aa5c, 0x00000000, 0x00000000, 0x00058304, 0x00058304, 0x00000000 },
@@ -6583,8 +6668,8 @@ static const u_int32_t ar9271Modes_9271[][6] = {
     { 0x0000aa7c, 0x00000000, 0x00000000, 0x0006870c, 0x0006870c, 0x00000000 },
     { 0x0000aa80, 0x00000000, 0x00000000, 0x00068780, 0x00068780, 0x00000000 },
     { 0x0000aa84, 0x00000000, 0x00000000, 0x00068784, 0x00068784, 0x00000000 },
-    { 0x0000aa88, 0x00000000, 0x00000000, 0x00078b04, 0x00078b04, 0x00000000 },
-    { 0x0000aa8c, 0x00000000, 0x00000000, 0x00078b08, 0x00078b08, 0x00000000 },
+    { 0x0000aa88, 0x00000000, 0x00000000, 0x00078b00, 0x00078b00, 0x00000000 },
+    { 0x0000aa8c, 0x00000000, 0x00000000, 0x00078b04, 0x00078b04, 0x00000000 },
     { 0x0000aa90, 0x00000000, 0x00000000, 0x00078b08, 0x00078b08, 0x00000000 },
     { 0x0000aa94, 0x00000000, 0x00000000, 0x00078b0c, 0x00078b0c, 0x00000000 },
     { 0x0000aa98, 0x00000000, 0x00000000, 0x00078b80, 0x00078b80, 0x00000000 },
@@ -6683,25 +6768,6 @@ static const u_int32_t ar9271Modes_9271[][6] = {
     { 0x0000a21c, 0x1883800a, 0x1883800a, 0x1883800a, 0x1883800a, 0x1883800a },
     { 0x0000a230, 0x00000000, 0x00000000, 0x00000210, 0x00000108, 0x00000000 },
     { 0x0000a250, 0x0004f000, 0x0004f000, 0x0004a000, 0x0004a000, 0x0004a000 },
-    { 0x0000a274, 0x0a21c652, 0x0a21c652, 0x0a218652, 0x0a218652, 0x0a22a652 },
-    { 0x0000a300, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
-    { 0x0000a304, 0x00000000, 0x00000000, 0x00009200, 0x00009200, 0x00000000 },
-    { 0x0000a308, 0x00000000, 0x00000000, 0x00010208, 0x00010208, 0x00000000 },
-    { 0x0000a30c, 0x00000000, 0x00000000, 0x00019608, 0x00019608, 0x00000000 },
-    { 0x0000a310, 0x00000000, 0x00000000, 0x0001e610, 0x0001e610, 0x00000000 },
-    { 0x0000a314, 0x00000000, 0x00000000, 0x0002d6d0, 0x0002d6d0, 0x00000000 },
-    { 0x0000a318, 0x00000000, 0x00000000, 0x00039758, 0x00039758, 0x00000000 },
-    { 0x0000a31c, 0x00000000, 0x00000000, 0x0003b759, 0x0003b759, 0x00000000 },
-    { 0x0000a320, 0x00000000, 0x00000000, 0x0003d75a, 0x0003d75a, 0x00000000 },
-    { 0x0000a324, 0x00000000, 0x00000000, 0x0004175c, 0x0004175c, 0x00000000 },
-    { 0x0000a328, 0x00000000, 0x00000000, 0x0004575e, 0x0004575e, 0x00000000 },
-    { 0x0000a32c, 0x00000000, 0x00000000, 0x0004979f, 0x0004979f, 0x00000000 },
-    { 0x0000a330, 0x00000000, 0x00000000, 0x0004d7df, 0x0004d7df, 0x00000000 },
-    { 0x0000a334, 0x000368de, 0x000368de, 0x000368de, 0x000368de, 0x00000000 },
-    { 0x0000a338, 0x0003891e, 0x0003891e, 0x0003891e, 0x0003891e, 0x00000000 },
-    { 0x0000a33c, 0x0003a95e, 0x0003a95e, 0x0003a95e, 0x0003a95e, 0x00000000 },
-    { 0x0000a340, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
-    { 0x0000a344, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
     { 0x0000a358, 0x7999aa02, 0x7999aa02, 0x7999aa0e, 0x7999aa0e, 0x7999aa0e },
 };
 
@@ -6879,7 +6945,7 @@ static const u_int32_t ar9271Common_9271[][2] = {
     { 0x00008258, 0x00000000 },
     { 0x0000825c, 0x400000ff },
     { 0x00008260, 0x00080922 },
-    { 0x00008264, 0x88a00010 },
+    { 0x00008264, 0xa8a00010 },
     { 0x00008270, 0x00000000 },
     { 0x00008274, 0x40000000 },
     { 0x00008278, 0x003e4180 },
@@ -6910,13 +6976,10 @@ static const u_int32_t ar9271Common_9271[][2] = {
     { 0x00007810, 0x71c0d388 },
     { 0x00007814, 0x924934a8 },
     { 0x0000781c, 0x00000000 },
-    { 0x00007820, 0x00000c04 },
-    { 0x00007824, 0x00d8abff },
     { 0x00007828, 0x66964300 },
     { 0x0000782c, 0x8db6d961 },
     { 0x00007830, 0x8db6d96c },
     { 0x00007834, 0x6140008b },
-    { 0x00007838, 0x00000029 },
     { 0x0000783c, 0x72ee0a72 },
     { 0x00007840, 0xbbfffffc },
     { 0x00007844, 0x000c0db6 },
@@ -6929,7 +6992,6 @@ static const u_int32_t ar9271Common_9271[][2] = {
     { 0x00007860, 0x21084210 },
     { 0x00007864, 0xf7d7ffde },
     { 0x00007868, 0xc2034080 },
-    { 0x0000786c, 0x48609eb4 },
     { 0x00007870, 0x10142c00 },
     { 0x00009808, 0x00000000 },
     { 0x0000980c, 0xafe68e30 },
@@ -6982,9 +7044,6 @@ static const u_int32_t ar9271Common_9271[][2] = {
     { 0x000099e8, 0x3c466478 },
     { 0x000099ec, 0x0cc80caa },
     { 0x000099f0, 0x00000000 },
-    { 0x0000a1f4, 0x00000000 },
-    { 0x0000a1f8, 0x71733d01 },
-    { 0x0000a1fc, 0xd0ad5c12 },
     { 0x0000a208, 0x803e68c8 },
     { 0x0000a210, 0x4080a333 },
     { 0x0000a214, 0x00206c10 },
@@ -7004,13 +7063,9 @@ static const u_int32_t ar9271Common_9271[][2] = {
     { 0x0000a260, 0xdfa90f01 },
     { 0x0000a268, 0x00000000 },
     { 0x0000a26c, 0x0ebae9e6 },
-    { 0x0000a278, 0x3bdef7bd },
-    { 0x0000a27c, 0x050e83bd },
     { 0x0000a388, 0x0c000000 },
     { 0x0000a38c, 0x20202020 },
     { 0x0000a390, 0x20202020 },
-    { 0x0000a394, 0x3bdef7bd },
-    { 0x0000a398, 0x000003bd },
     { 0x0000a39c, 0x00000001 },
     { 0x0000a3a0, 0x00000000 },
     { 0x0000a3a4, 0x00000000 },
@@ -7025,8 +7080,6 @@ static const u_int32_t ar9271Common_9271[][2] = {
     { 0x0000a3cc, 0x20202020 },
     { 0x0000a3d0, 0x20202020 },
     { 0x0000a3d4, 0x20202020 },
-    { 0x0000a3dc, 0x3bdef7bd },
-    { 0x0000a3e0, 0x000003bd },
     { 0x0000a3e4, 0x00000000 },
     { 0x0000a3e8, 0x18c43433 },
     { 0x0000a3ec, 0x00f70081 },
@@ -7046,7 +7099,102 @@ static const u_int32_t ar9271Common_9271[][2] = {
     { 0x0000d384, 0xf3307ff0 },
 };
 
+static const u_int32_t ar9271Common_normal_cck_fir_coeff_9271[][2] = {
+    { 0x0000a1f4, 0x00fffeff },
+    { 0x0000a1f8, 0x00f5f9ff },
+    { 0x0000a1fc, 0xb79f6427 },
+};
+
+static const u_int32_t ar9271Common_japan_2484_cck_fir_coeff_9271[][2] = {
+    { 0x0000a1f4, 0x00000000 },
+    { 0x0000a1f8, 0xefff0301 },
+    { 0x0000a1fc, 0xca9228ee },
+};
+
 static const u_int32_t ar9271Modes_9271_1_0_only[][6] = {
     { 0x00009910, 0x30002311, 0x30002311, 0x30002311, 0x30002311, 0x30002311 },
     { 0x00009828, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001 },
 };
+
+static const u_int32_t ar9271Modes_9271_ANI_reg[][6] = {
+    { 0x00009850, 0x6d4000e2, 0x6d4000e2, 0x6d4000e2, 0x6d4000e2, 0x6d4000e2 },
+    { 0x0000985c, 0x3139605e, 0x3139605e, 0x3137605e, 0x3137605e, 0x3139605e },
+    { 0x00009858, 0x7ec84d2e, 0x7ec84d2e, 0x7ec84d2e, 0x7ec84d2e, 0x7ec84d2e },
+    { 0x0000986c, 0x06903881, 0x06903881, 0x06903881, 0x06903881, 0x06903881 },
+    { 0x00009868, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0 },
+    { 0x0000a208, 0x803e68c8, 0x803e68c8, 0x803e68c8, 0x803e68c8, 0x803e68c8 },
+    { 0x00009924, 0xd00a8007, 0xd00a8007, 0xd00a800d, 0xd00a800d, 0xd00a800d },
+    { 0x000099c0, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4 },
+};
+
+static const u_int32_t ar9271Modes_normal_power_tx_gain_9271[][6] = {
+    { 0x0000a300, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
+    { 0x0000a304, 0x00000000, 0x00000000, 0x00009200, 0x00009200, 0x00000000 },
+    { 0x0000a308, 0x00000000, 0x00000000, 0x00010208, 0x00010208, 0x00000000 },
+    { 0x0000a30c, 0x00000000, 0x00000000, 0x00019608, 0x00019608, 0x00000000 },
+    { 0x0000a310, 0x00000000, 0x00000000, 0x0001e610, 0x0001e610, 0x00000000 },
+    { 0x0000a314, 0x00000000, 0x00000000, 0x0002d6d0, 0x0002d6d0, 0x00000000 },
+    { 0x0000a318, 0x00000000, 0x00000000, 0x00039758, 0x00039758, 0x00000000 },
+    { 0x0000a31c, 0x00000000, 0x00000000, 0x0003b759, 0x0003b759, 0x00000000 },
+    { 0x0000a320, 0x00000000, 0x00000000, 0x0003d75a, 0x0003d75a, 0x00000000 },
+    { 0x0000a324, 0x00000000, 0x00000000, 0x0004175c, 0x0004175c, 0x00000000 },
+    { 0x0000a328, 0x00000000, 0x00000000, 0x0004575e, 0x0004575e, 0x00000000 },
+    { 0x0000a32c, 0x00000000, 0x00000000, 0x0004979f, 0x0004979f, 0x00000000 },
+    { 0x0000a330, 0x00000000, 0x00000000, 0x0004d7df, 0x0004d7df, 0x00000000 },
+    { 0x0000a334, 0x000368de, 0x000368de, 0x000368de, 0x000368de, 0x00000000 },
+    { 0x0000a338, 0x0003891e, 0x0003891e, 0x0003891e, 0x0003891e, 0x00000000 },
+    { 0x0000a33c, 0x0003a95e, 0x0003a95e, 0x0003a95e, 0x0003a95e, 0x00000000 },
+    { 0x0000a340, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x0000a344, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x0000a348, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x0000a34c, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x0000a350, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x0000a354, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x00007838, 0x00000029, 0x00000029, 0x00000029, 0x00000029, 0x00000029 },
+    { 0x00007824, 0x00d8abff, 0x00d8abff, 0x00d8abff, 0x00d8abff, 0x00d8abff },
+    { 0x0000786c, 0x48609eb4, 0x48609eb4, 0x48609eb4, 0x48609eb4, 0x48609eb4 },
+    { 0x00007820, 0x00000c04, 0x00000c04, 0x00000c04, 0x00000c04, 0x00000c04 },
+    { 0x0000a274, 0x0a21c652, 0x0a21c652, 0x0a218652, 0x0a218652, 0x0a22a652 },
+    { 0x0000a278, 0x3bdef7bd, 0x3bdef7bd, 0x3bdef7bd, 0x3bdef7bd, 0x3bdef7bd },
+    { 0x0000a27c, 0x050e83bd, 0x050e83bd, 0x050e83bd, 0x050e83bd, 0x050e83bd },
+    { 0x0000a394, 0x3bdef7bd, 0x3bdef7bd, 0x3bdef7bd, 0x3bdef7bd, 0x3bdef7bd },
+    { 0x0000a398, 0x000003bd, 0x000003bd, 0x000003bd, 0x000003bd, 0x000003bd },
+    { 0x0000a3dc, 0x3bdef7bd, 0x3bdef7bd, 0x3bdef7bd, 0x3bdef7bd, 0x3bdef7bd },
+    { 0x0000a3e0, 0x000003bd, 0x000003bd, 0x000003bd, 0x000003bd, 0x000003bd },
+};
+
+static const u_int32_t ar9271Modes_high_power_tx_gain_9271[][6] = {
+    { 0x0000a300, 0x00000000, 0x00000000, 0x00010000, 0x00010000, 0x00000000 },
+    { 0x0000a304, 0x00000000, 0x00000000, 0x00016200, 0x00016200, 0x00000000 },
+    { 0x0000a308, 0x00000000, 0x00000000, 0x00018201, 0x00018201, 0x00000000 },
+    { 0x0000a30c, 0x00000000, 0x00000000, 0x0001b240, 0x0001b240, 0x00000000 },
+    { 0x0000a310, 0x00000000, 0x00000000, 0x0001d241, 0x0001d241, 0x00000000 },
+    { 0x0000a314, 0x00000000, 0x00000000, 0x0001f600, 0x0001f600, 0x00000000 },
+    { 0x0000a318, 0x00000000, 0x00000000, 0x00022800, 0x00022800, 0x00000000 },
+    { 0x0000a31c, 0x00000000, 0x00000000, 0x00026802, 0x00026802, 0x00000000 },
+    { 0x0000a320, 0x00000000, 0x00000000, 0x0002b805, 0x0002b805, 0x00000000 },
+    { 0x0000a324, 0x00000000, 0x00000000, 0x0002ea41, 0x0002ea41, 0x00000000 },
+    { 0x0000a328, 0x00000000, 0x00000000, 0x00038b00, 0x00038b00, 0x00000000 },
+    { 0x0000a32c, 0x00000000, 0x00000000, 0x0003ab40, 0x0003ab40, 0x00000000 },
+    { 0x0000a330, 0x00000000, 0x00000000, 0x0003cd80, 0x0003cd80, 0x00000000 },
+    { 0x0000a334, 0x000368de, 0x000368de, 0x000368de, 0x000368de, 0x00000000 },
+    { 0x0000a338, 0x0003891e, 0x0003891e, 0x0003891e, 0x0003891e, 0x00000000 },
+    { 0x0000a33c, 0x0003a95e, 0x0003a95e, 0x0003a95e, 0x0003a95e, 0x00000000 },
+    { 0x0000a340, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x0000a344, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x0000a348, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x0000a34c, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x0000a350, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x0000a354, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x0003e9df, 0x00000000 },
+    { 0x00007838, 0x0000002b, 0x0000002b, 0x0000002b, 0x0000002b, 0x0000002b },
+    { 0x00007824, 0x00d8a7ff, 0x00d8a7ff, 0x00d8a7ff, 0x00d8a7ff, 0x00d8a7ff },
+    { 0x0000786c, 0x08609eb6, 0x08609eb6, 0x08609eba, 0x08609eba, 0x08609eb6 },
+    { 0x00007820, 0x00000c00, 0x00000c00, 0x00000c00, 0x00000c00, 0x00000c00 },
+    { 0x0000a274, 0x0a22a652, 0x0a22a652, 0x0a212652, 0x0a212652, 0x0a22a652 },
+    { 0x0000a278, 0x0e739ce7, 0x0e739ce7, 0x0e739ce7, 0x0e739ce7, 0x0e739ce7 },
+    { 0x0000a27c, 0x05018063, 0x05038063, 0x05018063, 0x05018063, 0x05018063 },
+    { 0x0000a394, 0x06318c63, 0x06318c63, 0x06318c63, 0x06318c63, 0x06318c63 },
+    { 0x0000a398, 0x00000063, 0x00000063, 0x00000063, 0x00000063, 0x00000063 },
+    { 0x0000a3dc, 0x06318c63, 0x06318c63, 0x06318c63, 0x06318c63, 0x06318c63 },
+    { 0x0000a3e0, 0x00000063, 0x00000063, 0x00000063, 0x00000063, 0x00000063 },
+};
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index efc420cd42bf..4a2060e5a777 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -31,8 +31,10 @@ static void ath9k_hw_set_txq_interrupts(struct ath_hw *ah,
         REG_WRITE(ah, AR_IMR_S1,
                   SM(ah->txerr_interrupt_mask, AR_IMR_S1_QCU_TXERR)
                   | SM(ah->txeol_interrupt_mask, AR_IMR_S1_QCU_TXEOL));
-        REG_RMW_FIELD(ah, AR_IMR_S2,
-                      AR_IMR_S2_QCU_TXURN, ah->txurn_interrupt_mask);
+
+        ah->imrs2_reg &= ~AR_IMR_S2_QCU_TXURN;
+        ah->imrs2_reg |= (ah->txurn_interrupt_mask & AR_IMR_S2_QCU_TXURN);
+        REG_WRITE(ah, AR_IMR_S2, ah->imrs2_reg);
 }
 
 u32 ath9k_hw_gettxbuf(struct ath_hw *ah, u32 q)
@@ -103,7 +105,7 @@ bool ath9k_hw_updatetxtriglevel(struct ath_hw *ah, bool bIncTrigLevel)
         if (ah->tx_trig_level >= ah->config.max_txtrig_level)
                 return false;
 
-        omask = ath9k_hw_set_interrupts(ah, ah->mask_reg & ~ATH9K_INT_GLOBAL);
+        omask = ath9k_hw_set_interrupts(ah, ah->imask & ~ATH9K_INT_GLOBAL);
 
         txcfg = REG_READ(ah, AR_TXCFG);
         curLevel = MS(txcfg, AR_FTRIG);
@@ -244,79 +246,80 @@ void ath9k_hw_cleartxdesc(struct ath_hw *ah, struct ath_desc *ds)
 }
 EXPORT_SYMBOL(ath9k_hw_cleartxdesc);
 
-int ath9k_hw_txprocdesc(struct ath_hw *ah, struct ath_desc *ds)
+int ath9k_hw_txprocdesc(struct ath_hw *ah, struct ath_desc *ds,
+                        struct ath_tx_status *ts)
 {
         struct ar5416_desc *ads = AR5416DESC(ds);
 
         if ((ads->ds_txstatus9 & AR_TxDone) == 0)
                 return -EINPROGRESS;
 
-        ds->ds_txstat.ts_seqnum = MS(ads->ds_txstatus9, AR_SeqNum);
-        ds->ds_txstat.ts_tstamp = ads->AR_SendTimestamp;
-        ds->ds_txstat.ts_status = 0;
-        ds->ds_txstat.ts_flags = 0;
+        ts->ts_seqnum = MS(ads->ds_txstatus9, AR_SeqNum);
+        ts->ts_tstamp = ads->AR_SendTimestamp;
+        ts->ts_status = 0;
+        ts->ts_flags = 0;
 
         if (ads->ds_txstatus1 & AR_FrmXmitOK)
-                ds->ds_txstat.ts_status |= ATH9K_TX_ACKED;
+                ts->ts_status |= ATH9K_TX_ACKED;
         if (ads->ds_txstatus1 & AR_ExcessiveRetries)
-                ds->ds_txstat.ts_status |= ATH9K_TXERR_XRETRY;
+                ts->ts_status |= ATH9K_TXERR_XRETRY;
         if (ads->ds_txstatus1 & AR_Filtered)
-                ds->ds_txstat.ts_status |= ATH9K_TXERR_FILT;
+                ts->ts_status |= ATH9K_TXERR_FILT;
         if (ads->ds_txstatus1 & AR_FIFOUnderrun) {
-                ds->ds_txstat.ts_status |= ATH9K_TXERR_FIFO;
+                ts->ts_status |= ATH9K_TXERR_FIFO;
                 ath9k_hw_updatetxtriglevel(ah, true);
         }
         if (ads->ds_txstatus9 & AR_TxOpExceeded)
-                ds->ds_txstat.ts_status |= ATH9K_TXERR_XTXOP;
+                ts->ts_status |= ATH9K_TXERR_XTXOP;
         if (ads->ds_txstatus1 & AR_TxTimerExpired)
-                ds->ds_txstat.ts_status |= ATH9K_TXERR_TIMER_EXPIRED;
+                ts->ts_status |= ATH9K_TXERR_TIMER_EXPIRED;
 
         if (ads->ds_txstatus1 & AR_DescCfgErr)
-                ds->ds_txstat.ts_flags |= ATH9K_TX_DESC_CFG_ERR;
+                ts->ts_flags |= ATH9K_TX_DESC_CFG_ERR;
         if (ads->ds_txstatus1 & AR_TxDataUnderrun) {
-                ds->ds_txstat.ts_flags |= ATH9K_TX_DATA_UNDERRUN;
+                ts->ts_flags |= ATH9K_TX_DATA_UNDERRUN;
                 ath9k_hw_updatetxtriglevel(ah, true);
         }
         if (ads->ds_txstatus1 & AR_TxDelimUnderrun) {
-                ds->ds_txstat.ts_flags |= ATH9K_TX_DELIM_UNDERRUN;
+                ts->ts_flags |= ATH9K_TX_DELIM_UNDERRUN;
                 ath9k_hw_updatetxtriglevel(ah, true);
         }
         if (ads->ds_txstatus0 & AR_TxBaStatus) {
-                ds->ds_txstat.ts_flags |= ATH9K_TX_BA;
-                ds->ds_txstat.ba_low = ads->AR_BaBitmapLow;
-                ds->ds_txstat.ba_high = ads->AR_BaBitmapHigh;
+                ts->ts_flags |= ATH9K_TX_BA;
+                ts->ba_low = ads->AR_BaBitmapLow;
+                ts->ba_high = ads->AR_BaBitmapHigh;
         }
 
-        ds->ds_txstat.ts_rateindex = MS(ads->ds_txstatus9, AR_FinalTxIdx);
-        switch (ds->ds_txstat.ts_rateindex) {
+        ts->ts_rateindex = MS(ads->ds_txstatus9, AR_FinalTxIdx);
+        switch (ts->ts_rateindex) {
         case 0:
-                ds->ds_txstat.ts_ratecode = MS(ads->ds_ctl3, AR_XmitRate0);
+                ts->ts_ratecode = MS(ads->ds_ctl3, AR_XmitRate0);
                 break;
         case 1:
-                ds->ds_txstat.ts_ratecode = MS(ads->ds_ctl3, AR_XmitRate1);
+                ts->ts_ratecode = MS(ads->ds_ctl3, AR_XmitRate1);
                 break;
         case 2:
-                ds->ds_txstat.ts_ratecode = MS(ads->ds_ctl3, AR_XmitRate2);
+                ts->ts_ratecode = MS(ads->ds_ctl3, AR_XmitRate2);
                 break;
         case 3:
-                ds->ds_txstat.ts_ratecode = MS(ads->ds_ctl3, AR_XmitRate3);
+                ts->ts_ratecode = MS(ads->ds_ctl3, AR_XmitRate3);
                 break;
         }
 
-        ds->ds_txstat.ts_rssi = MS(ads->ds_txstatus5, AR_TxRSSICombined);
-        ds->ds_txstat.ts_rssi_ctl0 = MS(ads->ds_txstatus0, AR_TxRSSIAnt00);
-        ds->ds_txstat.ts_rssi_ctl1 = MS(ads->ds_txstatus0, AR_TxRSSIAnt01);
-        ds->ds_txstat.ts_rssi_ctl2 = MS(ads->ds_txstatus0, AR_TxRSSIAnt02);
-        ds->ds_txstat.ts_rssi_ext0 = MS(ads->ds_txstatus5, AR_TxRSSIAnt10);
-        ds->ds_txstat.ts_rssi_ext1 = MS(ads->ds_txstatus5, AR_TxRSSIAnt11);
-        ds->ds_txstat.ts_rssi_ext2 = MS(ads->ds_txstatus5, AR_TxRSSIAnt12);
-        ds->ds_txstat.evm0 = ads->AR_TxEVM0;
-        ds->ds_txstat.evm1 = ads->AR_TxEVM1;
-        ds->ds_txstat.evm2 = ads->AR_TxEVM2;
-        ds->ds_txstat.ts_shortretry = MS(ads->ds_txstatus1, AR_RTSFailCnt);
-        ds->ds_txstat.ts_longretry = MS(ads->ds_txstatus1, AR_DataFailCnt);
-        ds->ds_txstat.ts_virtcol = MS(ads->ds_txstatus1, AR_VirtRetryCnt);
-        ds->ds_txstat.ts_antenna = 0;
+        ts->ts_rssi = MS(ads->ds_txstatus5, AR_TxRSSICombined);
+        ts->ts_rssi_ctl0 = MS(ads->ds_txstatus0, AR_TxRSSIAnt00);
+        ts->ts_rssi_ctl1 = MS(ads->ds_txstatus0, AR_TxRSSIAnt01);
+        ts->ts_rssi_ctl2 = MS(ads->ds_txstatus0, AR_TxRSSIAnt02);
+        ts->ts_rssi_ext0 = MS(ads->ds_txstatus5, AR_TxRSSIAnt10);
+        ts->ts_rssi_ext1 = MS(ads->ds_txstatus5, AR_TxRSSIAnt11);
+        ts->ts_rssi_ext2 = MS(ads->ds_txstatus5, AR_TxRSSIAnt12);
+        ts->evm0 = ads->AR_TxEVM0;
+        ts->evm1 = ads->AR_TxEVM1;
+        ts->evm2 = ads->AR_TxEVM2;
+        ts->ts_shortretry = MS(ads->ds_txstatus1, AR_RTSFailCnt);
+        ts->ts_longretry = MS(ads->ds_txstatus1, AR_DataFailCnt);
+        ts->ts_virtcol = MS(ads->ds_txstatus1, AR_VirtRetryCnt);
+        ts->ts_antenna = 0;
 
         return 0;
 }
@@ -349,7 +352,7 @@ void ath9k_hw_set11n_txdesc(struct ath_hw *ah, struct ath_desc *ds,
 
         ads->ds_ctl6 = SM(keyType, AR_EncrType);
 
-        if (AR_SREV_9285(ah)) {
+        if (AR_SREV_9285(ah) || AR_SREV_9271(ah)) {
                 ads->ds_ctl8 = 0;
                 ads->ds_ctl9 = 0;
                 ads->ds_ctl10 = 0;
@@ -856,7 +859,7 @@ bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q)
 EXPORT_SYMBOL(ath9k_hw_resettxqueue);
 
 int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
-                        u32 pa, struct ath_desc *nds, u64 tsf)
+                        struct ath_rx_status *rs, u64 tsf)
 {
         struct ar5416_desc ads;
         struct ar5416_desc *adsp = AR5416DESC(ds);
@@ -867,70 +870,70 @@ int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
 
         ads.u.rx = adsp->u.rx;
 
-        ds->ds_rxstat.rs_status = 0;
-        ds->ds_rxstat.rs_flags = 0;
+        rs->rs_status = 0;
+        rs->rs_flags = 0;
 
-        ds->ds_rxstat.rs_datalen = ads.ds_rxstatus1 & AR_DataLen;
-        ds->ds_rxstat.rs_tstamp = ads.AR_RcvTimestamp;
+        rs->rs_datalen = ads.ds_rxstatus1 & AR_DataLen;
+        rs->rs_tstamp = ads.AR_RcvTimestamp;
 
         if (ads.ds_rxstatus8 & AR_PostDelimCRCErr) {
-                ds->ds_rxstat.rs_rssi = ATH9K_RSSI_BAD;
-                ds->ds_rxstat.rs_rssi_ctl0 = ATH9K_RSSI_BAD;
-                ds->ds_rxstat.rs_rssi_ctl1 = ATH9K_RSSI_BAD;
-                ds->ds_rxstat.rs_rssi_ctl2 = ATH9K_RSSI_BAD;
-                ds->ds_rxstat.rs_rssi_ext0 = ATH9K_RSSI_BAD;
-                ds->ds_rxstat.rs_rssi_ext1 = ATH9K_RSSI_BAD;
-                ds->ds_rxstat.rs_rssi_ext2 = ATH9K_RSSI_BAD;
+                rs->rs_rssi = ATH9K_RSSI_BAD;
+                rs->rs_rssi_ctl0 = ATH9K_RSSI_BAD;
+                rs->rs_rssi_ctl1 = ATH9K_RSSI_BAD;
+                rs->rs_rssi_ctl2 = ATH9K_RSSI_BAD;
+                rs->rs_rssi_ext0 = ATH9K_RSSI_BAD;
+                rs->rs_rssi_ext1 = ATH9K_RSSI_BAD;
+                rs->rs_rssi_ext2 = ATH9K_RSSI_BAD;
         } else {
-                ds->ds_rxstat.rs_rssi = MS(ads.ds_rxstatus4, AR_RxRSSICombined);
-                ds->ds_rxstat.rs_rssi_ctl0 = MS(ads.ds_rxstatus0,
+                rs->rs_rssi = MS(ads.ds_rxstatus4, AR_RxRSSICombined);
+                rs->rs_rssi_ctl0 = MS(ads.ds_rxstatus0,
                                                 AR_RxRSSIAnt00);
-                ds->ds_rxstat.rs_rssi_ctl1 = MS(ads.ds_rxstatus0,
+                rs->rs_rssi_ctl1 = MS(ads.ds_rxstatus0,
                                                 AR_RxRSSIAnt01);
-                ds->ds_rxstat.rs_rssi_ctl2 = MS(ads.ds_rxstatus0,
+                rs->rs_rssi_ctl2 = MS(ads.ds_rxstatus0,
                                                 AR_RxRSSIAnt02);
-                ds->ds_rxstat.rs_rssi_ext0 = MS(ads.ds_rxstatus4,
+                rs->rs_rssi_ext0 = MS(ads.ds_rxstatus4,
                                                 AR_RxRSSIAnt10);
-                ds->ds_rxstat.rs_rssi_ext1 = MS(ads.ds_rxstatus4,
+                rs->rs_rssi_ext1 = MS(ads.ds_rxstatus4,
                                                 AR_RxRSSIAnt11);
-                ds->ds_rxstat.rs_rssi_ext2 = MS(ads.ds_rxstatus4,
+                rs->rs_rssi_ext2 = MS(ads.ds_rxstatus4,
                                                 AR_RxRSSIAnt12);
         }
         if (ads.ds_rxstatus8 & AR_RxKeyIdxValid)
-                ds->ds_rxstat.rs_keyix = MS(ads.ds_rxstatus8, AR_KeyIdx);
+                rs->rs_keyix = MS(ads.ds_rxstatus8, AR_KeyIdx);
         else
-                ds->ds_rxstat.rs_keyix = ATH9K_RXKEYIX_INVALID;
+                rs->rs_keyix = ATH9K_RXKEYIX_INVALID;
 
-        ds->ds_rxstat.rs_rate = RXSTATUS_RATE(ah, (&ads));
-        ds->ds_rxstat.rs_more = (ads.ds_rxstatus1 & AR_RxMore) ? 1 : 0;
+        rs->rs_rate = RXSTATUS_RATE(ah, (&ads));
+        rs->rs_more = (ads.ds_rxstatus1 & AR_RxMore) ? 1 : 0;
 
-        ds->ds_rxstat.rs_isaggr = (ads.ds_rxstatus8 & AR_RxAggr) ? 1 : 0;
-        ds->ds_rxstat.rs_moreaggr =
+        rs->rs_isaggr = (ads.ds_rxstatus8 & AR_RxAggr) ? 1 : 0;
+        rs->rs_moreaggr =
                 (ads.ds_rxstatus8 & AR_RxMoreAggr) ? 1 : 0;
-        ds->ds_rxstat.rs_antenna = MS(ads.ds_rxstatus3, AR_RxAntenna);
-        ds->ds_rxstat.rs_flags =
+        rs->rs_antenna = MS(ads.ds_rxstatus3, AR_RxAntenna);
+        rs->rs_flags =
                 (ads.ds_rxstatus3 & AR_GI) ? ATH9K_RX_GI : 0;
-        ds->ds_rxstat.rs_flags |=
+        rs->rs_flags |=
                 (ads.ds_rxstatus3 & AR_2040) ? ATH9K_RX_2040 : 0;
 
         if (ads.ds_rxstatus8 & AR_PreDelimCRCErr)
-                ds->ds_rxstat.rs_flags |= ATH9K_RX_DELIM_CRC_PRE;
+                rs->rs_flags |= ATH9K_RX_DELIM_CRC_PRE;
         if (ads.ds_rxstatus8 & AR_PostDelimCRCErr)
-                ds->ds_rxstat.rs_flags |= ATH9K_RX_DELIM_CRC_POST;
+                rs->rs_flags |= ATH9K_RX_DELIM_CRC_POST;
         if (ads.ds_rxstatus8 & AR_DecryptBusyErr)
-                ds->ds_rxstat.rs_flags |= ATH9K_RX_DECRYPT_BUSY;
+                rs->rs_flags |= ATH9K_RX_DECRYPT_BUSY;
 
         if ((ads.ds_rxstatus8 & AR_RxFrameOK) == 0) {
                 if (ads.ds_rxstatus8 & AR_CRCErr)
-                        ds->ds_rxstat.rs_status |= ATH9K_RXERR_CRC;
+                        rs->rs_status |= ATH9K_RXERR_CRC;
                 else if (ads.ds_rxstatus8 & AR_PHYErr) {
-                        ds->ds_rxstat.rs_status |= ATH9K_RXERR_PHY;
+                        rs->rs_status |= ATH9K_RXERR_PHY;
                         phyerr = MS(ads.ds_rxstatus8, AR_PHYErrCode);
-                        ds->ds_rxstat.rs_phyerr = phyerr;
+                        rs->rs_phyerr = phyerr;
                 } else if (ads.ds_rxstatus8 & AR_DecryptCRCErr)
-                        ds->ds_rxstat.rs_status |= ATH9K_RXERR_DECRYPT;
+                        rs->rs_status |= ATH9K_RXERR_DECRYPT;
                 else if (ads.ds_rxstatus8 & AR_MichaelErr)
-                        ds->ds_rxstat.rs_status |= ATH9K_RXERR_MIC;
+                        rs->rs_status |= ATH9K_RXERR_MIC;
         }
 
         return 0;
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index 29851e6376a9..68dbd7a8ddca 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -150,6 +150,32 @@ struct ath_rx_status {
         u32 evm2;
 };
 
+struct ath_htc_rx_status {
+        u64 rs_tstamp;
+        u16 rs_datalen;
+        u8 rs_status;
+        u8 rs_phyerr;
+        int8_t rs_rssi;
+        int8_t rs_rssi_ctl0;
+        int8_t rs_rssi_ctl1;
+        int8_t rs_rssi_ctl2;
+        int8_t rs_rssi_ext0;
+        int8_t rs_rssi_ext1;
+        int8_t rs_rssi_ext2;
+        u8 rs_keyix;
+        u8 rs_rate;
+        u8 rs_antenna;
+        u8 rs_more;
+        u8 rs_isaggr;
+        u8 rs_moreaggr;
+        u8 rs_num_delims;
+        u8 rs_flags;
+        u8 rs_dummy;
+        u32 evm0;
+        u32 evm1;
+        u32 evm2;
+};
+
 #define ATH9K_RXERR_CRC           0x01
 #define ATH9K_RXERR_PHY           0x02
 #define ATH9K_RXERR_FIFO          0x04
@@ -207,18 +233,9 @@ struct ath_desc {
         u32 ds_ctl0;
         u32 ds_ctl1;
         u32 ds_hw[20];
-        union {
-                struct ath_tx_status tx;
-                struct ath_rx_status rx;
-                void *stats;
-        } ds_us;
         void *ds_vdata;
 } __packed;
 
-#define ds_txstat       ds_us.tx
-#define ds_rxstat       ds_us.rx
-#define ds_stat         ds_us.stats
-
 #define ATH9K_TXDESC_CLRDMASK           0x0001
 #define ATH9K_TXDESC_NOACK              0x0002
 #define ATH9K_TXDESC_RTSENA             0x0004
@@ -676,7 +693,8 @@ void ath9k_hw_filltxdesc(struct ath_hw *ah, struct ath_desc *ds,
                          u32 segLen, bool firstSeg,
                          bool lastSeg, const struct ath_desc *ds0);
 void ath9k_hw_cleartxdesc(struct ath_hw *ah, struct ath_desc *ds);
-int ath9k_hw_txprocdesc(struct ath_hw *ah, struct ath_desc *ds);
+int ath9k_hw_txprocdesc(struct ath_hw *ah, struct ath_desc *ds,
+                        struct ath_tx_status *ts);
 void ath9k_hw_set11n_txdesc(struct ath_hw *ah, struct ath_desc *ds,
                             u32 pktLen, enum ath9k_pkt_type type, u32 txPower,
                             u32 keyIx, enum ath9k_key_type keyType, u32 flags);
@@ -706,7 +724,7 @@ int ath9k_hw_setuptxqueue(struct ath_hw *ah, enum ath9k_tx_queue type,
 bool ath9k_hw_releasetxqueue(struct ath_hw *ah, u32 q);
 bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q);
 int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
-                        u32 pa, struct ath_desc *nds, u64 tsf);
+                        struct ath_rx_status *rs, u64 tsf);
 void ath9k_hw_setuprxdesc(struct ath_hw *ah, struct ath_desc *ds,
                           u32 size, u32 flags);
 bool ath9k_hw_setrxabort(struct ath_hw *ah, bool set);
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 115e1aeedb59..f7ef11407e27 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -225,7 +225,7 @@ int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
 
         ath_cache_conf_rate(sc, &hw->conf);
         ath_update_txpow(sc);
-        ath9k_hw_set_interrupts(ah, sc->imask);
+        ath9k_hw_set_interrupts(ah, ah->imask);
 
  ps_restore:
         ath9k_ps_restore(sc);
@@ -434,7 +434,7 @@ void ath9k_tasklet(unsigned long data)
                         ath_gen_timer_isr(sc->sc_ah);
 
         /* re-enable hardware interrupt */
-        ath9k_hw_set_interrupts(ah, sc->imask);
+        ath9k_hw_set_interrupts(ah, ah->imask);
         ath9k_ps_restore(sc);
 }
 
@@ -477,7 +477,7 @@ irqreturn_t ath_isr(int irq, void *dev)
          * value to insure we only process bits we requested.
          */
         ath9k_hw_getisr(ah, &status);   /* NB: clears ISR too */
-        status &= sc->imask;    /* discard unasked-for bits */
+        status &= ah->imask;    /* discard unasked-for bits */
 
         /*
          * If there are no status bits set, then this interrupt was not
@@ -518,7 +518,7 @@ irqreturn_t ath_isr(int irq, void *dev)
                  * the interrupt.
                  */
                 ath9k_hw_procmibevent(ah);
-                ath9k_hw_set_interrupts(ah, sc->imask);
+                ath9k_hw_set_interrupts(ah, ah->imask);
         }
 
         if (!(ah->caps.hw_caps & ATH9K_HW_CAP_AUTOSLEEP))
@@ -536,7 +536,7 @@ chip_reset:
 
         if (sched) {
                 /* turn off every interrupt except SWBA */
-                ath9k_hw_set_interrupts(ah, (sc->imask & ATH9K_INT_SWBA));
+                ath9k_hw_set_interrupts(ah, (ah->imask & ATH9K_INT_SWBA));
                 tasklet_schedule(&sc->intr_tq);
         }
 
@@ -887,7 +887,7 @@ void ath_radio_enable(struct ath_softc *sc, struct ieee80211_hw *hw)
                 ath_beacon_config(sc, NULL);    /* restart beacons */
 
         /* Re-Enable  interrupts */
-        ath9k_hw_set_interrupts(ah, sc->imask);
+        ath9k_hw_set_interrupts(ah, ah->imask);
 
         /* Enable LED */
         ath9k_hw_cfg_output(ah, ah->led_pin,
@@ -977,7 +977,7 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
         if (sc->sc_flags & SC_OP_BEACONS)
                 ath_beacon_config(sc, NULL);    /* restart beacons */
 
-        ath9k_hw_set_interrupts(ah, sc->imask);
+        ath9k_hw_set_interrupts(ah, ah->imask);
 
         if (retry_tx) {
                 int i;
@@ -1162,23 +1162,23 @@ static int ath9k_start(struct ieee80211_hw *hw)
         }
 
         /* Setup our intr mask. */
-        sc->imask = ATH9K_INT_RX | ATH9K_INT_TX
+        ah->imask = ATH9K_INT_RX | ATH9K_INT_TX
                 | ATH9K_INT_RXEOL | ATH9K_INT_RXORN
                 | ATH9K_INT_FATAL | ATH9K_INT_GLOBAL;
 
         if (ah->caps.hw_caps & ATH9K_HW_CAP_GTT)
-                sc->imask |= ATH9K_INT_GTT;
+                ah->imask |= ATH9K_INT_GTT;
 
         if (ah->caps.hw_caps & ATH9K_HW_CAP_HT)
-                sc->imask |= ATH9K_INT_CST;
+                ah->imask |= ATH9K_INT_CST;
 
         ath_cache_conf_rate(sc, &hw->conf);
 
         sc->sc_flags &= ~SC_OP_INVALID;
 
         /* Disable BMISS interrupt when we're not associated */
-        sc->imask &= ~(ATH9K_INT_SWBA | ATH9K_INT_BMISS);
-        ath9k_hw_set_interrupts(ah, sc->imask);
+        ah->imask &= ~(ATH9K_INT_SWBA | ATH9K_INT_BMISS);
+        ath9k_hw_set_interrupts(ah, ah->imask);
 
         ieee80211_wake_queues(hw);
 
@@ -1372,14 +1372,15 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
 {
         struct ath_wiphy *aphy = hw->priv;
         struct ath_softc *sc = aphy->sc;
-        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ath_vif *avp = (void *)vif->drv_priv;
         enum nl80211_iftype ic_opmode = NL80211_IFTYPE_UNSPECIFIED;
         int ret = 0;
 
         mutex_lock(&sc->mutex);
 
-        if (!(sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_BSSIDMASK) &&
+        if (!(ah->caps.hw_caps & ATH9K_HW_CAP_BSSIDMASK) &&
             sc->nvifs > 0) {
                 ret = -ENOBUFS;
                 goto out;
@@ -1414,19 +1415,19 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
 
         sc->nvifs++;
 
-        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_BSSIDMASK)
+        if (ah->caps.hw_caps & ATH9K_HW_CAP_BSSIDMASK)
                 ath9k_set_bssid_mask(hw);
 
         if (sc->nvifs > 1)
                 goto out; /* skip global settings for secondary vif */
 
         if (ic_opmode == NL80211_IFTYPE_AP) {
-                ath9k_hw_set_tsfadjust(sc->sc_ah, 1);
+                ath9k_hw_set_tsfadjust(ah, 1);
                 sc->sc_flags |= SC_OP_TSF_RESET;
         }
 
         /* Set the device opmode */
-        sc->sc_ah->opmode = ic_opmode;
+        ah->opmode = ic_opmode;
 
         /*
          * Enable MIB interrupts when there are hardware phy counters.
@@ -1435,11 +1436,11 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
         if ((vif->type == NL80211_IFTYPE_STATION) ||
             (vif->type == NL80211_IFTYPE_ADHOC) ||
             (vif->type == NL80211_IFTYPE_MESH_POINT)) {
-                sc->imask |= ATH9K_INT_MIB;
-                sc->imask |= ATH9K_INT_TSFOOR;
+                ah->imask |= ATH9K_INT_MIB;
+                ah->imask |= ATH9K_INT_TSFOOR;
         }
 
-        ath9k_hw_set_interrupts(sc->sc_ah, sc->imask);
+        ath9k_hw_set_interrupts(ah, ah->imask);
 
         if (vif->type == NL80211_IFTYPE_AP    ||
             vif->type == NL80211_IFTYPE_ADHOC ||
@@ -1495,15 +1496,16 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
 
 void ath9k_enable_ps(struct ath_softc *sc)
 {
+        struct ath_hw *ah = sc->sc_ah;
+
         sc->ps_enabled = true;
-        if (!(sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_AUTOSLEEP)) {
-                if ((sc->imask & ATH9K_INT_TIM_TIMER) == 0) {
-                        sc->imask |= ATH9K_INT_TIM_TIMER;
-                        ath9k_hw_set_interrupts(sc->sc_ah,
-                                        sc->imask);
+        if (!(ah->caps.hw_caps & ATH9K_HW_CAP_AUTOSLEEP)) {
+                if ((ah->imask & ATH9K_INT_TIM_TIMER) == 0) {
+                        ah->imask |= ATH9K_INT_TIM_TIMER;
+                        ath9k_hw_set_interrupts(ah, ah->imask);
                 }
         }
-        ath9k_hw_setrxabort(sc->sc_ah, 1);
+        ath9k_hw_setrxabort(ah, 1);
 }
 
 static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
@@ -1579,10 +1581,10 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                                                   PS_WAIT_FOR_CAB |
                                                   PS_WAIT_FOR_PSPOLL_DATA |
                                                   PS_WAIT_FOR_TX_ACK);
-                                if (sc->imask & ATH9K_INT_TIM_TIMER) {
-                                        sc->imask &= ~ATH9K_INT_TIM_TIMER;
+                                if (ah->imask & ATH9K_INT_TIM_TIMER) {
+                                        ah->imask &= ~ATH9K_INT_TIM_TIMER;
                                         ath9k_hw_set_interrupts(sc->sc_ah,
-                                                        sc->imask);
+                                                        ah->imask);
                                 }
                         }
                 }
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 9441c6718a30..1ec836cf1c0d 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -88,6 +88,7 @@ static void ath_pci_bt_coex_prep(struct ath_common *common)
 }
 
 static const struct ath_bus_ops ath_pci_bus_ops = {
+        .ath_bus_type = ATH_PCI,
         .read_cachesize = ath_pci_read_cachesize,
         .eeprom_read = ath_pci_eeprom_read,
         .bt_coex_prep = ath_pci_bt_coex_prep,
diff --git a/drivers/net/wireless/ath/ath9k/phy.h b/drivers/net/wireless/ath/ath9k/phy.h
index 0999a495fd46..0132e4c9a9f9 100644
--- a/drivers/net/wireless/ath/ath9k/phy.h
+++ b/drivers/net/wireless/ath/ath9k/phy.h
@@ -503,6 +503,8 @@ bool ath9k_hw_set_rf_regs(struct ath_hw *ah,
 #define AR_PHY_TX_PWRCTRL_ERR_EST_MODE_S   24
 
 #define AR_PHY_TX_PWRCTRL7       0xa274
+#define AR_PHY_TX_PWRCTRL_TX_GAIN_TAB_MAX   0x0007E000
+#define AR_PHY_TX_PWRCTRL_TX_GAIN_TAB_MAX_S 13
 #define AR_PHY_TX_PWRCTRL_INIT_TX_GAIN     0x01F80000
 #define AR_PHY_TX_PWRCTRL_INIT_TX_GAIN_S   19
 
@@ -513,8 +515,16 @@ bool ath9k_hw_set_rf_regs(struct ath_hw *ah,
 #define AR_PHY_TX_PWRCTRL9_RES_DC_REMOVAL_S 31
 
 #define AR_PHY_TX_GAIN_TBL1      0xa300
-#define AR_PHY_TX_GAIN                     0x0007F000
-#define AR_PHY_TX_GAIN_S                   12
+#define AR_PHY_TX_GAIN_CLC       0x0000001E
+#define AR_PHY_TX_GAIN_CLC_S     1
+#define AR_PHY_TX_GAIN           0x0007F000
+#define AR_PHY_TX_GAIN_S         12
+
+#define AR_PHY_CLC_TBL1      0xa35c
+#define AR_PHY_CLC_I0        0x07ff0000
+#define AR_PHY_CLC_I0_S      16
+#define AR_PHY_CLC_Q0        0x0000ffd0
+#define AR_PHY_CLC_Q0_S      5
 
 #define AR_PHY_CH0_TX_PWRCTRL11  0xa398
 #define AR_PHY_CH1_TX_PWRCTRL11  0xb398
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index 0e79e58cf4c9..3c4b5d2d9e16 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -1226,8 +1226,12 @@ static void ath_tx_status(void *priv, struct ieee80211_supported_band *sband,
                 long_retry = rate->count - 1;
         }
 
-        if (!priv_sta || !ieee80211_is_data(fc) ||
-            !(tx_info->pad[0] & ATH_TX_INFO_UPDATE_RC))
+        if (!priv_sta || !ieee80211_is_data(fc))
+                return;
+
+        /* This packet was aggregated but doesn't carry status info */
+        if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) &&
+            !(tx_info->flags & IEEE80211_TX_STAT_AMPDU))
                 return;
 
         if (tx_info->flags & IEEE80211_TX_STAT_TX_FILTERED)
diff --git a/drivers/net/wireless/ath/ath9k/rc.h b/drivers/net/wireless/ath/ath9k/rc.h
index 4f6d6fd442f4..3d8d40cdc99e 100644
--- a/drivers/net/wireless/ath/ath9k/rc.h
+++ b/drivers/net/wireless/ath/ath9k/rc.h
@@ -110,8 +110,8 @@ struct ath_rate_table {
         int rate_cnt;
         int mcs_start;
         struct {
-                int valid;
-                int valid_single_stream;
+                u8 valid;
+                u8 valid_single_stream;
                 u8 phy;
                 u32 ratekbps;
                 u32 user_ratekbps;
@@ -172,14 +172,13 @@ struct ath_rate_priv {
 
 #define ATH_TX_INFO_FRAME_TYPE_INTERNAL (1 << 0)
 #define ATH_TX_INFO_FRAME_TYPE_PAUSE    (1 << 1)
-#define ATH_TX_INFO_UPDATE_RC           (1 << 2)
 #define ATH_TX_INFO_XRETRY              (1 << 3)
 #define ATH_TX_INFO_UNDERRUN            (1 << 4)
 
 enum ath9k_internal_frame_type {
-        ATH9K_NOT_INTERNAL,
-        ATH9K_INT_PAUSE,
-        ATH9K_INT_UNPAUSE
+        ATH9K_IFT_NOT_INTERNAL,
+        ATH9K_IFT_PAUSE,
+        ATH9K_IFT_UNPAUSE
 };
 
 int ath_rate_control_register(void);
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 1ca42e5148c8..94560e2fe376 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -477,7 +477,6 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
 
         struct ath_buf *bf;
         struct ath_desc *ds;
-        struct ath_rx_status *rx_stats;
         struct sk_buff *skb = NULL, *requeue_skb;
         struct ieee80211_rx_status *rxs;
         struct ath_hw *ah = sc->sc_ah;
@@ -491,6 +490,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
         struct ieee80211_hdr *hdr;
         int retval;
         bool decrypt_error = false;
+        struct ath_rx_status rs;
 
         spin_lock_bh(&sc->rx.rxbuflock);
 
@@ -518,14 +518,14 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
                  * on.  All this is necessary because of our use of
                  * a self-linked list to avoid rx overruns.
                  */
-                retval = ath9k_hw_rxprocdesc(ah, ds,
-                                             bf->bf_daddr,
-                                             PA2DESC(sc, ds->ds_link),
-                                             0);
+                memset(&rs, 0, sizeof(rs));
+                retval = ath9k_hw_rxprocdesc(ah, ds, &rs, 0);
                 if (retval == -EINPROGRESS) {
+                        struct ath_rx_status trs;
                         struct ath_buf *tbf;
                         struct ath_desc *tds;
 
+                        memset(&trs, 0, sizeof(trs));
                         if (list_is_last(&bf->list, &sc->rx.rxbuf)) {
                                 sc->rx.rxlink = NULL;
                                 break;
@@ -545,8 +545,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
                          */
 
                         tds = tbf->bf_desc;
-                        retval = ath9k_hw_rxprocdesc(ah, tds, tbf->bf_daddr,
-                                             PA2DESC(sc, tds->ds_link), 0);
+                        retval = ath9k_hw_rxprocdesc(ah, tds, &trs, 0);
                         if (retval == -EINPROGRESS) {
                                 break;
                         }
@@ -569,9 +568,8 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
                 rxs =  IEEE80211_SKB_RXCB(skb);
 
                 hw = ath_get_virt_hw(sc, hdr);
-                rx_stats = &ds->ds_rxstat;
 
-                ath_debug_stat_rx(sc, bf);
+                ath_debug_stat_rx(sc, &rs);
 
                 /*
                  * If we're asked to flush receive queue, directly
@@ -580,7 +578,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
                 if (flush)
                         goto requeue;
 
-                retval = ath9k_cmn_rx_skb_preprocess(common, hw, skb, rx_stats,
+                retval = ath9k_cmn_rx_skb_preprocess(common, hw, skb, &rs,
                                                      rxs, &decrypt_error);
                 if (retval)
                         goto requeue;
@@ -601,9 +599,9 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
                                  common->rx_bufsize,
                                  DMA_FROM_DEVICE);
 
-                skb_put(skb, rx_stats->rs_datalen);
+                skb_put(skb, rs.rs_datalen);
 
-                ath9k_cmn_rx_skb_postprocess(common, skb, rx_stats,
+                ath9k_cmn_rx_skb_postprocess(common, skb, &rs,
                                              rxs, decrypt_error);
 
                 /* We will now give hardware our shiny new allocated skb */
@@ -626,9 +624,9 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
                  * change the default rx antenna if rx diversity chooses the
                  * other antenna 3 times in a row.
                  */
-                if (sc->rx.defant != ds->ds_rxstat.rs_antenna) {
+                if (sc->rx.defant != rs.rs_antenna) {
                         if (++sc->rx.rxotherant >= 3)
-                                ath_setdefantenna(sc, rx_stats->rs_antenna);
+                                ath_setdefantenna(sc, rs.rs_antenna);
                 } else {
                         sc->rx.rxotherant = 0;
                 }
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index 72cfa8ebd9ae..7e36ad7421b7 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -679,7 +679,7 @@
 
 #define AR_WA                           0x4004
 #define AR_WA_D3_L1_DISABLE             (1 << 14)
-#define AR9285_WA_DEFAULT               0x004a05cb
+#define AR9285_WA_DEFAULT               0x004a050b
 #define AR9280_WA_DEFAULT               0x0040073b
 #define AR_WA_DEFAULT                   0x0000073f
 
@@ -845,6 +845,10 @@
     (AR_SREV_9271(_ah) && \
      ((_ah)->hw_version.macRev == AR_SREV_REVISION_9271_11))
 
+#define AR_SREV_9285E_20(_ah) \
+    (AR_SREV_9285_12_OR_LATER(_ah) && \
+     ((REG_READ(_ah, AR_AN_SYNTH9) & 0x7) == 0x1))
+
 #define AR_RADIO_SREV_MAJOR                   0xf0
 #define AR_RAD5133_SREV_MAJOR                 0xc0
 #define AR_RAD2133_SREV_MAJOR                 0xd0
@@ -940,6 +944,7 @@ enum {
 #define AR928X_NUM_GPIO                          10
 #define AR9285_NUM_GPIO                          12
 #define AR9287_NUM_GPIO                          11
+#define AR9271_NUM_GPIO                          16
 
 #define AR_GPIO_IN_OUT                           0x4048
 #define AR_GPIO_IN_VAL                           0x0FFFC000
@@ -950,6 +955,8 @@ enum {
 #define AR9285_GPIO_IN_VAL_S                     12
 #define AR9287_GPIO_IN_VAL                       0x003FF800
 #define AR9287_GPIO_IN_VAL_S                     11
+#define AR9271_GPIO_IN_VAL                       0xFFFF0000
+#define AR9271_GPIO_IN_VAL_S                     16
 
 #define AR_GPIO_OE_OUT                           0x404c
 #define AR_GPIO_OE_OUT_DRV                       0x3
@@ -1178,6 +1185,13 @@ enum {
 #define AR9285_AN_RF2G4_DB2_4    0x00003800
 #define AR9285_AN_RF2G4_DB2_4_S    11
 
+#define AR9285_RF2G5                    0x7830
+#define AR9285_RF2G5_IC50TX             0xfffff8ff
+#define AR9285_RF2G5_IC50TX_SET         0x00000400
+#define AR9285_RF2G5_IC50TX_XE_SET      0x00000500
+#define AR9285_RF2G5_IC50TX_CLEAR       0x00000700
+#define AR9285_RF2G5_IC50TX_CLEAR_S     8
+
 /* AR9271 : 0x7828, 0x782c different setting from AR9285 */
 #define AR9271_AN_RF2G3_OB_cck          0x001C0000
 #define AR9271_AN_RF2G3_OB_cck_S        18
diff --git a/drivers/net/wireless/ath/ath9k/virtual.c b/drivers/net/wireless/ath/ath9k/virtual.c
index a43fbf84dab9..e95aaa3f18f3 100644
--- a/drivers/net/wireless/ath/ath9k/virtual.c
+++ b/drivers/net/wireless/ath/ath9k/virtual.c
@@ -218,7 +218,7 @@ static int ath9k_send_nullfunc(struct ath_wiphy *aphy,
 
         memset(&txctl, 0, sizeof(struct ath_tx_control));
         txctl.txq = &sc->tx.txq[sc->tx.hwq_map[ATH9K_WME_AC_VO]];
-        txctl.frame_type = ps ? ATH9K_INT_PAUSE : ATH9K_INT_UNPAUSE;
+        txctl.frame_type = ps ? ATH9K_IFT_PAUSE : ATH9K_IFT_UNPAUSE;
 
         if (ath_tx_start(aphy->hw, skb, &txctl) != 0)
                 goto exit;
diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
new file mode 100644
index 000000000000..818dea0164ec
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/wmi.c
@@ -0,0 +1,319 @@
+/*
+ * Copyright (c) 2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "htc.h"
+
+static const char *wmi_cmd_to_name(enum wmi_cmd_id wmi_cmd)
+{
+        switch (wmi_cmd) {
+        case WMI_ECHO_CMDID:
+                return "WMI_ECHO_CMDID";
+        case WMI_ACCESS_MEMORY_CMDID:
+                return "WMI_ACCESS_MEMORY_CMDID";
+        case WMI_DISABLE_INTR_CMDID:
+                return "WMI_DISABLE_INTR_CMDID";
+        case WMI_ENABLE_INTR_CMDID:
+                return "WMI_ENABLE_INTR_CMDID";
+        case WMI_RX_LINK_CMDID:
+                return "WMI_RX_LINK_CMDID";
+        case WMI_ATH_INIT_CMDID:
+                return "WMI_ATH_INIT_CMDID";
+        case WMI_ABORT_TXQ_CMDID:
+                return "WMI_ABORT_TXQ_CMDID";
+        case WMI_STOP_TX_DMA_CMDID:
+                return "WMI_STOP_TX_DMA_CMDID";
+        case WMI_STOP_DMA_RECV_CMDID:
+                return "WMI_STOP_DMA_RECV_CMDID";
+        case WMI_ABORT_TX_DMA_CMDID:
+                return "WMI_ABORT_TX_DMA_CMDID";
+        case WMI_DRAIN_TXQ_CMDID:
+                return "WMI_DRAIN_TXQ_CMDID";
+        case WMI_DRAIN_TXQ_ALL_CMDID:
+                return "WMI_DRAIN_TXQ_ALL_CMDID";
+        case WMI_START_RECV_CMDID:
+                return "WMI_START_RECV_CMDID";
+        case WMI_STOP_RECV_CMDID:
+                return "WMI_STOP_RECV_CMDID";
+        case WMI_FLUSH_RECV_CMDID:
+                return "WMI_FLUSH_RECV_CMDID";
+        case WMI_SET_MODE_CMDID:
+                return "WMI_SET_MODE_CMDID";
+        case WMI_RESET_CMDID:
+                return "WMI_RESET_CMDID";
+        case WMI_NODE_CREATE_CMDID:
+                return "WMI_NODE_CREATE_CMDID";
+        case WMI_NODE_REMOVE_CMDID:
+                return "WMI_NODE_REMOVE_CMDID";
+        case WMI_VAP_REMOVE_CMDID:
+                return "WMI_VAP_REMOVE_CMDID";
+        case WMI_VAP_CREATE_CMDID:
+                return "WMI_VAP_CREATE_CMDID";
+        case WMI_BEACON_UPDATE_CMDID:
+                return "WMI_BEACON_UPDATE_CMDID";
+        case WMI_REG_READ_CMDID:
+                return "WMI_REG_READ_CMDID";
+        case WMI_REG_WRITE_CMDID:
+                return "WMI_REG_WRITE_CMDID";
+        case WMI_RC_STATE_CHANGE_CMDID:
+                return "WMI_RC_STATE_CHANGE_CMDID";
+        case WMI_RC_RATE_UPDATE_CMDID:
+                return "WMI_RC_RATE_UPDATE_CMDID";
+        case WMI_DEBUG_INFO_CMDID:
+                return "WMI_DEBUG_INFO_CMDID";
+        case WMI_HOST_ATTACH:
+                return "WMI_HOST_ATTACH";
+        case WMI_TARGET_IC_UPDATE_CMDID:
+                return "WMI_TARGET_IC_UPDATE_CMDID";
+        case WMI_TGT_STATS_CMDID:
+                return "WMI_TGT_STATS_CMDID";
+        case WMI_TX_AGGR_ENABLE_CMDID:
+                return "WMI_TX_AGGR_ENABLE_CMDID";
+        case WMI_TGT_DETACH_CMDID:
+                return "WMI_TGT_DETACH_CMDID";
+        case WMI_TGT_TXQ_ENABLE_CMDID:
+                return "WMI_TGT_TXQ_ENABLE_CMDID";
+        }
+
+        return "Bogus";
+}
+
+struct wmi *ath9k_init_wmi(struct ath9k_htc_priv *priv)
+{
+        struct wmi *wmi;
+
+        wmi = kzalloc(sizeof(struct wmi), GFP_KERNEL);
+        if (!wmi)
+                return NULL;
+
+        wmi->drv_priv = priv;
+        wmi->stopped = false;
+        mutex_init(&wmi->op_mutex);
+        init_completion(&wmi->cmd_wait);
+
+        return wmi;
+}
+
+void ath9k_deinit_wmi(struct ath9k_htc_priv *priv)
+{
+        struct wmi *wmi = priv->wmi;
+
+        mutex_lock(&wmi->op_mutex);
+        wmi->stopped = true;
+        mutex_unlock(&wmi->op_mutex);
+
+        kfree(priv->wmi);
+}
+
+void ath9k_wmi_tasklet(unsigned long data)
+{
+        struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *)data;
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct wmi_cmd_hdr *hdr;
+        struct wmi_swba *swba_hdr;
+        enum wmi_event_id event;
+        struct sk_buff *skb;
+        void *wmi_event;
+        unsigned long flags;
+#ifdef CONFIG_ATH9K_HTC_DEBUGFS
+        u32 txrate;
+#endif
+
+        spin_lock_irqsave(&priv->wmi->wmi_lock, flags);
+        skb = priv->wmi->wmi_skb;
+        spin_unlock_irqrestore(&priv->wmi->wmi_lock, flags);
+
+        hdr = (struct wmi_cmd_hdr *) skb->data;
+        event = be16_to_cpu(hdr->command_id);
+        wmi_event = skb_pull(skb, sizeof(struct wmi_cmd_hdr));
+
+        ath_print(common, ATH_DBG_WMI,
+                  "WMI Event: 0x%x\n", event);
+
+        switch (event) {
+        case WMI_TGT_RDY_EVENTID:
+                break;
+        case WMI_SWBA_EVENTID:
+                swba_hdr = (struct wmi_swba *) wmi_event;
+                ath9k_htc_swba(priv, swba_hdr->beacon_pending);
+                break;
+        case WMI_FATAL_EVENTID:
+                break;
+        case WMI_TXTO_EVENTID:
+                break;
+        case WMI_BMISS_EVENTID:
+                break;
+        case WMI_WLAN_TXCOMP_EVENTID:
+                break;
+        case WMI_DELBA_EVENTID:
+                break;
+        case WMI_TXRATE_EVENTID:
+#ifdef CONFIG_ATH9K_HTC_DEBUGFS
+                txrate = ((struct wmi_event_txrate *)wmi_event)->txrate;
+                priv->debug.txrate = be32_to_cpu(txrate);
+#endif
+                break;
+        default:
+                break;
+        }
+
+        dev_kfree_skb_any(skb);
+}
+
+static void ath9k_wmi_rsp_callback(struct wmi *wmi, struct sk_buff *skb)
+{
+        skb_pull(skb, sizeof(struct wmi_cmd_hdr));
+
+        if (wmi->cmd_rsp_buf != NULL && wmi->cmd_rsp_len != 0)
+                memcpy(wmi->cmd_rsp_buf, skb->data, wmi->cmd_rsp_len);
+
+        complete(&wmi->cmd_wait);
+}
+
+static void ath9k_wmi_ctrl_rx(void *priv, struct sk_buff *skb,
+                              enum htc_endpoint_id epid)
+{
+        struct wmi *wmi = (struct wmi *) priv;
+        struct wmi_cmd_hdr *hdr;
+        u16 cmd_id;
+
+        if (unlikely(wmi->stopped))
+                goto free_skb;
+
+        hdr = (struct wmi_cmd_hdr *) skb->data;
+        cmd_id = be16_to_cpu(hdr->command_id);
+
+        if (cmd_id & 0x1000) {
+                spin_lock(&wmi->wmi_lock);
+                wmi->wmi_skb = skb;
+                spin_unlock(&wmi->wmi_lock);
+                tasklet_schedule(&wmi->drv_priv->wmi_tasklet);
+                return;
+        }
+
+        /* WMI command response */
+        ath9k_wmi_rsp_callback(wmi, skb);
+
+free_skb:
+        dev_kfree_skb_any(skb);
+}
+
+static void ath9k_wmi_ctrl_tx(void *priv, struct sk_buff *skb,
+                              enum htc_endpoint_id epid, bool txok)
+{
+        dev_kfree_skb_any(skb);
+}
+
+int ath9k_wmi_connect(struct htc_target *htc, struct wmi *wmi,
+                      enum htc_endpoint_id *wmi_ctrl_epid)
+{
+        struct htc_service_connreq connect;
+        int ret;
+
+        wmi->htc = htc;
+
+        memset(&connect, 0, sizeof(connect));
+
+        connect.ep_callbacks.priv = wmi;
+        connect.ep_callbacks.tx = ath9k_wmi_ctrl_tx;
+        connect.ep_callbacks.rx = ath9k_wmi_ctrl_rx;
+        connect.service_id = WMI_CONTROL_SVC;
+
+        ret = htc_connect_service(htc, &connect, &wmi->ctrl_epid);
+        if (ret)
+                return ret;
+
+        *wmi_ctrl_epid = wmi->ctrl_epid;
+
+        return 0;
+}
+
+static int ath9k_wmi_cmd_issue(struct wmi *wmi,
+                               struct sk_buff *skb,
+                               enum wmi_cmd_id cmd, u16 len)
+{
+        struct wmi_cmd_hdr *hdr;
+
+        hdr = (struct wmi_cmd_hdr *) skb_push(skb, sizeof(struct wmi_cmd_hdr));
+        hdr->command_id = cpu_to_be16(cmd);
+        hdr->seq_no = cpu_to_be16(++wmi->tx_seq_id);
+
+        return htc_send(wmi->htc, skb, wmi->ctrl_epid, NULL);
+}
+
+int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
+                  u8 *cmd_buf, u32 cmd_len,
+                  u8 *rsp_buf, u32 rsp_len,
+                  u32 timeout)
+{
+        struct ath_hw *ah = wmi->drv_priv->ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        u16 headroom = sizeof(struct htc_frame_hdr) +
+                       sizeof(struct wmi_cmd_hdr);
+        struct sk_buff *skb;
+        u8 *data;
+        int time_left, ret = 0;
+
+        if (!wmi)
+                return -EINVAL;
+
+        skb = dev_alloc_skb(headroom + cmd_len);
+        if (!skb)
+                return -ENOMEM;
+
+        skb_reserve(skb, headroom);
+
+        if (cmd_len != 0 && cmd_buf != NULL) {
+                data = (u8 *) skb_put(skb, cmd_len);
+                memcpy(data, cmd_buf, cmd_len);
+        }
+
+        mutex_lock(&wmi->op_mutex);
+
+        /* check if wmi stopped flag is set */
+        if (unlikely(wmi->stopped)) {
+                ret = -EPROTO;
+                goto out;
+        }
+
+        /* record the rsp buffer and length */
+        wmi->cmd_rsp_buf = rsp_buf;
+        wmi->cmd_rsp_len = rsp_len;
+
+        ret = ath9k_wmi_cmd_issue(wmi, skb, cmd_id, cmd_len);
+        if (ret)
+                goto out;
+
+        time_left = wait_for_completion_timeout(&wmi->cmd_wait, timeout);
+        if (!time_left) {
+                ath_print(common, ATH_DBG_WMI,
+                          "Timeout waiting for WMI command: %s\n",
+                          wmi_cmd_to_name(cmd_id));
+                mutex_unlock(&wmi->op_mutex);
+                return -ETIMEDOUT;
+        }
+
+        mutex_unlock(&wmi->op_mutex);
+
+        return 0;
+
+out:
+        ath_print(common, ATH_DBG_WMI,
+                  "WMI failure for: %s\n", wmi_cmd_to_name(cmd_id));
+        mutex_unlock(&wmi->op_mutex);
+        dev_kfree_skb_any(skb);
+
+        return ret;
+}
diff --git a/drivers/net/wireless/ath/ath9k/wmi.h b/drivers/net/wireless/ath/ath9k/wmi.h
new file mode 100644
index 000000000000..39ef926f27c2
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/wmi.h
@@ -0,0 +1,126 @@
+/*
+ * Copyright (c) 2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef WMI_H
+#define WMI_H
+
+
+struct wmi_event_txrate {
+        u32 txrate;
+        struct {
+                u8 rssi_thresh;
+                u8 per;
+        } rc_stats;
+} __packed;
+
+struct wmi_cmd_hdr {
+        u16 command_id;
+        u16 seq_no;
+} __packed;
+
+struct wmi_swba {
+        u8 beacon_pending;
+} __packed;
+
+enum wmi_cmd_id {
+        WMI_ECHO_CMDID = 0x0001,
+        WMI_ACCESS_MEMORY_CMDID,
+
+        /* Commands to Target */
+        WMI_DISABLE_INTR_CMDID,
+        WMI_ENABLE_INTR_CMDID,
+        WMI_RX_LINK_CMDID,
+        WMI_ATH_INIT_CMDID,
+        WMI_ABORT_TXQ_CMDID,
+        WMI_STOP_TX_DMA_CMDID,
+        WMI_STOP_DMA_RECV_CMDID,
+        WMI_ABORT_TX_DMA_CMDID,
+        WMI_DRAIN_TXQ_CMDID,
+        WMI_DRAIN_TXQ_ALL_CMDID,
+        WMI_START_RECV_CMDID,
+        WMI_STOP_RECV_CMDID,
+        WMI_FLUSH_RECV_CMDID,
+        WMI_SET_MODE_CMDID,
+        WMI_RESET_CMDID,
+        WMI_NODE_CREATE_CMDID,
+        WMI_NODE_REMOVE_CMDID,
+        WMI_VAP_REMOVE_CMDID,
+        WMI_VAP_CREATE_CMDID,
+        WMI_BEACON_UPDATE_CMDID,
+        WMI_REG_READ_CMDID,
+        WMI_REG_WRITE_CMDID,
+        WMI_RC_STATE_CHANGE_CMDID,
+        WMI_RC_RATE_UPDATE_CMDID,
+        WMI_DEBUG_INFO_CMDID,
+        WMI_HOST_ATTACH,
+        WMI_TARGET_IC_UPDATE_CMDID,
+        WMI_TGT_STATS_CMDID,
+        WMI_TX_AGGR_ENABLE_CMDID,
+        WMI_TGT_DETACH_CMDID,
+        WMI_TGT_TXQ_ENABLE_CMDID,
+};
+
+enum wmi_event_id {
+        WMI_TGT_RDY_EVENTID = 0x1001,
+        WMI_SWBA_EVENTID,
+        WMI_FATAL_EVENTID,
+        WMI_TXTO_EVENTID,
+        WMI_BMISS_EVENTID,
+        WMI_WLAN_TXCOMP_EVENTID,
+        WMI_DELBA_EVENTID,
+        WMI_TXRATE_EVENTID,
+};
+
+struct wmi {
+        struct ath9k_htc_priv *drv_priv;
+        struct htc_target *htc;
+        enum htc_endpoint_id ctrl_epid;
+        struct mutex op_mutex;
+        struct completion cmd_wait;
+        u16 tx_seq_id;
+        u8 *cmd_rsp_buf;
+        u32 cmd_rsp_len;
+        bool stopped;
+
+        struct sk_buff *wmi_skb;
+        spinlock_t wmi_lock;
+};
+
+struct wmi *ath9k_init_wmi(struct ath9k_htc_priv *priv);
+void ath9k_deinit_wmi(struct ath9k_htc_priv *priv);
+int ath9k_wmi_connect(struct htc_target *htc, struct wmi *wmi,
+                      enum htc_endpoint_id *wmi_ctrl_epid);
+int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
+                  u8 *cmd_buf, u32 cmd_len,
+                  u8 *rsp_buf, u32 rsp_len,
+                  u32 timeout);
+void ath9k_wmi_tasklet(unsigned long data);
+
+#define WMI_CMD(_wmi_cmd)                                               \
+        do {                                                            \
+                ret = ath9k_wmi_cmd(priv->wmi, _wmi_cmd, NULL, 0,       \
+                                    (u8 *) &cmd_rsp,                    \
+                                    sizeof(cmd_rsp), HZ);               \
+        } while (0)
+
+#define WMI_CMD_BUF(_wmi_cmd, _buf)                                     \
+        do {                                                            \
+                ret = ath9k_wmi_cmd(priv->wmi, _wmi_cmd,                \
+                                    (u8 *) _buf, sizeof(*_buf),         \
+                                    &cmd_rsp, sizeof(cmd_rsp), HZ);     \
+        } while (0)
+
+#endif /* WMI_H */
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 294b486bc3ed..02df4cbf179f 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -59,15 +59,14 @@ static void ath_tx_send_ht_normal(struct ath_softc *sc, struct ath_txq *txq,
                                   struct ath_atx_tid *tid,
                                   struct list_head *bf_head);
 static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
-                                struct ath_txq *txq,
-                                struct list_head *bf_q,
-                                int txok, int sendbar);
+                                struct ath_txq *txq, struct list_head *bf_q,
+                                struct ath_tx_status *ts, int txok, int sendbar);
 static void ath_tx_txqaddbuf(struct ath_softc *sc, struct ath_txq *txq,
                              struct list_head *head);
 static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf);
 static int ath_tx_num_badfrms(struct ath_softc *sc, struct ath_buf *bf,
-                              int txok);
-static void ath_tx_rc_status(struct ath_buf *bf, struct ath_desc *ds,
+                              struct ath_tx_status *ts, int txok);
+static void ath_tx_rc_status(struct ath_buf *bf, struct ath_tx_status *ts,
                              int nbad, int txok, bool update_rc);
 
 enum {
@@ -223,6 +222,9 @@ static void ath_tid_drain(struct ath_softc *sc, struct ath_txq *txq,
 {
         struct ath_buf *bf;
         struct list_head bf_head;
+        struct ath_tx_status ts;
+
+        memset(&ts, 0, sizeof(ts));
         INIT_LIST_HEAD(&bf_head);
 
         for (;;) {
@@ -236,7 +238,7 @@ static void ath_tid_drain(struct ath_softc *sc, struct ath_txq *txq,
                         ath_tx_update_baw(sc, tid, bf->bf_seqno);
 
                 spin_unlock(&txq->axq_lock);
-                ath_tx_complete_buf(sc, bf, txq, &bf_head, 0, 0);
+                ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0, 0);
                 spin_lock(&txq->axq_lock);
         }
 
@@ -286,7 +288,7 @@ static struct ath_buf* ath_clone_txbuf(struct ath_softc *sc, struct ath_buf *bf)
 
 static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                                  struct ath_buf *bf, struct list_head *bf_q,
-                                 int txok)
+                                 struct ath_tx_status *ts, int txok)
 {
         struct ath_node *an = NULL;
         struct sk_buff *skb;
@@ -296,7 +298,6 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
         struct ieee80211_tx_info *tx_info;
         struct ath_atx_tid *tid = NULL;
         struct ath_buf *bf_next, *bf_last = bf->bf_lastbf;
-        struct ath_desc *ds = bf_last->bf_desc;
         struct list_head bf_head, bf_pending;
         u16 seq_st = 0, acked_cnt = 0, txfail_cnt = 0;
         u32 ba[WME_BA_BMP_SIZE >> 5];
@@ -325,10 +326,9 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
         memset(ba, 0, WME_BA_BMP_SIZE >> 3);
 
         if (isaggr && txok) {
-                if (ATH_DS_TX_BA(ds)) {
-                        seq_st = ATH_DS_BA_SEQ(ds);
-                        memcpy(ba, ATH_DS_BA_BITMAP(ds),
-                               WME_BA_BMP_SIZE >> 3);
+                if (ts->ts_flags & ATH9K_TX_BA) {
+                        seq_st = ts->ts_seqnum;
+                        memcpy(ba, &ts->ba_low, WME_BA_BMP_SIZE >> 3);
                 } else {
                         /*
                          * AR5416 can become deaf/mute when BA
@@ -345,7 +345,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
         INIT_LIST_HEAD(&bf_pending);
         INIT_LIST_HEAD(&bf_head);
 
-        nbad = ath_tx_num_badfrms(sc, bf, txok);
+        nbad = ath_tx_num_badfrms(sc, bf, ts, txok);
         while (bf) {
                 txfail = txpending = 0;
                 bf_next = bf->bf_next;
@@ -359,7 +359,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                         acked_cnt++;
                 } else {
                         if (!(tid->state & AGGR_CLEANUP) &&
-                            ds->ds_txstat.ts_flags != ATH9K_TX_SW_ABORTED) {
+                            ts->ts_flags != ATH9K_TX_SW_ABORTED) {
                                 if (bf->bf_retries < ATH_MAX_SW_RETRIES) {
                                         ath_tx_set_retry(sc, txq, bf);
                                         txpending = 1;
@@ -402,13 +402,14 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                         spin_unlock_bh(&txq->axq_lock);
 
                         if (rc_update && (acked_cnt == 1 || txfail_cnt == 1)) {
-                                ath_tx_rc_status(bf, ds, nbad, txok, true);
+                                ath_tx_rc_status(bf, ts, nbad, txok, true);
                                 rc_update = false;
                         } else {
-                                ath_tx_rc_status(bf, ds, nbad, txok, false);
+                                ath_tx_rc_status(bf, ts, nbad, txok, false);
                         }
 
-                        ath_tx_complete_buf(sc, bf, txq, &bf_head, !txfail, sendbar);
+                        ath_tx_complete_buf(sc, bf, txq, &bf_head, ts,
+                                !txfail, sendbar);
                 } else {
                         /* retry the un-acked ones */
                         if (bf->bf_next == NULL && bf_last->bf_stale) {
@@ -426,10 +427,10 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                                         spin_unlock_bh(&txq->axq_lock);
 
                                         bf->bf_state.bf_type |= BUF_XRETRY;
-                                        ath_tx_rc_status(bf, ds, nbad,
+                                        ath_tx_rc_status(bf, ts, nbad,
                                                          0, false);
                                         ath_tx_complete_buf(sc, bf, txq,
-                                                            &bf_head, 0, 0);
+                                                            &bf_head, ts, 0, 0);
                                         break;
                                 }
 
@@ -752,8 +753,11 @@ void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
         struct ath_node *an = (struct ath_node *)sta->drv_priv;
         struct ath_atx_tid *txtid = ATH_AN_2_TID(an, tid);
         struct ath_txq *txq = &sc->tx.txq[txtid->ac->qnum];
+        struct ath_tx_status ts;
         struct ath_buf *bf;
         struct list_head bf_head;
+
+        memset(&ts, 0, sizeof(ts));
         INIT_LIST_HEAD(&bf_head);
 
         if (txtid->state & AGGR_CLEANUP)
@@ -780,7 +784,7 @@ void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
                 }
                 list_move_tail(&bf->list, &bf_head);
                 ath_tx_update_baw(sc, txtid, bf->bf_seqno);
-                ath_tx_complete_buf(sc, bf, txq, &bf_head, 0, 0);
+                ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0, 0);
         }
         spin_unlock_bh(&txq->axq_lock);
 
@@ -1028,6 +1032,11 @@ void ath_draintxq(struct ath_softc *sc, struct ath_txq *txq, bool retry_tx)
 {
         struct ath_buf *bf, *lastbf;
         struct list_head bf_head;
+        struct ath_tx_status ts;
+
+        memset(&ts, 0, sizeof(ts));
+        if (!retry_tx)
+                ts.ts_flags = ATH9K_TX_SW_ABORTED;
 
         INIT_LIST_HEAD(&bf_head);
 
@@ -1053,9 +1062,6 @@ void ath_draintxq(struct ath_softc *sc, struct ath_txq *txq, bool retry_tx)
                 }
 
                 lastbf = bf->bf_lastbf;
-                if (!retry_tx)
-                        lastbf->bf_desc->ds_txstat.ts_flags =
-                                ATH9K_TX_SW_ABORTED;
 
                 /* remove ath_buf's of the same mpdu from txq */
                 list_cut_position(&bf_head, &txq->axq_q, &lastbf->list);
@@ -1064,9 +1070,9 @@ void ath_draintxq(struct ath_softc *sc, struct ath_txq *txq, bool retry_tx)
                 spin_unlock_bh(&txq->axq_lock);
 
                 if (bf_isampdu(bf))
-                        ath_tx_complete_aggr(sc, txq, bf, &bf_head, 0);
+                        ath_tx_complete_aggr(sc, txq, bf, &bf_head, &ts, 0);
                 else
-                        ath_tx_complete_buf(sc, bf, txq, &bf_head, 0, 0);
+                        ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, 0, 0);
         }
 
         spin_lock_bh(&txq->axq_lock);
@@ -1568,12 +1574,12 @@ static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
 
         tx_info->pad[0] = 0;
         switch (txctl->frame_type) {
-        case ATH9K_NOT_INTERNAL:
+        case ATH9K_IFT_NOT_INTERNAL:
                 break;
-        case ATH9K_INT_PAUSE:
+        case ATH9K_IFT_PAUSE:
                 tx_info->pad[0] |= ATH_TX_INFO_FRAME_TYPE_PAUSE;
                 /* fall through */
-        case ATH9K_INT_UNPAUSE:
+        case ATH9K_IFT_UNPAUSE:
                 tx_info->pad[0] |= ATH_TX_INFO_FRAME_TYPE_INTERNAL;
                 break;
         }
@@ -1852,9 +1858,8 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
 }
 
 static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
-                                struct ath_txq *txq,
-                                struct list_head *bf_q,
-                                int txok, int sendbar)
+                                struct ath_txq *txq, struct list_head *bf_q,
+                                struct ath_tx_status *ts, int txok, int sendbar)
 {
         struct sk_buff *skb = bf->bf_mpdu;
         unsigned long flags;
@@ -1872,7 +1877,7 @@ static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
 
         dma_unmap_single(sc->dev, bf->bf_dmacontext, skb->len, DMA_TO_DEVICE);
         ath_tx_complete(sc, skb, bf->aphy, tx_flags);
-        ath_debug_stat_tx(sc, txq, bf);
+        ath_debug_stat_tx(sc, txq, bf, ts);
 
         /*
          * Return the list of ath_buf of this mpdu to free queue
@@ -1883,23 +1888,21 @@ static void ath_tx_complete_buf(struct ath_softc *sc, struct ath_buf *bf,
 }
 
 static int ath_tx_num_badfrms(struct ath_softc *sc, struct ath_buf *bf,
-                              int txok)
+                              struct ath_tx_status *ts, int txok)
 {
-        struct ath_buf *bf_last = bf->bf_lastbf;
-        struct ath_desc *ds = bf_last->bf_desc;
         u16 seq_st = 0;
         u32 ba[WME_BA_BMP_SIZE >> 5];
         int ba_index;
         int nbad = 0;
         int isaggr = 0;
 
-        if (ds->ds_txstat.ts_flags == ATH9K_TX_SW_ABORTED)
+        if (ts->ts_flags == ATH9K_TX_SW_ABORTED)
                 return 0;
 
         isaggr = bf_isaggr(bf);
         if (isaggr) {
-                seq_st = ATH_DS_BA_SEQ(ds);
-                memcpy(ba, ATH_DS_BA_BITMAP(ds), WME_BA_BMP_SIZE >> 3);
+                seq_st = ts->ts_seqnum;
+                memcpy(ba, &ts->ba_low, WME_BA_BMP_SIZE >> 3);
         }
 
         while (bf) {
@@ -1913,7 +1916,7 @@ static int ath_tx_num_badfrms(struct ath_softc *sc, struct ath_buf *bf,
         return nbad;
 }
 
-static void ath_tx_rc_status(struct ath_buf *bf, struct ath_desc *ds,
+static void ath_tx_rc_status(struct ath_buf *bf, struct ath_tx_status *ts,
                              int nbad, int txok, bool update_rc)
 {
         struct sk_buff *skb = bf->bf_mpdu;
@@ -1923,24 +1926,24 @@ static void ath_tx_rc_status(struct ath_buf *bf, struct ath_desc *ds,
         u8 i, tx_rateindex;
 
         if (txok)
-                tx_info->status.ack_signal = ds->ds_txstat.ts_rssi;
+                tx_info->status.ack_signal = ts->ts_rssi;
 
-        tx_rateindex = ds->ds_txstat.ts_rateindex;
+        tx_rateindex = ts->ts_rateindex;
         WARN_ON(tx_rateindex >= hw->max_rates);
 
-        if (update_rc)
-                tx_info->pad[0] |= ATH_TX_INFO_UPDATE_RC;
-        if (ds->ds_txstat.ts_status & ATH9K_TXERR_FILT)
+        if (ts->ts_status & ATH9K_TXERR_FILT)
                 tx_info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
+        if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && update_rc)
+                tx_info->flags |= IEEE80211_TX_STAT_AMPDU;
 
-        if ((ds->ds_txstat.ts_status & ATH9K_TXERR_FILT) == 0 &&
+        if ((ts->ts_status & ATH9K_TXERR_FILT) == 0 &&
             (bf->bf_flags & ATH9K_TXDESC_NOACK) == 0 && update_rc) {
                 if (ieee80211_is_data(hdr->frame_control)) {
-                        if (ds->ds_txstat.ts_flags &
+                        if (ts->ts_flags &
                             (ATH9K_TX_DATA_UNDERRUN | ATH9K_TX_DELIM_UNDERRUN))
                                 tx_info->pad[0] |= ATH_TX_INFO_UNDERRUN;
-                        if ((ds->ds_txstat.ts_status & ATH9K_TXERR_XRETRY) ||
-                            (ds->ds_txstat.ts_status & ATH9K_TXERR_FIFO))
+                        if ((ts->ts_status & ATH9K_TXERR_XRETRY) ||
+                            (ts->ts_status & ATH9K_TXERR_FIFO))
                                 tx_info->pad[0] |= ATH_TX_INFO_XRETRY;
                         tx_info->status.ampdu_len = bf->bf_nframes;
                         tx_info->status.ampdu_ack_len = bf->bf_nframes - nbad;
@@ -1978,6 +1981,7 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
         struct ath_buf *bf, *lastbf, *bf_held = NULL;
         struct list_head bf_head;
         struct ath_desc *ds;
+        struct ath_tx_status ts;
         int txok;
         int status;
 
@@ -2017,7 +2021,8 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
                 lastbf = bf->bf_lastbf;
                 ds = lastbf->bf_desc;
 
-                status = ath9k_hw_txprocdesc(ah, ds);
+                memset(&ts, 0, sizeof(ts));
+                status = ath9k_hw_txprocdesc(ah, ds, &ts);
                 if (status == -EINPROGRESS) {
                         spin_unlock_bh(&txq->axq_lock);
                         break;
@@ -2028,7 +2033,7 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
                  * can disable RX.
                  */
                 if (bf->bf_isnullfunc &&
-                    (ds->ds_txstat.ts_status & ATH9K_TX_ACKED)) {
+                    (ts.ts_status & ATH9K_TX_ACKED)) {
                         if ((sc->ps_flags & PS_ENABLED))
                                 ath9k_enable_ps(sc);
                         else
@@ -2047,7 +2052,7 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
                                 &txq->axq_q, lastbf->list.prev);
 
                 txq->axq_depth--;
-                txok = !(ds->ds_txstat.ts_status & ATH9K_TXERR_MASK);
+                txok = !(ts.ts_status & ATH9K_TXERR_MASK);
                 txq->axq_tx_inprogress = false;
                 spin_unlock_bh(&txq->axq_lock);
 
@@ -2062,16 +2067,16 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
                          * This frame is sent out as a single frame.
                          * Use hardware retry status for this frame.
                          */
-                        bf->bf_retries = ds->ds_txstat.ts_longretry;
-                        if (ds->ds_txstat.ts_status & ATH9K_TXERR_XRETRY)
+                        bf->bf_retries = ts.ts_longretry;
+                        if (ts.ts_status & ATH9K_TXERR_XRETRY)
                                 bf->bf_state.bf_type |= BUF_XRETRY;
-                        ath_tx_rc_status(bf, ds, 0, txok, true);
+                        ath_tx_rc_status(bf, &ts, 0, txok, true);
                 }
 
                 if (bf_isampdu(bf))
-                        ath_tx_complete_aggr(sc, txq, bf, &bf_head, txok);
+                        ath_tx_complete_aggr(sc, txq, bf, &bf_head, &ts, txok);
                 else
-                        ath_tx_complete_buf(sc, bf, txq, &bf_head, txok, 0);
+                        ath_tx_complete_buf(sc, bf, txq, &bf_head, &ts, txok, 0);
 
                 ath_wake_mac80211_queue(sc, txq);
 
diff --git a/drivers/net/wireless/ath/debug.h b/drivers/net/wireless/ath/debug.h
index 8263633c003c..873bf526e11f 100644
--- a/drivers/net/wireless/ath/debug.h
+++ b/drivers/net/wireless/ath/debug.h
@@ -59,6 +59,7 @@ enum ATH_DEBUG {
         ATH_DBG_PS              = 0x00000800,
         ATH_DBG_HWTIMER         = 0x00001000,
         ATH_DBG_BTCOEX          = 0x00002000,
+        ATH_DBG_WMI             = 0x00004000,
         ATH_DBG_ANY             = 0xffffffff
 };
 
diff --git a/drivers/net/wireless/ath/hw.c b/drivers/net/wireless/ath/hw.c
index ecc9eb01f4fa..a8f81ea09f14 100644
--- a/drivers/net/wireless/ath/hw.c
+++ b/drivers/net/wireless/ath/hw.c
@@ -19,8 +19,8 @@
 #include "ath.h"
 #include "reg.h"
 
-#define REG_READ        common->ops->read
-#define REG_WRITE       common->ops->write
+#define REG_READ        (common->ops->read)
+#define REG_WRITE       (common->ops->write)
 
 /**
  * ath_hw_set_bssid_mask - filter out bssids we listen
diff --git a/drivers/net/wireless/ath/regd.c b/drivers/net/wireless/ath/regd.c
index 04abd1f556b7..d5c23328aef1 100644
--- a/drivers/net/wireless/ath/regd.c
+++ b/drivers/net/wireless/ath/regd.c
@@ -51,6 +51,7 @@
 
 #define ATH9K_5GHZ_ALL          ATH9K_5GHZ_5150_5350, \
                                 ATH9K_5GHZ_5470_5850
+
 /* This one skips what we call "mid band" */
 #define ATH9K_5GHZ_NO_MIDBAND   ATH9K_5GHZ_5150_5350, \
                                 ATH9K_5GHZ_5725_5850
@@ -361,7 +362,7 @@ EXPORT_SYMBOL(ath_reg_notifier_apply);
 
 static bool ath_regd_is_eeprom_valid(struct ath_regulatory *reg)
 {
-         u16 rd = ath_regd_get_eepromRD(reg);
+        u16 rd = ath_regd_get_eepromRD(reg);
         int i;
 
         if (rd & COUNTRY_ERD_FLAG) {
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index b8807fb12c92..3a003e6803a5 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -104,6 +104,7 @@
 #define B43_MMIO_MACFILTER_CONTROL      0x420
 #define B43_MMIO_MACFILTER_DATA         0x422
 #define B43_MMIO_RCMTA_COUNT            0x43C
+#define B43_MMIO_PSM_PHY_HDR            0x492
 #define B43_MMIO_RADIO_HWENABLED_LO     0x49A
 #define B43_MMIO_GPIO_CONTROL           0x49C
 #define B43_MMIO_GPIO_MASK              0x49E
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 1521b1e78d21..14cf3bd7ea51 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -4348,11 +4348,10 @@ static int b43_wireless_core_init(struct b43_wldev *dev)
         b43_set_phytxctl_defaults(dev);
 
         /* Minimum Contention Window */
-        if (phy->type == B43_PHYTYPE_B) {
+        if (phy->type == B43_PHYTYPE_B)
                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0x1F);
-        } else {
+        else
                 b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MINCONT, 0xF);
-        }
         /* Maximum Contention Window */
         b43_shm_write16(dev, B43_SHM_SCRATCH, B43_SHM_SC_MAXCONT, 0x3FF);
 
diff --git a/drivers/net/wireless/b43/phy_n.c b/drivers/net/wireless/b43/phy_n.c
index 795bb1e3345d..9e93eb4a17cf 100644
--- a/drivers/net/wireless/b43/phy_n.c
+++ b/drivers/net/wireless/b43/phy_n.c
@@ -72,6 +72,22 @@ static void b43_nphy_rf_control_override(struct b43_wldev *dev, u16 field,
                                                 u16 value, u8 core, bool off);
 static void b43_nphy_rf_control_intc_override(struct b43_wldev *dev, u8 field,
                                                 u16 value, u8 core);
+static int nphy_channel_switch(struct b43_wldev *dev, unsigned int channel);
+
+static inline bool b43_empty_chanspec(struct b43_chanspec *chanspec)
+{
+        return !chanspec->channel && !chanspec->sideband &&
+                !chanspec->b_width && !chanspec->b_freq;
+}
+
+static inline bool b43_eq_chanspecs(struct b43_chanspec *chanspec1,
+                                        struct b43_chanspec *chanspec2)
+{
+        return (chanspec1->channel == chanspec2->channel &&
+                chanspec1->sideband == chanspec2->sideband &&
+                chanspec1->b_width == chanspec2->b_width &&
+                chanspec1->b_freq == chanspec2->b_freq);
+}
 
 void b43_nphy_set_rxantenna(struct b43_wldev *dev, int antenna)
 {//TODO
@@ -88,34 +104,44 @@ static enum b43_txpwr_result b43_nphy_op_recalc_txpower(struct b43_wldev *dev,
 }
 
 static void b43_chantab_radio_upload(struct b43_wldev *dev,
-                                     const struct b43_nphy_channeltab_entry *e)
-{
-        b43_radio_write16(dev, B2055_PLL_REF, e->radio_pll_ref);
-        b43_radio_write16(dev, B2055_RF_PLLMOD0, e->radio_rf_pllmod0);
-        b43_radio_write16(dev, B2055_RF_PLLMOD1, e->radio_rf_pllmod1);
-        b43_radio_write16(dev, B2055_VCO_CAPTAIL, e->radio_vco_captail);
-        b43_radio_write16(dev, B2055_VCO_CAL1, e->radio_vco_cal1);
-        b43_radio_write16(dev, B2055_VCO_CAL2, e->radio_vco_cal2);
-        b43_radio_write16(dev, B2055_PLL_LFC1, e->radio_pll_lfc1);
-        b43_radio_write16(dev, B2055_PLL_LFR1, e->radio_pll_lfr1);
-        b43_radio_write16(dev, B2055_PLL_LFC2, e->radio_pll_lfc2);
-        b43_radio_write16(dev, B2055_LGBUF_CENBUF, e->radio_lgbuf_cenbuf);
-        b43_radio_write16(dev, B2055_LGEN_TUNE1, e->radio_lgen_tune1);
-        b43_radio_write16(dev, B2055_LGEN_TUNE2, e->radio_lgen_tune2);
-        b43_radio_write16(dev, B2055_C1_LGBUF_ATUNE, e->radio_c1_lgbuf_atune);
-        b43_radio_write16(dev, B2055_C1_LGBUF_GTUNE, e->radio_c1_lgbuf_gtune);
-        b43_radio_write16(dev, B2055_C1_RX_RFR1, e->radio_c1_rx_rfr1);
-        b43_radio_write16(dev, B2055_C1_TX_PGAPADTN, e->radio_c1_tx_pgapadtn);
-        b43_radio_write16(dev, B2055_C1_TX_MXBGTRIM, e->radio_c1_tx_mxbgtrim);
-        b43_radio_write16(dev, B2055_C2_LGBUF_ATUNE, e->radio_c2_lgbuf_atune);
-        b43_radio_write16(dev, B2055_C2_LGBUF_GTUNE, e->radio_c2_lgbuf_gtune);
-        b43_radio_write16(dev, B2055_C2_RX_RFR1, e->radio_c2_rx_rfr1);
-        b43_radio_write16(dev, B2055_C2_TX_PGAPADTN, e->radio_c2_tx_pgapadtn);
-        b43_radio_write16(dev, B2055_C2_TX_MXBGTRIM, e->radio_c2_tx_mxbgtrim);
+                                const struct b43_nphy_channeltab_entry_rev2 *e)
+{
+        b43_radio_write(dev, B2055_PLL_REF, e->radio_pll_ref);
+        b43_radio_write(dev, B2055_RF_PLLMOD0, e->radio_rf_pllmod0);
+        b43_radio_write(dev, B2055_RF_PLLMOD1, e->radio_rf_pllmod1);
+        b43_radio_write(dev, B2055_VCO_CAPTAIL, e->radio_vco_captail);
+        b43_read32(dev, B43_MMIO_MACCTL); /* flush writes */
+
+        b43_radio_write(dev, B2055_VCO_CAL1, e->radio_vco_cal1);
+        b43_radio_write(dev, B2055_VCO_CAL2, e->radio_vco_cal2);
+        b43_radio_write(dev, B2055_PLL_LFC1, e->radio_pll_lfc1);
+        b43_radio_write(dev, B2055_PLL_LFR1, e->radio_pll_lfr1);
+        b43_read32(dev, B43_MMIO_MACCTL); /* flush writes */
+
+        b43_radio_write(dev, B2055_PLL_LFC2, e->radio_pll_lfc2);
+        b43_radio_write(dev, B2055_LGBUF_CENBUF, e->radio_lgbuf_cenbuf);
+        b43_radio_write(dev, B2055_LGEN_TUNE1, e->radio_lgen_tune1);
+        b43_radio_write(dev, B2055_LGEN_TUNE2, e->radio_lgen_tune2);
+        b43_read32(dev, B43_MMIO_MACCTL); /* flush writes */
+
+        b43_radio_write(dev, B2055_C1_LGBUF_ATUNE, e->radio_c1_lgbuf_atune);
+        b43_radio_write(dev, B2055_C1_LGBUF_GTUNE, e->radio_c1_lgbuf_gtune);
+        b43_radio_write(dev, B2055_C1_RX_RFR1, e->radio_c1_rx_rfr1);
+        b43_radio_write(dev, B2055_C1_TX_PGAPADTN, e->radio_c1_tx_pgapadtn);
+        b43_read32(dev, B43_MMIO_MACCTL); /* flush writes */
+
+        b43_radio_write(dev, B2055_C1_TX_MXBGTRIM, e->radio_c1_tx_mxbgtrim);
+        b43_radio_write(dev, B2055_C2_LGBUF_ATUNE, e->radio_c2_lgbuf_atune);
+        b43_radio_write(dev, B2055_C2_LGBUF_GTUNE, e->radio_c2_lgbuf_gtune);
+        b43_radio_write(dev, B2055_C2_RX_RFR1, e->radio_c2_rx_rfr1);
+        b43_read32(dev, B43_MMIO_MACCTL); /* flush writes */
+
+        b43_radio_write(dev, B2055_C2_TX_PGAPADTN, e->radio_c2_tx_pgapadtn);
+        b43_radio_write(dev, B2055_C2_TX_MXBGTRIM, e->radio_c2_tx_mxbgtrim);
 }
 
 static void b43_chantab_phy_upload(struct b43_wldev *dev,
-                                   const struct b43_nphy_channeltab_entry *e)
+                                   const struct b43_phy_n_sfo_cfg *e)
 {
         b43_phy_write(dev, B43_NPHY_BW1A, e->phy_bw1a);
         b43_phy_write(dev, B43_NPHY_BW2, e->phy_bw2);
@@ -130,34 +156,20 @@ static void b43_nphy_tx_power_fix(struct b43_wldev *dev)
         //TODO
 }
 
-/* Tune the hardware to a new channel. */
-static int nphy_channel_switch(struct b43_wldev *dev, unsigned int channel)
-{
-        const struct b43_nphy_channeltab_entry *tabent;
 
-        tabent = b43_nphy_get_chantabent(dev, channel);
-        if (!tabent)
-                return -ESRCH;
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/Radio/2055Setup */
+static void b43_radio_2055_setup(struct b43_wldev *dev,
+                                const struct b43_nphy_channeltab_entry_rev2 *e)
+{
+        B43_WARN_ON(dev->phy.rev >= 3);
 
-        //FIXME enable/disable band select upper20 in RXCTL
-        if (0 /*FIXME 5Ghz*/)
-                b43_radio_maskset(dev, B2055_MASTER1, 0xFF8F, 0x20);
-        else
-                b43_radio_maskset(dev, B2055_MASTER1, 0xFF8F, 0x50);
-        b43_chantab_radio_upload(dev, tabent);
+        b43_chantab_radio_upload(dev, e);
         udelay(50);
-        b43_radio_write16(dev, B2055_VCO_CAL10, 5);
-        b43_radio_write16(dev, B2055_VCO_CAL10, 45);
-        b43_radio_write16(dev, B2055_VCO_CAL10, 65);
+        b43_radio_write(dev, B2055_VCO_CAL10, 0x05);
+        b43_radio_write(dev, B2055_VCO_CAL10, 0x45);
+        b43_read32(dev, B43_MMIO_MACCTL); /* flush writes */
+        b43_radio_write(dev, B2055_VCO_CAL10, 0x65);
         udelay(300);
-        if (0 /*FIXME 5Ghz*/)
-                b43_phy_set(dev, B43_NPHY_BANDCTL, B43_NPHY_BANDCTL_5GHZ);
-        else
-                b43_phy_mask(dev, B43_NPHY_BANDCTL, ~B43_NPHY_BANDCTL_5GHZ);
-        b43_chantab_phy_upload(dev, tabent);
-        b43_nphy_tx_power_fix(dev);
-
-        return 0;
 }
 
 static void b43_radio_init2055_pre(struct b43_wldev *dev)
@@ -173,52 +185,64 @@ static void b43_radio_init2055_pre(struct b43_wldev *dev)
 
 static void b43_radio_init2055_post(struct b43_wldev *dev)
 {
+        struct b43_phy_n *nphy = dev->phy.n;
         struct ssb_sprom *sprom = &(dev->dev->bus->sprom);
         struct ssb_boardinfo *binfo = &(dev->dev->bus->boardinfo);
         int i;
         u16 val;
+        bool workaround = false;
+
+        if (sprom->revision < 4)
+                workaround = (binfo->vendor != PCI_VENDOR_ID_BROADCOM ||
+                                binfo->type != 0x46D ||
+                                binfo->rev < 0x41);
+        else
+                workaround = ((sprom->boardflags_hi & B43_BFH_NOPA) == 0);
 
         b43_radio_mask(dev, B2055_MASTER1, 0xFFF3);
-        msleep(1);
-        if ((sprom->revision != 4) ||
-           !(sprom->boardflags_hi & B43_BFH_RSSIINV)) {
-                if ((binfo->vendor != PCI_VENDOR_ID_BROADCOM) ||
-                    (binfo->type != 0x46D) ||
-                    (binfo->rev < 0x41)) {
-                        b43_radio_mask(dev, B2055_C1_RX_BB_REG, 0x7F);
-                        b43_radio_mask(dev, B2055_C1_RX_BB_REG, 0x7F);
-                        msleep(1);
-                }
+        if (workaround) {
+                b43_radio_mask(dev, B2055_C1_RX_BB_REG, 0x7F);
+                b43_radio_mask(dev, B2055_C2_RX_BB_REG, 0x7F);
         }
-        b43_radio_maskset(dev, B2055_RRCCAL_NOPTSEL, 0x3F, 0x2C);
-        msleep(1);
-        b43_radio_write16(dev, B2055_CAL_MISC, 0x3C);
-        msleep(1);
+        b43_radio_maskset(dev, B2055_RRCCAL_NOPTSEL, 0xFFC0, 0x2C);
+        b43_radio_write(dev, B2055_CAL_MISC, 0x3C);
         b43_radio_mask(dev, B2055_CAL_MISC, 0xFFBE);
-        msleep(1);
         b43_radio_set(dev, B2055_CAL_LPOCTL, 0x80);
-        msleep(1);
         b43_radio_set(dev, B2055_CAL_MISC, 0x1);
         msleep(1);
         b43_radio_set(dev, B2055_CAL_MISC, 0x40);
-        msleep(1);
-        for (i = 0; i < 100; i++) {
-                val = b43_radio_read16(dev, B2055_CAL_COUT2);
-                if (val & 0x80)
+        for (i = 0; i < 200; i++) {
+                val = b43_radio_read(dev, B2055_CAL_COUT2);
+                if (val & 0x80) {
+                        i = 0;
                         break;
+                }
                 udelay(10);
         }
-        msleep(1);
+        if (i)
+                b43err(dev->wl, "radio post init timeout\n");
         b43_radio_mask(dev, B2055_CAL_LPOCTL, 0xFF7F);
-        msleep(1);
         nphy_channel_switch(dev, dev->phy.channel);
-        b43_radio_write16(dev, B2055_C1_RX_BB_LPF, 0x9);
-        b43_radio_write16(dev, B2055_C2_RX_BB_LPF, 0x9);
-        b43_radio_write16(dev, B2055_C1_RX_BB_MIDACHP, 0x83);
-        b43_radio_write16(dev, B2055_C2_RX_BB_MIDACHP, 0x83);
+        b43_radio_write(dev, B2055_C1_RX_BB_LPF, 0x9);
+        b43_radio_write(dev, B2055_C2_RX_BB_LPF, 0x9);
+        b43_radio_write(dev, B2055_C1_RX_BB_MIDACHP, 0x83);
+        b43_radio_write(dev, B2055_C2_RX_BB_MIDACHP, 0x83);
+        b43_radio_maskset(dev, B2055_C1_LNA_GAINBST, 0xFFF8, 0x6);
+        b43_radio_maskset(dev, B2055_C2_LNA_GAINBST, 0xFFF8, 0x6);
+        if (!nphy->gain_boost) {
+                b43_radio_set(dev, B2055_C1_RX_RFSPC1, 0x2);
+                b43_radio_set(dev, B2055_C2_RX_RFSPC1, 0x2);
+        } else {
+                b43_radio_mask(dev, B2055_C1_RX_RFSPC1, 0xFFFD);
+                b43_radio_mask(dev, B2055_C2_RX_RFSPC1, 0xFFFD);
+        }
+        udelay(2);
 }
 
-/* Initialize a Broadcom 2055 N-radio */
+/*
+ * Initialize a Broadcom 2055 N-radio
+ * http://bcm-v4.sipsolutions.net/802.11/Radio/2055/Init
+ */
 static void b43_radio_init2055(struct b43_wldev *dev)
 {
         b43_radio_init2055_pre(dev);
@@ -229,16 +253,15 @@ static void b43_radio_init2055(struct b43_wldev *dev)
         b43_radio_init2055_post(dev);
 }
 
-void b43_nphy_radio_turn_on(struct b43_wldev *dev)
+/*
+ * Initialize a Broadcom 2056 N-radio
+ * http://bcm-v4.sipsolutions.net/802.11/Radio/2056/Init
+ */
+static void b43_radio_init2056(struct b43_wldev *dev)
 {
-        b43_radio_init2055(dev);
+        /* TODO */
 }
 
-void b43_nphy_radio_turn_off(struct b43_wldev *dev)
-{
-        b43_phy_mask(dev, B43_NPHY_RFCTL_CMD,
-                     ~B43_NPHY_RFCTL_CMD_EN);
-}
 
 /*
  * Upload the N-PHY tables.
@@ -646,6 +669,41 @@ static void b43_nphy_read_clip_detection(struct b43_wldev *dev, u16 *clip_st)
         clip_st[1] = b43_phy_read(dev, B43_NPHY_C2_CLIP1THRES);
 }
 
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/SuperSwitchInit */
+static void b43_nphy_superswitch_init(struct b43_wldev *dev, bool init)
+{
+        if (dev->phy.rev >= 3) {
+                if (!init)
+                        return;
+                if (0 /* FIXME */) {
+                        b43_ntab_write(dev, B43_NTAB16(9, 2), 0x211);
+                        b43_ntab_write(dev, B43_NTAB16(9, 3), 0x222);
+                        b43_ntab_write(dev, B43_NTAB16(9, 8), 0x144);
+                        b43_ntab_write(dev, B43_NTAB16(9, 12), 0x188);
+                }
+        } else {
+                b43_phy_write(dev, B43_NPHY_GPIO_LOOEN, 0);
+                b43_phy_write(dev, B43_NPHY_GPIO_HIOEN, 0);
+
+                ssb_chipco_gpio_control(&dev->dev->bus->chipco, 0xFC00,
+                                        0xFC00);
+                b43_write32(dev, B43_MMIO_MACCTL,
+                        b43_read32(dev, B43_MMIO_MACCTL) &
+                        ~B43_MACCTL_GPOUTSMSK);
+                b43_write16(dev, B43_MMIO_GPIO_MASK,
+                        b43_read16(dev, B43_MMIO_GPIO_MASK) | 0xFC00);
+                b43_write16(dev, B43_MMIO_GPIO_CONTROL,
+                        b43_read16(dev, B43_MMIO_GPIO_CONTROL) & ~0xFC00);
+
+                if (init) {
+                        b43_phy_write(dev, B43_NPHY_RFCTL_LUT_TRSW_LO1, 0x2D8);
+                        b43_phy_write(dev, B43_NPHY_RFCTL_LUT_TRSW_UP1, 0x301);
+                        b43_phy_write(dev, B43_NPHY_RFCTL_LUT_TRSW_LO2, 0x2D8);
+                        b43_phy_write(dev, B43_NPHY_RFCTL_LUT_TRSW_UP2, 0x301);
+                }
+        }
+}
+
 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/classifier */
 static u16 b43_nphy_classifier(struct b43_wldev *dev, u16 mask, u16 val)
 {
@@ -722,7 +780,7 @@ static void b43_nphy_spur_workaround(struct b43_wldev *dev)
 {
         struct b43_phy_n *nphy = dev->phy.n;
 
-        unsigned int channel;
+        u8 channel = nphy->radio_chanspec.channel;
         int tone[2] = { 57, 58 };
         u32 noise[2] = { 0x3FF, 0x3FF };
 
@@ -731,8 +789,6 @@ static void b43_nphy_spur_workaround(struct b43_wldev *dev)
         if (nphy->hang_avoid)
                 b43_nphy_stay_in_carrier_search(dev, 1);
 
-        /* FIXME: channel = radio_chanspec */
-
         if (nphy->gband_spurwar_en) {
                 /* TODO: N PHY Adjust Analog Pfbw (7) */
                 if (channel == 11 && dev->phy.is_40mhz)
@@ -778,6 +834,62 @@ static void b43_nphy_spur_workaround(struct b43_wldev *dev)
                 b43_nphy_stay_in_carrier_search(dev, 0);
 }
 
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/AdjustLnaGainTbl */
+static void b43_nphy_adjust_lna_gain_table(struct b43_wldev *dev)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+
+        u8 i;
+        s16 tmp;
+        u16 data[4];
+        s16 gain[2];
+        u16 minmax[2];
+        u16 lna_gain[4] = { -2, 10, 19, 25 };
+
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, 1);
+
+        if (nphy->gain_boost) {
+                if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
+                        gain[0] = 6;
+                        gain[1] = 6;
+                } else {
+                        tmp = 40370 - 315 * nphy->radio_chanspec.channel;
+                        gain[0] = ((tmp >> 13) + ((tmp >> 12) & 1));
+                        tmp = 23242 - 224 * nphy->radio_chanspec.channel;
+                        gain[1] = ((tmp >> 13) + ((tmp >> 12) & 1));
+                }
+        } else {
+                gain[0] = 0;
+                gain[1] = 0;
+        }
+
+        for (i = 0; i < 2; i++) {
+                if (nphy->elna_gain_config) {
+                        data[0] = 19 + gain[i];
+                        data[1] = 25 + gain[i];
+                        data[2] = 25 + gain[i];
+                        data[3] = 25 + gain[i];
+                } else {
+                        data[0] = lna_gain[0] + gain[i];
+                        data[1] = lna_gain[1] + gain[i];
+                        data[2] = lna_gain[2] + gain[i];
+                        data[3] = lna_gain[3] + gain[i];
+                }
+                b43_ntab_write_bulk(dev, B43_NTAB16(10, 8), 4, data);
+
+                minmax[i] = 23 + gain[i];
+        }
+
+        b43_phy_maskset(dev, B43_NPHY_C1_MINMAX_GAIN, ~B43_NPHY_C1_MINGAIN,
+                                minmax[0] << B43_NPHY_C1_MINGAIN_SHIFT);
+        b43_phy_maskset(dev, B43_NPHY_C2_MINMAX_GAIN, ~B43_NPHY_C2_MINGAIN,
+                                minmax[1] << B43_NPHY_C2_MINGAIN_SHIFT);
+
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, 0);
+}
+
 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/WorkaroundsGainCtrl */
 static void b43_nphy_gain_crtl_workarounds(struct b43_wldev *dev)
 {
@@ -862,7 +974,7 @@ static void b43_nphy_gain_crtl_workarounds(struct b43_wldev *dev)
                 b43_phy_write(dev, B43_NPHY_TABLE_DATALO,
                                         (code << 8 | 0x7C));
 
-                /* TODO: b43_nphy_adjust_lna_gain_table(dev); */
+                b43_nphy_adjust_lna_gain_table(dev);
 
                 if (nphy->elna_gain_config) {
                         b43_phy_write(dev, B43_NPHY_TABLE_ADDR, 0x0808);
@@ -1969,12 +2081,12 @@ static void b43_nphy_restore_rssi_cal(struct b43_wldev *dev)
         u16 *rssical_phy_regs = NULL;
 
         if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
-                if (!nphy->rssical_chanspec_2G)
+                if (b43_empty_chanspec(&nphy->rssical_chanspec_2G))
                         return;
                 rssical_radio_regs = nphy->rssical_cache.rssical_radio_regs_2G;
                 rssical_phy_regs = nphy->rssical_cache.rssical_phy_regs_2G;
         } else {
-                if (!nphy->rssical_chanspec_5G)
+                if (b43_empty_chanspec(&nphy->rssical_chanspec_5G))
                         return;
                 rssical_radio_regs = nphy->rssical_cache.rssical_radio_regs_5G;
                 rssical_phy_regs = nphy->rssical_cache.rssical_phy_regs_5G;
@@ -2394,7 +2506,7 @@ static void b43_nphy_save_cal(struct b43_wldev *dev)
 
         struct b43_phy_n_iq_comp *rxcal_coeffs = NULL;
         u16 *txcal_radio_regs = NULL;
-        u8 *iqcal_chanspec;
+        struct b43_chanspec *iqcal_chanspec;
         u16 *table = NULL;
 
         if (nphy->hang_avoid)
@@ -2450,12 +2562,12 @@ static void b43_nphy_restore_cal(struct b43_wldev *dev)
         struct b43_phy_n_iq_comp *rxcal_coeffs = NULL;
 
         if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
-                if (nphy->iqcal_chanspec_2G == 0)
+                if (b43_empty_chanspec(&nphy->iqcal_chanspec_2G))
                         return;
                 table = nphy->cal_cache.txcal_coeffs_2G;
                 loft = &nphy->cal_cache.txcal_coeffs_2G[5];
         } else {
-                if (nphy->iqcal_chanspec_5G == 0)
+                if (b43_empty_chanspec(&nphy->iqcal_chanspec_5G))
                         return;
                 table = nphy->cal_cache.txcal_coeffs_5G;
                 loft = &nphy->cal_cache.txcal_coeffs_5G[5];
@@ -2688,7 +2800,7 @@ static int b43_nphy_cal_tx_iq_lo(struct b43_wldev *dev,
                         }
                         b43_ntab_write_bulk(dev, B43_NTAB16(15, 88), 4,
                                                 buffer);
-                        b43_ntab_write_bulk(dev, B43_NTAB16(15, 101), 2,
+                        b43_ntab_read_bulk(dev, B43_NTAB16(15, 101), 2,
                                                 buffer);
                         b43_ntab_write_bulk(dev, B43_NTAB16(15, 85), 2,
                                                 buffer);
@@ -2700,8 +2812,7 @@ static int b43_nphy_cal_tx_iq_lo(struct b43_wldev *dev,
                         b43_ntab_read_bulk(dev, B43_NTAB16(15, 96), length,
                                                 nphy->txiqlocal_bestc);
                         nphy->txiqlocal_coeffsvalid = true;
-                        /* TODO: Set nphy->txiqlocal_chanspec to
-                                the current channel */
+                        nphy->txiqlocal_chanspec = nphy->radio_chanspec;
                 } else {
                         length = 11;
                         if (dev->phy.rev < 3)
@@ -2736,7 +2847,8 @@ static void b43_nphy_reapply_tx_cal_coeffs(struct b43_wldev *dev)
         u16 buffer[7];
         bool equal = true;
 
-        if (!nphy->txiqlocal_coeffsvalid || 1 /* FIXME */)
+        if (!nphy->txiqlocal_coeffsvalid ||
+            b43_eq_chanspecs(&nphy->txiqlocal_chanspec, &nphy->radio_chanspec))
                 return;
 
         b43_ntab_read_bulk(dev, B43_NTAB16(15, 80), 7, buffer);
@@ -3091,9 +3203,11 @@ int b43_phy_initn(struct b43_wldev *dev)
         do_rssi_cal = false;
         if (phy->rev >= 3) {
                 if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
-                        do_rssi_cal = (nphy->rssical_chanspec_2G == 0);
+                        do_rssi_cal =
+                                b43_empty_chanspec(&nphy->rssical_chanspec_2G);
                 else
-                        do_rssi_cal = (nphy->rssical_chanspec_5G == 0);
+                        do_rssi_cal =
+                                b43_empty_chanspec(&nphy->rssical_chanspec_5G);
 
                 if (do_rssi_cal)
                         b43_nphy_rssi_cal(dev);
@@ -3105,9 +3219,9 @@ int b43_phy_initn(struct b43_wldev *dev)
 
         if (!((nphy->measure_hold & 0x6) != 0)) {
                 if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
-                        do_cal = (nphy->iqcal_chanspec_2G == 0);
+                        do_cal = b43_empty_chanspec(&nphy->iqcal_chanspec_2G);
                 else
-                        do_cal = (nphy->iqcal_chanspec_5G == 0);
+                        do_cal = b43_empty_chanspec(&nphy->iqcal_chanspec_5G);
 
                 if (nphy->mute)
                         do_cal = false;
@@ -3116,7 +3230,7 @@ int b43_phy_initn(struct b43_wldev *dev)
                         target = b43_nphy_get_tx_gains(dev);
 
                         if (nphy->antsel_type == 2)
-                                ;/*TODO NPHY Superswitch Init with argument 1*/
+                                b43_nphy_superswitch_init(dev, true);
                         if (nphy->perical != 2) {
                                 b43_nphy_rssi_cal(dev);
                                 if (phy->rev >= 3) {
@@ -3154,6 +3268,133 @@ int b43_phy_initn(struct b43_wldev *dev)
         return 0;
 }
 
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/ChanspecSetup */
+static void b43_nphy_chanspec_setup(struct b43_wldev *dev,
+                                const struct b43_phy_n_sfo_cfg *e,
+                                struct b43_chanspec chanspec)
+{
+        struct b43_phy *phy = &dev->phy;
+        struct b43_phy_n *nphy = dev->phy.n;
+
+        u16 tmp;
+        u32 tmp32;
+
+        tmp = b43_phy_read(dev, B43_NPHY_BANDCTL) & B43_NPHY_BANDCTL_5GHZ;
+        if (chanspec.b_freq == 1 && tmp == 0) {
+                tmp32 = b43_read32(dev, B43_MMIO_PSM_PHY_HDR);
+                b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32 | 4);
+                b43_phy_set(dev, B43_PHY_B_BBCFG, 0xC000);
+                b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32);
+                b43_phy_set(dev, B43_NPHY_BANDCTL, B43_NPHY_BANDCTL_5GHZ);
+        } else if (chanspec.b_freq == 1) {
+                b43_phy_mask(dev, B43_NPHY_BANDCTL, ~B43_NPHY_BANDCTL_5GHZ);
+                tmp32 = b43_read32(dev, B43_MMIO_PSM_PHY_HDR);
+                b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32 | 4);
+                b43_phy_mask(dev, B43_PHY_B_BBCFG, (u16)~0xC000);
+                b43_write32(dev, B43_MMIO_PSM_PHY_HDR, tmp32);
+        }
+
+        b43_chantab_phy_upload(dev, e);
+
+        tmp = chanspec.channel;
+        if (chanspec.b_freq == 1)
+                tmp |= 0x0100;
+        if (chanspec.b_width == 3)
+                tmp |= 0x0200;
+        b43_shm_write16(dev, B43_SHM_SHARED, 0xA0, tmp);
+
+        if (nphy->radio_chanspec.channel == 14) {
+                b43_nphy_classifier(dev, 2, 0);
+                b43_phy_set(dev, B43_PHY_B_TEST, 0x0800);
+        } else {
+                b43_nphy_classifier(dev, 2, 2);
+                if (chanspec.b_freq == 2)
+                        b43_phy_mask(dev, B43_PHY_B_TEST, ~0x840);
+        }
+
+        if (nphy->txpwrctrl)
+                b43_nphy_tx_power_fix(dev);
+
+        if (dev->phy.rev < 3)
+                b43_nphy_adjust_lna_gain_table(dev);
+
+        b43_nphy_tx_lp_fbw(dev);
+
+        if (dev->phy.rev >= 3 && 0) {
+                /* TODO */
+        }
+
+        b43_phy_write(dev, B43_NPHY_NDATAT_DUP40, 0x3830);
+
+        if (phy->rev >= 3)
+                b43_nphy_spur_workaround(dev);
+}
+
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/SetChanspec */
+static int b43_nphy_set_chanspec(struct b43_wldev *dev,
+                                        struct b43_chanspec chanspec)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+
+        const struct b43_nphy_channeltab_entry_rev2 *tabent_r2;
+        const struct b43_nphy_channeltab_entry_rev3 *tabent_r3;
+
+        u8 tmp;
+        u8 channel = chanspec.channel;
+
+        if (dev->phy.rev >= 3) {
+                /* TODO */
+                tabent_r3 = NULL;
+                if (!tabent_r3)
+                        return -ESRCH;
+        } else {
+                tabent_r2 = b43_nphy_get_chantabent_rev2(dev, channel);
+                if (!tabent_r2)
+                        return -ESRCH;
+        }
+
+        nphy->radio_chanspec = chanspec;
+
+        if (chanspec.b_width != nphy->b_width)
+                ; /* TODO: BMAC BW Set (chanspec.b_width) */
+
+        /* TODO: use defines */
+        if (chanspec.b_width == 3) {
+                if (chanspec.sideband == 2)
+                        b43_phy_set(dev, B43_NPHY_RXCTL,
+                                        B43_NPHY_RXCTL_BSELU20);
+                else
+                        b43_phy_mask(dev, B43_NPHY_RXCTL,
+                                        ~B43_NPHY_RXCTL_BSELU20);
+        }
+
+        if (dev->phy.rev >= 3) {
+                tmp = (chanspec.b_freq == 1) ? 4 : 0;
+                b43_radio_maskset(dev, 0x08, 0xFFFB, tmp);
+                /* TODO: PHY Radio2056 Setup (dev, tabent_r3); */
+                b43_nphy_chanspec_setup(dev, &(tabent_r3->phy_regs), chanspec);
+        } else {
+                tmp = (chanspec.b_freq == 1) ? 0x0020 : 0x0050;
+                b43_radio_maskset(dev, B2055_MASTER1, 0xFF8F, tmp);
+                b43_radio_2055_setup(dev, tabent_r2);
+                b43_nphy_chanspec_setup(dev, &(tabent_r2->phy_regs), chanspec);
+        }
+
+        return 0;
+}
+
+/* Tune the hardware to a new channel */
+static int nphy_channel_switch(struct b43_wldev *dev, unsigned int channel)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+
+        struct b43_chanspec chanspec;
+        chanspec = nphy->radio_chanspec;
+        chanspec.channel = channel;
+
+        return b43_nphy_set_chanspec(dev, chanspec);
+}
+
 static int b43_nphy_op_allocate(struct b43_wldev *dev)
 {
         struct b43_phy_n *nphy;
@@ -3242,9 +3483,43 @@ static void b43_nphy_op_radio_write(struct b43_wldev *dev, u16 reg, u16 value)
         b43_write16(dev, B43_MMIO_RADIO_DATA_LOW, value);
 }
 
+/* http://bcm-v4.sipsolutions.net/802.11/Radio/Switch%20Radio */
 static void b43_nphy_op_software_rfkill(struct b43_wldev *dev,
                                         bool blocked)
-{//TODO
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+
+        if (b43_read32(dev, B43_MMIO_MACCTL) & B43_MACCTL_ENABLED)
+                b43err(dev->wl, "MAC not suspended\n");
+
+        if (blocked) {
+                b43_phy_mask(dev, B43_NPHY_RFCTL_CMD,
+                                ~B43_NPHY_RFCTL_CMD_CHIP0PU);
+                if (dev->phy.rev >= 3) {
+                        b43_radio_mask(dev, 0x09, ~0x2);
+
+                        b43_radio_write(dev, 0x204D, 0);
+                        b43_radio_write(dev, 0x2053, 0);
+                        b43_radio_write(dev, 0x2058, 0);
+                        b43_radio_write(dev, 0x205E, 0);
+                        b43_radio_mask(dev, 0x2062, ~0xF0);
+                        b43_radio_write(dev, 0x2064, 0);
+
+                        b43_radio_write(dev, 0x304D, 0);
+                        b43_radio_write(dev, 0x3053, 0);
+                        b43_radio_write(dev, 0x3058, 0);
+                        b43_radio_write(dev, 0x305E, 0);
+                        b43_radio_mask(dev, 0x3062, ~0xF0);
+                        b43_radio_write(dev, 0x3064, 0);
+                }
+        } else {
+                if (dev->phy.rev >= 3) {
+                        b43_radio_init2056(dev);
+                        b43_nphy_set_chanspec(dev, nphy->radio_chanspec);
+                } else {
+                        b43_radio_init2055(dev);
+                }
+        }
 }
 
 static void b43_nphy_op_switch_analog(struct b43_wldev *dev, bool on)
diff --git a/drivers/net/wireless/b43/phy_n.h b/drivers/net/wireless/b43/phy_n.h
index 403aad3f894f..8b6d570dd0aa 100644
--- a/drivers/net/wireless/b43/phy_n.h
+++ b/drivers/net/wireless/b43/phy_n.h
@@ -711,6 +711,8 @@
 #define B43_NPHY_PAPD_EN1                       B43_PHY_N(0x29B) /* PAPD Enable1 TBD */
 #define B43_NPHY_EPS_TABLE_ADJ1                 B43_PHY_N(0x29C) /* EPS Table Adj1 TBD */
 
+#define B43_PHY_B_BBCFG                         B43_PHY_N_BMODE(0x001) /* BB config */
+#define B43_PHY_B_TEST                          B43_PHY_N_BMODE(0x00A)
 
 
 /* Broadcom 2055 radio registers */
@@ -924,6 +926,13 @@
 
 struct b43_wldev;
 
+struct b43_chanspec {
+        u8 channel;
+        u8 sideband;
+        u8 b_width;
+        u8 b_freq;
+};
+
 struct b43_phy_n_iq_comp {
         s16 a0;
         s16 b0;
@@ -975,7 +984,8 @@ struct b43_phy_n {
         u16 papd_epsilon_offset[2];
         s32 preamble_override;
         u32 bb_mult_save;
-        u16 radio_chanspec;
+        u8 b_width;
+        struct b43_chanspec radio_chanspec;
 
         bool gain_boost;
         bool elna_gain_config;
@@ -991,6 +1001,7 @@ struct b43_phy_n {
         u16 txiqlocal_bestc[11];
         bool txiqlocal_coeffsvalid;
         struct b43_phy_n_txpwrindex txpwrindex[2];
+        struct b43_chanspec txiqlocal_chanspec;
 
         u8 txrx_chain;
         u16 tx_rx_cal_phy_saveregs[11];
@@ -1006,12 +1017,12 @@ struct b43_phy_n {
         bool gband_spurwar_en;
 
         bool ipa2g_on;
-        u8 iqcal_chanspec_2G;
-        u8 rssical_chanspec_2G;
+        struct b43_chanspec iqcal_chanspec_2G;
+        struct b43_chanspec rssical_chanspec_2G;
 
         bool ipa5g_on;
-        u8 iqcal_chanspec_5G;
-        u8 rssical_chanspec_5G;
+        struct b43_chanspec iqcal_chanspec_5G;
+        struct b43_chanspec rssical_chanspec_5G;
 
         struct b43_phy_n_rssical_cache rssical_cache;
         struct b43_phy_n_cal_cache cal_cache;
diff --git a/drivers/net/wireless/b43/tables_nphy.c b/drivers/net/wireless/b43/tables_nphy.c
index a00d509150f7..d96e870ab8fe 100644
--- a/drivers/net/wireless/b43/tables_nphy.c
+++ b/drivers/net/wireless/b43/tables_nphy.c
@@ -318,14 +318,14 @@ void b2055_upload_inittab(struct b43_wldev *dev,
         .radio_c2_tx_mxbgtrim   = r21
 
 #define PHYREGS(r0, r1, r2, r3, r4, r5) \
-        .phy_bw1a       = r0,           \
-        .phy_bw2        = r1,           \
-        .phy_bw3        = r2,           \
-        .phy_bw4        = r3,           \
-        .phy_bw5        = r4,           \
-        .phy_bw6        = r5
-
-static const struct b43_nphy_channeltab_entry b43_nphy_channeltab[] = {
+        .phy_regs.phy_bw1a      = r0,   \
+        .phy_regs.phy_bw2       = r1,   \
+        .phy_regs.phy_bw3       = r2,   \
+        .phy_regs.phy_bw4       = r3,   \
+        .phy_regs.phy_bw5       = r4,   \
+        .phy_regs.phy_bw6       = r5
+
+static const struct b43_nphy_channeltab_entry_rev2 b43_nphy_channeltab[] = {
   {     .channel                = 184,
         .freq                   = 4920, /* MHz */
         .unk2                   = 3280,
@@ -1320,10 +1320,10 @@ static const struct b43_nphy_channeltab_entry b43_nphy_channeltab[] = {
   },
 };
 
-const struct b43_nphy_channeltab_entry *
-b43_nphy_get_chantabent(struct b43_wldev *dev, u8 channel)
+const struct b43_nphy_channeltab_entry_rev2 *
+b43_nphy_get_chantabent_rev2(struct b43_wldev *dev, u8 channel)
 {
-        const struct b43_nphy_channeltab_entry *e;
+        const struct b43_nphy_channeltab_entry_rev2 *e;
         unsigned int i;
 
         for (i = 0; i < ARRAY_SIZE(b43_nphy_channeltab); i++) {
diff --git a/drivers/net/wireless/b43/tables_nphy.h b/drivers/net/wireless/b43/tables_nphy.h
index 9c1c6ecd3672..8fc1da9f8fe5 100644
--- a/drivers/net/wireless/b43/tables_nphy.h
+++ b/drivers/net/wireless/b43/tables_nphy.h
@@ -4,9 +4,22 @@
 #include <linux/types.h>
 
 
-struct b43_nphy_channeltab_entry {
+struct b43_phy_n_sfo_cfg {
+        u16 phy_bw1a;
+        u16 phy_bw2;
+        u16 phy_bw3;
+        u16 phy_bw4;
+        u16 phy_bw5;
+        u16 phy_bw6;
+};
+
+struct b43_nphy_channeltab_entry_rev2 {
         /* The channel number */
         u8 channel;
+        /* The channel frequency in MHz */
+        u16 freq;
+        /* An unknown value */
+        u16 unk2;
         /* Radio register values on channelswitch */
         u8 radio_pll_ref;
         u8 radio_rf_pllmod0;
@@ -31,16 +44,18 @@ struct b43_nphy_channeltab_entry {
         u8 radio_c2_tx_pgapadtn;
         u8 radio_c2_tx_mxbgtrim;
         /* PHY register values on channelswitch */
-        u16 phy_bw1a;
-        u16 phy_bw2;
-        u16 phy_bw3;
-        u16 phy_bw4;
-        u16 phy_bw5;
-        u16 phy_bw6;
+        struct b43_phy_n_sfo_cfg phy_regs;
+};
+
+struct b43_nphy_channeltab_entry_rev3 {
+        /* The channel number */
+        u8 channel;
         /* The channel frequency in MHz */
         u16 freq;
-        /* An unknown value */
-        u16 unk2;
+        /* Radio register values on channelswitch */
+        /* TODO */
+        /* PHY register values on channelswitch */
+        struct b43_phy_n_sfo_cfg phy_regs;
 };
 
 
@@ -77,8 +92,8 @@ void b2055_upload_inittab(struct b43_wldev *dev,
 
 /* Get the NPHY Channel Switch Table entry for a channel number.
  * Returns NULL on failure to find an entry. */
-const struct b43_nphy_channeltab_entry *
-b43_nphy_get_chantabent(struct b43_wldev *dev, u8 channel);
+const struct b43_nphy_channeltab_entry_rev2 *
+b43_nphy_get_chantabent_rev2(struct b43_wldev *dev, u8 channel);
 
 
 /* The N-PHY tables. */
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 9b72c45a7748..2088ac029b35 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -2140,7 +2140,7 @@ static void isr_indicate_association_lost(struct ipw2100_priv *priv, u32 status)
         DECLARE_SSID_BUF(ssid);
 
         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE | IPW_DL_ASSOC,
-                  "disassociated: '%s' %pM \n",
+                  "disassociated: '%s' %pM\n",
                   print_ssid(ssid, priv->essid, priv->essid_len),
                   priv->bssid);
 
@@ -3285,7 +3285,7 @@ static void ipw2100_irq_tasklet(struct ipw2100_priv *priv)
 
         if (inta & IPW2100_INTA_PARITY_ERROR) {
                 printk(KERN_ERR DRV_NAME
-                       ": ***** PARITY ERROR INTERRUPT !!!! \n");
+                       ": ***** PARITY ERROR INTERRUPT !!!!\n");
                 priv->inta_other++;
                 write_register(dev, IPW_REG_INTA, IPW2100_INTA_PARITY_ERROR);
         }
@@ -6102,7 +6102,7 @@ static const struct net_device_ops ipw2100_netdev_ops = {
         .ndo_validate_addr      = eth_validate_addr,
 };
 
-/* Look into using netdev destructor to shutdown ieee80211? */
+/* Look into using netdev destructor to shutdown libipw? */
 
 static struct net_device *ipw2100_alloc_device(struct pci_dev *pci_dev,
                                                void __iomem * base_addr,
@@ -6112,7 +6112,7 @@ static struct net_device *ipw2100_alloc_device(struct pci_dev *pci_dev,
         struct ipw2100_priv *priv;
         struct net_device *dev;
 
-        dev = alloc_ieee80211(sizeof(struct ipw2100_priv), 0);
+        dev = alloc_libipw(sizeof(struct ipw2100_priv), 0);
         if (!dev)
                 return NULL;
         priv = libipw_priv(dev);
@@ -6425,7 +6425,7 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
                 sysfs_remove_group(&pci_dev->dev.kobj,
                                    &ipw2100_attribute_group);
 
-                free_ieee80211(dev, 0);
+                free_libipw(dev, 0);
                 pci_set_drvdata(pci_dev, NULL);
         }
 
@@ -6483,10 +6483,10 @@ static void __devexit ipw2100_pci_remove_one(struct pci_dev *pci_dev)
                 if (dev->base_addr)
                         iounmap((void __iomem *)dev->base_addr);
 
-                /* wiphy_unregister needs to be here, before free_ieee80211 */
+                /* wiphy_unregister needs to be here, before free_libipw */
                 wiphy_unregister(priv->ieee->wdev.wiphy);
                 kfree(priv->ieee->bg_band.channels);
-                free_ieee80211(dev, 0);
+                free_libipw(dev, 0);
         }
 
         pci_release_regions(pci_dev);
@@ -6753,7 +6753,7 @@ static int ipw2100_wx_set_freq(struct net_device *dev,
                 err = -EOPNOTSUPP;
                 goto done;
         } else {                /* Set the channel */
-                IPW_DEBUG_WX("SET Freq/Channel -> %d \n", fwrq->m);
+                IPW_DEBUG_WX("SET Freq/Channel -> %d\n", fwrq->m);
                 err = ipw2100_set_channel(priv, fwrq->m, 0);
         }
 
@@ -6782,7 +6782,7 @@ static int ipw2100_wx_get_freq(struct net_device *dev,
         else
                 wrqu->freq.m = 0;
 
-        IPW_DEBUG_WX("GET Freq/Channel -> %d \n", priv->channel);
+        IPW_DEBUG_WX("GET Freq/Channel -> %d\n", priv->channel);
         return 0;
 
 }
@@ -6794,7 +6794,7 @@ static int ipw2100_wx_set_mode(struct net_device *dev,
         struct ipw2100_priv *priv = libipw_priv(dev);
         int err = 0;
 
-        IPW_DEBUG_WX("SET Mode -> %d \n", wrqu->mode);
+        IPW_DEBUG_WX("SET Mode -> %d\n", wrqu->mode);
 
         if (wrqu->mode == priv->ieee->iw_mode)
                 return 0;
@@ -7149,7 +7149,7 @@ static int ipw2100_wx_set_nick(struct net_device *dev,
         memset(priv->nick, 0, sizeof(priv->nick));
         memcpy(priv->nick, extra, wrqu->data.length);
 
-        IPW_DEBUG_WX("SET Nickname -> %s \n", priv->nick);
+        IPW_DEBUG_WX("SET Nickname -> %s\n", priv->nick);
 
         return 0;
 }
@@ -7168,7 +7168,7 @@ static int ipw2100_wx_get_nick(struct net_device *dev,
         memcpy(extra, priv->nick, wrqu->data.length);
         wrqu->data.flags = 1;   /* active */
 
-        IPW_DEBUG_WX("GET Nickname -> %s \n", extra);
+        IPW_DEBUG_WX("GET Nickname -> %s\n", extra);
 
         return 0;
 }
@@ -7207,7 +7207,7 @@ static int ipw2100_wx_set_rate(struct net_device *dev,
 
         err = ipw2100_set_tx_rates(priv, rate, 0);
 
-        IPW_DEBUG_WX("SET Rate -> %04X \n", rate);
+        IPW_DEBUG_WX("SET Rate -> %04X\n", rate);
       done:
         mutex_unlock(&priv->action_mutex);
         return err;
@@ -7258,7 +7258,7 @@ static int ipw2100_wx_get_rate(struct net_device *dev,
                 wrqu->bitrate.value = 0;
         }
 
-        IPW_DEBUG_WX("GET Rate -> %d \n", wrqu->bitrate.value);
+        IPW_DEBUG_WX("GET Rate -> %d\n", wrqu->bitrate.value);
 
       done:
         mutex_unlock(&priv->action_mutex);
@@ -7294,7 +7294,7 @@ static int ipw2100_wx_set_rts(struct net_device *dev,
 
         err = ipw2100_set_rts_threshold(priv, value);
 
-        IPW_DEBUG_WX("SET RTS Threshold -> 0x%08X \n", value);
+        IPW_DEBUG_WX("SET RTS Threshold -> 0x%08X\n", value);
       done:
         mutex_unlock(&priv->action_mutex);
         return err;
@@ -7316,7 +7316,7 @@ static int ipw2100_wx_get_rts(struct net_device *dev,
         /* If RTS is set to the default value, then it is disabled */
         wrqu->rts.disabled = (priv->rts_threshold & RTS_DISABLED) ? 1 : 0;
 
-        IPW_DEBUG_WX("GET RTS Threshold -> 0x%08X \n", wrqu->rts.value);
+        IPW_DEBUG_WX("GET RTS Threshold -> 0x%08X\n", wrqu->rts.value);
 
         return 0;
 }
@@ -7355,7 +7355,7 @@ static int ipw2100_wx_set_txpow(struct net_device *dev,
 
         err = ipw2100_set_tx_power(priv, value);
 
-        IPW_DEBUG_WX("SET TX Power -> %d \n", value);
+        IPW_DEBUG_WX("SET TX Power -> %d\n", value);
 
       done:
         mutex_unlock(&priv->action_mutex);
@@ -7384,7 +7384,7 @@ static int ipw2100_wx_get_txpow(struct net_device *dev,
 
         wrqu->txpower.flags = IW_TXPOW_DBM;
 
-        IPW_DEBUG_WX("GET TX Power -> %d \n", wrqu->txpower.value);
+        IPW_DEBUG_WX("GET TX Power -> %d\n", wrqu->txpower.value);
 
         return 0;
 }
@@ -7414,7 +7414,7 @@ static int ipw2100_wx_set_frag(struct net_device *dev,
                 priv->frag_threshold = priv->ieee->fts;
         }
 
-        IPW_DEBUG_WX("SET Frag Threshold -> %d \n", priv->ieee->fts);
+        IPW_DEBUG_WX("SET Frag Threshold -> %d\n", priv->ieee->fts);
 
         return 0;
 }
@@ -7432,7 +7432,7 @@ static int ipw2100_wx_get_frag(struct net_device *dev,
         wrqu->frag.fixed = 0;   /* no auto select */
         wrqu->frag.disabled = (priv->frag_threshold & FRAG_DISABLED) ? 1 : 0;
 
-        IPW_DEBUG_WX("GET Frag Threshold -> %d \n", wrqu->frag.value);
+        IPW_DEBUG_WX("GET Frag Threshold -> %d\n", wrqu->frag.value);
 
         return 0;
 }
@@ -7458,14 +7458,14 @@ static int ipw2100_wx_set_retry(struct net_device *dev,
 
         if (wrqu->retry.flags & IW_RETRY_SHORT) {
                 err = ipw2100_set_short_retry(priv, wrqu->retry.value);
-                IPW_DEBUG_WX("SET Short Retry Limit -> %d \n",
+                IPW_DEBUG_WX("SET Short Retry Limit -> %d\n",
                              wrqu->retry.value);
                 goto done;
         }
 
         if (wrqu->retry.flags & IW_RETRY_LONG) {
                 err = ipw2100_set_long_retry(priv, wrqu->retry.value);
-                IPW_DEBUG_WX("SET Long Retry Limit -> %d \n",
+                IPW_DEBUG_WX("SET Long Retry Limit -> %d\n",
                              wrqu->retry.value);
                 goto done;
         }
@@ -7474,7 +7474,7 @@ static int ipw2100_wx_set_retry(struct net_device *dev,
         if (!err)
                 err = ipw2100_set_long_retry(priv, wrqu->retry.value);
 
-        IPW_DEBUG_WX("SET Both Retry Limits -> %d \n", wrqu->retry.value);
+        IPW_DEBUG_WX("SET Both Retry Limits -> %d\n", wrqu->retry.value);
 
       done:
         mutex_unlock(&priv->action_mutex);
@@ -7508,7 +7508,7 @@ static int ipw2100_wx_get_retry(struct net_device *dev,
                 wrqu->retry.value = priv->short_retry_limit;
         }
 
-        IPW_DEBUG_WX("GET Retry -> %d \n", wrqu->retry.value);
+        IPW_DEBUG_WX("GET Retry -> %d\n", wrqu->retry.value);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 5c7aa1b1eb56..9e2ae8f3ecb0 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -458,7 +458,7 @@ static u8 _ipw_read_reg8(struct ipw_priv *priv, u32 reg)
 {
         u32 word;
         _ipw_write32(priv, IPW_INDIRECT_ADDR, reg & IPW_INDIRECT_ADDR_MASK);
-        IPW_DEBUG_IO(" reg = 0x%8X : \n", reg);
+        IPW_DEBUG_IO(" reg = 0x%8X :\n", reg);
         word = _ipw_read32(priv, IPW_INDIRECT_DATA);
         return (word >> ((reg & 0x3) * 8)) & 0xff;
 }
@@ -472,7 +472,7 @@ static u32 _ipw_read_reg32(struct ipw_priv *priv, u32 reg)
 
         _ipw_write32(priv, IPW_INDIRECT_ADDR, reg);
         value = _ipw_read32(priv, IPW_INDIRECT_DATA);
-        IPW_DEBUG_IO(" reg = 0x%4X : value = 0x%4x \n", reg, value);
+        IPW_DEBUG_IO(" reg = 0x%4X : value = 0x%4x\n", reg, value);
         return value;
 }
 
@@ -2348,16 +2348,25 @@ static void ipw_bg_adapter_restart(struct work_struct *work)
         mutex_unlock(&priv->mutex);
 }
 
-#define IPW_SCAN_CHECK_WATCHDOG (5 * HZ)
+static void ipw_abort_scan(struct ipw_priv *priv);
+
+#define IPW_SCAN_CHECK_WATCHDOG (5 * HZ)
 
 static void ipw_scan_check(void *data)
 {
         struct ipw_priv *priv = data;
-        if (priv->status & (STATUS_SCANNING | STATUS_SCAN_ABORTING)) {
+
+        if (priv->status & STATUS_SCAN_ABORTING) {
                 IPW_DEBUG_SCAN("Scan completion watchdog resetting "
                                "adapter after (%dms).\n",
                                jiffies_to_msecs(IPW_SCAN_CHECK_WATCHDOG));
                 queue_work(priv->workqueue, &priv->adapter_restart);
+        } else if (priv->status & STATUS_SCANNING) {
+                IPW_DEBUG_SCAN("Scan completion watchdog aborting scan "
+                               "after (%dms).\n",
+                               jiffies_to_msecs(IPW_SCAN_CHECK_WATCHDOG));
+                ipw_abort_scan(priv);
+                queue_delayed_work(priv->workqueue, &priv->scan_check, HZ);
         }
 }
 
@@ -2738,7 +2747,7 @@ static inline void ipw_fw_dma_reset_command_blocks(struct ipw_priv *priv)
 static int ipw_fw_dma_enable(struct ipw_priv *priv)
 {                               /* start dma engine but no transfers yet */
 
-        IPW_DEBUG_FW(">> : \n");
+        IPW_DEBUG_FW(">> :\n");
 
         /* Start the dma */
         ipw_fw_dma_reset_command_blocks(priv);
@@ -2746,7 +2755,7 @@ static int ipw_fw_dma_enable(struct ipw_priv *priv)
         /* Write CB base address */
         ipw_write_reg32(priv, IPW_DMA_I_CB_BASE, IPW_SHARED_SRAM_DMA_CONTROL);
 
-        IPW_DEBUG_FW("<< : \n");
+        IPW_DEBUG_FW("<< :\n");
         return 0;
 }
 
@@ -2761,7 +2770,7 @@ static void ipw_fw_dma_abort(struct ipw_priv *priv)
         ipw_write_reg32(priv, IPW_DMA_I_DMA_CONTROL, control);
         priv->sram_desc.last_cb_index = 0;
 
-        IPW_DEBUG_FW("<< \n");
+        IPW_DEBUG_FW("<<\n");
 }
 
 static int ipw_fw_dma_write_command_block(struct ipw_priv *priv, int index,
@@ -2812,29 +2821,29 @@ static void ipw_fw_dma_dump_command_block(struct ipw_priv *priv)
 
         IPW_DEBUG_FW(">> :\n");
         address = ipw_read_reg32(priv, IPW_DMA_I_CURRENT_CB);
-        IPW_DEBUG_FW_INFO("Current CB is 0x%x \n", address);
+        IPW_DEBUG_FW_INFO("Current CB is 0x%x\n", address);
 
         /* Read the DMA Controlor register */
         register_value = ipw_read_reg32(priv, IPW_DMA_I_DMA_CONTROL);
-        IPW_DEBUG_FW_INFO("IPW_DMA_I_DMA_CONTROL is 0x%x \n", register_value);
+        IPW_DEBUG_FW_INFO("IPW_DMA_I_DMA_CONTROL is 0x%x\n", register_value);
 
         /* Print the CB values */
         cb_fields_address = address;
         register_value = ipw_read_reg32(priv, cb_fields_address);
-        IPW_DEBUG_FW_INFO("Current CB ControlField is 0x%x \n", register_value);
+        IPW_DEBUG_FW_INFO("Current CB Control Field is 0x%x\n", register_value);
 
         cb_fields_address += sizeof(u32);
         register_value = ipw_read_reg32(priv, cb_fields_address);
-        IPW_DEBUG_FW_INFO("Current CB Source Field is 0x%x \n", register_value);
+        IPW_DEBUG_FW_INFO("Current CB Source Field is 0x%x\n", register_value);
 
         cb_fields_address += sizeof(u32);
         register_value = ipw_read_reg32(priv, cb_fields_address);
-        IPW_DEBUG_FW_INFO("Current CB Destination Field is 0x%x \n",
+        IPW_DEBUG_FW_INFO("Current CB Destination Field is 0x%x\n",
                           register_value);
 
         cb_fields_address += sizeof(u32);
         register_value = ipw_read_reg32(priv, cb_fields_address);
-        IPW_DEBUG_FW_INFO("Current CB Status Field is 0x%x \n", register_value);
+        IPW_DEBUG_FW_INFO("Current CB Status Field is 0x%x\n", register_value);
 
         IPW_DEBUG_FW(">> :\n");
 }
@@ -2850,7 +2859,7 @@ static int ipw_fw_dma_command_block_index(struct ipw_priv *priv)
         current_cb_index = (current_cb_address - IPW_SHARED_SRAM_DMA_CONTROL) /
             sizeof(struct command_block);
 
-        IPW_DEBUG_FW_INFO("Current CB index 0x%x address = 0x%X \n",
+        IPW_DEBUG_FW_INFO("Current CB index 0x%x address = 0x%X\n",
                           current_cb_index, current_cb_address);
 
         IPW_DEBUG_FW(">> :\n");
@@ -2909,7 +2918,7 @@ static int ipw_fw_dma_add_buffer(struct ipw_priv *priv, dma_addr_t *src_address,
         int ret, i;
         u32 size;
 
-        IPW_DEBUG_FW(">> \n");
+        IPW_DEBUG_FW(">>\n");
         IPW_DEBUG_FW_INFO("nr=%d dest_address=0x%x len=0x%x\n",
                           nr, dest_address, len);
 
@@ -2926,7 +2935,7 @@ static int ipw_fw_dma_add_buffer(struct ipw_priv *priv, dma_addr_t *src_address,
                         IPW_DEBUG_FW_INFO(": Added new cb\n");
         }
 
-        IPW_DEBUG_FW("<< \n");
+        IPW_DEBUG_FW("<<\n");
         return 0;
 }
 
@@ -2935,7 +2944,7 @@ static int ipw_fw_dma_wait(struct ipw_priv *priv)
         u32 current_index = 0, previous_index;
         u32 watchdog = 0;
 
-        IPW_DEBUG_FW(">> : \n");
+        IPW_DEBUG_FW(">> :\n");
 
         current_index = ipw_fw_dma_command_block_index(priv);
         IPW_DEBUG_FW_INFO("sram_desc.last_cb_index:0x%08X\n",
@@ -2964,7 +2973,7 @@ static int ipw_fw_dma_wait(struct ipw_priv *priv)
         ipw_set_bit(priv, IPW_RESET_REG,
                     IPW_RESET_REG_MASTER_DISABLED | IPW_RESET_REG_STOP_MASTER);
 
-        IPW_DEBUG_FW("<< dmaWaitSync \n");
+        IPW_DEBUG_FW("<< dmaWaitSync\n");
         return 0;
 }
 
@@ -3025,7 +3034,7 @@ static int ipw_stop_master(struct ipw_priv *priv)
 {
         int rc;
 
-        IPW_DEBUG_TRACE(">> \n");
+        IPW_DEBUG_TRACE(">>\n");
         /* stop master. typical delay - 0 */
         ipw_set_bit(priv, IPW_RESET_REG, IPW_RESET_REG_STOP_MASTER);
 
@@ -3044,7 +3053,7 @@ static int ipw_stop_master(struct ipw_priv *priv)
 
 static void ipw_arc_release(struct ipw_priv *priv)
 {
-        IPW_DEBUG_TRACE(">> \n");
+        IPW_DEBUG_TRACE(">>\n");
         mdelay(5);
 
         ipw_clear_bit(priv, IPW_RESET_REG, CBD_RESET_REG_PRINCETON_RESET);
@@ -3066,7 +3075,7 @@ static int ipw_load_ucode(struct ipw_priv *priv, u8 * data, size_t len)
 
         image = (__le16 *) data;
 
-        IPW_DEBUG_TRACE(">> \n");
+        IPW_DEBUG_TRACE(">>\n");
 
         rc = ipw_stop_master(priv);
 
@@ -3180,7 +3189,7 @@ static int ipw_load_firmware(struct ipw_priv *priv, u8 * data, size_t len)
         void **virts;
         dma_addr_t *phys;
 
-        IPW_DEBUG_TRACE("<< : \n");
+        IPW_DEBUG_TRACE("<< :\n");
 
         virts = kmalloc(sizeof(void *) * CB_NUMBER_OF_ELEMENTS_SMALL,
                         GFP_KERNEL);
@@ -4481,7 +4490,7 @@ static void ipw_rx_notification(struct ipw_priv *priv,
                         case CMAS_ASSOCIATED:{
                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
                                                   IPW_DL_ASSOC,
-                                                  "associated: '%s' %pM \n",
+                                                  "associated: '%s' %pM\n",
                                                   print_ssid(ssid, priv->essid,
                                                              priv->essid_len),
                                                   priv->bssid);
@@ -4562,7 +4571,7 @@ static void ipw_rx_notification(struct ipw_priv *priv,
                                                           IPW_DL_ASSOC,
                                                           "deauthenticated: '%s' "
                                                           "%pM"
-                                                          ": (0x%04X) - %s \n",
+                                                          ": (0x%04X) - %s\n",
                                                           print_ssid(ssid,
                                                                      priv->
                                                                      essid,
@@ -4613,7 +4622,7 @@ static void ipw_rx_notification(struct ipw_priv *priv,
 
                                         IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE |
                                                   IPW_DL_ASSOC,
-                                                  "disassociated: '%s' %pM \n",
+                                                  "disassociated: '%s' %pM\n",
                                                   print_ssid(ssid, priv->essid,
                                                              priv->essid_len),
                                                   priv->bssid);
@@ -4651,7 +4660,7 @@ static void ipw_rx_notification(struct ipw_priv *priv,
                         switch (auth->state) {
                         case CMAS_AUTHENTICATED:
                                 IPW_DEBUG(IPW_DL_NOTIF | IPW_DL_STATE,
-                                          "authenticated: '%s' %pM \n",
+                                          "authenticated: '%s' %pM\n",
                                           print_ssid(ssid, priv->essid,
                                                      priv->essid_len),
                                           priv->bssid);
@@ -6924,7 +6933,7 @@ static u8 ipw_qos_current_mode(struct ipw_priv * priv)
         } else {
                 mode = priv->ieee->mode;
         }
-        IPW_DEBUG_QOS("QoS network/card mode %d \n", mode);
+        IPW_DEBUG_QOS("QoS network/card mode %d\n", mode);
         return mode;
 }
 
@@ -6964,7 +6973,7 @@ static int ipw_qos_handle_probe_response(struct ipw_priv *priv,
                                &def_parameters_OFDM, size);
 
                 if ((network->qos_data.active == 1) && (active_network == 1)) {
-                        IPW_DEBUG_QOS("QoS was disabled call qos_activate \n");
+                        IPW_DEBUG_QOS("QoS was disabled call qos_activate\n");
                         schedule_work(&priv->qos_activate);
                 }
 
@@ -7541,7 +7550,7 @@ static int ipw_associate_network(struct ipw_priv *priv,
                 return err;
         }
 
-        IPW_DEBUG(IPW_DL_STATE, "associating: '%s' %pM \n",
+        IPW_DEBUG(IPW_DL_STATE, "associating: '%s' %pM\n",
                   print_ssid(ssid, priv->essid, priv->essid_len),
                   priv->bssid);
 
@@ -8792,7 +8801,7 @@ static int ipw_wx_set_freq(struct net_device *dev,
                 }
         }
 
-        IPW_DEBUG_WX("SET Freq/Channel -> %d \n", fwrq->m);
+        IPW_DEBUG_WX("SET Freq/Channel -> %d\n", fwrq->m);
         mutex_lock(&priv->mutex);
         ret = ipw_set_channel(priv, channel);
         mutex_unlock(&priv->mutex);
@@ -8834,7 +8843,7 @@ static int ipw_wx_get_freq(struct net_device *dev,
                 wrqu->freq.m = 0;
 
         mutex_unlock(&priv->mutex);
-        IPW_DEBUG_WX("GET Freq/Channel -> %d \n", priv->channel);
+        IPW_DEBUG_WX("GET Freq/Channel -> %d\n", priv->channel);
         return 0;
 }
 
@@ -9229,7 +9238,7 @@ static int ipw_wx_get_sens(struct net_device *dev,
         wrqu->sens.value = priv->roaming_threshold;
         mutex_unlock(&priv->mutex);
 
-        IPW_DEBUG_WX("GET roaming threshold -> %s %d \n",
+        IPW_DEBUG_WX("GET roaming threshold -> %s %d\n",
                      wrqu->power.disabled ? "OFF" : "ON", wrqu->power.value);
 
         return 0;
@@ -9357,7 +9366,7 @@ static int ipw_wx_get_rate(struct net_device *dev,
         wrqu->bitrate.value = priv->last_rate;
         wrqu->bitrate.fixed = (priv->config & CFG_FIXED_RATE) ? 1 : 0;
         mutex_unlock(&priv->mutex);
-        IPW_DEBUG_WX("GET Rate -> %d \n", wrqu->bitrate.value);
+        IPW_DEBUG_WX("GET Rate -> %d\n", wrqu->bitrate.value);
         return 0;
 }
 
@@ -9380,7 +9389,7 @@ static int ipw_wx_set_rts(struct net_device *dev,
 
         ipw_send_rts_threshold(priv, priv->rts_threshold);
         mutex_unlock(&priv->mutex);
-        IPW_DEBUG_WX("SET RTS Threshold -> %d \n", priv->rts_threshold);
+        IPW_DEBUG_WX("SET RTS Threshold -> %d\n", priv->rts_threshold);
         return 0;
 }
 
@@ -9394,7 +9403,7 @@ static int ipw_wx_get_rts(struct net_device *dev,
         wrqu->rts.fixed = 0;    /* no auto select */
         wrqu->rts.disabled = (wrqu->rts.value == DEFAULT_RTS_THRESHOLD);
         mutex_unlock(&priv->mutex);
-        IPW_DEBUG_WX("GET RTS Threshold -> %d \n", wrqu->rts.value);
+        IPW_DEBUG_WX("GET RTS Threshold -> %d\n", wrqu->rts.value);
         return 0;
 }
 
@@ -9444,7 +9453,7 @@ static int ipw_wx_get_txpow(struct net_device *dev,
         wrqu->power.disabled = (priv->status & STATUS_RF_KILL_MASK) ? 1 : 0;
         mutex_unlock(&priv->mutex);
 
-        IPW_DEBUG_WX("GET TX Power -> %s %d \n",
+        IPW_DEBUG_WX("GET TX Power -> %s %d\n",
                      wrqu->power.disabled ? "OFF" : "ON", wrqu->power.value);
 
         return 0;
@@ -9470,7 +9479,7 @@ static int ipw_wx_set_frag(struct net_device *dev,
 
         ipw_send_frag_threshold(priv, wrqu->frag.value);
         mutex_unlock(&priv->mutex);
-        IPW_DEBUG_WX("SET Frag Threshold -> %d \n", wrqu->frag.value);
+        IPW_DEBUG_WX("SET Frag Threshold -> %d\n", wrqu->frag.value);
         return 0;
 }
 
@@ -9484,7 +9493,7 @@ static int ipw_wx_get_frag(struct net_device *dev,
         wrqu->frag.fixed = 0;   /* no auto select */
         wrqu->frag.disabled = (wrqu->frag.value == DEFAULT_FTS);
         mutex_unlock(&priv->mutex);
-        IPW_DEBUG_WX("GET Frag Threshold -> %d \n", wrqu->frag.value);
+        IPW_DEBUG_WX("GET Frag Threshold -> %d\n", wrqu->frag.value);
 
         return 0;
 }
@@ -9548,7 +9557,7 @@ static int ipw_wx_get_retry(struct net_device *dev,
         }
         mutex_unlock(&priv->mutex);
 
-        IPW_DEBUG_WX("GET retry -> %d \n", wrqu->retry.value);
+        IPW_DEBUG_WX("GET retry -> %d\n", wrqu->retry.value);
 
         return 0;
 }
@@ -9995,49 +10004,48 @@ static int ipw_wx_sw_reset(struct net_device *dev,
 }
 
 /* Rebase the WE IOCTLs to zero for the handler array */
-#define IW_IOCTL(x) [(x)-SIOCSIWCOMMIT]
 static iw_handler ipw_wx_handlers[] = {
-        IW_IOCTL(SIOCGIWNAME) = (iw_handler) cfg80211_wext_giwname,
-        IW_IOCTL(SIOCSIWFREQ) = ipw_wx_set_freq,
-        IW_IOCTL(SIOCGIWFREQ) = ipw_wx_get_freq,
-        IW_IOCTL(SIOCSIWMODE) = ipw_wx_set_mode,
-        IW_IOCTL(SIOCGIWMODE) = ipw_wx_get_mode,
-        IW_IOCTL(SIOCSIWSENS) = ipw_wx_set_sens,
-        IW_IOCTL(SIOCGIWSENS) = ipw_wx_get_sens,
-        IW_IOCTL(SIOCGIWRANGE) = ipw_wx_get_range,
-        IW_IOCTL(SIOCSIWAP) = ipw_wx_set_wap,
-        IW_IOCTL(SIOCGIWAP) = ipw_wx_get_wap,
-        IW_IOCTL(SIOCSIWSCAN) = ipw_wx_set_scan,
-        IW_IOCTL(SIOCGIWSCAN) = ipw_wx_get_scan,
-        IW_IOCTL(SIOCSIWESSID) = ipw_wx_set_essid,
-        IW_IOCTL(SIOCGIWESSID) = ipw_wx_get_essid,
-        IW_IOCTL(SIOCSIWNICKN) = ipw_wx_set_nick,
-        IW_IOCTL(SIOCGIWNICKN) = ipw_wx_get_nick,
-        IW_IOCTL(SIOCSIWRATE) = ipw_wx_set_rate,
-        IW_IOCTL(SIOCGIWRATE) = ipw_wx_get_rate,
-        IW_IOCTL(SIOCSIWRTS) = ipw_wx_set_rts,
-        IW_IOCTL(SIOCGIWRTS) = ipw_wx_get_rts,
-        IW_IOCTL(SIOCSIWFRAG) = ipw_wx_set_frag,
-        IW_IOCTL(SIOCGIWFRAG) = ipw_wx_get_frag,
-        IW_IOCTL(SIOCSIWTXPOW) = ipw_wx_set_txpow,
-        IW_IOCTL(SIOCGIWTXPOW) = ipw_wx_get_txpow,
-        IW_IOCTL(SIOCSIWRETRY) = ipw_wx_set_retry,
-        IW_IOCTL(SIOCGIWRETRY) = ipw_wx_get_retry,
-        IW_IOCTL(SIOCSIWENCODE) = ipw_wx_set_encode,
-        IW_IOCTL(SIOCGIWENCODE) = ipw_wx_get_encode,
-        IW_IOCTL(SIOCSIWPOWER) = ipw_wx_set_power,
-        IW_IOCTL(SIOCGIWPOWER) = ipw_wx_get_power,
-        IW_IOCTL(SIOCSIWSPY) = iw_handler_set_spy,
-        IW_IOCTL(SIOCGIWSPY) = iw_handler_get_spy,
-        IW_IOCTL(SIOCSIWTHRSPY) = iw_handler_set_thrspy,
-        IW_IOCTL(SIOCGIWTHRSPY) = iw_handler_get_thrspy,
-        IW_IOCTL(SIOCSIWGENIE) = ipw_wx_set_genie,
-        IW_IOCTL(SIOCGIWGENIE) = ipw_wx_get_genie,
-        IW_IOCTL(SIOCSIWMLME) = ipw_wx_set_mlme,
-        IW_IOCTL(SIOCSIWAUTH) = ipw_wx_set_auth,
-        IW_IOCTL(SIOCGIWAUTH) = ipw_wx_get_auth,
-        IW_IOCTL(SIOCSIWENCODEEXT) = ipw_wx_set_encodeext,
-        IW_IOCTL(SIOCGIWENCODEEXT) = ipw_wx_get_encodeext,
+        IW_HANDLER(SIOCGIWNAME, (iw_handler)cfg80211_wext_giwname),
+        IW_HANDLER(SIOCSIWFREQ, ipw_wx_set_freq),
+        IW_HANDLER(SIOCGIWFREQ, ipw_wx_get_freq),
+        IW_HANDLER(SIOCSIWMODE, ipw_wx_set_mode),
+        IW_HANDLER(SIOCGIWMODE, ipw_wx_get_mode),
+        IW_HANDLER(SIOCSIWSENS, ipw_wx_set_sens),
+        IW_HANDLER(SIOCGIWSENS, ipw_wx_get_sens),
+        IW_HANDLER(SIOCGIWRANGE, ipw_wx_get_range),
+        IW_HANDLER(SIOCSIWAP, ipw_wx_set_wap),
+        IW_HANDLER(SIOCGIWAP, ipw_wx_get_wap),
+        IW_HANDLER(SIOCSIWSCAN, ipw_wx_set_scan),
+        IW_HANDLER(SIOCGIWSCAN, ipw_wx_get_scan),
+        IW_HANDLER(SIOCSIWESSID, ipw_wx_set_essid),
+        IW_HANDLER(SIOCGIWESSID, ipw_wx_get_essid),
+        IW_HANDLER(SIOCSIWNICKN, ipw_wx_set_nick),
+        IW_HANDLER(SIOCGIWNICKN, ipw_wx_get_nick),
+        IW_HANDLER(SIOCSIWRATE, ipw_wx_set_rate),
+        IW_HANDLER(SIOCGIWRATE, ipw_wx_get_rate),
+        IW_HANDLER(SIOCSIWRTS, ipw_wx_set_rts),
+        IW_HANDLER(SIOCGIWRTS, ipw_wx_get_rts),
+        IW_HANDLER(SIOCSIWFRAG, ipw_wx_set_frag),
+        IW_HANDLER(SIOCGIWFRAG, ipw_wx_get_frag),
+        IW_HANDLER(SIOCSIWTXPOW, ipw_wx_set_txpow),
+        IW_HANDLER(SIOCGIWTXPOW, ipw_wx_get_txpow),
+        IW_HANDLER(SIOCSIWRETRY, ipw_wx_set_retry),
+        IW_HANDLER(SIOCGIWRETRY, ipw_wx_get_retry),
+        IW_HANDLER(SIOCSIWENCODE, ipw_wx_set_encode),
+        IW_HANDLER(SIOCGIWENCODE, ipw_wx_get_encode),
+        IW_HANDLER(SIOCSIWPOWER, ipw_wx_set_power),
+        IW_HANDLER(SIOCGIWPOWER, ipw_wx_get_power),
+        IW_HANDLER(SIOCSIWSPY, iw_handler_set_spy),
+        IW_HANDLER(SIOCGIWSPY, iw_handler_get_spy),
+        IW_HANDLER(SIOCSIWTHRSPY, iw_handler_set_thrspy),
+        IW_HANDLER(SIOCGIWTHRSPY, iw_handler_get_thrspy),
+        IW_HANDLER(SIOCSIWGENIE, ipw_wx_set_genie),
+        IW_HANDLER(SIOCGIWGENIE, ipw_wx_get_genie),
+        IW_HANDLER(SIOCSIWMLME, ipw_wx_set_mlme),
+        IW_HANDLER(SIOCSIWAUTH, ipw_wx_set_auth),
+        IW_HANDLER(SIOCGIWAUTH, ipw_wx_get_auth),
+        IW_HANDLER(SIOCSIWENCODEEXT, ipw_wx_set_encodeext),
+        IW_HANDLER(SIOCGIWENCODEEXT, ipw_wx_get_encodeext),
 };
 
 enum {
@@ -11666,7 +11674,7 @@ static int ipw_prom_alloc(struct ipw_priv *priv)
         if (priv->prom_net_dev)
                 return -EPERM;
 
-        priv->prom_net_dev = alloc_ieee80211(sizeof(struct ipw_prom_priv), 1);
+        priv->prom_net_dev = alloc_libipw(sizeof(struct ipw_prom_priv), 1);
         if (priv->prom_net_dev == NULL)
                 return -ENOMEM;
 
@@ -11685,7 +11693,7 @@ static int ipw_prom_alloc(struct ipw_priv *priv)
 
         rc = register_netdev(priv->prom_net_dev);
         if (rc) {
-                free_ieee80211(priv->prom_net_dev, 1);
+                free_libipw(priv->prom_net_dev, 1);
                 priv->prom_net_dev = NULL;
                 return rc;
         }
@@ -11699,7 +11707,7 @@ static void ipw_prom_free(struct ipw_priv *priv)
                 return;
 
         unregister_netdev(priv->prom_net_dev);
-        free_ieee80211(priv->prom_net_dev, 1);
+        free_libipw(priv->prom_net_dev, 1);
 
         priv->prom_net_dev = NULL;
 }
@@ -11727,7 +11735,7 @@ static int __devinit ipw_pci_probe(struct pci_dev *pdev,
         struct ipw_priv *priv;
         int i;
 
-        net_dev = alloc_ieee80211(sizeof(struct ipw_priv), 0);
+        net_dev = alloc_libipw(sizeof(struct ipw_priv), 0);
         if (net_dev == NULL) {
                 err = -ENOMEM;
                 goto out;
@@ -11747,7 +11755,7 @@ static int __devinit ipw_pci_probe(struct pci_dev *pdev,
         mutex_init(&priv->mutex);
         if (pci_enable_device(pdev)) {
                 err = -ENODEV;
-                goto out_free_ieee80211;
+                goto out_free_libipw;
         }
 
         pci_set_master(pdev);
@@ -11874,8 +11882,8 @@ static int __devinit ipw_pci_probe(struct pci_dev *pdev,
       out_pci_disable_device:
         pci_disable_device(pdev);
         pci_set_drvdata(pdev, NULL);
-      out_free_ieee80211:
-        free_ieee80211(priv->net_dev, 0);
+      out_free_libipw:
+        free_libipw(priv->net_dev, 0);
       out:
         return err;
 }
@@ -11942,11 +11950,11 @@ static void __devexit ipw_pci_remove(struct pci_dev *pdev)
         pci_release_regions(pdev);
         pci_disable_device(pdev);
         pci_set_drvdata(pdev, NULL);
-        /* wiphy_unregister needs to be here, before free_ieee80211 */
+        /* wiphy_unregister needs to be here, before free_libipw */
         wiphy_unregister(priv->ieee->wdev.wiphy);
         kfree(priv->ieee->a_band.channels);
         kfree(priv->ieee->bg_band.channels);
-        free_ieee80211(priv->net_dev, 0);
+        free_libipw(priv->net_dev, 0);
         free_firmware();
 }
 
diff --git a/drivers/net/wireless/ipw2x00/libipw.h b/drivers/net/wireless/ipw2x00/libipw.h
index a6d5e42647e4..284b0e4cb815 100644
--- a/drivers/net/wireless/ipw2x00/libipw.h
+++ b/drivers/net/wireless/ipw2x00/libipw.h
@@ -64,7 +64,7 @@
 extern u32 libipw_debug_level;
 #define LIBIPW_DEBUG(level, fmt, args...) \
 do { if (libipw_debug_level & (level)) \
-  printk(KERN_DEBUG "ieee80211: %c %s " fmt, \
+  printk(KERN_DEBUG "libipw: %c %s " fmt, \
          in_interrupt() ? 'I' : 'U', __func__ , ## args); } while (0)
 static inline bool libipw_ratelimit_debug(u32 level)
 {
@@ -116,8 +116,8 @@ static inline bool libipw_ratelimit_debug(u32 level)
 #define LIBIPW_DL_RX            (1<<9)
 #define LIBIPW_DL_QOS           (1<<31)
 
-#define LIBIPW_ERROR(f, a...) printk(KERN_ERR "ieee80211: " f, ## a)
-#define LIBIPW_WARNING(f, a...) printk(KERN_WARNING "ieee80211: " f, ## a)
+#define LIBIPW_ERROR(f, a...) printk(KERN_ERR "libipw: " f, ## a)
+#define LIBIPW_WARNING(f, a...) printk(KERN_WARNING "libipw: " f, ## a)
 #define LIBIPW_DEBUG_INFO(f, a...)   LIBIPW_DEBUG(LIBIPW_DL_INFO, f, ## a)
 
 #define LIBIPW_DEBUG_WX(f, a...)     LIBIPW_DEBUG(LIBIPW_DL_WX, f, ## a)
@@ -905,7 +905,7 @@ struct libipw_device {
                                        struct libipw_reassoc_request * req);
 
         /* This must be the last item so that it points to the data
-         * allocated beyond this structure by alloc_ieee80211 */
+         * allocated beyond this structure by alloc_libipw */
         u8 priv[0];
 };
 
@@ -1017,9 +1017,9 @@ static inline int libipw_is_cck_rate(u8 rate)
         return 0;
 }
 
-/* ieee80211.c */
-extern void free_ieee80211(struct net_device *dev, int monitor);
-extern struct net_device *alloc_ieee80211(int sizeof_priv, int monitor);
+/* libipw.c */
+extern void free_libipw(struct net_device *dev, int monitor);
+extern struct net_device *alloc_libipw(int sizeof_priv, int monitor);
 extern int libipw_change_mtu(struct net_device *dev, int new_mtu);
 
 extern void libipw_networks_age(struct libipw_device *ieee,
diff --git a/drivers/net/wireless/ipw2x00/libipw_module.c b/drivers/net/wireless/ipw2x00/libipw_module.c
index 2fa55867bd8b..55965408ff3f 100644
--- a/drivers/net/wireless/ipw2x00/libipw_module.c
+++ b/drivers/net/wireless/ipw2x00/libipw_module.c
@@ -53,7 +53,7 @@
 #include "libipw.h"
 
 #define DRV_DESCRIPTION "802.11 data/management/control stack"
-#define DRV_NAME        "ieee80211"
+#define DRV_NAME        "libipw"
 #define DRV_VERSION     LIBIPW_VERSION
 #define DRV_COPYRIGHT   "Copyright (C) 2004-2005 Intel Corporation <jketreno@linux.intel.com>"
 
@@ -140,7 +140,7 @@ int libipw_change_mtu(struct net_device *dev, int new_mtu)
 }
 EXPORT_SYMBOL(libipw_change_mtu);
 
-struct net_device *alloc_ieee80211(int sizeof_priv, int monitor)
+struct net_device *alloc_libipw(int sizeof_priv, int monitor)
 {
         struct libipw_device *ieee;
         struct net_device *dev;
@@ -222,8 +222,9 @@ failed_free_netdev:
 failed:
         return NULL;
 }
+EXPORT_SYMBOL(alloc_libipw);
 
-void free_ieee80211(struct net_device *dev, int monitor)
+void free_libipw(struct net_device *dev, int monitor)
 {
         struct libipw_device *ieee = netdev_priv(dev);
 
@@ -237,6 +238,7 @@ void free_ieee80211(struct net_device *dev, int monitor)
 
         free_netdev(dev);
 }
+EXPORT_SYMBOL(free_libipw);
 
 #ifdef CONFIG_LIBIPW_DEBUG
 
@@ -291,7 +293,7 @@ static int __init libipw_init(void)
         struct proc_dir_entry *e;
 
         libipw_debug_level = debug;
-        libipw_proc = proc_mkdir(DRV_NAME, init_net.proc_net);
+        libipw_proc = proc_mkdir("ieee80211", init_net.proc_net);
         if (libipw_proc == NULL) {
                 LIBIPW_ERROR("Unable to create " DRV_NAME
                                 " proc directory\n");
@@ -331,6 +333,3 @@ MODULE_PARM_DESC(debug, "debug output mask");
 
 module_exit(libipw_exit);
 module_init(libipw_init);
-
-EXPORT_SYMBOL(alloc_ieee80211);
-EXPORT_SYMBOL(free_ieee80211);
diff --git a/drivers/net/wireless/iwlwifi/Makefile b/drivers/net/wireless/iwlwifi/Makefile
index 4e378faee650..a684a72eb6e9 100644
--- a/drivers/net/wireless/iwlwifi/Makefile
+++ b/drivers/net/wireless/iwlwifi/Makefile
@@ -9,7 +9,9 @@ CFLAGS_iwl-devtrace.o := -I$(src)
 
 # AGN
 obj-$(CONFIG_IWLAGN)    += iwlagn.o
-iwlagn-objs             := iwl-agn.o iwl-agn-rs.o iwl-agn-led.o
+iwlagn-objs             := iwl-agn.o iwl-agn-rs.o iwl-agn-led.o iwl-agn-ict.o
+iwlagn-objs             += iwl-agn-ucode.o iwl-agn-hcmd.o iwl-agn-tx.o
+iwlagn-objs             += iwl-agn-lib.o
 
 iwlagn-$(CONFIG_IWL4965) += iwl-4965.o
 iwlagn-$(CONFIG_IWL5000) += iwl-5000.o
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index 3bf2e6e9b2d9..b941b3e95697 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -42,8 +42,9 @@
 #include "iwl-core.h"
 #include "iwl-io.h"
 #include "iwl-sta.h"
+#include "iwl-agn.h"
 #include "iwl-helpers.h"
-#include "iwl-5000-hw.h"
+#include "iwl-agn-hw.h"
 #include "iwl-agn-led.h"
 
 /* Highest firmware API version supported */
@@ -117,7 +118,7 @@ static struct iwl_sensitivity_ranges iwl1000_sensitivity = {
 static int iwl1000_hw_set_hw_params(struct iwl_priv *priv)
 {
         if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
-            priv->cfg->mod_params->num_of_queues <= IWL50_NUM_QUEUES)
+            priv->cfg->mod_params->num_of_queues <= IWLAGN_NUM_QUEUES)
                 priv->cfg->num_of_queues =
                         priv->cfg->mod_params->num_of_queues;
 
@@ -125,13 +126,13 @@ static int iwl1000_hw_set_hw_params(struct iwl_priv *priv)
         priv->hw_params.dma_chnl_num = FH50_TCSR_CHNL_NUM;
         priv->hw_params.scd_bc_tbls_size =
                         priv->cfg->num_of_queues *
-                        sizeof(struct iwl5000_scd_bc_tbl);
+                        sizeof(struct iwlagn_scd_bc_tbl);
         priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
         priv->hw_params.max_stations = IWL5000_STATION_COUNT;
         priv->hw_params.bcast_sta_id = IWL5000_BROADCAST_ID;
 
-        priv->hw_params.max_data_size = IWL50_RTC_DATA_SIZE;
-        priv->hw_params.max_inst_size = IWL50_RTC_INST_SIZE;
+        priv->hw_params.max_data_size = IWLAGN_RTC_DATA_SIZE;
+        priv->hw_params.max_inst_size = IWLAGN_RTC_INST_SIZE;
 
         priv->hw_params.max_bsm_size = 0;
         priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ) |
@@ -161,25 +162,25 @@ static int iwl1000_hw_set_hw_params(struct iwl_priv *priv)
 
 static struct iwl_lib_ops iwl1000_lib = {
         .set_hw_params = iwl1000_hw_set_hw_params,
-        .txq_update_byte_cnt_tbl = iwl5000_txq_update_byte_cnt_tbl,
-        .txq_inval_byte_cnt_tbl = iwl5000_txq_inval_byte_cnt_tbl,
-        .txq_set_sched = iwl5000_txq_set_sched,
-        .txq_agg_enable = iwl5000_txq_agg_enable,
-        .txq_agg_disable = iwl5000_txq_agg_disable,
+        .txq_update_byte_cnt_tbl = iwlagn_txq_update_byte_cnt_tbl,
+        .txq_inval_byte_cnt_tbl = iwlagn_txq_inval_byte_cnt_tbl,
+        .txq_set_sched = iwlagn_txq_set_sched,
+        .txq_agg_enable = iwlagn_txq_agg_enable,
+        .txq_agg_disable = iwlagn_txq_agg_disable,
         .txq_attach_buf_to_tfd = iwl_hw_txq_attach_buf_to_tfd,
         .txq_free_tfd = iwl_hw_txq_free_tfd,
         .txq_init = iwl_hw_tx_queue_init,
-        .rx_handler_setup = iwl5000_rx_handler_setup,
-        .setup_deferred_work = iwl5000_setup_deferred_work,
-        .is_valid_rtc_data_addr = iwl5000_hw_valid_rtc_data_addr,
-        .load_ucode = iwl5000_load_ucode,
+        .rx_handler_setup = iwlagn_rx_handler_setup,
+        .setup_deferred_work = iwlagn_setup_deferred_work,
+        .is_valid_rtc_data_addr = iwlagn_hw_valid_rtc_data_addr,
+        .load_ucode = iwlagn_load_ucode,
         .dump_nic_event_log = iwl_dump_nic_event_log,
         .dump_nic_error_log = iwl_dump_nic_error_log,
         .dump_csr = iwl_dump_csr,
         .dump_fh = iwl_dump_fh,
-        .init_alive_start = iwl5000_init_alive_start,
-        .alive_notify = iwl5000_alive_notify,
-        .send_tx_power = iwl5000_send_tx_power,
+        .init_alive_start = iwlagn_init_alive_start,
+        .alive_notify = iwlagn_alive_notify,
+        .send_tx_power = iwlagn_send_tx_power,
         .update_chain_flags = iwl_update_chain_flags,
         .apm_ops = {
                 .init = iwl_apm_init,
@@ -189,40 +190,43 @@ static struct iwl_lib_ops iwl1000_lib = {
         },
         .eeprom_ops = {
                 .regulatory_bands = {
-                        EEPROM_5000_REG_BAND_1_CHANNELS,
-                        EEPROM_5000_REG_BAND_2_CHANNELS,
-                        EEPROM_5000_REG_BAND_3_CHANNELS,
-                        EEPROM_5000_REG_BAND_4_CHANNELS,
-                        EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
-                        EEPROM_5000_REG_BAND_52_HT40_CHANNELS
+                        EEPROM_REG_BAND_1_CHANNELS,
+                        EEPROM_REG_BAND_2_CHANNELS,
+                        EEPROM_REG_BAND_3_CHANNELS,
+                        EEPROM_REG_BAND_4_CHANNELS,
+                        EEPROM_REG_BAND_5_CHANNELS,
+                        EEPROM_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
                 .acquire_semaphore = iwlcore_eeprom_acquire_semaphore,
                 .release_semaphore = iwlcore_eeprom_release_semaphore,
-                .calib_version  = iwl5000_eeprom_calib_version,
-                .query_addr = iwl5000_eeprom_query_addr,
+                .calib_version  = iwlagn_eeprom_calib_version,
+                .query_addr = iwlagn_eeprom_query_addr,
         },
         .post_associate = iwl_post_associate,
         .isr = iwl_isr_ict,
         .config_ap = iwl_config_ap,
         .temp_ops = {
-                .temperature = iwl5000_temperature,
+                .temperature = iwlagn_temperature,
                 .set_ct_kill = iwl1000_set_ct_threshold,
          },
         .add_bcast_station = iwl_add_bcast_station,
+        .recover_from_tx_stall = iwl_bg_monitor_recover,
+        .check_plcp_health = iwl_good_plcp_health,
+        .check_ack_health = iwl_good_ack_health,
 };
 
 static const struct iwl_ops iwl1000_ops = {
-        .ucode = &iwl5000_ucode,
+        .ucode = &iwlagn_ucode,
         .lib = &iwl1000_lib,
-        .hcmd = &iwl5000_hcmd,
-        .utils = &iwl5000_hcmd_utils,
+        .hcmd = &iwlagn_hcmd,
+        .utils = &iwlagn_hcmd_utils,
         .led = &iwlagn_led_ops,
 };
 
 struct iwl_cfg iwl1000_bgn_cfg = {
-        .name = "1000 Series BGN",
+        .name = "Intel(R) Centrino(R) Wireless-N 1000 BGN",
         .fw_name_pre = IWL1000_FW_PRE,
         .ucode_api_max = IWL1000_UCODE_API_MAX,
         .ucode_api_min = IWL1000_UCODE_API_MIN,
@@ -230,10 +234,10 @@ struct iwl_cfg iwl1000_bgn_cfg = {
         .ops = &iwl1000_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_1000_EEPROM_VERSION,
-        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .eeprom_calib_ver = EEPROM_1000_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_A,
         .valid_rx_ant = ANT_AB,
         .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
@@ -248,10 +252,11 @@ struct iwl_cfg iwl1000_bgn_cfg = {
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_EXT_LONG_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
 };
 
 struct iwl_cfg iwl1000_bg_cfg = {
-        .name = "1000 Series BG",
+        .name = "Intel(R) Centrino(R) Wireless-N 1000 BG",
         .fw_name_pre = IWL1000_FW_PRE,
         .ucode_api_max = IWL1000_UCODE_API_MAX,
         .ucode_api_min = IWL1000_UCODE_API_MIN,
@@ -259,10 +264,10 @@ struct iwl_cfg iwl1000_bg_cfg = {
         .ops = &iwl1000_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_1000_EEPROM_VERSION,
-        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .eeprom_calib_ver = EEPROM_1000_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_A,
         .valid_rx_ant = ANT_AB,
         .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
@@ -276,6 +281,7 @@ struct iwl_cfg iwl1000_bg_cfg = {
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_EXT_LONG_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
 };
 
 MODULE_FIRMWARE(IWL1000_MODULE_FIRMWARE(IWL1000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
index 3a876a8ece38..91bcb4e3cdfb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
@@ -71,13 +71,11 @@
 
 #include "iwl-eeprom.h"
 
-/* Time constants */
-#define SHORT_SLOT_TIME 9
-#define LONG_SLOT_TIME 20
-
 /* RSSI to dBm */
 #define IWL39_RSSI_OFFSET       95
 
+#define IWL_DEFAULT_TX_POWER    0x0F
+
 /*
  * EEPROM related constants, enums, and structures.
  */
@@ -228,7 +226,6 @@ struct iwl3945_eeprom {
 
 /* 4 DATA + 1 CMD. There are 2 HCCA queues that are not used. */
 #define IWL39_NUM_QUEUES        5
-#define IWL_NUM_SCAN_RATES         (2)
 
 #define IWL_DEFAULT_TX_RETRY  15
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
index 47909f94271e..9e411dc0e5e1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
@@ -329,16 +329,25 @@ static void iwl3945_collect_tx_data(struct iwl3945_rs_sta *rs_sta,
 
 }
 
-static void rs_rate_init(void *priv_r, struct ieee80211_supported_band *sband,
-                         struct ieee80211_sta *sta, void *priv_sta)
+/*
+ * Called after adding a new station to initialize rate scaling
+ */
+void iwl3945_rs_rate_init(struct iwl_priv *priv, struct ieee80211_sta *sta, u8 sta_id)
 {
-        struct iwl3945_rs_sta *rs_sta = priv_sta;
-        struct iwl_priv *priv = (struct iwl_priv *)priv_r;
+        struct ieee80211_hw *hw = priv->hw;
+        struct ieee80211_conf *conf = &priv->hw->conf;
+        struct iwl3945_sta_priv *psta;
+        struct iwl3945_rs_sta *rs_sta;
+        struct ieee80211_supported_band *sband;
         int i;
 
-        IWL_DEBUG_RATE(priv, "enter\n");
+        IWL_DEBUG_INFO(priv, "enter\n");
+        if (sta_id == priv->hw_params.bcast_sta_id)
+                goto out;
 
-        spin_lock_init(&rs_sta->lock);
+        psta = (struct iwl3945_sta_priv *) sta->drv_priv;
+        rs_sta = &psta->rs_sta;
+        sband = hw->wiphy->bands[conf->channel->band];
 
         rs_sta->priv = priv;
 
@@ -351,9 +360,7 @@ static void rs_rate_init(void *priv_r, struct ieee80211_supported_band *sband,
         rs_sta->last_flush = jiffies;
         rs_sta->flush_time = IWL_RATE_FLUSH;
         rs_sta->last_tx_packets = 0;
-        rs_sta->ibss_sta_added = 0;
 
-        init_timer(&rs_sta->rate_scale_flush);
         rs_sta->rate_scale_flush.data = (unsigned long)rs_sta;
         rs_sta->rate_scale_flush.function = iwl3945_bg_rate_scale_flush;
 
@@ -372,16 +379,18 @@ static void rs_rate_init(void *priv_r, struct ieee80211_supported_band *sband,
                 }
         }
 
-        priv->sta_supp_rates = sta->supp_rates[sband->band];
+        priv->_3945.sta_supp_rates = sta->supp_rates[sband->band];
         /* For 5 GHz band it start at IWL_FIRST_OFDM_RATE */
         if (sband->band == IEEE80211_BAND_5GHZ) {
                 rs_sta->last_txrate_idx += IWL_FIRST_OFDM_RATE;
-                priv->sta_supp_rates = priv->sta_supp_rates <<
+                priv->_3945.sta_supp_rates = priv->_3945.sta_supp_rates <<
                                                 IWL_FIRST_OFDM_RATE;
         }
 
+out:
+        priv->stations[sta_id].used &= ~IWL_STA_UCODE_INPROGRESS;
 
-        IWL_DEBUG_RATE(priv, "leave\n");
+        IWL_DEBUG_INFO(priv, "leave\n");
 }
 
 static void *rs_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
@@ -405,6 +414,9 @@ static void *rs_alloc_sta(void *iwl_priv, struct ieee80211_sta *sta, gfp_t gfp)
 
         rs_sta = &psta->rs_sta;
 
+        spin_lock_init(&rs_sta->lock);
+        init_timer(&rs_sta->rate_scale_flush);
+
         IWL_DEBUG_RATE(priv, "leave\n");
 
         return rs_sta;
@@ -413,13 +425,14 @@ static void *rs_alloc_sta(void *iwl_priv, struct ieee80211_sta *sta, gfp_t gfp)
 static void rs_free_sta(void *iwl_priv, struct ieee80211_sta *sta,
                         void *priv_sta)
 {
-        struct iwl3945_sta_priv *psta = (void *) sta->drv_priv;
-        struct iwl3945_rs_sta *rs_sta = &psta->rs_sta;
-        struct iwl_priv *priv __maybe_unused = rs_sta->priv;
+        struct iwl3945_rs_sta *rs_sta = priv_sta;
 
-        IWL_DEBUG_RATE(priv, "enter\n");
+        /*
+         * Be careful not to use any members of iwl3945_rs_sta (like trying
+         * to use iwl_priv to print out debugging) since it may not be fully
+         * initialized at this point.
+         */
         del_timer_sync(&rs_sta->rate_scale_flush);
-        IWL_DEBUG_RATE(priv, "leave\n");
 }
 
 
@@ -458,6 +471,13 @@ static void rs_tx_status(void *priv_rate, struct ieee80211_supported_band *sband
                 return;
         }
 
+        /* Treat uninitialized rate scaling data same as non-existing. */
+        if (!rs_sta->priv) {
+                IWL_DEBUG_RATE(priv, "leave: STA priv data uninitialized!\n");
+                return;
+        }
+
+
         rs_sta->tx_packets++;
 
         scale_rate_index = first_index;
@@ -625,7 +645,6 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta,
         u32 fail_count;
         s8 scale_action = 0;
         unsigned long flags;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         u16 rate_mask = sta ? sta->supp_rates[sband->band] : 0;
         s8 max_rate_idx = -1;
         struct iwl_priv *priv = (struct iwl_priv *)priv_r;
@@ -633,6 +652,12 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta,
 
         IWL_DEBUG_RATE(priv, "enter\n");
 
+        /* Treat uninitialized rate scaling data same as non-existing. */
+        if (rs_sta && !rs_sta->priv) {
+                IWL_DEBUG_RATE(priv, "Rate scaling information not initialized yet.\n");
+                priv_sta = NULL;
+        }
+
         if (rate_control_send_low(sta, priv_sta, txrc))
                 return;
 
@@ -650,20 +675,6 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta,
         if (sband->band == IEEE80211_BAND_5GHZ)
                 rate_mask = rate_mask << IWL_FIRST_OFDM_RATE;
 
-        if ((priv->iw_mode == NL80211_IFTYPE_ADHOC) &&
-            !rs_sta->ibss_sta_added) {
-                u8 sta_id = iwl_find_station(priv, hdr->addr1);
-
-                if (sta_id == IWL_INVALID_STATION) {
-                        IWL_DEBUG_RATE(priv, "LQ: ADD station %pM\n",
-                                       hdr->addr1);
-                        sta_id = iwl_add_station(priv, hdr->addr1, false,
-                                CMD_ASYNC, NULL);
-                }
-                if (sta_id != IWL_INVALID_STATION)
-                        rs_sta->ibss_sta_added = 1;
-        }
-
         spin_lock_irqsave(&rs_sta->lock, flags);
 
         /* for recent assoc, choose best rate regarding
@@ -883,12 +894,22 @@ static void iwl3945_remove_debugfs(void *priv, void *priv_sta)
 }
 #endif
 
+/*
+ * Initialization of rate scaling information is done by driver after
+ * the station is added. Since mac80211 calls this function before a
+ * station is added we ignore it.
+ */
+static void rs_rate_init_stub(void *priv_r, struct ieee80211_supported_band *sband,
+                              struct ieee80211_sta *sta, void *priv_sta)
+{
+}
+
 static struct rate_control_ops rs_ops = {
         .module = NULL,
         .name = RS_NAME,
         .tx_status = rs_tx_status,
         .get_rate = rs_get_rate,
-        .rate_init = rs_rate_init,
+        .rate_init = rs_rate_init_stub,
         .alloc = rs_alloc,
         .free = rs_free,
         .alloc_sta = rs_alloc_sta,
@@ -899,7 +920,6 @@ static struct rate_control_ops rs_ops = {
 #endif
 
 };
-
 void iwl3945_rate_scale_init(struct ieee80211_hw *hw, s32 sta_id)
 {
         struct iwl_priv *priv = hw->priv;
@@ -916,6 +936,7 @@ void iwl3945_rate_scale_init(struct ieee80211_hw *hw, s32 sta_id)
         sta = ieee80211_find_sta(priv->vif,
                                  priv->stations[sta_id].sta.sta.addr);
         if (!sta) {
+                IWL_DEBUG_RATE(priv, "Unable to find station to initialize rate scaling.\n");
                 rcu_read_unlock();
                 return;
         }
@@ -946,7 +967,7 @@ void iwl3945_rate_scale_init(struct ieee80211_hw *hw, s32 sta_id)
 
         spin_unlock_irqrestore(&rs_sta->lock, flags);
 
-        rssi = priv->last_rx_rssi;
+        rssi = priv->_3945.last_rx_rssi;
         if (rssi == 0)
                 rssi = IWL_MIN_RSSI_VAL;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index e0678d921055..f88f75dfd96e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -242,7 +242,7 @@ int iwl3945_rs_next_rate(struct iwl_priv *priv, int rate)
                         next_rate = IWL_RATE_6M_INDEX;
                 break;
         case IEEE80211_BAND_2GHZ:
-                if (!(priv->sta_supp_rates & IWL_OFDM_RATES_MASK) &&
+                if (!(priv->_3945.sta_supp_rates & IWL_OFDM_RATES_MASK) &&
                     iwl_is_associated(priv)) {
                         if (rate == IWL_RATE_11M_INDEX)
                                 next_rate = IWL_RATE_5M_INDEX;
@@ -359,7 +359,7 @@ void iwl3945_hw_rx_statistics(struct iwl_priv *priv,
                      (int)sizeof(struct iwl3945_notif_statistics),
                      le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
 
-        memcpy(&priv->statistics_39, pkt->u.raw, sizeof(priv->statistics_39));
+        memcpy(&priv->_3945.statistics, pkt->u.raw, sizeof(priv->_3945.statistics));
 }
 
 /******************************************************************************
@@ -486,7 +486,7 @@ static void _iwl3945_dbg_report_frame(struct iwl_priv *priv,
                  *    but you can hack it to show more, if you'd like to. */
                 if (dataframe)
                         IWL_DEBUG_RX(priv, "%s: mhd=0x%04x, dst=0x%02x, "
-                                     "len=%u, rssi=%d, chnl=%d, rate=%d, \n",
+                                     "len=%u, rssi=%d, chnl=%d, rate=%d,\n",
                                      title, le16_to_cpu(fc), header->addr1[5],
                                      length, rssi, channel, rate);
                 else {
@@ -548,7 +548,6 @@ static void iwl3945_pass_packet_to_mac80211(struct iwl_priv *priv,
         struct iwl3945_rx_frame_end *rx_end = IWL_RX_END(pkt);
         u16 len = le16_to_cpu(rx_hdr->len);
         struct sk_buff *skb;
-        int ret;
         __le16 fc = hdr->frame_control;
 
         /* We received data from the HW, so stop the watchdog */
@@ -565,9 +564,9 @@ static void iwl3945_pass_packet_to_mac80211(struct iwl_priv *priv,
                 return;
         }
 
-        skb = alloc_skb(IWL_LINK_HDR_MAX * 2, GFP_ATOMIC);
+        skb = dev_alloc_skb(128);
         if (!skb) {
-                IWL_ERR(priv, "alloc_skb failed\n");
+                IWL_ERR(priv, "dev_alloc_skb failed\n");
                 return;
         }
 
@@ -576,37 +575,13 @@ static void iwl3945_pass_packet_to_mac80211(struct iwl_priv *priv,
                                        (struct ieee80211_hdr *)rxb_addr(rxb),
                                        le32_to_cpu(rx_end->status), stats);
 
-        skb_reserve(skb, IWL_LINK_HDR_MAX);
         skb_add_rx_frag(skb, 0, rxb->page,
                         (void *)rx_hdr->payload - (void *)pkt, len);
 
-        /* mac80211 currently doesn't support paged SKB. Convert it to
-         * linear SKB for management frame and data frame requires
-         * software decryption or software defragementation. */
-        if (ieee80211_is_mgmt(fc) ||
-            ieee80211_has_protected(fc) ||
-            ieee80211_has_morefrags(fc) ||
-            le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG)
-                ret = skb_linearize(skb);
-        else
-                ret = __pskb_pull_tail(skb, min_t(u16, IWL_LINK_HDR_MAX, len)) ?
-                        0 : -ENOMEM;
-
-        if (ret) {
-                kfree_skb(skb);
-                goto out;
-        }
-
-        /*
-         * XXX: We cannot touch the page and its virtual memory (pkt) after
-         * here. It might have already been freed by the above skb change.
-         */
-
         iwl_update_stats(priv, false, fc, len);
         memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
 
         ieee80211_rx(priv->hw, skb);
- out:
         priv->alloc_rxb_page--;
         rxb->page = NULL;
 }
@@ -622,7 +597,6 @@ static void iwl3945_rx_reply_rx(struct iwl_priv *priv,
         struct iwl3945_rx_frame_stats *rx_stats = IWL_RX_STATS(pkt);
         struct iwl3945_rx_frame_hdr *rx_hdr = IWL_RX_HDR(pkt);
         struct iwl3945_rx_frame_end *rx_end = IWL_RX_END(pkt);
-        int snr;
         u16 rx_stats_sig_avg = le16_to_cpu(rx_stats->sig_avg);
         u16 rx_stats_noise_diff = le16_to_cpu(rx_stats->noise_diff);
         u8 network_packet;
@@ -662,53 +636,29 @@ static void iwl3945_rx_reply_rx(struct iwl_priv *priv,
         /* Convert 3945's rssi indicator to dBm */
         rx_status.signal = rx_stats->rssi - IWL39_RSSI_OFFSET;
 
-        /* Set default noise value to -127 */
-        if (priv->last_rx_noise == 0)
-                priv->last_rx_noise = IWL_NOISE_MEAS_NOT_AVAILABLE;
-
-        /* 3945 provides noise info for OFDM frames only.
-         * sig_avg and noise_diff are measured by the 3945's digital signal
-         *   processor (DSP), and indicate linear levels of signal level and
-         *   distortion/noise within the packet preamble after
-         *   automatic gain control (AGC).  sig_avg should stay fairly
-         *   constant if the radio's AGC is working well.
-         * Since these values are linear (not dB or dBm), linear
-         *   signal-to-noise ratio (SNR) is (sig_avg / noise_diff).
-         * Convert linear SNR to dB SNR, then subtract that from rssi dBm
-         *   to obtain noise level in dBm.
-         * Calculate rx_status.signal (quality indicator in %) based on SNR. */
-        if (rx_stats_noise_diff) {
-                snr = rx_stats_sig_avg / rx_stats_noise_diff;
-                rx_status.noise = rx_status.signal -
-                                        iwl3945_calc_db_from_ratio(snr);
-        } else {
-                rx_status.noise = priv->last_rx_noise;
-        }
-
-
-        IWL_DEBUG_STATS(priv, "Rssi %d noise %d sig_avg %d noise_diff %d\n",
-                        rx_status.signal, rx_status.noise,
-                        rx_stats_sig_avg, rx_stats_noise_diff);
+        IWL_DEBUG_STATS(priv, "Rssi %d sig_avg %d noise_diff %d\n",
+                        rx_status.signal, rx_stats_sig_avg,
+                        rx_stats_noise_diff);
 
         header = (struct ieee80211_hdr *)IWL_RX_DATA(pkt);
 
         network_packet = iwl3945_is_network_packet(priv, header);
 
-        IWL_DEBUG_STATS_LIMIT(priv, "[%c] %d RSSI:%d Signal:%u, Noise:%u, Rate:%u\n",
+        IWL_DEBUG_STATS_LIMIT(priv, "[%c] %d RSSI:%d Signal:%u, Rate:%u\n",
                               network_packet ? '*' : ' ',
                               le16_to_cpu(rx_hdr->channel),
                               rx_status.signal, rx_status.signal,
-                              rx_status.noise, rx_status.rate_idx);
+                              rx_status.rate_idx);
 
         /* Set "1" to report good data frames in groups of 100 */
         iwl3945_dbg_report_frame(priv, pkt, header, 1);
         iwl_dbg_log_rx_data_frame(priv, le16_to_cpu(rx_hdr->len), header);
 
         if (network_packet) {
-                priv->last_beacon_time = le32_to_cpu(rx_end->beacon_timestamp);
-                priv->last_tsf = le64_to_cpu(rx_end->timestamp);
-                priv->last_rx_rssi = rx_status.signal;
-                priv->last_rx_noise = rx_status.noise;
+                priv->_3945.last_beacon_time =
+                        le32_to_cpu(rx_end->beacon_timestamp);
+                priv->_3945.last_tsf = le64_to_cpu(rx_end->timestamp);
+                priv->_3945.last_rx_rssi = rx_status.signal;
         }
 
         iwl3945_pass_packet_to_mac80211(priv, rxb, &rx_status);
@@ -956,7 +906,7 @@ static int iwl3945_tx_reset(struct iwl_priv *priv)
         iwl_write_prph(priv, ALM_SCD_TXF5MF_REG, 0x000005);
 
         iwl_write_direct32(priv, FH39_TSSR_CBB_BASE,
-                             priv->shared_phys);
+                             priv->_3945.shared_phys);
 
         iwl_write_direct32(priv, FH39_TSSR_MSG_CONFIG,
                 FH39_TSSR_TX_MSG_CONFIG_REG_VAL_SNOOP_RD_TXPD_ON |
@@ -1048,7 +998,7 @@ static void iwl3945_nic_config(struct iwl_priv *priv)
         IWL_DEBUG_INFO(priv, "HW Revision ID = 0x%X\n", rev_id);
 
         if (rev_id & PCI_CFG_REV_ID_BIT_RTP)
-                IWL_DEBUG_INFO(priv, "RTP type \n");
+                IWL_DEBUG_INFO(priv, "RTP type\n");
         else if (rev_id & PCI_CFG_REV_ID_BIT_BASIC_SKU) {
                 IWL_DEBUG_INFO(priv, "3945 RADIO-MB type\n");
                 iwl_set_bit(priv, CSR_HW_IF_CONFIG_REG,
@@ -1606,7 +1556,7 @@ static int iwl3945_hw_reg_set_new_power(struct iwl_priv *priv,
         int power;
 
         /* Get this chnlgrp's rate-to-max/clip-powers table */
-        clip_pwrs = priv->clip39_groups[ch_info->group_index].clip_powers;
+        clip_pwrs = priv->_3945.clip_groups[ch_info->group_index].clip_powers;
 
         /* Get this channel's rate-to-current-power settings table */
         power_info = ch_info->power_info;
@@ -1732,7 +1682,7 @@ static int iwl3945_hw_reg_comp_txpower_temp(struct iwl_priv *priv)
                 }
 
                 /* Get this chnlgrp's rate-to-max/clip-powers table */
-                clip_pwrs = priv->clip39_groups[ch_info->group_index].clip_powers;
+                clip_pwrs = priv->_3945.clip_groups[ch_info->group_index].clip_powers;
 
                 /* set scan tx power, 1Mbit for CCK, 6Mbit for OFDM */
                 for (scan_tbl_index = 0;
@@ -1910,6 +1860,8 @@ static int iwl3945_commit_rxon(struct iwl_priv *priv)
                                   "configuration (%d).\n", rc);
                         return rc;
                 }
+                iwl_clear_ucode_stations(priv, false);
+                iwl_restore_stations(priv);
         }
 
         IWL_DEBUG_INFO(priv, "Sending RXON\n"
@@ -1940,7 +1892,10 @@ static int iwl3945_commit_rxon(struct iwl_priv *priv)
 
         memcpy(active_rxon, staging_rxon, sizeof(*active_rxon));
 
-        iwl_clear_stations_table(priv);
+        if (!new_assoc) {
+                iwl_clear_ucode_stations(priv, false);
+                iwl_restore_stations(priv);
+        }
 
         /* If we issue a new RXON command which required a tune then we must
          * send a new TXPOWER command or we won't be able to Tx any frames */
@@ -1950,19 +1905,6 @@ static int iwl3945_commit_rxon(struct iwl_priv *priv)
                 return rc;
         }
 
-        /* Add the broadcast address so we can send broadcast frames */
-        priv->cfg->ops->lib->add_bcast_station(priv);
-
-        /* If we have set the ASSOC_MSK and we are in BSS mode then
-         * add the IWL_AP_ID to the station rate table */
-        if (iwl_is_associated(priv) &&
-            (priv->iw_mode == NL80211_IFTYPE_STATION))
-                if (iwl_add_station(priv, priv->active_rxon.bssid_addr,
-                                true, CMD_SYNC, NULL) == IWL_INVALID_STATION) {
-                        IWL_ERR(priv, "Error adding AP address for transmit\n");
-                        return -EIO;
-                }
-
         /* Init the hardware's rate fallback order based on the band */
         rc = iwl3945_init_hw_rate_table(priv);
         if (rc) {
@@ -1997,13 +1939,13 @@ void iwl3945_reg_txpower_periodic(struct iwl_priv *priv)
 
  reschedule:
         queue_delayed_work(priv->workqueue,
-                           &priv->thermal_periodic, REG_RECALIB_PERIOD * HZ);
+                           &priv->_3945.thermal_periodic, REG_RECALIB_PERIOD * HZ);
 }
 
 static void iwl3945_bg_reg_txpower_periodic(struct work_struct *work)
 {
         struct iwl_priv *priv = container_of(work, struct iwl_priv,
-                                             thermal_periodic.work);
+                                             _3945.thermal_periodic.work);
 
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
@@ -2139,7 +2081,7 @@ static void iwl3945_hw_reg_init_channel_groups(struct iwl_priv *priv)
                  *   power peaks, without too much distortion (clipping).
                  */
                 /* we'll fill in this array with h/w max power levels */
-                clip_pwrs = (s8 *) priv->clip39_groups[i].clip_powers;
+                clip_pwrs = (s8 *) priv->_3945.clip_groups[i].clip_powers;
 
                 /* divide factory saturation power by 2 to find -3dB level */
                 satur_pwr = (s8) (group->saturation_power >> 1);
@@ -2223,7 +2165,7 @@ int iwl3945_txpower_set_from_eeprom(struct iwl_priv *priv)
                         iwl3945_hw_reg_get_ch_grp_index(priv, ch_info);
 
                 /* Get this chnlgrp's rate->max/clip-powers table */
-                clip_pwrs = priv->clip39_groups[ch_info->group_index].clip_powers;
+                clip_pwrs = priv->_3945.clip_groups[ch_info->group_index].clip_powers;
 
                 /* calculate power index *adjustment* value according to
                  *  diff between current temperature and factory temperature */
@@ -2331,7 +2273,7 @@ int iwl3945_hw_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq)
 {
         int txq_id = txq->q.id;
 
-        struct iwl3945_shared *shared_data = priv->shared_virt;
+        struct iwl3945_shared *shared_data = priv->_3945.shared_virt;
 
         shared_data->tx_base_ptr[txq_id] = cpu_to_le32((u32)txq->q.dma_addr);
 
@@ -2431,7 +2373,7 @@ int iwl3945_init_hw_rate_table(struct iwl_priv *priv)
                 /* If an OFDM rate is used, have it fall back to the
                  * 1M CCK rates */
 
-                if (!(priv->sta_supp_rates & IWL_OFDM_RATES_MASK) &&
+                if (!(priv->_3945.sta_supp_rates & IWL_OFDM_RATES_MASK) &&
                     iwl_is_associated(priv)) {
 
                         index = IWL_FIRST_CCK_RATE;
@@ -2470,10 +2412,11 @@ int iwl3945_hw_set_hw_params(struct iwl_priv *priv)
         memset((void *)&priv->hw_params, 0,
                sizeof(struct iwl_hw_params));
 
-        priv->shared_virt = dma_alloc_coherent(&priv->pci_dev->dev,
-                                               sizeof(struct iwl3945_shared),
-                                               &priv->shared_phys, GFP_KERNEL);
-        if (!priv->shared_virt) {
+        priv->_3945.shared_virt =
+                dma_alloc_coherent(&priv->pci_dev->dev,
+                                   sizeof(struct iwl3945_shared),
+                                   &priv->_3945.shared_phys, GFP_KERNEL);
+        if (!priv->_3945.shared_virt) {
                 IWL_ERR(priv, "failed to allocate pci memory\n");
                 mutex_unlock(&priv->mutex);
                 return -ENOMEM;
@@ -2536,13 +2479,13 @@ void iwl3945_hw_rx_handler_setup(struct iwl_priv *priv)
 
 void iwl3945_hw_setup_deferred_work(struct iwl_priv *priv)
 {
-        INIT_DELAYED_WORK(&priv->thermal_periodic,
+        INIT_DELAYED_WORK(&priv->_3945.thermal_periodic,
                           iwl3945_bg_reg_txpower_periodic);
 }
 
 void iwl3945_hw_cancel_deferred_work(struct iwl_priv *priv)
 {
-        cancel_delayed_work(&priv->thermal_periodic);
+        cancel_delayed_work(&priv->_3945.thermal_periodic);
 }
 
 /* check contents of special bootstrap uCode SRAM */
@@ -2826,6 +2769,7 @@ static struct iwl_cfg iwl3945_bg_cfg = {
         .led_compensation = 64,
         .broken_powersave = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
 };
 
 static struct iwl_cfg iwl3945_abg_cfg = {
@@ -2844,6 +2788,7 @@ static struct iwl_cfg iwl3945_abg_cfg = {
         .led_compensation = 64,
         .broken_powersave = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
 };
 
 DEFINE_PCI_DEVICE_TABLE(iwl3945_hw_card_ids) = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.h b/drivers/net/wireless/iwlwifi/iwl-3945.h
index 452dfd5456c6..b89219573b91 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.h
@@ -95,7 +95,6 @@ struct iwl3945_rs_sta {
         u8 tgg;
         u8 flush_pending;
         u8 start_rate;
-        u8 ibss_sta_added;
         struct timer_list rate_scale_flush;
         struct iwl3945_rate_scale_data win[IWL_RATE_COUNT_3945];
 #ifdef CONFIG_MAC80211_DEBUGFS
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965-hw.h b/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
index 67ef562e8db1..cd4b61ae25b7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
@@ -81,26 +81,6 @@
  */
 #define IWL49_FIRST_AMPDU_QUEUE 7
 
-/* Time constants */
-#define SHORT_SLOT_TIME 9
-#define LONG_SLOT_TIME 20
-
-/* RSSI to dBm */
-#define IWL49_RSSI_OFFSET       44
-
-
-/* PCI registers */
-#define PCI_CFG_RETRY_TIMEOUT   0x041
-
-/* PCI register values */
-#define PCI_CFG_LINK_CTRL_VAL_L0S_EN    0x01
-#define PCI_CFG_LINK_CTRL_VAL_L1_EN     0x02
-
-#define IWL_NUM_SCAN_RATES         (2)
-
-#define IWL_DEFAULT_TX_RETRY  15
-
-
 /* Sizes and addresses for instruction and data memory (SRAM) in
  * 4965's embedded processor.  Driver access is via HBUS_TARG_MEM_* regs. */
 #define IWL49_RTC_INST_LOWER_BOUND              (0x000000)
@@ -393,10 +373,6 @@ static inline int iwl4965_hw_valid_rtc_data_addr(u32 addr)
  *     location(s) in command (struct iwl4965_txpowertable_cmd).
  */
 
-/* Limit range of txpower output target to be between these values */
-#define IWL_TX_POWER_TARGET_POWER_MIN       (0) /* 0 dBm = 1 milliwatt */
-#define IWL_TX_POWER_TARGET_POWER_MAX      (16) /* 16 dBm */
-
 /**
  * When MIMO is used (2 transmitters operating simultaneously), driver should
  * limit each transmitter to deliver a max of 3 dB below the regulatory limit
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index 83c52a682622..6edae9b83bb7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -46,6 +46,7 @@
 #include "iwl-calib.h"
 #include "iwl-sta.h"
 #include "iwl-agn-led.h"
+#include "iwl-agn.h"
 
 static int iwl4965_send_tx_power(struct iwl_priv *priv);
 static int iwl4965_hw_get_temperature(struct iwl_priv *priv);
@@ -60,14 +61,6 @@ static int iwl4965_hw_get_temperature(struct iwl_priv *priv);
 #define _IWL4965_MODULE_FIRMWARE(api) IWL4965_FW_PRE #api ".ucode"
 #define IWL4965_MODULE_FIRMWARE(api) _IWL4965_MODULE_FIRMWARE(api)
 
-
-/* module parameters */
-static struct iwl_mod_params iwl4965_mod_params = {
-        .amsdu_size_8K = 1,
-        .restart_fw = 1,
-        /* the rest are 0 by default */
-};
-
 /* check contents of special bootstrap uCode SRAM */
 static int iwl4965_verify_bsm(struct iwl_priv *priv)
 {
@@ -417,7 +410,7 @@ static void iwl4965_gain_computation(struct iwl_priv *priv,
                                       sizeof(cmd), &cmd);
                 if (ret)
                         IWL_DEBUG_CALIB(priv, "fail sending cmd "
-                                     "REPLY_PHY_CALIBRATION_CMD \n");
+                                     "REPLY_PHY_CALIBRATION_CMD\n");
 
                 /* TODO we might want recalculate
                  * rx_chain in rxon cmd */
@@ -502,14 +495,14 @@ static void iwl4965_tx_queue_set_status(struct iwl_priv *priv,
                        scd_retry ? "BA" : "AC", txq_id, tx_fifo_id);
 }
 
-static const u16 default_queue_to_tx_fifo[] = {
-        IWL_TX_FIFO_AC3,
-        IWL_TX_FIFO_AC2,
-        IWL_TX_FIFO_AC1,
-        IWL_TX_FIFO_AC0,
+static const s8 default_queue_to_tx_fifo[] = {
+        IWL_TX_FIFO_VO,
+        IWL_TX_FIFO_VI,
+        IWL_TX_FIFO_BE,
+        IWL_TX_FIFO_BK,
         IWL49_CMD_FIFO_NUM,
-        IWL_TX_FIFO_HCCA_1,
-        IWL_TX_FIFO_HCCA_2
+        IWL_TX_FIFO_UNUSED,
+        IWL_TX_FIFO_UNUSED,
 };
 
 static int iwl4965_alive_notify(struct iwl_priv *priv)
@@ -589,9 +582,15 @@ static int iwl4965_alive_notify(struct iwl_priv *priv)
         /* reset to 0 to enable all the queue first */
         priv->txq_ctx_active_msk = 0;
         /* Map each Tx/cmd queue to its corresponding fifo */
+        BUILD_BUG_ON(ARRAY_SIZE(default_queue_to_tx_fifo) != 7);
         for (i = 0; i < ARRAY_SIZE(default_queue_to_tx_fifo); i++) {
                 int ac = default_queue_to_tx_fifo[i];
+
                 iwl_txq_ctx_activate(priv, i);
+
+                if (ac == IWL_TX_FIFO_UNUSED)
+                        continue;
+
                 iwl4965_tx_queue_set_status(priv, &priv->txq[i], ac, 0);
         }
 
@@ -1613,19 +1612,19 @@ static int iwl4965_is_temp_calib_needed(struct iwl_priv *priv)
 
         /* get absolute value */
         if (temp_diff < 0) {
-                IWL_DEBUG_POWER(priv, "Getting cooler, delta %d, \n", temp_diff);
+                IWL_DEBUG_POWER(priv, "Getting cooler, delta %d\n", temp_diff);
                 temp_diff = -temp_diff;
         } else if (temp_diff == 0)
-                IWL_DEBUG_POWER(priv, "Same temp, \n");
+                IWL_DEBUG_POWER(priv, "Temperature unchanged\n");
         else
-                IWL_DEBUG_POWER(priv, "Getting warmer, delta %d, \n", temp_diff);
+                IWL_DEBUG_POWER(priv, "Getting warmer, delta %d\n", temp_diff);
 
         if (temp_diff < IWL_TEMPERATURE_THRESHOLD) {
-                IWL_DEBUG_POWER(priv, "Thermal txpower calib not needed\n");
+                IWL_DEBUG_POWER(priv, " => thermal txpower calib not needed\n");
                 return 0;
         }
 
-        IWL_DEBUG_POWER(priv, "Thermal txpower calib needed\n");
+        IWL_DEBUG_POWER(priv, " => thermal txpower calib needed\n");
 
         return 1;
 }
@@ -1874,7 +1873,7 @@ static int iwl4965_tx_status_reply_tx(struct iwl_priv *priv,
                 info->status.rates[0].count = tx_resp->failure_frame + 1;
                 info->flags &= ~IEEE80211_TX_CTL_AMPDU;
                 info->flags |= iwl_tx_status_to_mac80211(status);
-                iwl_hwrate_to_tx_control(priv, rate_n_flags, info);
+                iwlagn_hwrate_to_tx_control(priv, rate_n_flags, info);
                 /* FIXME: code repetition end */
 
                 IWL_DEBUG_TX_REPLY(priv, "1 Frame 0x%x failure :%d\n",
@@ -2014,7 +2013,7 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
                         index = iwl_queue_dec_wrap(scd_ssn & 0xff, txq->q.n_bd);
                         IWL_DEBUG_TX_REPLY(priv, "Retry scheduler reclaim scd_ssn "
                                            "%d index %d\n", scd_ssn , index);
-                        freed = iwl_tx_queue_reclaim(priv, txq_id, index);
+                        freed = iwlagn_tx_queue_reclaim(priv, txq_id, index);
                         iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
 
                         if (priv->mac80211_registered &&
@@ -2029,7 +2028,7 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
         } else {
                 info->status.rates[0].count = tx_resp->failure_frame + 1;
                 info->flags |= iwl_tx_status_to_mac80211(status);
-                iwl_hwrate_to_tx_control(priv,
+                iwlagn_hwrate_to_tx_control(priv,
                                         le32_to_cpu(tx_resp->rate_n_flags),
                                         info);
 
@@ -2040,7 +2039,7 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
                                    le32_to_cpu(tx_resp->rate_n_flags),
                                    tx_resp->failure_frame);
 
-                freed = iwl_tx_queue_reclaim(priv, txq_id, index);
+                freed = iwlagn_tx_queue_reclaim(priv, txq_id, index);
                 iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
 
                 if (priv->mac80211_registered &&
@@ -2048,7 +2047,7 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
                         iwl_wake_queue(priv, txq_id);
         }
 
-        iwl_txq_check_empty(priv, sta_id, tid, txq_id);
+        iwlagn_txq_check_empty(priv, sta_id, tid, txq_id);
 
         if (iwl_check_bits(status, TX_ABORT_REQUIRED_MSK))
                 IWL_ERR(priv, "TODO:  Implement Tx ABORT REQUIRED!!!\n");
@@ -2085,7 +2084,7 @@ static int iwl4965_calc_rssi(struct iwl_priv *priv,
 
         /* dBm = max_rssi dB - agc dB - constant.
          * Higher AGC (higher radio gain) means lower signal. */
-        return max_rssi - agc - IWL49_RSSI_OFFSET;
+        return max_rssi - agc - IWLAGN_RSSI_OFFSET;
 }
 
 
@@ -2093,7 +2092,7 @@ static int iwl4965_calc_rssi(struct iwl_priv *priv,
 static void iwl4965_rx_handler_setup(struct iwl_priv *priv)
 {
         /* Legacy Rx frames */
-        priv->rx_handlers[REPLY_RX] = iwl_rx_reply_rx;
+        priv->rx_handlers[REPLY_RX] = iwlagn_rx_reply_rx;
         /* Tx response */
         priv->rx_handlers[REPLY_TX] = iwl4965_rx_reply_tx;
 }
@@ -2179,6 +2178,7 @@ static struct iwl_lib_ops iwl4965_lib = {
         .load_ucode = iwl4965_load_bsm,
         .dump_nic_event_log = iwl_dump_nic_event_log,
         .dump_nic_error_log = iwl_dump_nic_error_log,
+        .dump_fh = iwl_dump_fh,
         .set_channel_switch = iwl4965_hw_channel_switch,
         .apm_ops = {
                 .init = iwl_apm_init,
@@ -2212,6 +2212,7 @@ static struct iwl_lib_ops iwl4965_lib = {
                 .set_ct_kill = iwl4965_set_ct_threshold,
         },
         .add_bcast_station = iwl_add_bcast_station,
+        .check_plcp_health = iwl_good_plcp_health,
 };
 
 static const struct iwl_ops iwl4965_ops = {
@@ -2223,7 +2224,7 @@ static const struct iwl_ops iwl4965_ops = {
 };
 
 struct iwl_cfg iwl4965_agn_cfg = {
-        .name = "4965AGN",
+        .name = "Intel(R) Wireless WiFi Link 4965AGN",
         .fw_name_pre = IWL4965_FW_PRE,
         .ucode_api_max = IWL4965_UCODE_API_MAX,
         .ucode_api_min = IWL4965_UCODE_API_MIN,
@@ -2234,7 +2235,7 @@ struct iwl_cfg iwl4965_agn_cfg = {
         .ops = &iwl4965_ops,
         .num_of_queues = IWL49_NUM_QUEUES,
         .num_of_ampdu_queues = IWL49_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl4965_mod_params,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_ABC,
         .pll_cfg_val = 0,
@@ -2246,27 +2247,11 @@ struct iwl_cfg iwl4965_agn_cfg = {
         .led_compensation = 61,
         .chain_noise_num_beacons = IWL4965_CAL_NUM_BEACONS,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+        .temperature_kelvin = true,
+        .off_channel_workaround = true,
 };
 
 /* Module firmware */
 MODULE_FIRMWARE(IWL4965_MODULE_FIRMWARE(IWL4965_UCODE_API_MAX));
 
-module_param_named(antenna, iwl4965_mod_params.antenna, int, S_IRUGO);
-MODULE_PARM_DESC(antenna, "select antenna (1=Main, 2=Aux, default 0 [both])");
-module_param_named(swcrypto, iwl4965_mod_params.sw_crypto, int, S_IRUGO);
-MODULE_PARM_DESC(swcrypto, "using crypto in software (default 0 [hardware])");
-module_param_named(
-        disable_hw_scan, iwl4965_mod_params.disable_hw_scan, int, S_IRUGO);
-MODULE_PARM_DESC(disable_hw_scan, "disable hardware scanning (default 0)");
-
-module_param_named(queues_num, iwl4965_mod_params.num_of_queues, int, S_IRUGO);
-MODULE_PARM_DESC(queues_num, "number of hw queues.");
-/* 11n */
-module_param_named(11n_disable, iwl4965_mod_params.disable_11n, int, S_IRUGO);
-MODULE_PARM_DESC(11n_disable, "disable 11n functionality");
-module_param_named(amsdu_size_8K, iwl4965_mod_params.amsdu_size_8K,
-                   int, S_IRUGO);
-MODULE_PARM_DESC(amsdu_size_8K, "enable 8K amsdu size");
-
-module_param_named(fw_restart4965, iwl4965_mod_params.restart_fw, int, S_IRUGO);
-MODULE_PARM_DESC(fw_restart4965, "restart firmware in case of error");
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000-hw.h b/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
index 714e032f6217..146e6431ae95 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
@@ -68,25 +68,6 @@
 #ifndef __iwl_5000_hw_h__
 #define __iwl_5000_hw_h__
 
-#define IWL50_RTC_INST_LOWER_BOUND              (0x000000)
-#define IWL50_RTC_INST_UPPER_BOUND              (0x020000)
-
-#define IWL50_RTC_DATA_LOWER_BOUND              (0x800000)
-#define IWL50_RTC_DATA_UPPER_BOUND              (0x80C000)
-
-#define IWL50_RTC_INST_SIZE (IWL50_RTC_INST_UPPER_BOUND - \
-                                IWL50_RTC_INST_LOWER_BOUND)
-#define IWL50_RTC_DATA_SIZE (IWL50_RTC_DATA_UPPER_BOUND - \
-                                IWL50_RTC_DATA_LOWER_BOUND)
-
-/* EEPROM */
-#define IWL_5000_EEPROM_IMG_SIZE                        2048
-
-#define IWL50_CMD_FIFO_NUM                 7
-#define IWL50_NUM_QUEUES                  20
-#define IWL50_NUM_AMPDU_QUEUES            10
-#define IWL50_FIRST_AMPDU_QUEUE           10
-
 /* 5150 only */
 #define IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF   (-5)
 
@@ -103,19 +84,5 @@ static inline s32 iwl_temp_calib_to_offset(struct iwl_priv *priv)
         return (s32)(temperature - voltage / IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF);
 }
 
-/* Fixed (non-configurable) rx data from phy */
-
-/**
- * struct iwl5000_schedq_bc_tbl scheduler byte count table
- *      base physical address of iwl5000_shared
- *      is provided to SCD_DRAM_BASE_ADDR
- * @tfd_offset  0-12 - tx command byte count
- *             12-16 - station index
- */
-struct iwl5000_scd_bc_tbl {
-        __le16 tfd_offset[TFD_QUEUE_BC_SIZE];
-} __attribute__ ((packed));
-
-
 #endif /* __iwl_5000_hw_h__ */
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index e476acb53aa7..ecc302e4c205 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -19,6 +19,7 @@
  * file called LICENSE.
  *
  * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
  * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
  *
  *****************************************************************************/
@@ -43,9 +44,10 @@
 #include "iwl-io.h"
 #include "iwl-sta.h"
 #include "iwl-helpers.h"
+#include "iwl-agn.h"
 #include "iwl-agn-led.h"
+#include "iwl-agn-hw.h"
 #include "iwl-5000-hw.h"
-#include "iwl-6000-hw.h"
 
 /* Highest firmware API version supported */
 #define IWL5000_UCODE_API_MAX 2
@@ -63,18 +65,8 @@
 #define _IWL5150_MODULE_FIRMWARE(api) IWL5150_FW_PRE #api ".ucode"
 #define IWL5150_MODULE_FIRMWARE(api) _IWL5150_MODULE_FIRMWARE(api)
 
-static const u16 iwl5000_default_queue_to_tx_fifo[] = {
-        IWL_TX_FIFO_AC3,
-        IWL_TX_FIFO_AC2,
-        IWL_TX_FIFO_AC1,
-        IWL_TX_FIFO_AC0,
-        IWL50_CMD_FIFO_NUM,
-        IWL_TX_FIFO_HCCA_1,
-        IWL_TX_FIFO_HCCA_2
-};
-
 /* NIC configuration for 5000 series */
-void iwl5000_nic_config(struct iwl_priv *priv)
+static void iwl5000_nic_config(struct iwl_priv *priv)
 {
         unsigned long flags;
         u16 radio_cfg;
@@ -107,162 +99,6 @@ void iwl5000_nic_config(struct iwl_priv *priv)
         spin_unlock_irqrestore(&priv->lock, flags);
 }
 
-
-/*
- * EEPROM
- */
-static u32 eeprom_indirect_address(const struct iwl_priv *priv, u32 address)
-{
-        u16 offset = 0;
-
-        if ((address & INDIRECT_ADDRESS) == 0)
-                return address;
-
-        switch (address & INDIRECT_TYPE_MSK) {
-        case INDIRECT_HOST:
-                offset = iwl_eeprom_query16(priv, EEPROM_5000_LINK_HOST);
-                break;
-        case INDIRECT_GENERAL:
-                offset = iwl_eeprom_query16(priv, EEPROM_5000_LINK_GENERAL);
-                break;
-        case INDIRECT_REGULATORY:
-                offset = iwl_eeprom_query16(priv, EEPROM_5000_LINK_REGULATORY);
-                break;
-        case INDIRECT_CALIBRATION:
-                offset = iwl_eeprom_query16(priv, EEPROM_5000_LINK_CALIBRATION);
-                break;
-        case INDIRECT_PROCESS_ADJST:
-                offset = iwl_eeprom_query16(priv, EEPROM_5000_LINK_PROCESS_ADJST);
-                break;
-        case INDIRECT_OTHERS:
-                offset = iwl_eeprom_query16(priv, EEPROM_5000_LINK_OTHERS);
-                break;
-        default:
-                IWL_ERR(priv, "illegal indirect type: 0x%X\n",
-                address & INDIRECT_TYPE_MSK);
-                break;
-        }
-
-        /* translate the offset from words to byte */
-        return (address & ADDRESS_MSK) + (offset << 1);
-}
-
-u16 iwl5000_eeprom_calib_version(struct iwl_priv *priv)
-{
-        struct iwl_eeprom_calib_hdr {
-                u8 version;
-                u8 pa_type;
-                u16 voltage;
-        } *hdr;
-
-        hdr = (struct iwl_eeprom_calib_hdr *)iwl_eeprom_query_addr(priv,
-                                                        EEPROM_5000_CALIB_ALL);
-        return hdr->version;
-
-}
-
-static void iwl5000_gain_computation(struct iwl_priv *priv,
-                u32 average_noise[NUM_RX_CHAINS],
-                u16 min_average_noise_antenna_i,
-                u32 min_average_noise,
-                u8 default_chain)
-{
-        int i;
-        s32 delta_g;
-        struct iwl_chain_noise_data *data = &priv->chain_noise_data;
-
-        /*
-         * Find Gain Code for the chains based on "default chain"
-         */
-        for (i = default_chain + 1; i < NUM_RX_CHAINS; i++) {
-                if ((data->disconn_array[i])) {
-                        data->delta_gain_code[i] = 0;
-                        continue;
-                }
-
-                delta_g = (priv->cfg->chain_noise_scale *
-                        ((s32)average_noise[default_chain] -
-                        (s32)average_noise[i])) / 1500;
-
-                /* bound gain by 2 bits value max, 3rd bit is sign */
-                data->delta_gain_code[i] =
-                        min(abs(delta_g), (long) CHAIN_NOISE_MAX_DELTA_GAIN_CODE);
-
-                if (delta_g < 0)
-                        /*
-                         * set negative sign ...
-                         * note to Intel developers:  This is uCode API format,
-                         *   not the format of any internal device registers.
-                         *   Do not change this format for e.g. 6050 or similar
-                         *   devices.  Change format only if more resolution
-                         *   (i.e. more than 2 bits magnitude) is needed.
-                         */
-                        data->delta_gain_code[i] |= (1 << 2);
-        }
-
-        IWL_DEBUG_CALIB(priv, "Delta gains: ANT_B = %d  ANT_C = %d\n",
-                        data->delta_gain_code[1], data->delta_gain_code[2]);
-
-        if (!data->radio_write) {
-                struct iwl_calib_chain_noise_gain_cmd cmd;
-
-                memset(&cmd, 0, sizeof(cmd));
-
-                cmd.hdr.op_code = IWL_PHY_CALIBRATE_CHAIN_NOISE_GAIN_CMD;
-                cmd.hdr.first_group = 0;
-                cmd.hdr.groups_num = 1;
-                cmd.hdr.data_valid = 1;
-                cmd.delta_gain_1 = data->delta_gain_code[1];
-                cmd.delta_gain_2 = data->delta_gain_code[2];
-                iwl_send_cmd_pdu_async(priv, REPLY_PHY_CALIBRATION_CMD,
-                        sizeof(cmd), &cmd, NULL);
-
-                data->radio_write = 1;
-                data->state = IWL_CHAIN_NOISE_CALIBRATED;
-        }
-
-        data->chain_noise_a = 0;
-        data->chain_noise_b = 0;
-        data->chain_noise_c = 0;
-        data->chain_signal_a = 0;
-        data->chain_signal_b = 0;
-        data->chain_signal_c = 0;
-        data->beacon_count = 0;
-}
-
-static void iwl5000_chain_noise_reset(struct iwl_priv *priv)
-{
-        struct iwl_chain_noise_data *data = &priv->chain_noise_data;
-        int ret;
-
-        if ((data->state == IWL_CHAIN_NOISE_ALIVE) && iwl_is_associated(priv)) {
-                struct iwl_calib_chain_noise_reset_cmd cmd;
-                memset(&cmd, 0, sizeof(cmd));
-
-                cmd.hdr.op_code = IWL_PHY_CALIBRATE_CHAIN_NOISE_RESET_CMD;
-                cmd.hdr.first_group = 0;
-                cmd.hdr.groups_num = 1;
-                cmd.hdr.data_valid = 1;
-                ret = iwl_send_cmd_pdu(priv, REPLY_PHY_CALIBRATION_CMD,
-                                        sizeof(cmd), &cmd);
-                if (ret)
-                        IWL_ERR(priv,
-                                "Could not send REPLY_PHY_CALIBRATION_CMD\n");
-                data->state = IWL_CHAIN_NOISE_ACCUMULATE;
-                IWL_DEBUG_CALIB(priv, "Run chain_noise_calibrate\n");
-        }
-}
-
-void iwl5000_rts_tx_cmd_flag(struct ieee80211_tx_info *info,
-                        __le32 *tx_flags)
-{
-        if ((info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) ||
-            (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT))
-                *tx_flags |= TX_CMD_FLG_RTS_CTS_MSK;
-        else
-                *tx_flags &= ~TX_CMD_FLG_RTS_CTS_MSK;
-}
-
 static struct iwl_sensitivity_ranges iwl5000_sensitivity = {
         .min_nrg_cck = 95,
         .max_nrg_cck = 0, /* not used, set to 0 */
@@ -314,14 +150,6 @@ static struct iwl_sensitivity_ranges iwl5150_sensitivity = {
         .nrg_th_cca = 62,
 };
 
-const u8 *iwl5000_eeprom_query_addr(const struct iwl_priv *priv,
-                                           size_t offset)
-{
-        u32 address = eeprom_indirect_address(priv, offset);
-        BUG_ON(address >= priv->cfg->eeprom_size);
-        return &priv->eeprom[address];
-}
-
 static void iwl5150_set_ct_threshold(struct iwl_priv *priv)
 {
         const s32 volt2temp_coef = IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF;
@@ -337,356 +165,10 @@ static void iwl5000_set_ct_threshold(struct iwl_priv *priv)
         priv->hw_params.ct_kill_threshold = CT_KILL_THRESHOLD_LEGACY;
 }
 
-/*
- *  Calibration
- */
-static int iwl5000_set_Xtal_calib(struct iwl_priv *priv)
-{
-        struct iwl_calib_xtal_freq_cmd cmd;
-        __le16 *xtal_calib =
-                (__le16 *)iwl_eeprom_query_addr(priv, EEPROM_5000_XTAL);
-
-        cmd.hdr.op_code = IWL_PHY_CALIBRATE_CRYSTAL_FRQ_CMD;
-        cmd.hdr.first_group = 0;
-        cmd.hdr.groups_num = 1;
-        cmd.hdr.data_valid = 1;
-        cmd.cap_pin1 = le16_to_cpu(xtal_calib[0]);
-        cmd.cap_pin2 = le16_to_cpu(xtal_calib[1]);
-        return iwl_calib_set(&priv->calib_results[IWL_CALIB_XTAL],
-                             (u8 *)&cmd, sizeof(cmd));
-}
-
-static int iwl5000_send_calib_cfg(struct iwl_priv *priv)
-{
-        struct iwl_calib_cfg_cmd calib_cfg_cmd;
-        struct iwl_host_cmd cmd = {
-                .id = CALIBRATION_CFG_CMD,
-                .len = sizeof(struct iwl_calib_cfg_cmd),
-                .data = &calib_cfg_cmd,
-        };
-
-        memset(&calib_cfg_cmd, 0, sizeof(calib_cfg_cmd));
-        calib_cfg_cmd.ucd_calib_cfg.once.is_enable = IWL_CALIB_INIT_CFG_ALL;
-        calib_cfg_cmd.ucd_calib_cfg.once.start = IWL_CALIB_INIT_CFG_ALL;
-        calib_cfg_cmd.ucd_calib_cfg.once.send_res = IWL_CALIB_INIT_CFG_ALL;
-        calib_cfg_cmd.ucd_calib_cfg.flags = IWL_CALIB_INIT_CFG_ALL;
-
-        return iwl_send_cmd(priv, &cmd);
-}
-
-static void iwl5000_rx_calib_result(struct iwl_priv *priv,
-                             struct iwl_rx_mem_buffer *rxb)
-{
-        struct iwl_rx_packet *pkt = rxb_addr(rxb);
-        struct iwl_calib_hdr *hdr = (struct iwl_calib_hdr *)pkt->u.raw;
-        int len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
-        int index;
-
-        /* reduce the size of the length field itself */
-        len -= 4;
-
-        /* Define the order in which the results will be sent to the runtime
-         * uCode. iwl_send_calib_results sends them in a row according to their
-         * index. We sort them here */
-        switch (hdr->op_code) {
-        case IWL_PHY_CALIBRATE_DC_CMD:
-                index = IWL_CALIB_DC;
-                break;
-        case IWL_PHY_CALIBRATE_LO_CMD:
-                index = IWL_CALIB_LO;
-                break;
-        case IWL_PHY_CALIBRATE_TX_IQ_CMD:
-                index = IWL_CALIB_TX_IQ;
-                break;
-        case IWL_PHY_CALIBRATE_TX_IQ_PERD_CMD:
-                index = IWL_CALIB_TX_IQ_PERD;
-                break;
-        case IWL_PHY_CALIBRATE_BASE_BAND_CMD:
-                index = IWL_CALIB_BASE_BAND;
-                break;
-        default:
-                IWL_ERR(priv, "Unknown calibration notification %d\n",
-                          hdr->op_code);
-                return;
-        }
-        iwl_calib_set(&priv->calib_results[index], pkt->u.raw, len);
-}
-
-static void iwl5000_rx_calib_complete(struct iwl_priv *priv,
-                               struct iwl_rx_mem_buffer *rxb)
-{
-        IWL_DEBUG_INFO(priv, "Init. calibration is completed, restarting fw.\n");
-        queue_work(priv->workqueue, &priv->restart);
-}
-
-/*
- * ucode
- */
-static int iwl5000_load_section(struct iwl_priv *priv, const char *name,
-                                struct fw_desc *image, u32 dst_addr)
-{
-        dma_addr_t phy_addr = image->p_addr;
-        u32 byte_cnt = image->len;
-        int ret;
-
-        priv->ucode_write_complete = 0;
-
-        iwl_write_direct32(priv,
-                FH_TCSR_CHNL_TX_CONFIG_REG(FH_SRVC_CHNL),
-                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_PAUSE);
-
-        iwl_write_direct32(priv,
-                FH_SRVC_CHNL_SRAM_ADDR_REG(FH_SRVC_CHNL), dst_addr);
-
-        iwl_write_direct32(priv,
-                FH_TFDIB_CTRL0_REG(FH_SRVC_CHNL),
-                phy_addr & FH_MEM_TFDIB_DRAM_ADDR_LSB_MSK);
-
-        iwl_write_direct32(priv,
-                FH_TFDIB_CTRL1_REG(FH_SRVC_CHNL),
-                (iwl_get_dma_hi_addr(phy_addr)
-                        << FH_MEM_TFDIB_REG1_ADDR_BITSHIFT) | byte_cnt);
-
-        iwl_write_direct32(priv,
-                FH_TCSR_CHNL_TX_BUF_STS_REG(FH_SRVC_CHNL),
-                1 << FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_NUM |
-                1 << FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_IDX |
-                FH_TCSR_CHNL_TX_BUF_STS_REG_VAL_TFDB_VALID);
-
-        iwl_write_direct32(priv,
-                FH_TCSR_CHNL_TX_CONFIG_REG(FH_SRVC_CHNL),
-                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE       |
-                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_DISABLE    |
-                FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_HOST_ENDTFD);
-
-        IWL_DEBUG_INFO(priv, "%s uCode section being loaded...\n", name);
-        ret = wait_event_interruptible_timeout(priv->wait_command_queue,
-                                        priv->ucode_write_complete, 5 * HZ);
-        if (ret == -ERESTARTSYS) {
-                IWL_ERR(priv, "Could not load the %s uCode section due "
-                        "to interrupt\n", name);
-                return ret;
-        }
-        if (!ret) {
-                IWL_ERR(priv, "Could not load the %s uCode section\n",
-                        name);
-                return -ETIMEDOUT;
-        }
-
-        return 0;
-}
-
-static int iwl5000_load_given_ucode(struct iwl_priv *priv,
-                struct fw_desc *inst_image,
-                struct fw_desc *data_image)
-{
-        int ret = 0;
-
-        ret = iwl5000_load_section(priv, "INST", inst_image,
-                                   IWL50_RTC_INST_LOWER_BOUND);
-        if (ret)
-                return ret;
-
-        return iwl5000_load_section(priv, "DATA", data_image,
-                                    IWL50_RTC_DATA_LOWER_BOUND);
-}
-
-int iwl5000_load_ucode(struct iwl_priv *priv)
-{
-        int ret = 0;
-
-        /* check whether init ucode should be loaded, or rather runtime ucode */
-        if (priv->ucode_init.len && (priv->ucode_type == UCODE_NONE)) {
-                IWL_DEBUG_INFO(priv, "Init ucode found. Loading init ucode...\n");
-                ret = iwl5000_load_given_ucode(priv,
-                        &priv->ucode_init, &priv->ucode_init_data);
-                if (!ret) {
-                        IWL_DEBUG_INFO(priv, "Init ucode load complete.\n");
-                        priv->ucode_type = UCODE_INIT;
-                }
-        } else {
-                IWL_DEBUG_INFO(priv, "Init ucode not found, or already loaded. "
-                        "Loading runtime ucode...\n");
-                ret = iwl5000_load_given_ucode(priv,
-                        &priv->ucode_code, &priv->ucode_data);
-                if (!ret) {
-                        IWL_DEBUG_INFO(priv, "Runtime ucode load complete.\n");
-                        priv->ucode_type = UCODE_RT;
-                }
-        }
-
-        return ret;
-}
-
-void iwl5000_init_alive_start(struct iwl_priv *priv)
-{
-        int ret = 0;
-
-        /* Check alive response for "valid" sign from uCode */
-        if (priv->card_alive_init.is_valid != UCODE_VALID_OK) {
-                /* We had an error bringing up the hardware, so take it
-                 * all the way back down so we can try again */
-                IWL_DEBUG_INFO(priv, "Initialize Alive failed.\n");
-                goto restart;
-        }
-
-        /* initialize uCode was loaded... verify inst image.
-         * This is a paranoid check, because we would not have gotten the
-         * "initialize" alive if code weren't properly loaded.  */
-        if (iwl_verify_ucode(priv)) {
-                /* Runtime instruction load was bad;
-                 * take it all the way back down so we can try again */
-                IWL_DEBUG_INFO(priv, "Bad \"initialize\" uCode load.\n");
-                goto restart;
-        }
-
-        iwl_clear_stations_table(priv);
-        ret = priv->cfg->ops->lib->alive_notify(priv);
-        if (ret) {
-                IWL_WARN(priv,
-                        "Could not complete ALIVE transition: %d\n", ret);
-                goto restart;
-        }
-
-        iwl5000_send_calib_cfg(priv);
-        return;
-
-restart:
-        /* real restart (first load init_ucode) */
-        queue_work(priv->workqueue, &priv->restart);
-}
-
-static void iwl5000_set_wr_ptrs(struct iwl_priv *priv,
-                                int txq_id, u32 index)
-{
-        iwl_write_direct32(priv, HBUS_TARG_WRPTR,
-                        (index & 0xff) | (txq_id << 8));
-        iwl_write_prph(priv, IWL50_SCD_QUEUE_RDPTR(txq_id), index);
-}
-
-static void iwl5000_tx_queue_set_status(struct iwl_priv *priv,
-                                        struct iwl_tx_queue *txq,
-                                        int tx_fifo_id, int scd_retry)
-{
-        int txq_id = txq->q.id;
-        int active = test_bit(txq_id, &priv->txq_ctx_active_msk) ? 1 : 0;
-
-        iwl_write_prph(priv, IWL50_SCD_QUEUE_STATUS_BITS(txq_id),
-                        (active << IWL50_SCD_QUEUE_STTS_REG_POS_ACTIVE) |
-                        (tx_fifo_id << IWL50_SCD_QUEUE_STTS_REG_POS_TXF) |
-                        (1 << IWL50_SCD_QUEUE_STTS_REG_POS_WSL) |
-                        IWL50_SCD_QUEUE_STTS_REG_MSK);
-
-        txq->sched_retry = scd_retry;
-
-        IWL_DEBUG_INFO(priv, "%s %s Queue %d on AC %d\n",
-                       active ? "Activate" : "Deactivate",
-                       scd_retry ? "BA" : "AC", txq_id, tx_fifo_id);
-}
-
-int iwl5000_alive_notify(struct iwl_priv *priv)
-{
-        u32 a;
-        unsigned long flags;
-        int i, chan;
-        u32 reg_val;
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        priv->scd_base_addr = iwl_read_prph(priv, IWL50_SCD_SRAM_BASE_ADDR);
-        a = priv->scd_base_addr + IWL50_SCD_CONTEXT_DATA_OFFSET;
-        for (; a < priv->scd_base_addr + IWL50_SCD_TX_STTS_BITMAP_OFFSET;
-                a += 4)
-                iwl_write_targ_mem(priv, a, 0);
-        for (; a < priv->scd_base_addr + IWL50_SCD_TRANSLATE_TBL_OFFSET;
-                a += 4)
-                iwl_write_targ_mem(priv, a, 0);
-        for (; a < priv->scd_base_addr +
-               IWL50_SCD_TRANSLATE_TBL_OFFSET_QUEUE(priv->hw_params.max_txq_num); a += 4)
-                iwl_write_targ_mem(priv, a, 0);
-
-        iwl_write_prph(priv, IWL50_SCD_DRAM_BASE_ADDR,
-                       priv->scd_bc_tbls.dma >> 10);
-
-        /* Enable DMA channel */
-        for (chan = 0; chan < FH50_TCSR_CHNL_NUM ; chan++)
-                iwl_write_direct32(priv, FH_TCSR_CHNL_TX_CONFIG_REG(chan),
-                                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE |
-                                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_ENABLE);
-
-        /* Update FH chicken bits */
-        reg_val = iwl_read_direct32(priv, FH_TX_CHICKEN_BITS_REG);
-        iwl_write_direct32(priv, FH_TX_CHICKEN_BITS_REG,
-                           reg_val | FH_TX_CHICKEN_BITS_SCD_AUTO_RETRY_EN);
-
-        iwl_write_prph(priv, IWL50_SCD_QUEUECHAIN_SEL,
-                IWL50_SCD_QUEUECHAIN_SEL_ALL(priv->hw_params.max_txq_num));
-        iwl_write_prph(priv, IWL50_SCD_AGGR_SEL, 0);
-
-        /* initiate the queues */
-        for (i = 0; i < priv->hw_params.max_txq_num; i++) {
-                iwl_write_prph(priv, IWL50_SCD_QUEUE_RDPTR(i), 0);
-                iwl_write_direct32(priv, HBUS_TARG_WRPTR, 0 | (i << 8));
-                iwl_write_targ_mem(priv, priv->scd_base_addr +
-                                IWL50_SCD_CONTEXT_QUEUE_OFFSET(i), 0);
-                iwl_write_targ_mem(priv, priv->scd_base_addr +
-                                IWL50_SCD_CONTEXT_QUEUE_OFFSET(i) +
-                                sizeof(u32),
-                                ((SCD_WIN_SIZE <<
-                                IWL50_SCD_QUEUE_CTX_REG2_WIN_SIZE_POS) &
-                                IWL50_SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK) |
-                                ((SCD_FRAME_LIMIT <<
-                                IWL50_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS) &
-                                IWL50_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK));
-        }
-
-        iwl_write_prph(priv, IWL50_SCD_INTERRUPT_MASK,
-                        IWL_MASK(0, priv->hw_params.max_txq_num));
-
-        /* Activate all Tx DMA/FIFO channels */
-        priv->cfg->ops->lib->txq_set_sched(priv, IWL_MASK(0, 7));
-
-        iwl5000_set_wr_ptrs(priv, IWL_CMD_QUEUE_NUM, 0);
-
-        /* make sure all queue are not stopped */
-        memset(&priv->queue_stopped[0], 0, sizeof(priv->queue_stopped));
-        for (i = 0; i < 4; i++)
-                atomic_set(&priv->queue_stop_count[i], 0);
-
-        /* reset to 0 to enable all the queue first */
-        priv->txq_ctx_active_msk = 0;
-        /* map qos queues to fifos one-to-one */
-        for (i = 0; i < ARRAY_SIZE(iwl5000_default_queue_to_tx_fifo); i++) {
-                int ac = iwl5000_default_queue_to_tx_fifo[i];
-                iwl_txq_ctx_activate(priv, i);
-                iwl5000_tx_queue_set_status(priv, &priv->txq[i], ac, 0);
-        }
-
-        /*
-         * TODO - need to initialize these queues and map them to FIFOs
-         * in the loop above, not only mark them as active. We do this
-         * because we want the first aggregation queue to be queue #10,
-         * but do not use 8 or 9 otherwise yet.
-         */
-        iwl_txq_ctx_activate(priv, 7);
-        iwl_txq_ctx_activate(priv, 8);
-        iwl_txq_ctx_activate(priv, 9);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-
-        iwl_send_wimax_coex(priv);
-
-        iwl5000_set_Xtal_calib(priv);
-        iwl_send_calib_results(priv);
-
-        return 0;
-}
-
-int iwl5000_hw_set_hw_params(struct iwl_priv *priv)
+static int iwl5000_hw_set_hw_params(struct iwl_priv *priv)
 {
         if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
-            priv->cfg->mod_params->num_of_queues <= IWL50_NUM_QUEUES)
+            priv->cfg->mod_params->num_of_queues <= IWLAGN_NUM_QUEUES)
                 priv->cfg->num_of_queues =
                         priv->cfg->mod_params->num_of_queues;
 
@@ -694,13 +176,13 @@ int iwl5000_hw_set_hw_params(struct iwl_priv *priv)
         priv->hw_params.dma_chnl_num = FH50_TCSR_CHNL_NUM;
         priv->hw_params.scd_bc_tbls_size =
                         priv->cfg->num_of_queues *
-                        sizeof(struct iwl5000_scd_bc_tbl);
+                        sizeof(struct iwlagn_scd_bc_tbl);
         priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
         priv->hw_params.max_stations = IWL5000_STATION_COUNT;
         priv->hw_params.bcast_sta_id = IWL5000_BROADCAST_ID;
 
-        priv->hw_params.max_data_size = IWL50_RTC_DATA_SIZE;
-        priv->hw_params.max_inst_size = IWL50_RTC_INST_SIZE;
+        priv->hw_params.max_data_size = IWLAGN_RTC_DATA_SIZE;
+        priv->hw_params.max_inst_size = IWLAGN_RTC_INST_SIZE;
 
         priv->hw_params.max_bsm_size = 0;
         priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ) |
@@ -741,547 +223,6 @@ int iwl5000_hw_set_hw_params(struct iwl_priv *priv)
         return 0;
 }
 
-/**
- * iwl5000_txq_update_byte_cnt_tbl - Set up entry in Tx byte-count array
- */
-void iwl5000_txq_update_byte_cnt_tbl(struct iwl_priv *priv,
-                                            struct iwl_tx_queue *txq,
-                                            u16 byte_cnt)
-{
-        struct iwl5000_scd_bc_tbl *scd_bc_tbl = priv->scd_bc_tbls.addr;
-        int write_ptr = txq->q.write_ptr;
-        int txq_id = txq->q.id;
-        u8 sec_ctl = 0;
-        u8 sta_id = 0;
-        u16 len = byte_cnt + IWL_TX_CRC_SIZE + IWL_TX_DELIMITER_SIZE;
-        __le16 bc_ent;
-
-        WARN_ON(len > 0xFFF || write_ptr >= TFD_QUEUE_SIZE_MAX);
-
-        if (txq_id != IWL_CMD_QUEUE_NUM) {
-                sta_id = txq->cmd[txq->q.write_ptr]->cmd.tx.sta_id;
-                sec_ctl = txq->cmd[txq->q.write_ptr]->cmd.tx.sec_ctl;
-
-                switch (sec_ctl & TX_CMD_SEC_MSK) {
-                case TX_CMD_SEC_CCM:
-                        len += CCMP_MIC_LEN;
-                        break;
-                case TX_CMD_SEC_TKIP:
-                        len += TKIP_ICV_LEN;
-                        break;
-                case TX_CMD_SEC_WEP:
-                        len += WEP_IV_LEN + WEP_ICV_LEN;
-                        break;
-                }
-        }
-
-        bc_ent = cpu_to_le16((len & 0xFFF) | (sta_id << 12));
-
-        scd_bc_tbl[txq_id].tfd_offset[write_ptr] = bc_ent;
-
-        if (write_ptr < TFD_QUEUE_SIZE_BC_DUP)
-                scd_bc_tbl[txq_id].
-                        tfd_offset[TFD_QUEUE_SIZE_MAX + write_ptr] = bc_ent;
-}
-
-void iwl5000_txq_inval_byte_cnt_tbl(struct iwl_priv *priv,
-                                           struct iwl_tx_queue *txq)
-{
-        struct iwl5000_scd_bc_tbl *scd_bc_tbl = priv->scd_bc_tbls.addr;
-        int txq_id = txq->q.id;
-        int read_ptr = txq->q.read_ptr;
-        u8 sta_id = 0;
-        __le16 bc_ent;
-
-        WARN_ON(read_ptr >= TFD_QUEUE_SIZE_MAX);
-
-        if (txq_id != IWL_CMD_QUEUE_NUM)
-                sta_id = txq->cmd[read_ptr]->cmd.tx.sta_id;
-
-        bc_ent = cpu_to_le16(1 | (sta_id << 12));
-        scd_bc_tbl[txq_id].tfd_offset[read_ptr] = bc_ent;
-
-        if (read_ptr < TFD_QUEUE_SIZE_BC_DUP)
-                scd_bc_tbl[txq_id].
-                        tfd_offset[TFD_QUEUE_SIZE_MAX + read_ptr] = bc_ent;
-}
-
-static int iwl5000_tx_queue_set_q2ratid(struct iwl_priv *priv, u16 ra_tid,
-                                        u16 txq_id)
-{
-        u32 tbl_dw_addr;
-        u32 tbl_dw;
-        u16 scd_q2ratid;
-
-        scd_q2ratid = ra_tid & IWL_SCD_QUEUE_RA_TID_MAP_RATID_MSK;
-
-        tbl_dw_addr = priv->scd_base_addr +
-                        IWL50_SCD_TRANSLATE_TBL_OFFSET_QUEUE(txq_id);
-
-        tbl_dw = iwl_read_targ_mem(priv, tbl_dw_addr);
-
-        if (txq_id & 0x1)
-                tbl_dw = (scd_q2ratid << 16) | (tbl_dw & 0x0000FFFF);
-        else
-                tbl_dw = scd_q2ratid | (tbl_dw & 0xFFFF0000);
-
-        iwl_write_targ_mem(priv, tbl_dw_addr, tbl_dw);
-
-        return 0;
-}
-static void iwl5000_tx_queue_stop_scheduler(struct iwl_priv *priv, u16 txq_id)
-{
-        /* Simply stop the queue, but don't change any configuration;
-         * the SCD_ACT_EN bit is the write-enable mask for the ACTIVE bit. */
-        iwl_write_prph(priv,
-                IWL50_SCD_QUEUE_STATUS_BITS(txq_id),
-                (0 << IWL50_SCD_QUEUE_STTS_REG_POS_ACTIVE)|
-                (1 << IWL50_SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN));
-}
-
-int iwl5000_txq_agg_enable(struct iwl_priv *priv, int txq_id,
-                                  int tx_fifo, int sta_id, int tid, u16 ssn_idx)
-{
-        unsigned long flags;
-        u16 ra_tid;
-
-        if ((IWL50_FIRST_AMPDU_QUEUE > txq_id) ||
-            (IWL50_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
-             <= txq_id)) {
-                IWL_WARN(priv,
-                        "queue number out of range: %d, must be %d to %d\n",
-                        txq_id, IWL50_FIRST_AMPDU_QUEUE,
-                        IWL50_FIRST_AMPDU_QUEUE +
-                        priv->cfg->num_of_ampdu_queues - 1);
-                return -EINVAL;
-        }
-
-        ra_tid = BUILD_RAxTID(sta_id, tid);
-
-        /* Modify device's station table to Tx this TID */
-        iwl_sta_tx_modify_enable_tid(priv, sta_id, tid);
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        /* Stop this Tx queue before configuring it */
-        iwl5000_tx_queue_stop_scheduler(priv, txq_id);
-
-        /* Map receiver-address / traffic-ID to this queue */
-        iwl5000_tx_queue_set_q2ratid(priv, ra_tid, txq_id);
-
-        /* Set this queue as a chain-building queue */
-        iwl_set_bits_prph(priv, IWL50_SCD_QUEUECHAIN_SEL, (1<<txq_id));
-
-        /* enable aggregations for the queue */
-        iwl_set_bits_prph(priv, IWL50_SCD_AGGR_SEL, (1<<txq_id));
-
-        /* Place first TFD at index corresponding to start sequence number.
-         * Assumes that ssn_idx is valid (!= 0xFFF) */
-        priv->txq[txq_id].q.read_ptr = (ssn_idx & 0xff);
-        priv->txq[txq_id].q.write_ptr = (ssn_idx & 0xff);
-        iwl5000_set_wr_ptrs(priv, txq_id, ssn_idx);
-
-        /* Set up Tx window size and frame limit for this queue */
-        iwl_write_targ_mem(priv, priv->scd_base_addr +
-                        IWL50_SCD_CONTEXT_QUEUE_OFFSET(txq_id) +
-                        sizeof(u32),
-                        ((SCD_WIN_SIZE <<
-                        IWL50_SCD_QUEUE_CTX_REG2_WIN_SIZE_POS) &
-                        IWL50_SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK) |
-                        ((SCD_FRAME_LIMIT <<
-                        IWL50_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS) &
-                        IWL50_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK));
-
-        iwl_set_bits_prph(priv, IWL50_SCD_INTERRUPT_MASK, (1 << txq_id));
-
-        /* Set up Status area in SRAM, map to Tx DMA/FIFO, activate the queue */
-        iwl5000_tx_queue_set_status(priv, &priv->txq[txq_id], tx_fifo, 1);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        return 0;
-}
-
-int iwl5000_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
-                                   u16 ssn_idx, u8 tx_fifo)
-{
-        if ((IWL50_FIRST_AMPDU_QUEUE > txq_id) ||
-            (IWL50_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
-             <= txq_id)) {
-                IWL_ERR(priv,
-                        "queue number out of range: %d, must be %d to %d\n",
-                        txq_id, IWL50_FIRST_AMPDU_QUEUE,
-                        IWL50_FIRST_AMPDU_QUEUE +
-                        priv->cfg->num_of_ampdu_queues - 1);
-                return -EINVAL;
-        }
-
-        iwl5000_tx_queue_stop_scheduler(priv, txq_id);
-
-        iwl_clear_bits_prph(priv, IWL50_SCD_AGGR_SEL, (1 << txq_id));
-
-        priv->txq[txq_id].q.read_ptr = (ssn_idx & 0xff);
-        priv->txq[txq_id].q.write_ptr = (ssn_idx & 0xff);
-        /* supposes that ssn_idx is valid (!= 0xFFF) */
-        iwl5000_set_wr_ptrs(priv, txq_id, ssn_idx);
-
-        iwl_clear_bits_prph(priv, IWL50_SCD_INTERRUPT_MASK, (1 << txq_id));
-        iwl_txq_ctx_deactivate(priv, txq_id);
-        iwl5000_tx_queue_set_status(priv, &priv->txq[txq_id], tx_fifo, 0);
-
-        return 0;
-}
-
-u16 iwl5000_build_addsta_hcmd(const struct iwl_addsta_cmd *cmd, u8 *data)
-{
-        u16 size = (u16)sizeof(struct iwl_addsta_cmd);
-        struct iwl_addsta_cmd *addsta = (struct iwl_addsta_cmd *)data;
-        memcpy(addsta, cmd, size);
-        /* resrved in 5000 */
-        addsta->rate_n_flags = cpu_to_le16(0);
-        return size;
-}
-
-
-/*
- * Activate/Deactivate Tx DMA/FIFO channels according tx fifos mask
- * must be called under priv->lock and mac access
- */
-void iwl5000_txq_set_sched(struct iwl_priv *priv, u32 mask)
-{
-        iwl_write_prph(priv, IWL50_SCD_TXFACT, mask);
-}
-
-
-static inline u32 iwl5000_get_scd_ssn(struct iwl5000_tx_resp *tx_resp)
-{
-        return le32_to_cpup((__le32 *)&tx_resp->status +
-                            tx_resp->frame_count) & MAX_SN;
-}
-
-static int iwl5000_tx_status_reply_tx(struct iwl_priv *priv,
-                                      struct iwl_ht_agg *agg,
-                                      struct iwl5000_tx_resp *tx_resp,
-                                      int txq_id, u16 start_idx)
-{
-        u16 status;
-        struct agg_tx_status *frame_status = &tx_resp->status;
-        struct ieee80211_tx_info *info = NULL;
-        struct ieee80211_hdr *hdr = NULL;
-        u32 rate_n_flags = le32_to_cpu(tx_resp->rate_n_flags);
-        int i, sh, idx;
-        u16 seq;
-
-        if (agg->wait_for_ba)
-                IWL_DEBUG_TX_REPLY(priv, "got tx response w/o block-ack\n");
-
-        agg->frame_count = tx_resp->frame_count;
-        agg->start_idx = start_idx;
-        agg->rate_n_flags = rate_n_flags;
-        agg->bitmap = 0;
-
-        /* # frames attempted by Tx command */
-        if (agg->frame_count == 1) {
-                /* Only one frame was attempted; no block-ack will arrive */
-                status = le16_to_cpu(frame_status[0].status);
-                idx = start_idx;
-
-                /* FIXME: code repetition */
-                IWL_DEBUG_TX_REPLY(priv, "FrameCnt = %d, StartIdx=%d idx=%d\n",
-                                   agg->frame_count, agg->start_idx, idx);
-
-                info = IEEE80211_SKB_CB(priv->txq[txq_id].txb[idx].skb[0]);
-                info->status.rates[0].count = tx_resp->failure_frame + 1;
-                info->flags &= ~IEEE80211_TX_CTL_AMPDU;
-                info->flags |= iwl_tx_status_to_mac80211(status);
-                iwl_hwrate_to_tx_control(priv, rate_n_flags, info);
-
-                /* FIXME: code repetition end */
-
-                IWL_DEBUG_TX_REPLY(priv, "1 Frame 0x%x failure :%d\n",
-                                    status & 0xff, tx_resp->failure_frame);
-                IWL_DEBUG_TX_REPLY(priv, "Rate Info rate_n_flags=%x\n", rate_n_flags);
-
-                agg->wait_for_ba = 0;
-        } else {
-                /* Two or more frames were attempted; expect block-ack */
-                u64 bitmap = 0;
-                int start = agg->start_idx;
-
-                /* Construct bit-map of pending frames within Tx window */
-                for (i = 0; i < agg->frame_count; i++) {
-                        u16 sc;
-                        status = le16_to_cpu(frame_status[i].status);
-                        seq  = le16_to_cpu(frame_status[i].sequence);
-                        idx = SEQ_TO_INDEX(seq);
-                        txq_id = SEQ_TO_QUEUE(seq);
-
-                        if (status & (AGG_TX_STATE_FEW_BYTES_MSK |
-                                      AGG_TX_STATE_ABORT_MSK))
-                                continue;
-
-                        IWL_DEBUG_TX_REPLY(priv, "FrameCnt = %d, txq_id=%d idx=%d\n",
-                                           agg->frame_count, txq_id, idx);
-
-                        hdr = iwl_tx_queue_get_hdr(priv, txq_id, idx);
-                        if (!hdr) {
-                                IWL_ERR(priv,
-                                        "BUG_ON idx doesn't point to valid skb"
-                                        " idx=%d, txq_id=%d\n", idx, txq_id);
-                                return -1;
-                        }
-
-                        sc = le16_to_cpu(hdr->seq_ctrl);
-                        if (idx != (SEQ_TO_SN(sc) & 0xff)) {
-                                IWL_ERR(priv,
-                                        "BUG_ON idx doesn't match seq control"
-                                        " idx=%d, seq_idx=%d, seq=%d\n",
-                                          idx, SEQ_TO_SN(sc),
-                                          hdr->seq_ctrl);
-                                return -1;
-                        }
-
-                        IWL_DEBUG_TX_REPLY(priv, "AGG Frame i=%d idx %d seq=%d\n",
-                                           i, idx, SEQ_TO_SN(sc));
-
-                        sh = idx - start;
-                        if (sh > 64) {
-                                sh = (start - idx) + 0xff;
-                                bitmap = bitmap << sh;
-                                sh = 0;
-                                start = idx;
-                        } else if (sh < -64)
-                                sh  = 0xff - (start - idx);
-                        else if (sh < 0) {
-                                sh = start - idx;
-                                start = idx;
-                                bitmap = bitmap << sh;
-                                sh = 0;
-                        }
-                        bitmap |= 1ULL << sh;
-                        IWL_DEBUG_TX_REPLY(priv, "start=%d bitmap=0x%llx\n",
-                                           start, (unsigned long long)bitmap);
-                }
-
-                agg->bitmap = bitmap;
-                agg->start_idx = start;
-                IWL_DEBUG_TX_REPLY(priv, "Frames %d start_idx=%d bitmap=0x%llx\n",
-                                   agg->frame_count, agg->start_idx,
-                                   (unsigned long long)agg->bitmap);
-
-                if (bitmap)
-                        agg->wait_for_ba = 1;
-        }
-        return 0;
-}
-
-static void iwl5000_rx_reply_tx(struct iwl_priv *priv,
-                                struct iwl_rx_mem_buffer *rxb)
-{
-        struct iwl_rx_packet *pkt = rxb_addr(rxb);
-        u16 sequence = le16_to_cpu(pkt->hdr.sequence);
-        int txq_id = SEQ_TO_QUEUE(sequence);
-        int index = SEQ_TO_INDEX(sequence);
-        struct iwl_tx_queue *txq = &priv->txq[txq_id];
-        struct ieee80211_tx_info *info;
-        struct iwl5000_tx_resp *tx_resp = (void *)&pkt->u.raw[0];
-        u32  status = le16_to_cpu(tx_resp->status.status);
-        int tid;
-        int sta_id;
-        int freed;
-
-        if ((index >= txq->q.n_bd) || (iwl_queue_used(&txq->q, index) == 0)) {
-                IWL_ERR(priv, "Read index for DMA queue txq_id (%d) index %d "
-                          "is out of range [0-%d] %d %d\n", txq_id,
-                          index, txq->q.n_bd, txq->q.write_ptr,
-                          txq->q.read_ptr);
-                return;
-        }
-
-        info = IEEE80211_SKB_CB(txq->txb[txq->q.read_ptr].skb[0]);
-        memset(&info->status, 0, sizeof(info->status));
-
-        tid = (tx_resp->ra_tid & IWL50_TX_RES_TID_MSK) >> IWL50_TX_RES_TID_POS;
-        sta_id = (tx_resp->ra_tid & IWL50_TX_RES_RA_MSK) >> IWL50_TX_RES_RA_POS;
-
-        if (txq->sched_retry) {
-                const u32 scd_ssn = iwl5000_get_scd_ssn(tx_resp);
-                struct iwl_ht_agg *agg = NULL;
-
-                agg = &priv->stations[sta_id].tid[tid].agg;
-
-                iwl5000_tx_status_reply_tx(priv, agg, tx_resp, txq_id, index);
-
-                /* check if BAR is needed */
-                if ((tx_resp->frame_count == 1) && !iwl_is_tx_success(status))
-                        info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
-
-                if (txq->q.read_ptr != (scd_ssn & 0xff)) {
-                        index = iwl_queue_dec_wrap(scd_ssn & 0xff, txq->q.n_bd);
-                        IWL_DEBUG_TX_REPLY(priv, "Retry scheduler reclaim "
-                                        "scd_ssn=%d idx=%d txq=%d swq=%d\n",
-                                        scd_ssn , index, txq_id, txq->swq_id);
-
-                        freed = iwl_tx_queue_reclaim(priv, txq_id, index);
-                        iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
-
-                        if (priv->mac80211_registered &&
-                            (iwl_queue_space(&txq->q) > txq->q.low_mark) &&
-                            (agg->state != IWL_EMPTYING_HW_QUEUE_DELBA)) {
-                                if (agg->state == IWL_AGG_OFF)
-                                        iwl_wake_queue(priv, txq_id);
-                                else
-                                        iwl_wake_queue(priv, txq->swq_id);
-                        }
-                }
-        } else {
-                BUG_ON(txq_id != txq->swq_id);
-
-                info->status.rates[0].count = tx_resp->failure_frame + 1;
-                info->flags |= iwl_tx_status_to_mac80211(status);
-                iwl_hwrate_to_tx_control(priv,
-                                        le32_to_cpu(tx_resp->rate_n_flags),
-                                        info);
-
-                IWL_DEBUG_TX_REPLY(priv, "TXQ %d status %s (0x%08x) rate_n_flags "
-                                   "0x%x retries %d\n",
-                                   txq_id,
-                                   iwl_get_tx_fail_reason(status), status,
-                                   le32_to_cpu(tx_resp->rate_n_flags),
-                                   tx_resp->failure_frame);
-
-                freed = iwl_tx_queue_reclaim(priv, txq_id, index);
-                iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
-
-                if (priv->mac80211_registered &&
-                    (iwl_queue_space(&txq->q) > txq->q.low_mark))
-                        iwl_wake_queue(priv, txq_id);
-        }
-
-        iwl_txq_check_empty(priv, sta_id, tid, txq_id);
-
-        if (iwl_check_bits(status, TX_ABORT_REQUIRED_MSK))
-                IWL_ERR(priv, "TODO:  Implement Tx ABORT REQUIRED!!!\n");
-}
-
-/* Currently 5000 is the superset of everything */
-u16 iwl5000_get_hcmd_size(u8 cmd_id, u16 len)
-{
-        return len;
-}
-
-void iwl5000_setup_deferred_work(struct iwl_priv *priv)
-{
-        /* in 5000 the tx power calibration is done in uCode */
-        priv->disable_tx_power_cal = 1;
-}
-
-void iwl5000_rx_handler_setup(struct iwl_priv *priv)
-{
-        /* init calibration handlers */
-        priv->rx_handlers[CALIBRATION_RES_NOTIFICATION] =
-                                        iwl5000_rx_calib_result;
-        priv->rx_handlers[CALIBRATION_COMPLETE_NOTIFICATION] =
-                                        iwl5000_rx_calib_complete;
-        priv->rx_handlers[REPLY_TX] = iwl5000_rx_reply_tx;
-}
-
-
-int iwl5000_hw_valid_rtc_data_addr(u32 addr)
-{
-        return (addr >= IWL50_RTC_DATA_LOWER_BOUND) &&
-                (addr < IWL50_RTC_DATA_UPPER_BOUND);
-}
-
-static int iwl5000_send_rxon_assoc(struct iwl_priv *priv)
-{
-        int ret = 0;
-        struct iwl5000_rxon_assoc_cmd rxon_assoc;
-        const struct iwl_rxon_cmd *rxon1 = &priv->staging_rxon;
-        const struct iwl_rxon_cmd *rxon2 = &priv->active_rxon;
-
-        if ((rxon1->flags == rxon2->flags) &&
-            (rxon1->filter_flags == rxon2->filter_flags) &&
-            (rxon1->cck_basic_rates == rxon2->cck_basic_rates) &&
-            (rxon1->ofdm_ht_single_stream_basic_rates ==
-             rxon2->ofdm_ht_single_stream_basic_rates) &&
-            (rxon1->ofdm_ht_dual_stream_basic_rates ==
-             rxon2->ofdm_ht_dual_stream_basic_rates) &&
-            (rxon1->ofdm_ht_triple_stream_basic_rates ==
-             rxon2->ofdm_ht_triple_stream_basic_rates) &&
-            (rxon1->acquisition_data == rxon2->acquisition_data) &&
-            (rxon1->rx_chain == rxon2->rx_chain) &&
-            (rxon1->ofdm_basic_rates == rxon2->ofdm_basic_rates)) {
-                IWL_DEBUG_INFO(priv, "Using current RXON_ASSOC.  Not resending.\n");
-                return 0;
-        }
-
-        rxon_assoc.flags = priv->staging_rxon.flags;
-        rxon_assoc.filter_flags = priv->staging_rxon.filter_flags;
-        rxon_assoc.ofdm_basic_rates = priv->staging_rxon.ofdm_basic_rates;
-        rxon_assoc.cck_basic_rates = priv->staging_rxon.cck_basic_rates;
-        rxon_assoc.reserved1 = 0;
-        rxon_assoc.reserved2 = 0;
-        rxon_assoc.reserved3 = 0;
-        rxon_assoc.ofdm_ht_single_stream_basic_rates =
-            priv->staging_rxon.ofdm_ht_single_stream_basic_rates;
-        rxon_assoc.ofdm_ht_dual_stream_basic_rates =
-            priv->staging_rxon.ofdm_ht_dual_stream_basic_rates;
-        rxon_assoc.rx_chain_select_flags = priv->staging_rxon.rx_chain;
-        rxon_assoc.ofdm_ht_triple_stream_basic_rates =
-                 priv->staging_rxon.ofdm_ht_triple_stream_basic_rates;
-        rxon_assoc.acquisition_data = priv->staging_rxon.acquisition_data;
-
-        ret = iwl_send_cmd_pdu_async(priv, REPLY_RXON_ASSOC,
-                                     sizeof(rxon_assoc), &rxon_assoc, NULL);
-        if (ret)
-                return ret;
-
-        return ret;
-}
-int  iwl5000_send_tx_power(struct iwl_priv *priv)
-{
-        struct iwl5000_tx_power_dbm_cmd tx_power_cmd;
-        u8 tx_ant_cfg_cmd;
-
-        /* half dBm need to multiply */
-        tx_power_cmd.global_lmt = (s8)(2 * priv->tx_power_user_lmt);
-
-        if (priv->tx_power_lmt_in_half_dbm &&
-            priv->tx_power_lmt_in_half_dbm < tx_power_cmd.global_lmt) {
-                /*
-                 * For the newer devices which using enhanced/extend tx power
-                 * table in EEPROM, the format is in half dBm. driver need to
-                 * convert to dBm format before report to mac80211.
-                 * By doing so, there is a possibility of 1/2 dBm resolution
-                 * lost. driver will perform "round-up" operation before
-                 * reporting, but it will cause 1/2 dBm tx power over the
-                 * regulatory limit. Perform the checking here, if the
-                 * "tx_power_user_lmt" is higher than EEPROM value (in
-                 * half-dBm format), lower the tx power based on EEPROM
-                 */
-                tx_power_cmd.global_lmt = priv->tx_power_lmt_in_half_dbm;
-        }
-        tx_power_cmd.flags = IWL50_TX_POWER_NO_CLOSED;
-        tx_power_cmd.srv_chan_lmt = IWL50_TX_POWER_AUTO;
-
-        if (IWL_UCODE_API(priv->ucode_ver) == 1)
-                tx_ant_cfg_cmd = REPLY_TX_POWER_DBM_CMD_V1;
-        else
-                tx_ant_cfg_cmd = REPLY_TX_POWER_DBM_CMD;
-
-        return  iwl_send_cmd_pdu_async(priv, tx_ant_cfg_cmd,
-                                       sizeof(tx_power_cmd), &tx_power_cmd,
-                                       NULL);
-}
-
-void iwl5000_temperature(struct iwl_priv *priv)
-{
-        /* store temperature from statistics (in Celsius) */
-        priv->temperature = le32_to_cpu(priv->statistics.general.temperature);
-        iwl_tt_handler(priv);
-}
-
 static void iwl5150_temperature(struct iwl_priv *priv)
 {
         u32 vt = 0;
@@ -1294,100 +235,6 @@ static void iwl5150_temperature(struct iwl_priv *priv)
         iwl_tt_handler(priv);
 }
 
-/* Calc max signal level (dBm) among 3 possible receivers */
-int iwl5000_calc_rssi(struct iwl_priv *priv,
-                             struct iwl_rx_phy_res *rx_resp)
-{
-        /* data from PHY/DSP regarding signal strength, etc.,
-         *   contents are always there, not configurable by host
-         */
-        struct iwl5000_non_cfg_phy *ncphy =
-                (struct iwl5000_non_cfg_phy *)rx_resp->non_cfg_phy_buf;
-        u32 val, rssi_a, rssi_b, rssi_c, max_rssi;
-        u8 agc;
-
-        val  = le32_to_cpu(ncphy->non_cfg_phy[IWL50_RX_RES_AGC_IDX]);
-        agc = (val & IWL50_OFDM_AGC_MSK) >> IWL50_OFDM_AGC_BIT_POS;
-
-        /* Find max rssi among 3 possible receivers.
-         * These values are measured by the digital signal processor (DSP).
-         * They should stay fairly constant even as the signal strength varies,
-         *   if the radio's automatic gain control (AGC) is working right.
-         * AGC value (see below) will provide the "interesting" info.
-         */
-        val = le32_to_cpu(ncphy->non_cfg_phy[IWL50_RX_RES_RSSI_AB_IDX]);
-        rssi_a = (val & IWL50_OFDM_RSSI_A_MSK) >> IWL50_OFDM_RSSI_A_BIT_POS;
-        rssi_b = (val & IWL50_OFDM_RSSI_B_MSK) >> IWL50_OFDM_RSSI_B_BIT_POS;
-        val = le32_to_cpu(ncphy->non_cfg_phy[IWL50_RX_RES_RSSI_C_IDX]);
-        rssi_c = (val & IWL50_OFDM_RSSI_C_MSK) >> IWL50_OFDM_RSSI_C_BIT_POS;
-
-        max_rssi = max_t(u32, rssi_a, rssi_b);
-        max_rssi = max_t(u32, max_rssi, rssi_c);
-
-        IWL_DEBUG_STATS(priv, "Rssi In A %d B %d C %d Max %d AGC dB %d\n",
-                rssi_a, rssi_b, rssi_c, max_rssi, agc);
-
-        /* dBm = max_rssi dB - agc dB - constant.
-         * Higher AGC (higher radio gain) means lower signal. */
-        return max_rssi - agc - IWL49_RSSI_OFFSET;
-}
-
-static int iwl5000_send_tx_ant_config(struct iwl_priv *priv, u8 valid_tx_ant)
-{
-        struct iwl_tx_ant_config_cmd tx_ant_cmd = {
-          .valid = cpu_to_le32(valid_tx_ant),
-        };
-
-        if (IWL_UCODE_API(priv->ucode_ver) > 1) {
-                IWL_DEBUG_HC(priv, "select valid tx ant: %u\n", valid_tx_ant);
-                return iwl_send_cmd_pdu(priv, TX_ANT_CONFIGURATION_CMD,
-                                        sizeof(struct iwl_tx_ant_config_cmd),
-                                        &tx_ant_cmd);
-        } else {
-                IWL_DEBUG_HC(priv, "TX_ANT_CONFIGURATION_CMD not supported\n");
-                return -EOPNOTSUPP;
-        }
-}
-
-
-#define IWL5000_UCODE_GET(item)                                         \
-static u32 iwl5000_ucode_get_##item(const struct iwl_ucode_header *ucode,\
-                                    u32 api_ver)                        \
-{                                                                       \
-        if (api_ver <= 2)                                               \
-                return le32_to_cpu(ucode->u.v1.item);                   \
-        return le32_to_cpu(ucode->u.v2.item);                           \
-}
-
-static u32 iwl5000_ucode_get_header_size(u32 api_ver)
-{
-        if (api_ver <= 2)
-                return UCODE_HEADER_SIZE(1);
-        return UCODE_HEADER_SIZE(2);
-}
-
-static u32 iwl5000_ucode_get_build(const struct iwl_ucode_header *ucode,
-                                   u32 api_ver)
-{
-        if (api_ver <= 2)
-                return 0;
-        return le32_to_cpu(ucode->u.v2.build);
-}
-
-static u8 *iwl5000_ucode_get_data(const struct iwl_ucode_header *ucode,
-                                  u32 api_ver)
-{
-        if (api_ver <= 2)
-                return (u8 *) ucode->u.v1.data;
-        return (u8 *) ucode->u.v2.data;
-}
-
-IWL5000_UCODE_GET(inst_size);
-IWL5000_UCODE_GET(data_size);
-IWL5000_UCODE_GET(init_size);
-IWL5000_UCODE_GET(init_data_size);
-IWL5000_UCODE_GET(boot_size);
-
 static int iwl5000_hw_channel_switch(struct iwl_priv *priv, u16 channel)
 {
         struct iwl5000_channel_switch_cmd cmd;
@@ -1420,54 +267,27 @@ static int iwl5000_hw_channel_switch(struct iwl_priv *priv, u16 channel)
         return iwl_send_cmd_sync(priv, &hcmd);
 }
 
-struct iwl_hcmd_ops iwl5000_hcmd = {
-        .rxon_assoc = iwl5000_send_rxon_assoc,
-        .commit_rxon = iwl_commit_rxon,
-        .set_rxon_chain = iwl_set_rxon_chain,
-        .set_tx_ant = iwl5000_send_tx_ant_config,
-};
-
-struct iwl_hcmd_utils_ops iwl5000_hcmd_utils = {
-        .get_hcmd_size = iwl5000_get_hcmd_size,
-        .build_addsta_hcmd = iwl5000_build_addsta_hcmd,
-        .gain_computation = iwl5000_gain_computation,
-        .chain_noise_reset = iwl5000_chain_noise_reset,
-        .rts_tx_cmd_flag = iwl5000_rts_tx_cmd_flag,
-        .calc_rssi = iwl5000_calc_rssi,
-};
-
-struct iwl_ucode_ops iwl5000_ucode = {
-        .get_header_size = iwl5000_ucode_get_header_size,
-        .get_build = iwl5000_ucode_get_build,
-        .get_inst_size = iwl5000_ucode_get_inst_size,
-        .get_data_size = iwl5000_ucode_get_data_size,
-        .get_init_size = iwl5000_ucode_get_init_size,
-        .get_init_data_size = iwl5000_ucode_get_init_data_size,
-        .get_boot_size = iwl5000_ucode_get_boot_size,
-        .get_data = iwl5000_ucode_get_data,
-};
-
-struct iwl_lib_ops iwl5000_lib = {
+static struct iwl_lib_ops iwl5000_lib = {
         .set_hw_params = iwl5000_hw_set_hw_params,
-        .txq_update_byte_cnt_tbl = iwl5000_txq_update_byte_cnt_tbl,
-        .txq_inval_byte_cnt_tbl = iwl5000_txq_inval_byte_cnt_tbl,
-        .txq_set_sched = iwl5000_txq_set_sched,
-        .txq_agg_enable = iwl5000_txq_agg_enable,
-        .txq_agg_disable = iwl5000_txq_agg_disable,
+        .txq_update_byte_cnt_tbl = iwlagn_txq_update_byte_cnt_tbl,
+        .txq_inval_byte_cnt_tbl = iwlagn_txq_inval_byte_cnt_tbl,
+        .txq_set_sched = iwlagn_txq_set_sched,
+        .txq_agg_enable = iwlagn_txq_agg_enable,
+        .txq_agg_disable = iwlagn_txq_agg_disable,
         .txq_attach_buf_to_tfd = iwl_hw_txq_attach_buf_to_tfd,
         .txq_free_tfd = iwl_hw_txq_free_tfd,
         .txq_init = iwl_hw_tx_queue_init,
-        .rx_handler_setup = iwl5000_rx_handler_setup,
-        .setup_deferred_work = iwl5000_setup_deferred_work,
-        .is_valid_rtc_data_addr = iwl5000_hw_valid_rtc_data_addr,
+        .rx_handler_setup = iwlagn_rx_handler_setup,
+        .setup_deferred_work = iwlagn_setup_deferred_work,
+        .is_valid_rtc_data_addr = iwlagn_hw_valid_rtc_data_addr,
         .dump_nic_event_log = iwl_dump_nic_event_log,
         .dump_nic_error_log = iwl_dump_nic_error_log,
         .dump_csr = iwl_dump_csr,
         .dump_fh = iwl_dump_fh,
-        .load_ucode = iwl5000_load_ucode,
-        .init_alive_start = iwl5000_init_alive_start,
-        .alive_notify = iwl5000_alive_notify,
-        .send_tx_power = iwl5000_send_tx_power,
+        .load_ucode = iwlagn_load_ucode,
+        .init_alive_start = iwlagn_init_alive_start,
+        .alive_notify = iwlagn_alive_notify,
+        .send_tx_power = iwlagn_send_tx_power,
         .update_chain_flags = iwl_update_chain_flags,
         .set_channel_switch = iwl5000_hw_channel_switch,
         .apm_ops = {
@@ -1478,50 +298,53 @@ struct iwl_lib_ops iwl5000_lib = {
         },
         .eeprom_ops = {
                 .regulatory_bands = {
-                        EEPROM_5000_REG_BAND_1_CHANNELS,
-                        EEPROM_5000_REG_BAND_2_CHANNELS,
-                        EEPROM_5000_REG_BAND_3_CHANNELS,
-                        EEPROM_5000_REG_BAND_4_CHANNELS,
-                        EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
-                        EEPROM_5000_REG_BAND_52_HT40_CHANNELS
+                        EEPROM_REG_BAND_1_CHANNELS,
+                        EEPROM_REG_BAND_2_CHANNELS,
+                        EEPROM_REG_BAND_3_CHANNELS,
+                        EEPROM_REG_BAND_4_CHANNELS,
+                        EEPROM_REG_BAND_5_CHANNELS,
+                        EEPROM_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
                 .acquire_semaphore = iwlcore_eeprom_acquire_semaphore,
                 .release_semaphore = iwlcore_eeprom_release_semaphore,
-                .calib_version  = iwl5000_eeprom_calib_version,
-                .query_addr = iwl5000_eeprom_query_addr,
+                .calib_version  = iwlagn_eeprom_calib_version,
+                .query_addr = iwlagn_eeprom_query_addr,
         },
         .post_associate = iwl_post_associate,
         .isr = iwl_isr_ict,
         .config_ap = iwl_config_ap,
         .temp_ops = {
-                .temperature = iwl5000_temperature,
+                .temperature = iwlagn_temperature,
                 .set_ct_kill = iwl5000_set_ct_threshold,
          },
         .add_bcast_station = iwl_add_bcast_station,
+        .recover_from_tx_stall = iwl_bg_monitor_recover,
+        .check_plcp_health = iwl_good_plcp_health,
+        .check_ack_health = iwl_good_ack_health,
 };
 
 static struct iwl_lib_ops iwl5150_lib = {
         .set_hw_params = iwl5000_hw_set_hw_params,
-        .txq_update_byte_cnt_tbl = iwl5000_txq_update_byte_cnt_tbl,
-        .txq_inval_byte_cnt_tbl = iwl5000_txq_inval_byte_cnt_tbl,
-        .txq_set_sched = iwl5000_txq_set_sched,
-        .txq_agg_enable = iwl5000_txq_agg_enable,
-        .txq_agg_disable = iwl5000_txq_agg_disable,
+        .txq_update_byte_cnt_tbl = iwlagn_txq_update_byte_cnt_tbl,
+        .txq_inval_byte_cnt_tbl = iwlagn_txq_inval_byte_cnt_tbl,
+        .txq_set_sched = iwlagn_txq_set_sched,
+        .txq_agg_enable = iwlagn_txq_agg_enable,
+        .txq_agg_disable = iwlagn_txq_agg_disable,
         .txq_attach_buf_to_tfd = iwl_hw_txq_attach_buf_to_tfd,
         .txq_free_tfd = iwl_hw_txq_free_tfd,
         .txq_init = iwl_hw_tx_queue_init,
-        .rx_handler_setup = iwl5000_rx_handler_setup,
-        .setup_deferred_work = iwl5000_setup_deferred_work,
-        .is_valid_rtc_data_addr = iwl5000_hw_valid_rtc_data_addr,
+        .rx_handler_setup = iwlagn_rx_handler_setup,
+        .setup_deferred_work = iwlagn_setup_deferred_work,
+        .is_valid_rtc_data_addr = iwlagn_hw_valid_rtc_data_addr,
         .dump_nic_event_log = iwl_dump_nic_event_log,
         .dump_nic_error_log = iwl_dump_nic_error_log,
         .dump_csr = iwl_dump_csr,
-        .load_ucode = iwl5000_load_ucode,
-        .init_alive_start = iwl5000_init_alive_start,
-        .alive_notify = iwl5000_alive_notify,
-        .send_tx_power = iwl5000_send_tx_power,
+        .load_ucode = iwlagn_load_ucode,
+        .init_alive_start = iwlagn_init_alive_start,
+        .alive_notify = iwlagn_alive_notify,
+        .send_tx_power = iwlagn_send_tx_power,
         .update_chain_flags = iwl_update_chain_flags,
         .set_channel_switch = iwl5000_hw_channel_switch,
         .apm_ops = {
@@ -1532,19 +355,19 @@ static struct iwl_lib_ops iwl5150_lib = {
         },
         .eeprom_ops = {
                 .regulatory_bands = {
-                        EEPROM_5000_REG_BAND_1_CHANNELS,
-                        EEPROM_5000_REG_BAND_2_CHANNELS,
-                        EEPROM_5000_REG_BAND_3_CHANNELS,
-                        EEPROM_5000_REG_BAND_4_CHANNELS,
-                        EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
-                        EEPROM_5000_REG_BAND_52_HT40_CHANNELS
+                        EEPROM_REG_BAND_1_CHANNELS,
+                        EEPROM_REG_BAND_2_CHANNELS,
+                        EEPROM_REG_BAND_3_CHANNELS,
+                        EEPROM_REG_BAND_4_CHANNELS,
+                        EEPROM_REG_BAND_5_CHANNELS,
+                        EEPROM_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
                 .acquire_semaphore = iwlcore_eeprom_acquire_semaphore,
                 .release_semaphore = iwlcore_eeprom_release_semaphore,
-                .calib_version  = iwl5000_eeprom_calib_version,
-                .query_addr = iwl5000_eeprom_query_addr,
+                .calib_version  = iwlagn_eeprom_calib_version,
+                .query_addr = iwlagn_eeprom_query_addr,
         },
         .post_associate = iwl_post_associate,
         .isr = iwl_isr_ict,
@@ -1554,44 +377,40 @@ static struct iwl_lib_ops iwl5150_lib = {
                 .set_ct_kill = iwl5150_set_ct_threshold,
          },
         .add_bcast_station = iwl_add_bcast_station,
+        .recover_from_tx_stall = iwl_bg_monitor_recover,
+        .check_plcp_health = iwl_good_plcp_health,
+        .check_ack_health = iwl_good_ack_health,
 };
 
 static const struct iwl_ops iwl5000_ops = {
-        .ucode = &iwl5000_ucode,
+        .ucode = &iwlagn_ucode,
         .lib = &iwl5000_lib,
-        .hcmd = &iwl5000_hcmd,
-        .utils = &iwl5000_hcmd_utils,
+        .hcmd = &iwlagn_hcmd,
+        .utils = &iwlagn_hcmd_utils,
         .led = &iwlagn_led_ops,
 };
 
 static const struct iwl_ops iwl5150_ops = {
-        .ucode = &iwl5000_ucode,
+        .ucode = &iwlagn_ucode,
         .lib = &iwl5150_lib,
-        .hcmd = &iwl5000_hcmd,
-        .utils = &iwl5000_hcmd_utils,
+        .hcmd = &iwlagn_hcmd,
+        .utils = &iwlagn_hcmd_utils,
         .led = &iwlagn_led_ops,
 };
 
-struct iwl_mod_params iwl50_mod_params = {
-        .amsdu_size_8K = 1,
-        .restart_fw = 1,
-        /* the rest are 0 by default */
-};
-
-
 struct iwl_cfg iwl5300_agn_cfg = {
-        .name = "5300AGN",
+        .name = "Intel(R) Ultimate N WiFi Link 5300 AGN",
         .fw_name_pre = IWL5000_FW_PRE,
         .ucode_api_max = IWL5000_UCODE_API_MAX,
         .ucode_api_min = IWL5000_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
         .ops = &iwl5000_ops,
-        .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
+        .eeprom_size = IWLAGN_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_ABC,
         .valid_rx_ant = ANT_ABC,
         .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
@@ -1603,21 +422,22 @@ struct iwl_cfg iwl5300_agn_cfg = {
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
 };
 
 struct iwl_cfg iwl5100_bgn_cfg = {
-        .name = "5100BGN",
+        .name = "Intel(R) WiFi Link 5100 BGN",
         .fw_name_pre = IWL5000_FW_PRE,
         .ucode_api_max = IWL5000_UCODE_API_MAX,
         .ucode_api_min = IWL5000_UCODE_API_MIN,
         .sku = IWL_SKU_G|IWL_SKU_N,
         .ops = &iwl5000_ops,
-        .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
+        .eeprom_size = IWLAGN_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_B,
         .valid_rx_ant = ANT_AB,
         .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
@@ -1629,21 +449,22 @@ struct iwl_cfg iwl5100_bgn_cfg = {
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
 };
 
 struct iwl_cfg iwl5100_abg_cfg = {
-        .name = "5100ABG",
+        .name = "Intel(R) WiFi Link 5100 ABG",
         .fw_name_pre = IWL5000_FW_PRE,
         .ucode_api_max = IWL5000_UCODE_API_MAX,
         .ucode_api_min = IWL5000_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G,
         .ops = &iwl5000_ops,
-        .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
+        .eeprom_size = IWLAGN_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_B,
         .valid_rx_ant = ANT_AB,
         .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
@@ -1653,21 +474,22 @@ struct iwl_cfg iwl5100_abg_cfg = {
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
 };
 
 struct iwl_cfg iwl5100_agn_cfg = {
-        .name = "5100AGN",
+        .name = "Intel(R) WiFi Link 5100 AGN",
         .fw_name_pre = IWL5000_FW_PRE,
         .ucode_api_max = IWL5000_UCODE_API_MAX,
         .ucode_api_min = IWL5000_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
         .ops = &iwl5000_ops,
-        .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
+        .eeprom_size = IWLAGN_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_B,
         .valid_rx_ant = ANT_AB,
         .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
@@ -1679,21 +501,22 @@ struct iwl_cfg iwl5100_agn_cfg = {
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
 };
 
 struct iwl_cfg iwl5350_agn_cfg = {
-        .name = "5350AGN",
+        .name = "Intel(R) WiMAX/WiFi Link 5350 AGN",
         .fw_name_pre = IWL5000_FW_PRE,
         .ucode_api_max = IWL5000_UCODE_API_MAX,
         .ucode_api_min = IWL5000_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
         .ops = &iwl5000_ops,
-        .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
+        .eeprom_size = IWLAGN_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_ABC,
         .valid_rx_ant = ANT_ABC,
         .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
@@ -1705,21 +528,22 @@ struct iwl_cfg iwl5350_agn_cfg = {
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
 };
 
 struct iwl_cfg iwl5150_agn_cfg = {
-        .name = "5150AGN",
+        .name = "Intel(R) WiMAX/WiFi Link 5150 AGN",
         .fw_name_pre = IWL5150_FW_PRE,
         .ucode_api_max = IWL5150_UCODE_API_MAX,
         .ucode_api_min = IWL5150_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
         .ops = &iwl5150_ops,
-        .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
+        .eeprom_size = IWLAGN_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_A,
         .valid_rx_ant = ANT_AB,
         .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
@@ -1731,21 +555,22 @@ struct iwl_cfg iwl5150_agn_cfg = {
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
 };
 
 struct iwl_cfg iwl5150_abg_cfg = {
-        .name = "5150ABG",
+        .name = "Intel(R) WiMAX/WiFi Link 5150 ABG",
         .fw_name_pre = IWL5150_FW_PRE,
         .ucode_api_max = IWL5150_UCODE_API_MAX,
         .ucode_api_min = IWL5150_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G,
         .ops = &iwl5150_ops,
-        .eeprom_size = IWL_5000_EEPROM_IMG_SIZE,
+        .eeprom_size = IWLAGN_EEPROM_IMG_SIZE,
         .eeprom_ver = EEPROM_5050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_A,
         .valid_rx_ant = ANT_AB,
         .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
@@ -1755,20 +580,8 @@ struct iwl_cfg iwl5150_abg_cfg = {
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
 };
 
 MODULE_FIRMWARE(IWL5000_MODULE_FIRMWARE(IWL5000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL5150_MODULE_FIRMWARE(IWL5150_UCODE_API_MAX));
-
-module_param_named(swcrypto50, iwl50_mod_params.sw_crypto, bool, S_IRUGO);
-MODULE_PARM_DESC(swcrypto50,
-                  "using software crypto engine (default 0 [hardware])\n");
-module_param_named(queues_num50, iwl50_mod_params.num_of_queues, int, S_IRUGO);
-MODULE_PARM_DESC(queues_num50, "number of hw queues in 50xx series");
-module_param_named(11n_disable50, iwl50_mod_params.disable_11n, int, S_IRUGO);
-MODULE_PARM_DESC(11n_disable50, "disable 50XX 11n functionality");
-module_param_named(amsdu_size_8K50, iwl50_mod_params.amsdu_size_8K,
-                   int, S_IRUGO);
-MODULE_PARM_DESC(amsdu_size_8K50, "enable 8K amsdu size in 50XX series");
-module_param_named(fw_restart50, iwl50_mod_params.restart_fw, int, S_IRUGO);
-MODULE_PARM_DESC(fw_restart50, "restart firmware in case of error");
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index c4844adff92a..7473518e7e0a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -42,8 +42,9 @@
 #include "iwl-core.h"
 #include "iwl-io.h"
 #include "iwl-sta.h"
+#include "iwl-agn.h"
 #include "iwl-helpers.h"
-#include "iwl-5000-hw.h"
+#include "iwl-agn-hw.h"
 #include "iwl-6000-hw.h"
 #include "iwl-agn-led.h"
 
@@ -56,6 +57,7 @@
 #define IWL6050_UCODE_API_MIN 4
 
 #define IWL6000_FW_PRE "iwlwifi-6000-"
+#define IWL6000_G2_FW_PRE "iwlwifi-6005-"
 #define _IWL6000_MODULE_FIRMWARE(api) IWL6000_FW_PRE #api ".ucode"
 #define IWL6000_MODULE_FIRMWARE(api) _IWL6000_MODULE_FIRMWARE(api)
 
@@ -136,7 +138,7 @@ static struct iwl_sensitivity_ranges iwl6000_sensitivity = {
 static int iwl6000_hw_set_hw_params(struct iwl_priv *priv)
 {
         if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
-            priv->cfg->mod_params->num_of_queues <= IWL50_NUM_QUEUES)
+            priv->cfg->mod_params->num_of_queues <= IWLAGN_NUM_QUEUES)
                 priv->cfg->num_of_queues =
                         priv->cfg->mod_params->num_of_queues;
 
@@ -144,7 +146,7 @@ static int iwl6000_hw_set_hw_params(struct iwl_priv *priv)
         priv->hw_params.dma_chnl_num = FH50_TCSR_CHNL_NUM;
         priv->hw_params.scd_bc_tbls_size =
                         priv->cfg->num_of_queues *
-                        sizeof(struct iwl5000_scd_bc_tbl);
+                        sizeof(struct iwlagn_scd_bc_tbl);
         priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
         priv->hw_params.max_stations = IWL5000_STATION_COUNT;
         priv->hw_params.bcast_sta_id = IWL5000_BROADCAST_ID;
@@ -225,25 +227,25 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv, u16 channel)
 
 static struct iwl_lib_ops iwl6000_lib = {
         .set_hw_params = iwl6000_hw_set_hw_params,
-        .txq_update_byte_cnt_tbl = iwl5000_txq_update_byte_cnt_tbl,
-        .txq_inval_byte_cnt_tbl = iwl5000_txq_inval_byte_cnt_tbl,
-        .txq_set_sched = iwl5000_txq_set_sched,
-        .txq_agg_enable = iwl5000_txq_agg_enable,
-        .txq_agg_disable = iwl5000_txq_agg_disable,
+        .txq_update_byte_cnt_tbl = iwlagn_txq_update_byte_cnt_tbl,
+        .txq_inval_byte_cnt_tbl = iwlagn_txq_inval_byte_cnt_tbl,
+        .txq_set_sched = iwlagn_txq_set_sched,
+        .txq_agg_enable = iwlagn_txq_agg_enable,
+        .txq_agg_disable = iwlagn_txq_agg_disable,
         .txq_attach_buf_to_tfd = iwl_hw_txq_attach_buf_to_tfd,
         .txq_free_tfd = iwl_hw_txq_free_tfd,
         .txq_init = iwl_hw_tx_queue_init,
-        .rx_handler_setup = iwl5000_rx_handler_setup,
-        .setup_deferred_work = iwl5000_setup_deferred_work,
-        .is_valid_rtc_data_addr = iwl5000_hw_valid_rtc_data_addr,
-        .load_ucode = iwl5000_load_ucode,
+        .rx_handler_setup = iwlagn_rx_handler_setup,
+        .setup_deferred_work = iwlagn_setup_deferred_work,
+        .is_valid_rtc_data_addr = iwlagn_hw_valid_rtc_data_addr,
+        .load_ucode = iwlagn_load_ucode,
         .dump_nic_event_log = iwl_dump_nic_event_log,
         .dump_nic_error_log = iwl_dump_nic_error_log,
         .dump_csr = iwl_dump_csr,
         .dump_fh = iwl_dump_fh,
-        .init_alive_start = iwl5000_init_alive_start,
-        .alive_notify = iwl5000_alive_notify,
-        .send_tx_power = iwl5000_send_tx_power,
+        .init_alive_start = iwlagn_init_alive_start,
+        .alive_notify = iwlagn_alive_notify,
+        .send_tx_power = iwlagn_send_tx_power,
         .update_chain_flags = iwl_update_chain_flags,
         .set_channel_switch = iwl6000_hw_channel_switch,
         .apm_ops = {
@@ -254,60 +256,63 @@ static struct iwl_lib_ops iwl6000_lib = {
         },
         .eeprom_ops = {
                 .regulatory_bands = {
-                        EEPROM_5000_REG_BAND_1_CHANNELS,
-                        EEPROM_5000_REG_BAND_2_CHANNELS,
-                        EEPROM_5000_REG_BAND_3_CHANNELS,
-                        EEPROM_5000_REG_BAND_4_CHANNELS,
-                        EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
-                        EEPROM_5000_REG_BAND_52_HT40_CHANNELS
+                        EEPROM_REG_BAND_1_CHANNELS,
+                        EEPROM_REG_BAND_2_CHANNELS,
+                        EEPROM_REG_BAND_3_CHANNELS,
+                        EEPROM_REG_BAND_4_CHANNELS,
+                        EEPROM_REG_BAND_5_CHANNELS,
+                        EEPROM_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
                 .acquire_semaphore = iwlcore_eeprom_acquire_semaphore,
                 .release_semaphore = iwlcore_eeprom_release_semaphore,
-                .calib_version  = iwl5000_eeprom_calib_version,
-                .query_addr = iwl5000_eeprom_query_addr,
+                .calib_version  = iwlagn_eeprom_calib_version,
+                .query_addr = iwlagn_eeprom_query_addr,
                 .update_enhanced_txpower = iwlcore_eeprom_enhanced_txpower,
         },
         .post_associate = iwl_post_associate,
         .isr = iwl_isr_ict,
         .config_ap = iwl_config_ap,
         .temp_ops = {
-                .temperature = iwl5000_temperature,
+                .temperature = iwlagn_temperature,
                 .set_ct_kill = iwl6000_set_ct_threshold,
          },
         .add_bcast_station = iwl_add_bcast_station,
+        .recover_from_tx_stall = iwl_bg_monitor_recover,
+        .check_plcp_health = iwl_good_plcp_health,
+        .check_ack_health = iwl_good_ack_health,
 };
 
 static const struct iwl_ops iwl6000_ops = {
-        .ucode = &iwl5000_ucode,
+        .ucode = &iwlagn_ucode,
         .lib = &iwl6000_lib,
-        .hcmd = &iwl5000_hcmd,
-        .utils = &iwl5000_hcmd_utils,
+        .hcmd = &iwlagn_hcmd,
+        .utils = &iwlagn_hcmd_utils,
         .led = &iwlagn_led_ops,
 };
 
 static struct iwl_lib_ops iwl6050_lib = {
         .set_hw_params = iwl6000_hw_set_hw_params,
-        .txq_update_byte_cnt_tbl = iwl5000_txq_update_byte_cnt_tbl,
-        .txq_inval_byte_cnt_tbl = iwl5000_txq_inval_byte_cnt_tbl,
-        .txq_set_sched = iwl5000_txq_set_sched,
-        .txq_agg_enable = iwl5000_txq_agg_enable,
-        .txq_agg_disable = iwl5000_txq_agg_disable,
+        .txq_update_byte_cnt_tbl = iwlagn_txq_update_byte_cnt_tbl,
+        .txq_inval_byte_cnt_tbl = iwlagn_txq_inval_byte_cnt_tbl,
+        .txq_set_sched = iwlagn_txq_set_sched,
+        .txq_agg_enable = iwlagn_txq_agg_enable,
+        .txq_agg_disable = iwlagn_txq_agg_disable,
         .txq_attach_buf_to_tfd = iwl_hw_txq_attach_buf_to_tfd,
         .txq_free_tfd = iwl_hw_txq_free_tfd,
         .txq_init = iwl_hw_tx_queue_init,
-        .rx_handler_setup = iwl5000_rx_handler_setup,
-        .setup_deferred_work = iwl5000_setup_deferred_work,
-        .is_valid_rtc_data_addr = iwl5000_hw_valid_rtc_data_addr,
-        .load_ucode = iwl5000_load_ucode,
+        .rx_handler_setup = iwlagn_rx_handler_setup,
+        .setup_deferred_work = iwlagn_setup_deferred_work,
+        .is_valid_rtc_data_addr = iwlagn_hw_valid_rtc_data_addr,
+        .load_ucode = iwlagn_load_ucode,
         .dump_nic_event_log = iwl_dump_nic_event_log,
         .dump_nic_error_log = iwl_dump_nic_error_log,
         .dump_csr = iwl_dump_csr,
         .dump_fh = iwl_dump_fh,
-        .init_alive_start = iwl5000_init_alive_start,
-        .alive_notify = iwl5000_alive_notify,
-        .send_tx_power = iwl5000_send_tx_power,
+        .init_alive_start = iwlagn_init_alive_start,
+        .alive_notify = iwlagn_alive_notify,
+        .send_tx_power = iwlagn_send_tx_power,
         .update_chain_flags = iwl_update_chain_flags,
         .set_channel_switch = iwl6000_hw_channel_switch,
         .apm_ops = {
@@ -318,45 +323,81 @@ static struct iwl_lib_ops iwl6050_lib = {
         },
         .eeprom_ops = {
                 .regulatory_bands = {
-                        EEPROM_5000_REG_BAND_1_CHANNELS,
-                        EEPROM_5000_REG_BAND_2_CHANNELS,
-                        EEPROM_5000_REG_BAND_3_CHANNELS,
-                        EEPROM_5000_REG_BAND_4_CHANNELS,
-                        EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
-                        EEPROM_5000_REG_BAND_52_HT40_CHANNELS
+                        EEPROM_REG_BAND_1_CHANNELS,
+                        EEPROM_REG_BAND_2_CHANNELS,
+                        EEPROM_REG_BAND_3_CHANNELS,
+                        EEPROM_REG_BAND_4_CHANNELS,
+                        EEPROM_REG_BAND_5_CHANNELS,
+                        EEPROM_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
                 .acquire_semaphore = iwlcore_eeprom_acquire_semaphore,
                 .release_semaphore = iwlcore_eeprom_release_semaphore,
-                .calib_version  = iwl5000_eeprom_calib_version,
-                .query_addr = iwl5000_eeprom_query_addr,
+                .calib_version  = iwlagn_eeprom_calib_version,
+                .query_addr = iwlagn_eeprom_query_addr,
                 .update_enhanced_txpower = iwlcore_eeprom_enhanced_txpower,
         },
         .post_associate = iwl_post_associate,
         .isr = iwl_isr_ict,
         .config_ap = iwl_config_ap,
         .temp_ops = {
-                .temperature = iwl5000_temperature,
+                .temperature = iwlagn_temperature,
                 .set_ct_kill = iwl6000_set_ct_threshold,
                 .set_calib_version = iwl6050_set_calib_version,
          },
         .add_bcast_station = iwl_add_bcast_station,
+        .recover_from_tx_stall = iwl_bg_monitor_recover,
+        .check_plcp_health = iwl_good_plcp_health,
+        .check_ack_health = iwl_good_ack_health,
 };
 
 static const struct iwl_ops iwl6050_ops = {
-        .ucode = &iwl5000_ucode,
+        .ucode = &iwlagn_ucode,
         .lib = &iwl6050_lib,
-        .hcmd = &iwl5000_hcmd,
-        .utils = &iwl5000_hcmd_utils,
+        .hcmd = &iwlagn_hcmd,
+        .utils = &iwlagn_hcmd_utils,
         .led = &iwlagn_led_ops,
 };
 
 /*
  * "i": Internal configuration, use internal Power Amplifier
  */
+struct iwl_cfg iwl6000i_g2_2agn_cfg = {
+        .name = "6000 Series 2x2 AGN Gen2",
+        .fw_name_pre = IWL6000_G2_FW_PRE,
+        .ucode_api_max = IWL6000_UCODE_API_MAX,
+        .ucode_api_min = IWL6000_UCODE_API_MIN,
+        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
+        .ops = &iwl6000_ops,
+        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
+        .eeprom_calib_ver = EEPROM_6000_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
+        .pll_cfg_val = 0,
+        .set_l0s = true,
+        .use_bsm = false,
+        .pa_type = IWL_PA_INTERNAL,
+        .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+        .shadow_ram_support = true,
+        .ht_greenfield_support = true,
+        .led_compensation = 51,
+        .use_rts_for_ht = true, /* use rts/cts protection */
+        .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
+        .supports_idle = true,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
+};
+
 struct iwl_cfg iwl6000i_2agn_cfg = {
-        .name = "6000 Series 2x2 AGN",
+        .name = "Intel(R) Centrino(R) Advanced-N 6200 AGN",
         .fw_name_pre = IWL6000_FW_PRE,
         .ucode_api_max = IWL6000_UCODE_API_MAX,
         .ucode_api_min = IWL6000_UCODE_API_MIN,
@@ -364,10 +405,10 @@ struct iwl_cfg iwl6000i_2agn_cfg = {
         .ops = &iwl6000_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
-        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .eeprom_calib_ver = EEPROM_6000_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_BC,
         .valid_rx_ant = ANT_BC,
         .pll_cfg_val = 0,
@@ -385,10 +426,11 @@ struct iwl_cfg iwl6000i_2agn_cfg = {
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
 };
 
 struct iwl_cfg iwl6000i_2abg_cfg = {
-        .name = "6000 Series 2x2 ABG",
+        .name = "Intel(R) Centrino(R) Advanced-N 6200 ABG",
         .fw_name_pre = IWL6000_FW_PRE,
         .ucode_api_max = IWL6000_UCODE_API_MAX,
         .ucode_api_min = IWL6000_UCODE_API_MIN,
@@ -396,10 +438,10 @@ struct iwl_cfg iwl6000i_2abg_cfg = {
         .ops = &iwl6000_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
-        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .eeprom_calib_ver = EEPROM_6000_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_BC,
         .valid_rx_ant = ANT_BC,
         .pll_cfg_val = 0,
@@ -416,10 +458,11 @@ struct iwl_cfg iwl6000i_2abg_cfg = {
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
 };
 
 struct iwl_cfg iwl6000i_2bg_cfg = {
-        .name = "6000 Series 2x2 BG",
+        .name = "Intel(R) Centrino(R) Advanced-N 6200 BG",
         .fw_name_pre = IWL6000_FW_PRE,
         .ucode_api_max = IWL6000_UCODE_API_MAX,
         .ucode_api_min = IWL6000_UCODE_API_MIN,
@@ -427,10 +470,10 @@ struct iwl_cfg iwl6000i_2bg_cfg = {
         .ops = &iwl6000_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
-        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .eeprom_calib_ver = EEPROM_6000_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_BC,
         .valid_rx_ant = ANT_BC,
         .pll_cfg_val = 0,
@@ -447,10 +490,11 @@ struct iwl_cfg iwl6000i_2bg_cfg = {
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
 };
 
 struct iwl_cfg iwl6050_2agn_cfg = {
-        .name = "6050 Series 2x2 AGN",
+        .name = "Intel(R) Centrino(R) Advanced-N + WiMAX 6250 AGN",
         .fw_name_pre = IWL6050_FW_PRE,
         .ucode_api_max = IWL6050_UCODE_API_MAX,
         .ucode_api_min = IWL6050_UCODE_API_MIN,
@@ -458,10 +502,10 @@ struct iwl_cfg iwl6050_2agn_cfg = {
         .ops = &iwl6050_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_6050_EEPROM_VERSION,
-        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .eeprom_calib_ver = EEPROM_6050_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_AB,
         .pll_cfg_val = 0,
@@ -479,10 +523,11 @@ struct iwl_cfg iwl6050_2agn_cfg = {
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
         .chain_noise_scale = 1500,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
 };
 
 struct iwl_cfg iwl6050_2abg_cfg = {
-        .name = "6050 Series 2x2 ABG",
+        .name = "Intel(R) Centrino(R) Advanced-N + WiMAX 6250 ABG",
         .fw_name_pre = IWL6050_FW_PRE,
         .ucode_api_max = IWL6050_UCODE_API_MAX,
         .ucode_api_min = IWL6050_UCODE_API_MIN,
@@ -490,10 +535,10 @@ struct iwl_cfg iwl6050_2abg_cfg = {
         .ops = &iwl6050_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_6050_EEPROM_VERSION,
-        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .eeprom_calib_ver = EEPROM_6050_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_AB,
         .pll_cfg_val = 0,
@@ -510,10 +555,11 @@ struct iwl_cfg iwl6050_2abg_cfg = {
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
         .chain_noise_scale = 1500,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
 };
 
 struct iwl_cfg iwl6000_3agn_cfg = {
-        .name = "6000 Series 3x3 AGN",
+        .name = "Intel(R) Centrino(R) Ultimate-N 6300 AGN",
         .fw_name_pre = IWL6000_FW_PRE,
         .ucode_api_max = IWL6000_UCODE_API_MAX,
         .ucode_api_min = IWL6000_UCODE_API_MIN,
@@ -521,10 +567,10 @@ struct iwl_cfg iwl6000_3agn_cfg = {
         .ops = &iwl6000_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
-        .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
-        .num_of_queues = IWL50_NUM_QUEUES,
-        .num_of_ampdu_queues = IWL50_NUM_AMPDU_QUEUES,
-        .mod_params = &iwl50_mod_params,
+        .eeprom_calib_ver = EEPROM_6000_TX_POWER_VERSION,
+        .num_of_queues = IWLAGN_NUM_QUEUES,
+        .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
+        .mod_params = &iwlagn_mod_params,
         .valid_tx_ant = ANT_ABC,
         .valid_rx_ant = ANT_ABC,
         .pll_cfg_val = 0,
@@ -542,6 +588,7 @@ struct iwl_cfg iwl6000_3agn_cfg = {
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
         .chain_noise_scale = 1000,
+        .monitor_recover_period = IWL_MONITORING_PERIOD,
 };
 
 MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
new file mode 100644
index 000000000000..28bc8f8ba981
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
@@ -0,0 +1,274 @@
+/******************************************************************************
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ *****************************************************************************/
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/sched.h>
+
+#include "iwl-dev.h"
+#include "iwl-core.h"
+#include "iwl-io.h"
+#include "iwl-agn.h"
+
+static int iwlagn_send_rxon_assoc(struct iwl_priv *priv)
+{
+        int ret = 0;
+        struct iwl5000_rxon_assoc_cmd rxon_assoc;
+        const struct iwl_rxon_cmd *rxon1 = &priv->staging_rxon;
+        const struct iwl_rxon_cmd *rxon2 = &priv->active_rxon;
+
+        if ((rxon1->flags == rxon2->flags) &&
+            (rxon1->filter_flags == rxon2->filter_flags) &&
+            (rxon1->cck_basic_rates == rxon2->cck_basic_rates) &&
+            (rxon1->ofdm_ht_single_stream_basic_rates ==
+             rxon2->ofdm_ht_single_stream_basic_rates) &&
+            (rxon1->ofdm_ht_dual_stream_basic_rates ==
+             rxon2->ofdm_ht_dual_stream_basic_rates) &&
+            (rxon1->ofdm_ht_triple_stream_basic_rates ==
+             rxon2->ofdm_ht_triple_stream_basic_rates) &&
+            (rxon1->acquisition_data == rxon2->acquisition_data) &&
+            (rxon1->rx_chain == rxon2->rx_chain) &&
+            (rxon1->ofdm_basic_rates == rxon2->ofdm_basic_rates)) {
+                IWL_DEBUG_INFO(priv, "Using current RXON_ASSOC.  Not resending.\n");
+                return 0;
+        }
+
+        rxon_assoc.flags = priv->staging_rxon.flags;
+        rxon_assoc.filter_flags = priv->staging_rxon.filter_flags;
+        rxon_assoc.ofdm_basic_rates = priv->staging_rxon.ofdm_basic_rates;
+        rxon_assoc.cck_basic_rates = priv->staging_rxon.cck_basic_rates;
+        rxon_assoc.reserved1 = 0;
+        rxon_assoc.reserved2 = 0;
+        rxon_assoc.reserved3 = 0;
+        rxon_assoc.ofdm_ht_single_stream_basic_rates =
+            priv->staging_rxon.ofdm_ht_single_stream_basic_rates;
+        rxon_assoc.ofdm_ht_dual_stream_basic_rates =
+            priv->staging_rxon.ofdm_ht_dual_stream_basic_rates;
+        rxon_assoc.rx_chain_select_flags = priv->staging_rxon.rx_chain;
+        rxon_assoc.ofdm_ht_triple_stream_basic_rates =
+                 priv->staging_rxon.ofdm_ht_triple_stream_basic_rates;
+        rxon_assoc.acquisition_data = priv->staging_rxon.acquisition_data;
+
+        ret = iwl_send_cmd_pdu_async(priv, REPLY_RXON_ASSOC,
+                                     sizeof(rxon_assoc), &rxon_assoc, NULL);
+        if (ret)
+                return ret;
+
+        return ret;
+}
+
+static int iwlagn_send_tx_ant_config(struct iwl_priv *priv, u8 valid_tx_ant)
+{
+        struct iwl_tx_ant_config_cmd tx_ant_cmd = {
+          .valid = cpu_to_le32(valid_tx_ant),
+        };
+
+        if (IWL_UCODE_API(priv->ucode_ver) > 1) {
+                IWL_DEBUG_HC(priv, "select valid tx ant: %u\n", valid_tx_ant);
+                return iwl_send_cmd_pdu(priv, TX_ANT_CONFIGURATION_CMD,
+                                        sizeof(struct iwl_tx_ant_config_cmd),
+                                        &tx_ant_cmd);
+        } else {
+                IWL_DEBUG_HC(priv, "TX_ANT_CONFIGURATION_CMD not supported\n");
+                return -EOPNOTSUPP;
+        }
+}
+
+/* Currently this is the superset of everything */
+static u16 iwlagn_get_hcmd_size(u8 cmd_id, u16 len)
+{
+        return len;
+}
+
+static u16 iwlagn_build_addsta_hcmd(const struct iwl_addsta_cmd *cmd, u8 *data)
+{
+        u16 size = (u16)sizeof(struct iwl_addsta_cmd);
+        struct iwl_addsta_cmd *addsta = (struct iwl_addsta_cmd *)data;
+        memcpy(addsta, cmd, size);
+        /* resrved in 5000 */
+        addsta->rate_n_flags = cpu_to_le16(0);
+        return size;
+}
+
+static void iwlagn_gain_computation(struct iwl_priv *priv,
+                u32 average_noise[NUM_RX_CHAINS],
+                u16 min_average_noise_antenna_i,
+                u32 min_average_noise,
+                u8 default_chain)
+{
+        int i;
+        s32 delta_g;
+        struct iwl_chain_noise_data *data = &priv->chain_noise_data;
+
+        /*
+         * Find Gain Code for the chains based on "default chain"
+         */
+        for (i = default_chain + 1; i < NUM_RX_CHAINS; i++) {
+                if ((data->disconn_array[i])) {
+                        data->delta_gain_code[i] = 0;
+                        continue;
+                }
+
+                delta_g = (priv->cfg->chain_noise_scale *
+                        ((s32)average_noise[default_chain] -
+                        (s32)average_noise[i])) / 1500;
+
+                /* bound gain by 2 bits value max, 3rd bit is sign */
+                data->delta_gain_code[i] =
+                        min(abs(delta_g), (long) CHAIN_NOISE_MAX_DELTA_GAIN_CODE);
+
+                if (delta_g < 0)
+                        /*
+                         * set negative sign ...
+                         * note to Intel developers:  This is uCode API format,
+                         *   not the format of any internal device registers.
+                         *   Do not change this format for e.g. 6050 or similar
+                         *   devices.  Change format only if more resolution
+                         *   (i.e. more than 2 bits magnitude) is needed.
+                         */
+                        data->delta_gain_code[i] |= (1 << 2);
+        }
+
+        IWL_DEBUG_CALIB(priv, "Delta gains: ANT_B = %d  ANT_C = %d\n",
+                        data->delta_gain_code[1], data->delta_gain_code[2]);
+
+        if (!data->radio_write) {
+                struct iwl_calib_chain_noise_gain_cmd cmd;
+
+                memset(&cmd, 0, sizeof(cmd));
+
+                cmd.hdr.op_code = IWL_PHY_CALIBRATE_CHAIN_NOISE_GAIN_CMD;
+                cmd.hdr.first_group = 0;
+                cmd.hdr.groups_num = 1;
+                cmd.hdr.data_valid = 1;
+                cmd.delta_gain_1 = data->delta_gain_code[1];
+                cmd.delta_gain_2 = data->delta_gain_code[2];
+                iwl_send_cmd_pdu_async(priv, REPLY_PHY_CALIBRATION_CMD,
+                        sizeof(cmd), &cmd, NULL);
+
+                data->radio_write = 1;
+                data->state = IWL_CHAIN_NOISE_CALIBRATED;
+        }
+
+        data->chain_noise_a = 0;
+        data->chain_noise_b = 0;
+        data->chain_noise_c = 0;
+        data->chain_signal_a = 0;
+        data->chain_signal_b = 0;
+        data->chain_signal_c = 0;
+        data->beacon_count = 0;
+}
+
+static void iwlagn_chain_noise_reset(struct iwl_priv *priv)
+{
+        struct iwl_chain_noise_data *data = &priv->chain_noise_data;
+        int ret;
+
+        if ((data->state == IWL_CHAIN_NOISE_ALIVE) && iwl_is_associated(priv)) {
+                struct iwl_calib_chain_noise_reset_cmd cmd;
+                memset(&cmd, 0, sizeof(cmd));
+
+                cmd.hdr.op_code = IWL_PHY_CALIBRATE_CHAIN_NOISE_RESET_CMD;
+                cmd.hdr.first_group = 0;
+                cmd.hdr.groups_num = 1;
+                cmd.hdr.data_valid = 1;
+                ret = iwl_send_cmd_pdu(priv, REPLY_PHY_CALIBRATION_CMD,
+                                        sizeof(cmd), &cmd);
+                if (ret)
+                        IWL_ERR(priv,
+                                "Could not send REPLY_PHY_CALIBRATION_CMD\n");
+                data->state = IWL_CHAIN_NOISE_ACCUMULATE;
+                IWL_DEBUG_CALIB(priv, "Run chain_noise_calibrate\n");
+        }
+}
+
+static void iwlagn_rts_tx_cmd_flag(struct ieee80211_tx_info *info,
+                        __le32 *tx_flags)
+{
+        if ((info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) ||
+            (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT))
+                *tx_flags |= TX_CMD_FLG_RTS_CTS_MSK;
+        else
+                *tx_flags &= ~TX_CMD_FLG_RTS_CTS_MSK;
+}
+
+/* Calc max signal level (dBm) among 3 possible receivers */
+static int iwlagn_calc_rssi(struct iwl_priv *priv,
+                             struct iwl_rx_phy_res *rx_resp)
+{
+        /* data from PHY/DSP regarding signal strength, etc.,
+         *   contents are always there, not configurable by host
+         */
+        struct iwl5000_non_cfg_phy *ncphy =
+                (struct iwl5000_non_cfg_phy *)rx_resp->non_cfg_phy_buf;
+        u32 val, rssi_a, rssi_b, rssi_c, max_rssi;
+        u8 agc;
+
+        val  = le32_to_cpu(ncphy->non_cfg_phy[IWL50_RX_RES_AGC_IDX]);
+        agc = (val & IWL50_OFDM_AGC_MSK) >> IWL50_OFDM_AGC_BIT_POS;
+
+        /* Find max rssi among 3 possible receivers.
+         * These values are measured by the digital signal processor (DSP).
+         * They should stay fairly constant even as the signal strength varies,
+         *   if the radio's automatic gain control (AGC) is working right.
+         * AGC value (see below) will provide the "interesting" info.
+         */
+        val = le32_to_cpu(ncphy->non_cfg_phy[IWL50_RX_RES_RSSI_AB_IDX]);
+        rssi_a = (val & IWL50_OFDM_RSSI_A_MSK) >> IWL50_OFDM_RSSI_A_BIT_POS;
+        rssi_b = (val & IWL50_OFDM_RSSI_B_MSK) >> IWL50_OFDM_RSSI_B_BIT_POS;
+        val = le32_to_cpu(ncphy->non_cfg_phy[IWL50_RX_RES_RSSI_C_IDX]);
+        rssi_c = (val & IWL50_OFDM_RSSI_C_MSK) >> IWL50_OFDM_RSSI_C_BIT_POS;
+
+        max_rssi = max_t(u32, rssi_a, rssi_b);
+        max_rssi = max_t(u32, max_rssi, rssi_c);
+
+        IWL_DEBUG_STATS(priv, "Rssi In A %d B %d C %d Max %d AGC dB %d\n",
+                rssi_a, rssi_b, rssi_c, max_rssi, agc);
+
+        /* dBm = max_rssi dB - agc dB - constant.
+         * Higher AGC (higher radio gain) means lower signal. */
+        return max_rssi - agc - IWLAGN_RSSI_OFFSET;
+}
+
+struct iwl_hcmd_ops iwlagn_hcmd = {
+        .rxon_assoc = iwlagn_send_rxon_assoc,
+        .commit_rxon = iwl_commit_rxon,
+        .set_rxon_chain = iwl_set_rxon_chain,
+        .set_tx_ant = iwlagn_send_tx_ant_config,
+};
+
+struct iwl_hcmd_utils_ops iwlagn_hcmd_utils = {
+        .get_hcmd_size = iwlagn_get_hcmd_size,
+        .build_addsta_hcmd = iwlagn_build_addsta_hcmd,
+        .gain_computation = iwlagn_gain_computation,
+        .chain_noise_reset = iwlagn_chain_noise_reset,
+        .rts_tx_cmd_flag = iwlagn_rts_tx_cmd_flag,
+        .calc_rssi = iwlagn_calc_rssi,
+};
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-hw.h b/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
new file mode 100644
index 000000000000..f9a3fbb6338f
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
@@ -0,0 +1,118 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2007 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+/*
+ * Please use this file (iwl-agn-hw.h) only for hardware-related definitions.
+ */
+
+#ifndef __iwl_agn_hw_h__
+#define __iwl_agn_hw_h__
+
+#define IWLAGN_RTC_INST_LOWER_BOUND             (0x000000)
+#define IWLAGN_RTC_INST_UPPER_BOUND             (0x020000)
+
+#define IWLAGN_RTC_DATA_LOWER_BOUND             (0x800000)
+#define IWLAGN_RTC_DATA_UPPER_BOUND             (0x80C000)
+
+#define IWLAGN_RTC_INST_SIZE (IWLAGN_RTC_INST_UPPER_BOUND - \
+                                IWLAGN_RTC_INST_LOWER_BOUND)
+#define IWLAGN_RTC_DATA_SIZE (IWLAGN_RTC_DATA_UPPER_BOUND - \
+                                IWLAGN_RTC_DATA_LOWER_BOUND)
+
+/* RSSI to dBm */
+#define IWLAGN_RSSI_OFFSET      44
+
+/* PCI registers */
+#define PCI_CFG_RETRY_TIMEOUT   0x041
+
+/* PCI register values */
+#define PCI_CFG_LINK_CTRL_VAL_L0S_EN    0x01
+#define PCI_CFG_LINK_CTRL_VAL_L1_EN     0x02
+
+#define IWLAGN_DEFAULT_TX_RETRY  15
+
+/* Limit range of txpower output target to be between these values */
+#define IWLAGN_TX_POWER_TARGET_POWER_MIN        (0)     /* 0 dBm: 1 milliwatt */
+#define IWLAGN_TX_POWER_TARGET_POWER_MAX        (16)    /* 16 dBm */
+
+/* EEPROM */
+#define IWLAGN_EEPROM_IMG_SIZE          2048
+
+#define IWLAGN_CMD_FIFO_NUM             7
+#define IWLAGN_NUM_QUEUES               20
+#define IWLAGN_NUM_AMPDU_QUEUES         10
+#define IWLAGN_FIRST_AMPDU_QUEUE        10
+
+/* Fixed (non-configurable) rx data from phy */
+
+/**
+ * struct iwlagn_schedq_bc_tbl scheduler byte count table
+ *      base physical address provided by SCD_DRAM_BASE_ADDR
+ * @tfd_offset  0-12 - tx command byte count
+ *             12-16 - station index
+ */
+struct iwlagn_scd_bc_tbl {
+        __le16 tfd_offset[TFD_QUEUE_BC_SIZE];
+} __attribute__ ((packed));
+
+
+#endif /* __iwl_agn_hw_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-ict.c b/drivers/net/wireless/iwlwifi/iwl-agn-ict.c
new file mode 100644
index 000000000000..a273e373b7b0
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-ict.c
@@ -0,0 +1,307 @@
+/******************************************************************************
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *****************************************************************************/
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/etherdevice.h>
+#include <linux/sched.h>
+#include <net/mac80211.h>
+
+#include "iwl-dev.h"
+#include "iwl-core.h"
+#include "iwl-agn.h"
+#include "iwl-helpers.h"
+
+#define ICT_COUNT (PAGE_SIZE/sizeof(u32))
+
+/* Free dram table */
+void iwl_free_isr_ict(struct iwl_priv *priv)
+{
+        if (priv->_agn.ict_tbl_vir) {
+                dma_free_coherent(&priv->pci_dev->dev,
+                                  (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
+                                  priv->_agn.ict_tbl_vir,
+                                  priv->_agn.ict_tbl_dma);
+                priv->_agn.ict_tbl_vir = NULL;
+        }
+}
+
+
+/* allocate dram shared table it is a PAGE_SIZE aligned
+ * also reset all data related to ICT table interrupt.
+ */
+int iwl_alloc_isr_ict(struct iwl_priv *priv)
+{
+
+        if (priv->cfg->use_isr_legacy)
+                return 0;
+        /* allocate shrared data table */
+        priv->_agn.ict_tbl_vir =
+                dma_alloc_coherent(&priv->pci_dev->dev,
+                                   (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
+                                   &priv->_agn.ict_tbl_dma, GFP_KERNEL);
+        if (!priv->_agn.ict_tbl_vir)
+                return -ENOMEM;
+
+        /* align table to PAGE_SIZE boundry */
+        priv->_agn.aligned_ict_tbl_dma = ALIGN(priv->_agn.ict_tbl_dma, PAGE_SIZE);
+
+        IWL_DEBUG_ISR(priv, "ict dma addr %Lx dma aligned %Lx diff %d\n",
+                             (unsigned long long)priv->_agn.ict_tbl_dma,
+                             (unsigned long long)priv->_agn.aligned_ict_tbl_dma,
+                        (int)(priv->_agn.aligned_ict_tbl_dma - priv->_agn.ict_tbl_dma));
+
+        priv->_agn.ict_tbl =  priv->_agn.ict_tbl_vir +
+                          (priv->_agn.aligned_ict_tbl_dma - priv->_agn.ict_tbl_dma);
+
+        IWL_DEBUG_ISR(priv, "ict vir addr %p vir aligned %p diff %d\n",
+                             priv->_agn.ict_tbl, priv->_agn.ict_tbl_vir,
+                        (int)(priv->_agn.aligned_ict_tbl_dma - priv->_agn.ict_tbl_dma));
+
+        /* reset table and index to all 0 */
+        memset(priv->_agn.ict_tbl_vir,0, (sizeof(u32) * ICT_COUNT) + PAGE_SIZE);
+        priv->_agn.ict_index = 0;
+
+        /* add periodic RX interrupt */
+        priv->inta_mask |= CSR_INT_BIT_RX_PERIODIC;
+        return 0;
+}
+
+/* Device is going up inform it about using ICT interrupt table,
+ * also we need to tell the driver to start using ICT interrupt.
+ */
+int iwl_reset_ict(struct iwl_priv *priv)
+{
+        u32 val;
+        unsigned long flags;
+
+        if (!priv->_agn.ict_tbl_vir)
+                return 0;
+
+        spin_lock_irqsave(&priv->lock, flags);
+        iwl_disable_interrupts(priv);
+
+        memset(&priv->_agn.ict_tbl[0], 0, sizeof(u32) * ICT_COUNT);
+
+        val = priv->_agn.aligned_ict_tbl_dma >> PAGE_SHIFT;
+
+        val |= CSR_DRAM_INT_TBL_ENABLE;
+        val |= CSR_DRAM_INIT_TBL_WRAP_CHECK;
+
+        IWL_DEBUG_ISR(priv, "CSR_DRAM_INT_TBL_REG =0x%X "
+                        "aligned dma address %Lx\n",
+                        val, (unsigned long long)priv->_agn.aligned_ict_tbl_dma);
+
+        iwl_write32(priv, CSR_DRAM_INT_TBL_REG, val);
+        priv->_agn.use_ict = true;
+        priv->_agn.ict_index = 0;
+        iwl_write32(priv, CSR_INT, priv->inta_mask);
+        iwl_enable_interrupts(priv);
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        return 0;
+}
+
+/* Device is going down disable ict interrupt usage */
+void iwl_disable_ict(struct iwl_priv *priv)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->lock, flags);
+        priv->_agn.use_ict = false;
+        spin_unlock_irqrestore(&priv->lock, flags);
+}
+
+static irqreturn_t iwl_isr(int irq, void *data)
+{
+        struct iwl_priv *priv = data;
+        u32 inta, inta_mask;
+        unsigned long flags;
+#ifdef CONFIG_IWLWIFI_DEBUG
+        u32 inta_fh;
+#endif
+        if (!priv)
+                return IRQ_NONE;
+
+        spin_lock_irqsave(&priv->lock, flags);
+
+        /* Disable (but don't clear!) interrupts here to avoid
+         *    back-to-back ISRs and sporadic interrupts from our NIC.
+         * If we have something to service, the tasklet will re-enable ints.
+         * If we *don't* have something, we'll re-enable before leaving here. */
+        inta_mask = iwl_read32(priv, CSR_INT_MASK);  /* just for debug */
+        iwl_write32(priv, CSR_INT_MASK, 0x00000000);
+
+        /* Discover which interrupts are active/pending */
+        inta = iwl_read32(priv, CSR_INT);
+
+        /* Ignore interrupt if there's nothing in NIC to service.
+         * This may be due to IRQ shared with another device,
+         * or due to sporadic interrupts thrown from our NIC. */
+        if (!inta) {
+                IWL_DEBUG_ISR(priv, "Ignore interrupt, inta == 0\n");
+                goto none;
+        }
+
+        if ((inta == 0xFFFFFFFF) || ((inta & 0xFFFFFFF0) == 0xa5a5a5a0)) {
+                /* Hardware disappeared. It might have already raised
+                 * an interrupt */
+                IWL_WARN(priv, "HARDWARE GONE?? INTA == 0x%08x\n", inta);
+                goto unplugged;
+        }
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+        if (iwl_get_debug_level(priv) & (IWL_DL_ISR)) {
+                inta_fh = iwl_read32(priv, CSR_FH_INT_STATUS);
+                IWL_DEBUG_ISR(priv, "ISR inta 0x%08x, enabled 0x%08x, "
+                              "fh 0x%08x\n", inta, inta_mask, inta_fh);
+        }
+#endif
+
+        priv->_agn.inta |= inta;
+        /* iwl_irq_tasklet() will service interrupts and re-enable them */
+        if (likely(inta))
+                tasklet_schedule(&priv->irq_tasklet);
+        else if (test_bit(STATUS_INT_ENABLED, &priv->status) && !priv->_agn.inta)
+                iwl_enable_interrupts(priv);
+
+ unplugged:
+        spin_unlock_irqrestore(&priv->lock, flags);
+        return IRQ_HANDLED;
+
+ none:
+        /* re-enable interrupts here since we don't have anything to service. */
+        /* only Re-enable if diabled by irq  and no schedules tasklet. */
+        if (test_bit(STATUS_INT_ENABLED, &priv->status) && !priv->_agn.inta)
+                iwl_enable_interrupts(priv);
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+        return IRQ_NONE;
+}
+
+/* interrupt handler using ict table, with this interrupt driver will
+ * stop using INTA register to get device's interrupt, reading this register
+ * is expensive, device will write interrupts in ICT dram table, increment
+ * index then will fire interrupt to driver, driver will OR all ICT table
+ * entries from current index up to table entry with 0 value. the result is
+ * the interrupt we need to service, driver will set the entries back to 0 and
+ * set index.
+ */
+irqreturn_t iwl_isr_ict(int irq, void *data)
+{
+        struct iwl_priv *priv = data;
+        u32 inta, inta_mask;
+        u32 val = 0;
+        unsigned long flags;
+
+        if (!priv)
+                return IRQ_NONE;
+
+        /* dram interrupt table not set yet,
+         * use legacy interrupt.
+         */
+        if (!priv->_agn.use_ict)
+                return iwl_isr(irq, data);
+
+        spin_lock_irqsave(&priv->lock, flags);
+
+        /* Disable (but don't clear!) interrupts here to avoid
+         * back-to-back ISRs and sporadic interrupts from our NIC.
+         * If we have something to service, the tasklet will re-enable ints.
+         * If we *don't* have something, we'll re-enable before leaving here.
+         */
+        inta_mask = iwl_read32(priv, CSR_INT_MASK);  /* just for debug */
+        iwl_write32(priv, CSR_INT_MASK, 0x00000000);
+
+
+        /* Ignore interrupt if there's nothing in NIC to service.
+         * This may be due to IRQ shared with another device,
+         * or due to sporadic interrupts thrown from our NIC. */
+        if (!priv->_agn.ict_tbl[priv->_agn.ict_index]) {
+                IWL_DEBUG_ISR(priv, "Ignore interrupt, inta == 0\n");
+                goto none;
+        }
+
+        /* read all entries that not 0 start with ict_index */
+        while (priv->_agn.ict_tbl[priv->_agn.ict_index]) {
+
+                val |= le32_to_cpu(priv->_agn.ict_tbl[priv->_agn.ict_index]);
+                IWL_DEBUG_ISR(priv, "ICT index %d value 0x%08X\n",
+                                priv->_agn.ict_index,
+                                le32_to_cpu(priv->_agn.ict_tbl[priv->_agn.ict_index]));
+                priv->_agn.ict_tbl[priv->_agn.ict_index] = 0;
+                priv->_agn.ict_index = iwl_queue_inc_wrap(priv->_agn.ict_index,
+                                                     ICT_COUNT);
+
+        }
+
+        /* We should not get this value, just ignore it. */
+        if (val == 0xffffffff)
+                val = 0;
+
+        /*
+         * this is a w/a for a h/w bug. the h/w bug may cause the Rx bit
+         * (bit 15 before shifting it to 31) to clear when using interrupt
+         * coalescing. fortunately, bits 18 and 19 stay set when this happens
+         * so we use them to decide on the real state of the Rx bit.
+         * In order words, bit 15 is set if bit 18 or bit 19 are set.
+         */
+        if (val & 0xC0000)
+                val |= 0x8000;
+
+        inta = (0xff & val) | ((0xff00 & val) << 16);
+        IWL_DEBUG_ISR(priv, "ISR inta 0x%08x, enabled 0x%08x ict 0x%08x\n",
+                        inta, inta_mask, val);
+
+        inta &= priv->inta_mask;
+        priv->_agn.inta |= inta;
+
+        /* iwl_irq_tasklet() will service interrupts and re-enable them */
+        if (likely(inta))
+                tasklet_schedule(&priv->irq_tasklet);
+        else if (test_bit(STATUS_INT_ENABLED, &priv->status) && !priv->_agn.inta) {
+                /* Allow interrupt if was disabled by this handler and
+                 * no tasklet was schedules, We should not enable interrupt,
+                 * tasklet will enable it.
+                 */
+                iwl_enable_interrupts(priv);
+        }
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+        return IRQ_HANDLED;
+
+ none:
+        /* re-enable interrupts here since we don't have anything to service.
+         * only Re-enable if disabled by irq.
+         */
+        if (test_bit(STATUS_INT_ENABLED, &priv->status) && !priv->_agn.inta)
+                iwl_enable_interrupts(priv);
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+        return IRQ_NONE;
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
new file mode 100644
index 000000000000..49e20f1acb7c
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
@@ -0,0 +1,1103 @@
+/******************************************************************************
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ *****************************************************************************/
+#include <linux/etherdevice.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/sched.h>
+
+#include "iwl-dev.h"
+#include "iwl-core.h"
+#include "iwl-io.h"
+#include "iwl-helpers.h"
+#include "iwl-agn-hw.h"
+#include "iwl-agn.h"
+
+static inline u32 iwlagn_get_scd_ssn(struct iwl5000_tx_resp *tx_resp)
+{
+        return le32_to_cpup((__le32 *)&tx_resp->status +
+                            tx_resp->frame_count) & MAX_SN;
+}
+
+static int iwlagn_tx_status_reply_tx(struct iwl_priv *priv,
+                                      struct iwl_ht_agg *agg,
+                                      struct iwl5000_tx_resp *tx_resp,
+                                      int txq_id, u16 start_idx)
+{
+        u16 status;
+        struct agg_tx_status *frame_status = &tx_resp->status;
+        struct ieee80211_tx_info *info = NULL;
+        struct ieee80211_hdr *hdr = NULL;
+        u32 rate_n_flags = le32_to_cpu(tx_resp->rate_n_flags);
+        int i, sh, idx;
+        u16 seq;
+
+        if (agg->wait_for_ba)
+                IWL_DEBUG_TX_REPLY(priv, "got tx response w/o block-ack\n");
+
+        agg->frame_count = tx_resp->frame_count;
+        agg->start_idx = start_idx;
+        agg->rate_n_flags = rate_n_flags;
+        agg->bitmap = 0;
+
+        /* # frames attempted by Tx command */
+        if (agg->frame_count == 1) {
+                /* Only one frame was attempted; no block-ack will arrive */
+                status = le16_to_cpu(frame_status[0].status);
+                idx = start_idx;
+
+                /* FIXME: code repetition */
+                IWL_DEBUG_TX_REPLY(priv, "FrameCnt = %d, StartIdx=%d idx=%d\n",
+                                   agg->frame_count, agg->start_idx, idx);
+
+                info = IEEE80211_SKB_CB(priv->txq[txq_id].txb[idx].skb[0]);
+                info->status.rates[0].count = tx_resp->failure_frame + 1;
+                info->flags &= ~IEEE80211_TX_CTL_AMPDU;
+                info->flags |= iwl_tx_status_to_mac80211(status);
+                iwlagn_hwrate_to_tx_control(priv, rate_n_flags, info);
+
+                /* FIXME: code repetition end */
+
+                IWL_DEBUG_TX_REPLY(priv, "1 Frame 0x%x failure :%d\n",
+                                    status & 0xff, tx_resp->failure_frame);
+                IWL_DEBUG_TX_REPLY(priv, "Rate Info rate_n_flags=%x\n", rate_n_flags);
+
+                agg->wait_for_ba = 0;
+        } else {
+                /* Two or more frames were attempted; expect block-ack */
+                u64 bitmap = 0;
+                int start = agg->start_idx;
+
+                /* Construct bit-map of pending frames within Tx window */
+                for (i = 0; i < agg->frame_count; i++) {
+                        u16 sc;
+                        status = le16_to_cpu(frame_status[i].status);
+                        seq  = le16_to_cpu(frame_status[i].sequence);
+                        idx = SEQ_TO_INDEX(seq);
+                        txq_id = SEQ_TO_QUEUE(seq);
+
+                        if (status & (AGG_TX_STATE_FEW_BYTES_MSK |
+                                      AGG_TX_STATE_ABORT_MSK))
+                                continue;
+
+                        IWL_DEBUG_TX_REPLY(priv, "FrameCnt = %d, txq_id=%d idx=%d\n",
+                                           agg->frame_count, txq_id, idx);
+
+                        hdr = iwl_tx_queue_get_hdr(priv, txq_id, idx);
+                        if (!hdr) {
+                                IWL_ERR(priv,
+                                        "BUG_ON idx doesn't point to valid skb"
+                                        " idx=%d, txq_id=%d\n", idx, txq_id);
+                                return -1;
+                        }
+
+                        sc = le16_to_cpu(hdr->seq_ctrl);
+                        if (idx != (SEQ_TO_SN(sc) & 0xff)) {
+                                IWL_ERR(priv,
+                                        "BUG_ON idx doesn't match seq control"
+                                        " idx=%d, seq_idx=%d, seq=%d\n",
+                                          idx, SEQ_TO_SN(sc),
+                                          hdr->seq_ctrl);
+                                return -1;
+                        }
+
+                        IWL_DEBUG_TX_REPLY(priv, "AGG Frame i=%d idx %d seq=%d\n",
+                                           i, idx, SEQ_TO_SN(sc));
+
+                        sh = idx - start;
+                        if (sh > 64) {
+                                sh = (start - idx) + 0xff;
+                                bitmap = bitmap << sh;
+                                sh = 0;
+                                start = idx;
+                        } else if (sh < -64)
+                                sh  = 0xff - (start - idx);
+                        else if (sh < 0) {
+                                sh = start - idx;
+                                start = idx;
+                                bitmap = bitmap << sh;
+                                sh = 0;
+                        }
+                        bitmap |= 1ULL << sh;
+                        IWL_DEBUG_TX_REPLY(priv, "start=%d bitmap=0x%llx\n",
+                                           start, (unsigned long long)bitmap);
+                }
+
+                agg->bitmap = bitmap;
+                agg->start_idx = start;
+                IWL_DEBUG_TX_REPLY(priv, "Frames %d start_idx=%d bitmap=0x%llx\n",
+                                   agg->frame_count, agg->start_idx,
+                                   (unsigned long long)agg->bitmap);
+
+                if (bitmap)
+                        agg->wait_for_ba = 1;
+        }
+        return 0;
+}
+
+static void iwlagn_rx_reply_tx(struct iwl_priv *priv,
+                                struct iwl_rx_mem_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        u16 sequence = le16_to_cpu(pkt->hdr.sequence);
+        int txq_id = SEQ_TO_QUEUE(sequence);
+        int index = SEQ_TO_INDEX(sequence);
+        struct iwl_tx_queue *txq = &priv->txq[txq_id];
+        struct ieee80211_tx_info *info;
+        struct iwl5000_tx_resp *tx_resp = (void *)&pkt->u.raw[0];
+        u32  status = le16_to_cpu(tx_resp->status.status);
+        int tid;
+        int sta_id;
+        int freed;
+
+        if ((index >= txq->q.n_bd) || (iwl_queue_used(&txq->q, index) == 0)) {
+                IWL_ERR(priv, "Read index for DMA queue txq_id (%d) index %d "
+                          "is out of range [0-%d] %d %d\n", txq_id,
+                          index, txq->q.n_bd, txq->q.write_ptr,
+                          txq->q.read_ptr);
+                return;
+        }
+
+        info = IEEE80211_SKB_CB(txq->txb[txq->q.read_ptr].skb[0]);
+        memset(&info->status, 0, sizeof(info->status));
+
+        tid = (tx_resp->ra_tid & IWL50_TX_RES_TID_MSK) >> IWL50_TX_RES_TID_POS;
+        sta_id = (tx_resp->ra_tid & IWL50_TX_RES_RA_MSK) >> IWL50_TX_RES_RA_POS;
+
+        if (txq->sched_retry) {
+                const u32 scd_ssn = iwlagn_get_scd_ssn(tx_resp);
+                struct iwl_ht_agg *agg = NULL;
+
+                agg = &priv->stations[sta_id].tid[tid].agg;
+
+                iwlagn_tx_status_reply_tx(priv, agg, tx_resp, txq_id, index);
+
+                /* check if BAR is needed */
+                if ((tx_resp->frame_count == 1) && !iwl_is_tx_success(status))
+                        info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
+
+                if (txq->q.read_ptr != (scd_ssn & 0xff)) {
+                        index = iwl_queue_dec_wrap(scd_ssn & 0xff, txq->q.n_bd);
+                        IWL_DEBUG_TX_REPLY(priv, "Retry scheduler reclaim "
+                                        "scd_ssn=%d idx=%d txq=%d swq=%d\n",
+                                        scd_ssn , index, txq_id, txq->swq_id);
+
+                        freed = iwlagn_tx_queue_reclaim(priv, txq_id, index);
+                        iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
+
+                        if (priv->mac80211_registered &&
+                            (iwl_queue_space(&txq->q) > txq->q.low_mark) &&
+                            (agg->state != IWL_EMPTYING_HW_QUEUE_DELBA)) {
+                                if (agg->state == IWL_AGG_OFF)
+                                        iwl_wake_queue(priv, txq_id);
+                                else
+                                        iwl_wake_queue(priv, txq->swq_id);
+                        }
+                }
+        } else {
+                BUG_ON(txq_id != txq->swq_id);
+
+                info->status.rates[0].count = tx_resp->failure_frame + 1;
+                info->flags |= iwl_tx_status_to_mac80211(status);
+                iwlagn_hwrate_to_tx_control(priv,
+                                        le32_to_cpu(tx_resp->rate_n_flags),
+                                        info);
+
+                IWL_DEBUG_TX_REPLY(priv, "TXQ %d status %s (0x%08x) rate_n_flags "
+                                   "0x%x retries %d\n",
+                                   txq_id,
+                                   iwl_get_tx_fail_reason(status), status,
+                                   le32_to_cpu(tx_resp->rate_n_flags),
+                                   tx_resp->failure_frame);
+
+                freed = iwlagn_tx_queue_reclaim(priv, txq_id, index);
+                iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
+
+                if (priv->mac80211_registered &&
+                    (iwl_queue_space(&txq->q) > txq->q.low_mark))
+                        iwl_wake_queue(priv, txq_id);
+        }
+
+        iwlagn_txq_check_empty(priv, sta_id, tid, txq_id);
+
+        if (iwl_check_bits(status, TX_ABORT_REQUIRED_MSK))
+                IWL_ERR(priv, "TODO:  Implement Tx ABORT REQUIRED!!!\n");
+}
+
+void iwlagn_rx_handler_setup(struct iwl_priv *priv)
+{
+        /* init calibration handlers */
+        priv->rx_handlers[CALIBRATION_RES_NOTIFICATION] =
+                                        iwlagn_rx_calib_result;
+        priv->rx_handlers[CALIBRATION_COMPLETE_NOTIFICATION] =
+                                        iwlagn_rx_calib_complete;
+        priv->rx_handlers[REPLY_TX] = iwlagn_rx_reply_tx;
+}
+
+void iwlagn_setup_deferred_work(struct iwl_priv *priv)
+{
+        /* in agn, the tx power calibration is done in uCode */
+        priv->disable_tx_power_cal = 1;
+}
+
+int iwlagn_hw_valid_rtc_data_addr(u32 addr)
+{
+        return (addr >= IWLAGN_RTC_DATA_LOWER_BOUND) &&
+                (addr < IWLAGN_RTC_DATA_UPPER_BOUND);
+}
+
+int iwlagn_send_tx_power(struct iwl_priv *priv)
+{
+        struct iwl5000_tx_power_dbm_cmd tx_power_cmd;
+        u8 tx_ant_cfg_cmd;
+
+        /* half dBm need to multiply */
+        tx_power_cmd.global_lmt = (s8)(2 * priv->tx_power_user_lmt);
+
+        if (priv->tx_power_lmt_in_half_dbm &&
+            priv->tx_power_lmt_in_half_dbm < tx_power_cmd.global_lmt) {
+                /*
+                 * For the newer devices which using enhanced/extend tx power
+                 * table in EEPROM, the format is in half dBm. driver need to
+                 * convert to dBm format before report to mac80211.
+                 * By doing so, there is a possibility of 1/2 dBm resolution
+                 * lost. driver will perform "round-up" operation before
+                 * reporting, but it will cause 1/2 dBm tx power over the
+                 * regulatory limit. Perform the checking here, if the
+                 * "tx_power_user_lmt" is higher than EEPROM value (in
+                 * half-dBm format), lower the tx power based on EEPROM
+                 */
+                tx_power_cmd.global_lmt = priv->tx_power_lmt_in_half_dbm;
+        }
+        tx_power_cmd.flags = IWL50_TX_POWER_NO_CLOSED;
+        tx_power_cmd.srv_chan_lmt = IWL50_TX_POWER_AUTO;
+
+        if (IWL_UCODE_API(priv->ucode_ver) == 1)
+                tx_ant_cfg_cmd = REPLY_TX_POWER_DBM_CMD_V1;
+        else
+                tx_ant_cfg_cmd = REPLY_TX_POWER_DBM_CMD;
+
+        return  iwl_send_cmd_pdu_async(priv, tx_ant_cfg_cmd,
+                                       sizeof(tx_power_cmd), &tx_power_cmd,
+                                       NULL);
+}
+
+void iwlagn_temperature(struct iwl_priv *priv)
+{
+        /* store temperature from statistics (in Celsius) */
+        priv->temperature = le32_to_cpu(priv->statistics.general.temperature);
+        iwl_tt_handler(priv);
+}
+
+u16 iwlagn_eeprom_calib_version(struct iwl_priv *priv)
+{
+        struct iwl_eeprom_calib_hdr {
+                u8 version;
+                u8 pa_type;
+                u16 voltage;
+        } *hdr;
+
+        hdr = (struct iwl_eeprom_calib_hdr *)iwl_eeprom_query_addr(priv,
+                                                        EEPROM_5000_CALIB_ALL);
+        return hdr->version;
+
+}
+
+/*
+ * EEPROM
+ */
+static u32 eeprom_indirect_address(const struct iwl_priv *priv, u32 address)
+{
+        u16 offset = 0;
+
+        if ((address & INDIRECT_ADDRESS) == 0)
+                return address;
+
+        switch (address & INDIRECT_TYPE_MSK) {
+        case INDIRECT_HOST:
+                offset = iwl_eeprom_query16(priv, EEPROM_5000_LINK_HOST);
+                break;
+        case INDIRECT_GENERAL:
+                offset = iwl_eeprom_query16(priv, EEPROM_5000_LINK_GENERAL);
+                break;
+        case INDIRECT_REGULATORY:
+                offset = iwl_eeprom_query16(priv, EEPROM_5000_LINK_REGULATORY);
+                break;
+        case INDIRECT_CALIBRATION:
+                offset = iwl_eeprom_query16(priv, EEPROM_5000_LINK_CALIBRATION);
+                break;
+        case INDIRECT_PROCESS_ADJST:
+                offset = iwl_eeprom_query16(priv, EEPROM_5000_LINK_PROCESS_ADJST);
+                break;
+        case INDIRECT_OTHERS:
+                offset = iwl_eeprom_query16(priv, EEPROM_5000_LINK_OTHERS);
+                break;
+        default:
+                IWL_ERR(priv, "illegal indirect type: 0x%X\n",
+                address & INDIRECT_TYPE_MSK);
+                break;
+        }
+
+        /* translate the offset from words to byte */
+        return (address & ADDRESS_MSK) + (offset << 1);
+}
+
+const u8 *iwlagn_eeprom_query_addr(const struct iwl_priv *priv,
+                                           size_t offset)
+{
+        u32 address = eeprom_indirect_address(priv, offset);
+        BUG_ON(address >= priv->cfg->eeprom_size);
+        return &priv->eeprom[address];
+}
+
+struct iwl_mod_params iwlagn_mod_params = {
+        .amsdu_size_8K = 1,
+        .restart_fw = 1,
+        /* the rest are 0 by default */
+};
+
+void iwlagn_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
+{
+        unsigned long flags;
+        int i;
+        spin_lock_irqsave(&rxq->lock, flags);
+        INIT_LIST_HEAD(&rxq->rx_free);
+        INIT_LIST_HEAD(&rxq->rx_used);
+        /* Fill the rx_used queue with _all_ of the Rx buffers */
+        for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
+                /* In the reset function, these buffers may have been allocated
+                 * to an SKB, so we need to unmap and free potential storage */
+                if (rxq->pool[i].page != NULL) {
+                        pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
+                                PAGE_SIZE << priv->hw_params.rx_page_order,
+                                PCI_DMA_FROMDEVICE);
+                        __iwl_free_pages(priv, rxq->pool[i].page);
+                        rxq->pool[i].page = NULL;
+                }
+                list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
+        }
+
+        for (i = 0; i < RX_QUEUE_SIZE; i++)
+                rxq->queue[i] = NULL;
+
+        /* Set us so that we have processed and used all buffers, but have
+         * not restocked the Rx queue with fresh buffers */
+        rxq->read = rxq->write = 0;
+        rxq->write_actual = 0;
+        rxq->free_count = 0;
+        spin_unlock_irqrestore(&rxq->lock, flags);
+}
+
+int iwlagn_rx_init(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
+{
+        u32 rb_size;
+        const u32 rfdnlog = RX_QUEUE_SIZE_LOG; /* 256 RBDs */
+        u32 rb_timeout = 0; /* FIXME: RX_RB_TIMEOUT for all devices? */
+
+        if (!priv->cfg->use_isr_legacy)
+                rb_timeout = RX_RB_TIMEOUT;
+
+        if (priv->cfg->mod_params->amsdu_size_8K)
+                rb_size = FH_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_8K;
+        else
+                rb_size = FH_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_4K;
+
+        /* Stop Rx DMA */
+        iwl_write_direct32(priv, FH_MEM_RCSR_CHNL0_CONFIG_REG, 0);
+
+        /* Reset driver's Rx queue write index */
+        iwl_write_direct32(priv, FH_RSCSR_CHNL0_RBDCB_WPTR_REG, 0);
+
+        /* Tell device where to find RBD circular buffer in DRAM */
+        iwl_write_direct32(priv, FH_RSCSR_CHNL0_RBDCB_BASE_REG,
+                           (u32)(rxq->dma_addr >> 8));
+
+        /* Tell device where in DRAM to update its Rx status */
+        iwl_write_direct32(priv, FH_RSCSR_CHNL0_STTS_WPTR_REG,
+                           rxq->rb_stts_dma >> 4);
+
+        /* Enable Rx DMA
+         * FH_RCSR_CHNL0_RX_IGNORE_RXF_EMPTY is set because of HW bug in
+         *      the credit mechanism in 5000 HW RX FIFO
+         * Direct rx interrupts to hosts
+         * Rx buffer size 4 or 8k
+         * RB timeout 0x10
+         * 256 RBDs
+         */
+        iwl_write_direct32(priv, FH_MEM_RCSR_CHNL0_CONFIG_REG,
+                           FH_RCSR_RX_CONFIG_CHNL_EN_ENABLE_VAL |
+                           FH_RCSR_CHNL0_RX_IGNORE_RXF_EMPTY |
+                           FH_RCSR_CHNL0_RX_CONFIG_IRQ_DEST_INT_HOST_VAL |
+                           FH_RCSR_CHNL0_RX_CONFIG_SINGLE_FRAME_MSK |
+                           rb_size|
+                           (rb_timeout << FH_RCSR_RX_CONFIG_REG_IRQ_RBTH_POS)|
+                           (rfdnlog << FH_RCSR_RX_CONFIG_RBDCB_SIZE_POS));
+
+        /* Set interrupt coalescing timer to default (2048 usecs) */
+        iwl_write8(priv, CSR_INT_COALESCING, IWL_HOST_INT_TIMEOUT_DEF);
+
+        return 0;
+}
+
+int iwlagn_hw_nic_init(struct iwl_priv *priv)
+{
+        unsigned long flags;
+        struct iwl_rx_queue *rxq = &priv->rxq;
+        int ret;
+
+        /* nic_init */
+        spin_lock_irqsave(&priv->lock, flags);
+        priv->cfg->ops->lib->apm_ops.init(priv);
+
+        /* Set interrupt coalescing calibration timer to default (512 usecs) */
+        iwl_write8(priv, CSR_INT_COALESCING, IWL_HOST_INT_CALIB_TIMEOUT_DEF);
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        ret = priv->cfg->ops->lib->apm_ops.set_pwr_src(priv, IWL_PWR_SRC_VMAIN);
+
+        priv->cfg->ops->lib->apm_ops.config(priv);
+
+        /* Allocate the RX queue, or reset if it is already allocated */
+        if (!rxq->bd) {
+                ret = iwl_rx_queue_alloc(priv);
+                if (ret) {
+                        IWL_ERR(priv, "Unable to initialize Rx queue\n");
+                        return -ENOMEM;
+                }
+        } else
+                iwlagn_rx_queue_reset(priv, rxq);
+
+        iwlagn_rx_replenish(priv);
+
+        iwlagn_rx_init(priv, rxq);
+
+        spin_lock_irqsave(&priv->lock, flags);
+
+        rxq->need_update = 1;
+        iwl_rx_queue_update_write_ptr(priv, rxq);
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        /* Allocate and init all Tx and Command queues */
+        ret = iwlagn_txq_ctx_reset(priv);
+        if (ret)
+                return ret;
+
+        set_bit(STATUS_INIT, &priv->status);
+
+        return 0;
+}
+
+/**
+ * iwlagn_dma_addr2rbd_ptr - convert a DMA address to a uCode read buffer ptr
+ */
+static inline __le32 iwlagn_dma_addr2rbd_ptr(struct iwl_priv *priv,
+                                          dma_addr_t dma_addr)
+{
+        return cpu_to_le32((u32)(dma_addr >> 8));
+}
+
+/**
+ * iwlagn_rx_queue_restock - refill RX queue from pre-allocated pool
+ *
+ * If there are slots in the RX queue that need to be restocked,
+ * and we have free pre-allocated buffers, fill the ranks as much
+ * as we can, pulling from rx_free.
+ *
+ * This moves the 'write' index forward to catch up with 'processed', and
+ * also updates the memory address in the firmware to reference the new
+ * target buffer.
+ */
+void iwlagn_rx_queue_restock(struct iwl_priv *priv)
+{
+        struct iwl_rx_queue *rxq = &priv->rxq;
+        struct list_head *element;
+        struct iwl_rx_mem_buffer *rxb;
+        unsigned long flags;
+
+        spin_lock_irqsave(&rxq->lock, flags);
+        while ((iwl_rx_queue_space(rxq) > 0) && (rxq->free_count)) {
+                /* The overwritten rxb must be a used one */
+                rxb = rxq->queue[rxq->write];
+                BUG_ON(rxb && rxb->page);
+
+                /* Get next free Rx buffer, remove from free list */
+                element = rxq->rx_free.next;
+                rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
+                list_del(element);
+
+                /* Point to Rx buffer via next RBD in circular buffer */
+                rxq->bd[rxq->write] = iwlagn_dma_addr2rbd_ptr(priv,
+                                                              rxb->page_dma);
+                rxq->queue[rxq->write] = rxb;
+                rxq->write = (rxq->write + 1) & RX_QUEUE_MASK;
+                rxq->free_count--;
+        }
+        spin_unlock_irqrestore(&rxq->lock, flags);
+        /* If the pre-allocated buffer pool is dropping low, schedule to
+         * refill it */
+        if (rxq->free_count <= RX_LOW_WATERMARK)
+                queue_work(priv->workqueue, &priv->rx_replenish);
+
+
+        /* If we've added more space for the firmware to place data, tell it.
+         * Increment device's write pointer in multiples of 8. */
+        if (rxq->write_actual != (rxq->write & ~0x7)) {
+                spin_lock_irqsave(&rxq->lock, flags);
+                rxq->need_update = 1;
+                spin_unlock_irqrestore(&rxq->lock, flags);
+                iwl_rx_queue_update_write_ptr(priv, rxq);
+        }
+}
+
+/**
+ * iwlagn_rx_replenish - Move all used packet from rx_used to rx_free
+ *
+ * When moving to rx_free an SKB is allocated for the slot.
+ *
+ * Also restock the Rx queue via iwl_rx_queue_restock.
+ * This is called as a scheduled work item (except for during initialization)
+ */
+void iwlagn_rx_allocate(struct iwl_priv *priv, gfp_t priority)
+{
+        struct iwl_rx_queue *rxq = &priv->rxq;
+        struct list_head *element;
+        struct iwl_rx_mem_buffer *rxb;
+        struct page *page;
+        unsigned long flags;
+        gfp_t gfp_mask = priority;
+
+        while (1) {
+                spin_lock_irqsave(&rxq->lock, flags);
+                if (list_empty(&rxq->rx_used)) {
+                        spin_unlock_irqrestore(&rxq->lock, flags);
+                        return;
+                }
+                spin_unlock_irqrestore(&rxq->lock, flags);
+
+                if (rxq->free_count > RX_LOW_WATERMARK)
+                        gfp_mask |= __GFP_NOWARN;
+
+                if (priv->hw_params.rx_page_order > 0)
+                        gfp_mask |= __GFP_COMP;
+
+                /* Alloc a new receive buffer */
+                page = alloc_pages(gfp_mask, priv->hw_params.rx_page_order);
+                if (!page) {
+                        if (net_ratelimit())
+                                IWL_DEBUG_INFO(priv, "alloc_pages failed, "
+                                               "order: %d\n",
+                                               priv->hw_params.rx_page_order);
+
+                        if ((rxq->free_count <= RX_LOW_WATERMARK) &&
+                            net_ratelimit())
+                                IWL_CRIT(priv, "Failed to alloc_pages with %s. Only %u free buffers remaining.\n",
+                                         priority == GFP_ATOMIC ?  "GFP_ATOMIC" : "GFP_KERNEL",
+                                         rxq->free_count);
+                        /* We don't reschedule replenish work here -- we will
+                         * call the restock method and if it still needs
+                         * more buffers it will schedule replenish */
+                        return;
+                }
+
+                spin_lock_irqsave(&rxq->lock, flags);
+
+                if (list_empty(&rxq->rx_used)) {
+                        spin_unlock_irqrestore(&rxq->lock, flags);
+                        __free_pages(page, priv->hw_params.rx_page_order);
+                        return;
+                }
+                element = rxq->rx_used.next;
+                rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
+                list_del(element);
+
+                spin_unlock_irqrestore(&rxq->lock, flags);
+
+                BUG_ON(rxb->page);
+                rxb->page = page;
+                /* Get physical address of the RB */
+                rxb->page_dma = pci_map_page(priv->pci_dev, page, 0,
+                                PAGE_SIZE << priv->hw_params.rx_page_order,
+                                PCI_DMA_FROMDEVICE);
+                /* dma address must be no more than 36 bits */
+                BUG_ON(rxb->page_dma & ~DMA_BIT_MASK(36));
+                /* and also 256 byte aligned! */
+                BUG_ON(rxb->page_dma & DMA_BIT_MASK(8));
+
+                spin_lock_irqsave(&rxq->lock, flags);
+
+                list_add_tail(&rxb->list, &rxq->rx_free);
+                rxq->free_count++;
+                priv->alloc_rxb_page++;
+
+                spin_unlock_irqrestore(&rxq->lock, flags);
+        }
+}
+
+void iwlagn_rx_replenish(struct iwl_priv *priv)
+{
+        unsigned long flags;
+
+        iwlagn_rx_allocate(priv, GFP_KERNEL);
+
+        spin_lock_irqsave(&priv->lock, flags);
+        iwlagn_rx_queue_restock(priv);
+        spin_unlock_irqrestore(&priv->lock, flags);
+}
+
+void iwlagn_rx_replenish_now(struct iwl_priv *priv)
+{
+        iwlagn_rx_allocate(priv, GFP_ATOMIC);
+
+        iwlagn_rx_queue_restock(priv);
+}
+
+/* Assumes that the skb field of the buffers in 'pool' is kept accurate.
+ * If an SKB has been detached, the POOL needs to have its SKB set to NULL
+ * This free routine walks the list of POOL entries and if SKB is set to
+ * non NULL it is unmapped and freed
+ */
+void iwlagn_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
+{
+        int i;
+        for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
+                if (rxq->pool[i].page != NULL) {
+                        pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
+                                PAGE_SIZE << priv->hw_params.rx_page_order,
+                                PCI_DMA_FROMDEVICE);
+                        __iwl_free_pages(priv, rxq->pool[i].page);
+                        rxq->pool[i].page = NULL;
+                }
+        }
+
+        dma_free_coherent(&priv->pci_dev->dev, 4 * RX_QUEUE_SIZE, rxq->bd,
+                          rxq->dma_addr);
+        dma_free_coherent(&priv->pci_dev->dev, sizeof(struct iwl_rb_status),
+                          rxq->rb_stts, rxq->rb_stts_dma);
+        rxq->bd = NULL;
+        rxq->rb_stts  = NULL;
+}
+
+int iwlagn_rxq_stop(struct iwl_priv *priv)
+{
+
+        /* stop Rx DMA */
+        iwl_write_direct32(priv, FH_MEM_RCSR_CHNL0_CONFIG_REG, 0);
+        iwl_poll_direct_bit(priv, FH_MEM_RSSR_RX_STATUS_REG,
+                            FH_RSSR_CHNL0_RX_STATUS_CHNL_IDLE, 1000);
+
+        return 0;
+}
+
+int iwlagn_hwrate_to_mac80211_idx(u32 rate_n_flags, enum ieee80211_band band)
+{
+        int idx = 0;
+        int band_offset = 0;
+
+        /* HT rate format: mac80211 wants an MCS number, which is just LSB */
+        if (rate_n_flags & RATE_MCS_HT_MSK) {
+                idx = (rate_n_flags & 0xff);
+                return idx;
+        /* Legacy rate format, search for match in table */
+        } else {
+                if (band == IEEE80211_BAND_5GHZ)
+                        band_offset = IWL_FIRST_OFDM_RATE;
+                for (idx = band_offset; idx < IWL_RATE_COUNT_LEGACY; idx++)
+                        if (iwl_rates[idx].plcp == (rate_n_flags & 0xFF))
+                                return idx - band_offset;
+        }
+
+        return -1;
+}
+
+/* Calc max signal level (dBm) among 3 possible receivers */
+static inline int iwlagn_calc_rssi(struct iwl_priv *priv,
+                                struct iwl_rx_phy_res *rx_resp)
+{
+        return priv->cfg->ops->utils->calc_rssi(priv, rx_resp);
+}
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+/**
+ * iwlagn_dbg_report_frame - dump frame to syslog during debug sessions
+ *
+ * You may hack this function to show different aspects of received frames,
+ * including selective frame dumps.
+ * group100 parameter selects whether to show 1 out of 100 good data frames.
+ *    All beacon and probe response frames are printed.
+ */
+static void iwlagn_dbg_report_frame(struct iwl_priv *priv,
+                      struct iwl_rx_phy_res *phy_res, u16 length,
+                      struct ieee80211_hdr *header, int group100)
+{
+        u32 to_us;
+        u32 print_summary = 0;
+        u32 print_dump = 0;     /* set to 1 to dump all frames' contents */
+        u32 hundred = 0;
+        u32 dataframe = 0;
+        __le16 fc;
+        u16 seq_ctl;
+        u16 channel;
+        u16 phy_flags;
+        u32 rate_n_flags;
+        u32 tsf_low;
+        int rssi;
+
+        if (likely(!(iwl_get_debug_level(priv) & IWL_DL_RX)))
+                return;
+
+        /* MAC header */
+        fc = header->frame_control;
+        seq_ctl = le16_to_cpu(header->seq_ctrl);
+
+        /* metadata */
+        channel = le16_to_cpu(phy_res->channel);
+        phy_flags = le16_to_cpu(phy_res->phy_flags);
+        rate_n_flags = le32_to_cpu(phy_res->rate_n_flags);
+
+        /* signal statistics */
+        rssi = iwlagn_calc_rssi(priv, phy_res);
+        tsf_low = le64_to_cpu(phy_res->timestamp) & 0x0ffffffff;
+
+        to_us = !compare_ether_addr(header->addr1, priv->mac_addr);
+
+        /* if data frame is to us and all is good,
+         *   (optionally) print summary for only 1 out of every 100 */
+        if (to_us && (fc & ~cpu_to_le16(IEEE80211_FCTL_PROTECTED)) ==
+            cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FTYPE_DATA)) {
+                dataframe = 1;
+                if (!group100)
+                        print_summary = 1;      /* print each frame */
+                else if (priv->framecnt_to_us < 100) {
+                        priv->framecnt_to_us++;
+                        print_summary = 0;
+                } else {
+                        priv->framecnt_to_us = 0;
+                        print_summary = 1;
+                        hundred = 1;
+                }
+        } else {
+                /* print summary for all other frames */
+                print_summary = 1;
+        }
+
+        if (print_summary) {
+                char *title;
+                int rate_idx;
+                u32 bitrate;
+
+                if (hundred)
+                        title = "100Frames";
+                else if (ieee80211_has_retry(fc))
+                        title = "Retry";
+                else if (ieee80211_is_assoc_resp(fc))
+                        title = "AscRsp";
+                else if (ieee80211_is_reassoc_resp(fc))
+                        title = "RasRsp";
+                else if (ieee80211_is_probe_resp(fc)) {
+                        title = "PrbRsp";
+                        print_dump = 1; /* dump frame contents */
+                } else if (ieee80211_is_beacon(fc)) {
+                        title = "Beacon";
+                        print_dump = 1; /* dump frame contents */
+                } else if (ieee80211_is_atim(fc))
+                        title = "ATIM";
+                else if (ieee80211_is_auth(fc))
+                        title = "Auth";
+                else if (ieee80211_is_deauth(fc))
+                        title = "DeAuth";
+                else if (ieee80211_is_disassoc(fc))
+                        title = "DisAssoc";
+                else
+                        title = "Frame";
+
+                rate_idx = iwl_hwrate_to_plcp_idx(rate_n_flags);
+                if (unlikely((rate_idx < 0) || (rate_idx >= IWL_RATE_COUNT))) {
+                        bitrate = 0;
+                        WARN_ON_ONCE(1);
+                } else {
+                        bitrate = iwl_rates[rate_idx].ieee / 2;
+                }
+
+                /* print frame summary.
+                 * MAC addresses show just the last byte (for brevity),
+                 *    but you can hack it to show more, if you'd like to. */
+                if (dataframe)
+                        IWL_DEBUG_RX(priv, "%s: mhd=0x%04x, dst=0x%02x, "
+                                     "len=%u, rssi=%d, chnl=%d, rate=%u,\n",
+                                     title, le16_to_cpu(fc), header->addr1[5],
+                                     length, rssi, channel, bitrate);
+                else {
+                        /* src/dst addresses assume managed mode */
+                        IWL_DEBUG_RX(priv, "%s: 0x%04x, dst=0x%02x, src=0x%02x, "
+                                     "len=%u, rssi=%d, tim=%lu usec, "
+                                     "phy=0x%02x, chnl=%d\n",
+                                     title, le16_to_cpu(fc), header->addr1[5],
+                                     header->addr3[5], length, rssi,
+                                     tsf_low - priv->scan_start_tsf,
+                                     phy_flags, channel);
+                }
+        }
+        if (print_dump)
+                iwl_print_hex_dump(priv, IWL_DL_RX, header, length);
+}
+#endif
+
+static u32 iwlagn_translate_rx_status(struct iwl_priv *priv, u32 decrypt_in)
+{
+        u32 decrypt_out = 0;
+
+        if ((decrypt_in & RX_RES_STATUS_STATION_FOUND) ==
+                                        RX_RES_STATUS_STATION_FOUND)
+                decrypt_out |= (RX_RES_STATUS_STATION_FOUND |
+                                RX_RES_STATUS_NO_STATION_INFO_MISMATCH);
+
+        decrypt_out |= (decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK);
+
+        /* packet was not encrypted */
+        if ((decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) ==
+                                        RX_RES_STATUS_SEC_TYPE_NONE)
+                return decrypt_out;
+
+        /* packet was encrypted with unknown alg */
+        if ((decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) ==
+                                        RX_RES_STATUS_SEC_TYPE_ERR)
+                return decrypt_out;
+
+        /* decryption was not done in HW */
+        if ((decrypt_in & RX_MPDU_RES_STATUS_DEC_DONE_MSK) !=
+                                        RX_MPDU_RES_STATUS_DEC_DONE_MSK)
+                return decrypt_out;
+
+        switch (decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) {
+
+        case RX_RES_STATUS_SEC_TYPE_CCMP:
+                /* alg is CCM: check MIC only */
+                if (!(decrypt_in & RX_MPDU_RES_STATUS_MIC_OK))
+                        /* Bad MIC */
+                        decrypt_out |= RX_RES_STATUS_BAD_ICV_MIC;
+                else
+                        decrypt_out |= RX_RES_STATUS_DECRYPT_OK;
+
+                break;
+
+        case RX_RES_STATUS_SEC_TYPE_TKIP:
+                if (!(decrypt_in & RX_MPDU_RES_STATUS_TTAK_OK)) {
+                        /* Bad TTAK */
+                        decrypt_out |= RX_RES_STATUS_BAD_KEY_TTAK;
+                        break;
+                }
+                /* fall through if TTAK OK */
+        default:
+                if (!(decrypt_in & RX_MPDU_RES_STATUS_ICV_OK))
+                        decrypt_out |= RX_RES_STATUS_BAD_ICV_MIC;
+                else
+                        decrypt_out |= RX_RES_STATUS_DECRYPT_OK;
+                break;
+        };
+
+        IWL_DEBUG_RX(priv, "decrypt_in:0x%x  decrypt_out = 0x%x\n",
+                                        decrypt_in, decrypt_out);
+
+        return decrypt_out;
+}
+
+static void iwlagn_pass_packet_to_mac80211(struct iwl_priv *priv,
+                                        struct ieee80211_hdr *hdr,
+                                        u16 len,
+                                        u32 ampdu_status,
+                                        struct iwl_rx_mem_buffer *rxb,
+                                        struct ieee80211_rx_status *stats)
+{
+        struct sk_buff *skb;
+        __le16 fc = hdr->frame_control;
+
+        /* We only process data packets if the interface is open */
+        if (unlikely(!priv->is_open)) {
+                IWL_DEBUG_DROP_LIMIT(priv,
+                    "Dropping packet while interface is not open.\n");
+                return;
+        }
+
+        /* In case of HW accelerated crypto and bad decryption, drop */
+        if (!priv->cfg->mod_params->sw_crypto &&
+            iwl_set_decrypted_flag(priv, hdr, ampdu_status, stats))
+                return;
+
+        skb = dev_alloc_skb(128);
+        if (!skb) {
+                IWL_ERR(priv, "dev_alloc_skb failed\n");
+                return;
+        }
+
+        skb_add_rx_frag(skb, 0, rxb->page, (void *)hdr - rxb_addr(rxb), len);
+
+        iwl_update_stats(priv, false, fc, len);
+        memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
+
+        ieee80211_rx(priv->hw, skb);
+        priv->alloc_rxb_page--;
+        rxb->page = NULL;
+}
+
+/* Called for REPLY_RX (legacy ABG frames), or
+ * REPLY_RX_MPDU_CMD (HT high-throughput N frames). */
+void iwlagn_rx_reply_rx(struct iwl_priv *priv,
+                                struct iwl_rx_mem_buffer *rxb)
+{
+        struct ieee80211_hdr *header;
+        struct ieee80211_rx_status rx_status;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_rx_phy_res *phy_res;
+        __le32 rx_pkt_status;
+        struct iwl4965_rx_mpdu_res_start *amsdu;
+        u32 len;
+        u32 ampdu_status;
+        u32 rate_n_flags;
+
+        /**
+         * REPLY_RX and REPLY_RX_MPDU_CMD are handled differently.
+         *      REPLY_RX: physical layer info is in this buffer
+         *      REPLY_RX_MPDU_CMD: physical layer info was sent in separate
+         *              command and cached in priv->last_phy_res
+         *
+         * Here we set up local variables depending on which command is
+         * received.
+         */
+        if (pkt->hdr.cmd == REPLY_RX) {
+                phy_res = (struct iwl_rx_phy_res *)pkt->u.raw;
+                header = (struct ieee80211_hdr *)(pkt->u.raw + sizeof(*phy_res)
+                                + phy_res->cfg_phy_cnt);
+
+                len = le16_to_cpu(phy_res->byte_count);
+                rx_pkt_status = *(__le32 *)(pkt->u.raw + sizeof(*phy_res) +
+                                phy_res->cfg_phy_cnt + len);
+                ampdu_status = le32_to_cpu(rx_pkt_status);
+        } else {
+                if (!priv->last_phy_res[0]) {
+                        IWL_ERR(priv, "MPDU frame without cached PHY data\n");
+                        return;
+                }
+                phy_res = (struct iwl_rx_phy_res *)&priv->last_phy_res[1];
+                amsdu = (struct iwl4965_rx_mpdu_res_start *)pkt->u.raw;
+                header = (struct ieee80211_hdr *)(pkt->u.raw + sizeof(*amsdu));
+                len = le16_to_cpu(amsdu->byte_count);
+                rx_pkt_status = *(__le32 *)(pkt->u.raw + sizeof(*amsdu) + len);
+                ampdu_status = iwlagn_translate_rx_status(priv,
+                                le32_to_cpu(rx_pkt_status));
+        }
+
+        if ((unlikely(phy_res->cfg_phy_cnt > 20))) {
+                IWL_DEBUG_DROP(priv, "dsp size out of range [0,20]: %d/n",
+                                phy_res->cfg_phy_cnt);
+                return;
+        }
+
+        if (!(rx_pkt_status & RX_RES_STATUS_NO_CRC32_ERROR) ||
+            !(rx_pkt_status & RX_RES_STATUS_NO_RXE_OVERFLOW)) {
+                IWL_DEBUG_RX(priv, "Bad CRC or FIFO: 0x%08X.\n",
+                                le32_to_cpu(rx_pkt_status));
+                return;
+        }
+
+        /* This will be used in several places later */
+        rate_n_flags = le32_to_cpu(phy_res->rate_n_flags);
+
+        /* rx_status carries information about the packet to mac80211 */
+        rx_status.mactime = le64_to_cpu(phy_res->timestamp);
+        rx_status.freq =
+                ieee80211_channel_to_frequency(le16_to_cpu(phy_res->channel));
+        rx_status.band = (phy_res->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ?
+                                IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
+        rx_status.rate_idx =
+                iwlagn_hwrate_to_mac80211_idx(rate_n_flags, rx_status.band);
+        rx_status.flag = 0;
+
+        /* TSF isn't reliable. In order to allow smooth user experience,
+         * this W/A doesn't propagate it to the mac80211 */
+        /*rx_status.flag |= RX_FLAG_TSFT;*/
+
+        priv->ucode_beacon_time = le32_to_cpu(phy_res->beacon_time_stamp);
+
+        /* Find max signal strength (dBm) among 3 antenna/receiver chains */
+        rx_status.signal = iwlagn_calc_rssi(priv, phy_res);
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+        /* Set "1" to report good data frames in groups of 100 */
+        if (unlikely(iwl_get_debug_level(priv) & IWL_DL_RX))
+                iwlagn_dbg_report_frame(priv, phy_res, len, header, 1);
+#endif
+        iwl_dbg_log_rx_data_frame(priv, len, header);
+        IWL_DEBUG_STATS_LIMIT(priv, "Rssi %d, TSF %llu\n",
+                rx_status.signal, (unsigned long long)rx_status.mactime);
+
+        /*
+         * "antenna number"
+         *
+         * It seems that the antenna field in the phy flags value
+         * is actually a bit field. This is undefined by radiotap,
+         * it wants an actual antenna number but I always get "7"
+         * for most legacy frames I receive indicating that the
+         * same frame was received on all three RX chains.
+         *
+         * I think this field should be removed in favor of a
+         * new 802.11n radiotap field "RX chains" that is defined
+         * as a bitmask.
+         */
+        rx_status.antenna =
+                (le16_to_cpu(phy_res->phy_flags) & RX_RES_PHY_FLAGS_ANTENNA_MSK)
+                >> RX_RES_PHY_FLAGS_ANTENNA_POS;
+
+        /* set the preamble flag if appropriate */
+        if (phy_res->phy_flags & RX_RES_PHY_FLAGS_SHORT_PREAMBLE_MSK)
+                rx_status.flag |= RX_FLAG_SHORTPRE;
+
+        /* Set up the HT phy flags */
+        if (rate_n_flags & RATE_MCS_HT_MSK)
+                rx_status.flag |= RX_FLAG_HT;
+        if (rate_n_flags & RATE_MCS_HT40_MSK)
+                rx_status.flag |= RX_FLAG_40MHZ;
+        if (rate_n_flags & RATE_MCS_SGI_MSK)
+                rx_status.flag |= RX_FLAG_SHORT_GI;
+
+        iwlagn_pass_packet_to_mac80211(priv, header, len, ampdu_status,
+                                    rxb, &rx_status);
+}
+
+/* Cache phy data (Rx signal strength, etc) for HT frame (REPLY_RX_PHY_CMD).
+ * This will be used later in iwl_rx_reply_rx() for REPLY_RX_MPDU_CMD. */
+void iwlagn_rx_reply_rx_phy(struct iwl_priv *priv,
+                                    struct iwl_rx_mem_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        priv->last_phy_res[0] = 1;
+        memcpy(&priv->last_phy_res[1], &(pkt->u.raw[0]),
+               sizeof(struct iwl_rx_phy_res));
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index be00cb3b1d0e..0c3c76803c5e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -610,10 +610,6 @@ static u16 rs_get_supported_rates(struct iwl_lq_sta *lq_sta,
                                   struct ieee80211_hdr *hdr,
                                   enum iwl_table_type rate_type)
 {
-        if (hdr && is_multicast_ether_addr(hdr->addr1) &&
-            lq_sta->active_rate_basic)
-                return lq_sta->active_rate_basic;
-
         if (is_legacy(rate_type)) {
                 return lq_sta->active_legacy_rate;
         } else {
@@ -774,6 +770,15 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
 
         IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
 
+        /* Treat uninitialized rate scaling data same as non-existing. */
+        if (!lq_sta) {
+                IWL_DEBUG_RATE(priv, "Station rate scaling not created yet.\n");
+                return;
+        } else if (!lq_sta->drv) {
+                IWL_DEBUG_RATE(priv, "Rate scaling not initialized yet.\n");
+                return;
+        }
+
         if (!ieee80211_is_data(hdr->frame_control) ||
             info->flags & IEEE80211_TX_CTL_NO_ACK)
                 return;
@@ -783,10 +788,6 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
             !(info->flags & IEEE80211_TX_STAT_AMPDU))
                 return;
 
-        if ((priv->iw_mode == NL80211_IFTYPE_ADHOC) &&
-            !lq_sta->ibss_sta_added)
-                return;
-
         /*
          * Ignore this Tx frame response if its initial rate doesn't match
          * that of latest Link Quality command.  There may be stragglers
@@ -832,7 +833,7 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
                 lq_sta->missed_rate_counter++;
                 if (lq_sta->missed_rate_counter > IWL_MISSED_RATE_MAX) {
                         lq_sta->missed_rate_counter = 0;
-                        iwl_send_lq_cmd(priv, &lq_sta->lq, CMD_ASYNC);
+                        iwl_send_lq_cmd(priv, &lq_sta->lq, CMD_ASYNC, false);
                 }
                 /* Regardless, ignore this status info for outdated rate */
                 return;
@@ -1912,7 +1913,7 @@ static u32 rs_update_rate_tbl(struct iwl_priv *priv,
         /* Update uCode's rate table. */
         rate = rate_n_flags_from_tbl(priv, tbl, index, is_green);
         rs_fill_link_cmd(priv, lq_sta, rate);
-        iwl_send_lq_cmd(priv, &lq_sta->lq, CMD_ASYNC);
+        iwl_send_lq_cmd(priv, &lq_sta->lq, CMD_ASYNC, false);
 
         return rate;
 }
@@ -2001,7 +2002,7 @@ static void rs_rate_scale_perform(struct iwl_priv *priv,
         /* rates available for this association, and for modulation mode */
         rate_mask = rs_get_supported_rates(lq_sta, hdr, tbl->lq_type);
 
-        IWL_DEBUG_RATE(priv, "mask 0x%04X \n", rate_mask);
+        IWL_DEBUG_RATE(priv, "mask 0x%04X\n", rate_mask);
 
         /* mask with station rate restriction */
         if (is_legacy(tbl->lq_type)) {
@@ -2288,7 +2289,7 @@ lq_update:
                         IWL_DEBUG_RATE(priv, "Switch current  mcs: %X index: %d\n",
                                      tbl->current_rate, index);
                         rs_fill_link_cmd(priv, lq_sta, tbl->current_rate);
-                        iwl_send_lq_cmd(priv, &lq_sta->lq, CMD_ASYNC);
+                        iwl_send_lq_cmd(priv, &lq_sta->lq, CMD_ASYNC, false);
                 } else
                         done_search = 1;
         }
@@ -2337,7 +2338,20 @@ out:
         return;
 }
 
-
+/**
+ * rs_initialize_lq - Initialize a station's hardware rate table
+ *
+ * The uCode's station table contains a table of fallback rates
+ * for automatic fallback during transmission.
+ *
+ * NOTE: This sets up a default set of values.  These will be replaced later
+ *       if the driver's iwl-agn-rs rate scaling algorithm is used, instead of
+ *       rc80211_simple.
+ *
+ * NOTE: Run REPLY_ADD_STA command to set up station table entry, before
+ *       calling this function (which runs REPLY_TX_LINK_QUALITY_CMD,
+ *       which requires station table entry to exist).
+ */
 static void rs_initialize_lq(struct iwl_priv *priv,
                              struct ieee80211_conf *conf,
                              struct ieee80211_sta *sta,
@@ -2356,10 +2370,6 @@ static void rs_initialize_lq(struct iwl_priv *priv,
 
         i = lq_sta->last_txrate_idx;
 
-        if ((lq_sta->lq.sta_id == 0xff) &&
-            (priv->iw_mode == NL80211_IFTYPE_ADHOC))
-                goto out;
-
         valid_tx_ant = priv->hw_params.valid_tx_ant;
 
         if (!lq_sta->search_better_tbl)
@@ -2387,7 +2397,8 @@ static void rs_initialize_lq(struct iwl_priv *priv,
         tbl->current_rate = rate;
         rs_set_expected_tpt_table(lq_sta, tbl);
         rs_fill_link_cmd(NULL, lq_sta, rate);
-        iwl_send_lq_cmd(priv, &lq_sta->lq, CMD_ASYNC);
+        priv->stations[lq_sta->lq.sta_id].lq = &lq_sta->lq;
+        iwl_send_lq_cmd(priv, &lq_sta->lq, CMD_SYNC, true);
  out:
         return;
 }
@@ -2399,9 +2410,6 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta, void *priv_sta,
         struct sk_buff *skb = txrc->skb;
         struct ieee80211_supported_band *sband = txrc->sband;
         struct iwl_priv *priv = (struct iwl_priv *)priv_r;
-        struct ieee80211_conf *conf = &priv->hw->conf;
-        struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct iwl_lq_sta *lq_sta = priv_sta;
         int rate_idx;
@@ -2419,30 +2427,18 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta, void *priv_sta,
                         lq_sta->max_rate_idx = -1;
         }
 
+        /* Treat uninitialized rate scaling data same as non-existing. */
+        if (lq_sta && !lq_sta->drv) {
+                IWL_DEBUG_RATE(priv, "Rate scaling not initialized yet.\n");
+                priv_sta = NULL;
+        }
+
         /* Send management frames and NO_ACK data using lowest rate. */
         if (rate_control_send_low(sta, priv_sta, txrc))
                 return;
 
         rate_idx  = lq_sta->last_txrate_idx;
 
-        if ((priv->iw_mode == NL80211_IFTYPE_ADHOC) &&
-            !lq_sta->ibss_sta_added) {
-                u8 sta_id = iwl_find_station(priv, hdr->addr1);
-
-                if (sta_id == IWL_INVALID_STATION) {
-                        IWL_DEBUG_RATE(priv, "LQ: ADD station %pM\n",
-                                       hdr->addr1);
-                        sta_id = iwl_add_station(priv, hdr->addr1,
-                                                false, CMD_ASYNC, ht_cap);
-                }
-                if ((sta_id != IWL_INVALID_STATION)) {
-                        lq_sta->lq.sta_id = sta_id;
-                        lq_sta->lq.rs_table[0].rate_n_flags = 0;
-                        lq_sta->ibss_sta_added = 1;
-                        rs_initialize_lq(priv, conf, sta, lq_sta);
-                }
-        }
-
         if (lq_sta->last_rate_n_flags & RATE_MCS_HT_MSK) {
                 rate_idx -= IWL_FIRST_OFDM_RATE;
                 /* 6M and 9M shared same MCS index */
@@ -2492,16 +2488,25 @@ static void *rs_alloc_sta(void *priv_rate, struct ieee80211_sta *sta,
         return lq_sta;
 }
 
-static void rs_rate_init(void *priv_r, struct ieee80211_supported_band *sband,
-                         struct ieee80211_sta *sta, void *priv_sta)
+/*
+ * Called after adding a new station to initialize rate scaling
+ */
+void iwl_rs_rate_init(struct iwl_priv *priv, struct ieee80211_sta *sta, u8 sta_id)
 {
         int i, j;
-        struct iwl_priv *priv = (struct iwl_priv *)priv_r;
+        struct ieee80211_hw *hw = priv->hw;
         struct ieee80211_conf *conf = &priv->hw->conf;
         struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
-        struct iwl_lq_sta *lq_sta = priv_sta;
+        struct iwl_station_priv *sta_priv;
+        struct iwl_lq_sta *lq_sta;
+        struct ieee80211_supported_band *sband;
+
+        sta_priv = (struct iwl_station_priv *) sta->drv_priv;
+        lq_sta = &sta_priv->lq_sta;
+        sband = hw->wiphy->bands[conf->channel->band];
+
 
-        lq_sta->lq.sta_id = 0xff;
+        lq_sta->lq.sta_id = sta_id;
 
         for (j = 0; j < LQ_SIZE; j++)
                 for (i = 0; i < IWL_RATE_COUNT; i++)
@@ -2513,39 +2518,18 @@ static void rs_rate_init(void *priv_r, struct ieee80211_supported_band *sband,
                 for (i = 0; i < IWL_RATE_COUNT; i++)
                         rs_rate_scale_clear_window(&lq_sta->lq_info[j].win[i]);
 
-        IWL_DEBUG_RATE(priv, "LQ: *** rate scale station global init ***\n");
+        IWL_DEBUG_RATE(priv, "LQ: *** rate scale station global init for station %d ***\n",
+                       sta_id);
         /* TODO: what is a good starting rate for STA? About middle? Maybe not
          * the lowest or the highest rate.. Could consider using RSSI from
          * previous packets? Need to have IEEE 802.1X auth succeed immediately
          * after assoc.. */
 
-        lq_sta->ibss_sta_added = 0;
-        if (priv->iw_mode == NL80211_IFTYPE_AP) {
-                u8 sta_id = iwl_find_station(priv,
-                                                                sta->addr);
-
-                /* for IBSS the call are from tasklet */
-                IWL_DEBUG_RATE(priv, "LQ: ADD station %pM\n", sta->addr);
-
-                if (sta_id == IWL_INVALID_STATION) {
-                        IWL_DEBUG_RATE(priv, "LQ: ADD station %pM\n", sta->addr);
-                        sta_id = iwl_add_station(priv, sta->addr, false,
-                                                CMD_ASYNC, ht_cap);
-                }
-                if ((sta_id != IWL_INVALID_STATION)) {
-                        lq_sta->lq.sta_id = sta_id;
-                        lq_sta->lq.rs_table[0].rate_n_flags = 0;
-                }
-                /* FIXME: this is w/a remove it later */
-                priv->assoc_station_added = 1;
-        }
-
         lq_sta->is_dup = 0;
         lq_sta->max_rate_idx = -1;
         lq_sta->missed_rate_counter = IWL_MISSED_RATE_MAX;
         lq_sta->is_green = rs_use_green(sta, &priv->current_ht_config);
         lq_sta->active_legacy_rate = priv->active_rate & ~(0x1000);
-        lq_sta->active_rate_basic = priv->active_rate_basic;
         lq_sta->band = priv->band;
         /*
          * active_siso_rate mask includes 9 MBits (bit 5), and CCK (bits 0-3),
@@ -2793,7 +2777,7 @@ static ssize_t rs_sta_dbgfs_scale_table_write(struct file *file,
 
         if (lq_sta->dbg_fixed_rate) {
                 rs_fill_link_cmd(NULL, lq_sta, lq_sta->dbg_fixed_rate);
-                iwl_send_lq_cmd(lq_sta->drv, &lq_sta->lq, CMD_ASYNC);
+                iwl_send_lq_cmd(lq_sta->drv, &lq_sta->lq, CMD_ASYNC, false);
         }
 
         return count;
@@ -2949,12 +2933,6 @@ static ssize_t rs_sta_dbgfs_rate_scale_data_read(struct file *file,
                 desc += sprintf(buff+desc,
                                 "Bit Rate= %d Mb/s\n",
                                 iwl_rates[lq_sta->last_txrate_idx].ieee >> 1);
-        desc += sprintf(buff+desc,
-                        "Signal Level= %d dBm\tNoise Level= %d dBm\n",
-                        priv->last_rx_rssi, priv->last_rx_noise);
-        desc += sprintf(buff+desc,
-                        "Tsf= 0x%llx\tBeacon time= 0x%08X\n",
-                        priv->last_tsf, priv->last_beacon_time);
 
         ret = simple_read_from_buffer(user_buf, count, ppos, buff, desc);
         return ret;
@@ -2994,12 +2972,21 @@ static void rs_remove_debugfs(void *priv, void *priv_sta)
 }
 #endif
 
+/*
+ * Initialization of rate scaling information is done by driver after
+ * the station is added. Since mac80211 calls this function before a
+ * station is added we ignore it.
+ */
+static void rs_rate_init_stub(void *priv_r, struct ieee80211_supported_band *sband,
+                         struct ieee80211_sta *sta, void *priv_sta)
+{
+}
 static struct rate_control_ops rs_ops = {
         .module = NULL,
         .name = RS_NAME,
         .tx_status = rs_tx_status,
         .get_rate = rs_get_rate,
-        .rate_init = rs_rate_init,
+        .rate_init = rs_rate_init_stub,
         .alloc = rs_alloc,
         .free = rs_free,
         .alloc_sta = rs_alloc_sta,
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.h b/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
index e71923961e69..8292f6d48ec6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.h
@@ -403,7 +403,6 @@ struct iwl_lq_sta {
         u8 is_green;
         u8 is_dup;
         enum ieee80211_band band;
-        u8 ibss_sta_added;
 
         /* The following are bitmaps of rates; IWL_RATE_6M_MASK, etc. */
         u32 supp_rates;
@@ -411,7 +410,6 @@ struct iwl_lq_sta {
         u16 active_siso_rate;
         u16 active_mimo2_rate;
         u16 active_mimo3_rate;
-        u16 active_rate_basic;
         s8 max_rate_idx;     /* Max rate set by user */
         u8 missed_rate_counter;
 
@@ -479,6 +477,12 @@ static inline u8 iwl3945_get_prev_ieee_rate(u8 rate_index)
  */
 extern void iwl3945_rate_scale_init(struct ieee80211_hw *hw, s32 sta_id);
 
+/* Initialize station's rate scaling information after adding station */
+extern void iwl_rs_rate_init(struct iwl_priv *priv,
+                             struct ieee80211_sta *sta, u8 sta_id);
+extern void iwl3945_rs_rate_init(struct iwl_priv *priv,
+                                 struct ieee80211_sta *sta, u8 sta_id);
+
 /**
  * iwl_rate_control_register - Register the rate control algorithm callbacks
  *
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
new file mode 100644
index 000000000000..a76e14351b5a
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
@@ -0,0 +1,1314 @@
+/******************************************************************************
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ *****************************************************************************/
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/sched.h>
+
+#include "iwl-dev.h"
+#include "iwl-core.h"
+#include "iwl-sta.h"
+#include "iwl-io.h"
+#include "iwl-helpers.h"
+#include "iwl-agn-hw.h"
+#include "iwl-agn.h"
+
+/*
+ * mac80211 queues, ACs, hardware queues, FIFOs.
+ *
+ * Cf. http://wireless.kernel.org/en/developers/Documentation/mac80211/queues
+ *
+ * Mac80211 uses the following numbers, which we get as from it
+ * by way of skb_get_queue_mapping(skb):
+ *
+ *      VO      0
+ *      VI      1
+ *      BE      2
+ *      BK      3
+ *
+ *
+ * Regular (not A-MPDU) frames are put into hardware queues corresponding
+ * to the FIFOs, see comments in iwl-prph.h. Aggregated frames get their
+ * own queue per aggregation session (RA/TID combination), such queues are
+ * set up to map into FIFOs too, for which we need an AC->FIFO mapping. In
+ * order to map frames to the right queue, we also need an AC->hw queue
+ * mapping. This is implemented here.
+ *
+ * Due to the way hw queues are set up (by the hw specific modules like
+ * iwl-4965.c, iwl-5000.c etc.), the AC->hw queue mapping is the identity
+ * mapping.
+ */
+
+static const u8 tid_to_ac[] = {
+        /* this matches the mac80211 numbers */
+        2, 3, 3, 2, 1, 1, 0, 0
+};
+
+static const u8 ac_to_fifo[] = {
+        IWL_TX_FIFO_VO,
+        IWL_TX_FIFO_VI,
+        IWL_TX_FIFO_BE,
+        IWL_TX_FIFO_BK,
+};
+
+static inline int get_fifo_from_ac(u8 ac)
+{
+        return ac_to_fifo[ac];
+}
+
+static inline int get_fifo_from_tid(u16 tid)
+{
+        if (likely(tid < ARRAY_SIZE(tid_to_ac)))
+                return get_fifo_from_ac(tid_to_ac[tid]);
+
+        /* no support for TIDs 8-15 yet */
+        return -EINVAL;
+}
+
+/**
+ * iwlagn_txq_update_byte_cnt_tbl - Set up entry in Tx byte-count array
+ */
+void iwlagn_txq_update_byte_cnt_tbl(struct iwl_priv *priv,
+                                            struct iwl_tx_queue *txq,
+                                            u16 byte_cnt)
+{
+        struct iwlagn_scd_bc_tbl *scd_bc_tbl = priv->scd_bc_tbls.addr;
+        int write_ptr = txq->q.write_ptr;
+        int txq_id = txq->q.id;
+        u8 sec_ctl = 0;
+        u8 sta_id = 0;
+        u16 len = byte_cnt + IWL_TX_CRC_SIZE + IWL_TX_DELIMITER_SIZE;
+        __le16 bc_ent;
+
+        WARN_ON(len > 0xFFF || write_ptr >= TFD_QUEUE_SIZE_MAX);
+
+        if (txq_id != IWL_CMD_QUEUE_NUM) {
+                sta_id = txq->cmd[txq->q.write_ptr]->cmd.tx.sta_id;
+                sec_ctl = txq->cmd[txq->q.write_ptr]->cmd.tx.sec_ctl;
+
+                switch (sec_ctl & TX_CMD_SEC_MSK) {
+                case TX_CMD_SEC_CCM:
+                        len += CCMP_MIC_LEN;
+                        break;
+                case TX_CMD_SEC_TKIP:
+                        len += TKIP_ICV_LEN;
+                        break;
+                case TX_CMD_SEC_WEP:
+                        len += WEP_IV_LEN + WEP_ICV_LEN;
+                        break;
+                }
+        }
+
+        bc_ent = cpu_to_le16((len & 0xFFF) | (sta_id << 12));
+
+        scd_bc_tbl[txq_id].tfd_offset[write_ptr] = bc_ent;
+
+        if (write_ptr < TFD_QUEUE_SIZE_BC_DUP)
+                scd_bc_tbl[txq_id].
+                        tfd_offset[TFD_QUEUE_SIZE_MAX + write_ptr] = bc_ent;
+}
+
+void iwlagn_txq_inval_byte_cnt_tbl(struct iwl_priv *priv,
+                                           struct iwl_tx_queue *txq)
+{
+        struct iwlagn_scd_bc_tbl *scd_bc_tbl = priv->scd_bc_tbls.addr;
+        int txq_id = txq->q.id;
+        int read_ptr = txq->q.read_ptr;
+        u8 sta_id = 0;
+        __le16 bc_ent;
+
+        WARN_ON(read_ptr >= TFD_QUEUE_SIZE_MAX);
+
+        if (txq_id != IWL_CMD_QUEUE_NUM)
+                sta_id = txq->cmd[read_ptr]->cmd.tx.sta_id;
+
+        bc_ent = cpu_to_le16(1 | (sta_id << 12));
+        scd_bc_tbl[txq_id].tfd_offset[read_ptr] = bc_ent;
+
+        if (read_ptr < TFD_QUEUE_SIZE_BC_DUP)
+                scd_bc_tbl[txq_id].
+                        tfd_offset[TFD_QUEUE_SIZE_MAX + read_ptr] = bc_ent;
+}
+
+static int iwlagn_tx_queue_set_q2ratid(struct iwl_priv *priv, u16 ra_tid,
+                                        u16 txq_id)
+{
+        u32 tbl_dw_addr;
+        u32 tbl_dw;
+        u16 scd_q2ratid;
+
+        scd_q2ratid = ra_tid & IWL_SCD_QUEUE_RA_TID_MAP_RATID_MSK;
+
+        tbl_dw_addr = priv->scd_base_addr +
+                        IWL50_SCD_TRANSLATE_TBL_OFFSET_QUEUE(txq_id);
+
+        tbl_dw = iwl_read_targ_mem(priv, tbl_dw_addr);
+
+        if (txq_id & 0x1)
+                tbl_dw = (scd_q2ratid << 16) | (tbl_dw & 0x0000FFFF);
+        else
+                tbl_dw = scd_q2ratid | (tbl_dw & 0xFFFF0000);
+
+        iwl_write_targ_mem(priv, tbl_dw_addr, tbl_dw);
+
+        return 0;
+}
+
+static void iwlagn_tx_queue_stop_scheduler(struct iwl_priv *priv, u16 txq_id)
+{
+        /* Simply stop the queue, but don't change any configuration;
+         * the SCD_ACT_EN bit is the write-enable mask for the ACTIVE bit. */
+        iwl_write_prph(priv,
+                IWL50_SCD_QUEUE_STATUS_BITS(txq_id),
+                (0 << IWL50_SCD_QUEUE_STTS_REG_POS_ACTIVE)|
+                (1 << IWL50_SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN));
+}
+
+void iwlagn_set_wr_ptrs(struct iwl_priv *priv,
+                                int txq_id, u32 index)
+{
+        iwl_write_direct32(priv, HBUS_TARG_WRPTR,
+                        (index & 0xff) | (txq_id << 8));
+        iwl_write_prph(priv, IWL50_SCD_QUEUE_RDPTR(txq_id), index);
+}
+
+void iwlagn_tx_queue_set_status(struct iwl_priv *priv,
+                                        struct iwl_tx_queue *txq,
+                                        int tx_fifo_id, int scd_retry)
+{
+        int txq_id = txq->q.id;
+        int active = test_bit(txq_id, &priv->txq_ctx_active_msk) ? 1 : 0;
+
+        iwl_write_prph(priv, IWL50_SCD_QUEUE_STATUS_BITS(txq_id),
+                        (active << IWL50_SCD_QUEUE_STTS_REG_POS_ACTIVE) |
+                        (tx_fifo_id << IWL50_SCD_QUEUE_STTS_REG_POS_TXF) |
+                        (1 << IWL50_SCD_QUEUE_STTS_REG_POS_WSL) |
+                        IWL50_SCD_QUEUE_STTS_REG_MSK);
+
+        txq->sched_retry = scd_retry;
+
+        IWL_DEBUG_INFO(priv, "%s %s Queue %d on FIFO %d\n",
+                       active ? "Activate" : "Deactivate",
+                       scd_retry ? "BA" : "AC/CMD", txq_id, tx_fifo_id);
+}
+
+int iwlagn_txq_agg_enable(struct iwl_priv *priv, int txq_id,
+                          int tx_fifo, int sta_id, int tid, u16 ssn_idx)
+{
+        unsigned long flags;
+        u16 ra_tid;
+
+        if ((IWLAGN_FIRST_AMPDU_QUEUE > txq_id) ||
+            (IWLAGN_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
+             <= txq_id)) {
+                IWL_WARN(priv,
+                        "queue number out of range: %d, must be %d to %d\n",
+                        txq_id, IWLAGN_FIRST_AMPDU_QUEUE,
+                        IWLAGN_FIRST_AMPDU_QUEUE +
+                        priv->cfg->num_of_ampdu_queues - 1);
+                return -EINVAL;
+        }
+
+        ra_tid = BUILD_RAxTID(sta_id, tid);
+
+        /* Modify device's station table to Tx this TID */
+        iwl_sta_tx_modify_enable_tid(priv, sta_id, tid);
+
+        spin_lock_irqsave(&priv->lock, flags);
+
+        /* Stop this Tx queue before configuring it */
+        iwlagn_tx_queue_stop_scheduler(priv, txq_id);
+
+        /* Map receiver-address / traffic-ID to this queue */
+        iwlagn_tx_queue_set_q2ratid(priv, ra_tid, txq_id);
+
+        /* Set this queue as a chain-building queue */
+        iwl_set_bits_prph(priv, IWL50_SCD_QUEUECHAIN_SEL, (1<<txq_id));
+
+        /* enable aggregations for the queue */
+        iwl_set_bits_prph(priv, IWL50_SCD_AGGR_SEL, (1<<txq_id));
+
+        /* Place first TFD at index corresponding to start sequence number.
+         * Assumes that ssn_idx is valid (!= 0xFFF) */
+        priv->txq[txq_id].q.read_ptr = (ssn_idx & 0xff);
+        priv->txq[txq_id].q.write_ptr = (ssn_idx & 0xff);
+        iwlagn_set_wr_ptrs(priv, txq_id, ssn_idx);
+
+        /* Set up Tx window size and frame limit for this queue */
+        iwl_write_targ_mem(priv, priv->scd_base_addr +
+                        IWL50_SCD_CONTEXT_QUEUE_OFFSET(txq_id) +
+                        sizeof(u32),
+                        ((SCD_WIN_SIZE <<
+                        IWL50_SCD_QUEUE_CTX_REG2_WIN_SIZE_POS) &
+                        IWL50_SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK) |
+                        ((SCD_FRAME_LIMIT <<
+                        IWL50_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS) &
+                        IWL50_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK));
+
+        iwl_set_bits_prph(priv, IWL50_SCD_INTERRUPT_MASK, (1 << txq_id));
+
+        /* Set up Status area in SRAM, map to Tx DMA/FIFO, activate the queue */
+        iwlagn_tx_queue_set_status(priv, &priv->txq[txq_id], tx_fifo, 1);
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        return 0;
+}
+
+int iwlagn_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
+                           u16 ssn_idx, u8 tx_fifo)
+{
+        if ((IWLAGN_FIRST_AMPDU_QUEUE > txq_id) ||
+            (IWLAGN_FIRST_AMPDU_QUEUE + priv->cfg->num_of_ampdu_queues
+             <= txq_id)) {
+                IWL_ERR(priv,
+                        "queue number out of range: %d, must be %d to %d\n",
+                        txq_id, IWLAGN_FIRST_AMPDU_QUEUE,
+                        IWLAGN_FIRST_AMPDU_QUEUE +
+                        priv->cfg->num_of_ampdu_queues - 1);
+                return -EINVAL;
+        }
+
+        iwlagn_tx_queue_stop_scheduler(priv, txq_id);
+
+        iwl_clear_bits_prph(priv, IWL50_SCD_AGGR_SEL, (1 << txq_id));
+
+        priv->txq[txq_id].q.read_ptr = (ssn_idx & 0xff);
+        priv->txq[txq_id].q.write_ptr = (ssn_idx & 0xff);
+        /* supposes that ssn_idx is valid (!= 0xFFF) */
+        iwlagn_set_wr_ptrs(priv, txq_id, ssn_idx);
+
+        iwl_clear_bits_prph(priv, IWL50_SCD_INTERRUPT_MASK, (1 << txq_id));
+        iwl_txq_ctx_deactivate(priv, txq_id);
+        iwlagn_tx_queue_set_status(priv, &priv->txq[txq_id], tx_fifo, 0);
+
+        return 0;
+}
+
+/*
+ * Activate/Deactivate Tx DMA/FIFO channels according tx fifos mask
+ * must be called under priv->lock and mac access
+ */
+void iwlagn_txq_set_sched(struct iwl_priv *priv, u32 mask)
+{
+        iwl_write_prph(priv, IWL50_SCD_TXFACT, mask);
+}
+
+static inline int get_queue_from_ac(u16 ac)
+{
+        return ac;
+}
+
+/*
+ * handle build REPLY_TX command notification.
+ */
+static void iwlagn_tx_cmd_build_basic(struct iwl_priv *priv,
+                                  struct iwl_tx_cmd *tx_cmd,
+                                  struct ieee80211_tx_info *info,
+                                  struct ieee80211_hdr *hdr,
+                                  u8 std_id)
+{
+        __le16 fc = hdr->frame_control;
+        __le32 tx_flags = tx_cmd->tx_flags;
+
+        tx_cmd->stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
+        if (!(info->flags & IEEE80211_TX_CTL_NO_ACK)) {
+                tx_flags |= TX_CMD_FLG_ACK_MSK;
+                if (ieee80211_is_mgmt(fc))
+                        tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
+                if (ieee80211_is_probe_resp(fc) &&
+                    !(le16_to_cpu(hdr->seq_ctrl) & 0xf))
+                        tx_flags |= TX_CMD_FLG_TSF_MSK;
+        } else {
+                tx_flags &= (~TX_CMD_FLG_ACK_MSK);
+                tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
+        }
+
+        if (ieee80211_is_back_req(fc))
+                tx_flags |= TX_CMD_FLG_ACK_MSK | TX_CMD_FLG_IMM_BA_RSP_MASK;
+
+
+        tx_cmd->sta_id = std_id;
+        if (ieee80211_has_morefrags(fc))
+                tx_flags |= TX_CMD_FLG_MORE_FRAG_MSK;
+
+        if (ieee80211_is_data_qos(fc)) {
+                u8 *qc = ieee80211_get_qos_ctl(hdr);
+                tx_cmd->tid_tspec = qc[0] & 0xf;
+                tx_flags &= ~TX_CMD_FLG_SEQ_CTL_MSK;
+        } else {
+                tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
+        }
+
+        priv->cfg->ops->utils->rts_tx_cmd_flag(info, &tx_flags);
+
+        if ((tx_flags & TX_CMD_FLG_RTS_MSK) || (tx_flags & TX_CMD_FLG_CTS_MSK))
+                tx_flags |= TX_CMD_FLG_FULL_TXOP_PROT_MSK;
+
+        tx_flags &= ~(TX_CMD_FLG_ANT_SEL_MSK);
+        if (ieee80211_is_mgmt(fc)) {
+                if (ieee80211_is_assoc_req(fc) || ieee80211_is_reassoc_req(fc))
+                        tx_cmd->timeout.pm_frame_timeout = cpu_to_le16(3);
+                else
+                        tx_cmd->timeout.pm_frame_timeout = cpu_to_le16(2);
+        } else {
+                tx_cmd->timeout.pm_frame_timeout = 0;
+        }
+
+        tx_cmd->driver_txop = 0;
+        tx_cmd->tx_flags = tx_flags;
+        tx_cmd->next_frame_len = 0;
+}
+
+#define RTS_DFAULT_RETRY_LIMIT          60
+
+static void iwlagn_tx_cmd_build_rate(struct iwl_priv *priv,
+                              struct iwl_tx_cmd *tx_cmd,
+                              struct ieee80211_tx_info *info,
+                              __le16 fc)
+{
+        u32 rate_flags;
+        int rate_idx;
+        u8 rts_retry_limit;
+        u8 data_retry_limit;
+        u8 rate_plcp;
+
+        /* Set retry limit on DATA packets and Probe Responses*/
+        if (ieee80211_is_probe_resp(fc))
+                data_retry_limit = 3;
+        else
+                data_retry_limit = IWLAGN_DEFAULT_TX_RETRY;
+        tx_cmd->data_retry_limit = data_retry_limit;
+
+        /* Set retry limit on RTS packets */
+        rts_retry_limit = RTS_DFAULT_RETRY_LIMIT;
+        if (data_retry_limit < rts_retry_limit)
+                rts_retry_limit = data_retry_limit;
+        tx_cmd->rts_retry_limit = rts_retry_limit;
+
+        /* DATA packets will use the uCode station table for rate/antenna
+         * selection */
+        if (ieee80211_is_data(fc)) {
+                tx_cmd->initial_rate_index = 0;
+                tx_cmd->tx_flags |= TX_CMD_FLG_STA_RATE_MSK;
+                return;
+        }
+
+        /**
+         * If the current TX rate stored in mac80211 has the MCS bit set, it's
+         * not really a TX rate.  Thus, we use the lowest supported rate for
+         * this band.  Also use the lowest supported rate if the stored rate
+         * index is invalid.
+         */
+        rate_idx = info->control.rates[0].idx;
+        if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS ||
+                        (rate_idx < 0) || (rate_idx > IWL_RATE_COUNT_LEGACY))
+                rate_idx = rate_lowest_index(&priv->bands[info->band],
+                                info->control.sta);
+        /* For 5 GHZ band, remap mac80211 rate indices into driver indices */
+        if (info->band == IEEE80211_BAND_5GHZ)
+                rate_idx += IWL_FIRST_OFDM_RATE;
+        /* Get PLCP rate for tx_cmd->rate_n_flags */
+        rate_plcp = iwl_rates[rate_idx].plcp;
+        /* Zero out flags for this packet */
+        rate_flags = 0;
+
+        /* Set CCK flag as needed */
+        if ((rate_idx >= IWL_FIRST_CCK_RATE) && (rate_idx <= IWL_LAST_CCK_RATE))
+                rate_flags |= RATE_MCS_CCK_MSK;
+
+        /* Set up RTS and CTS flags for certain packets */
+        switch (fc & cpu_to_le16(IEEE80211_FCTL_STYPE)) {
+        case cpu_to_le16(IEEE80211_STYPE_AUTH):
+        case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
+        case cpu_to_le16(IEEE80211_STYPE_ASSOC_REQ):
+        case cpu_to_le16(IEEE80211_STYPE_REASSOC_REQ):
+                if (tx_cmd->tx_flags & TX_CMD_FLG_RTS_MSK) {
+                        tx_cmd->tx_flags &= ~TX_CMD_FLG_RTS_MSK;
+                        tx_cmd->tx_flags |= TX_CMD_FLG_CTS_MSK;
+                }
+                break;
+        default:
+                break;
+        }
+
+        /* Set up antennas */
+        priv->mgmt_tx_ant = iwl_toggle_tx_ant(priv, priv->mgmt_tx_ant);
+        rate_flags |= iwl_ant_idx_to_flags(priv->mgmt_tx_ant);
+
+        /* Set the rate in the TX cmd */
+        tx_cmd->rate_n_flags = iwl_hw_set_rate_n_flags(rate_plcp, rate_flags);
+}
+
+static void iwlagn_tx_cmd_build_hwcrypto(struct iwl_priv *priv,
+                                      struct ieee80211_tx_info *info,
+                                      struct iwl_tx_cmd *tx_cmd,
+                                      struct sk_buff *skb_frag,
+                                      int sta_id)
+{
+        struct ieee80211_key_conf *keyconf = info->control.hw_key;
+
+        switch (keyconf->alg) {
+        case ALG_CCMP:
+                tx_cmd->sec_ctl = TX_CMD_SEC_CCM;
+                memcpy(tx_cmd->key, keyconf->key, keyconf->keylen);
+                if (info->flags & IEEE80211_TX_CTL_AMPDU)
+                        tx_cmd->tx_flags |= TX_CMD_FLG_AGG_CCMP_MSK;
+                IWL_DEBUG_TX(priv, "tx_cmd with AES hwcrypto\n");
+                break;
+
+        case ALG_TKIP:
+                tx_cmd->sec_ctl = TX_CMD_SEC_TKIP;
+                ieee80211_get_tkip_key(keyconf, skb_frag,
+                        IEEE80211_TKIP_P2_KEY, tx_cmd->key);
+                IWL_DEBUG_TX(priv, "tx_cmd with tkip hwcrypto\n");
+                break;
+
+        case ALG_WEP:
+                tx_cmd->sec_ctl |= (TX_CMD_SEC_WEP |
+                        (keyconf->keyidx & TX_CMD_SEC_MSK) << TX_CMD_SEC_SHIFT);
+
+                if (keyconf->keylen == WEP_KEY_LEN_128)
+                        tx_cmd->sec_ctl |= TX_CMD_SEC_KEY128;
+
+                memcpy(&tx_cmd->key[3], keyconf->key, keyconf->keylen);
+
+                IWL_DEBUG_TX(priv, "Configuring packet for WEP encryption "
+                             "with key %d\n", keyconf->keyidx);
+                break;
+
+        default:
+                IWL_ERR(priv, "Unknown encode alg %d\n", keyconf->alg);
+                break;
+        }
+}
+
+/*
+ * start REPLY_TX command process
+ */
+int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_sta *sta = info->control.sta;
+        struct iwl_station_priv *sta_priv = NULL;
+        struct iwl_tx_queue *txq;
+        struct iwl_queue *q;
+        struct iwl_device_cmd *out_cmd;
+        struct iwl_cmd_meta *out_meta;
+        struct iwl_tx_cmd *tx_cmd;
+        int swq_id, txq_id;
+        dma_addr_t phys_addr;
+        dma_addr_t txcmd_phys;
+        dma_addr_t scratch_phys;
+        u16 len, len_org, firstlen, secondlen;
+        u16 seq_number = 0;
+        __le16 fc;
+        u8 hdr_len;
+        u8 sta_id;
+        u8 wait_write_ptr = 0;
+        u8 tid = 0;
+        u8 *qc = NULL;
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->lock, flags);
+        if (iwl_is_rfkill(priv)) {
+                IWL_DEBUG_DROP(priv, "Dropping - RF KILL\n");
+                goto drop_unlock;
+        }
+
+        fc = hdr->frame_control;
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+        if (ieee80211_is_auth(fc))
+                IWL_DEBUG_TX(priv, "Sending AUTH frame\n");
+        else if (ieee80211_is_assoc_req(fc))
+                IWL_DEBUG_TX(priv, "Sending ASSOC frame\n");
+        else if (ieee80211_is_reassoc_req(fc))
+                IWL_DEBUG_TX(priv, "Sending REASSOC frame\n");
+#endif
+
+        hdr_len = ieee80211_hdrlen(fc);
+
+        /* Find (or create) index into station table for destination station */
+        if (info->flags & IEEE80211_TX_CTL_INJECTED)
+                sta_id = priv->hw_params.bcast_sta_id;
+        else
+                sta_id = iwl_get_sta_id(priv, hdr);
+        if (sta_id == IWL_INVALID_STATION) {
+                IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
+                               hdr->addr1);
+                goto drop_unlock;
+        }
+
+        IWL_DEBUG_TX(priv, "station Id %d\n", sta_id);
+
+        if (sta)
+                sta_priv = (void *)sta->drv_priv;
+
+        if (sta_priv && sta_id != priv->hw_params.bcast_sta_id &&
+            sta_priv->asleep) {
+                WARN_ON(!(info->flags & IEEE80211_TX_CTL_PSPOLL_RESPONSE));
+                /*
+                 * This sends an asynchronous command to the device,
+                 * but we can rely on it being processed before the
+                 * next frame is processed -- and the next frame to
+                 * this station is the one that will consume this
+                 * counter.
+                 * For now set the counter to just 1 since we do not
+                 * support uAPSD yet.
+                 */
+                iwl_sta_modify_sleep_tx_count(priv, sta_id, 1);
+        }
+
+        txq_id = get_queue_from_ac(skb_get_queue_mapping(skb));
+        if (ieee80211_is_data_qos(fc)) {
+                qc = ieee80211_get_qos_ctl(hdr);
+                tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
+                if (unlikely(tid >= MAX_TID_COUNT))
+                        goto drop_unlock;
+                seq_number = priv->stations[sta_id].tid[tid].seq_number;
+                seq_number &= IEEE80211_SCTL_SEQ;
+                hdr->seq_ctrl = hdr->seq_ctrl &
+                                cpu_to_le16(IEEE80211_SCTL_FRAG);
+                hdr->seq_ctrl |= cpu_to_le16(seq_number);
+                seq_number += 0x10;
+                /* aggregation is on for this <sta,tid> */
+                if (info->flags & IEEE80211_TX_CTL_AMPDU &&
+                    priv->stations[sta_id].tid[tid].agg.state == IWL_AGG_ON) {
+                        txq_id = priv->stations[sta_id].tid[tid].agg.txq_id;
+                }
+        }
+
+        txq = &priv->txq[txq_id];
+        swq_id = txq->swq_id;
+        q = &txq->q;
+
+        if (unlikely(iwl_queue_space(q) < q->high_mark))
+                goto drop_unlock;
+
+        if (ieee80211_is_data_qos(fc))
+                priv->stations[sta_id].tid[tid].tfds_in_queue++;
+
+        /* Set up driver data for this TFD */
+        memset(&(txq->txb[q->write_ptr]), 0, sizeof(struct iwl_tx_info));
+        txq->txb[q->write_ptr].skb[0] = skb;
+
+        /* Set up first empty entry in queue's array of Tx/cmd buffers */
+        out_cmd = txq->cmd[q->write_ptr];
+        out_meta = &txq->meta[q->write_ptr];
+        tx_cmd = &out_cmd->cmd.tx;
+        memset(&out_cmd->hdr, 0, sizeof(out_cmd->hdr));
+        memset(tx_cmd, 0, sizeof(struct iwl_tx_cmd));
+
+        /*
+         * Set up the Tx-command (not MAC!) header.
+         * Store the chosen Tx queue and TFD index within the sequence field;
+         * after Tx, uCode's Tx response will return this value so driver can
+         * locate the frame within the tx queue and do post-tx processing.
+         */
+        out_cmd->hdr.cmd = REPLY_TX;
+        out_cmd->hdr.sequence = cpu_to_le16((u16)(QUEUE_TO_SEQ(txq_id) |
+                                INDEX_TO_SEQ(q->write_ptr)));
+
+        /* Copy MAC header from skb into command buffer */
+        memcpy(tx_cmd->hdr, hdr, hdr_len);
+
+
+        /* Total # bytes to be transmitted */
+        len = (u16)skb->len;
+        tx_cmd->len = cpu_to_le16(len);
+
+        if (info->control.hw_key)
+                iwlagn_tx_cmd_build_hwcrypto(priv, info, tx_cmd, skb, sta_id);
+
+        /* TODO need this for burst mode later on */
+        iwlagn_tx_cmd_build_basic(priv, tx_cmd, info, hdr, sta_id);
+        iwl_dbg_log_tx_data_frame(priv, len, hdr);
+
+        iwlagn_tx_cmd_build_rate(priv, tx_cmd, info, fc);
+
+        iwl_update_stats(priv, true, fc, len);
+        /*
+         * Use the first empty entry in this queue's command buffer array
+         * to contain the Tx command and MAC header concatenated together
+         * (payload data will be in another buffer).
+         * Size of this varies, due to varying MAC header length.
+         * If end is not dword aligned, we'll have 2 extra bytes at the end
+         * of the MAC header (device reads on dword boundaries).
+         * We'll tell device about this padding later.
+         */
+        len = sizeof(struct iwl_tx_cmd) +
+                sizeof(struct iwl_cmd_header) + hdr_len;
+
+        len_org = len;
+        firstlen = len = (len + 3) & ~3;
+
+        if (len_org != len)
+                len_org = 1;
+        else
+                len_org = 0;
+
+        /* Tell NIC about any 2-byte padding after MAC header */
+        if (len_org)
+                tx_cmd->tx_flags |= TX_CMD_FLG_MH_PAD_MSK;
+
+        /* Physical address of this Tx command's header (not MAC header!),
+         * within command buffer array. */
+        txcmd_phys = pci_map_single(priv->pci_dev,
+                                    &out_cmd->hdr, len,
+                                    PCI_DMA_BIDIRECTIONAL);
+        pci_unmap_addr_set(out_meta, mapping, txcmd_phys);
+        pci_unmap_len_set(out_meta, len, len);
+        /* Add buffer containing Tx command and MAC(!) header to TFD's
+         * first entry */
+        priv->cfg->ops->lib->txq_attach_buf_to_tfd(priv, txq,
+                                                   txcmd_phys, len, 1, 0);
+
+        if (!ieee80211_has_morefrags(hdr->frame_control)) {
+                txq->need_update = 1;
+                if (qc)
+                        priv->stations[sta_id].tid[tid].seq_number = seq_number;
+        } else {
+                wait_write_ptr = 1;
+                txq->need_update = 0;
+        }
+
+        /* Set up TFD's 2nd entry to point directly to remainder of skb,
+         * if any (802.11 null frames have no payload). */
+        secondlen = len = skb->len - hdr_len;
+        if (len) {
+                phys_addr = pci_map_single(priv->pci_dev, skb->data + hdr_len,
+                                           len, PCI_DMA_TODEVICE);
+                priv->cfg->ops->lib->txq_attach_buf_to_tfd(priv, txq,
+                                                           phys_addr, len,
+                                                           0, 0);
+        }
+
+        scratch_phys = txcmd_phys + sizeof(struct iwl_cmd_header) +
+                                offsetof(struct iwl_tx_cmd, scratch);
+
+        len = sizeof(struct iwl_tx_cmd) +
+                sizeof(struct iwl_cmd_header) + hdr_len;
+        /* take back ownership of DMA buffer to enable update */
+        pci_dma_sync_single_for_cpu(priv->pci_dev, txcmd_phys,
+                                    len, PCI_DMA_BIDIRECTIONAL);
+        tx_cmd->dram_lsb_ptr = cpu_to_le32(scratch_phys);
+        tx_cmd->dram_msb_ptr = iwl_get_dma_hi_addr(scratch_phys);
+
+        IWL_DEBUG_TX(priv, "sequence nr = 0X%x\n",
+                     le16_to_cpu(out_cmd->hdr.sequence));
+        IWL_DEBUG_TX(priv, "tx_flags = 0X%x\n", le32_to_cpu(tx_cmd->tx_flags));
+        iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd, sizeof(*tx_cmd));
+        iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd->hdr, hdr_len);
+
+        /* Set up entry for this TFD in Tx byte-count array */
+        if (info->flags & IEEE80211_TX_CTL_AMPDU)
+                priv->cfg->ops->lib->txq_update_byte_cnt_tbl(priv, txq,
+                                                     le16_to_cpu(tx_cmd->len));
+
+        pci_dma_sync_single_for_device(priv->pci_dev, txcmd_phys,
+                                       len, PCI_DMA_BIDIRECTIONAL);
+
+        trace_iwlwifi_dev_tx(priv,
+                             &((struct iwl_tfd *)txq->tfds)[txq->q.write_ptr],
+                             sizeof(struct iwl_tfd),
+                             &out_cmd->hdr, firstlen,
+                             skb->data + hdr_len, secondlen);
+
+        /* Tell device the write index *just past* this latest filled TFD */
+        q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
+        iwl_txq_update_write_ptr(priv, txq);
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        /*
+         * At this point the frame is "transmitted" successfully
+         * and we will get a TX status notification eventually,
+         * regardless of the value of ret. "ret" only indicates
+         * whether or not we should update the write pointer.
+         */
+
+        /* avoid atomic ops if it isn't an associated client */
+        if (sta_priv && sta_priv->client)
+                atomic_inc(&sta_priv->pending_frames);
+
+        if ((iwl_queue_space(q) < q->high_mark) && priv->mac80211_registered) {
+                if (wait_write_ptr) {
+                        spin_lock_irqsave(&priv->lock, flags);
+                        txq->need_update = 1;
+                        iwl_txq_update_write_ptr(priv, txq);
+                        spin_unlock_irqrestore(&priv->lock, flags);
+                } else {
+                        iwl_stop_queue(priv, txq->swq_id);
+                }
+        }
+
+        return 0;
+
+drop_unlock:
+        spin_unlock_irqrestore(&priv->lock, flags);
+        return -1;
+}
+
+static inline int iwlagn_alloc_dma_ptr(struct iwl_priv *priv,
+                                    struct iwl_dma_ptr *ptr, size_t size)
+{
+        ptr->addr = dma_alloc_coherent(&priv->pci_dev->dev, size, &ptr->dma,
+                                       GFP_KERNEL);
+        if (!ptr->addr)
+                return -ENOMEM;
+        ptr->size = size;
+        return 0;
+}
+
+static inline void iwlagn_free_dma_ptr(struct iwl_priv *priv,
+                                    struct iwl_dma_ptr *ptr)
+{
+        if (unlikely(!ptr->addr))
+                return;
+
+        dma_free_coherent(&priv->pci_dev->dev, ptr->size, ptr->addr, ptr->dma);
+        memset(ptr, 0, sizeof(*ptr));
+}
+
+/**
+ * iwlagn_hw_txq_ctx_free - Free TXQ Context
+ *
+ * Destroy all TX DMA queues and structures
+ */
+void iwlagn_hw_txq_ctx_free(struct iwl_priv *priv)
+{
+        int txq_id;
+
+        /* Tx queues */
+        if (priv->txq) {
+                for (txq_id = 0; txq_id < priv->hw_params.max_txq_num;
+                     txq_id++)
+                        if (txq_id == IWL_CMD_QUEUE_NUM)
+                                iwl_cmd_queue_free(priv);
+                        else
+                                iwl_tx_queue_free(priv, txq_id);
+        }
+        iwlagn_free_dma_ptr(priv, &priv->kw);
+
+        iwlagn_free_dma_ptr(priv, &priv->scd_bc_tbls);
+
+        /* free tx queue structure */
+        iwl_free_txq_mem(priv);
+}
+
+/**
+ * iwlagn_txq_ctx_reset - Reset TX queue context
+ * Destroys all DMA structures and initialize them again
+ *
+ * @param priv
+ * @return error code
+ */
+int iwlagn_txq_ctx_reset(struct iwl_priv *priv)
+{
+        int ret = 0;
+        int txq_id, slots_num;
+        unsigned long flags;
+
+        /* Free all tx/cmd queues and keep-warm buffer */
+        iwlagn_hw_txq_ctx_free(priv);
+
+        ret = iwlagn_alloc_dma_ptr(priv, &priv->scd_bc_tbls,
+                                priv->hw_params.scd_bc_tbls_size);
+        if (ret) {
+                IWL_ERR(priv, "Scheduler BC Table allocation failed\n");
+                goto error_bc_tbls;
+        }
+        /* Alloc keep-warm buffer */
+        ret = iwlagn_alloc_dma_ptr(priv, &priv->kw, IWL_KW_SIZE);
+        if (ret) {
+                IWL_ERR(priv, "Keep Warm allocation failed\n");
+                goto error_kw;
+        }
+
+        /* allocate tx queue structure */
+        ret = iwl_alloc_txq_mem(priv);
+        if (ret)
+                goto error;
+
+        spin_lock_irqsave(&priv->lock, flags);
+
+        /* Turn off all Tx DMA fifos */
+        priv->cfg->ops->lib->txq_set_sched(priv, 0);
+
+        /* Tell NIC where to find the "keep warm" buffer */
+        iwl_write_direct32(priv, FH_KW_MEM_ADDR_REG, priv->kw.dma >> 4);
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        /* Alloc and init all Tx queues, including the command queue (#4) */
+        for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++) {
+                slots_num = (txq_id == IWL_CMD_QUEUE_NUM) ?
+                                        TFD_CMD_SLOTS : TFD_TX_CMD_SLOTS;
+                ret = iwl_tx_queue_init(priv, &priv->txq[txq_id], slots_num,
+                                       txq_id);
+                if (ret) {
+                        IWL_ERR(priv, "Tx %d queue init failed\n", txq_id);
+                        goto error;
+                }
+        }
+
+        return ret;
+
+ error:
+        iwlagn_hw_txq_ctx_free(priv);
+        iwlagn_free_dma_ptr(priv, &priv->kw);
+ error_kw:
+        iwlagn_free_dma_ptr(priv, &priv->scd_bc_tbls);
+ error_bc_tbls:
+        return ret;
+}
+
+/**
+ * iwlagn_txq_ctx_stop - Stop all Tx DMA channels, free Tx queue memory
+ */
+void iwlagn_txq_ctx_stop(struct iwl_priv *priv)
+{
+        int ch;
+        unsigned long flags;
+
+        /* Turn off all Tx DMA fifos */
+        spin_lock_irqsave(&priv->lock, flags);
+
+        priv->cfg->ops->lib->txq_set_sched(priv, 0);
+
+        /* Stop each Tx DMA channel, and wait for it to be idle */
+        for (ch = 0; ch < priv->hw_params.dma_chnl_num; ch++) {
+                iwl_write_direct32(priv, FH_TCSR_CHNL_TX_CONFIG_REG(ch), 0x0);
+                iwl_poll_direct_bit(priv, FH_TSSR_TX_STATUS_REG,
+                                    FH_TSSR_TX_STATUS_REG_MSK_CHNL_IDLE(ch),
+                                    1000);
+        }
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        /* Deallocate memory for all Tx queues */
+        iwlagn_hw_txq_ctx_free(priv);
+}
+
+/*
+ * Find first available (lowest unused) Tx Queue, mark it "active".
+ * Called only when finding queue for aggregation.
+ * Should never return anything < 7, because they should already
+ * be in use as EDCA AC (0-3), Command (4), reserved (5, 6)
+ */
+static int iwlagn_txq_ctx_activate_free(struct iwl_priv *priv)
+{
+        int txq_id;
+
+        for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++)
+                if (!test_and_set_bit(txq_id, &priv->txq_ctx_active_msk))
+                        return txq_id;
+        return -1;
+}
+
+int iwlagn_tx_agg_start(struct iwl_priv *priv, const u8 *ra, u16 tid, u16 *ssn)
+{
+        int sta_id;
+        int tx_fifo;
+        int txq_id;
+        int ret;
+        unsigned long flags;
+        struct iwl_tid_data *tid_data;
+
+        tx_fifo = get_fifo_from_tid(tid);
+        if (unlikely(tx_fifo < 0))
+                return tx_fifo;
+
+        IWL_WARN(priv, "%s on ra = %pM tid = %d\n",
+                        __func__, ra, tid);
+
+        sta_id = iwl_find_station(priv, ra);
+        if (sta_id == IWL_INVALID_STATION) {
+                IWL_ERR(priv, "Start AGG on invalid station\n");
+                return -ENXIO;
+        }
+        if (unlikely(tid >= MAX_TID_COUNT))
+                return -EINVAL;
+
+        if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_OFF) {
+                IWL_ERR(priv, "Start AGG when state is not IWL_AGG_OFF !\n");
+                return -ENXIO;
+        }
+
+        txq_id = iwlagn_txq_ctx_activate_free(priv);
+        if (txq_id == -1) {
+                IWL_ERR(priv, "No free aggregation queue available\n");
+                return -ENXIO;
+        }
+
+        spin_lock_irqsave(&priv->sta_lock, flags);
+        tid_data = &priv->stations[sta_id].tid[tid];
+        *ssn = SEQ_TO_SN(tid_data->seq_number);
+        tid_data->agg.txq_id = txq_id;
+        priv->txq[txq_id].swq_id = iwl_virtual_agg_queue_num(tx_fifo, txq_id);
+        spin_unlock_irqrestore(&priv->sta_lock, flags);
+
+        ret = priv->cfg->ops->lib->txq_agg_enable(priv, txq_id, tx_fifo,
+                                                  sta_id, tid, *ssn);
+        if (ret)
+                return ret;
+
+        if (tid_data->tfds_in_queue == 0) {
+                IWL_DEBUG_HT(priv, "HW queue is empty\n");
+                tid_data->agg.state = IWL_AGG_ON;
+                ieee80211_start_tx_ba_cb_irqsafe(priv->vif, ra, tid);
+        } else {
+                IWL_DEBUG_HT(priv, "HW queue is NOT empty: %d packets in HW queue\n",
+                             tid_data->tfds_in_queue);
+                tid_data->agg.state = IWL_EMPTYING_HW_QUEUE_ADDBA;
+        }
+        return ret;
+}
+
+int iwlagn_tx_agg_stop(struct iwl_priv *priv , const u8 *ra, u16 tid)
+{
+        int tx_fifo_id, txq_id, sta_id, ssn = -1;
+        struct iwl_tid_data *tid_data;
+        int write_ptr, read_ptr;
+        unsigned long flags;
+
+        if (!ra) {
+                IWL_ERR(priv, "ra = NULL\n");
+                return -EINVAL;
+        }
+
+        tx_fifo_id = get_fifo_from_tid(tid);
+        if (unlikely(tx_fifo_id < 0))
+                return tx_fifo_id;
+
+        sta_id = iwl_find_station(priv, ra);
+
+        if (sta_id == IWL_INVALID_STATION) {
+                IWL_ERR(priv, "Invalid station for AGG tid %d\n", tid);
+                return -ENXIO;
+        }
+
+        if (priv->stations[sta_id].tid[tid].agg.state ==
+                                IWL_EMPTYING_HW_QUEUE_ADDBA) {
+                IWL_DEBUG_HT(priv, "AGG stop before setup done\n");
+                ieee80211_stop_tx_ba_cb_irqsafe(priv->vif, ra, tid);
+                priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF;
+                return 0;
+        }
+
+        if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_ON)
+                IWL_WARN(priv, "Stopping AGG while state not ON or starting\n");
+
+        tid_data = &priv->stations[sta_id].tid[tid];
+        ssn = (tid_data->seq_number & IEEE80211_SCTL_SEQ) >> 4;
+        txq_id = tid_data->agg.txq_id;
+        write_ptr = priv->txq[txq_id].q.write_ptr;
+        read_ptr = priv->txq[txq_id].q.read_ptr;
+
+        /* The queue is not empty */
+        if (write_ptr != read_ptr) {
+                IWL_DEBUG_HT(priv, "Stopping a non empty AGG HW QUEUE\n");
+                priv->stations[sta_id].tid[tid].agg.state =
+                                IWL_EMPTYING_HW_QUEUE_DELBA;
+                return 0;
+        }
+
+        IWL_DEBUG_HT(priv, "HW queue is empty\n");
+        priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF;
+
+        spin_lock_irqsave(&priv->lock, flags);
+        /*
+         * the only reason this call can fail is queue number out of range,
+         * which can happen if uCode is reloaded and all the station
+         * information are lost. if it is outside the range, there is no need
+         * to deactivate the uCode queue, just return "success" to allow
+         *  mac80211 to clean up it own data.
+         */
+        priv->cfg->ops->lib->txq_agg_disable(priv, txq_id, ssn,
+                                                   tx_fifo_id);
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        ieee80211_stop_tx_ba_cb_irqsafe(priv->vif, ra, tid);
+
+        return 0;
+}
+
+int iwlagn_txq_check_empty(struct iwl_priv *priv,
+                           int sta_id, u8 tid, int txq_id)
+{
+        struct iwl_queue *q = &priv->txq[txq_id].q;
+        u8 *addr = priv->stations[sta_id].sta.sta.addr;
+        struct iwl_tid_data *tid_data = &priv->stations[sta_id].tid[tid];
+
+        switch (priv->stations[sta_id].tid[tid].agg.state) {
+        case IWL_EMPTYING_HW_QUEUE_DELBA:
+                /* We are reclaiming the last packet of the */
+                /* aggregated HW queue */
+                if ((txq_id  == tid_data->agg.txq_id) &&
+                    (q->read_ptr == q->write_ptr)) {
+                        u16 ssn = SEQ_TO_SN(tid_data->seq_number);
+                        int tx_fifo = get_fifo_from_tid(tid);
+                        IWL_DEBUG_HT(priv, "HW queue empty: continue DELBA flow\n");
+                        priv->cfg->ops->lib->txq_agg_disable(priv, txq_id,
+                                                             ssn, tx_fifo);
+                        tid_data->agg.state = IWL_AGG_OFF;
+                        ieee80211_stop_tx_ba_cb_irqsafe(priv->vif, addr, tid);
+                }
+                break;
+        case IWL_EMPTYING_HW_QUEUE_ADDBA:
+                /* We are reclaiming the last packet of the queue */
+                if (tid_data->tfds_in_queue == 0) {
+                        IWL_DEBUG_HT(priv, "HW queue empty: continue ADDBA flow\n");
+                        tid_data->agg.state = IWL_AGG_ON;
+                        ieee80211_start_tx_ba_cb_irqsafe(priv->vif, addr, tid);
+                }
+                break;
+        }
+        return 0;
+}
+
+static void iwlagn_tx_status(struct iwl_priv *priv, struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_sta *sta;
+        struct iwl_station_priv *sta_priv;
+
+        sta = ieee80211_find_sta(priv->vif, hdr->addr1);
+        if (sta) {
+                sta_priv = (void *)sta->drv_priv;
+                /* avoid atomic ops if this isn't a client */
+                if (sta_priv->client &&
+                    atomic_dec_return(&sta_priv->pending_frames) == 0)
+                        ieee80211_sta_block_awake(priv->hw, sta, false);
+        }
+
+        ieee80211_tx_status_irqsafe(priv->hw, skb);
+}
+
+int iwlagn_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
+{
+        struct iwl_tx_queue *txq = &priv->txq[txq_id];
+        struct iwl_queue *q = &txq->q;
+        struct iwl_tx_info *tx_info;
+        int nfreed = 0;
+        struct ieee80211_hdr *hdr;
+
+        if ((index >= q->n_bd) || (iwl_queue_used(q, index) == 0)) {
+                IWL_ERR(priv, "Read index for DMA queue txq id (%d), index %d, "
+                          "is out of range [0-%d] %d %d.\n", txq_id,
+                          index, q->n_bd, q->write_ptr, q->read_ptr);
+                return 0;
+        }
+
+        for (index = iwl_queue_inc_wrap(index, q->n_bd);
+             q->read_ptr != index;
+             q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
+
+                tx_info = &txq->txb[txq->q.read_ptr];
+                iwlagn_tx_status(priv, tx_info->skb[0]);
+
+                hdr = (struct ieee80211_hdr *)tx_info->skb[0]->data;
+                if (hdr && ieee80211_is_data_qos(hdr->frame_control))
+                        nfreed++;
+                tx_info->skb[0] = NULL;
+
+                if (priv->cfg->ops->lib->txq_inval_byte_cnt_tbl)
+                        priv->cfg->ops->lib->txq_inval_byte_cnt_tbl(priv, txq);
+
+                priv->cfg->ops->lib->txq_free_tfd(priv, txq);
+        }
+        return nfreed;
+}
+
+/**
+ * iwlagn_tx_status_reply_compressed_ba - Update tx status from block-ack
+ *
+ * Go through block-ack's bitmap of ACK'd frames, update driver's record of
+ * ACK vs. not.  This gets sent to mac80211, then to rate scaling algo.
+ */
+static int iwlagn_tx_status_reply_compressed_ba(struct iwl_priv *priv,
+                                 struct iwl_ht_agg *agg,
+                                 struct iwl_compressed_ba_resp *ba_resp)
+
+{
+        int i, sh, ack;
+        u16 seq_ctl = le16_to_cpu(ba_resp->seq_ctl);
+        u16 scd_flow = le16_to_cpu(ba_resp->scd_flow);
+        u64 bitmap;
+        int successes = 0;
+        struct ieee80211_tx_info *info;
+
+        if (unlikely(!agg->wait_for_ba))  {
+                IWL_ERR(priv, "Received BA when not expected\n");
+                return -EINVAL;
+        }
+
+        /* Mark that the expected block-ack response arrived */
+        agg->wait_for_ba = 0;
+        IWL_DEBUG_TX_REPLY(priv, "BA %d %d\n", agg->start_idx, ba_resp->seq_ctl);
+
+        /* Calculate shift to align block-ack bits with our Tx window bits */
+        sh = agg->start_idx - SEQ_TO_INDEX(seq_ctl >> 4);
+        if (sh < 0) /* tbw something is wrong with indices */
+                sh += 0x100;
+
+        /* don't use 64-bit values for now */
+        bitmap = le64_to_cpu(ba_resp->bitmap) >> sh;
+
+        if (agg->frame_count > (64 - sh)) {
+                IWL_DEBUG_TX_REPLY(priv, "more frames than bitmap size");
+                return -1;
+        }
+
+        /* check for success or failure according to the
+         * transmitted bitmap and block-ack bitmap */
+        bitmap &= agg->bitmap;
+
+        /* For each frame attempted in aggregation,
+         * update driver's record of tx frame's status. */
+        for (i = 0; i < agg->frame_count ; i++) {
+                ack = bitmap & (1ULL << i);
+                successes += !!ack;
+                IWL_DEBUG_TX_REPLY(priv, "%s ON i=%d idx=%d raw=%d\n",
+                        ack ? "ACK" : "NACK", i, (agg->start_idx + i) & 0xff,
+                        agg->start_idx + i);
+        }
+
+        info = IEEE80211_SKB_CB(priv->txq[scd_flow].txb[agg->start_idx].skb[0]);
+        memset(&info->status, 0, sizeof(info->status));
+        info->flags |= IEEE80211_TX_STAT_ACK;
+        info->flags |= IEEE80211_TX_STAT_AMPDU;
+        info->status.ampdu_ack_map = successes;
+        info->status.ampdu_ack_len = agg->frame_count;
+        iwlagn_hwrate_to_tx_control(priv, agg->rate_n_flags, info);
+
+        IWL_DEBUG_TX_REPLY(priv, "Bitmap %llx\n", (unsigned long long)bitmap);
+
+        return 0;
+}
+
+/**
+ * translate ucode response to mac80211 tx status control values
+ */
+void iwlagn_hwrate_to_tx_control(struct iwl_priv *priv, u32 rate_n_flags,
+                                  struct ieee80211_tx_info *info)
+{
+        struct ieee80211_tx_rate *r = &info->control.rates[0];
+
+        info->antenna_sel_tx =
+                ((rate_n_flags & RATE_MCS_ANT_ABC_MSK) >> RATE_MCS_ANT_POS);
+        if (rate_n_flags & RATE_MCS_HT_MSK)
+                r->flags |= IEEE80211_TX_RC_MCS;
+        if (rate_n_flags & RATE_MCS_GF_MSK)
+                r->flags |= IEEE80211_TX_RC_GREEN_FIELD;
+        if (rate_n_flags & RATE_MCS_HT40_MSK)
+                r->flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
+        if (rate_n_flags & RATE_MCS_DUP_MSK)
+                r->flags |= IEEE80211_TX_RC_DUP_DATA;
+        if (rate_n_flags & RATE_MCS_SGI_MSK)
+                r->flags |= IEEE80211_TX_RC_SHORT_GI;
+        r->idx = iwlagn_hwrate_to_mac80211_idx(rate_n_flags, info->band);
+}
+
+/**
+ * iwlagn_rx_reply_compressed_ba - Handler for REPLY_COMPRESSED_BA
+ *
+ * Handles block-acknowledge notification from device, which reports success
+ * of frames sent via aggregation.
+ */
+void iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
+                                           struct iwl_rx_mem_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_compressed_ba_resp *ba_resp = &pkt->u.compressed_ba;
+        struct iwl_tx_queue *txq = NULL;
+        struct iwl_ht_agg *agg;
+        int index;
+        int sta_id;
+        int tid;
+
+        /* "flow" corresponds to Tx queue */
+        u16 scd_flow = le16_to_cpu(ba_resp->scd_flow);
+
+        /* "ssn" is start of block-ack Tx window, corresponds to index
+         * (in Tx queue's circular buffer) of first TFD/frame in window */
+        u16 ba_resp_scd_ssn = le16_to_cpu(ba_resp->scd_ssn);
+
+        if (scd_flow >= priv->hw_params.max_txq_num) {
+                IWL_ERR(priv,
+                        "BUG_ON scd_flow is bigger than number of queues\n");
+                return;
+        }
+
+        txq = &priv->txq[scd_flow];
+        sta_id = ba_resp->sta_id;
+        tid = ba_resp->tid;
+        agg = &priv->stations[sta_id].tid[tid].agg;
+
+        /* Find index just before block-ack window */
+        index = iwl_queue_dec_wrap(ba_resp_scd_ssn & 0xff, txq->q.n_bd);
+
+        /* TODO: Need to get this copy more safely - now good for debug */
+
+        IWL_DEBUG_TX_REPLY(priv, "REPLY_COMPRESSED_BA [%d] Received from %pM, "
+                           "sta_id = %d\n",
+                           agg->wait_for_ba,
+                           (u8 *) &ba_resp->sta_addr_lo32,
+                           ba_resp->sta_id);
+        IWL_DEBUG_TX_REPLY(priv, "TID = %d, SeqCtl = %d, bitmap = 0x%llx, scd_flow = "
+                           "%d, scd_ssn = %d\n",
+                           ba_resp->tid,
+                           ba_resp->seq_ctl,
+                           (unsigned long long)le64_to_cpu(ba_resp->bitmap),
+                           ba_resp->scd_flow,
+                           ba_resp->scd_ssn);
+        IWL_DEBUG_TX_REPLY(priv, "DAT start_idx = %d, bitmap = 0x%llx\n",
+                           agg->start_idx,
+                           (unsigned long long)agg->bitmap);
+
+        /* Update driver's record of ACK vs. not for each frame in window */
+        iwlagn_tx_status_reply_compressed_ba(priv, agg, ba_resp);
+
+        /* Release all TFDs before the SSN, i.e. all TFDs in front of
+         * block-ack window (we assume that they've been successfully
+         * transmitted ... if not, it's too late anyway). */
+        if (txq->q.read_ptr != (ba_resp_scd_ssn & 0xff)) {
+                /* calculate mac80211 ampdu sw queue to wake */
+                int freed = iwlagn_tx_queue_reclaim(priv, scd_flow, index);
+                iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
+
+                if ((iwl_queue_space(&txq->q) > txq->q.low_mark) &&
+                    priv->mac80211_registered &&
+                    (agg->state != IWL_EMPTYING_HW_QUEUE_DELBA))
+                        iwl_wake_queue(priv, txq->swq_id);
+
+                iwlagn_txq_check_empty(priv, sta_id, tid, scd_flow);
+        }
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c b/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
new file mode 100644
index 000000000000..52ae157968b2
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
@@ -0,0 +1,416 @@
+/******************************************************************************
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ *****************************************************************************/
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/sched.h>
+
+#include "iwl-dev.h"
+#include "iwl-core.h"
+#include "iwl-io.h"
+#include "iwl-helpers.h"
+#include "iwl-agn-hw.h"
+#include "iwl-agn.h"
+
+static const s8 iwlagn_default_queue_to_tx_fifo[] = {
+        IWL_TX_FIFO_VO,
+        IWL_TX_FIFO_VI,
+        IWL_TX_FIFO_BE,
+        IWL_TX_FIFO_BK,
+        IWLAGN_CMD_FIFO_NUM,
+        IWL_TX_FIFO_UNUSED,
+        IWL_TX_FIFO_UNUSED,
+        IWL_TX_FIFO_UNUSED,
+        IWL_TX_FIFO_UNUSED,
+        IWL_TX_FIFO_UNUSED,
+};
+
+/*
+ * ucode
+ */
+static int iwlagn_load_section(struct iwl_priv *priv, const char *name,
+                                struct fw_desc *image, u32 dst_addr)
+{
+        dma_addr_t phy_addr = image->p_addr;
+        u32 byte_cnt = image->len;
+        int ret;
+
+        priv->ucode_write_complete = 0;
+
+        iwl_write_direct32(priv,
+                FH_TCSR_CHNL_TX_CONFIG_REG(FH_SRVC_CHNL),
+                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_PAUSE);
+
+        iwl_write_direct32(priv,
+                FH_SRVC_CHNL_SRAM_ADDR_REG(FH_SRVC_CHNL), dst_addr);
+
+        iwl_write_direct32(priv,
+                FH_TFDIB_CTRL0_REG(FH_SRVC_CHNL),
+                phy_addr & FH_MEM_TFDIB_DRAM_ADDR_LSB_MSK);
+
+        iwl_write_direct32(priv,
+                FH_TFDIB_CTRL1_REG(FH_SRVC_CHNL),
+                (iwl_get_dma_hi_addr(phy_addr)
+                        << FH_MEM_TFDIB_REG1_ADDR_BITSHIFT) | byte_cnt);
+
+        iwl_write_direct32(priv,
+                FH_TCSR_CHNL_TX_BUF_STS_REG(FH_SRVC_CHNL),
+                1 << FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_NUM |
+                1 << FH_TCSR_CHNL_TX_BUF_STS_REG_POS_TB_IDX |
+                FH_TCSR_CHNL_TX_BUF_STS_REG_VAL_TFDB_VALID);
+
+        iwl_write_direct32(priv,
+                FH_TCSR_CHNL_TX_CONFIG_REG(FH_SRVC_CHNL),
+                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE       |
+                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_DISABLE    |
+                FH_TCSR_TX_CONFIG_REG_VAL_CIRQ_HOST_ENDTFD);
+
+        IWL_DEBUG_INFO(priv, "%s uCode section being loaded...\n", name);
+        ret = wait_event_interruptible_timeout(priv->wait_command_queue,
+                                        priv->ucode_write_complete, 5 * HZ);
+        if (ret == -ERESTARTSYS) {
+                IWL_ERR(priv, "Could not load the %s uCode section due "
+                        "to interrupt\n", name);
+                return ret;
+        }
+        if (!ret) {
+                IWL_ERR(priv, "Could not load the %s uCode section\n",
+                        name);
+                return -ETIMEDOUT;
+        }
+
+        return 0;
+}
+
+static int iwlagn_load_given_ucode(struct iwl_priv *priv,
+                struct fw_desc *inst_image,
+                struct fw_desc *data_image)
+{
+        int ret = 0;
+
+        ret = iwlagn_load_section(priv, "INST", inst_image,
+                                   IWLAGN_RTC_INST_LOWER_BOUND);
+        if (ret)
+                return ret;
+
+        return iwlagn_load_section(priv, "DATA", data_image,
+                                    IWLAGN_RTC_DATA_LOWER_BOUND);
+}
+
+int iwlagn_load_ucode(struct iwl_priv *priv)
+{
+        int ret = 0;
+
+        /* check whether init ucode should be loaded, or rather runtime ucode */
+        if (priv->ucode_init.len && (priv->ucode_type == UCODE_NONE)) {
+                IWL_DEBUG_INFO(priv, "Init ucode found. Loading init ucode...\n");
+                ret = iwlagn_load_given_ucode(priv,
+                        &priv->ucode_init, &priv->ucode_init_data);
+                if (!ret) {
+                        IWL_DEBUG_INFO(priv, "Init ucode load complete.\n");
+                        priv->ucode_type = UCODE_INIT;
+                }
+        } else {
+                IWL_DEBUG_INFO(priv, "Init ucode not found, or already loaded. "
+                        "Loading runtime ucode...\n");
+                ret = iwlagn_load_given_ucode(priv,
+                        &priv->ucode_code, &priv->ucode_data);
+                if (!ret) {
+                        IWL_DEBUG_INFO(priv, "Runtime ucode load complete.\n");
+                        priv->ucode_type = UCODE_RT;
+                }
+        }
+
+        return ret;
+}
+
+#define IWL_UCODE_GET(item)                                             \
+static u32 iwlagn_ucode_get_##item(const struct iwl_ucode_header *ucode,\
+                                    u32 api_ver)                        \
+{                                                                       \
+        if (api_ver <= 2)                                               \
+                return le32_to_cpu(ucode->u.v1.item);                   \
+        return le32_to_cpu(ucode->u.v2.item);                           \
+}
+
+static u32 iwlagn_ucode_get_header_size(u32 api_ver)
+{
+        if (api_ver <= 2)
+                return UCODE_HEADER_SIZE(1);
+        return UCODE_HEADER_SIZE(2);
+}
+
+static u32 iwlagn_ucode_get_build(const struct iwl_ucode_header *ucode,
+                                   u32 api_ver)
+{
+        if (api_ver <= 2)
+                return 0;
+        return le32_to_cpu(ucode->u.v2.build);
+}
+
+static u8 *iwlagn_ucode_get_data(const struct iwl_ucode_header *ucode,
+                                  u32 api_ver)
+{
+        if (api_ver <= 2)
+                return (u8 *) ucode->u.v1.data;
+        return (u8 *) ucode->u.v2.data;
+}
+
+IWL_UCODE_GET(inst_size);
+IWL_UCODE_GET(data_size);
+IWL_UCODE_GET(init_size);
+IWL_UCODE_GET(init_data_size);
+IWL_UCODE_GET(boot_size);
+
+struct iwl_ucode_ops iwlagn_ucode = {
+        .get_header_size = iwlagn_ucode_get_header_size,
+        .get_build = iwlagn_ucode_get_build,
+        .get_inst_size = iwlagn_ucode_get_inst_size,
+        .get_data_size = iwlagn_ucode_get_data_size,
+        .get_init_size = iwlagn_ucode_get_init_size,
+        .get_init_data_size = iwlagn_ucode_get_init_data_size,
+        .get_boot_size = iwlagn_ucode_get_boot_size,
+        .get_data = iwlagn_ucode_get_data,
+};
+
+/*
+ *  Calibration
+ */
+static int iwlagn_set_Xtal_calib(struct iwl_priv *priv)
+{
+        struct iwl_calib_xtal_freq_cmd cmd;
+        __le16 *xtal_calib =
+                (__le16 *)iwl_eeprom_query_addr(priv, EEPROM_5000_XTAL);
+
+        cmd.hdr.op_code = IWL_PHY_CALIBRATE_CRYSTAL_FRQ_CMD;
+        cmd.hdr.first_group = 0;
+        cmd.hdr.groups_num = 1;
+        cmd.hdr.data_valid = 1;
+        cmd.cap_pin1 = le16_to_cpu(xtal_calib[0]);
+        cmd.cap_pin2 = le16_to_cpu(xtal_calib[1]);
+        return iwl_calib_set(&priv->calib_results[IWL_CALIB_XTAL],
+                             (u8 *)&cmd, sizeof(cmd));
+}
+
+static int iwlagn_send_calib_cfg(struct iwl_priv *priv)
+{
+        struct iwl_calib_cfg_cmd calib_cfg_cmd;
+        struct iwl_host_cmd cmd = {
+                .id = CALIBRATION_CFG_CMD,
+                .len = sizeof(struct iwl_calib_cfg_cmd),
+                .data = &calib_cfg_cmd,
+        };
+
+        memset(&calib_cfg_cmd, 0, sizeof(calib_cfg_cmd));
+        calib_cfg_cmd.ucd_calib_cfg.once.is_enable = IWL_CALIB_INIT_CFG_ALL;
+        calib_cfg_cmd.ucd_calib_cfg.once.start = IWL_CALIB_INIT_CFG_ALL;
+        calib_cfg_cmd.ucd_calib_cfg.once.send_res = IWL_CALIB_INIT_CFG_ALL;
+        calib_cfg_cmd.ucd_calib_cfg.flags = IWL_CALIB_INIT_CFG_ALL;
+
+        return iwl_send_cmd(priv, &cmd);
+}
+
+void iwlagn_rx_calib_result(struct iwl_priv *priv,
+                             struct iwl_rx_mem_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_calib_hdr *hdr = (struct iwl_calib_hdr *)pkt->u.raw;
+        int len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
+        int index;
+
+        /* reduce the size of the length field itself */
+        len -= 4;
+
+        /* Define the order in which the results will be sent to the runtime
+         * uCode. iwl_send_calib_results sends them in a row according to
+         * their index. We sort them here
+         */
+        switch (hdr->op_code) {
+        case IWL_PHY_CALIBRATE_DC_CMD:
+                index = IWL_CALIB_DC;
+                break;
+        case IWL_PHY_CALIBRATE_LO_CMD:
+                index = IWL_CALIB_LO;
+                break;
+        case IWL_PHY_CALIBRATE_TX_IQ_CMD:
+                index = IWL_CALIB_TX_IQ;
+                break;
+        case IWL_PHY_CALIBRATE_TX_IQ_PERD_CMD:
+                index = IWL_CALIB_TX_IQ_PERD;
+                break;
+        case IWL_PHY_CALIBRATE_BASE_BAND_CMD:
+                index = IWL_CALIB_BASE_BAND;
+                break;
+        default:
+                IWL_ERR(priv, "Unknown calibration notification %d\n",
+                          hdr->op_code);
+                return;
+        }
+        iwl_calib_set(&priv->calib_results[index], pkt->u.raw, len);
+}
+
+void iwlagn_rx_calib_complete(struct iwl_priv *priv,
+                               struct iwl_rx_mem_buffer *rxb)
+{
+        IWL_DEBUG_INFO(priv, "Init. calibration is completed, restarting fw.\n");
+        queue_work(priv->workqueue, &priv->restart);
+}
+
+void iwlagn_init_alive_start(struct iwl_priv *priv)
+{
+        int ret = 0;
+
+        /* Check alive response for "valid" sign from uCode */
+        if (priv->card_alive_init.is_valid != UCODE_VALID_OK) {
+                /* We had an error bringing up the hardware, so take it
+                 * all the way back down so we can try again */
+                IWL_DEBUG_INFO(priv, "Initialize Alive failed.\n");
+                goto restart;
+        }
+
+        /* initialize uCode was loaded... verify inst image.
+         * This is a paranoid check, because we would not have gotten the
+         * "initialize" alive if code weren't properly loaded.  */
+        if (iwl_verify_ucode(priv)) {
+                /* Runtime instruction load was bad;
+                 * take it all the way back down so we can try again */
+                IWL_DEBUG_INFO(priv, "Bad \"initialize\" uCode load.\n");
+                goto restart;
+        }
+
+        ret = priv->cfg->ops->lib->alive_notify(priv);
+        if (ret) {
+                IWL_WARN(priv,
+                        "Could not complete ALIVE transition: %d\n", ret);
+                goto restart;
+        }
+
+        iwlagn_send_calib_cfg(priv);
+        return;
+
+restart:
+        /* real restart (first load init_ucode) */
+        queue_work(priv->workqueue, &priv->restart);
+}
+
+int iwlagn_alive_notify(struct iwl_priv *priv)
+{
+        u32 a;
+        unsigned long flags;
+        int i, chan;
+        u32 reg_val;
+
+        spin_lock_irqsave(&priv->lock, flags);
+
+        priv->scd_base_addr = iwl_read_prph(priv, IWL50_SCD_SRAM_BASE_ADDR);
+        a = priv->scd_base_addr + IWL50_SCD_CONTEXT_DATA_OFFSET;
+        for (; a < priv->scd_base_addr + IWL50_SCD_TX_STTS_BITMAP_OFFSET;
+                a += 4)
+                iwl_write_targ_mem(priv, a, 0);
+        for (; a < priv->scd_base_addr + IWL50_SCD_TRANSLATE_TBL_OFFSET;
+                a += 4)
+                iwl_write_targ_mem(priv, a, 0);
+        for (; a < priv->scd_base_addr +
+               IWL50_SCD_TRANSLATE_TBL_OFFSET_QUEUE(priv->hw_params.max_txq_num); a += 4)
+                iwl_write_targ_mem(priv, a, 0);
+
+        iwl_write_prph(priv, IWL50_SCD_DRAM_BASE_ADDR,
+                       priv->scd_bc_tbls.dma >> 10);
+
+        /* Enable DMA channel */
+        for (chan = 0; chan < FH50_TCSR_CHNL_NUM ; chan++)
+                iwl_write_direct32(priv, FH_TCSR_CHNL_TX_CONFIG_REG(chan),
+                                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE |
+                                FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_ENABLE);
+
+        /* Update FH chicken bits */
+        reg_val = iwl_read_direct32(priv, FH_TX_CHICKEN_BITS_REG);
+        iwl_write_direct32(priv, FH_TX_CHICKEN_BITS_REG,
+                           reg_val | FH_TX_CHICKEN_BITS_SCD_AUTO_RETRY_EN);
+
+        iwl_write_prph(priv, IWL50_SCD_QUEUECHAIN_SEL,
+                IWL50_SCD_QUEUECHAIN_SEL_ALL(priv->hw_params.max_txq_num));
+        iwl_write_prph(priv, IWL50_SCD_AGGR_SEL, 0);
+
+        /* initiate the queues */
+        for (i = 0; i < priv->hw_params.max_txq_num; i++) {
+                iwl_write_prph(priv, IWL50_SCD_QUEUE_RDPTR(i), 0);
+                iwl_write_direct32(priv, HBUS_TARG_WRPTR, 0 | (i << 8));
+                iwl_write_targ_mem(priv, priv->scd_base_addr +
+                                IWL50_SCD_CONTEXT_QUEUE_OFFSET(i), 0);
+                iwl_write_targ_mem(priv, priv->scd_base_addr +
+                                IWL50_SCD_CONTEXT_QUEUE_OFFSET(i) +
+                                sizeof(u32),
+                                ((SCD_WIN_SIZE <<
+                                IWL50_SCD_QUEUE_CTX_REG2_WIN_SIZE_POS) &
+                                IWL50_SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK) |
+                                ((SCD_FRAME_LIMIT <<
+                                IWL50_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS) &
+                                IWL50_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK));
+        }
+
+        iwl_write_prph(priv, IWL50_SCD_INTERRUPT_MASK,
+                        IWL_MASK(0, priv->hw_params.max_txq_num));
+
+        /* Activate all Tx DMA/FIFO channels */
+        priv->cfg->ops->lib->txq_set_sched(priv, IWL_MASK(0, 7));
+
+        iwlagn_set_wr_ptrs(priv, IWL_CMD_QUEUE_NUM, 0);
+
+        /* make sure all queue are not stopped */
+        memset(&priv->queue_stopped[0], 0, sizeof(priv->queue_stopped));
+        for (i = 0; i < 4; i++)
+                atomic_set(&priv->queue_stop_count[i], 0);
+
+        /* reset to 0 to enable all the queue first */
+        priv->txq_ctx_active_msk = 0;
+        /* map qos queues to fifos one-to-one */
+        BUILD_BUG_ON(ARRAY_SIZE(iwlagn_default_queue_to_tx_fifo) != 10);
+
+        for (i = 0; i < ARRAY_SIZE(iwlagn_default_queue_to_tx_fifo); i++) {
+                int ac = iwlagn_default_queue_to_tx_fifo[i];
+
+                iwl_txq_ctx_activate(priv, i);
+
+                if (ac == IWL_TX_FIFO_UNUSED)
+                        continue;
+
+                iwlagn_tx_queue_set_status(priv, &priv->txq[i], ac, 0);
+        }
+
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        iwl_send_wimax_coex(priv);
+
+        iwlagn_set_Xtal_calib(priv);
+        iwl_send_calib_results(priv);
+
+        return 0;
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index e4c2e1e448ad..4f0cb803f732 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -54,6 +54,7 @@
 #include "iwl-helpers.h"
 #include "iwl-sta.h"
 #include "iwl-calib.h"
+#include "iwl-agn.h"
 
 
 /******************************************************************************
@@ -82,13 +83,6 @@ MODULE_AUTHOR(DRV_COPYRIGHT " " DRV_AUTHOR);
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("iwl4965");
 
-/*************** STATION TABLE MANAGEMENT ****
- * mac80211 should be examined to determine if sta_info is duplicating
- * the functionality provided here
- */
-
-/**************************************************************/
-
 /**
  * iwl_commit_rxon - commit staging_rxon to hardware
  *
@@ -143,9 +137,6 @@ int iwl_commit_rxon(struct iwl_priv *priv)
                 return 0;
         }
 
-        /* station table will be cleared */
-        priv->assoc_station_added = 0;
-
         /* If we are currently associated and the new config requires
          * an RXON_ASSOC and the new config wants the associated mask enabled,
          * we must clear the associated from the active configuration
@@ -165,6 +156,8 @@ int iwl_commit_rxon(struct iwl_priv *priv)
                         IWL_ERR(priv, "Error clearing ASSOC_MSK (%d)\n", ret);
                         return ret;
                 }
+                iwl_clear_ucode_stations(priv, false);
+                iwl_restore_stations(priv);
         }
 
         IWL_DEBUG_INFO(priv, "Sending RXON\n"
@@ -178,9 +171,8 @@ int iwl_commit_rxon(struct iwl_priv *priv)
         iwl_set_rxon_hwcrypto(priv, !priv->cfg->mod_params->sw_crypto);
 
         /* Apply the new configuration
-         * RXON unassoc clears the station table in uCode, send it before
-         * we add the bcast station. If assoc bit is set, we will send RXON
-         * after having added the bcast and bssid station.
+         * RXON unassoc clears the station table in uCode so restoration of
+         * stations is needed after it (the RXON command) completes
          */
         if (!new_assoc) {
                 ret = iwl_send_cmd_pdu(priv, REPLY_RXON,
@@ -189,35 +181,14 @@ int iwl_commit_rxon(struct iwl_priv *priv)
                         IWL_ERR(priv, "Error setting new RXON (%d)\n", ret);
                         return ret;
                 }
+                IWL_DEBUG_INFO(priv, "Return from !new_assoc RXON.\n");
                 memcpy(active_rxon, &priv->staging_rxon, sizeof(*active_rxon));
+                iwl_clear_ucode_stations(priv, false);
+                iwl_restore_stations(priv);
         }
 
-        iwl_clear_stations_table(priv);
-
         priv->start_calib = 0;
-
-        /* Add the broadcast address so we can send broadcast frames */
-        priv->cfg->ops->lib->add_bcast_station(priv);
-
-
-        /* If we have set the ASSOC_MSK and we are in BSS mode then
-         * add the IWL_AP_ID to the station rate table */
         if (new_assoc) {
-                if (priv->iw_mode == NL80211_IFTYPE_STATION) {
-                        ret = iwl_rxon_add_station(priv,
-                                           priv->active_rxon.bssid_addr, 1);
-                        if (ret == IWL_INVALID_STATION) {
-                                IWL_ERR(priv,
-                                        "Error adding AP address for TX.\n");
-                                return -EIO;
-                        }
-                        priv->assoc_station_added = 1;
-                        if (priv->default_wep_key &&
-                            iwl_send_static_wepkey_cmd(priv, 0))
-                                IWL_ERR(priv,
-                                        "Could not send WEP static key.\n");
-                }
-
                 /*
                  * allow CTS-to-self if possible for new association.
                  * this is relevant only for 5000 series and up,
@@ -906,10 +877,10 @@ static void iwl_setup_rx_handlers(struct iwl_priv *priv)
         priv->rx_handlers[MISSED_BEACONS_NOTIFICATION] =
             iwl_rx_missed_beacon_notif;
         /* Rx handlers */
-        priv->rx_handlers[REPLY_RX_PHY_CMD] = iwl_rx_reply_rx_phy;
-        priv->rx_handlers[REPLY_RX_MPDU_CMD] = iwl_rx_reply_rx;
+        priv->rx_handlers[REPLY_RX_PHY_CMD] = iwlagn_rx_reply_rx_phy;
+        priv->rx_handlers[REPLY_RX_MPDU_CMD] = iwlagn_rx_reply_rx;
         /* block ack */
-        priv->rx_handlers[REPLY_COMPRESSED_BA] = iwl_rx_reply_compressed_ba;
+        priv->rx_handlers[REPLY_COMPRESSED_BA] = iwlagn_rx_reply_compressed_ba;
         /* Set up hardware specific Rx handlers */
         priv->cfg->ops->lib->rx_handler_setup(priv);
 }
@@ -1037,7 +1008,7 @@ void iwl_rx_handle(struct iwl_priv *priv)
                         count++;
                         if (count >= 8) {
                                 rxq->read = i;
-                                iwl_rx_replenish_now(priv);
+                                iwlagn_rx_replenish_now(priv);
                                 count = 0;
                         }
                 }
@@ -1046,9 +1017,9 @@ void iwl_rx_handle(struct iwl_priv *priv)
         /* Backtrack one entry */
         rxq->read = i;
         if (fill_rx)
-                iwl_rx_replenish_now(priv);
+                iwlagn_rx_replenish_now(priv);
         else
-                iwl_rx_queue_restock(priv);
+                iwlagn_rx_queue_restock(priv);
 }
 
 /* call this function to flush any scheduled tasklet */
@@ -1266,9 +1237,9 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
          * hardware bugs here by ACKing all the possible interrupts so that
          * interrupt coalescing can still be achieved.
          */
-        iwl_write32(priv, CSR_INT, priv->inta | ~priv->inta_mask);
+        iwl_write32(priv, CSR_INT, priv->_agn.inta | ~priv->inta_mask);
 
-        inta = priv->inta;
+        inta = priv->_agn.inta;
 
 #ifdef CONFIG_IWLWIFI_DEBUG
         if (iwl_get_debug_level(priv) & IWL_DL_ISR) {
@@ -1281,8 +1252,8 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
 
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        /* saved interrupt in inta variable now we can reset priv->inta */
-        priv->inta = 0;
+        /* saved interrupt in inta variable now we can reset priv->_agn.inta */
+        priv->_agn.inta = 0;
 
         /* Now service all interrupt bits discovered above. */
         if (inta & CSR_INT_BIT_HW_ERR) {
@@ -1447,6 +1418,60 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
                 iwl_enable_interrupts(priv);
 }
 
+/* the threshold ratio of actual_ack_cnt to expected_ack_cnt in percent */
+#define ACK_CNT_RATIO (50)
+#define BA_TIMEOUT_CNT (5)
+#define BA_TIMEOUT_MAX (16)
+
+/**
+ * iwl_good_ack_health - checks for ACK count ratios, BA timeout retries.
+ *
+ * When the ACK count ratio is 0 and aggregated BA timeout retries exceeding
+ * the BA_TIMEOUT_MAX, reload firmware and bring system back to normal
+ * operation state.
+ */
+bool iwl_good_ack_health(struct iwl_priv *priv,
+                                struct iwl_rx_packet *pkt)
+{
+        bool rc = true;
+        int actual_ack_cnt_delta, expected_ack_cnt_delta;
+        int ba_timeout_delta;
+
+        actual_ack_cnt_delta =
+                le32_to_cpu(pkt->u.stats.tx.actual_ack_cnt) -
+                le32_to_cpu(priv->statistics.tx.actual_ack_cnt);
+        expected_ack_cnt_delta =
+                le32_to_cpu(pkt->u.stats.tx.expected_ack_cnt) -
+                le32_to_cpu(priv->statistics.tx.expected_ack_cnt);
+        ba_timeout_delta =
+                le32_to_cpu(pkt->u.stats.tx.agg.ba_timeout) -
+                le32_to_cpu(priv->statistics.tx.agg.ba_timeout);
+        if ((priv->_agn.agg_tids_count > 0) &&
+            (expected_ack_cnt_delta > 0) &&
+            (((actual_ack_cnt_delta * 100) / expected_ack_cnt_delta)
+                < ACK_CNT_RATIO) &&
+            (ba_timeout_delta > BA_TIMEOUT_CNT)) {
+                IWL_DEBUG_RADIO(priv, "actual_ack_cnt delta = %d,"
+                                " expected_ack_cnt = %d\n",
+                                actual_ack_cnt_delta, expected_ack_cnt_delta);
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+                IWL_DEBUG_RADIO(priv, "rx_detected_cnt delta = %d\n",
+                                priv->delta_statistics.tx.rx_detected_cnt);
+                IWL_DEBUG_RADIO(priv,
+                                "ack_or_ba_timeout_collision delta = %d\n",
+                                priv->delta_statistics.tx.
+                                ack_or_ba_timeout_collision);
+#endif
+                IWL_DEBUG_RADIO(priv, "agg ba_timeout delta = %d\n",
+                                ba_timeout_delta);
+                if (!actual_ack_cnt_delta &&
+                    (ba_timeout_delta >= BA_TIMEOUT_MAX))
+                        rc = false;
+        }
+        return rc;
+}
+
 
 /******************************************************************************
  *
@@ -2094,7 +2119,6 @@ static void iwl_alive_start(struct iwl_priv *priv)
                 goto restart;
         }
 
-        iwl_clear_stations_table(priv);
         ret = priv->cfg->ops->lib->alive_notify(priv);
         if (ret) {
                 IWL_WARN(priv,
@@ -2105,13 +2129,19 @@ static void iwl_alive_start(struct iwl_priv *priv)
         /* After the ALIVE response, we can send host commands to the uCode */
         set_bit(STATUS_ALIVE, &priv->status);
 
+        if (priv->cfg->ops->lib->recover_from_tx_stall) {
+                /* Enable timer to monitor the driver queues */
+                mod_timer(&priv->monitor_recover,
+                        jiffies +
+                        msecs_to_jiffies(priv->cfg->monitor_recover_period));
+        }
+
         if (iwl_is_rfkill(priv))
                 return;
 
         ieee80211_wake_queues(priv->hw);
 
-        priv->active_rate = priv->rates_mask;
-        priv->active_rate_basic = priv->rates_mask & IWL_BASIC_RATES_MASK;
+        priv->active_rate = IWL_RATES_MASK;
 
         /* Configure Tx antenna selection based on H/W config */
         if (priv->cfg->ops->hcmd->set_tx_ant)
@@ -2151,18 +2181,8 @@ static void iwl_alive_start(struct iwl_priv *priv)
         wake_up_interruptible(&priv->wait_command_queue);
 
         iwl_power_update_mode(priv, true);
+        IWL_DEBUG_INFO(priv, "Updated power mode\n");
 
-        /* reassociate for ADHOC mode */
-        if (priv->vif && (priv->iw_mode == NL80211_IFTYPE_ADHOC)) {
-                struct sk_buff *beacon = ieee80211_beacon_get(priv->hw,
-                                                                priv->vif);
-                if (beacon)
-                        iwl_mac_beacon_update(priv->hw, beacon);
-        }
-
-
-        if (test_and_clear_bit(STATUS_MODE_PENDING, &priv->status))
-                iwl_set_mode(priv, priv->iw_mode);
 
         return;
 
@@ -2182,7 +2202,7 @@ static void __iwl_down(struct iwl_priv *priv)
         if (!exit_pending)
                 set_bit(STATUS_EXIT_PENDING, &priv->status);
 
-        iwl_clear_stations_table(priv);
+        iwl_clear_ucode_stations(priv, true);
 
         /* Unblock any waiting calls */
         wake_up_interruptible_all(&priv->wait_command_queue);
@@ -2230,8 +2250,8 @@ static void __iwl_down(struct iwl_priv *priv)
         /* device going down, Stop using ICT table */
         iwl_disable_ict(priv);
 
-        iwl_txq_ctx_stop(priv);
-        iwl_rxq_stop(priv);
+        iwlagn_txq_ctx_stop(priv);
+        iwlagn_rxq_stop(priv);
 
         /* Power-down device's busmaster DMA clocks */
         iwl_write_prph(priv, APMG_CLK_DIS_REG, APMG_CLK_VAL_DMA_CLK_RQT);
@@ -2291,7 +2311,7 @@ static int iwl_prepare_card_hw(struct iwl_priv *priv)
 {
         int ret = 0;
 
-        IWL_DEBUG_INFO(priv, "iwl_prepare_card_hw enter \n");
+        IWL_DEBUG_INFO(priv, "iwl_prepare_card_hw enter\n");
 
         ret = iwl_set_hw_ready(priv);
         if (priv->hw_ready)
@@ -2352,7 +2372,7 @@ static int __iwl_up(struct iwl_priv *priv)
 
         iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
 
-        ret = iwl_hw_nic_init(priv);
+        ret = iwlagn_hw_nic_init(priv);
         if (ret) {
                 IWL_ERR(priv, "Unable to init nic\n");
                 return ret;
@@ -2379,8 +2399,6 @@ static int __iwl_up(struct iwl_priv *priv)
 
         for (i = 0; i < MAX_HW_RESTARTS; i++) {
 
-                iwl_clear_stations_table(priv);
-
                 /* load bootstrap state machine,
                  * load bootstrap program into processor's memory,
                  * prepare to load the "initialize" uCode */
@@ -2504,7 +2522,7 @@ static void iwl_bg_rx_replenish(struct work_struct *data)
                 return;
 
         mutex_lock(&priv->mutex);
-        iwl_rx_replenish(priv);
+        iwlagn_rx_replenish(priv);
         mutex_unlock(&priv->mutex);
 }
 
@@ -2514,17 +2532,12 @@ void iwl_post_associate(struct iwl_priv *priv)
 {
         struct ieee80211_conf *conf = NULL;
         int ret = 0;
-        unsigned long flags;
 
         if (priv->iw_mode == NL80211_IFTYPE_AP) {
                 IWL_ERR(priv, "%s Should not be called in AP mode\n", __func__);
                 return;
         }
 
-        IWL_DEBUG_ASSOC(priv, "Associated as %d to: %pM\n",
-                        priv->assoc_id, priv->active_rxon.bssid_addr);
-
-
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
@@ -2576,6 +2589,9 @@ void iwl_post_associate(struct iwl_priv *priv)
 
         iwlcore_commit_rxon(priv);
 
+        IWL_DEBUG_ASSOC(priv, "Associated as %d to: %pM\n",
+                        priv->assoc_id, priv->active_rxon.bssid_addr);
+
         switch (priv->iw_mode) {
         case NL80211_IFTYPE_STATION:
                 break;
@@ -2585,7 +2601,7 @@ void iwl_post_associate(struct iwl_priv *priv)
                 /* assume default assoc id */
                 priv->assoc_id = 1;
 
-                iwl_rxon_add_station(priv, priv->bssid, 0);
+                iwl_add_local_station(priv, priv->bssid, true);
                 iwl_send_beacon_cmd(priv);
 
                 break;
@@ -2596,13 +2612,6 @@ void iwl_post_associate(struct iwl_priv *priv)
                 break;
         }
 
-        if (priv->iw_mode == NL80211_IFTYPE_ADHOC)
-                priv->assoc_station_added = 1;
-
-        spin_lock_irqsave(&priv->lock, flags);
-        iwl_activate_qos(priv, 0);
-        spin_unlock_irqrestore(&priv->lock, flags);
-
         /* the chain noise calibration will enabled PM upon completion
          * If chain noise has already been run, then we need to enable
          * power management here */
@@ -2769,7 +2778,7 @@ static int iwl_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         IWL_DEBUG_TX(priv, "dev->xmit(%d bytes) at rate 0x%02x\n", skb->len,
                      ieee80211_get_tx_rate(hw, IEEE80211_SKB_CB(skb))->bitrate);
 
-        if (iwl_tx_skb(priv, skb))
+        if (iwlagn_tx_skb(priv, skb))
                 dev_kfree_skb_any(skb);
 
         IWL_DEBUG_MACDUMP(priv, "leave\n");
@@ -2779,7 +2788,6 @@ static int iwl_mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 void iwl_config_ap(struct iwl_priv *priv)
 {
         int ret = 0;
-        unsigned long flags;
 
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
@@ -2831,10 +2839,6 @@ void iwl_config_ap(struct iwl_priv *priv)
                 /* restore RXON assoc */
                 priv->staging_rxon.filter_flags |= RXON_FILTER_ASSOC_MSK;
                 iwlcore_commit_rxon(priv);
-                iwl_reset_qos(priv);
-                spin_lock_irqsave(&priv->lock, flags);
-                iwl_activate_qos(priv, 1);
-                spin_unlock_irqrestore(&priv->lock, flags);
                 iwl_add_bcast_station(priv);
         }
         iwl_send_beacon_cmd(priv);
@@ -2889,7 +2893,6 @@ static int iwl_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 
         mutex_lock(&priv->mutex);
         iwl_scan_cancel_timeout(priv, 100);
-        mutex_unlock(&priv->mutex);
 
         /* If we are getting WEP group key and we didn't receive any key mapping
          * so far, we are in legacy wep mode (group key only), otherwise we are
@@ -2925,6 +2928,7 @@ static int iwl_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 ret = -EINVAL;
         }
 
+        mutex_unlock(&priv->mutex);
         IWL_DEBUG_MAC80211(priv, "leave\n");
 
         return ret;
@@ -2957,10 +2961,21 @@ static int iwl_mac_ampdu_action(struct ieee80211_hw *hw,
                         return ret;
         case IEEE80211_AMPDU_TX_START:
                 IWL_DEBUG_HT(priv, "start Tx\n");
-                return iwl_tx_agg_start(priv, sta->addr, tid, ssn);
+                ret = iwlagn_tx_agg_start(priv, sta->addr, tid, ssn);
+                if (ret == 0) {
+                        priv->_agn.agg_tids_count++;
+                        IWL_DEBUG_HT(priv, "priv->_agn.agg_tids_count = %u\n",
+                                     priv->_agn.agg_tids_count);
+                }
+                return ret;
         case IEEE80211_AMPDU_TX_STOP:
                 IWL_DEBUG_HT(priv, "stop Tx\n");
-                ret = iwl_tx_agg_stop(priv, sta->addr, tid);
+                ret = iwlagn_tx_agg_stop(priv, sta->addr, tid);
+                if ((ret == 0) && (priv->_agn.agg_tids_count > 0)) {
+                        priv->_agn.agg_tids_count--;
+                        IWL_DEBUG_HT(priv, "priv->_agn.agg_tids_count = %u\n",
+                                     priv->_agn.agg_tids_count);
+                }
                 if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                         return 0;
                 else
@@ -2997,18 +3012,7 @@ static void iwl_mac_sta_notify(struct ieee80211_hw *hw,
         struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
         int sta_id;
 
-        /*
-         * TODO: We really should use this callback to
-         *       actually maintain the station table in
-         *       the device.
-         */
-
         switch (cmd) {
-        case STA_NOTIFY_ADD:
-                atomic_set(&sta_priv->pending_frames, 0);
-                if (vif->type == NL80211_IFTYPE_AP)
-                        sta_priv->client = true;
-                break;
         case STA_NOTIFY_SLEEP:
                 WARN_ON(!sta_priv->client);
                 sta_priv->asleep = true;
@@ -3029,6 +3033,55 @@ static void iwl_mac_sta_notify(struct ieee80211_hw *hw,
         }
 }
 
+/**
+ * iwl_restore_wepkeys - Restore WEP keys to device
+ */
+static void iwl_restore_wepkeys(struct iwl_priv *priv)
+{
+        mutex_lock(&priv->mutex);
+        if (priv->iw_mode == NL80211_IFTYPE_STATION &&
+            priv->default_wep_key &&
+            iwl_send_static_wepkey_cmd(priv, 0))
+                IWL_ERR(priv, "Could not send WEP static key\n");
+        mutex_unlock(&priv->mutex);
+}
+
+static int iwlagn_mac_sta_add(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif,
+                              struct ieee80211_sta *sta)
+{
+        struct iwl_priv *priv = hw->priv;
+        struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
+        bool is_ap = priv->iw_mode == NL80211_IFTYPE_STATION;
+        int ret;
+        u8 sta_id;
+
+        IWL_DEBUG_INFO(priv, "received request to add station %pM\n",
+                        sta->addr);
+
+        atomic_set(&sta_priv->pending_frames, 0);
+        if (vif->type == NL80211_IFTYPE_AP)
+                sta_priv->client = true;
+
+        ret = iwl_add_station_common(priv, sta->addr, is_ap, &sta->ht_cap,
+                                     &sta_id);
+        if (ret) {
+                IWL_ERR(priv, "Unable to add station %pM (%d)\n",
+                        sta->addr, ret);
+                /* Should we return success if return code is EEXIST ? */
+                return ret;
+        }
+
+        iwl_restore_wepkeys(priv);
+
+        /* Initialize rate scaling */
+        IWL_DEBUG_INFO(priv, "Initializing rate scaling for station %pM\n",
+                       sta->addr);
+        iwl_rs_rate_init(priv, sta, sta_id);
+
+        return ret;
+}
+
 /*****************************************************************************
  *
  * sysfs attributes
@@ -3129,87 +3182,6 @@ static ssize_t store_tx_power(struct device *d,
 
 static DEVICE_ATTR(tx_power, S_IWUSR | S_IRUGO, show_tx_power, store_tx_power);
 
-static ssize_t show_flags(struct device *d,
-                          struct device_attribute *attr, char *buf)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-
-        return sprintf(buf, "0x%04X\n", priv->active_rxon.flags);
-}
-
-static ssize_t store_flags(struct device *d,
-                           struct device_attribute *attr,
-                           const char *buf, size_t count)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-        unsigned long val;
-        u32 flags;
-        int ret = strict_strtoul(buf, 0, &val);
-        if (ret)
-                return ret;
-        flags = (u32)val;
-
-        mutex_lock(&priv->mutex);
-        if (le32_to_cpu(priv->staging_rxon.flags) != flags) {
-                /* Cancel any currently running scans... */
-                if (iwl_scan_cancel_timeout(priv, 100))
-                        IWL_WARN(priv, "Could not cancel scan.\n");
-                else {
-                        IWL_DEBUG_INFO(priv, "Commit rxon.flags = 0x%04X\n", flags);
-                        priv->staging_rxon.flags = cpu_to_le32(flags);
-                        iwlcore_commit_rxon(priv);
-                }
-        }
-        mutex_unlock(&priv->mutex);
-
-        return count;
-}
-
-static DEVICE_ATTR(flags, S_IWUSR | S_IRUGO, show_flags, store_flags);
-
-static ssize_t show_filter_flags(struct device *d,
-                                 struct device_attribute *attr, char *buf)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-
-        return sprintf(buf, "0x%04X\n",
-                le32_to_cpu(priv->active_rxon.filter_flags));
-}
-
-static ssize_t store_filter_flags(struct device *d,
-                                  struct device_attribute *attr,
-                                  const char *buf, size_t count)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-        unsigned long val;
-        u32 filter_flags;
-        int ret = strict_strtoul(buf, 0, &val);
-        if (ret)
-                return ret;
-        filter_flags = (u32)val;
-
-        mutex_lock(&priv->mutex);
-        if (le32_to_cpu(priv->staging_rxon.filter_flags) != filter_flags) {
-                /* Cancel any currently running scans... */
-                if (iwl_scan_cancel_timeout(priv, 100))
-                        IWL_WARN(priv, "Could not cancel scan.\n");
-                else {
-                        IWL_DEBUG_INFO(priv, "Committing rxon.filter_flags = "
-                                       "0x%04X\n", filter_flags);
-                        priv->staging_rxon.filter_flags =
-                                cpu_to_le32(filter_flags);
-                        iwlcore_commit_rxon(priv);
-                }
-        }
-        mutex_unlock(&priv->mutex);
-
-        return count;
-}
-
-static DEVICE_ATTR(filter_flags, S_IWUSR | S_IRUGO, show_filter_flags,
-                   store_filter_flags);
-
-
 static ssize_t show_statistics(struct device *d,
                                struct device_attribute *attr, char *buf)
 {
@@ -3315,6 +3287,13 @@ static void iwl_setup_deferred_work(struct iwl_priv *priv)
         priv->ucode_trace.data = (unsigned long)priv;
         priv->ucode_trace.function = iwl_bg_ucode_trace;
 
+        if (priv->cfg->ops->lib->recover_from_tx_stall) {
+                init_timer(&priv->monitor_recover);
+                priv->monitor_recover.data = (unsigned long)priv;
+                priv->monitor_recover.function =
+                        priv->cfg->ops->lib->recover_from_tx_stall;
+        }
+
         if (!priv->cfg->use_isr_legacy)
                 tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
                         iwl_irq_tasklet, (unsigned long)priv);
@@ -3334,6 +3313,8 @@ static void iwl_cancel_deferred_work(struct iwl_priv *priv)
         cancel_work_sync(&priv->beacon_update);
         del_timer_sync(&priv->statistics_periodic);
         del_timer_sync(&priv->ucode_trace);
+        if (priv->cfg->ops->lib->recover_from_tx_stall)
+                del_timer_sync(&priv->monitor_recover);
 }
 
 static void iwl_init_hw_rates(struct iwl_priv *priv,
@@ -3371,9 +3352,6 @@ static int iwl_init_drv(struct iwl_priv *priv)
         mutex_init(&priv->mutex);
         mutex_init(&priv->sync_cmd_mutex);
 
-        /* Clear the driver's (not device's) station table */
-        iwl_clear_stations_table(priv);
-
         priv->ieee_channels = NULL;
         priv->ieee_rates = NULL;
         priv->band = IEEE80211_BAND_2GHZ;
@@ -3381,6 +3359,7 @@ static int iwl_init_drv(struct iwl_priv *priv)
         priv->iw_mode = NL80211_IFTYPE_STATION;
         priv->current_ht_config.smps = IEEE80211_SMPS_STATIC;
         priv->missed_beacon_threshold = IWL_MISSED_BEACON_THRESHOLD_DEF;
+        priv->_agn.agg_tids_count = 0;
 
         /* initialize force reset */
         priv->force_reset[IWL_RF_RESET].reset_duration =
@@ -3394,16 +3373,10 @@ static int iwl_init_drv(struct iwl_priv *priv)
 
         iwl_init_scan_params(priv);
 
-        iwl_reset_qos(priv);
-
-        priv->qos_data.qos_active = 0;
-        priv->qos_data.qos_cap.val = 0;
-
-        priv->rates_mask = IWL_RATES_MASK;
         /* Set the tx_power_user_lmt to the lowest power level
          * this value will get overwritten by channel max power avg
          * from eeprom */
-        priv->tx_power_user_lmt = IWL_TX_POWER_TARGET_POWER_MIN;
+        priv->tx_power_user_lmt = IWLAGN_TX_POWER_TARGET_POWER_MIN;
 
         ret = iwl_init_channel_map(priv);
         if (ret) {
@@ -3435,8 +3408,6 @@ static void iwl_uninit_drv(struct iwl_priv *priv)
 }
 
 static struct attribute *iwl_sysfs_entries[] = {
-        &dev_attr_flags.attr,
-        &dev_attr_filter_flags.attr,
         &dev_attr_statistics.attr,
         &dev_attr_temperature.attr,
         &dev_attr_tx_power.attr,
@@ -3469,6 +3440,8 @@ static struct ieee80211_ops iwl_hw_ops = {
         .ampdu_action = iwl_mac_ampdu_action,
         .hw_scan = iwl_mac_hw_scan,
         .sta_notify = iwl_mac_sta_notify,
+        .sta_add = iwlagn_mac_sta_add,
+        .sta_remove = iwl_mac_sta_remove,
 };
 
 static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
@@ -3572,7 +3545,7 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         iwl_write32(priv, CSR_RESET, CSR_RESET_REG_FLAG_NEVO_RESET);
 
         iwl_hw_detect(priv);
-        IWL_INFO(priv, "Detected Intel Wireless WiFi Link %s REV=0x%X\n",
+        IWL_INFO(priv, "Detected %s, REV=0x%X\n",
                 priv->cfg->name, priv->hw_rev);
 
         /* We disable the RETRY_TIMEOUT register (0x41) to keep
@@ -3750,10 +3723,9 @@ static void __devexit iwl_pci_remove(struct pci_dev *pdev)
         iwl_dealloc_ucode_pci(priv);
 
         if (priv->rxq.bd)
-                iwl_rx_queue_free(priv, &priv->rxq);
-        iwl_hw_txq_ctx_free(priv);
+                iwlagn_rx_queue_free(priv, &priv->rxq);
+        iwlagn_hw_txq_ctx_free(priv);
 
-        iwl_clear_stations_table(priv);
         iwl_eeprom_free(priv);
 
 
@@ -3867,6 +3839,7 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
         {IWL_PCI_DEVICE(0x4238, 0x1111, iwl6000_3agn_cfg)},
         {IWL_PCI_DEVICE(0x4239, 0x1311, iwl6000i_2agn_cfg)},
         {IWL_PCI_DEVICE(0x4239, 0x1316, iwl6000i_2abg_cfg)},
+        {IWL_PCI_DEVICE(0x0082, 0x1201, iwl6000i_g2_2agn_cfg)},
 
 /* 6x50 WiFi/WiMax Series */
         {IWL_PCI_DEVICE(0x0087, 0x1301, iwl6050_2agn_cfg)},
@@ -3949,3 +3922,33 @@ module_param_named(debug, iwl_debug_level, uint, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(debug, "debug output mask");
 #endif
 
+module_param_named(swcrypto50, iwlagn_mod_params.sw_crypto, bool, S_IRUGO);
+MODULE_PARM_DESC(swcrypto50,
+                 "using crypto in software (default 0 [hardware]) (deprecated)");
+module_param_named(swcrypto, iwlagn_mod_params.sw_crypto, int, S_IRUGO);
+MODULE_PARM_DESC(swcrypto, "using crypto in software (default 0 [hardware])");
+module_param_named(queues_num50,
+                   iwlagn_mod_params.num_of_queues, int, S_IRUGO);
+MODULE_PARM_DESC(queues_num50,
+                 "number of hw queues in 50xx series (deprecated)");
+module_param_named(queues_num, iwlagn_mod_params.num_of_queues, int, S_IRUGO);
+MODULE_PARM_DESC(queues_num, "number of hw queues.");
+module_param_named(11n_disable50, iwlagn_mod_params.disable_11n, int, S_IRUGO);
+MODULE_PARM_DESC(11n_disable50, "disable 50XX 11n functionality (deprecated)");
+module_param_named(11n_disable, iwlagn_mod_params.disable_11n, int, S_IRUGO);
+MODULE_PARM_DESC(11n_disable, "disable 11n functionality");
+module_param_named(amsdu_size_8K50, iwlagn_mod_params.amsdu_size_8K,
+                   int, S_IRUGO);
+MODULE_PARM_DESC(amsdu_size_8K50,
+                 "enable 8K amsdu size in 50XX series (deprecated)");
+module_param_named(amsdu_size_8K, iwlagn_mod_params.amsdu_size_8K,
+                   int, S_IRUGO);
+MODULE_PARM_DESC(amsdu_size_8K, "enable 8K amsdu size");
+module_param_named(fw_restart50, iwlagn_mod_params.restart_fw, int, S_IRUGO);
+MODULE_PARM_DESC(fw_restart50,
+                 "restart firmware in case of error (deprecated)");
+module_param_named(fw_restart, iwlagn_mod_params.restart_fw, int, S_IRUGO);
+MODULE_PARM_DESC(fw_restart, "restart firmware in case of error");
+module_param_named(
+        disable_hw_scan, iwlagn_mod_params.disable_hw_scan, int, S_IRUGO);
+MODULE_PARM_DESC(disable_hw_scan, "disable hardware scanning (default 0)");
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.h b/drivers/net/wireless/iwlwifi/iwl-agn.h
new file mode 100644
index 000000000000..5ad14055eda3
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.h
@@ -0,0 +1,149 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2005 - 2010 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+
+#ifndef __iwl_agn_h__
+#define __iwl_agn_h__
+
+#include "iwl-dev.h"
+
+extern struct iwl_mod_params iwlagn_mod_params;
+extern struct iwl_ucode_ops iwlagn_ucode;
+extern struct iwl_hcmd_ops iwlagn_hcmd;
+extern struct iwl_hcmd_utils_ops iwlagn_hcmd_utils;
+
+int iwl_reset_ict(struct iwl_priv *priv);
+void iwl_disable_ict(struct iwl_priv *priv);
+int iwl_alloc_isr_ict(struct iwl_priv *priv);
+void iwl_free_isr_ict(struct iwl_priv *priv);
+irqreturn_t iwl_isr_ict(int irq, void *data);
+bool iwl_good_ack_health(struct iwl_priv *priv,
+                         struct iwl_rx_packet *pkt);
+
+/* tx queue */
+void iwlagn_set_wr_ptrs(struct iwl_priv *priv,
+                     int txq_id, u32 index);
+void iwlagn_tx_queue_set_status(struct iwl_priv *priv,
+                             struct iwl_tx_queue *txq,
+                             int tx_fifo_id, int scd_retry);
+void iwlagn_txq_update_byte_cnt_tbl(struct iwl_priv *priv,
+                                    struct iwl_tx_queue *txq,
+                                    u16 byte_cnt);
+void iwlagn_txq_inval_byte_cnt_tbl(struct iwl_priv *priv,
+                                   struct iwl_tx_queue *txq);
+int iwlagn_txq_agg_enable(struct iwl_priv *priv, int txq_id,
+                          int tx_fifo, int sta_id, int tid, u16 ssn_idx);
+int iwlagn_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
+                           u16 ssn_idx, u8 tx_fifo);
+void iwlagn_txq_set_sched(struct iwl_priv *priv, u32 mask);
+
+/* uCode */
+int iwlagn_load_ucode(struct iwl_priv *priv);
+void iwlagn_rx_calib_result(struct iwl_priv *priv,
+                         struct iwl_rx_mem_buffer *rxb);
+void iwlagn_rx_calib_complete(struct iwl_priv *priv,
+                           struct iwl_rx_mem_buffer *rxb);
+void iwlagn_init_alive_start(struct iwl_priv *priv);
+int iwlagn_alive_notify(struct iwl_priv *priv);
+
+/* lib */
+void iwlagn_rx_handler_setup(struct iwl_priv *priv);
+void iwlagn_setup_deferred_work(struct iwl_priv *priv);
+int iwlagn_hw_valid_rtc_data_addr(u32 addr);
+int iwlagn_send_tx_power(struct iwl_priv *priv);
+void iwlagn_temperature(struct iwl_priv *priv);
+u16 iwlagn_eeprom_calib_version(struct iwl_priv *priv);
+const u8 *iwlagn_eeprom_query_addr(const struct iwl_priv *priv,
+                                   size_t offset);
+void iwlagn_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
+int iwlagn_rx_init(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
+int iwlagn_hw_nic_init(struct iwl_priv *priv);
+
+/* rx */
+void iwlagn_rx_queue_restock(struct iwl_priv *priv);
+void iwlagn_rx_allocate(struct iwl_priv *priv, gfp_t priority);
+void iwlagn_rx_replenish(struct iwl_priv *priv);
+void iwlagn_rx_replenish_now(struct iwl_priv *priv);
+void iwlagn_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
+int iwlagn_rxq_stop(struct iwl_priv *priv);
+int iwlagn_hwrate_to_mac80211_idx(u32 rate_n_flags, enum ieee80211_band band);
+void iwlagn_rx_reply_rx(struct iwl_priv *priv,
+                     struct iwl_rx_mem_buffer *rxb);
+void iwlagn_rx_reply_rx_phy(struct iwl_priv *priv,
+                         struct iwl_rx_mem_buffer *rxb);
+
+/* tx */
+void iwlagn_hwrate_to_tx_control(struct iwl_priv *priv, u32 rate_n_flags,
+                              struct ieee80211_tx_info *info);
+int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb);
+int iwlagn_tx_agg_start(struct iwl_priv *priv,
+                        const u8 *ra, u16 tid, u16 *ssn);
+int iwlagn_tx_agg_stop(struct iwl_priv *priv , const u8 *ra, u16 tid);
+int iwlagn_txq_check_empty(struct iwl_priv *priv,
+                           int sta_id, u8 tid, int txq_id);
+void iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
+                                struct iwl_rx_mem_buffer *rxb);
+int iwlagn_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index);
+void iwlagn_hw_txq_ctx_free(struct iwl_priv *priv);
+int iwlagn_txq_ctx_reset(struct iwl_priv *priv);
+void iwlagn_txq_ctx_stop(struct iwl_priv *priv);
+
+#endif /* __iwl_agn_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-calib.c b/drivers/net/wireless/iwlwifi/iwl-calib.c
index 845831ac053e..dbb50a8e0ce3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-calib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-calib.c
@@ -592,7 +592,7 @@ void iwl_sensitivity_calibration(struct iwl_priv *priv,
         IWL_DEBUG_CALIB(priv, "rx_enable_time = %u usecs\n", rx_enable_time);
 
         if (!rx_enable_time) {
-                IWL_DEBUG_CALIB(priv, "<< RX Enable Time == 0! \n");
+                IWL_DEBUG_CALIB(priv, "<< RX Enable Time == 0!\n");
                 return;
         }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 894bcb8b8b37..f09bff823ab6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -65,7 +65,7 @@ MODULE_LICENSE("GPL");
  */
 static bool bt_coex_active = true;
 module_param(bt_coex_active, bool, S_IRUGO);
-MODULE_PARM_DESC(bt_coex_active, "enable wifi/bluetooth co-exist\n");
+MODULE_PARM_DESC(bt_coex_active, "enable wifi/bluetooth co-exist");
 
 static struct iwl_wimax_coex_event_entry cu_priorities[COEX_NUM_OF_EVENTS] = {
         {COEX_CU_UNASSOC_IDLE_RP, COEX_CU_UNASSOC_IDLE_WP,
@@ -114,8 +114,6 @@ static struct iwl_wimax_coex_event_entry cu_priorities[COEX_NUM_OF_EVENTS] = {
 u32 iwl_debug_level;
 EXPORT_SYMBOL(iwl_debug_level);
 
-static irqreturn_t iwl_isr(int irq, void *data);
-
 /*
  * Parameter order:
  *   rate, ht rate, prev rate, next rate, prev tgg rate, next tgg rate
@@ -142,30 +140,6 @@ const struct iwl_rate_info iwl_rates[IWL_RATE_COUNT] = {
 };
 EXPORT_SYMBOL(iwl_rates);
 
-/**
- * translate ucode response to mac80211 tx status control values
- */
-void iwl_hwrate_to_tx_control(struct iwl_priv *priv, u32 rate_n_flags,
-                                  struct ieee80211_tx_info *info)
-{
-        struct ieee80211_tx_rate *r = &info->control.rates[0];
-
-        info->antenna_sel_tx =
-                ((rate_n_flags & RATE_MCS_ANT_ABC_MSK) >> RATE_MCS_ANT_POS);
-        if (rate_n_flags & RATE_MCS_HT_MSK)
-                r->flags |= IEEE80211_TX_RC_MCS;
-        if (rate_n_flags & RATE_MCS_GF_MSK)
-                r->flags |= IEEE80211_TX_RC_GREEN_FIELD;
-        if (rate_n_flags & RATE_MCS_HT40_MSK)
-                r->flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
-        if (rate_n_flags & RATE_MCS_DUP_MSK)
-                r->flags |= IEEE80211_TX_RC_DUP_DATA;
-        if (rate_n_flags & RATE_MCS_SGI_MSK)
-                r->flags |= IEEE80211_TX_RC_SHORT_GI;
-        r->idx = iwl_hwrate_to_mac80211_idx(rate_n_flags, info->band);
-}
-EXPORT_SYMBOL(iwl_hwrate_to_tx_control);
-
 int iwl_hwrate_to_plcp_idx(u32 rate_n_flags)
 {
         int idx = 0;
@@ -197,27 +171,6 @@ int iwl_hwrate_to_plcp_idx(u32 rate_n_flags)
 }
 EXPORT_SYMBOL(iwl_hwrate_to_plcp_idx);
 
-int iwl_hwrate_to_mac80211_idx(u32 rate_n_flags, enum ieee80211_band band)
-{
-        int idx = 0;
-        int band_offset = 0;
-
-        /* HT rate format: mac80211 wants an MCS number, which is just LSB */
-        if (rate_n_flags & RATE_MCS_HT_MSK) {
-                idx = (rate_n_flags & 0xff);
-                return idx;
-        /* Legacy rate format, search for match in table */
-        } else {
-                if (band == IEEE80211_BAND_5GHZ)
-                        band_offset = IWL_FIRST_OFDM_RATE;
-                for (idx = band_offset; idx < IWL_RATE_COUNT_LEGACY; idx++)
-                        if (iwl_rates[idx].plcp == (rate_n_flags & 0xFF))
-                                return idx - band_offset;
-        }
-
-        return -1;
-}
-
 u8 iwl_toggle_tx_ant(struct iwl_priv *priv, u8 ant)
 {
         int i;
@@ -267,74 +220,16 @@ void iwl_hw_detect(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_hw_detect);
 
-int iwl_hw_nic_init(struct iwl_priv *priv)
-{
-        unsigned long flags;
-        struct iwl_rx_queue *rxq = &priv->rxq;
-        int ret;
-
-        /* nic_init */
-        spin_lock_irqsave(&priv->lock, flags);
-        priv->cfg->ops->lib->apm_ops.init(priv);
-
-        /* Set interrupt coalescing calibration timer to default (512 usecs) */
-        iwl_write8(priv, CSR_INT_COALESCING, IWL_HOST_INT_CALIB_TIMEOUT_DEF);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        ret = priv->cfg->ops->lib->apm_ops.set_pwr_src(priv, IWL_PWR_SRC_VMAIN);
-
-        priv->cfg->ops->lib->apm_ops.config(priv);
-
-        /* Allocate the RX queue, or reset if it is already allocated */
-        if (!rxq->bd) {
-                ret = iwl_rx_queue_alloc(priv);
-                if (ret) {
-                        IWL_ERR(priv, "Unable to initialize Rx queue\n");
-                        return -ENOMEM;
-                }
-        } else
-                iwl_rx_queue_reset(priv, rxq);
-
-        iwl_rx_replenish(priv);
-
-        iwl_rx_init(priv, rxq);
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        rxq->need_update = 1;
-        iwl_rx_queue_update_write_ptr(priv, rxq);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        /* Allocate or reset and init all Tx and Command queues */
-        if (!priv->txq) {
-                ret = iwl_txq_ctx_alloc(priv);
-                if (ret)
-                        return ret;
-        } else
-                iwl_txq_ctx_reset(priv);
-
-        set_bit(STATUS_INIT, &priv->status);
-
-        return 0;
-}
-EXPORT_SYMBOL(iwl_hw_nic_init);
-
 /*
  * QoS  support
 */
-void iwl_activate_qos(struct iwl_priv *priv, u8 force)
+static void iwl_update_qos(struct iwl_priv *priv)
 {
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
         priv->qos_data.def_qos_parm.qos_flags = 0;
 
-        if (priv->qos_data.qos_cap.q_AP.queue_request &&
-            !priv->qos_data.qos_cap.q_AP.txop_request)
-                priv->qos_data.def_qos_parm.qos_flags |=
-                        QOS_PARAM_FLG_TXOP_TYPE_MSK;
         if (priv->qos_data.qos_active)
                 priv->qos_data.def_qos_parm.qos_flags |=
                         QOS_PARAM_FLG_UPDATE_EDCA_MSK;
@@ -342,118 +237,14 @@ void iwl_activate_qos(struct iwl_priv *priv, u8 force)
         if (priv->current_ht_config.is_ht)
                 priv->qos_data.def_qos_parm.qos_flags |= QOS_PARAM_FLG_TGN_MSK;
 
-        if (force || iwl_is_associated(priv)) {
-                IWL_DEBUG_QOS(priv, "send QoS cmd with Qos active=%d FLAGS=0x%X\n",
-                                priv->qos_data.qos_active,
-                                priv->qos_data.def_qos_parm.qos_flags);
+        IWL_DEBUG_QOS(priv, "send QoS cmd with Qos active=%d FLAGS=0x%X\n",
+                      priv->qos_data.qos_active,
+                      priv->qos_data.def_qos_parm.qos_flags);
 
-                iwl_send_cmd_pdu_async(priv, REPLY_QOS_PARAM,
-                                       sizeof(struct iwl_qosparam_cmd),
-                                       &priv->qos_data.def_qos_parm, NULL);
-        }
+        iwl_send_cmd_pdu_async(priv, REPLY_QOS_PARAM,
+                               sizeof(struct iwl_qosparam_cmd),
+                               &priv->qos_data.def_qos_parm, NULL);
 }
-EXPORT_SYMBOL(iwl_activate_qos);
-
-/*
- * AC        CWmin         CW max      AIFSN      TXOP Limit    TXOP Limit
- *                                              (802.11b)      (802.11a/g)
- * AC_BK      15            1023        7           0               0
- * AC_BE      15            1023        3           0               0
- * AC_VI       7              15        2          6.016ms       3.008ms
- * AC_VO       3               7        2          3.264ms       1.504ms
- */
-void iwl_reset_qos(struct iwl_priv *priv)
-{
-        u16 cw_min = 15;
-        u16 cw_max = 1023;
-        u8 aifs = 2;
-        bool is_legacy = false;
-        unsigned long flags;
-        int i;
-
-        spin_lock_irqsave(&priv->lock, flags);
-        /* QoS always active in AP and ADHOC mode
-         * In STA mode wait for association
-         */
-        if (priv->iw_mode == NL80211_IFTYPE_ADHOC ||
-            priv->iw_mode == NL80211_IFTYPE_AP)
-                priv->qos_data.qos_active = 1;
-        else
-                priv->qos_data.qos_active = 0;
-
-        /* check for legacy mode */
-        if ((priv->iw_mode == NL80211_IFTYPE_ADHOC &&
-            (priv->active_rate & IWL_OFDM_RATES_MASK) == 0) ||
-            (priv->iw_mode == NL80211_IFTYPE_STATION &&
-            (priv->staging_rxon.flags & RXON_FLG_SHORT_SLOT_MSK) == 0)) {
-                cw_min = 31;
-                is_legacy = 1;
-        }
-
-        if (priv->qos_data.qos_active)
-                aifs = 3;
-
-        /* AC_BE */
-        priv->qos_data.def_qos_parm.ac[0].cw_min = cpu_to_le16(cw_min);
-        priv->qos_data.def_qos_parm.ac[0].cw_max = cpu_to_le16(cw_max);
-        priv->qos_data.def_qos_parm.ac[0].aifsn = aifs;
-        priv->qos_data.def_qos_parm.ac[0].edca_txop = 0;
-        priv->qos_data.def_qos_parm.ac[0].reserved1 = 0;
-
-        if (priv->qos_data.qos_active) {
-                /* AC_BK */
-                i = 1;
-                priv->qos_data.def_qos_parm.ac[i].cw_min = cpu_to_le16(cw_min);
-                priv->qos_data.def_qos_parm.ac[i].cw_max = cpu_to_le16(cw_max);
-                priv->qos_data.def_qos_parm.ac[i].aifsn = 7;
-                priv->qos_data.def_qos_parm.ac[i].edca_txop = 0;
-                priv->qos_data.def_qos_parm.ac[i].reserved1 = 0;
-
-                /* AC_VI */
-                i = 2;
-                priv->qos_data.def_qos_parm.ac[i].cw_min =
-                        cpu_to_le16((cw_min + 1) / 2 - 1);
-                priv->qos_data.def_qos_parm.ac[i].cw_max =
-                        cpu_to_le16(cw_min);
-                priv->qos_data.def_qos_parm.ac[i].aifsn = 2;
-                if (is_legacy)
-                        priv->qos_data.def_qos_parm.ac[i].edca_txop =
-                                cpu_to_le16(6016);
-                else
-                        priv->qos_data.def_qos_parm.ac[i].edca_txop =
-                                cpu_to_le16(3008);
-                priv->qos_data.def_qos_parm.ac[i].reserved1 = 0;
-
-                /* AC_VO */
-                i = 3;
-                priv->qos_data.def_qos_parm.ac[i].cw_min =
-                        cpu_to_le16((cw_min + 1) / 4 - 1);
-                priv->qos_data.def_qos_parm.ac[i].cw_max =
-                        cpu_to_le16((cw_min + 1) / 2 - 1);
-                priv->qos_data.def_qos_parm.ac[i].aifsn = 2;
-                priv->qos_data.def_qos_parm.ac[i].reserved1 = 0;
-                if (is_legacy)
-                        priv->qos_data.def_qos_parm.ac[i].edca_txop =
-                                cpu_to_le16(3264);
-                else
-                        priv->qos_data.def_qos_parm.ac[i].edca_txop =
-                                cpu_to_le16(1504);
-        } else {
-                for (i = 1; i < 4; i++) {
-                        priv->qos_data.def_qos_parm.ac[i].cw_min =
-                                cpu_to_le16(cw_min);
-                        priv->qos_data.def_qos_parm.ac[i].cw_max =
-                                cpu_to_le16(cw_max);
-                        priv->qos_data.def_qos_parm.ac[i].aifsn = aifs;
-                        priv->qos_data.def_qos_parm.ac[i].edca_txop = 0;
-                        priv->qos_data.def_qos_parm.ac[i].reserved1 = 0;
-                }
-        }
-        IWL_DEBUG_QOS(priv, "set QoS to default \n");
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-}
-EXPORT_SYMBOL(iwl_reset_qos);
 
 #define MAX_BIT_RATE_40_MHZ 150 /* Mbps */
 #define MAX_BIT_RATE_20_MHZ 72 /* Mbps */
@@ -902,23 +693,10 @@ EXPORT_SYMBOL(iwl_full_rxon_required);
 
 u8 iwl_rate_get_lowest_plcp(struct iwl_priv *priv)
 {
-        int i;
-        int rate_mask;
-
-        /* Set rate mask*/
-        if (priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK)
-                rate_mask = priv->active_rate_basic & IWL_CCK_RATES_MASK;
-        else
-                rate_mask = priv->active_rate_basic & IWL_OFDM_RATES_MASK;
-
-        /* Find lowest valid rate */
-        for (i = IWL_RATE_1M_INDEX; i != IWL_RATE_INVALID;
-                                        i = iwl_rates[i].next_ieee) {
-                if (rate_mask & (1 << i))
-                        return iwl_rates[i].plcp;
-        }
-
-        /* No valid rate was found. Assign the lowest one */
+        /*
+         * Assign the lowest rate -- should really get this from
+         * the beacon skb from mac80211.
+         */
         if (priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK)
                 return IWL_RATE_1M_PLCP;
         else
@@ -1106,12 +884,12 @@ void iwl_set_rxon_chain(struct iwl_priv *priv)
         rx_chain |= idle_rx_cnt  << RXON_RX_CHAIN_CNT_POS;
 
         /* copied from 'iwl_bg_request_scan()' */
-        /* Force use of chains B and C (0x6) for Rx for 4965
-         * Avoid A (0x1) because of its off-channel reception on A-band.
+        /* Force use of chains B and C (0x6) for Rx
+         * Avoid A (0x1) for the device has off-channel reception on A-band.
          * MIMO is not used here, but value is required */
         if (iwl_is_monitor_mode(priv) &&
             !(priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK) &&
-            ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_4965)) {
+            priv->cfg->off_channel_workaround) {
                 rx_chain = ANT_ABC << RXON_RX_CHAIN_VALID_POS;
                 rx_chain |= ANT_BC << RXON_RX_CHAIN_FORCE_SEL_POS;
                 rx_chain |= ANT_ABC << RXON_RX_CHAIN_FORCE_MIMO_SEL_POS;
@@ -1243,14 +1021,6 @@ void iwl_connection_init_rx_config(struct iwl_priv *priv, int mode)
         if (!ch_info)
                 ch_info = &priv->channel_info[0];
 
-        /*
-         * in some case A channels are all non IBSS
-         * in this case force B/G channel
-         */
-        if ((priv->iw_mode == NL80211_IFTYPE_ADHOC) &&
-            !(is_channel_ibss(ch_info)))
-                ch_info = &priv->channel_info[0];
-
         priv->staging_rxon.channel = cpu_to_le16(ch_info->channel);
         priv->band = ch_info->band;
 
@@ -1285,7 +1055,6 @@ static void iwl_set_rate(struct iwl_priv *priv)
         }
 
         priv->active_rate = 0;
-        priv->active_rate_basic = 0;
 
         for (i = 0; i < hw->n_bitrates; i++) {
                 rate = &(hw->bitrates[i]);
@@ -1293,30 +1062,13 @@ static void iwl_set_rate(struct iwl_priv *priv)
                         priv->active_rate |= (1 << rate->hw_value);
         }
 
-        IWL_DEBUG_RATE(priv, "Set active_rate = %0x, active_rate_basic = %0x\n",
-                       priv->active_rate, priv->active_rate_basic);
+        IWL_DEBUG_RATE(priv, "Set active_rate = %0x\n", priv->active_rate);
 
-        /*
-         * If a basic rate is configured, then use it (adding IWL_RATE_1M_MASK)
-         * otherwise set it to the default of all CCK rates and 6, 12, 24 for
-         * OFDM
-         */
-        if (priv->active_rate_basic & IWL_CCK_BASIC_RATES_MASK)
-                priv->staging_rxon.cck_basic_rates =
-                    ((priv->active_rate_basic &
-                      IWL_CCK_RATES_MASK) >> IWL_FIRST_CCK_RATE) & 0xF;
-        else
-                priv->staging_rxon.cck_basic_rates =
-                    (IWL_CCK_BASIC_RATES_MASK >> IWL_FIRST_CCK_RATE) & 0xF;
-
-        if (priv->active_rate_basic & IWL_OFDM_BASIC_RATES_MASK)
-                priv->staging_rxon.ofdm_basic_rates =
-                    ((priv->active_rate_basic &
-                      (IWL_OFDM_BASIC_RATES_MASK | IWL_RATE_6M_MASK)) >>
-                      IWL_FIRST_OFDM_RATE) & 0xFF;
-        else
-                priv->staging_rxon.ofdm_basic_rates =
-                   (IWL_OFDM_BASIC_RATES_MASK >> IWL_FIRST_OFDM_RATE) & 0xFF;
+        priv->staging_rxon.cck_basic_rates =
+            (IWL_CCK_BASIC_RATES_MASK >> IWL_FIRST_CCK_RATE) & 0xF;
+
+        priv->staging_rxon.ofdm_basic_rates =
+           (IWL_OFDM_BASIC_RATES_MASK >> IWL_FIRST_OFDM_RATE) & 0xFF;
 }
 
 void iwl_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
@@ -1400,7 +1152,7 @@ void iwl_irq_handle_error(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_irq_handle_error);
 
-int iwl_apm_stop_master(struct iwl_priv *priv)
+static int iwl_apm_stop_master(struct iwl_priv *priv)
 {
         int ret = 0;
 
@@ -1416,7 +1168,6 @@ int iwl_apm_stop_master(struct iwl_priv *priv)
 
         return ret;
 }
-EXPORT_SYMBOL(iwl_apm_stop_master);
 
 void iwl_apm_stop(struct iwl_priv *priv)
 {
@@ -1625,10 +1376,11 @@ int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force)
         int ret = 0;
         s8 prev_tx_power = priv->tx_power_user_lmt;
 
-        if (tx_power < IWL_TX_POWER_TARGET_POWER_MIN) {
-                IWL_WARN(priv, "Requested user TXPOWER %d below lower limit %d.\n",
+        if (tx_power < IWLAGN_TX_POWER_TARGET_POWER_MIN) {
+                IWL_WARN(priv,
+                         "Requested user TXPOWER %d below lower limit %d.\n",
                          tx_power,
-                         IWL_TX_POWER_TARGET_POWER_MIN);
+                         IWLAGN_TX_POWER_TARGET_POWER_MIN);
                 return -EINVAL;
         }
 
@@ -1667,286 +1419,16 @@ int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force)
 }
 EXPORT_SYMBOL(iwl_set_tx_power);
 
-#define ICT_COUNT (PAGE_SIZE/sizeof(u32))
-
-/* Free dram table */
-void iwl_free_isr_ict(struct iwl_priv *priv)
-{
-        if (priv->ict_tbl_vir) {
-                dma_free_coherent(&priv->pci_dev->dev,
-                                  (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
-                                  priv->ict_tbl_vir, priv->ict_tbl_dma);
-                priv->ict_tbl_vir = NULL;
-        }
-}
-EXPORT_SYMBOL(iwl_free_isr_ict);
-
-
-/* allocate dram shared table it is a PAGE_SIZE aligned
- * also reset all data related to ICT table interrupt.
- */
-int iwl_alloc_isr_ict(struct iwl_priv *priv)
-{
-
-        if (priv->cfg->use_isr_legacy)
-                return 0;
-        /* allocate shrared data table */
-        priv->ict_tbl_vir = dma_alloc_coherent(&priv->pci_dev->dev,
-                                        (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
-                                        &priv->ict_tbl_dma, GFP_KERNEL);
-        if (!priv->ict_tbl_vir)
-                return -ENOMEM;
-
-        /* align table to PAGE_SIZE boundry */
-        priv->aligned_ict_tbl_dma = ALIGN(priv->ict_tbl_dma, PAGE_SIZE);
-
-        IWL_DEBUG_ISR(priv, "ict dma addr %Lx dma aligned %Lx diff %d\n",
-                             (unsigned long long)priv->ict_tbl_dma,
-                             (unsigned long long)priv->aligned_ict_tbl_dma,
-                        (int)(priv->aligned_ict_tbl_dma - priv->ict_tbl_dma));
-
-        priv->ict_tbl =  priv->ict_tbl_vir +
-                          (priv->aligned_ict_tbl_dma - priv->ict_tbl_dma);
-
-        IWL_DEBUG_ISR(priv, "ict vir addr %p vir aligned %p diff %d\n",
-                             priv->ict_tbl, priv->ict_tbl_vir,
-                        (int)(priv->aligned_ict_tbl_dma - priv->ict_tbl_dma));
-
-        /* reset table and index to all 0 */
-        memset(priv->ict_tbl_vir,0, (sizeof(u32) * ICT_COUNT) + PAGE_SIZE);
-        priv->ict_index = 0;
-
-        /* add periodic RX interrupt */
-        priv->inta_mask |= CSR_INT_BIT_RX_PERIODIC;
-        return 0;
-}
-EXPORT_SYMBOL(iwl_alloc_isr_ict);
-
-/* Device is going up inform it about using ICT interrupt table,
- * also we need to tell the driver to start using ICT interrupt.
- */
-int iwl_reset_ict(struct iwl_priv *priv)
-{
-        u32 val;
-        unsigned long flags;
-
-        if (!priv->ict_tbl_vir)
-                return 0;
-
-        spin_lock_irqsave(&priv->lock, flags);
-        iwl_disable_interrupts(priv);
-
-        memset(&priv->ict_tbl[0], 0, sizeof(u32) * ICT_COUNT);
-
-        val = priv->aligned_ict_tbl_dma >> PAGE_SHIFT;
-
-        val |= CSR_DRAM_INT_TBL_ENABLE;
-        val |= CSR_DRAM_INIT_TBL_WRAP_CHECK;
-
-        IWL_DEBUG_ISR(priv, "CSR_DRAM_INT_TBL_REG =0x%X "
-                        "aligned dma address %Lx\n",
-                        val, (unsigned long long)priv->aligned_ict_tbl_dma);
-
-        iwl_write32(priv, CSR_DRAM_INT_TBL_REG, val);
-        priv->use_ict = true;
-        priv->ict_index = 0;
-        iwl_write32(priv, CSR_INT, priv->inta_mask);
-        iwl_enable_interrupts(priv);
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        return 0;
-}
-EXPORT_SYMBOL(iwl_reset_ict);
-
-/* Device is going down disable ict interrupt usage */
-void iwl_disable_ict(struct iwl_priv *priv)
-{
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->lock, flags);
-        priv->use_ict = false;
-        spin_unlock_irqrestore(&priv->lock, flags);
-}
-EXPORT_SYMBOL(iwl_disable_ict);
-
-/* interrupt handler using ict table, with this interrupt driver will
- * stop using INTA register to get device's interrupt, reading this register
- * is expensive, device will write interrupts in ICT dram table, increment
- * index then will fire interrupt to driver, driver will OR all ICT table
- * entries from current index up to table entry with 0 value. the result is
- * the interrupt we need to service, driver will set the entries back to 0 and
- * set index.
- */
-irqreturn_t iwl_isr_ict(int irq, void *data)
-{
-        struct iwl_priv *priv = data;
-        u32 inta, inta_mask;
-        u32 val = 0;
-
-        if (!priv)
-                return IRQ_NONE;
-
-        /* dram interrupt table not set yet,
-         * use legacy interrupt.
-         */
-        if (!priv->use_ict)
-                return iwl_isr(irq, data);
-
-        spin_lock(&priv->lock);
-
-        /* Disable (but don't clear!) interrupts here to avoid
-         * back-to-back ISRs and sporadic interrupts from our NIC.
-         * If we have something to service, the tasklet will re-enable ints.
-         * If we *don't* have something, we'll re-enable before leaving here.
-         */
-        inta_mask = iwl_read32(priv, CSR_INT_MASK);  /* just for debug */
-        iwl_write32(priv, CSR_INT_MASK, 0x00000000);
-
-
-        /* Ignore interrupt if there's nothing in NIC to service.
-         * This may be due to IRQ shared with another device,
-         * or due to sporadic interrupts thrown from our NIC. */
-        if (!priv->ict_tbl[priv->ict_index]) {
-                IWL_DEBUG_ISR(priv, "Ignore interrupt, inta == 0\n");
-                goto none;
-        }
-
-        /* read all entries that not 0 start with ict_index */
-        while (priv->ict_tbl[priv->ict_index]) {
-
-                val |= le32_to_cpu(priv->ict_tbl[priv->ict_index]);
-                IWL_DEBUG_ISR(priv, "ICT index %d value 0x%08X\n",
-                                priv->ict_index,
-                                le32_to_cpu(priv->ict_tbl[priv->ict_index]));
-                priv->ict_tbl[priv->ict_index] = 0;
-                priv->ict_index = iwl_queue_inc_wrap(priv->ict_index,
-                                                     ICT_COUNT);
-
-        }
-
-        /* We should not get this value, just ignore it. */
-        if (val == 0xffffffff)
-                val = 0;
-
-        /*
-         * this is a w/a for a h/w bug. the h/w bug may cause the Rx bit
-         * (bit 15 before shifting it to 31) to clear when using interrupt
-         * coalescing. fortunately, bits 18 and 19 stay set when this happens
-         * so we use them to decide on the real state of the Rx bit.
-         * In order words, bit 15 is set if bit 18 or bit 19 are set.
-         */
-        if (val & 0xC0000)
-                val |= 0x8000;
-
-        inta = (0xff & val) | ((0xff00 & val) << 16);
-        IWL_DEBUG_ISR(priv, "ISR inta 0x%08x, enabled 0x%08x ict 0x%08x\n",
-                        inta, inta_mask, val);
-
-        inta &= priv->inta_mask;
-        priv->inta |= inta;
-
-        /* iwl_irq_tasklet() will service interrupts and re-enable them */
-        if (likely(inta))
-                tasklet_schedule(&priv->irq_tasklet);
-        else if (test_bit(STATUS_INT_ENABLED, &priv->status) && !priv->inta) {
-                /* Allow interrupt if was disabled by this handler and
-                 * no tasklet was schedules, We should not enable interrupt,
-                 * tasklet will enable it.
-                 */
-                iwl_enable_interrupts(priv);
-        }
-
-        spin_unlock(&priv->lock);
-        return IRQ_HANDLED;
-
- none:
-        /* re-enable interrupts here since we don't have anything to service.
-         * only Re-enable if disabled by irq.
-         */
-        if (test_bit(STATUS_INT_ENABLED, &priv->status) && !priv->inta)
-                iwl_enable_interrupts(priv);
-
-        spin_unlock(&priv->lock);
-        return IRQ_NONE;
-}
-EXPORT_SYMBOL(iwl_isr_ict);
-
-
-static irqreturn_t iwl_isr(int irq, void *data)
-{
-        struct iwl_priv *priv = data;
-        u32 inta, inta_mask;
-#ifdef CONFIG_IWLWIFI_DEBUG
-        u32 inta_fh;
-#endif
-        if (!priv)
-                return IRQ_NONE;
-
-        spin_lock(&priv->lock);
-
-        /* Disable (but don't clear!) interrupts here to avoid
-         *    back-to-back ISRs and sporadic interrupts from our NIC.
-         * If we have something to service, the tasklet will re-enable ints.
-         * If we *don't* have something, we'll re-enable before leaving here. */
-        inta_mask = iwl_read32(priv, CSR_INT_MASK);  /* just for debug */
-        iwl_write32(priv, CSR_INT_MASK, 0x00000000);
-
-        /* Discover which interrupts are active/pending */
-        inta = iwl_read32(priv, CSR_INT);
-
-        /* Ignore interrupt if there's nothing in NIC to service.
-         * This may be due to IRQ shared with another device,
-         * or due to sporadic interrupts thrown from our NIC. */
-        if (!inta) {
-                IWL_DEBUG_ISR(priv, "Ignore interrupt, inta == 0\n");
-                goto none;
-        }
-
-        if ((inta == 0xFFFFFFFF) || ((inta & 0xFFFFFFF0) == 0xa5a5a5a0)) {
-                /* Hardware disappeared. It might have already raised
-                 * an interrupt */
-                IWL_WARN(priv, "HARDWARE GONE?? INTA == 0x%08x\n", inta);
-                goto unplugged;
-        }
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-        if (iwl_get_debug_level(priv) & (IWL_DL_ISR)) {
-                inta_fh = iwl_read32(priv, CSR_FH_INT_STATUS);
-                IWL_DEBUG_ISR(priv, "ISR inta 0x%08x, enabled 0x%08x, "
-                              "fh 0x%08x\n", inta, inta_mask, inta_fh);
-        }
-#endif
-
-        priv->inta |= inta;
-        /* iwl_irq_tasklet() will service interrupts and re-enable them */
-        if (likely(inta))
-                tasklet_schedule(&priv->irq_tasklet);
-        else if (test_bit(STATUS_INT_ENABLED, &priv->status) && !priv->inta)
-                iwl_enable_interrupts(priv);
-
- unplugged:
-        spin_unlock(&priv->lock);
-        return IRQ_HANDLED;
-
- none:
-        /* re-enable interrupts here since we don't have anything to service. */
-        /* only Re-enable if diabled by irq  and no schedules tasklet. */
-        if (test_bit(STATUS_INT_ENABLED, &priv->status) && !priv->inta)
-                iwl_enable_interrupts(priv);
-
-        spin_unlock(&priv->lock);
-        return IRQ_NONE;
-}
-
 irqreturn_t iwl_isr_legacy(int irq, void *data)
 {
         struct iwl_priv *priv = data;
         u32 inta, inta_mask;
         u32 inta_fh;
+        unsigned long flags;
         if (!priv)
                 return IRQ_NONE;
 
-        spin_lock(&priv->lock);
+        spin_lock_irqsave(&priv->lock, flags);
 
         /* Disable (but don't clear!) interrupts here to avoid
          *    back-to-back ISRs and sporadic interrupts from our NIC.
@@ -1984,7 +1466,7 @@ irqreturn_t iwl_isr_legacy(int irq, void *data)
                 tasklet_schedule(&priv->irq_tasklet);
 
  unplugged:
-        spin_unlock(&priv->lock);
+        spin_unlock_irqrestore(&priv->lock, flags);
         return IRQ_HANDLED;
 
  none:
@@ -1992,7 +1474,7 @@ irqreturn_t iwl_isr_legacy(int irq, void *data)
         /* only Re-enable if diabled by irq */
         if (test_bit(STATUS_INT_ENABLED, &priv->status))
                 iwl_enable_interrupts(priv);
-        spin_unlock(&priv->lock);
+        spin_unlock_irqrestore(&priv->lock, flags);
         return IRQ_NONE;
 }
 EXPORT_SYMBOL(iwl_isr_legacy);
@@ -2305,12 +1787,6 @@ int iwl_mac_conf_tx(struct ieee80211_hw *hw, u16 queue,
                         cpu_to_le16((params->txop * 32));
 
         priv->qos_data.def_qos_parm.ac[q].reserved1 = 0;
-        priv->qos_data.qos_active = 1;
-
-        if (priv->iw_mode == NL80211_IFTYPE_AP)
-                iwl_activate_qos(priv, 1);
-        else if (priv->assoc_id && iwl_is_associated(priv))
-                iwl_activate_qos(priv, 0);
 
         spin_unlock_irqrestore(&priv->lock, flags);
 
@@ -2325,7 +1801,7 @@ static void iwl_ht_conf(struct iwl_priv *priv,
         struct iwl_ht_config *ht_conf = &priv->current_ht_config;
         struct ieee80211_sta *sta;
 
-        IWL_DEBUG_MAC80211(priv, "enter: \n");
+        IWL_DEBUG_MAC80211(priv, "enter:\n");
 
         if (!ht_conf->is_ht)
                 return;
@@ -2567,11 +2043,6 @@ int iwl_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb)
                 return -EIO;
         }
 
-        if (priv->iw_mode != NL80211_IFTYPE_ADHOC) {
-                IWL_DEBUG_MAC80211(priv, "leave - not IBSS\n");
-                return -EIO;
-        }
-
         spin_lock_irqsave(&priv->lock, flags);
 
         if (priv->ibss_beacon)
@@ -2586,52 +2057,25 @@ int iwl_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb)
         IWL_DEBUG_MAC80211(priv, "leave\n");
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        iwl_reset_qos(priv);
-
         priv->cfg->ops->lib->post_associate(priv);
 
-
         return 0;
 }
 EXPORT_SYMBOL(iwl_mac_beacon_update);
 
-int iwl_set_mode(struct iwl_priv *priv, int mode)
+static int iwl_set_mode(struct iwl_priv *priv, struct ieee80211_vif *vif)
 {
-        if (mode == NL80211_IFTYPE_ADHOC) {
-                const struct iwl_channel_info *ch_info;
-
-                ch_info = iwl_get_channel_info(priv,
-                        priv->band,
-                        le16_to_cpu(priv->staging_rxon.channel));
-
-                if (!ch_info || !is_channel_ibss(ch_info)) {
-                        IWL_ERR(priv, "channel %d not IBSS channel\n",
-                                  le16_to_cpu(priv->staging_rxon.channel));
-                        return -EINVAL;
-                }
-        }
-
-        iwl_connection_init_rx_config(priv, mode);
+        iwl_connection_init_rx_config(priv, vif->type);
 
         if (priv->cfg->ops->hcmd->set_rxon_chain)
                 priv->cfg->ops->hcmd->set_rxon_chain(priv);
 
         memcpy(priv->staging_rxon.node_addr, priv->mac_addr, ETH_ALEN);
 
-        iwl_clear_stations_table(priv);
-
-        /* dont commit rxon if rf-kill is on*/
-        if (!iwl_is_ready_rf(priv))
-                return -EAGAIN;
-
-        iwlcore_commit_rxon(priv);
-
-        return 0;
+        return iwlcore_commit_rxon(priv);
 }
-EXPORT_SYMBOL(iwl_set_mode);
 
-int iwl_mac_add_interface(struct ieee80211_hw *hw,
-                                 struct ieee80211_vif *vif)
+int iwl_mac_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 {
         struct iwl_priv *priv = hw->priv;
         int err = 0;
@@ -2640,6 +2084,11 @@ int iwl_mac_add_interface(struct ieee80211_hw *hw,
 
         mutex_lock(&priv->mutex);
 
+        if (WARN_ON(!iwl_is_ready_rf(priv))) {
+                err = -EINVAL;
+                goto out;
+        }
+
         if (priv->vif) {
                 IWL_DEBUG_MAC80211(priv, "leave - vif != NULL\n");
                 err = -EOPNOTSUPP;
@@ -2649,15 +2098,21 @@ int iwl_mac_add_interface(struct ieee80211_hw *hw,
         priv->vif = vif;
         priv->iw_mode = vif->type;
 
-        if (vif->addr) {
-                IWL_DEBUG_MAC80211(priv, "Set %pM\n", vif->addr);
-                memcpy(priv->mac_addr, vif->addr, ETH_ALEN);
-        }
+        IWL_DEBUG_MAC80211(priv, "Set %pM\n", vif->addr);
+        memcpy(priv->mac_addr, vif->addr, ETH_ALEN);
+
+        err = iwl_set_mode(priv, vif);
+        if (err)
+                goto out_err;
+
+        /* Add the broadcast address so we can send broadcast frames */
+        priv->cfg->ops->lib->add_bcast_station(priv);
 
-        if (iwl_set_mode(priv, vif->type) == -EAGAIN)
-                /* we are not ready, will run again when ready */
-                set_bit(STATUS_MODE_PENDING, &priv->status);
+        goto out;
 
+ out_err:
+        priv->vif = NULL;
+        priv->iw_mode = NL80211_IFTYPE_STATION;
  out:
         mutex_unlock(&priv->mutex);
 
@@ -2667,7 +2122,7 @@ int iwl_mac_add_interface(struct ieee80211_hw *hw,
 EXPORT_SYMBOL(iwl_mac_add_interface);
 
 void iwl_mac_remove_interface(struct ieee80211_hw *hw,
-                                     struct ieee80211_vif *vif)
+                              struct ieee80211_vif *vif)
 {
         struct iwl_priv *priv = hw->priv;
 
@@ -2675,6 +2130,8 @@ void iwl_mac_remove_interface(struct ieee80211_hw *hw,
 
         mutex_lock(&priv->mutex);
 
+        iwl_clear_ucode_stations(priv, true);
+
         if (iwl_is_ready_rf(priv)) {
                 iwl_scan_cancel_timeout(priv, 100);
                 priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
@@ -2751,15 +2208,6 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
                         goto set_ch_out;
                 }
 
-                if (priv->iw_mode == NL80211_IFTYPE_ADHOC &&
-                        !is_channel_ibss(ch_info)) {
-                        IWL_ERR(priv, "channel %d in band %d not "
-                                "IBSS channel\n",
-                                conf->channel->hw_value, conf->channel->band);
-                        ret = -EINVAL;
-                        goto set_ch_out;
-                }
-
                 spin_lock_irqsave(&priv->lock, flags);
 
                 /* Configure HT40 channels */
@@ -2832,6 +2280,15 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
                 iwl_set_tx_power(priv, conf->power_level, false);
         }
 
+        if (changed & IEEE80211_CONF_CHANGE_QOS) {
+                bool qos_active = !!(conf->flags & IEEE80211_CONF_QOS);
+
+                spin_lock_irqsave(&priv->lock, flags);
+                priv->qos_data.qos_active = qos_active;
+                iwl_update_qos(priv);
+                spin_unlock_irqrestore(&priv->lock, flags);
+        }
+
         if (!iwl_is_ready(priv)) {
                 IWL_DEBUG_MAC80211(priv, "leave - not ready\n");
                 goto out;
@@ -2866,12 +2323,9 @@ void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
         memset(&priv->current_ht_config, 0, sizeof(struct iwl_ht_config));
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        iwl_reset_qos(priv);
-
         spin_lock_irqsave(&priv->lock, flags);
         priv->assoc_id = 0;
         priv->assoc_capability = 0;
-        priv->assoc_station_added = 0;
 
         /* new association get rid of ibss beacon skb */
         if (priv->ibss_beacon)
@@ -2881,8 +2335,6 @@ void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
 
         priv->beacon_int = priv->vif->bss_conf.beacon_int;
         priv->timestamp = 0;
-        if ((priv->iw_mode == NL80211_IFTYPE_STATION))
-                priv->beacon_int = 0;
 
         spin_unlock_irqrestore(&priv->lock, flags);
 
@@ -2895,17 +2347,9 @@ void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
         /* we are restarting association process
          * clear RXON_FILTER_ASSOC_MSK bit
          */
-        if (priv->iw_mode != NL80211_IFTYPE_AP) {
-                iwl_scan_cancel_timeout(priv, 100);
-                priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
-                iwlcore_commit_rxon(priv);
-        }
-
-        if (priv->iw_mode != NL80211_IFTYPE_ADHOC) {
-                IWL_DEBUG_MAC80211(priv, "leave - not in IBSS\n");
-                mutex_unlock(&priv->mutex);
-                return;
-        }
+        iwl_scan_cancel_timeout(priv, 100);
+        priv->staging_rxon.filter_flags &= ~RXON_FILTER_ASSOC_MSK;
+        iwlcore_commit_rxon(priv);
 
         iwl_set_rate(priv);
 
@@ -2922,7 +2366,7 @@ int iwl_alloc_txq_mem(struct iwl_priv *priv)
                         sizeof(struct iwl_tx_queue) * priv->cfg->num_of_queues,
                         GFP_KERNEL);
         if (!priv->txq) {
-                IWL_ERR(priv, "Not enough memory for txq \n");
+                IWL_ERR(priv, "Not enough memory for txq\n");
                 return -ENOMEM;
         }
         return 0;
@@ -3403,6 +2847,99 @@ int iwl_force_reset(struct iwl_priv *priv, int mode)
         }
         return 0;
 }
+EXPORT_SYMBOL(iwl_force_reset);
+
+/**
+ * iwl_bg_monitor_recover - Timer callback to check for stuck queue and recover
+ *
+ * During normal condition (no queue is stuck), the timer is continually set to
+ * execute every monitor_recover_period milliseconds after the last timer
+ * expired.  When the queue read_ptr is at the same place, the timer is
+ * shorten to 100mSecs.  This is
+ *      1) to reduce the chance that the read_ptr may wrap around (not stuck)
+ *      2) to detect the stuck queues quicker before the station and AP can
+ *      disassociate each other.
+ *
+ * This function monitors all the tx queues and recover from it if any
+ * of the queues are stuck.
+ * 1. It first check the cmd queue for stuck conditions.  If it is stuck,
+ *      it will recover by resetting the firmware and return.
+ * 2. Then, it checks for station association.  If it associates it will check
+ *      other queues.  If any queue is stuck, it will recover by resetting
+ *      the firmware.
+ * Note: It the number of times the queue read_ptr to be at the same place to
+ *      be MAX_REPEAT+1 in order to consider to be stuck.
+ */
+/*
+ * The maximum number of times the read pointer of the tx queue at the
+ * same place without considering to be stuck.
+ */
+#define MAX_REPEAT      (2)
+static int iwl_check_stuck_queue(struct iwl_priv *priv, int cnt)
+{
+        struct iwl_tx_queue *txq;
+        struct iwl_queue *q;
+
+        txq = &priv->txq[cnt];
+        q = &txq->q;
+        /* queue is empty, skip */
+        if (q->read_ptr != q->write_ptr) {
+                if (q->read_ptr == q->last_read_ptr) {
+                        /* a queue has not been read from last time */
+                        if (q->repeat_same_read_ptr > MAX_REPEAT) {
+                                IWL_ERR(priv,
+                                        "queue %d stuck %d time. Fw reload.\n",
+                                        q->id, q->repeat_same_read_ptr);
+                                q->repeat_same_read_ptr = 0;
+                                iwl_force_reset(priv, IWL_FW_RESET);
+                        } else {
+                                q->repeat_same_read_ptr++;
+                                IWL_DEBUG_RADIO(priv,
+                                                "queue %d, not read %d time\n",
+                                                q->id,
+                                                q->repeat_same_read_ptr);
+                                mod_timer(&priv->monitor_recover, jiffies +
+                                        msecs_to_jiffies(IWL_ONE_HUNDRED_MSECS));
+                        }
+                        return 1;
+                } else {
+                        q->last_read_ptr = q->read_ptr;
+                        q->repeat_same_read_ptr = 0;
+                }
+        }
+        return 0;
+}
+
+void iwl_bg_monitor_recover(unsigned long data)
+{
+        struct iwl_priv *priv = (struct iwl_priv *)data;
+        int cnt;
+
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+
+        /* monitor and check for stuck cmd queue */
+        if (iwl_check_stuck_queue(priv, IWL_CMD_QUEUE_NUM))
+                return;
+
+        /* monitor and check for other stuck queues */
+        if (iwl_is_associated(priv)) {
+                for (cnt = 0; cnt < priv->hw_params.max_txq_num; cnt++) {
+                        /* skip as we already checked the command queue */
+                        if (cnt == IWL_CMD_QUEUE_NUM)
+                                continue;
+                        if (iwl_check_stuck_queue(priv, cnt))
+                                return;
+                }
+        }
+        /*
+         * Reschedule the timer to occur in
+         * priv->cfg->monitor_recover_period
+         */
+        mod_timer(&priv->monitor_recover,
+                jiffies + msecs_to_jiffies(priv->cfg->monitor_recover_period));
+}
+EXPORT_SYMBOL(iwl_bg_monitor_recover);
 
 #ifdef CONFIG_PM
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 732590f5fe30..10f95724536f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -191,6 +191,14 @@ struct iwl_lib_ops {
         struct iwl_temp_ops temp_ops;
         /* station management */
         void (*add_bcast_station)(struct iwl_priv *priv);
+        /* recover from tx queue stall */
+        void (*recover_from_tx_stall)(unsigned long data);
+        /* check for plcp health */
+        bool (*check_plcp_health)(struct iwl_priv *priv,
+                                        struct iwl_rx_packet *pkt);
+        /* check for ack health */
+        bool (*check_ack_health)(struct iwl_priv *priv,
+                                        struct iwl_rx_packet *pkt);
 };
 
 struct iwl_led_ops {
@@ -295,6 +303,10 @@ struct iwl_cfg {
         const bool support_wimax_coexist;
         u8 plcp_delta_threshold;
         s32 chain_noise_scale;
+        /* timer period for monitor the driver queues */
+        u32 monitor_recover_period;
+        bool temperature_kelvin;
+        bool off_channel_workaround;
 };
 
 /***************************
@@ -304,8 +316,7 @@ struct iwl_cfg {
 struct ieee80211_hw *iwl_alloc_all(struct iwl_cfg *cfg,
                 struct ieee80211_ops *hw_ops);
 void iwl_hw_detect(struct iwl_priv *priv);
-void iwl_reset_qos(struct iwl_priv *priv);
-void iwl_activate_qos(struct iwl_priv *priv, u8 force);
+void iwl_activate_qos(struct iwl_priv *priv);
 int iwl_mac_conf_tx(struct ieee80211_hw *hw, u16 queue,
                     const struct ieee80211_tx_queue_params *params);
 void iwl_set_rxon_hwcrypto(struct iwl_priv *priv, int hw_decrypt);
@@ -326,7 +337,6 @@ void iwl_irq_handle_error(struct iwl_priv *priv);
 void iwl_configure_filter(struct ieee80211_hw *hw,
                           unsigned int changed_flags,
                           unsigned int *total_flags, u64 multicast);
-int iwl_hw_nic_init(struct iwl_priv *priv);
 int iwl_set_hw_params(struct iwl_priv *priv);
 bool iwl_is_monitor_mode(struct iwl_priv *priv);
 void iwl_post_associate(struct iwl_priv *priv);
@@ -336,7 +346,6 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
                                      u32 changes);
 int iwl_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *skb);
 int iwl_commit_rxon(struct iwl_priv *priv);
-int iwl_set_mode(struct iwl_priv *priv, int mode);
 int iwl_mac_add_interface(struct ieee80211_hw *hw,
                           struct ieee80211_vif *vif);
 void iwl_mac_remove_interface(struct ieee80211_hw *hw,
@@ -411,26 +420,22 @@ void iwl_rx_reply_error(struct iwl_priv *priv,
 /*****************************************************
 * RX
 ******************************************************/
-void iwl_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
 void iwl_cmd_queue_free(struct iwl_priv *priv);
 int iwl_rx_queue_alloc(struct iwl_priv *priv);
 void iwl_rx_handle(struct iwl_priv *priv);
 void iwl_rx_queue_update_write_ptr(struct iwl_priv *priv,
                                   struct iwl_rx_queue *q);
-void iwl_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
-void iwl_rx_replenish(struct iwl_priv *priv);
-void iwl_rx_replenish_now(struct iwl_priv *priv);
-int iwl_rx_init(struct iwl_priv *priv, struct iwl_rx_queue *rxq);
-void iwl_rx_queue_restock(struct iwl_priv *priv);
 int iwl_rx_queue_space(const struct iwl_rx_queue *q);
-void iwl_rx_allocate(struct iwl_priv *priv, gfp_t priority);
 void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb);
-int iwl_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index);
 /* Handlers */
 void iwl_rx_missed_beacon_notif(struct iwl_priv *priv,
                                struct iwl_rx_mem_buffer *rxb);
 void iwl_rx_spectrum_measure_notif(struct iwl_priv *priv,
                                           struct iwl_rx_mem_buffer *rxb);
+bool iwl_good_plcp_health(struct iwl_priv *priv,
+                                 struct iwl_rx_packet *pkt);
+bool iwl_good_ack_health(struct iwl_priv *priv,
+                                 struct iwl_rx_packet *pkt);
 void iwl_rx_statistics(struct iwl_priv *priv,
                               struct iwl_rx_mem_buffer *rxb);
 void iwl_reply_statistics(struct iwl_priv *priv,
@@ -442,14 +447,10 @@ void iwl_rx_csa(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb);
 /*****************************************************
 * TX
 ******************************************************/
-int iwl_txq_ctx_alloc(struct iwl_priv *priv);
-void iwl_txq_ctx_reset(struct iwl_priv *priv);
 void iwl_hw_txq_free_tfd(struct iwl_priv *priv, struct iwl_tx_queue *txq);
 int iwl_hw_txq_attach_buf_to_tfd(struct iwl_priv *priv,
                                  struct iwl_tx_queue *txq,
                                  dma_addr_t addr, u16 len, u8 reset, u8 pad);
-int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb);
-void iwl_hw_txq_ctx_free(struct iwl_priv *priv);
 int iwl_hw_tx_queue_init(struct iwl_priv *priv,
                          struct iwl_tx_queue *txq);
 void iwl_free_tfds_in_queue(struct iwl_priv *priv,
@@ -460,9 +461,6 @@ int iwl_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq,
 void iwl_tx_queue_reset(struct iwl_priv *priv, struct iwl_tx_queue *txq,
                         int slots_num, u32 txq_id);
 void iwl_tx_queue_free(struct iwl_priv *priv, int txq_id);
-int iwl_tx_agg_start(struct iwl_priv *priv, const u8 *ra, u16 tid, u16 *ssn);
-int iwl_tx_agg_stop(struct iwl_priv *priv , const u8 *ra, u16 tid);
-int iwl_txq_check_empty(struct iwl_priv *priv, int sta_id, u8 tid, int txq_id);
 /*****************************************************
  * TX power
  ****************************************************/
@@ -472,10 +470,7 @@ int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force);
  * Rate
  ******************************************************************************/
 
-void iwl_hwrate_to_tx_control(struct iwl_priv *priv, u32 rate_n_flags,
-                              struct ieee80211_tx_info *info);
 int iwl_hwrate_to_plcp_idx(u32 rate_n_flags);
-int iwl_hwrate_to_mac80211_idx(u32 rate_n_flags, enum ieee80211_band band);
 
 u8 iwl_rate_get_lowest_plcp(struct iwl_priv *priv);
 
@@ -563,11 +558,6 @@ int iwl_send_card_state(struct iwl_priv *priv, u32 flags,
  * PCI                                               *
  *****************************************************/
 irqreturn_t iwl_isr_legacy(int irq, void *data);
-int iwl_reset_ict(struct iwl_priv *priv);
-void iwl_disable_ict(struct iwl_priv *priv);
-int iwl_alloc_isr_ict(struct iwl_priv *priv);
-void iwl_free_isr_ict(struct iwl_priv *priv);
-irqreturn_t iwl_isr_ict(int irq, void *data);
 
 static inline u16 iwl_pcie_link_ctl(struct iwl_priv *priv)
 {
@@ -577,6 +567,9 @@ static inline u16 iwl_pcie_link_ctl(struct iwl_priv *priv)
         pci_read_config_word(priv->pci_dev, pos + PCI_EXP_LNKCTL, &pci_lnk_ctl);
         return pci_lnk_ctl;
 }
+
+void iwl_bg_monitor_recover(unsigned long data);
+
 #ifdef CONFIG_PM
 int iwl_pci_suspend(struct pci_dev *pdev, pm_message_t state);
 int iwl_pci_resume(struct pci_dev *pdev);
@@ -625,7 +618,6 @@ void iwlcore_free_geos(struct iwl_priv *priv);
 #define STATUS_SCAN_HW          15
 #define STATUS_POWER_PMI        16
 #define STATUS_FW_ERROR         17
-#define STATUS_MODE_PENDING     18
 
 
 static inline int iwl_is_ready(struct iwl_priv *priv)
@@ -677,15 +669,8 @@ extern int iwl_send_statistics_request(struct iwl_priv *priv,
                                        u8 flags, bool clear);
 extern int iwl_verify_ucode(struct iwl_priv *priv);
 extern int iwl_send_lq_cmd(struct iwl_priv *priv,
-                struct iwl_link_quality_cmd *lq, u8 flags);
-extern void iwl_rx_reply_rx(struct iwl_priv *priv,
-                struct iwl_rx_mem_buffer *rxb);
-extern void iwl_rx_reply_rx_phy(struct iwl_priv *priv,
-                                    struct iwl_rx_mem_buffer *rxb);
-void iwl_rx_reply_compressed_ba(struct iwl_priv *priv,
-                                           struct iwl_rx_mem_buffer *rxb);
+                struct iwl_link_quality_cmd *lq, u8 flags, bool init);
 void iwl_apm_stop(struct iwl_priv *priv);
-int iwl_apm_stop_master(struct iwl_priv *priv);
 int iwl_apm_init(struct iwl_priv *priv);
 
 void iwl_setup_rxon_timing(struct iwl_priv *priv);
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index 7bf44f146799..5f5820249a29 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -560,8 +560,6 @@ static ssize_t iwl_dbgfs_status_read(struct file *file,
                 test_bit(STATUS_POWER_PMI, &priv->status));
         pos += scnprintf(buf + pos, bufsz - pos, "STATUS_FW_ERROR:\t %d\n",
                 test_bit(STATUS_FW_ERROR, &priv->status));
-        pos += scnprintf(buf + pos, bufsz - pos, "STATUS_MODE_PENDING:\t %d\n",
-                test_bit(STATUS_MODE_PENDING, &priv->status));
         return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
@@ -660,7 +658,6 @@ static ssize_t iwl_dbgfs_qos_read(struct file *file, char __user *user_buf,
         int pos = 0, i;
         char buf[256];
         const size_t bufsz = sizeof(buf);
-        ssize_t ret;
 
         for (i = 0; i < AC_NUM; i++) {
                 pos += scnprintf(buf + pos, bufsz - pos,
@@ -672,8 +669,7 @@ static ssize_t iwl_dbgfs_qos_read(struct file *file, char __user *user_buf,
                                 priv->qos_data.def_qos_parm.ac[i].aifsn,
                                 priv->qos_data.def_qos_parm.ac[i].edca_txop);
         }
-        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-        return ret;
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
 static ssize_t iwl_dbgfs_led_read(struct file *file, char __user *user_buf,
@@ -683,7 +679,6 @@ static ssize_t iwl_dbgfs_led_read(struct file *file, char __user *user_buf,
         int pos = 0;
         char buf[256];
         const size_t bufsz = sizeof(buf);
-        ssize_t ret;
 
         pos += scnprintf(buf + pos, bufsz - pos,
                          "allow blinking: %s\n",
@@ -697,8 +692,7 @@ static ssize_t iwl_dbgfs_led_read(struct file *file, char __user *user_buf,
                                  priv->last_blink_time);
         }
 
-        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-        return ret;
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
 static ssize_t iwl_dbgfs_thermal_throttling_read(struct file *file,
@@ -711,7 +705,6 @@ static ssize_t iwl_dbgfs_thermal_throttling_read(struct file *file,
         char buf[100];
         int pos = 0;
         const size_t bufsz = sizeof(buf);
-        ssize_t ret;
 
         pos += scnprintf(buf + pos, bufsz - pos,
                         "Thermal Throttling Mode: %s\n",
@@ -731,8 +724,7 @@ static ssize_t iwl_dbgfs_thermal_throttling_read(struct file *file,
                                 "HT mode: %d\n",
                                 restriction->is_ht);
         }
-        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-        return ret;
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
 static ssize_t iwl_dbgfs_disable_ht40_write(struct file *file,
@@ -769,13 +761,11 @@ static ssize_t iwl_dbgfs_disable_ht40_read(struct file *file,
         char buf[100];
         int pos = 0;
         const size_t bufsz = sizeof(buf);
-        ssize_t ret;
 
         pos += scnprintf(buf + pos, bufsz - pos,
                         "11n 40MHz Mode: %s\n",
                         priv->disable_ht40 ? "Disabled" : "Enabled");
-        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-        return ret;
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
 static ssize_t iwl_dbgfs_sleep_level_override_write(struct file *file,
@@ -2051,7 +2041,6 @@ static ssize_t iwl_dbgfs_ucode_tracing_read(struct file *file,
         int pos = 0;
         char buf[128];
         const size_t bufsz = sizeof(buf);
-        ssize_t ret;
 
         pos += scnprintf(buf + pos, bufsz - pos, "ucode trace timer is %s\n",
                         priv->event_log.ucode_trace ? "On" : "Off");
@@ -2062,8 +2051,7 @@ static ssize_t iwl_dbgfs_ucode_tracing_read(struct file *file,
         pos += scnprintf(buf + pos, bufsz - pos, "wraps_more_count:\t\t %u\n",
                         priv->event_log.wraps_more_count);
 
-        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-        return ret;
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
 static ssize_t iwl_dbgfs_ucode_tracing_write(struct file *file,
@@ -2095,6 +2083,31 @@ static ssize_t iwl_dbgfs_ucode_tracing_write(struct file *file,
         return count;
 }
 
+static ssize_t iwl_dbgfs_rxon_flags_read(struct file *file,
+                                         char __user *user_buf,
+                                         size_t count, loff_t *ppos) {
+
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        int len = 0;
+        char buf[20];
+
+        len = sprintf(buf, "0x%04X\n", le32_to_cpu(priv->active_rxon.flags));
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t iwl_dbgfs_rxon_filter_flags_read(struct file *file,
+                                                char __user *user_buf,
+                                                size_t count, loff_t *ppos) {
+
+        struct iwl_priv *priv = (struct iwl_priv *)file->private_data;
+        int len = 0;
+        char buf[20];
+
+        len = sprintf(buf, "0x%04X\n",
+                      le32_to_cpu(priv->active_rxon.filter_flags));
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
 static ssize_t iwl_dbgfs_fh_reg_read(struct file *file,
                                          char __user *user_buf,
                                          size_t count, loff_t *ppos)
@@ -2124,13 +2137,11 @@ static ssize_t iwl_dbgfs_missed_beacon_read(struct file *file,
         int pos = 0;
         char buf[12];
         const size_t bufsz = sizeof(buf);
-        ssize_t ret;
 
         pos += scnprintf(buf + pos, bufsz - pos, "%d\n",
                         priv->missed_beacon_threshold);
 
-        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-        return ret;
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
 static ssize_t iwl_dbgfs_missed_beacon_write(struct file *file,
@@ -2159,27 +2170,6 @@ static ssize_t iwl_dbgfs_missed_beacon_write(struct file *file,
         return count;
 }
 
-static ssize_t iwl_dbgfs_internal_scan_write(struct file *file,
-                                         const char __user *user_buf,
-                                         size_t count, loff_t *ppos)
-{
-        struct iwl_priv *priv = file->private_data;
-        char buf[8];
-        int buf_size;
-        int scan;
-
-        memset(buf, 0, sizeof(buf));
-        buf_size = min(count, sizeof(buf) -  1);
-        if (copy_from_user(buf, user_buf, buf_size))
-                return -EFAULT;
-        if (sscanf(buf, "%d", &scan) != 1)
-                return -EINVAL;
-
-        iwl_internal_short_hw_scan(priv);
-
-        return count;
-}
-
 static ssize_t iwl_dbgfs_plcp_delta_read(struct file *file,
                                         char __user *user_buf,
                                         size_t count, loff_t *ppos) {
@@ -2188,13 +2178,11 @@ static ssize_t iwl_dbgfs_plcp_delta_read(struct file *file,
         int pos = 0;
         char buf[12];
         const size_t bufsz = sizeof(buf);
-        ssize_t ret;
 
         pos += scnprintf(buf + pos, bufsz - pos, "%u\n",
                         priv->cfg->plcp_delta_threshold);
 
-        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-        return ret;
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
 static ssize_t iwl_dbgfs_plcp_delta_write(struct file *file,
@@ -2295,9 +2283,10 @@ DEBUGFS_WRITE_FILE_OPS(csr);
 DEBUGFS_READ_WRITE_FILE_OPS(ucode_tracing);
 DEBUGFS_READ_FILE_OPS(fh_reg);
 DEBUGFS_READ_WRITE_FILE_OPS(missed_beacon);
-DEBUGFS_WRITE_FILE_OPS(internal_scan);
 DEBUGFS_READ_WRITE_FILE_OPS(plcp_delta);
 DEBUGFS_READ_WRITE_FILE_OPS(force_reset);
+DEBUGFS_READ_FILE_OPS(rxon_flags);
+DEBUGFS_READ_FILE_OPS(rxon_filter_flags);
 
 /*
  * Create the debugfs files and directories
@@ -2349,7 +2338,6 @@ int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
         DEBUGFS_ADD_FILE(csr, dir_debug, S_IWUSR);
         DEBUGFS_ADD_FILE(fh_reg, dir_debug, S_IRUSR);
         DEBUGFS_ADD_FILE(missed_beacon, dir_debug, S_IWUSR);
-        DEBUGFS_ADD_FILE(internal_scan, dir_debug, S_IWUSR);
         DEBUGFS_ADD_FILE(plcp_delta, dir_debug, S_IWUSR | S_IRUSR);
         DEBUGFS_ADD_FILE(force_reset, dir_debug, S_IWUSR | S_IRUSR);
         if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) != CSR_HW_REV_TYPE_3945) {
@@ -2360,6 +2348,8 @@ int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
                 DEBUGFS_ADD_FILE(chain_noise, dir_debug, S_IRUSR);
                 DEBUGFS_ADD_FILE(ucode_tracing, dir_debug, S_IWUSR | S_IRUSR);
         }
+        DEBUGFS_ADD_FILE(rxon_flags, dir_debug, S_IWUSR);
+        DEBUGFS_ADD_FILE(rxon_filter_flags, dir_debug, S_IWUSR);
         DEBUGFS_ADD_BOOL(disable_sensitivity, dir_rf, &priv->disable_sens_cal);
         DEBUGFS_ADD_BOOL(disable_chain_noise, dir_rf,
                          &priv->disable_chain_noise_cal);
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 6054c5fba0c1..4319bda487d9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -43,6 +43,7 @@
 #include "iwl-debug.h"
 #include "iwl-4965-hw.h"
 #include "iwl-3945-hw.h"
+#include "iwl-agn-hw.h"
 #include "iwl-led.h"
 #include "iwl-power.h"
 #include "iwl-agn-rs.h"
@@ -57,6 +58,7 @@ extern struct iwl_cfg iwl5100_abg_cfg;
 extern struct iwl_cfg iwl5150_agn_cfg;
 extern struct iwl_cfg iwl5150_abg_cfg;
 extern struct iwl_cfg iwl6000i_2agn_cfg;
+extern struct iwl_cfg iwl6000i_g2_2agn_cfg;
 extern struct iwl_cfg iwl6000i_2abg_cfg;
 extern struct iwl_cfg iwl6000i_2bg_cfg;
 extern struct iwl_cfg iwl6000_3agn_cfg;
@@ -67,45 +69,6 @@ extern struct iwl_cfg iwl1000_bg_cfg;
 
 struct iwl_tx_queue;
 
-/* shared structures from iwl-5000.c */
-extern struct iwl_mod_params iwl50_mod_params;
-extern struct iwl_ucode_ops iwl5000_ucode;
-extern struct iwl_lib_ops iwl5000_lib;
-extern struct iwl_hcmd_ops iwl5000_hcmd;
-extern struct iwl_hcmd_utils_ops iwl5000_hcmd_utils;
-
-/* shared functions from iwl-5000.c */
-extern u16 iwl5000_get_hcmd_size(u8 cmd_id, u16 len);
-extern u16 iwl5000_build_addsta_hcmd(const struct iwl_addsta_cmd *cmd,
-                                     u8 *data);
-extern void iwl5000_rts_tx_cmd_flag(struct ieee80211_tx_info *info,
-                                    __le32 *tx_flags);
-extern int iwl5000_calc_rssi(struct iwl_priv *priv,
-                             struct iwl_rx_phy_res *rx_resp);
-extern void iwl5000_nic_config(struct iwl_priv *priv);
-extern u16 iwl5000_eeprom_calib_version(struct iwl_priv *priv);
-extern const u8 *iwl5000_eeprom_query_addr(const struct iwl_priv *priv,
-                                    size_t offset);
-extern void iwl5000_txq_update_byte_cnt_tbl(struct iwl_priv *priv,
-                                            struct iwl_tx_queue *txq,
-                                            u16 byte_cnt);
-extern void iwl5000_txq_inval_byte_cnt_tbl(struct iwl_priv *priv,
-                                    struct iwl_tx_queue *txq);
-extern int iwl5000_load_ucode(struct iwl_priv *priv);
-extern void iwl5000_init_alive_start(struct iwl_priv *priv);
-extern int iwl5000_alive_notify(struct iwl_priv *priv);
-extern int iwl5000_hw_set_hw_params(struct iwl_priv *priv);
-extern int iwl5000_txq_agg_enable(struct iwl_priv *priv, int txq_id,
-                           int tx_fifo, int sta_id, int tid, u16 ssn_idx);
-extern int iwl5000_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
-                            u16 ssn_idx, u8 tx_fifo);
-extern void iwl5000_txq_set_sched(struct iwl_priv *priv, u32 mask);
-extern void iwl5000_setup_deferred_work(struct iwl_priv *priv);
-extern void iwl5000_rx_handler_setup(struct iwl_priv *priv);
-extern int iwl5000_hw_valid_rtc_data_addr(u32 addr);
-extern int iwl5000_send_tx_power(struct iwl_priv *priv);
-extern void iwl5000_temperature(struct iwl_priv *priv);
-
 /* CT-KILL constants */
 #define CT_KILL_THRESHOLD_LEGACY   110 /* in Celsius */
 #define CT_KILL_THRESHOLD          114 /* in Celsius */
@@ -183,6 +146,10 @@ struct iwl_queue {
         int n_bd;              /* number of BDs in this queue */
         int write_ptr;       /* 1-st empty entry (index) host_w*/
         int read_ptr;         /* last used entry (index) host_r*/
+        /* use for monitoring and recovering the stuck queue */
+        int last_read_ptr;      /* storing the last read_ptr */
+        /* number of time read_ptr and last_read_ptr are the same */
+        u8 repeat_same_read_ptr;
         dma_addr_t dma_addr;   /* physical addr for BD's */
         int n_window;          /* safe queue window */
         u32 id;
@@ -304,13 +271,11 @@ struct iwl_channel_info {
         struct iwl3945_scan_power_info scan_pwr_info[IWL_NUM_SCAN_RATES];
 };
 
-#define IWL_TX_FIFO_AC0 0
-#define IWL_TX_FIFO_AC1 1
-#define IWL_TX_FIFO_AC2 2
-#define IWL_TX_FIFO_AC3 3
-#define IWL_TX_FIFO_HCCA_1      5
-#define IWL_TX_FIFO_HCCA_2      6
-#define IWL_TX_FIFO_NONE        7
+#define IWL_TX_FIFO_BK          0
+#define IWL_TX_FIFO_BE          1
+#define IWL_TX_FIFO_VI          2
+#define IWL_TX_FIFO_VO          3
+#define IWL_TX_FIFO_UNUSED      -1
 
 /* Minimum number of queues. MAX_NUM is defined in hw specific files.
  * Set the minimum to accommodate the 4 standard TX queues, 1 command
@@ -361,13 +326,6 @@ enum {
 
 #define DEF_CMD_PAYLOAD_SIZE 320
 
-/*
- * IWL_LINK_HDR_MAX should include ieee80211_hdr, radiotap header,
- * SNAP header and alignment. It should also be big enough for 802.11
- * control frames.
- */
-#define IWL_LINK_HDR_MAX 64
-
 /**
  * struct iwl_device_cmd
  *
@@ -519,38 +477,24 @@ struct iwl_ht_config {
         u8 non_GF_STA_present;
 };
 
-union iwl_qos_capabity {
-        struct {
-                u8 edca_count:4;        /* bit 0-3 */
-                u8 q_ack:1;             /* bit 4 */
-                u8 queue_request:1;     /* bit 5 */
-                u8 txop_request:1;      /* bit 6 */
-                u8 reserved:1;          /* bit 7 */
-        } q_AP;
-        struct {
-                u8 acvo_APSD:1;         /* bit 0 */
-                u8 acvi_APSD:1;         /* bit 1 */
-                u8 ac_bk_APSD:1;        /* bit 2 */
-                u8 ac_be_APSD:1;        /* bit 3 */
-                u8 q_ack:1;             /* bit 4 */
-                u8 max_len:2;           /* bit 5-6 */
-                u8 more_data_ack:1;     /* bit 7 */
-        } q_STA;
-        u8 val;
-};
-
 /* QoS structures */
 struct iwl_qos_info {
         int qos_active;
-        union iwl_qos_capabity qos_cap;
         struct iwl_qosparam_cmd def_qos_parm;
 };
 
+/*
+ * Structure should be accessed with sta_lock held. When station addition
+ * is in progress (IWL_STA_UCODE_INPROGRESS) it is possible to access only
+ * the commands (iwl_addsta_cmd and iwl_link_quality_cmd) without sta_lock
+ * held.
+ */
 struct iwl_station_entry {
         struct iwl_addsta_cmd sta;
         struct iwl_tid_data tid[MAX_TID_COUNT];
         u8 used;
         struct iwl_hw_key keyinfo;
+        struct iwl_link_quality_cmd *lq;
 };
 
 /*
@@ -1039,6 +983,11 @@ struct iwl_event_log {
 #define IWL_DELAY_NEXT_FORCE_RF_RESET  (HZ*3)
 #define IWL_DELAY_NEXT_FORCE_FW_RELOAD (HZ*5)
 
+/* timer constants use to monitor and recover stuck tx queues in mSecs */
+#define IWL_MONITORING_PERIOD  (1000)
+#define IWL_ONE_HUNDRED_MSECS   (100)
+#define IWL_SIXTY_SECS          (60000)
+
 enum iwl_reset {
         IWL_RF_RESET = 0,
         IWL_FW_RESET,
@@ -1092,10 +1041,6 @@ struct iwl_priv {
         struct iwl_channel_info *channel_info;  /* channel info array */
         u8 channel_count;       /* # of channels */
 
-        /* each calibration channel group in the EEPROM has a derived
-         * clip setting for each rate. 3945 only.*/
-        const struct iwl3945_clip_group clip39_groups[5];
-
         /* thermal calibration */
         s32 temperature;        /* degrees Kelvin */
         s32 last_temperature;
@@ -1168,9 +1113,7 @@ struct iwl_priv {
         u64 led_tpt;
 
         u16 active_rate;
-        u16 active_rate_basic;
 
-        u8 assoc_station_added;
         u8 start_calib;
         struct iwl_sensitivity_data sensitivity_data;
         struct iwl_chain_noise_data chain_noise_data;
@@ -1197,9 +1140,6 @@ struct iwl_priv {
 
         unsigned long status;
 
-        int last_rx_rssi;       /* From Rx packet statistics */
-        int last_rx_noise;      /* From beacon statistics */
-
         /* counts mgmt, ctl, and data packets */
         struct traffic_stats tx_stats;
         struct traffic_stats rx_stats;
@@ -1218,8 +1158,6 @@ struct iwl_priv {
 #endif
 
         /* context information */
-        u16 rates_mask;
-
         u8 bssid[ETH_ALEN];
         u16 rts_threshold;
         u8 mac_addr[ETH_ALEN];
@@ -1228,7 +1166,7 @@ struct iwl_priv {
         spinlock_t sta_lock;
         int num_stations;
         struct iwl_station_entry stations[IWL_STATION_COUNT];
-        struct iwl_wep_key wep_keys[WEP_KEYS_MAX];
+        struct iwl_wep_key wep_keys[WEP_KEYS_MAX]; /* protected by mutex */
         u8 default_wep_key;
         u8 key_mapping_key;
         unsigned long ucode_key_table;
@@ -1244,10 +1182,6 @@ struct iwl_priv {
 
         u8 mac80211_registered;
 
-        /* Rx'd packet timing information */
-        u32 last_beacon_time;
-        u64 last_tsf;
-
         /* eeprom -- this is in the card's little endian byte order */
         u8 *eeprom;
         int    nvm_device_type;
@@ -1262,20 +1196,53 @@ struct iwl_priv {
         u16 beacon_int;
         struct ieee80211_vif *vif;
 
-        /*Added for 3945 */
-        void *shared_virt;
-        dma_addr_t shared_phys;
-        /*End*/
-        struct iwl_hw_params hw_params;
+        union {
+#if defined(CONFIG_IWL3945) || defined(CONFIG_IWL3945_MODULE)
+                struct {
+                        void *shared_virt;
+                        dma_addr_t shared_phys;
+
+                        struct delayed_work thermal_periodic;
+                        struct delayed_work rfkill_poll;
+
+                        struct iwl3945_notif_statistics statistics;
+
+                        u32 sta_supp_rates;
+                        int last_rx_rssi;       /* From Rx packet statistics */
+
+                        /* Rx'd packet timing information */
+                        u32 last_beacon_time;
+                        u64 last_tsf;
+
+                        /*
+                         * each calibration channel group in the
+                         * EEPROM has a derived clip setting for
+                         * each rate.
+                         */
+                        const struct iwl3945_clip_group clip_groups[5];
+
+                } _3945;
+#endif
+#if defined(CONFIG_IWLAGN) || defined(CONFIG_IWLAGN_MODULE)
+                struct {
+                        /* INT ICT Table */
+                        __le32 *ict_tbl;
+                        void *ict_tbl_vir;
+                        dma_addr_t ict_tbl_dma;
+                        dma_addr_t aligned_ict_tbl_dma;
+                        int ict_index;
+                        u32 inta;
+                        bool use_ict;
+                        /*
+                         * reporting the number of tids has AGG on. 0 means
+                         * no AGGREGATION
+                         */
+                        u8 agg_tids_count;
+                } _agn;
+#endif
+        };
 
-        /* INT ICT Table */
-        __le32 *ict_tbl;
-        dma_addr_t ict_tbl_dma;
-        dma_addr_t aligned_ict_tbl_dma;
-        int ict_index;
-        void *ict_tbl_vir;
-        u32 inta;
-        bool use_ict;
+        struct iwl_hw_params hw_params;
 
         u32 inta_mask;
         /* Current association information needed to configure the
@@ -1303,10 +1270,6 @@ struct iwl_priv {
         struct delayed_work alive_start;
         struct delayed_work scan_check;
 
-        /*For 3945 only*/
-        struct delayed_work thermal_periodic;
-        struct delayed_work rfkill_poll;
-
         /* TX Power */
         s8 tx_power_user_lmt;
         s8 tx_power_device_lmt;
@@ -1338,13 +1301,8 @@ struct iwl_priv {
         struct work_struct run_time_calib_work;
         struct timer_list statistics_periodic;
         struct timer_list ucode_trace;
+        struct timer_list monitor_recover;
         bool hw_ready;
-        /*For 3945*/
-#define IWL_DEFAULT_TX_POWER 0x0F
-
-        struct iwl3945_notif_statistics statistics_39;
-
-        u32 sta_supp_rates;
 
         struct iwl_event_log event_log;
 }; /*iwl_priv */
diff --git a/drivers/net/wireless/iwlwifi/iwl-devtrace.c b/drivers/net/wireless/iwlwifi/iwl-devtrace.c
index 36580d8d8b8d..f469aa92316a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-devtrace.c
+++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.c
@@ -35,6 +35,7 @@ EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_iowrite8);
 EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ioread32);
 EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_iowrite32);
 EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_rx);
+EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_tx);
 EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ucode_event);
 EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ucode_error);
 EXPORT_TRACEPOINT_SYMBOL(iwlwifi_dev_ucode_cont_event);
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
index 4e1ba824dc50..cb6d50b78140 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -188,19 +188,19 @@ struct iwl_eeprom_enhanced_txpwr {
 /* 5000 regulatory - indirect access */
 #define EEPROM_5000_REG_SKU_ID ((0x02)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 4  bytes */
-#define EEPROM_5000_REG_BAND_1_CHANNELS       ((0x08)\
+#define EEPROM_REG_BAND_1_CHANNELS       ((0x08)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 28 bytes */
-#define EEPROM_5000_REG_BAND_2_CHANNELS       ((0x26)\
+#define EEPROM_REG_BAND_2_CHANNELS       ((0x26)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 26 bytes */
-#define EEPROM_5000_REG_BAND_3_CHANNELS       ((0x42)\
+#define EEPROM_REG_BAND_3_CHANNELS       ((0x42)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 24 bytes */
-#define EEPROM_5000_REG_BAND_4_CHANNELS       ((0x5C)\
+#define EEPROM_REG_BAND_4_CHANNELS       ((0x5C)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 22 bytes */
-#define EEPROM_5000_REG_BAND_5_CHANNELS       ((0x74)\
+#define EEPROM_REG_BAND_5_CHANNELS       ((0x74)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 12 bytes */
-#define EEPROM_5000_REG_BAND_24_HT40_CHANNELS  ((0x82)\
+#define EEPROM_REG_BAND_24_HT40_CHANNELS  ((0x82)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 14  bytes */
-#define EEPROM_5000_REG_BAND_52_HT40_CHANNELS  ((0x92)\
+#define EEPROM_REG_BAND_52_HT40_CHANNELS  ((0x92)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 22  bytes */
 
 /* 6000 and up regulatory tx power - indirect access */
@@ -261,12 +261,15 @@ struct iwl_eeprom_enhanced_txpwr {
 #define EEPROM_5050_EEPROM_VERSION      (0x21E)
 
 /* 1000 Specific */
+#define EEPROM_1000_TX_POWER_VERSION    (4)
 #define EEPROM_1000_EEPROM_VERSION      (0x15C)
 
 /* 6x00 Specific */
+#define EEPROM_6000_TX_POWER_VERSION    (4)
 #define EEPROM_6000_EEPROM_VERSION      (0x434)
 
 /* 6x50 Specific */
+#define EEPROM_6050_TX_POWER_VERSION    (4)
 #define EEPROM_6050_EEPROM_VERSION      (0x532)
 
 /* OTP */
diff --git a/drivers/net/wireless/iwlwifi/iwl-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
index 73681c4fefe7..51f89e7ba681 100644
--- a/drivers/net/wireless/iwlwifi/iwl-hcmd.c
+++ b/drivers/net/wireless/iwlwifi/iwl-hcmd.c
@@ -169,7 +169,7 @@ int iwl_send_cmd_sync(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
         mutex_lock(&priv->sync_cmd_mutex);
 
         set_bit(STATUS_HCMD_ACTIVE, &priv->status);
-        IWL_DEBUG_INFO(priv, "Setting HCMD_ACTIVE for command %s \n",
+        IWL_DEBUG_INFO(priv, "Setting HCMD_ACTIVE for command %s\n",
                         get_cmd_string(cmd->id));
 
         cmd_idx = iwl_enqueue_hcmd(priv, cmd);
@@ -191,7 +191,7 @@ int iwl_send_cmd_sync(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
                                 jiffies_to_msecs(HOST_COMPLETE_TIMEOUT));
 
                         clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
-                        IWL_DEBUG_INFO(priv, "Clearing HCMD_ACTIVE for command %s \n",
+                        IWL_DEBUG_INFO(priv, "Clearing HCMD_ACTIVE for command %s\n",
                                        get_cmd_string(cmd->id));
                         ret = -ETIMEDOUT;
                         goto cancel;
diff --git a/drivers/net/wireless/iwlwifi/iwl-helpers.h b/drivers/net/wireless/iwlwifi/iwl-helpers.h
index 51a67fb2e185..3ff6b9d25a10 100644
--- a/drivers/net/wireless/iwlwifi/iwl-helpers.h
+++ b/drivers/net/wireless/iwlwifi/iwl-helpers.h
@@ -31,6 +31,9 @@
 #define __iwl_helpers_h__
 
 #include <linux/ctype.h>
+#include <net/mac80211.h>
+
+#include "iwl-io.h"
 
 #define IWL_MASK(lo, hi) ((1 << (hi)) | ((1 << (hi)) - (1 << (lo))))
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-io.h b/drivers/net/wireless/iwlwifi/iwl-io.h
index c719baf2585a..4f54a5f71cd5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-io.h
+++ b/drivers/net/wireless/iwlwifi/iwl-io.h
@@ -297,7 +297,7 @@ static inline u32 __iwl_read_direct32(const char *f, u32 l,
                                         struct iwl_priv *priv, u32 reg)
 {
         u32 value = _iwl_read_direct32(priv, reg);
-        IWL_DEBUG_IO(priv, "read_direct32(0x%4X) = 0x%08x - %s %d \n", reg, value,
+        IWL_DEBUG_IO(priv, "read_direct32(0x%4X) = 0x%08x - %s %d\n", reg, value,
                      f, l);
         return value;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-led.c b/drivers/net/wireless/iwlwifi/iwl-led.c
index a6f9c918aabc..db5bfcb036ca 100644
--- a/drivers/net/wireless/iwlwifi/iwl-led.c
+++ b/drivers/net/wireless/iwlwifi/iwl-led.c
@@ -46,7 +46,7 @@
 static int led_mode;
 module_param(led_mode, int, S_IRUGO);
 MODULE_PARM_DESC(led_mode, "led mode: 0=blinking, 1=On(RF On)/Off(RF Off), "
-                           "(default 0)\n");
+                           "(default 0)");
 
 
 static const struct {
diff --git a/drivers/net/wireless/iwlwifi/iwl-power.c b/drivers/net/wireless/iwlwifi/iwl-power.c
index 1a1a9f081cc7..2655dbdc8175 100644
--- a/drivers/net/wireless/iwlwifi/iwl-power.c
+++ b/drivers/net/wireless/iwlwifi/iwl-power.c
@@ -383,10 +383,10 @@ EXPORT_SYMBOL(iwl_ht_enabled);
 
 bool iwl_within_ct_kill_margin(struct iwl_priv *priv)
 {
-        s32 temp = priv->temperature; /* degrees CELSIUS except 4965 */
+        s32 temp = priv->temperature; /* degrees CELSIUS except specified */
         bool within_margin = false;
 
-        if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_4965)
+        if (priv->cfg->temperature_kelvin)
                 temp = KELVIN_TO_CELSIUS(priv->temperature);
 
         if (!priv->thermal_throttle.advanced_tt)
@@ -839,12 +839,12 @@ EXPORT_SYMBOL(iwl_tt_exit_ct_kill);
 static void iwl_bg_tt_work(struct work_struct *work)
 {
         struct iwl_priv *priv = container_of(work, struct iwl_priv, tt_work);
-        s32 temp = priv->temperature; /* degrees CELSIUS except 4965 */
+        s32 temp = priv->temperature; /* degrees CELSIUS except specified */
 
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
-        if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_4965)
+        if (priv->cfg->temperature_kelvin)
                 temp = KELVIN_TO_CELSIUS(priv->temperature);
 
         if (!priv->thermal_throttle.advanced_tt)
@@ -874,7 +874,7 @@ void iwl_tt_initialize(struct iwl_priv *priv)
         int size = sizeof(struct iwl_tt_trans) * (IWL_TI_STATE_MAX - 1);
         struct iwl_tt_trans *transaction;
 
-        IWL_DEBUG_POWER(priv, "Initialize Thermal Throttling \n");
+        IWL_DEBUG_POWER(priv, "Initialize Thermal Throttling\n");
 
         memset(tt, 0, sizeof(struct iwl_tt_mgmt));
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index d2d2a9174900..5944de7a98a2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -254,7 +254,7 @@
  * device.  A queue maps to only one (selectable by driver) Tx DMA channel,
  * but one DMA channel may take input from several queues.
  *
- * Tx DMA channels have dedicated purposes.  For 4965, they are used as follows
+ * Tx DMA FIFOs have dedicated purposes.  For 4965, they are used as follows
  * (cf. default_queue_to_tx_fifo in iwl-4965.c):
  *
  * 0 -- EDCA BK (background) frames, lowest priority
@@ -262,20 +262,20 @@
  * 2 -- EDCA VI (video) frames, higher priority
  * 3 -- EDCA VO (voice) and management frames, highest priority
  * 4 -- Commands (e.g. RXON, etc.)
- * 5 -- HCCA short frames
- * 6 -- HCCA long frames
+ * 5 -- unused (HCCA)
+ * 6 -- unused (HCCA)
  * 7 -- not used by driver (device-internal only)
  *
- * For 5000 series and up, they are used slightly differently
+ * For 5000 series and up, they are used differently
  * (cf. iwl5000_default_queue_to_tx_fifo in iwl-5000.c):
  *
  * 0 -- EDCA BK (background) frames, lowest priority
  * 1 -- EDCA BE (best effort) frames, normal priority
  * 2 -- EDCA VI (video) frames, higher priority
  * 3 -- EDCA VO (voice) and management frames, highest priority
- * 4 -- (TBD)
- * 5 -- HCCA short frames
- * 6 -- HCCA long frames
+ * 4 -- unused
+ * 5 -- unused
+ * 6 -- unused
  * 7 -- Commands
  *
  * Driver should normally map queues 0-6 to Tx DMA/FIFO channels 0-6.
diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index df257bc15f49..1dff14a67b2c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -162,197 +162,6 @@ void iwl_rx_queue_update_write_ptr(struct iwl_priv *priv, struct iwl_rx_queue *q
         spin_unlock_irqrestore(&q->lock, flags);
 }
 EXPORT_SYMBOL(iwl_rx_queue_update_write_ptr);
-/**
- * iwl_dma_addr2rbd_ptr - convert a DMA address to a uCode read buffer ptr
- */
-static inline __le32 iwl_dma_addr2rbd_ptr(struct iwl_priv *priv,
-                                          dma_addr_t dma_addr)
-{
-        return cpu_to_le32((u32)(dma_addr >> 8));
-}
-
-/**
- * iwl_rx_queue_restock - refill RX queue from pre-allocated pool
- *
- * If there are slots in the RX queue that need to be restocked,
- * and we have free pre-allocated buffers, fill the ranks as much
- * as we can, pulling from rx_free.
- *
- * This moves the 'write' index forward to catch up with 'processed', and
- * also updates the memory address in the firmware to reference the new
- * target buffer.
- */
-void iwl_rx_queue_restock(struct iwl_priv *priv)
-{
-        struct iwl_rx_queue *rxq = &priv->rxq;
-        struct list_head *element;
-        struct iwl_rx_mem_buffer *rxb;
-        unsigned long flags;
-        int write;
-
-        spin_lock_irqsave(&rxq->lock, flags);
-        write = rxq->write & ~0x7;
-        while ((iwl_rx_queue_space(rxq) > 0) && (rxq->free_count)) {
-                /* Get next free Rx buffer, remove from free list */
-                element = rxq->rx_free.next;
-                rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
-                list_del(element);
-
-                /* Point to Rx buffer via next RBD in circular buffer */
-                rxq->bd[rxq->write] = iwl_dma_addr2rbd_ptr(priv, rxb->page_dma);
-                rxq->queue[rxq->write] = rxb;
-                rxq->write = (rxq->write + 1) & RX_QUEUE_MASK;
-                rxq->free_count--;
-        }
-        spin_unlock_irqrestore(&rxq->lock, flags);
-        /* If the pre-allocated buffer pool is dropping low, schedule to
-         * refill it */
-        if (rxq->free_count <= RX_LOW_WATERMARK)
-                queue_work(priv->workqueue, &priv->rx_replenish);
-
-
-        /* If we've added more space for the firmware to place data, tell it.
-         * Increment device's write pointer in multiples of 8. */
-        if (rxq->write_actual != (rxq->write & ~0x7)) {
-                spin_lock_irqsave(&rxq->lock, flags);
-                rxq->need_update = 1;
-                spin_unlock_irqrestore(&rxq->lock, flags);
-                iwl_rx_queue_update_write_ptr(priv, rxq);
-        }
-}
-EXPORT_SYMBOL(iwl_rx_queue_restock);
-
-
-/**
- * iwl_rx_replenish - Move all used packet from rx_used to rx_free
- *
- * When moving to rx_free an SKB is allocated for the slot.
- *
- * Also restock the Rx queue via iwl_rx_queue_restock.
- * This is called as a scheduled work item (except for during initialization)
- */
-void iwl_rx_allocate(struct iwl_priv *priv, gfp_t priority)
-{
-        struct iwl_rx_queue *rxq = &priv->rxq;
-        struct list_head *element;
-        struct iwl_rx_mem_buffer *rxb;
-        struct page *page;
-        unsigned long flags;
-        gfp_t gfp_mask = priority;
-
-        while (1) {
-                spin_lock_irqsave(&rxq->lock, flags);
-                if (list_empty(&rxq->rx_used)) {
-                        spin_unlock_irqrestore(&rxq->lock, flags);
-                        return;
-                }
-                spin_unlock_irqrestore(&rxq->lock, flags);
-
-                if (rxq->free_count > RX_LOW_WATERMARK)
-                        gfp_mask |= __GFP_NOWARN;
-
-                if (priv->hw_params.rx_page_order > 0)
-                        gfp_mask |= __GFP_COMP;
-
-                /* Alloc a new receive buffer */
-                page = alloc_pages(gfp_mask, priv->hw_params.rx_page_order);
-                if (!page) {
-                        if (net_ratelimit())
-                                IWL_DEBUG_INFO(priv, "alloc_pages failed, "
-                                               "order: %d\n",
-                                               priv->hw_params.rx_page_order);
-
-                        if ((rxq->free_count <= RX_LOW_WATERMARK) &&
-                            net_ratelimit())
-                                IWL_CRIT(priv, "Failed to alloc_pages with %s. Only %u free buffers remaining.\n",
-                                         priority == GFP_ATOMIC ?  "GFP_ATOMIC" : "GFP_KERNEL",
-                                         rxq->free_count);
-                        /* We don't reschedule replenish work here -- we will
-                         * call the restock method and if it still needs
-                         * more buffers it will schedule replenish */
-                        return;
-                }
-
-                spin_lock_irqsave(&rxq->lock, flags);
-
-                if (list_empty(&rxq->rx_used)) {
-                        spin_unlock_irqrestore(&rxq->lock, flags);
-                        __free_pages(page, priv->hw_params.rx_page_order);
-                        return;
-                }
-                element = rxq->rx_used.next;
-                rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
-                list_del(element);
-
-                spin_unlock_irqrestore(&rxq->lock, flags);
-
-                rxb->page = page;
-                /* Get physical address of the RB */
-                rxb->page_dma = pci_map_page(priv->pci_dev, page, 0,
-                                PAGE_SIZE << priv->hw_params.rx_page_order,
-                                PCI_DMA_FROMDEVICE);
-                /* dma address must be no more than 36 bits */
-                BUG_ON(rxb->page_dma & ~DMA_BIT_MASK(36));
-                /* and also 256 byte aligned! */
-                BUG_ON(rxb->page_dma & DMA_BIT_MASK(8));
-
-                spin_lock_irqsave(&rxq->lock, flags);
-
-                list_add_tail(&rxb->list, &rxq->rx_free);
-                rxq->free_count++;
-                priv->alloc_rxb_page++;
-
-                spin_unlock_irqrestore(&rxq->lock, flags);
-        }
-}
-
-void iwl_rx_replenish(struct iwl_priv *priv)
-{
-        unsigned long flags;
-
-        iwl_rx_allocate(priv, GFP_KERNEL);
-
-        spin_lock_irqsave(&priv->lock, flags);
-        iwl_rx_queue_restock(priv);
-        spin_unlock_irqrestore(&priv->lock, flags);
-}
-EXPORT_SYMBOL(iwl_rx_replenish);
-
-void iwl_rx_replenish_now(struct iwl_priv *priv)
-{
-        iwl_rx_allocate(priv, GFP_ATOMIC);
-
-        iwl_rx_queue_restock(priv);
-}
-EXPORT_SYMBOL(iwl_rx_replenish_now);
-
-
-/* Assumes that the skb field of the buffers in 'pool' is kept accurate.
- * If an SKB has been detached, the POOL needs to have its SKB set to NULL
- * This free routine walks the list of POOL entries and if SKB is set to
- * non NULL it is unmapped and freed
- */
-void iwl_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
-{
-        int i;
-        for (i = 0; i < RX_QUEUE_SIZE + RX_FREE_BUFFERS; i++) {
-                if (rxq->pool[i].page != NULL) {
-                        pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
-                                PAGE_SIZE << priv->hw_params.rx_page_order,
-                                PCI_DMA_FROMDEVICE);
-                        __iwl_free_pages(priv, rxq->pool[i].page);
-                        rxq->pool[i].page = NULL;
-                }
-        }
-
-        dma_free_coherent(&priv->pci_dev->dev, 4 * RX_QUEUE_SIZE, rxq->bd,
-                          rxq->dma_addr);
-        dma_free_coherent(&priv->pci_dev->dev, sizeof(struct iwl_rb_status),
-                          rxq->rb_stts, rxq->rb_stts_dma);
-        rxq->bd = NULL;
-        rxq->rb_stts  = NULL;
-}
-EXPORT_SYMBOL(iwl_rx_queue_free);
 
 int iwl_rx_queue_alloc(struct iwl_priv *priv)
 {
@@ -395,98 +204,6 @@ err_bd:
 }
 EXPORT_SYMBOL(iwl_rx_queue_alloc);
 
-void iwl_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
-{
-        unsigned long flags;
-        int i;
-        spin_lock_irqsave(&rxq->lock, flags);
-        INIT_LIST_HEAD(&rxq->rx_free);
-        INIT_LIST_HEAD(&rxq->rx_used);
-        /* Fill the rx_used queue with _all_ of the Rx buffers */
-        for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
-                /* In the reset function, these buffers may have been allocated
-                 * to an SKB, so we need to unmap and free potential storage */
-                if (rxq->pool[i].page != NULL) {
-                        pci_unmap_page(priv->pci_dev, rxq->pool[i].page_dma,
-                                PAGE_SIZE << priv->hw_params.rx_page_order,
-                                PCI_DMA_FROMDEVICE);
-                        __iwl_free_pages(priv, rxq->pool[i].page);
-                        rxq->pool[i].page = NULL;
-                }
-                list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
-        }
-
-        /* Set us so that we have processed and used all buffers, but have
-         * not restocked the Rx queue with fresh buffers */
-        rxq->read = rxq->write = 0;
-        rxq->write_actual = 0;
-        rxq->free_count = 0;
-        spin_unlock_irqrestore(&rxq->lock, flags);
-}
-
-int iwl_rx_init(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
-{
-        u32 rb_size;
-        const u32 rfdnlog = RX_QUEUE_SIZE_LOG; /* 256 RBDs */
-        u32 rb_timeout = 0; /* FIXME: RX_RB_TIMEOUT for all devices? */
-
-        if (!priv->cfg->use_isr_legacy)
-                rb_timeout = RX_RB_TIMEOUT;
-
-        if (priv->cfg->mod_params->amsdu_size_8K)
-                rb_size = FH_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_8K;
-        else
-                rb_size = FH_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_4K;
-
-        /* Stop Rx DMA */
-        iwl_write_direct32(priv, FH_MEM_RCSR_CHNL0_CONFIG_REG, 0);
-
-        /* Reset driver's Rx queue write index */
-        iwl_write_direct32(priv, FH_RSCSR_CHNL0_RBDCB_WPTR_REG, 0);
-
-        /* Tell device where to find RBD circular buffer in DRAM */
-        iwl_write_direct32(priv, FH_RSCSR_CHNL0_RBDCB_BASE_REG,
-                           (u32)(rxq->dma_addr >> 8));
-
-        /* Tell device where in DRAM to update its Rx status */
-        iwl_write_direct32(priv, FH_RSCSR_CHNL0_STTS_WPTR_REG,
-                           rxq->rb_stts_dma >> 4);
-
-        /* Enable Rx DMA
-         * FH_RCSR_CHNL0_RX_IGNORE_RXF_EMPTY is set because of HW bug in
-         *      the credit mechanism in 5000 HW RX FIFO
-         * Direct rx interrupts to hosts
-         * Rx buffer size 4 or 8k
-         * RB timeout 0x10
-         * 256 RBDs
-         */
-        iwl_write_direct32(priv, FH_MEM_RCSR_CHNL0_CONFIG_REG,
-                           FH_RCSR_RX_CONFIG_CHNL_EN_ENABLE_VAL |
-                           FH_RCSR_CHNL0_RX_IGNORE_RXF_EMPTY |
-                           FH_RCSR_CHNL0_RX_CONFIG_IRQ_DEST_INT_HOST_VAL |
-                           FH_RCSR_CHNL0_RX_CONFIG_SINGLE_FRAME_MSK |
-                           rb_size|
-                           (rb_timeout << FH_RCSR_RX_CONFIG_REG_IRQ_RBTH_POS)|
-                           (rfdnlog << FH_RCSR_RX_CONFIG_RBDCB_SIZE_POS));
-
-        /* Set interrupt coalescing timer to default (2048 usecs) */
-        iwl_write8(priv, CSR_INT_COALESCING, IWL_HOST_INT_TIMEOUT_DEF);
-
-        return 0;
-}
-
-int iwl_rxq_stop(struct iwl_priv *priv)
-{
-
-        /* stop Rx DMA */
-        iwl_write_direct32(priv, FH_MEM_RCSR_CHNL0_CONFIG_REG, 0);
-        iwl_poll_direct_bit(priv, FH_MEM_RSSR_RX_STATUS_REG,
-                            FH_RSSR_CHNL0_RX_STATUS_CHNL_IDLE, 1000);
-
-        return 0;
-}
-EXPORT_SYMBOL(iwl_rxq_stop);
-
 void iwl_rx_missed_beacon_notif(struct iwl_priv *priv,
                                 struct iwl_rx_mem_buffer *rxb)
 
@@ -542,6 +259,7 @@ static void iwl_rx_calc_noise(struct iwl_priv *priv)
                 le32_to_cpu(rx_info->beacon_silence_rssi_b) & IN_BAND_FILTER;
         int bcn_silence_c =
                 le32_to_cpu(rx_info->beacon_silence_rssi_c) & IN_BAND_FILTER;
+        int last_rx_noise;
 
         if (bcn_silence_a) {
                 total_silence += bcn_silence_a;
@@ -558,13 +276,13 @@ static void iwl_rx_calc_noise(struct iwl_priv *priv)
 
         /* Average among active antennas */
         if (num_active_rx)
-                priv->last_rx_noise = (total_silence / num_active_rx) - 107;
+                last_rx_noise = (total_silence / num_active_rx) - 107;
         else
-                priv->last_rx_noise = IWL_NOISE_MEAS_NOT_AVAILABLE;
+                last_rx_noise = IWL_NOISE_MEAS_NOT_AVAILABLE;
 
         IWL_DEBUG_CALIB(priv, "inband silence a %u, b %u, c %u, dBm %d\n",
                         bcn_silence_a, bcn_silence_b, bcn_silence_c,
-                        priv->last_rx_noise);
+                        last_rx_noise);
 }
 
 #ifdef CONFIG_IWLWIFI_DEBUG
@@ -616,29 +334,20 @@ static void iwl_accumulative_statistics(struct iwl_priv *priv,
 
 #define REG_RECALIB_PERIOD (60)
 
-#define PLCP_MSG "plcp_err exceeded %u, %u, %u, %u, %u, %d, %u mSecs\n"
-void iwl_rx_statistics(struct iwl_priv *priv,
-                              struct iwl_rx_mem_buffer *rxb)
+/**
+ * iwl_good_plcp_health - checks for plcp error.
+ *
+ * When the plcp error is exceeding the thresholds, reset the radio
+ * to improve the throughput.
+ */
+bool iwl_good_plcp_health(struct iwl_priv *priv,
+                                struct iwl_rx_packet *pkt)
 {
-        int change;
-        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        bool rc = true;
         int combined_plcp_delta;
         unsigned int plcp_msec;
         unsigned long plcp_received_jiffies;
 
-        IWL_DEBUG_RX(priv, "Statistics notification received (%d vs %d).\n",
-                     (int)sizeof(priv->statistics),
-                     le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
-
-        change = ((priv->statistics.general.temperature !=
-                   pkt->u.stats.general.temperature) ||
-                  ((priv->statistics.flag &
-                    STATISTICS_REPLY_FLG_HT40_MODE_MSK) !=
-                   (pkt->u.stats.flag & STATISTICS_REPLY_FLG_HT40_MODE_MSK)));
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-        iwl_accumulative_statistics(priv, (__le32 *)&pkt->u.stats);
-#endif
         /*
          * check for plcp_err and trigger radio reset if it exceeds
          * the plcp error threshold plcp_delta.
@@ -659,11 +368,11 @@ void iwl_rx_statistics(struct iwl_priv *priv,
                         le32_to_cpu(priv->statistics.rx.ofdm_ht.plcp_err));
 
                 if ((combined_plcp_delta > 0) &&
-                        ((combined_plcp_delta * 100) / plcp_msec) >
+                    ((combined_plcp_delta * 100) / plcp_msec) >
                         priv->cfg->plcp_delta_threshold) {
                         /*
-                         * if plcp_err exceed the threshold, the following
-                         * data is printed in csv format:
+                         * if plcp_err exceed the threshold,
+                         * the following data is printed in csv format:
                          *    Text: plcp_err exceeded %d,
                          *    Received ofdm.plcp_err,
                          *    Current ofdm.plcp_err,
@@ -672,22 +381,73 @@ void iwl_rx_statistics(struct iwl_priv *priv,
                          *    combined_plcp_delta,
                          *    plcp_msec
                          */
-                        IWL_DEBUG_RADIO(priv, PLCP_MSG,
+                        IWL_DEBUG_RADIO(priv, "plcp_err exceeded %u, "
+                                "%u, %u, %u, %u, %d, %u mSecs\n",
                                 priv->cfg->plcp_delta_threshold,
                                 le32_to_cpu(pkt->u.stats.rx.ofdm.plcp_err),
                                 le32_to_cpu(priv->statistics.rx.ofdm.plcp_err),
                                 le32_to_cpu(pkt->u.stats.rx.ofdm_ht.plcp_err),
                                 le32_to_cpu(
-                                        priv->statistics.rx.ofdm_ht.plcp_err),
+                                  priv->statistics.rx.ofdm_ht.plcp_err),
                                 combined_plcp_delta, plcp_msec);
+                        rc = false;
+                }
+        }
+        return rc;
+}
+EXPORT_SYMBOL(iwl_good_plcp_health);
 
-                        /*
-                         * Reset the RF radio due to the high plcp
-                         * error rate
-                         */
-                        iwl_force_reset(priv, IWL_RF_RESET);
+static void iwl_recover_from_statistics(struct iwl_priv *priv,
+                                struct iwl_rx_packet *pkt)
+{
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
+                return;
+        if (iwl_is_associated(priv)) {
+                if (priv->cfg->ops->lib->check_ack_health) {
+                        if (!priv->cfg->ops->lib->check_ack_health(
+                            priv, pkt)) {
+                                /*
+                                 * low ack count detected
+                                 * restart Firmware
+                                 */
+                                IWL_ERR(priv, "low ack count detected, "
+                                        "restart firmware\n");
+                                iwl_force_reset(priv, IWL_FW_RESET);
+                        }
+                } else if (priv->cfg->ops->lib->check_plcp_health) {
+                        if (!priv->cfg->ops->lib->check_plcp_health(
+                            priv, pkt)) {
+                                /*
+                                 * high plcp error detected
+                                 * reset Radio
+                                 */
+                                iwl_force_reset(priv, IWL_RF_RESET);
+                        }
                 }
         }
+}
+
+void iwl_rx_statistics(struct iwl_priv *priv,
+                              struct iwl_rx_mem_buffer *rxb)
+{
+        int change;
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+
+
+        IWL_DEBUG_RX(priv, "Statistics notification received (%d vs %d).\n",
+                     (int)sizeof(priv->statistics),
+                     le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
+
+        change = ((priv->statistics.general.temperature !=
+                   pkt->u.stats.general.temperature) ||
+                  ((priv->statistics.flag &
+                    STATISTICS_REPLY_FLG_HT40_MODE_MSK) !=
+                   (pkt->u.stats.flag & STATISTICS_REPLY_FLG_HT40_MODE_MSK)));
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+        iwl_accumulative_statistics(priv, (__le32 *)&pkt->u.stats);
+#endif
+        iwl_recover_from_statistics(priv, pkt);
 
         memcpy(&priv->statistics, &pkt->u.stats, sizeof(priv->statistics));
 
@@ -730,139 +490,6 @@ void iwl_reply_statistics(struct iwl_priv *priv,
 }
 EXPORT_SYMBOL(iwl_reply_statistics);
 
-/* Calc max signal level (dBm) among 3 possible receivers */
-static inline int iwl_calc_rssi(struct iwl_priv *priv,
-                                struct iwl_rx_phy_res *rx_resp)
-{
-        return priv->cfg->ops->utils->calc_rssi(priv, rx_resp);
-}
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-/**
- * iwl_dbg_report_frame - dump frame to syslog during debug sessions
- *
- * You may hack this function to show different aspects of received frames,
- * including selective frame dumps.
- * group100 parameter selects whether to show 1 out of 100 good data frames.
- *    All beacon and probe response frames are printed.
- */
-static void iwl_dbg_report_frame(struct iwl_priv *priv,
-                      struct iwl_rx_phy_res *phy_res, u16 length,
-                      struct ieee80211_hdr *header, int group100)
-{
-        u32 to_us;
-        u32 print_summary = 0;
-        u32 print_dump = 0;     /* set to 1 to dump all frames' contents */
-        u32 hundred = 0;
-        u32 dataframe = 0;
-        __le16 fc;
-        u16 seq_ctl;
-        u16 channel;
-        u16 phy_flags;
-        u32 rate_n_flags;
-        u32 tsf_low;
-        int rssi;
-
-        if (likely(!(iwl_get_debug_level(priv) & IWL_DL_RX)))
-                return;
-
-        /* MAC header */
-        fc = header->frame_control;
-        seq_ctl = le16_to_cpu(header->seq_ctrl);
-
-        /* metadata */
-        channel = le16_to_cpu(phy_res->channel);
-        phy_flags = le16_to_cpu(phy_res->phy_flags);
-        rate_n_flags = le32_to_cpu(phy_res->rate_n_flags);
-
-        /* signal statistics */
-        rssi = iwl_calc_rssi(priv, phy_res);
-        tsf_low = le64_to_cpu(phy_res->timestamp) & 0x0ffffffff;
-
-        to_us = !compare_ether_addr(header->addr1, priv->mac_addr);
-
-        /* if data frame is to us and all is good,
-         *   (optionally) print summary for only 1 out of every 100 */
-        if (to_us && (fc & ~cpu_to_le16(IEEE80211_FCTL_PROTECTED)) ==
-            cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FTYPE_DATA)) {
-                dataframe = 1;
-                if (!group100)
-                        print_summary = 1;      /* print each frame */
-                else if (priv->framecnt_to_us < 100) {
-                        priv->framecnt_to_us++;
-                        print_summary = 0;
-                } else {
-                        priv->framecnt_to_us = 0;
-                        print_summary = 1;
-                        hundred = 1;
-                }
-        } else {
-                /* print summary for all other frames */
-                print_summary = 1;
-        }
-
-        if (print_summary) {
-                char *title;
-                int rate_idx;
-                u32 bitrate;
-
-                if (hundred)
-                        title = "100Frames";
-                else if (ieee80211_has_retry(fc))
-                        title = "Retry";
-                else if (ieee80211_is_assoc_resp(fc))
-                        title = "AscRsp";
-                else if (ieee80211_is_reassoc_resp(fc))
-                        title = "RasRsp";
-                else if (ieee80211_is_probe_resp(fc)) {
-                        title = "PrbRsp";
-                        print_dump = 1; /* dump frame contents */
-                } else if (ieee80211_is_beacon(fc)) {
-                        title = "Beacon";
-                        print_dump = 1; /* dump frame contents */
-                } else if (ieee80211_is_atim(fc))
-                        title = "ATIM";
-                else if (ieee80211_is_auth(fc))
-                        title = "Auth";
-                else if (ieee80211_is_deauth(fc))
-                        title = "DeAuth";
-                else if (ieee80211_is_disassoc(fc))
-                        title = "DisAssoc";
-                else
-                        title = "Frame";
-
-                rate_idx = iwl_hwrate_to_plcp_idx(rate_n_flags);
-                if (unlikely((rate_idx < 0) || (rate_idx >= IWL_RATE_COUNT))) {
-                        bitrate = 0;
-                        WARN_ON_ONCE(1);
-                } else {
-                        bitrate = iwl_rates[rate_idx].ieee / 2;
-                }
-
-                /* print frame summary.
-                 * MAC addresses show just the last byte (for brevity),
-                 *    but you can hack it to show more, if you'd like to. */
-                if (dataframe)
-                        IWL_DEBUG_RX(priv, "%s: mhd=0x%04x, dst=0x%02x, "
-                                     "len=%u, rssi=%d, chnl=%d, rate=%u, \n",
-                                     title, le16_to_cpu(fc), header->addr1[5],
-                                     length, rssi, channel, bitrate);
-                else {
-                        /* src/dst addresses assume managed mode */
-                        IWL_DEBUG_RX(priv, "%s: 0x%04x, dst=0x%02x, src=0x%02x, "
-                                     "len=%u, rssi=%d, tim=%lu usec, "
-                                     "phy=0x%02x, chnl=%d\n",
-                                     title, le16_to_cpu(fc), header->addr1[5],
-                                     header->addr3[5], length, rssi,
-                                     tsf_low - priv->scan_start_tsf,
-                                     phy_flags, channel);
-                }
-        }
-        if (print_dump)
-                iwl_print_hex_dump(priv, IWL_DL_RX, header, length);
-}
-#endif
-
 /*
  * returns non-zero if packet should be dropped
  */
@@ -910,305 +537,3 @@ int iwl_set_decrypted_flag(struct iwl_priv *priv,
         return 0;
 }
 EXPORT_SYMBOL(iwl_set_decrypted_flag);
-
-static u32 iwl_translate_rx_status(struct iwl_priv *priv, u32 decrypt_in)
-{
-        u32 decrypt_out = 0;
-
-        if ((decrypt_in & RX_RES_STATUS_STATION_FOUND) ==
-                                        RX_RES_STATUS_STATION_FOUND)
-                decrypt_out |= (RX_RES_STATUS_STATION_FOUND |
-                                RX_RES_STATUS_NO_STATION_INFO_MISMATCH);
-
-        decrypt_out |= (decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK);
-
-        /* packet was not encrypted */
-        if ((decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) ==
-                                        RX_RES_STATUS_SEC_TYPE_NONE)
-                return decrypt_out;
-
-        /* packet was encrypted with unknown alg */
-        if ((decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) ==
-                                        RX_RES_STATUS_SEC_TYPE_ERR)
-                return decrypt_out;
-
-        /* decryption was not done in HW */
-        if ((decrypt_in & RX_MPDU_RES_STATUS_DEC_DONE_MSK) !=
-                                        RX_MPDU_RES_STATUS_DEC_DONE_MSK)
-                return decrypt_out;
-
-        switch (decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) {
-
-        case RX_RES_STATUS_SEC_TYPE_CCMP:
-                /* alg is CCM: check MIC only */
-                if (!(decrypt_in & RX_MPDU_RES_STATUS_MIC_OK))
-                        /* Bad MIC */
-                        decrypt_out |= RX_RES_STATUS_BAD_ICV_MIC;
-                else
-                        decrypt_out |= RX_RES_STATUS_DECRYPT_OK;
-
-                break;
-
-        case RX_RES_STATUS_SEC_TYPE_TKIP:
-                if (!(decrypt_in & RX_MPDU_RES_STATUS_TTAK_OK)) {
-                        /* Bad TTAK */
-                        decrypt_out |= RX_RES_STATUS_BAD_KEY_TTAK;
-                        break;
-                }
-                /* fall through if TTAK OK */
-        default:
-                if (!(decrypt_in & RX_MPDU_RES_STATUS_ICV_OK))
-                        decrypt_out |= RX_RES_STATUS_BAD_ICV_MIC;
-                else
-                        decrypt_out |= RX_RES_STATUS_DECRYPT_OK;
-                break;
-        };
-
-        IWL_DEBUG_RX(priv, "decrypt_in:0x%x  decrypt_out = 0x%x\n",
-                                        decrypt_in, decrypt_out);
-
-        return decrypt_out;
-}
-
-static void iwl_pass_packet_to_mac80211(struct iwl_priv *priv,
-                                        struct ieee80211_hdr *hdr,
-                                        u16 len,
-                                        u32 ampdu_status,
-                                        struct iwl_rx_mem_buffer *rxb,
-                                        struct ieee80211_rx_status *stats)
-{
-        struct sk_buff *skb;
-        int ret = 0;
-        __le16 fc = hdr->frame_control;
-
-        /* We only process data packets if the interface is open */
-        if (unlikely(!priv->is_open)) {
-                IWL_DEBUG_DROP_LIMIT(priv,
-                    "Dropping packet while interface is not open.\n");
-                return;
-        }
-
-        /* In case of HW accelerated crypto and bad decryption, drop */
-        if (!priv->cfg->mod_params->sw_crypto &&
-            iwl_set_decrypted_flag(priv, hdr, ampdu_status, stats))
-                return;
-
-        skb = alloc_skb(IWL_LINK_HDR_MAX * 2, GFP_ATOMIC);
-        if (!skb) {
-                IWL_ERR(priv, "alloc_skb failed\n");
-                return;
-        }
-
-        skb_reserve(skb, IWL_LINK_HDR_MAX);
-        skb_add_rx_frag(skb, 0, rxb->page, (void *)hdr - rxb_addr(rxb), len);
-
-        /* mac80211 currently doesn't support paged SKB. Convert it to
-         * linear SKB for management frame and data frame requires
-         * software decryption or software defragementation. */
-        if (ieee80211_is_mgmt(fc) ||
-            ieee80211_has_protected(fc) ||
-            ieee80211_has_morefrags(fc) ||
-            le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG ||
-            (ieee80211_is_data_qos(fc) &&
-             *ieee80211_get_qos_ctl(hdr) &
-             IEEE80211_QOS_CONTROL_A_MSDU_PRESENT))
-                ret = skb_linearize(skb);
-        else
-                ret = __pskb_pull_tail(skb, min_t(u16, IWL_LINK_HDR_MAX, len)) ?
-                         0 : -ENOMEM;
-
-        if (ret) {
-                kfree_skb(skb);
-                goto out;
-        }
-
-        /*
-         * XXX: We cannot touch the page and its virtual memory (hdr) after
-         * here. It might have already been freed by the above skb change.
-         */
-
-        iwl_update_stats(priv, false, fc, len);
-        memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
-
-        ieee80211_rx(priv->hw, skb);
- out:
-        priv->alloc_rxb_page--;
-        rxb->page = NULL;
-}
-
-/* This is necessary only for a number of statistics, see the caller. */
-static int iwl_is_network_packet(struct iwl_priv *priv,
-                struct ieee80211_hdr *header)
-{
-        /* Filter incoming packets to determine if they are targeted toward
-         * this network, discarding packets coming from ourselves */
-        switch (priv->iw_mode) {
-        case NL80211_IFTYPE_ADHOC: /* Header: Dest. | Source    | BSSID */
-                /* packets to our IBSS update information */
-                return !compare_ether_addr(header->addr3, priv->bssid);
-        case NL80211_IFTYPE_STATION: /* Header: Dest. | AP{BSSID} | Source */
-                /* packets to our IBSS update information */
-                return !compare_ether_addr(header->addr2, priv->bssid);
-        default:
-                return 1;
-        }
-}
-
-/* Called for REPLY_RX (legacy ABG frames), or
- * REPLY_RX_MPDU_CMD (HT high-throughput N frames). */
-void iwl_rx_reply_rx(struct iwl_priv *priv,
-                                struct iwl_rx_mem_buffer *rxb)
-{
-        struct ieee80211_hdr *header;
-        struct ieee80211_rx_status rx_status;
-        struct iwl_rx_packet *pkt = rxb_addr(rxb);
-        struct iwl_rx_phy_res *phy_res;
-        __le32 rx_pkt_status;
-        struct iwl4965_rx_mpdu_res_start *amsdu;
-        u32 len;
-        u32 ampdu_status;
-        u32 rate_n_flags;
-
-        /**
-         * REPLY_RX and REPLY_RX_MPDU_CMD are handled differently.
-         *      REPLY_RX: physical layer info is in this buffer
-         *      REPLY_RX_MPDU_CMD: physical layer info was sent in separate
-         *              command and cached in priv->last_phy_res
-         *
-         * Here we set up local variables depending on which command is
-         * received.
-         */
-        if (pkt->hdr.cmd == REPLY_RX) {
-                phy_res = (struct iwl_rx_phy_res *)pkt->u.raw;
-                header = (struct ieee80211_hdr *)(pkt->u.raw + sizeof(*phy_res)
-                                + phy_res->cfg_phy_cnt);
-
-                len = le16_to_cpu(phy_res->byte_count);
-                rx_pkt_status = *(__le32 *)(pkt->u.raw + sizeof(*phy_res) +
-                                phy_res->cfg_phy_cnt + len);
-                ampdu_status = le32_to_cpu(rx_pkt_status);
-        } else {
-                if (!priv->last_phy_res[0]) {
-                        IWL_ERR(priv, "MPDU frame without cached PHY data\n");
-                        return;
-                }
-                phy_res = (struct iwl_rx_phy_res *)&priv->last_phy_res[1];
-                amsdu = (struct iwl4965_rx_mpdu_res_start *)pkt->u.raw;
-                header = (struct ieee80211_hdr *)(pkt->u.raw + sizeof(*amsdu));
-                len = le16_to_cpu(amsdu->byte_count);
-                rx_pkt_status = *(__le32 *)(pkt->u.raw + sizeof(*amsdu) + len);
-                ampdu_status = iwl_translate_rx_status(priv,
-                                le32_to_cpu(rx_pkt_status));
-        }
-
-        if ((unlikely(phy_res->cfg_phy_cnt > 20))) {
-                IWL_DEBUG_DROP(priv, "dsp size out of range [0,20]: %d/n",
-                                phy_res->cfg_phy_cnt);
-                return;
-        }
-
-        if (!(rx_pkt_status & RX_RES_STATUS_NO_CRC32_ERROR) ||
-            !(rx_pkt_status & RX_RES_STATUS_NO_RXE_OVERFLOW)) {
-                IWL_DEBUG_RX(priv, "Bad CRC or FIFO: 0x%08X.\n",
-                                le32_to_cpu(rx_pkt_status));
-                return;
-        }
-
-        /* This will be used in several places later */
-        rate_n_flags = le32_to_cpu(phy_res->rate_n_flags);
-
-        /* rx_status carries information about the packet to mac80211 */
-        rx_status.mactime = le64_to_cpu(phy_res->timestamp);
-        rx_status.freq =
-                ieee80211_channel_to_frequency(le16_to_cpu(phy_res->channel));
-        rx_status.band = (phy_res->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ?
-                                IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
-        rx_status.rate_idx =
-                iwl_hwrate_to_mac80211_idx(rate_n_flags, rx_status.band);
-        rx_status.flag = 0;
-
-        /* TSF isn't reliable. In order to allow smooth user experience,
-         * this W/A doesn't propagate it to the mac80211 */
-        /*rx_status.flag |= RX_FLAG_TSFT;*/
-
-        priv->ucode_beacon_time = le32_to_cpu(phy_res->beacon_time_stamp);
-
-        /* Find max signal strength (dBm) among 3 antenna/receiver chains */
-        rx_status.signal = iwl_calc_rssi(priv, phy_res);
-
-        /* Meaningful noise values are available only from beacon statistics,
-         *   which are gathered only when associated, and indicate noise
-         *   only for the associated network channel ...
-         * Ignore these noise values while scanning (other channels) */
-        if (iwl_is_associated(priv) &&
-            !test_bit(STATUS_SCANNING, &priv->status)) {
-                rx_status.noise = priv->last_rx_noise;
-        } else {
-                rx_status.noise = IWL_NOISE_MEAS_NOT_AVAILABLE;
-        }
-
-        /* Reset beacon noise level if not associated. */
-        if (!iwl_is_associated(priv))
-                priv->last_rx_noise = IWL_NOISE_MEAS_NOT_AVAILABLE;
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-        /* Set "1" to report good data frames in groups of 100 */
-        if (unlikely(iwl_get_debug_level(priv) & IWL_DL_RX))
-                iwl_dbg_report_frame(priv, phy_res, len, header, 1);
-#endif
-        iwl_dbg_log_rx_data_frame(priv, len, header);
-        IWL_DEBUG_STATS_LIMIT(priv, "Rssi %d, noise %d, TSF %llu\n",
-                rx_status.signal, rx_status.noise,
-                (unsigned long long)rx_status.mactime);
-
-        /*
-         * "antenna number"
-         *
-         * It seems that the antenna field in the phy flags value
-         * is actually a bit field. This is undefined by radiotap,
-         * it wants an actual antenna number but I always get "7"
-         * for most legacy frames I receive indicating that the
-         * same frame was received on all three RX chains.
-         *
-         * I think this field should be removed in favor of a
-         * new 802.11n radiotap field "RX chains" that is defined
-         * as a bitmask.
-         */
-        rx_status.antenna =
-                (le16_to_cpu(phy_res->phy_flags) & RX_RES_PHY_FLAGS_ANTENNA_MSK)
-                >> RX_RES_PHY_FLAGS_ANTENNA_POS;
-
-        /* set the preamble flag if appropriate */
-        if (phy_res->phy_flags & RX_RES_PHY_FLAGS_SHORT_PREAMBLE_MSK)
-                rx_status.flag |= RX_FLAG_SHORTPRE;
-
-        /* Set up the HT phy flags */
-        if (rate_n_flags & RATE_MCS_HT_MSK)
-                rx_status.flag |= RX_FLAG_HT;
-        if (rate_n_flags & RATE_MCS_HT40_MSK)
-                rx_status.flag |= RX_FLAG_40MHZ;
-        if (rate_n_flags & RATE_MCS_SGI_MSK)
-                rx_status.flag |= RX_FLAG_SHORT_GI;
-
-        if (iwl_is_network_packet(priv, header)) {
-                priv->last_rx_rssi = rx_status.signal;
-                priv->last_beacon_time =  priv->ucode_beacon_time;
-                priv->last_tsf = le64_to_cpu(phy_res->timestamp);
-        }
-
-        iwl_pass_packet_to_mac80211(priv, header, len, ampdu_status,
-                                    rxb, &rx_status);
-}
-EXPORT_SYMBOL(iwl_rx_reply_rx);
-
-/* Cache phy data (Rx signal strength, etc) for HT frame (REPLY_RX_PHY_CMD).
- * This will be used later in iwl_rx_reply_rx() for REPLY_RX_MPDU_CMD. */
-void iwl_rx_reply_rx_phy(struct iwl_priv *priv,
-                                    struct iwl_rx_mem_buffer *rxb)
-{
-        struct iwl_rx_packet *pkt = rxb_addr(rxb);
-        priv->last_phy_res[0] = 1;
-        memcpy(&priv->last_phy_res[1], &(pkt->u.raw[0]),
-               sizeof(struct iwl_rx_phy_res));
-}
-EXPORT_SYMBOL(iwl_rx_reply_rx_phy);
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index bd2f7c420563..d817c9c184a5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -453,7 +453,7 @@ static int iwl_get_channels_for_scan(struct iwl_priv *priv,
                 added++;
         }
 
-        IWL_DEBUG_SCAN(priv, "total channels to scan %d \n", added);
+        IWL_DEBUG_SCAN(priv, "total channels to scan %d\n", added);
         return added;
 }
 
@@ -580,7 +580,6 @@ int iwl_internal_short_hw_scan(struct iwl_priv *priv)
 out:
         return ret;
 }
-EXPORT_SYMBOL(iwl_internal_short_hw_scan);
 
 #define IWL_SCAN_CHECK_WATCHDOG (7 * HZ)
 
@@ -665,7 +664,6 @@ static void iwl_bg_request_scan(struct work_struct *data)
         };
         struct iwl_scan_cmd *scan;
         struct ieee80211_conf *conf = NULL;
-        int ret = 0;
         u32 rate_flags = 0;
         u16 cmd_len;
         u16 rx_chain = 0;
@@ -698,7 +696,6 @@ static void iwl_bg_request_scan(struct work_struct *data)
         if (test_bit(STATUS_SCAN_HW, &priv->status)) {
                 IWL_DEBUG_INFO(priv, "Multiple concurrent scan requests in parallel. "
                                "Ignoring second request.\n");
-                ret = -EIO;
                 goto done;
         }
 
@@ -731,7 +728,8 @@ static void iwl_bg_request_scan(struct work_struct *data)
                 priv->scan = kmalloc(sizeof(struct iwl_scan_cmd) +
                                      IWL_MAX_SCAN_SIZE, GFP_KERNEL);
                 if (!priv->scan) {
-                        ret = -ENOMEM;
+                        IWL_DEBUG_SCAN(priv,
+                                       "fail to allocate memory for scan\n");
                         goto done;
                 }
         }
@@ -815,10 +813,11 @@ static void iwl_bg_request_scan(struct work_struct *data)
                  */
                 scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH : 0;
 
-                /* Force use of chains B and C (0x6) for scan Rx for 4965
-                 * Avoid A (0x1) because of its off-channel reception on A-band.
+                /* Force use of chains B and C (0x6) for scan Rx
+                 * Avoid A (0x1) for the device has off-channel reception
+                 * on A-band.
                  */
-                if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_4965)
+                if (priv->cfg->off_channel_workaround)
                         rx_ant = ANT_BC;
         } else {
                 IWL_WARN(priv, "Invalid scan band count\n");
@@ -892,8 +891,7 @@ static void iwl_bg_request_scan(struct work_struct *data)
         scan->len = cpu_to_le16(cmd.len);
 
         set_bit(STATUS_SCAN_HW, &priv->status);
-        ret = iwl_send_cmd_sync(priv, &cmd);
-        if (ret)
+        if (iwl_send_cmd_sync(priv, &cmd))
                 goto done;
 
         queue_delayed_work(priv->workqueue, &priv->scan_check,
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 4a6686fa6b36..e34ac0355c75 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -29,14 +29,12 @@
 
 #include <net/mac80211.h>
 #include <linux/etherdevice.h>
+#include <linux/sched.h>
 
 #include "iwl-dev.h"
 #include "iwl-core.h"
 #include "iwl-sta.h"
 
-#define IWL_STA_DRIVER_ACTIVE BIT(0) /* driver entry is active */
-#define IWL_STA_UCODE_ACTIVE  BIT(1) /* ucode entry is active */
-
 u8 iwl_find_station(struct iwl_priv *priv, const u8 *addr)
 {
         int i;
@@ -64,6 +62,19 @@ u8 iwl_find_station(struct iwl_priv *priv, const u8 *addr)
                               addr, priv->num_stations);
 
  out:
+        /*
+         * It may be possible that more commands interacting with stations
+         * arrive before we completed processing the adding of
+         * station
+         */
+        if (ret != IWL_INVALID_STATION &&
+            (!(priv->stations[ret].used & IWL_STA_UCODE_ACTIVE) ||
+             ((priv->stations[ret].used & IWL_STA_UCODE_ACTIVE) &&
+              (priv->stations[ret].used & IWL_STA_UCODE_INPROGRESS)))) {
+                IWL_ERR(priv, "Requested station info for sta %d before ready.\n",
+                        ret);
+                ret = IWL_INVALID_STATION;
+        }
         spin_unlock_irqrestore(&priv->sta_lock, flags);
         return ret;
 }
@@ -132,7 +143,7 @@ static void iwl_process_add_sta_resp(struct iwl_priv *priv,
                         sta_id);
                 break;
         case ADD_STA_MODIFY_NON_EXIST_STA:
-                IWL_ERR(priv, "Attempting to modify non-existing station %d \n",
+                IWL_ERR(priv, "Attempting to modify non-existing station %d\n",
                         sta_id);
                 break;
         default:
@@ -158,13 +169,6 @@ static void iwl_process_add_sta_resp(struct iwl_priv *priv,
                        priv->stations[sta_id].sta.mode ==
                        STA_CONTROL_MODIFY_MSK ? "Modified" : "Added",
                        addsta->sta.addr);
-
-        /*
-         * Determine if we wanted to modify or add a station,
-         * if adding a station succeeded we have some more initialization
-         * to do when using station notification. TODO
-         */
-
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 }
 
@@ -190,6 +194,10 @@ int iwl_send_add_sta(struct iwl_priv *priv,
                 .flags = flags,
                 .data = data,
         };
+        u8 sta_id = sta->sta.sta_id;
+
+        IWL_DEBUG_INFO(priv, "Adding sta %u (%pM) %ssynchronously\n",
+                       sta_id, sta->sta.addr, flags & CMD_ASYNC ?  "a" : "");
 
         if (flags & CMD_ASYNC)
                 cmd.callback = iwl_add_sta_callback;
@@ -263,18 +271,19 @@ static void iwl_set_ht_add_station(struct iwl_priv *priv, u8 index,
 }
 
 /**
- * iwl_add_station - Add station to tables in driver and device
+ * iwl_prep_station - Prepare station information for addition
+ *
+ * should be called with sta_lock held
  */
-u8 iwl_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap, u8 flags,
-                struct ieee80211_sta_ht_cap *ht_info)
+static u8 iwl_prep_station(struct iwl_priv *priv, const u8 *addr,
+                           bool is_ap,
+                           struct ieee80211_sta_ht_cap *ht_info)
 {
         struct iwl_station_entry *station;
-        unsigned long flags_spin;
         int i;
-        int sta_id = IWL_INVALID_STATION;
+        u8 sta_id = IWL_INVALID_STATION;
         u16 rate;
 
-        spin_lock_irqsave(&priv->sta_lock, flags_spin);
         if (is_ap)
                 sta_id = IWL_AP_ID;
         else if (is_broadcast_ether_addr(addr))
@@ -292,20 +301,32 @@ u8 iwl_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap, u8 flags,
                                 sta_id = i;
                 }
 
-        /* These two conditions have the same outcome, but keep them separate
-           since they have different meanings */
-        if (unlikely(sta_id == IWL_INVALID_STATION)) {
-                spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
+        /*
+         * These two conditions have the same outcome, but keep them
+         * separate
+         */
+        if (unlikely(sta_id == IWL_INVALID_STATION))
+                return sta_id;
+
+        /*
+         * uCode is not able to deal with multiple requests to add a
+         * station. Keep track if one is in progress so that we do not send
+         * another.
+         */
+        if (priv->stations[sta_id].used & IWL_STA_UCODE_INPROGRESS) {
+                IWL_DEBUG_INFO(priv, "STA %d already in process of being added.\n",
+                                sta_id);
                 return sta_id;
         }
 
-        if (priv->stations[sta_id].used &&
+        if ((priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE) &&
+            (priv->stations[sta_id].used & IWL_STA_UCODE_ACTIVE) &&
             !compare_ether_addr(priv->stations[sta_id].sta.sta.addr, addr)) {
-                spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
+                IWL_DEBUG_ASSOC(priv, "STA %d (%pM) already added, not adding again.\n",
+                                sta_id, addr);
                 return sta_id;
         }
 
-
         station = &priv->stations[sta_id];
         station->used = IWL_STA_DRIVER_ACTIVE;
         IWL_DEBUG_ASSOC(priv, "Add STA to driver ID %d: %pM\n",
@@ -330,86 +351,185 @@ u8 iwl_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap, u8 flags,
         /* Turn on both antennas for the station... */
         station->sta.rate_n_flags = cpu_to_le16(rate | RATE_MCS_ANT_AB_MSK);
 
+        return sta_id;
+
+}
+
+#define STA_WAIT_TIMEOUT (HZ/2)
+
+/**
+ * iwl_add_station_common -
+ */
+int iwl_add_station_common(struct iwl_priv *priv, const u8 *addr,
+                                  bool is_ap,
+                                  struct ieee80211_sta_ht_cap *ht_info,
+                                  u8 *sta_id_r)
+{
+        struct iwl_station_entry *station;
+        unsigned long flags_spin;
+        int ret = 0;
+        u8 sta_id;
+
+        *sta_id_r = 0;
+        spin_lock_irqsave(&priv->sta_lock, flags_spin);
+        sta_id = iwl_prep_station(priv, addr, is_ap, ht_info);
+        if (sta_id == IWL_INVALID_STATION) {
+                IWL_ERR(priv, "Unable to prepare station %pM for addition\n",
+                        addr);
+                spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
+                return -EINVAL;
+        }
+
+        /*
+         * uCode is not able to deal with multiple requests to add a
+         * station. Keep track if one is in progress so that we do not send
+         * another.
+         */
+        if (priv->stations[sta_id].used & IWL_STA_UCODE_INPROGRESS) {
+                IWL_DEBUG_INFO(priv, "STA %d already in process of being added.\n",
+                               sta_id);
+                spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
+                return -EEXIST;
+        }
+
+        if ((priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE) &&
+            (priv->stations[sta_id].used & IWL_STA_UCODE_ACTIVE)) {
+                IWL_DEBUG_ASSOC(priv, "STA %d (%pM) already added, not adding again.\n",
+                                sta_id, addr);
+                spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
+                return -EEXIST;
+        }
+
+        priv->stations[sta_id].used |= IWL_STA_UCODE_INPROGRESS;
+        station = &priv->stations[sta_id];
         spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
 
         /* Add station to device's station table */
-        iwl_send_add_sta(priv, &station->sta, flags);
-        return sta_id;
-
+        ret = iwl_send_add_sta(priv, &station->sta, CMD_SYNC);
+        if (ret) {
+                IWL_ERR(priv, "Adding station %pM failed.\n", station->sta.sta.addr);
+                spin_lock_irqsave(&priv->sta_lock, flags_spin);
+                priv->stations[sta_id].used &= ~IWL_STA_DRIVER_ACTIVE;
+                priv->stations[sta_id].used &= ~IWL_STA_UCODE_INPROGRESS;
+                spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
+        }
+        *sta_id_r = sta_id;
+        return ret;
 }
-EXPORT_SYMBOL(iwl_add_station);
+EXPORT_SYMBOL(iwl_add_station_common);
 
-static void iwl_sta_ucode_deactivate(struct iwl_priv *priv, const u8 *addr)
+static void iwl_sta_init_lq(struct iwl_priv *priv, const u8 *addr, bool is_ap)
 {
-        unsigned long flags;
-        u8 sta_id = iwl_find_station(priv, addr);
+        int i, r;
+        struct iwl_link_quality_cmd link_cmd = {
+                .reserved1 = 0,
+        };
+        u32 rate_flags;
 
-        BUG_ON(sta_id == IWL_INVALID_STATION);
+        /* Set up the rate scaling to start at selected rate, fall back
+         * all the way down to 1M in IEEE order, and then spin on 1M */
+        if (is_ap)
+                r = IWL_RATE_54M_INDEX;
+        else if (priv->band == IEEE80211_BAND_5GHZ)
+                r = IWL_RATE_6M_INDEX;
+        else
+                r = IWL_RATE_1M_INDEX;
 
-        IWL_DEBUG_ASSOC(priv, "Removed STA from Ucode: %pM\n", addr);
+        for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++) {
+                rate_flags = 0;
+                if (r >= IWL_FIRST_CCK_RATE && r <= IWL_LAST_CCK_RATE)
+                        rate_flags |= RATE_MCS_CCK_MSK;
 
-        spin_lock_irqsave(&priv->sta_lock, flags);
+                rate_flags |= first_antenna(priv->hw_params.valid_tx_ant) <<
+                                RATE_MCS_ANT_POS;
 
-        /* Ucode must be active and driver must be non active */
-        if (priv->stations[sta_id].used != IWL_STA_UCODE_ACTIVE)
-                IWL_ERR(priv, "removed non active STA %d\n", sta_id);
+                link_cmd.rs_table[i].rate_n_flags =
+                        iwl_hw_set_rate_n_flags(iwl_rates[r].plcp, rate_flags);
+                r = iwl_get_prev_ieee_rate(r);
+        }
 
-        priv->stations[sta_id].used &= ~IWL_STA_UCODE_ACTIVE;
+        link_cmd.general_params.single_stream_ant_msk =
+                                first_antenna(priv->hw_params.valid_tx_ant);
+        link_cmd.general_params.dual_stream_ant_msk = 3;
+        link_cmd.agg_params.agg_dis_start_th = LINK_QUAL_AGG_DISABLE_START_DEF;
+        link_cmd.agg_params.agg_time_limit =
+                cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
 
-        memset(&priv->stations[sta_id], 0, sizeof(struct iwl_station_entry));
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
+        /* Update the rate scaling for control frame Tx to AP */
+        link_cmd.sta_id = is_ap ? IWL_AP_ID : priv->hw_params.bcast_sta_id;
+
+        iwl_send_cmd_pdu(priv, REPLY_TX_LINK_QUALITY_CMD,
+                               sizeof(link_cmd), &link_cmd);
 }
 
-static void iwl_remove_sta_callback(struct iwl_priv *priv,
-                                    struct iwl_device_cmd *cmd,
-                                    struct iwl_rx_packet *pkt)
+/*
+ * iwl_add_local_stations - Add stations not requested by mac80211
+ *
+ * This will be either the broadcast station or the bssid station needed by
+ * ad-hoc.
+ *
+ * Function sleeps.
+ */
+int iwl_add_local_station(struct iwl_priv *priv, const u8 *addr, bool init_rs)
 {
-        struct iwl_rem_sta_cmd *rm_sta =
-                        (struct iwl_rem_sta_cmd *)cmd->cmd.payload;
-        const u8 *addr = rm_sta->addr;
+        int ret;
+        u8 sta_id;
 
-        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
-                IWL_ERR(priv, "Bad return from REPLY_REMOVE_STA (0x%08X)\n",
-                pkt->hdr.flags);
-                return;
+        ret = iwl_add_station_common(priv, addr, 0, NULL, &sta_id);
+        if (ret) {
+                IWL_ERR(priv, "Unable to add station %pM\n", addr);
+                return ret;
         }
 
-        switch (pkt->u.rem_sta.status) {
-        case REM_STA_SUCCESS_MSK:
-                iwl_sta_ucode_deactivate(priv, addr);
-                break;
-        default:
-                IWL_ERR(priv, "REPLY_REMOVE_STA failed\n");
-                break;
-        }
+        if (init_rs)
+                /* Set up default rate scaling table in device's station table */
+                iwl_sta_init_lq(priv, addr, false);
+        return 0;
+}
+EXPORT_SYMBOL(iwl_add_local_station);
+
+/**
+ * iwl_sta_ucode_deactivate - deactivate ucode status for a station
+ *
+ * priv->sta_lock must be held
+ */
+static void iwl_sta_ucode_deactivate(struct iwl_priv *priv, u8 sta_id)
+{
+        /* Ucode must be active and driver must be non active */
+        if (priv->stations[sta_id].used != IWL_STA_UCODE_ACTIVE)
+                IWL_ERR(priv, "removed non active STA %u\n", sta_id);
+
+        priv->stations[sta_id].used &= ~IWL_STA_UCODE_ACTIVE;
+
+        memset(&priv->stations[sta_id], 0, sizeof(struct iwl_station_entry));
+        IWL_DEBUG_ASSOC(priv, "Removed STA %u\n", sta_id);
 }
 
-static int iwl_send_remove_station(struct iwl_priv *priv, const u8 *addr,
-                                   u8 flags)
+static int iwl_send_remove_station(struct iwl_priv *priv,
+                                   struct iwl_station_entry *station)
 {
         struct iwl_rx_packet *pkt;
         int ret;
 
+        unsigned long flags_spin;
         struct iwl_rem_sta_cmd rm_sta_cmd;
 
         struct iwl_host_cmd cmd = {
                 .id = REPLY_REMOVE_STA,
                 .len = sizeof(struct iwl_rem_sta_cmd),
-                .flags = flags,
+                .flags = CMD_SYNC,
                 .data = &rm_sta_cmd,
         };
 
         memset(&rm_sta_cmd, 0, sizeof(rm_sta_cmd));
         rm_sta_cmd.num_sta = 1;
-        memcpy(&rm_sta_cmd.addr, addr , ETH_ALEN);
+        memcpy(&rm_sta_cmd.addr, &station->sta.sta.addr , ETH_ALEN);
+
+        cmd.flags |= CMD_WANT_SKB;
 
-        if (flags & CMD_ASYNC)
-                cmd.callback = iwl_remove_sta_callback;
-        else
-                cmd.flags |= CMD_WANT_SKB;
         ret = iwl_send_cmd(priv, &cmd);
 
-        if (ret || (flags & CMD_ASYNC))
+        if (ret)
                 return ret;
 
         pkt = (struct iwl_rx_packet *)cmd.reply_page;
@@ -422,7 +542,9 @@ static int iwl_send_remove_station(struct iwl_priv *priv, const u8 *addr,
         if (!ret) {
                 switch (pkt->u.rem_sta.status) {
                 case REM_STA_SUCCESS_MSK:
-                        iwl_sta_ucode_deactivate(priv, addr);
+                        spin_lock_irqsave(&priv->sta_lock, flags_spin);
+                        iwl_sta_ucode_deactivate(priv, station->sta.sta.sta_id);
+                        spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
                         IWL_DEBUG_ASSOC(priv, "REPLY_REMOVE_STA PASSED\n");
                         break;
                 default:
@@ -439,23 +561,35 @@ static int iwl_send_remove_station(struct iwl_priv *priv, const u8 *addr,
 /**
  * iwl_remove_station - Remove driver's knowledge of station.
  */
-int iwl_remove_station(struct iwl_priv *priv, const u8 *addr, bool is_ap)
+static int iwl_remove_station(struct iwl_priv *priv, struct ieee80211_sta *sta)
 {
         int sta_id = IWL_INVALID_STATION;
         int i, ret = -EINVAL;
         unsigned long flags;
+        bool is_ap = priv->iw_mode == NL80211_IFTYPE_STATION;
+        struct iwl_station_entry *station;
+
+        if (!iwl_is_ready(priv)) {
+                IWL_DEBUG_INFO(priv,
+                        "Unable to remove station %pM, device not ready.\n",
+                        sta->addr);
+                /*
+                 * It is typical for stations to be removed when we are
+                 * going down. Return success since device will be down
+                 * soon anyway
+                 */
+                return 0;
+        }
 
         spin_lock_irqsave(&priv->sta_lock, flags);
 
         if (is_ap)
                 sta_id = IWL_AP_ID;
-        else if (is_broadcast_ether_addr(addr))
-                sta_id = priv->hw_params.bcast_sta_id;
         else
                 for (i = IWL_STA_ID; i < priv->hw_params.max_stations; i++)
                         if (priv->stations[i].used &&
                             !compare_ether_addr(priv->stations[i].sta.sta.addr,
-                                                addr)) {
+                                                sta->addr)) {
                                 sta_id = i;
                                 break;
                         }
@@ -464,17 +598,17 @@ int iwl_remove_station(struct iwl_priv *priv, const u8 *addr, bool is_ap)
                 goto out;
 
         IWL_DEBUG_ASSOC(priv, "Removing STA from driver:%d  %pM\n",
-                sta_id, addr);
+                sta_id, sta->addr);
 
         if (!(priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE)) {
-                IWL_ERR(priv, "Removing %pM but non DRIVER active\n",
-                                addr);
+                IWL_DEBUG_INFO(priv, "Removing %pM but non DRIVER active\n",
+                                sta->addr);
                 goto out;
         }
 
         if (!(priv->stations[sta_id].used & IWL_STA_UCODE_ACTIVE)) {
-                IWL_ERR(priv, "Removing %pM but non UCODE active\n",
-                                addr);
+                IWL_DEBUG_INFO(priv, "Removing %pM but non UCODE active\n",
+                                sta->addr);
                 goto out;
         }
 
@@ -485,9 +619,10 @@ int iwl_remove_station(struct iwl_priv *priv, const u8 *addr, bool is_ap)
 
         BUG_ON(priv->num_stations < 0);
 
+        station = &priv->stations[sta_id];
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
-        ret = iwl_send_remove_station(priv, addr, CMD_ASYNC);
+        ret = iwl_send_remove_station(priv, station);
         return ret;
 out:
         spin_unlock_irqrestore(&priv->sta_lock, flags);
@@ -495,37 +630,122 @@ out:
 }
 
 /**
- * iwl_clear_stations_table - Clear the driver's station table
- *
- * NOTE:  This does not clear or otherwise alter the device's station table.
+ * iwl_clear_ucode_stations() - clear entire station table driver and/or ucode
+ * @priv:
+ * @force: If set then the uCode station table needs to be cleared here. If
+ *         not set then the uCode station table has already been cleared,
+ *         for example after sending it a RXON command without ASSOC bit
+ *         set, and we just need to change driver state here.
  */
-void iwl_clear_stations_table(struct iwl_priv *priv)
+void iwl_clear_ucode_stations(struct iwl_priv *priv, bool force)
 {
-        unsigned long flags;
         int i;
+        unsigned long flags_spin;
+        bool cleared = false;
+
+        IWL_DEBUG_INFO(priv, "Clearing ucode stations in driver%s\n",
+                        force ? " and ucode" : "");
+
+        if (force) {
+                if (!iwl_is_ready(priv)) {
+                        /*
+                         * If device is not ready at this point the station
+                         * table is likely already empty (uCode not ready
+                         * to receive station requests) or will soon be
+                         * due to interface going down.
+                         */
+                        IWL_DEBUG_INFO(priv, "Unable to remove stations from device - device not ready\n");
+                } else {
+                        iwl_send_cmd_pdu_async(priv, REPLY_REMOVE_ALL_STA, 0, NULL, NULL);
+                }
+        }
 
-        spin_lock_irqsave(&priv->sta_lock, flags);
+        spin_lock_irqsave(&priv->sta_lock, flags_spin);
+        if (force) {
+                IWL_DEBUG_INFO(priv, "Clearing all station information in driver\n");
+                priv->num_stations = 0;
+                memset(priv->stations, 0, sizeof(priv->stations));
+        } else {
+                for (i = 0; i < priv->hw_params.max_stations; i++) {
+                        if (priv->stations[i].used & IWL_STA_UCODE_ACTIVE) {
+                                IWL_DEBUG_INFO(priv, "Clearing ucode active for station %d\n", i);
+                                priv->stations[i].used &= ~IWL_STA_UCODE_ACTIVE;
+                                cleared = true;
+                        }
+                }
+        }
+        spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
 
-        if (iwl_is_alive(priv) &&
-           !test_bit(STATUS_EXIT_PENDING, &priv->status) &&
-           iwl_send_cmd_pdu_async(priv, REPLY_REMOVE_ALL_STA, 0, NULL, NULL))
-                IWL_ERR(priv, "Couldn't clear the station table\n");
+        if (!cleared)
+                IWL_DEBUG_INFO(priv, "No active stations found to be cleared\n");
+}
+EXPORT_SYMBOL(iwl_clear_ucode_stations);
+
+/**
+ * iwl_restore_stations() - Restore driver known stations to device
+ *
+ * All stations considered active by driver, but not present in ucode, is
+ * restored.
+ *
+ * Function sleeps.
+ */
+void iwl_restore_stations(struct iwl_priv *priv)
+{
+        struct iwl_station_entry *station;
+        unsigned long flags_spin;
+        int i;
+        bool found = false;
+        int ret;
 
-        priv->num_stations = 0;
-        memset(priv->stations, 0, sizeof(priv->stations));
+        if (!iwl_is_ready(priv)) {
+                IWL_DEBUG_INFO(priv, "Not ready yet, not restoring any stations.\n");
+                return;
+        }
 
-        /* clean ucode key table bit map */
-        priv->ucode_key_table = 0;
+        IWL_DEBUG_ASSOC(priv, "Restoring all known stations ... start.\n");
+        spin_lock_irqsave(&priv->sta_lock, flags_spin);
+        for (i = 0; i < priv->hw_params.max_stations; i++) {
+                if ((priv->stations[i].used & IWL_STA_DRIVER_ACTIVE) &&
+                            !(priv->stations[i].used & IWL_STA_UCODE_ACTIVE)) {
+                        IWL_DEBUG_ASSOC(priv, "Restoring sta %pM\n",
+                                        priv->stations[i].sta.sta.addr);
+                        priv->stations[i].sta.mode = 0;
+                        priv->stations[i].used |= IWL_STA_UCODE_INPROGRESS;
+                        found = true;
+                }
+        }
 
-        /* keep track of static keys */
-        for (i = 0; i < WEP_KEYS_MAX ; i++) {
-                if (priv->wep_keys[i].key_size)
-                        set_bit(i, &priv->ucode_key_table);
+        for (i = 0; i < priv->hw_params.max_stations; i++) {
+                if ((priv->stations[i].used & IWL_STA_UCODE_INPROGRESS)) {
+                        spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
+                        station = &priv->stations[i];
+                        ret = iwl_send_add_sta(priv, &priv->stations[i].sta, CMD_SYNC);
+                        if (ret) {
+                                IWL_ERR(priv, "Adding station %pM failed.\n",
+                                        station->sta.sta.addr);
+                                spin_lock_irqsave(&priv->sta_lock, flags_spin);
+                                priv->stations[i].used &= ~IWL_STA_DRIVER_ACTIVE;
+                                priv->stations[i].used &= ~IWL_STA_UCODE_INPROGRESS;
+                                spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
+                        }
+                        /*
+                         * Rate scaling has already been initialized, send
+                         * current LQ command
+                         */
+                        if (station->lq)
+                                iwl_send_lq_cmd(priv, station->lq, CMD_SYNC, true);
+                        spin_lock_irqsave(&priv->sta_lock, flags_spin);
+                        priv->stations[i].used &= ~IWL_STA_UCODE_INPROGRESS;
+                }
         }
 
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
+        spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
+        if (!found)
+                IWL_DEBUG_INFO(priv, "Restoring all known stations .... no stations to be restored.\n");
+        else
+                IWL_DEBUG_INFO(priv, "Restoring all known stations .... complete.\n");
 }
-EXPORT_SYMBOL(iwl_clear_stations_table);
+EXPORT_SYMBOL(iwl_restore_stations);
 
 int iwl_get_free_ucode_key_index(struct iwl_priv *priv)
 {
@@ -549,9 +769,11 @@ int iwl_send_static_wepkey_cmd(struct iwl_priv *priv, u8 send_if_empty)
         struct iwl_host_cmd cmd = {
                 .id = REPLY_WEPKEY,
                 .data = wep_cmd,
-                .flags = CMD_ASYNC,
+                .flags = CMD_SYNC,
         };
 
+        might_sleep();
+
         memset(wep_cmd, 0, cmd_size +
                         (sizeof(struct iwl_wep_key) * WEP_KEYS_MAX));
 
@@ -587,9 +809,9 @@ int iwl_remove_default_wep_key(struct iwl_priv *priv,
                                struct ieee80211_key_conf *keyconf)
 {
         int ret;
-        unsigned long flags;
 
-        spin_lock_irqsave(&priv->sta_lock, flags);
+        WARN_ON(!mutex_is_locked(&priv->mutex));
+
         IWL_DEBUG_WEP(priv, "Removing default WEP key: idx=%d\n",
                       keyconf->keyidx);
 
@@ -601,13 +823,12 @@ int iwl_remove_default_wep_key(struct iwl_priv *priv,
         memset(&priv->wep_keys[keyconf->keyidx], 0, sizeof(priv->wep_keys[0]));
         if (iwl_is_rfkill(priv)) {
                 IWL_DEBUG_WEP(priv, "Not sending REPLY_WEPKEY command due to RFKILL.\n");
-                spin_unlock_irqrestore(&priv->sta_lock, flags);
+                /* but keys in device are clear anyway so return success */
                 return 0;
         }
         ret = iwl_send_static_wepkey_cmd(priv, 1);
         IWL_DEBUG_WEP(priv, "Remove default WEP key: idx=%d ret=%d\n",
                       keyconf->keyidx, ret);
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
 
         return ret;
 }
@@ -617,7 +838,8 @@ int iwl_set_default_wep_key(struct iwl_priv *priv,
                             struct ieee80211_key_conf *keyconf)
 {
         int ret;
-        unsigned long flags;
+
+        WARN_ON(!mutex_is_locked(&priv->mutex));
 
         if (keyconf->keylen != WEP_KEY_LEN_128 &&
             keyconf->keylen != WEP_KEY_LEN_64) {
@@ -629,12 +851,11 @@ int iwl_set_default_wep_key(struct iwl_priv *priv,
         keyconf->hw_key_idx = HW_KEY_DEFAULT;
         priv->stations[IWL_AP_ID].keyinfo.alg = ALG_WEP;
 
-        spin_lock_irqsave(&priv->sta_lock, flags);
         priv->default_wep_key++;
 
         if (test_and_set_bit(keyconf->keyidx, &priv->ucode_key_table))
                 IWL_ERR(priv, "index %d already used in uCode key table.\n",
-                        keyconf->keyidx);
+                          keyconf->keyidx);
 
         priv->wep_keys[keyconf->keyidx].key_size = keyconf->keylen;
         memcpy(&priv->wep_keys[keyconf->keyidx].key, &keyconf->key,
@@ -643,7 +864,6 @@ int iwl_set_default_wep_key(struct iwl_priv *priv,
         ret = iwl_send_static_wepkey_cmd(priv, 0);
         IWL_DEBUG_WEP(priv, "Set default WEP key: len=%d idx=%d ret=%d\n",
                 keyconf->keylen, keyconf->keyidx, ret);
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
 
         return ret;
 }
@@ -885,7 +1105,7 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
         priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
 
         if (iwl_is_rfkill(priv)) {
-                IWL_DEBUG_WEP(priv, "Not sending REPLY_ADD_STA command because RFKILL enabled. \n");
+                IWL_DEBUG_WEP(priv, "Not sending REPLY_ADD_STA command because RFKILL enabled.\n");
                 spin_unlock_irqrestore(&priv->sta_lock, flags);
                 return 0;
         }
@@ -948,9 +1168,22 @@ static inline void iwl_dump_lq_cmd(struct iwl_priv *priv,
 }
 #endif
 
+/**
+ * iwl_send_lq_cmd() - Send link quality command
+ * @init: This command is sent as part of station initialization right
+ *        after station has been added.
+ *
+ * The link quality command is sent as the last step of station creation.
+ * This is the special case in which init is set and we call a callback in
+ * this case to clear the state indicating that station creation is in
+ * progress.
+ */
 int iwl_send_lq_cmd(struct iwl_priv *priv,
-                    struct iwl_link_quality_cmd *lq, u8 flags)
+                    struct iwl_link_quality_cmd *lq, u8 flags, bool init)
 {
+        int ret = 0;
+        unsigned long flags_spin;
+
         struct iwl_host_cmd cmd = {
                 .id = REPLY_TX_LINK_QUALITY_CMD,
                 .len = sizeof(struct iwl_link_quality_cmd),
@@ -966,167 +1199,31 @@ int iwl_send_lq_cmd(struct iwl_priv *priv,
                 lq->sta_id = IWL_AP_ID;
 
         iwl_dump_lq_cmd(priv, lq);
+        BUG_ON(init && (cmd.flags & CMD_ASYNC));
 
-        if (iwl_is_associated(priv) && priv->assoc_station_added)
-                return  iwl_send_cmd(priv, &cmd);
+        iwl_dump_lq_cmd(priv, lq);
+        ret = iwl_send_cmd(priv, &cmd);
+        if (ret || (cmd.flags & CMD_ASYNC))
+                return ret;
 
+        if (init) {
+                IWL_DEBUG_INFO(priv, "init LQ command complete, clearing sta addition status for sta %d\n",
+                               lq->sta_id);
+                spin_lock_irqsave(&priv->sta_lock, flags_spin);
+                priv->stations[lq->sta_id].used &= ~IWL_STA_UCODE_INPROGRESS;
+                spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
+        }
         return 0;
 }
 EXPORT_SYMBOL(iwl_send_lq_cmd);
 
 /**
- * iwl_sta_init_lq - Initialize a station's hardware rate table
- *
- * The uCode's station table contains a table of fallback rates
- * for automatic fallback during transmission.
- *
- * NOTE: This sets up a default set of values.  These will be replaced later
- *       if the driver's iwl-agn-rs rate scaling algorithm is used, instead of
- *       rc80211_simple.
- *
- * NOTE: Run REPLY_ADD_STA command to set up station table entry, before
- *       calling this function (which runs REPLY_TX_LINK_QUALITY_CMD,
- *       which requires station table entry to exist).
- */
-static void iwl_sta_init_lq(struct iwl_priv *priv, const u8 *addr, bool is_ap)
-{
-        int i, r;
-        struct iwl_link_quality_cmd link_cmd = {
-                .reserved1 = 0,
-        };
-        u32 rate_flags;
-
-        /* Set up the rate scaling to start at selected rate, fall back
-         * all the way down to 1M in IEEE order, and then spin on 1M */
-        if (is_ap)
-                r = IWL_RATE_54M_INDEX;
-        else if (priv->band == IEEE80211_BAND_5GHZ)
-                r = IWL_RATE_6M_INDEX;
-        else
-                r = IWL_RATE_1M_INDEX;
-
-        for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++) {
-                rate_flags = 0;
-                if (r >= IWL_FIRST_CCK_RATE && r <= IWL_LAST_CCK_RATE)
-                        rate_flags |= RATE_MCS_CCK_MSK;
-
-                rate_flags |= first_antenna(priv->hw_params.valid_tx_ant) <<
-                                RATE_MCS_ANT_POS;
-
-                link_cmd.rs_table[i].rate_n_flags =
-                        iwl_hw_set_rate_n_flags(iwl_rates[r].plcp, rate_flags);
-                r = iwl_get_prev_ieee_rate(r);
-        }
-
-        link_cmd.general_params.single_stream_ant_msk =
-                                first_antenna(priv->hw_params.valid_tx_ant);
-        link_cmd.general_params.dual_stream_ant_msk = 3;
-        link_cmd.agg_params.agg_dis_start_th = LINK_QUAL_AGG_DISABLE_START_DEF;
-        link_cmd.agg_params.agg_time_limit =
-                cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
-
-        /* Update the rate scaling for control frame Tx to AP */
-        link_cmd.sta_id = is_ap ? IWL_AP_ID : priv->hw_params.bcast_sta_id;
-
-        iwl_send_cmd_pdu_async(priv, REPLY_TX_LINK_QUALITY_CMD,
-                               sizeof(link_cmd), &link_cmd, NULL);
-}
-
-/**
- * iwl_rxon_add_station - add station into station table.
- *
- * there is only one AP station with id= IWL_AP_ID
- * NOTE: mutex must be held before calling this function
- */
-int iwl_rxon_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap)
-{
-        struct ieee80211_sta *sta;
-        struct ieee80211_sta_ht_cap ht_config;
-        struct ieee80211_sta_ht_cap *cur_ht_config = NULL;
-        u8 sta_id;
-
-        /*
-         * Set HT capabilities. It is ok to set this struct even if not using
-         * HT config: the priv->current_ht_config.is_ht flag will just be false
-         */
-        rcu_read_lock();
-        sta = ieee80211_find_sta(priv->vif, addr);
-        if (sta) {
-                memcpy(&ht_config, &sta->ht_cap, sizeof(ht_config));
-                cur_ht_config = &ht_config;
-        }
-        rcu_read_unlock();
-
-        /* Add station to device's station table */
-        sta_id = iwl_add_station(priv, addr, is_ap, CMD_SYNC, cur_ht_config);
-
-        /* Set up default rate scaling table in device's station table */
-        iwl_sta_init_lq(priv, addr, is_ap);
-
-        return sta_id;
-}
-EXPORT_SYMBOL(iwl_rxon_add_station);
-
-/**
- * iwl_sta_init_bcast_lq - Initialize a bcast station's hardware rate table
- *
- * NOTE: Run REPLY_ADD_STA command to set up station table entry, before
- *       calling this function (which runs REPLY_TX_LINK_QUALITY_CMD,
- *       which requires station table entry to exist).
- */
-static void iwl_sta_init_bcast_lq(struct iwl_priv *priv)
-{
-        int i, r;
-        struct iwl_link_quality_cmd link_cmd = {
-                .reserved1 = 0,
-        };
-        u32 rate_flags;
-
-        /* Set up the rate scaling to start at selected rate, fall back
-         * all the way down to 1M in IEEE order, and then spin on 1M */
-        if (priv->band == IEEE80211_BAND_5GHZ)
-                r = IWL_RATE_6M_INDEX;
-        else
-                r = IWL_RATE_1M_INDEX;
-
-        for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++) {
-                rate_flags = 0;
-                if (r >= IWL_FIRST_CCK_RATE && r <= IWL_LAST_CCK_RATE)
-                        rate_flags |= RATE_MCS_CCK_MSK;
-
-                rate_flags |= first_antenna(priv->hw_params.valid_tx_ant) <<
-                                RATE_MCS_ANT_POS;
-
-                link_cmd.rs_table[i].rate_n_flags =
-                        iwl_hw_set_rate_n_flags(iwl_rates[r].plcp, rate_flags);
-                r = iwl_get_prev_ieee_rate(r);
-        }
-
-        link_cmd.general_params.single_stream_ant_msk =
-                                first_antenna(priv->hw_params.valid_tx_ant);
-        link_cmd.general_params.dual_stream_ant_msk = 3;
-        link_cmd.agg_params.agg_dis_start_th = LINK_QUAL_AGG_DISABLE_START_DEF;
-        link_cmd.agg_params.agg_time_limit =
-                cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
-
-        /* Update the rate scaling for control frame Tx to AP */
-        link_cmd.sta_id = priv->hw_params.bcast_sta_id;
-
-        iwl_send_cmd_pdu_async(priv, REPLY_TX_LINK_QUALITY_CMD,
-                               sizeof(link_cmd), &link_cmd, NULL);
-}
-
-
-/**
  * iwl_add_bcast_station - add broadcast station into station table.
  */
 void iwl_add_bcast_station(struct iwl_priv *priv)
 {
         IWL_DEBUG_INFO(priv, "Adding broadcast station to station table\n");
-        iwl_add_station(priv, iwl_bcast_addr, false, CMD_SYNC, NULL);
-
-        /* Set up default rate scaling table in device's station table */
-        iwl_sta_init_bcast_lq(priv);
+        iwl_add_local_station(priv, iwl_bcast_addr, true);
 }
 EXPORT_SYMBOL(iwl_add_bcast_station);
 
@@ -1136,7 +1233,14 @@ EXPORT_SYMBOL(iwl_add_bcast_station);
 void iwl3945_add_bcast_station(struct iwl_priv *priv)
 {
         IWL_DEBUG_INFO(priv, "Adding broadcast station to station table\n");
-        iwl_add_station(priv, iwl_bcast_addr, false, CMD_SYNC, NULL);
+        iwl_add_local_station(priv, iwl_bcast_addr, false);
+        /*
+         * It is assumed that when station is added more initialization
+         * needs to be done, but for 3945 it is not the case and we can
+         * just release station table access right here.
+         */
+        priv->stations[priv->hw_params.bcast_sta_id].used &= ~IWL_STA_UCODE_INPROGRESS;
+
 }
 EXPORT_SYMBOL(iwl3945_add_bcast_station);
 
@@ -1159,6 +1263,13 @@ int iwl_get_sta_id(struct iwl_priv *priv, struct ieee80211_hdr *hdr)
         /* If we are a client station in a BSS network, use the special
          * AP station entry (that's the only station we communicate with) */
         case NL80211_IFTYPE_STATION:
+                /*
+                 * If addition of station not complete yet, which means
+                 * that rate scaling has not been initialized, then return
+                 * the broadcast station.
+                 */
+                if (!(priv->stations[IWL_AP_ID].used & IWL_STA_UCODE_ACTIVE))
+                        return priv->hw_params.bcast_sta_id;
                 return IWL_AP_ID;
 
         /* If we are an AP, then find the station, or use BCAST */
@@ -1175,13 +1286,6 @@ int iwl_get_sta_id(struct iwl_priv *priv, struct ieee80211_hdr *hdr)
                 if (sta_id != IWL_INVALID_STATION)
                         return sta_id;
 
-                /* Create new station table entry */
-                sta_id = iwl_add_station(priv, hdr->addr1, false,
-                                        CMD_ASYNC, NULL);
-
-                if (sta_id != IWL_INVALID_STATION)
-                        return sta_id;
-
                 IWL_DEBUG_DROP(priv, "Station %pM not in station map. "
                                "Defaulting to broadcast...\n",
                                hdr->addr1);
@@ -1291,3 +1395,20 @@ void iwl_sta_modify_sleep_tx_count(struct iwl_priv *priv, int sta_id, int cnt)
 
         iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
 }
+EXPORT_SYMBOL(iwl_sta_modify_sleep_tx_count);
+
+int iwl_mac_sta_remove(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               struct ieee80211_sta *sta)
+{
+        int ret;
+        struct iwl_priv *priv = hw->priv;
+        IWL_DEBUG_INFO(priv, "received request to remove station %pM\n",
+                        sta->addr);
+        ret = iwl_remove_station(priv, sta);
+        if (ret)
+                IWL_ERR(priv, "Error removing station %pM\n",
+                        sta->addr);
+        return ret;
+}
+EXPORT_SYMBOL(iwl_mac_sta_remove);
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.h b/drivers/net/wireless/iwlwifi/iwl-sta.h
index 2dc35fe28f56..87a34997a758 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.h
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.h
@@ -32,6 +32,12 @@
 #define HW_KEY_DYNAMIC 0
 #define HW_KEY_DEFAULT 1
 
+#define IWL_STA_DRIVER_ACTIVE BIT(0) /* driver entry is active */
+#define IWL_STA_UCODE_ACTIVE  BIT(1) /* ucode entry is active */
+#define IWL_STA_UCODE_INPROGRESS  BIT(2) /* ucode entry is in process of
+                                            being activated */
+
+
 /**
  * iwl_find_station - Find station id for a given BSSID
  * @bssid: MAC address of station ID to find
@@ -51,18 +57,22 @@ void iwl_update_tkip_key(struct iwl_priv *priv,
                         struct ieee80211_key_conf *keyconf,
                         const u8 *addr, u32 iv32, u16 *phase1key);
 
-int iwl_rxon_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap);
 void iwl_add_bcast_station(struct iwl_priv *priv);
 void iwl3945_add_bcast_station(struct iwl_priv *priv);
-int iwl_remove_station(struct iwl_priv *priv, const u8 *addr, bool is_ap);
-void iwl_clear_stations_table(struct iwl_priv *priv);
+void iwl_restore_stations(struct iwl_priv *priv);
+void iwl_clear_ucode_stations(struct iwl_priv *priv, bool force);
 int iwl_get_free_ucode_key_index(struct iwl_priv *priv);
 int iwl_get_sta_id(struct iwl_priv *priv, struct ieee80211_hdr *hdr);
 int iwl_get_ra_sta_id(struct iwl_priv *priv, struct ieee80211_hdr *hdr);
 int iwl_send_add_sta(struct iwl_priv *priv,
                      struct iwl_addsta_cmd *sta, u8 flags);
-u8 iwl_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap, u8 flags,
-                        struct ieee80211_sta_ht_cap *ht_info);
+int iwl_add_local_station(struct iwl_priv *priv, const u8 *addr, bool init_rs);
+int iwl_add_station_common(struct iwl_priv *priv, const u8 *addr,
+                                  bool is_ap,
+                                  struct ieee80211_sta_ht_cap *ht_info,
+                                  u8 *sta_id_r);
+int iwl_mac_sta_remove(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                       struct ieee80211_sta *sta);
 void iwl_sta_tx_modify_enable_tid(struct iwl_priv *priv, int sta_id, int tid);
 int iwl_sta_rx_agg_start(struct iwl_priv *priv,
                          const u8 *addr, int tid, u16 ssn);
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 343d81ad2653..a631afef5e33 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -37,47 +37,6 @@
 #include "iwl-io.h"
 #include "iwl-helpers.h"
 
-static const u16 default_tid_to_tx_fifo[] = {
-        IWL_TX_FIFO_AC1,
-        IWL_TX_FIFO_AC0,
-        IWL_TX_FIFO_AC0,
-        IWL_TX_FIFO_AC1,
-        IWL_TX_FIFO_AC2,
-        IWL_TX_FIFO_AC2,
-        IWL_TX_FIFO_AC3,
-        IWL_TX_FIFO_AC3,
-        IWL_TX_FIFO_NONE,
-        IWL_TX_FIFO_NONE,
-        IWL_TX_FIFO_NONE,
-        IWL_TX_FIFO_NONE,
-        IWL_TX_FIFO_NONE,
-        IWL_TX_FIFO_NONE,
-        IWL_TX_FIFO_NONE,
-        IWL_TX_FIFO_NONE,
-        IWL_TX_FIFO_AC3
-};
-
-static inline int iwl_alloc_dma_ptr(struct iwl_priv *priv,
-                                    struct iwl_dma_ptr *ptr, size_t size)
-{
-        ptr->addr = dma_alloc_coherent(&priv->pci_dev->dev, size, &ptr->dma,
-                                       GFP_KERNEL);
-        if (!ptr->addr)
-                return -ENOMEM;
-        ptr->size = size;
-        return 0;
-}
-
-static inline void iwl_free_dma_ptr(struct iwl_priv *priv,
-                                    struct iwl_dma_ptr *ptr)
-{
-        if (unlikely(!ptr->addr))
-                return;
-
-        dma_free_coherent(&priv->pci_dev->dev, ptr->size, ptr->addr, ptr->dma);
-        memset(ptr, 0, sizeof(*ptr));
-}
-
 /**
  * iwl_txq_update_write_ptr - Send new write index to hardware
  */
@@ -309,6 +268,8 @@ static int iwl_queue_init(struct iwl_priv *priv, struct iwl_queue *q,
                 q->high_mark = 2;
 
         q->write_ptr = q->read_ptr = 0;
+        q->last_read_ptr = 0;
+        q->repeat_same_read_ptr = 0;
 
         return 0;
 }
@@ -433,631 +394,6 @@ out_free_arrays:
 }
 EXPORT_SYMBOL(iwl_tx_queue_init);
 
-void iwl_tx_queue_reset(struct iwl_priv *priv, struct iwl_tx_queue *txq,
-                        int slots_num, u32 txq_id)
-{
-        int actual_slots = slots_num;
-
-        if (txq_id == IWL_CMD_QUEUE_NUM)
-                actual_slots++;
-
-        memset(txq->meta, 0, sizeof(struct iwl_cmd_meta) * actual_slots);
-
-        txq->need_update = 0;
-
-        /* Initialize queue's high/low-water marks, and head/tail indexes */
-        iwl_queue_init(priv, &txq->q, TFD_QUEUE_SIZE_MAX, slots_num, txq_id);
-
-        /* Tell device where to find queue */
-        priv->cfg->ops->lib->txq_init(priv, txq);
-}
-EXPORT_SYMBOL(iwl_tx_queue_reset);
-
-/**
- * iwl_hw_txq_ctx_free - Free TXQ Context
- *
- * Destroy all TX DMA queues and structures
- */
-void iwl_hw_txq_ctx_free(struct iwl_priv *priv)
-{
-        int txq_id;
-
-        /* Tx queues */
-        if (priv->txq) {
-                for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++)
-                        if (txq_id == IWL_CMD_QUEUE_NUM)
-                                iwl_cmd_queue_free(priv);
-                        else
-                                iwl_tx_queue_free(priv, txq_id);
-        }
-        iwl_free_dma_ptr(priv, &priv->kw);
-
-        iwl_free_dma_ptr(priv, &priv->scd_bc_tbls);
-
-        /* free tx queue structure */
-        iwl_free_txq_mem(priv);
-}
-EXPORT_SYMBOL(iwl_hw_txq_ctx_free);
-
-/**
- * iwl_txq_ctx_alloc - allocate TX queue context
- * Allocate all Tx DMA structures and initialize them
- *
- * @param priv
- * @return error code
- */
-int iwl_txq_ctx_alloc(struct iwl_priv *priv)
-{
-        int ret;
-        int txq_id, slots_num;
-        unsigned long flags;
-
-        /* Free all tx/cmd queues and keep-warm buffer */
-        iwl_hw_txq_ctx_free(priv);
-
-        ret = iwl_alloc_dma_ptr(priv, &priv->scd_bc_tbls,
-                                priv->hw_params.scd_bc_tbls_size);
-        if (ret) {
-                IWL_ERR(priv, "Scheduler BC Table allocation failed\n");
-                goto error_bc_tbls;
-        }
-        /* Alloc keep-warm buffer */
-        ret = iwl_alloc_dma_ptr(priv, &priv->kw, IWL_KW_SIZE);
-        if (ret) {
-                IWL_ERR(priv, "Keep Warm allocation failed\n");
-                goto error_kw;
-        }
-
-        /* allocate tx queue structure */
-        ret = iwl_alloc_txq_mem(priv);
-        if (ret)
-                goto error;
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        /* Turn off all Tx DMA fifos */
-        priv->cfg->ops->lib->txq_set_sched(priv, 0);
-
-        /* Tell NIC where to find the "keep warm" buffer */
-        iwl_write_direct32(priv, FH_KW_MEM_ADDR_REG, priv->kw.dma >> 4);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        /* Alloc and init all Tx queues, including the command queue (#4) */
-        for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++) {
-                slots_num = (txq_id == IWL_CMD_QUEUE_NUM) ?
-                                        TFD_CMD_SLOTS : TFD_TX_CMD_SLOTS;
-                ret = iwl_tx_queue_init(priv, &priv->txq[txq_id], slots_num,
-                                       txq_id);
-                if (ret) {
-                        IWL_ERR(priv, "Tx %d queue init failed\n", txq_id);
-                        goto error;
-                }
-        }
-
-        return ret;
-
- error:
-        iwl_hw_txq_ctx_free(priv);
-        iwl_free_dma_ptr(priv, &priv->kw);
- error_kw:
-        iwl_free_dma_ptr(priv, &priv->scd_bc_tbls);
- error_bc_tbls:
-        return ret;
-}
-
-void iwl_txq_ctx_reset(struct iwl_priv *priv)
-{
-        int txq_id, slots_num;
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        /* Turn off all Tx DMA fifos */
-        priv->cfg->ops->lib->txq_set_sched(priv, 0);
-
-        /* Tell NIC where to find the "keep warm" buffer */
-        iwl_write_direct32(priv, FH_KW_MEM_ADDR_REG, priv->kw.dma >> 4);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        /* Alloc and init all Tx queues, including the command queue (#4) */
-        for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++) {
-                slots_num = txq_id == IWL_CMD_QUEUE_NUM ?
-                            TFD_CMD_SLOTS : TFD_TX_CMD_SLOTS;
-                iwl_tx_queue_reset(priv, &priv->txq[txq_id], slots_num, txq_id);
-        }
-}
-
-/**
- * iwl_txq_ctx_stop - Stop all Tx DMA channels
- */
-void iwl_txq_ctx_stop(struct iwl_priv *priv)
-{
-        int ch;
-        unsigned long flags;
-
-        /* Turn off all Tx DMA fifos */
-        spin_lock_irqsave(&priv->lock, flags);
-
-        priv->cfg->ops->lib->txq_set_sched(priv, 0);
-
-        /* Stop each Tx DMA channel, and wait for it to be idle */
-        for (ch = 0; ch < priv->hw_params.dma_chnl_num; ch++) {
-                iwl_write_direct32(priv, FH_TCSR_CHNL_TX_CONFIG_REG(ch), 0x0);
-                iwl_poll_direct_bit(priv, FH_TSSR_TX_STATUS_REG,
-                                    FH_TSSR_TX_STATUS_REG_MSK_CHNL_IDLE(ch),
-                                    1000);
-        }
-        spin_unlock_irqrestore(&priv->lock, flags);
-}
-EXPORT_SYMBOL(iwl_txq_ctx_stop);
-
-/*
- * handle build REPLY_TX command notification.
- */
-static void iwl_tx_cmd_build_basic(struct iwl_priv *priv,
-                                  struct iwl_tx_cmd *tx_cmd,
-                                  struct ieee80211_tx_info *info,
-                                  struct ieee80211_hdr *hdr,
-                                  u8 std_id)
-{
-        __le16 fc = hdr->frame_control;
-        __le32 tx_flags = tx_cmd->tx_flags;
-
-        tx_cmd->stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
-        if (!(info->flags & IEEE80211_TX_CTL_NO_ACK)) {
-                tx_flags |= TX_CMD_FLG_ACK_MSK;
-                if (ieee80211_is_mgmt(fc))
-                        tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
-                if (ieee80211_is_probe_resp(fc) &&
-                    !(le16_to_cpu(hdr->seq_ctrl) & 0xf))
-                        tx_flags |= TX_CMD_FLG_TSF_MSK;
-        } else {
-                tx_flags &= (~TX_CMD_FLG_ACK_MSK);
-                tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
-        }
-
-        if (ieee80211_is_back_req(fc))
-                tx_flags |= TX_CMD_FLG_ACK_MSK | TX_CMD_FLG_IMM_BA_RSP_MASK;
-
-
-        tx_cmd->sta_id = std_id;
-        if (ieee80211_has_morefrags(fc))
-                tx_flags |= TX_CMD_FLG_MORE_FRAG_MSK;
-
-        if (ieee80211_is_data_qos(fc)) {
-                u8 *qc = ieee80211_get_qos_ctl(hdr);
-                tx_cmd->tid_tspec = qc[0] & 0xf;
-                tx_flags &= ~TX_CMD_FLG_SEQ_CTL_MSK;
-        } else {
-                tx_flags |= TX_CMD_FLG_SEQ_CTL_MSK;
-        }
-
-        priv->cfg->ops->utils->rts_tx_cmd_flag(info, &tx_flags);
-
-        if ((tx_flags & TX_CMD_FLG_RTS_MSK) || (tx_flags & TX_CMD_FLG_CTS_MSK))
-                tx_flags |= TX_CMD_FLG_FULL_TXOP_PROT_MSK;
-
-        tx_flags &= ~(TX_CMD_FLG_ANT_SEL_MSK);
-        if (ieee80211_is_mgmt(fc)) {
-                if (ieee80211_is_assoc_req(fc) || ieee80211_is_reassoc_req(fc))
-                        tx_cmd->timeout.pm_frame_timeout = cpu_to_le16(3);
-                else
-                        tx_cmd->timeout.pm_frame_timeout = cpu_to_le16(2);
-        } else {
-                tx_cmd->timeout.pm_frame_timeout = 0;
-        }
-
-        tx_cmd->driver_txop = 0;
-        tx_cmd->tx_flags = tx_flags;
-        tx_cmd->next_frame_len = 0;
-}
-
-#define RTS_HCCA_RETRY_LIMIT            3
-#define RTS_DFAULT_RETRY_LIMIT          60
-
-static void iwl_tx_cmd_build_rate(struct iwl_priv *priv,
-                              struct iwl_tx_cmd *tx_cmd,
-                              struct ieee80211_tx_info *info,
-                              __le16 fc, int is_hcca)
-{
-        u32 rate_flags;
-        int rate_idx;
-        u8 rts_retry_limit;
-        u8 data_retry_limit;
-        u8 rate_plcp;
-
-        /* Set retry limit on DATA packets and Probe Responses*/
-        if (ieee80211_is_probe_resp(fc))
-                data_retry_limit = 3;
-        else
-                data_retry_limit = IWL_DEFAULT_TX_RETRY;
-        tx_cmd->data_retry_limit = data_retry_limit;
-
-        /* Set retry limit on RTS packets */
-        rts_retry_limit = (is_hcca) ?  RTS_HCCA_RETRY_LIMIT :
-                RTS_DFAULT_RETRY_LIMIT;
-        if (data_retry_limit < rts_retry_limit)
-                rts_retry_limit = data_retry_limit;
-        tx_cmd->rts_retry_limit = rts_retry_limit;
-
-        /* DATA packets will use the uCode station table for rate/antenna
-         * selection */
-        if (ieee80211_is_data(fc)) {
-                tx_cmd->initial_rate_index = 0;
-                tx_cmd->tx_flags |= TX_CMD_FLG_STA_RATE_MSK;
-                return;
-        }
-
-        /**
-         * If the current TX rate stored in mac80211 has the MCS bit set, it's
-         * not really a TX rate.  Thus, we use the lowest supported rate for
-         * this band.  Also use the lowest supported rate if the stored rate
-         * index is invalid.
-         */
-        rate_idx = info->control.rates[0].idx;
-        if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS ||
-                        (rate_idx < 0) || (rate_idx > IWL_RATE_COUNT_LEGACY))
-                rate_idx = rate_lowest_index(&priv->bands[info->band],
-                                info->control.sta);
-        /* For 5 GHZ band, remap mac80211 rate indices into driver indices */
-        if (info->band == IEEE80211_BAND_5GHZ)
-                rate_idx += IWL_FIRST_OFDM_RATE;
-        /* Get PLCP rate for tx_cmd->rate_n_flags */
-        rate_plcp = iwl_rates[rate_idx].plcp;
-        /* Zero out flags for this packet */
-        rate_flags = 0;
-
-        /* Set CCK flag as needed */
-        if ((rate_idx >= IWL_FIRST_CCK_RATE) && (rate_idx <= IWL_LAST_CCK_RATE))
-                rate_flags |= RATE_MCS_CCK_MSK;
-
-        /* Set up RTS and CTS flags for certain packets */
-        switch (fc & cpu_to_le16(IEEE80211_FCTL_STYPE)) {
-        case cpu_to_le16(IEEE80211_STYPE_AUTH):
-        case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
-        case cpu_to_le16(IEEE80211_STYPE_ASSOC_REQ):
-        case cpu_to_le16(IEEE80211_STYPE_REASSOC_REQ):
-                if (tx_cmd->tx_flags & TX_CMD_FLG_RTS_MSK) {
-                        tx_cmd->tx_flags &= ~TX_CMD_FLG_RTS_MSK;
-                        tx_cmd->tx_flags |= TX_CMD_FLG_CTS_MSK;
-                }
-                break;
-        default:
-                break;
-        }
-
-        /* Set up antennas */
-        priv->mgmt_tx_ant = iwl_toggle_tx_ant(priv, priv->mgmt_tx_ant);
-        rate_flags |= iwl_ant_idx_to_flags(priv->mgmt_tx_ant);
-
-        /* Set the rate in the TX cmd */
-        tx_cmd->rate_n_flags = iwl_hw_set_rate_n_flags(rate_plcp, rate_flags);
-}
-
-static void iwl_tx_cmd_build_hwcrypto(struct iwl_priv *priv,
-                                      struct ieee80211_tx_info *info,
-                                      struct iwl_tx_cmd *tx_cmd,
-                                      struct sk_buff *skb_frag,
-                                      int sta_id)
-{
-        struct ieee80211_key_conf *keyconf = info->control.hw_key;
-
-        switch (keyconf->alg) {
-        case ALG_CCMP:
-                tx_cmd->sec_ctl = TX_CMD_SEC_CCM;
-                memcpy(tx_cmd->key, keyconf->key, keyconf->keylen);
-                if (info->flags & IEEE80211_TX_CTL_AMPDU)
-                        tx_cmd->tx_flags |= TX_CMD_FLG_AGG_CCMP_MSK;
-                IWL_DEBUG_TX(priv, "tx_cmd with AES hwcrypto\n");
-                break;
-
-        case ALG_TKIP:
-                tx_cmd->sec_ctl = TX_CMD_SEC_TKIP;
-                ieee80211_get_tkip_key(keyconf, skb_frag,
-                        IEEE80211_TKIP_P2_KEY, tx_cmd->key);
-                IWL_DEBUG_TX(priv, "tx_cmd with tkip hwcrypto\n");
-                break;
-
-        case ALG_WEP:
-                tx_cmd->sec_ctl |= (TX_CMD_SEC_WEP |
-                        (keyconf->keyidx & TX_CMD_SEC_MSK) << TX_CMD_SEC_SHIFT);
-
-                if (keyconf->keylen == WEP_KEY_LEN_128)
-                        tx_cmd->sec_ctl |= TX_CMD_SEC_KEY128;
-
-                memcpy(&tx_cmd->key[3], keyconf->key, keyconf->keylen);
-
-                IWL_DEBUG_TX(priv, "Configuring packet for WEP encryption "
-                             "with key %d\n", keyconf->keyidx);
-                break;
-
-        default:
-                IWL_ERR(priv, "Unknown encode alg %d\n", keyconf->alg);
-                break;
-        }
-}
-
-/*
- * start REPLY_TX command process
- */
-int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
-{
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        struct ieee80211_sta *sta = info->control.sta;
-        struct iwl_station_priv *sta_priv = NULL;
-        struct iwl_tx_queue *txq;
-        struct iwl_queue *q;
-        struct iwl_device_cmd *out_cmd;
-        struct iwl_cmd_meta *out_meta;
-        struct iwl_tx_cmd *tx_cmd;
-        int swq_id, txq_id;
-        dma_addr_t phys_addr;
-        dma_addr_t txcmd_phys;
-        dma_addr_t scratch_phys;
-        u16 len, len_org, firstlen, secondlen;
-        u16 seq_number = 0;
-        __le16 fc;
-        u8 hdr_len;
-        u8 sta_id;
-        u8 wait_write_ptr = 0;
-        u8 tid = 0;
-        u8 *qc = NULL;
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->lock, flags);
-        if (iwl_is_rfkill(priv)) {
-                IWL_DEBUG_DROP(priv, "Dropping - RF KILL\n");
-                goto drop_unlock;
-        }
-
-        fc = hdr->frame_control;
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-        if (ieee80211_is_auth(fc))
-                IWL_DEBUG_TX(priv, "Sending AUTH frame\n");
-        else if (ieee80211_is_assoc_req(fc))
-                IWL_DEBUG_TX(priv, "Sending ASSOC frame\n");
-        else if (ieee80211_is_reassoc_req(fc))
-                IWL_DEBUG_TX(priv, "Sending REASSOC frame\n");
-#endif
-
-        /* drop all non-injected data frame if we are not associated */
-        if (ieee80211_is_data(fc) &&
-            !(info->flags & IEEE80211_TX_CTL_INJECTED) &&
-            (!iwl_is_associated(priv) ||
-             ((priv->iw_mode == NL80211_IFTYPE_STATION) && !priv->assoc_id) ||
-             !priv->assoc_station_added)) {
-                IWL_DEBUG_DROP(priv, "Dropping - !iwl_is_associated\n");
-                goto drop_unlock;
-        }
-
-        hdr_len = ieee80211_hdrlen(fc);
-
-        /* Find (or create) index into station table for destination station */
-        if (info->flags & IEEE80211_TX_CTL_INJECTED)
-                sta_id = priv->hw_params.bcast_sta_id;
-        else
-                sta_id = iwl_get_sta_id(priv, hdr);
-        if (sta_id == IWL_INVALID_STATION) {
-                IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
-                               hdr->addr1);
-                goto drop_unlock;
-        }
-
-        IWL_DEBUG_TX(priv, "station Id %d\n", sta_id);
-
-        if (sta)
-                sta_priv = (void *)sta->drv_priv;
-
-        if (sta_priv && sta_id != priv->hw_params.bcast_sta_id &&
-            sta_priv->asleep) {
-                WARN_ON(!(info->flags & IEEE80211_TX_CTL_PSPOLL_RESPONSE));
-                /*
-                 * This sends an asynchronous command to the device,
-                 * but we can rely on it being processed before the
-                 * next frame is processed -- and the next frame to
-                 * this station is the one that will consume this
-                 * counter.
-                 * For now set the counter to just 1 since we do not
-                 * support uAPSD yet.
-                 */
-                iwl_sta_modify_sleep_tx_count(priv, sta_id, 1);
-        }
-
-        txq_id = skb_get_queue_mapping(skb);
-        if (ieee80211_is_data_qos(fc)) {
-                qc = ieee80211_get_qos_ctl(hdr);
-                tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
-                if (unlikely(tid >= MAX_TID_COUNT))
-                        goto drop_unlock;
-                seq_number = priv->stations[sta_id].tid[tid].seq_number;
-                seq_number &= IEEE80211_SCTL_SEQ;
-                hdr->seq_ctrl = hdr->seq_ctrl &
-                                cpu_to_le16(IEEE80211_SCTL_FRAG);
-                hdr->seq_ctrl |= cpu_to_le16(seq_number);
-                seq_number += 0x10;
-                /* aggregation is on for this <sta,tid> */
-                if (info->flags & IEEE80211_TX_CTL_AMPDU &&
-                    priv->stations[sta_id].tid[tid].agg.state == IWL_AGG_ON) {
-                        txq_id = priv->stations[sta_id].tid[tid].agg.txq_id;
-                }
-        }
-
-        txq = &priv->txq[txq_id];
-        swq_id = txq->swq_id;
-        q = &txq->q;
-
-        if (unlikely(iwl_queue_space(q) < q->high_mark))
-                goto drop_unlock;
-
-        if (ieee80211_is_data_qos(fc))
-                priv->stations[sta_id].tid[tid].tfds_in_queue++;
-
-        /* Set up driver data for this TFD */
-        memset(&(txq->txb[q->write_ptr]), 0, sizeof(struct iwl_tx_info));
-        txq->txb[q->write_ptr].skb[0] = skb;
-
-        /* Set up first empty entry in queue's array of Tx/cmd buffers */
-        out_cmd = txq->cmd[q->write_ptr];
-        out_meta = &txq->meta[q->write_ptr];
-        tx_cmd = &out_cmd->cmd.tx;
-        memset(&out_cmd->hdr, 0, sizeof(out_cmd->hdr));
-        memset(tx_cmd, 0, sizeof(struct iwl_tx_cmd));
-
-        /*
-         * Set up the Tx-command (not MAC!) header.
-         * Store the chosen Tx queue and TFD index within the sequence field;
-         * after Tx, uCode's Tx response will return this value so driver can
-         * locate the frame within the tx queue and do post-tx processing.
-         */
-        out_cmd->hdr.cmd = REPLY_TX;
-        out_cmd->hdr.sequence = cpu_to_le16((u16)(QUEUE_TO_SEQ(txq_id) |
-                                INDEX_TO_SEQ(q->write_ptr)));
-
-        /* Copy MAC header from skb into command buffer */
-        memcpy(tx_cmd->hdr, hdr, hdr_len);
-
-
-        /* Total # bytes to be transmitted */
-        len = (u16)skb->len;
-        tx_cmd->len = cpu_to_le16(len);
-
-        if (info->control.hw_key)
-                iwl_tx_cmd_build_hwcrypto(priv, info, tx_cmd, skb, sta_id);
-
-        /* TODO need this for burst mode later on */
-        iwl_tx_cmd_build_basic(priv, tx_cmd, info, hdr, sta_id);
-        iwl_dbg_log_tx_data_frame(priv, len, hdr);
-
-        /* set is_hcca to 0; it probably will never be implemented */
-        iwl_tx_cmd_build_rate(priv, tx_cmd, info, fc, 0);
-
-        iwl_update_stats(priv, true, fc, len);
-        /*
-         * Use the first empty entry in this queue's command buffer array
-         * to contain the Tx command and MAC header concatenated together
-         * (payload data will be in another buffer).
-         * Size of this varies, due to varying MAC header length.
-         * If end is not dword aligned, we'll have 2 extra bytes at the end
-         * of the MAC header (device reads on dword boundaries).
-         * We'll tell device about this padding later.
-         */
-        len = sizeof(struct iwl_tx_cmd) +
-                sizeof(struct iwl_cmd_header) + hdr_len;
-
-        len_org = len;
-        firstlen = len = (len + 3) & ~3;
-
-        if (len_org != len)
-                len_org = 1;
-        else
-                len_org = 0;
-
-        /* Tell NIC about any 2-byte padding after MAC header */
-        if (len_org)
-                tx_cmd->tx_flags |= TX_CMD_FLG_MH_PAD_MSK;
-
-        /* Physical address of this Tx command's header (not MAC header!),
-         * within command buffer array. */
-        txcmd_phys = pci_map_single(priv->pci_dev,
-                                    &out_cmd->hdr, len,
-                                    PCI_DMA_BIDIRECTIONAL);
-        pci_unmap_addr_set(out_meta, mapping, txcmd_phys);
-        pci_unmap_len_set(out_meta, len, len);
-        /* Add buffer containing Tx command and MAC(!) header to TFD's
-         * first entry */
-        priv->cfg->ops->lib->txq_attach_buf_to_tfd(priv, txq,
-                                                   txcmd_phys, len, 1, 0);
-
-        if (!ieee80211_has_morefrags(hdr->frame_control)) {
-                txq->need_update = 1;
-                if (qc)
-                        priv->stations[sta_id].tid[tid].seq_number = seq_number;
-        } else {
-                wait_write_ptr = 1;
-                txq->need_update = 0;
-        }
-
-        /* Set up TFD's 2nd entry to point directly to remainder of skb,
-         * if any (802.11 null frames have no payload). */
-        secondlen = len = skb->len - hdr_len;
-        if (len) {
-                phys_addr = pci_map_single(priv->pci_dev, skb->data + hdr_len,
-                                           len, PCI_DMA_TODEVICE);
-                priv->cfg->ops->lib->txq_attach_buf_to_tfd(priv, txq,
-                                                           phys_addr, len,
-                                                           0, 0);
-        }
-
-        scratch_phys = txcmd_phys + sizeof(struct iwl_cmd_header) +
-                                offsetof(struct iwl_tx_cmd, scratch);
-
-        len = sizeof(struct iwl_tx_cmd) +
-                sizeof(struct iwl_cmd_header) + hdr_len;
-        /* take back ownership of DMA buffer to enable update */
-        pci_dma_sync_single_for_cpu(priv->pci_dev, txcmd_phys,
-                                    len, PCI_DMA_BIDIRECTIONAL);
-        tx_cmd->dram_lsb_ptr = cpu_to_le32(scratch_phys);
-        tx_cmd->dram_msb_ptr = iwl_get_dma_hi_addr(scratch_phys);
-
-        IWL_DEBUG_TX(priv, "sequence nr = 0X%x \n",
-                     le16_to_cpu(out_cmd->hdr.sequence));
-        IWL_DEBUG_TX(priv, "tx_flags = 0X%x \n", le32_to_cpu(tx_cmd->tx_flags));
-        iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd, sizeof(*tx_cmd));
-        iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd->hdr, hdr_len);
-
-        /* Set up entry for this TFD in Tx byte-count array */
-        if (info->flags & IEEE80211_TX_CTL_AMPDU)
-                priv->cfg->ops->lib->txq_update_byte_cnt_tbl(priv, txq,
-                                                     le16_to_cpu(tx_cmd->len));
-
-        pci_dma_sync_single_for_device(priv->pci_dev, txcmd_phys,
-                                       len, PCI_DMA_BIDIRECTIONAL);
-
-        trace_iwlwifi_dev_tx(priv,
-                             &((struct iwl_tfd *)txq->tfds)[txq->q.write_ptr],
-                             sizeof(struct iwl_tfd),
-                             &out_cmd->hdr, firstlen,
-                             skb->data + hdr_len, secondlen);
-
-        /* Tell device the write index *just past* this latest filled TFD */
-        q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
-        iwl_txq_update_write_ptr(priv, txq);
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        /*
-         * At this point the frame is "transmitted" successfully
-         * and we will get a TX status notification eventually,
-         * regardless of the value of ret. "ret" only indicates
-         * whether or not we should update the write pointer.
-         */
-
-        /* avoid atomic ops if it isn't an associated client */
-        if (sta_priv && sta_priv->client)
-                atomic_inc(&sta_priv->pending_frames);
-
-        if ((iwl_queue_space(q) < q->high_mark) && priv->mac80211_registered) {
-                if (wait_write_ptr) {
-                        spin_lock_irqsave(&priv->lock, flags);
-                        txq->need_update = 1;
-                        iwl_txq_update_write_ptr(priv, txq);
-                        spin_unlock_irqrestore(&priv->lock, flags);
-                } else {
-                        iwl_stop_queue(priv, txq->swq_id);
-                }
-        }
-
-        return 0;
-
-drop_unlock:
-        spin_unlock_irqrestore(&priv->lock, flags);
-        return -1;
-}
-EXPORT_SYMBOL(iwl_tx_skb);
-
 /*************** HOST COMMAND QUEUE FUNCTIONS   *****/
 
 /**
@@ -1191,61 +527,6 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
         return idx;
 }
 
-static void iwl_tx_status(struct iwl_priv *priv, struct sk_buff *skb)
-{
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        struct ieee80211_sta *sta;
-        struct iwl_station_priv *sta_priv;
-
-        sta = ieee80211_find_sta(priv->vif, hdr->addr1);
-        if (sta) {
-                sta_priv = (void *)sta->drv_priv;
-                /* avoid atomic ops if this isn't a client */
-                if (sta_priv->client &&
-                    atomic_dec_return(&sta_priv->pending_frames) == 0)
-                        ieee80211_sta_block_awake(priv->hw, sta, false);
-        }
-
-        ieee80211_tx_status_irqsafe(priv->hw, skb);
-}
-
-int iwl_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
-{
-        struct iwl_tx_queue *txq = &priv->txq[txq_id];
-        struct iwl_queue *q = &txq->q;
-        struct iwl_tx_info *tx_info;
-        int nfreed = 0;
-        struct ieee80211_hdr *hdr;
-
-        if ((index >= q->n_bd) || (iwl_queue_used(q, index) == 0)) {
-                IWL_ERR(priv, "Read index for DMA queue txq id (%d), index %d, "
-                          "is out of range [0-%d] %d %d.\n", txq_id,
-                          index, q->n_bd, q->write_ptr, q->read_ptr);
-                return 0;
-        }
-
-        for (index = iwl_queue_inc_wrap(index, q->n_bd);
-             q->read_ptr != index;
-             q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
-
-                tx_info = &txq->txb[txq->q.read_ptr];
-                iwl_tx_status(priv, tx_info->skb[0]);
-
-                hdr = (struct ieee80211_hdr *)tx_info->skb[0]->data;
-                if (hdr && ieee80211_is_data_qos(hdr->frame_control))
-                        nfreed++;
-                tx_info->skb[0] = NULL;
-
-                if (priv->cfg->ops->lib->txq_inval_byte_cnt_tbl)
-                        priv->cfg->ops->lib->txq_inval_byte_cnt_tbl(priv, txq);
-
-                priv->cfg->ops->lib->txq_free_tfd(priv, txq);
-        }
-        return nfreed;
-}
-EXPORT_SYMBOL(iwl_tx_queue_reclaim);
-
-
 /**
  * iwl_hcmd_queue_reclaim - Reclaim TX command queue entries already Tx'd
  *
@@ -1339,7 +620,7 @@ void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
 
         if (!(meta->flags & CMD_ASYNC)) {
                 clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
-                IWL_DEBUG_INFO(priv, "Clearing HCMD_ACTIVE for command %s \n",
+                IWL_DEBUG_INFO(priv, "Clearing HCMD_ACTIVE for command %s\n",
                                get_cmd_string(cmd->hdr.cmd));
                 wake_up_interruptible(&priv->wait_command_queue);
         }
@@ -1347,334 +628,6 @@ void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
 }
 EXPORT_SYMBOL(iwl_tx_cmd_complete);
 
-/*
- * Find first available (lowest unused) Tx Queue, mark it "active".
- * Called only when finding queue for aggregation.
- * Should never return anything < 7, because they should already
- * be in use as EDCA AC (0-3), Command (4), HCCA (5, 6).
- */
-static int iwl_txq_ctx_activate_free(struct iwl_priv *priv)
-{
-        int txq_id;
-
-        for (txq_id = 0; txq_id < priv->hw_params.max_txq_num; txq_id++)
-                if (!test_and_set_bit(txq_id, &priv->txq_ctx_active_msk))
-                        return txq_id;
-        return -1;
-}
-
-int iwl_tx_agg_start(struct iwl_priv *priv, const u8 *ra, u16 tid, u16 *ssn)
-{
-        int sta_id;
-        int tx_fifo;
-        int txq_id;
-        int ret;
-        unsigned long flags;
-        struct iwl_tid_data *tid_data;
-
-        if (likely(tid < ARRAY_SIZE(default_tid_to_tx_fifo)))
-                tx_fifo = default_tid_to_tx_fifo[tid];
-        else
-                return -EINVAL;
-
-        IWL_WARN(priv, "%s on ra = %pM tid = %d\n",
-                        __func__, ra, tid);
-
-        sta_id = iwl_find_station(priv, ra);
-        if (sta_id == IWL_INVALID_STATION) {
-                IWL_ERR(priv, "Start AGG on invalid station\n");
-                return -ENXIO;
-        }
-        if (unlikely(tid >= MAX_TID_COUNT))
-                return -EINVAL;
-
-        if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_OFF) {
-                IWL_ERR(priv, "Start AGG when state is not IWL_AGG_OFF !\n");
-                return -ENXIO;
-        }
-
-        txq_id = iwl_txq_ctx_activate_free(priv);
-        if (txq_id == -1) {
-                IWL_ERR(priv, "No free aggregation queue available\n");
-                return -ENXIO;
-        }
-
-        spin_lock_irqsave(&priv->sta_lock, flags);
-        tid_data = &priv->stations[sta_id].tid[tid];
-        *ssn = SEQ_TO_SN(tid_data->seq_number);
-        tid_data->agg.txq_id = txq_id;
-        priv->txq[txq_id].swq_id = iwl_virtual_agg_queue_num(tx_fifo, txq_id);
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
-
-        ret = priv->cfg->ops->lib->txq_agg_enable(priv, txq_id, tx_fifo,
-                                                  sta_id, tid, *ssn);
-        if (ret)
-                return ret;
-
-        if (tid_data->tfds_in_queue == 0) {
-                IWL_DEBUG_HT(priv, "HW queue is empty\n");
-                tid_data->agg.state = IWL_AGG_ON;
-                ieee80211_start_tx_ba_cb_irqsafe(priv->vif, ra, tid);
-        } else {
-                IWL_DEBUG_HT(priv, "HW queue is NOT empty: %d packets in HW queue\n",
-                             tid_data->tfds_in_queue);
-                tid_data->agg.state = IWL_EMPTYING_HW_QUEUE_ADDBA;
-        }
-        return ret;
-}
-EXPORT_SYMBOL(iwl_tx_agg_start);
-
-int iwl_tx_agg_stop(struct iwl_priv *priv , const u8 *ra, u16 tid)
-{
-        int tx_fifo_id, txq_id, sta_id, ssn = -1;
-        struct iwl_tid_data *tid_data;
-        int write_ptr, read_ptr;
-        unsigned long flags;
-
-        if (!ra) {
-                IWL_ERR(priv, "ra = NULL\n");
-                return -EINVAL;
-        }
-
-        if (unlikely(tid >= MAX_TID_COUNT))
-                return -EINVAL;
-
-        if (likely(tid < ARRAY_SIZE(default_tid_to_tx_fifo)))
-                tx_fifo_id = default_tid_to_tx_fifo[tid];
-        else
-                return -EINVAL;
-
-        sta_id = iwl_find_station(priv, ra);
-
-        if (sta_id == IWL_INVALID_STATION) {
-                IWL_ERR(priv, "Invalid station for AGG tid %d\n", tid);
-                return -ENXIO;
-        }
-
-        if (priv->stations[sta_id].tid[tid].agg.state ==
-                                IWL_EMPTYING_HW_QUEUE_ADDBA) {
-                IWL_DEBUG_HT(priv, "AGG stop before setup done\n");
-                ieee80211_stop_tx_ba_cb_irqsafe(priv->vif, ra, tid);
-                priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF;
-                return 0;
-        }
-
-        if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_ON)
-                IWL_WARN(priv, "Stopping AGG while state not ON or starting\n");
-
-        tid_data = &priv->stations[sta_id].tid[tid];
-        ssn = (tid_data->seq_number & IEEE80211_SCTL_SEQ) >> 4;
-        txq_id = tid_data->agg.txq_id;
-        write_ptr = priv->txq[txq_id].q.write_ptr;
-        read_ptr = priv->txq[txq_id].q.read_ptr;
-
-        /* The queue is not empty */
-        if (write_ptr != read_ptr) {
-                IWL_DEBUG_HT(priv, "Stopping a non empty AGG HW QUEUE\n");
-                priv->stations[sta_id].tid[tid].agg.state =
-                                IWL_EMPTYING_HW_QUEUE_DELBA;
-                return 0;
-        }
-
-        IWL_DEBUG_HT(priv, "HW queue is empty\n");
-        priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF;
-
-        spin_lock_irqsave(&priv->lock, flags);
-        /*
-         * the only reason this call can fail is queue number out of range,
-         * which can happen if uCode is reloaded and all the station
-         * information are lost. if it is outside the range, there is no need
-         * to deactivate the uCode queue, just return "success" to allow
-         *  mac80211 to clean up it own data.
-         */
-        priv->cfg->ops->lib->txq_agg_disable(priv, txq_id, ssn,
-                                                   tx_fifo_id);
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        ieee80211_stop_tx_ba_cb_irqsafe(priv->vif, ra, tid);
-
-        return 0;
-}
-EXPORT_SYMBOL(iwl_tx_agg_stop);
-
-int iwl_txq_check_empty(struct iwl_priv *priv, int sta_id, u8 tid, int txq_id)
-{
-        struct iwl_queue *q = &priv->txq[txq_id].q;
-        u8 *addr = priv->stations[sta_id].sta.sta.addr;
-        struct iwl_tid_data *tid_data = &priv->stations[sta_id].tid[tid];
-
-        switch (priv->stations[sta_id].tid[tid].agg.state) {
-        case IWL_EMPTYING_HW_QUEUE_DELBA:
-                /* We are reclaiming the last packet of the */
-                /* aggregated HW queue */
-                if ((txq_id  == tid_data->agg.txq_id) &&
-                    (q->read_ptr == q->write_ptr)) {
-                        u16 ssn = SEQ_TO_SN(tid_data->seq_number);
-                        int tx_fifo = default_tid_to_tx_fifo[tid];
-                        IWL_DEBUG_HT(priv, "HW queue empty: continue DELBA flow\n");
-                        priv->cfg->ops->lib->txq_agg_disable(priv, txq_id,
-                                                             ssn, tx_fifo);
-                        tid_data->agg.state = IWL_AGG_OFF;
-                        ieee80211_stop_tx_ba_cb_irqsafe(priv->vif, addr, tid);
-                }
-                break;
-        case IWL_EMPTYING_HW_QUEUE_ADDBA:
-                /* We are reclaiming the last packet of the queue */
-                if (tid_data->tfds_in_queue == 0) {
-                        IWL_DEBUG_HT(priv, "HW queue empty: continue ADDBA flow\n");
-                        tid_data->agg.state = IWL_AGG_ON;
-                        ieee80211_start_tx_ba_cb_irqsafe(priv->vif, addr, tid);
-                }
-                break;
-        }
-        return 0;
-}
-EXPORT_SYMBOL(iwl_txq_check_empty);
-
-/**
- * iwl_tx_status_reply_compressed_ba - Update tx status from block-ack
- *
- * Go through block-ack's bitmap of ACK'd frames, update driver's record of
- * ACK vs. not.  This gets sent to mac80211, then to rate scaling algo.
- */
-static int iwl_tx_status_reply_compressed_ba(struct iwl_priv *priv,
-                                 struct iwl_ht_agg *agg,
-                                 struct iwl_compressed_ba_resp *ba_resp)
-
-{
-        int i, sh, ack;
-        u16 seq_ctl = le16_to_cpu(ba_resp->seq_ctl);
-        u16 scd_flow = le16_to_cpu(ba_resp->scd_flow);
-        u64 bitmap;
-        int successes = 0;
-        struct ieee80211_tx_info *info;
-
-        if (unlikely(!agg->wait_for_ba))  {
-                IWL_ERR(priv, "Received BA when not expected\n");
-                return -EINVAL;
-        }
-
-        /* Mark that the expected block-ack response arrived */
-        agg->wait_for_ba = 0;
-        IWL_DEBUG_TX_REPLY(priv, "BA %d %d\n", agg->start_idx, ba_resp->seq_ctl);
-
-        /* Calculate shift to align block-ack bits with our Tx window bits */
-        sh = agg->start_idx - SEQ_TO_INDEX(seq_ctl >> 4);
-        if (sh < 0) /* tbw something is wrong with indices */
-                sh += 0x100;
-
-        /* don't use 64-bit values for now */
-        bitmap = le64_to_cpu(ba_resp->bitmap) >> sh;
-
-        if (agg->frame_count > (64 - sh)) {
-                IWL_DEBUG_TX_REPLY(priv, "more frames than bitmap size");
-                return -1;
-        }
-
-        /* check for success or failure according to the
-         * transmitted bitmap and block-ack bitmap */
-        bitmap &= agg->bitmap;
-
-        /* For each frame attempted in aggregation,
-         * update driver's record of tx frame's status. */
-        for (i = 0; i < agg->frame_count ; i++) {
-                ack = bitmap & (1ULL << i);
-                successes += !!ack;
-                IWL_DEBUG_TX_REPLY(priv, "%s ON i=%d idx=%d raw=%d\n",
-                        ack ? "ACK" : "NACK", i, (agg->start_idx + i) & 0xff,
-                        agg->start_idx + i);
-        }
-
-        info = IEEE80211_SKB_CB(priv->txq[scd_flow].txb[agg->start_idx].skb[0]);
-        memset(&info->status, 0, sizeof(info->status));
-        info->flags |= IEEE80211_TX_STAT_ACK;
-        info->flags |= IEEE80211_TX_STAT_AMPDU;
-        info->status.ampdu_ack_map = successes;
-        info->status.ampdu_ack_len = agg->frame_count;
-        iwl_hwrate_to_tx_control(priv, agg->rate_n_flags, info);
-
-        IWL_DEBUG_TX_REPLY(priv, "Bitmap %llx\n", (unsigned long long)bitmap);
-
-        return 0;
-}
-
-/**
- * iwl_rx_reply_compressed_ba - Handler for REPLY_COMPRESSED_BA
- *
- * Handles block-acknowledge notification from device, which reports success
- * of frames sent via aggregation.
- */
-void iwl_rx_reply_compressed_ba(struct iwl_priv *priv,
-                                           struct iwl_rx_mem_buffer *rxb)
-{
-        struct iwl_rx_packet *pkt = rxb_addr(rxb);
-        struct iwl_compressed_ba_resp *ba_resp = &pkt->u.compressed_ba;
-        struct iwl_tx_queue *txq = NULL;
-        struct iwl_ht_agg *agg;
-        int index;
-        int sta_id;
-        int tid;
-
-        /* "flow" corresponds to Tx queue */
-        u16 scd_flow = le16_to_cpu(ba_resp->scd_flow);
-
-        /* "ssn" is start of block-ack Tx window, corresponds to index
-         * (in Tx queue's circular buffer) of first TFD/frame in window */
-        u16 ba_resp_scd_ssn = le16_to_cpu(ba_resp->scd_ssn);
-
-        if (scd_flow >= priv->hw_params.max_txq_num) {
-                IWL_ERR(priv,
-                        "BUG_ON scd_flow is bigger than number of queues\n");
-                return;
-        }
-
-        txq = &priv->txq[scd_flow];
-        sta_id = ba_resp->sta_id;
-        tid = ba_resp->tid;
-        agg = &priv->stations[sta_id].tid[tid].agg;
-
-        /* Find index just before block-ack window */
-        index = iwl_queue_dec_wrap(ba_resp_scd_ssn & 0xff, txq->q.n_bd);
-
-        /* TODO: Need to get this copy more safely - now good for debug */
-
-        IWL_DEBUG_TX_REPLY(priv, "REPLY_COMPRESSED_BA [%d] Received from %pM, "
-                           "sta_id = %d\n",
-                           agg->wait_for_ba,
-                           (u8 *) &ba_resp->sta_addr_lo32,
-                           ba_resp->sta_id);
-        IWL_DEBUG_TX_REPLY(priv, "TID = %d, SeqCtl = %d, bitmap = 0x%llx, scd_flow = "
-                           "%d, scd_ssn = %d\n",
-                           ba_resp->tid,
-                           ba_resp->seq_ctl,
-                           (unsigned long long)le64_to_cpu(ba_resp->bitmap),
-                           ba_resp->scd_flow,
-                           ba_resp->scd_ssn);
-        IWL_DEBUG_TX_REPLY(priv, "DAT start_idx = %d, bitmap = 0x%llx \n",
-                           agg->start_idx,
-                           (unsigned long long)agg->bitmap);
-
-        /* Update driver's record of ACK vs. not for each frame in window */
-        iwl_tx_status_reply_compressed_ba(priv, agg, ba_resp);
-
-        /* Release all TFDs before the SSN, i.e. all TFDs in front of
-         * block-ack window (we assume that they've been successfully
-         * transmitted ... if not, it's too late anyway). */
-        if (txq->q.read_ptr != (ba_resp_scd_ssn & 0xff)) {
-                /* calculate mac80211 ampdu sw queue to wake */
-                int freed = iwl_tx_queue_reclaim(priv, scd_flow, index);
-                iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
-
-                if ((iwl_queue_space(&txq->q) > txq->q.low_mark) &&
-                    priv->mac80211_registered &&
-                    (agg->state != IWL_EMPTYING_HW_QUEUE_DELBA))
-                        iwl_wake_queue(priv, txq->swq_id);
-
-                iwl_txq_check_empty(priv, sta_id, tid, scd_flow);
-        }
-}
-EXPORT_SYMBOL(iwl_rx_reply_compressed_ba);
-
 #ifdef CONFIG_IWLWIFI_DEBUG
 #define TX_STATUS_ENTRY(x) case TX_STATUS_FAIL_ ## x: return #x
 
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index e276f2a4e835..c9188b9c5651 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -351,11 +351,11 @@ static int iwl3945_send_beacon_cmd(struct iwl_priv *priv)
 
 static void iwl3945_unset_hw_params(struct iwl_priv *priv)
 {
-        if (priv->shared_virt)
+        if (priv->_3945.shared_virt)
                 dma_free_coherent(&priv->pci_dev->dev,
                                   sizeof(struct iwl3945_shared),
-                                  priv->shared_virt,
-                                  priv->shared_phys);
+                                  priv->_3945.shared_virt,
+                                  priv->_3945.shared_phys);
 }
 
 static void iwl3945_build_tx_cmd_hwcrypto(struct iwl_priv *priv,
@@ -504,15 +504,6 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                 IWL_DEBUG_TX(priv, "Sending REASSOC frame\n");
 #endif
 
-        /* drop all non-injected data frame if we are not associated */
-        if (ieee80211_is_data(fc) &&
-            !(info->flags & IEEE80211_TX_CTL_INJECTED) &&
-            (!iwl_is_associated(priv) ||
-             ((priv->iw_mode == NL80211_IFTYPE_STATION) && !priv->assoc_id))) {
-                IWL_DEBUG_DROP(priv, "Dropping - !iwl_is_associated\n");
-                goto drop_unlock;
-        }
-
         spin_unlock_irqrestore(&priv->lock, flags);
 
         hdr_len = ieee80211_hdrlen(fc);
@@ -606,9 +597,9 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                 txq->need_update = 0;
         }
 
-        IWL_DEBUG_TX(priv, "sequence nr = 0X%x \n",
+        IWL_DEBUG_TX(priv, "sequence nr = 0X%x\n",
                      le16_to_cpu(out_cmd->hdr.sequence));
-        IWL_DEBUG_TX(priv, "tx_flags = 0X%x \n", le32_to_cpu(tx_cmd->tx_flags));
+        IWL_DEBUG_TX(priv, "tx_flags = 0X%x\n", le32_to_cpu(tx_cmd->tx_flags));
         iwl_print_hex_dump(priv, IWL_DL_TX, tx_cmd, sizeof(*tx_cmd));
         iwl_print_hex_dump(priv, IWL_DL_TX, (u8 *)tx_cmd->hdr,
                            ieee80211_hdrlen(fc));
@@ -753,7 +744,7 @@ static int iwl3945_get_measurement(struct iwl_priv *priv,
         if (iwl_is_associated(priv))
                 add_time =
                     iwl3945_usecs_to_beacons(
-                        le64_to_cpu(params->start_time) - priv->last_tsf,
+                        le64_to_cpu(params->start_time) - priv->_3945.last_tsf,
                         le16_to_cpu(priv->rxon_timing.beacon_interval));
 
         memset(&spectrum, 0, sizeof(spectrum));
@@ -767,7 +758,7 @@ static int iwl3945_get_measurement(struct iwl_priv *priv,
 
         if (iwl_is_associated(priv))
                 spectrum.start_time =
-                    iwl3945_add_beacon_time(priv->last_beacon_time,
+                    iwl3945_add_beacon_time(priv->_3945.last_beacon_time,
                                 add_time,
                                 le16_to_cpu(priv->rxon_timing.beacon_interval));
         else
@@ -1946,7 +1937,7 @@ static int iwl3945_get_channels_for_scan(struct iwl_priv *priv,
                 added++;
         }
 
-        IWL_DEBUG_SCAN(priv, "total channels to scan %d \n", added);
+        IWL_DEBUG_SCAN(priv, "total channels to scan %d\n", added);
         return added;
 }
 
@@ -2489,8 +2480,6 @@ static void iwl3945_alive_start(struct iwl_priv *priv)
                 goto restart;
         }
 
-        iwl_clear_stations_table(priv);
-
         rfkill = iwl_read_prph(priv, APMG_RFKILL_REG);
         IWL_DEBUG_INFO(priv, "RFKILL status: 0x%x\n", rfkill);
 
@@ -2512,13 +2501,19 @@ static void iwl3945_alive_start(struct iwl_priv *priv)
         /* After the ALIVE response, we can send commands to 3945 uCode */
         set_bit(STATUS_ALIVE, &priv->status);
 
+        if (priv->cfg->ops->lib->recover_from_tx_stall) {
+                /* Enable timer to monitor the driver queues */
+                mod_timer(&priv->monitor_recover,
+                        jiffies +
+                        msecs_to_jiffies(priv->cfg->monitor_recover_period));
+        }
+
         if (iwl_is_rfkill(priv))
                 return;
 
         ieee80211_wake_queues(priv->hw);
 
-        priv->active_rate = priv->rates_mask;
-        priv->active_rate_basic = priv->rates_mask & IWL_BASIC_RATES_MASK;
+        priv->active_rate = IWL_RATES_MASK;
 
         iwl_power_update_mode(priv, true);
 
@@ -2547,17 +2542,6 @@ static void iwl3945_alive_start(struct iwl_priv *priv)
         set_bit(STATUS_READY, &priv->status);
         wake_up_interruptible(&priv->wait_command_queue);
 
-        /* reassociate for ADHOC mode */
-        if (priv->vif && (priv->iw_mode == NL80211_IFTYPE_ADHOC)) {
-                struct sk_buff *beacon = ieee80211_beacon_get(priv->hw,
-                                                                priv->vif);
-                if (beacon)
-                        iwl_mac_beacon_update(priv->hw, beacon);
-        }
-
-        if (test_and_clear_bit(STATUS_MODE_PENDING, &priv->status))
-                iwl_set_mode(priv, priv->iw_mode);
-
         return;
 
  restart:
@@ -2579,7 +2563,8 @@ static void __iwl3945_down(struct iwl_priv *priv)
         if (!exit_pending)
                 set_bit(STATUS_EXIT_PENDING, &priv->status);
 
-        iwl_clear_stations_table(priv);
+        /* Station information will now be cleared in device */
+        iwl_clear_ucode_stations(priv, true);
 
         /* Unblock any waiting calls */
         wake_up_interruptible_all(&priv->wait_command_queue);
@@ -2713,12 +2698,10 @@ static int __iwl3945_up(struct iwl_priv *priv)
 
         for (i = 0; i < MAX_HW_RESTARTS; i++) {
 
-                iwl_clear_stations_table(priv);
-
                 /* load bootstrap state machine,
                  * load bootstrap program into processor's memory,
                  * prepare to load the "initialize" uCode */
-                priv->cfg->ops->lib->load_ucode(priv);
+                rc = priv->cfg->ops->lib->load_ucode(priv);
 
                 if (rc) {
                         IWL_ERR(priv,
@@ -2786,7 +2769,7 @@ static void iwl3945_bg_alive_start(struct work_struct *data)
 static void iwl3945_rfkill_poll(struct work_struct *data)
 {
         struct iwl_priv *priv =
-            container_of(data, struct iwl_priv, rfkill_poll.work);
+            container_of(data, struct iwl_priv, _3945.rfkill_poll.work);
         bool old_rfkill = test_bit(STATUS_RF_KILL_HW, &priv->status);
         bool new_rfkill = !(iwl_read32(priv, CSR_GP_CNTRL)
                         & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW);
@@ -2805,7 +2788,7 @@ static void iwl3945_rfkill_poll(struct work_struct *data)
 
         /* Keep this running, even if radio now enabled.  This will be
          * cancelled in mac_start() if system decides to start again */
-        queue_delayed_work(priv->workqueue, &priv->rfkill_poll,
+        queue_delayed_work(priv->workqueue, &priv->_3945.rfkill_poll,
                            round_jiffies_relative(2 * HZ));
 
 }
@@ -2820,7 +2803,6 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
                 .len = sizeof(struct iwl3945_scan_cmd),
                 .flags = CMD_SIZE_HUGE,
         };
-        int rc = 0;
         struct iwl3945_scan_cmd *scan;
         struct ieee80211_conf *conf = NULL;
         u8 n_probes = 0;
@@ -2848,7 +2830,6 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
         if (test_bit(STATUS_SCAN_HW, &priv->status)) {
                 IWL_DEBUG_INFO(priv, "Multiple concurrent scan requests  "
                                 "Ignoring second request.\n");
-                rc = -EIO;
                 goto done;
         }
 
@@ -2883,7 +2864,7 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
                 priv->scan = kmalloc(sizeof(struct iwl3945_scan_cmd) +
                                      IWL_MAX_SCAN_SIZE, GFP_KERNEL);
                 if (!priv->scan) {
-                        rc = -ENOMEM;
+                        IWL_DEBUG_SCAN(priv, "Fail to allocate scan memory\n");
                         goto done;
                 }
         }
@@ -2926,7 +2907,9 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
                                scan_suspend_time, interval);
         }
 
-        if (priv->scan_request->n_ssids) {
+        if (priv->is_internal_short_scan) {
+                IWL_DEBUG_SCAN(priv, "Start internal passive scan.\n");
+        } else if (priv->scan_request->n_ssids) {
                 int i, p = 0;
                 IWL_DEBUG_SCAN(priv, "Kicking off active scan\n");
                 for (i = 0; i < priv->scan_request->n_ssids; i++) {
@@ -2973,13 +2956,20 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
                 goto done;
         }
 
-        scan->tx_cmd.len = cpu_to_le16(
+        if (!priv->is_internal_short_scan) {
+                scan->tx_cmd.len = cpu_to_le16(
                         iwl_fill_probe_req(priv,
                                 (struct ieee80211_mgmt *)scan->data,
                                 priv->scan_request->ie,
                                 priv->scan_request->ie_len,
                                 IWL_MAX_SCAN_SIZE - sizeof(*scan)));
-
+        } else {
+                scan->tx_cmd.len = cpu_to_le16(
+                        iwl_fill_probe_req(priv,
+                                (struct ieee80211_mgmt *)scan->data,
+                                NULL, 0,
+                                IWL_MAX_SCAN_SIZE - sizeof(*scan)));
+        }
         /* select Rx antennas */
         scan->flags |= iwl3945_get_antenna_flags(priv);
 
@@ -3001,8 +2991,7 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
         scan->len = cpu_to_le16(cmd.len);
 
         set_bit(STATUS_SCAN_HW, &priv->status);
-        rc = iwl_send_cmd_sync(priv, &cmd);
-        if (rc)
+        if (iwl_send_cmd_sync(priv, &cmd))
                 goto done;
 
         queue_delayed_work(priv->workqueue, &priv->scan_check,
@@ -3134,12 +3123,13 @@ void iwl3945_post_associate(struct iwl_priv *priv)
         case NL80211_IFTYPE_ADHOC:
 
                 priv->assoc_id = 1;
-                iwl_add_station(priv, priv->bssid, 0, CMD_SYNC, NULL);
+                iwl_add_local_station(priv, priv->bssid, false);
                 iwl3945_sync_sta(priv, IWL_STA_ID,
-                                 (priv->band == IEEE80211_BAND_5GHZ) ?
-                                 IWL_RATE_6M_PLCP : IWL_RATE_1M_PLCP,
+                                (priv->band == IEEE80211_BAND_5GHZ) ?
+                                IWL_RATE_6M_PLCP : IWL_RATE_1M_PLCP,
                                  CMD_ASYNC);
                 iwl3945_rate_scale_init(priv->hw, IWL_STA_ID);
+
                 iwl3945_send_beacon_cmd(priv);
 
                 break;
@@ -3150,8 +3140,6 @@ void iwl3945_post_associate(struct iwl_priv *priv)
                 break;
         }
 
-        iwl_activate_qos(priv, 0);
-
         /* we have just associated, don't start scan too early */
         priv->next_scan_jiffies = jiffies + IWL_DELAY_NEXT_SCAN;
 }
@@ -3212,7 +3200,7 @@ static int iwl3945_mac_start(struct ieee80211_hw *hw)
 
         /* ucode is running and will send rfkill notifications,
          * no need to poll the killswitch state anymore */
-        cancel_delayed_work(&priv->rfkill_poll);
+        cancel_delayed_work(&priv->_3945.rfkill_poll);
 
         iwl_led_start(priv);
 
@@ -3253,7 +3241,7 @@ static void iwl3945_mac_stop(struct ieee80211_hw *hw)
         flush_workqueue(priv->workqueue);
 
         /* start polling the killswitch state again */
-        queue_delayed_work(priv->workqueue, &priv->rfkill_poll,
+        queue_delayed_work(priv->workqueue, &priv->_3945.rfkill_poll,
                            round_jiffies_relative(2 * HZ));
 
         IWL_DEBUG_MAC80211(priv, "leave\n");
@@ -3324,7 +3312,7 @@ void iwl3945_config_ap(struct iwl_priv *priv)
                 /* restore RXON assoc */
                 priv->staging_rxon.filter_flags |= RXON_FILTER_ASSOC_MSK;
                 iwlcore_commit_rxon(priv);
-                iwl_add_station(priv, iwl_bcast_addr, 0, CMD_SYNC, NULL);
+                iwl_add_local_station(priv, iwl_bcast_addr, false);
         }
         iwl3945_send_beacon_cmd(priv);
 
@@ -3365,7 +3353,6 @@ static int iwl3945_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 
         mutex_lock(&priv->mutex);
         iwl_scan_cancel_timeout(priv, 100);
-        mutex_unlock(&priv->mutex);
 
         switch (cmd) {
         case SET_KEY:
@@ -3386,11 +3373,44 @@ static int iwl3945_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 ret = -EINVAL;
         }
 
+        mutex_unlock(&priv->mutex);
         IWL_DEBUG_MAC80211(priv, "leave\n");
 
         return ret;
 }
 
+static int iwl3945_mac_sta_add(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               struct ieee80211_sta *sta)
+{
+        struct iwl_priv *priv = hw->priv;
+        int ret;
+        bool is_ap = priv->iw_mode == NL80211_IFTYPE_STATION;
+        u8 sta_id;
+
+        IWL_DEBUG_INFO(priv, "received request to add station %pM\n",
+                        sta->addr);
+
+        ret = iwl_add_station_common(priv, sta->addr, is_ap, &sta->ht_cap,
+                                     &sta_id);
+        if (ret) {
+                IWL_ERR(priv, "Unable to add station %pM (%d)\n",
+                        sta->addr, ret);
+                /* Should we return success if return code is EEXIST ? */
+                return ret;
+        }
+
+        /* Initialize rate scaling */
+        IWL_DEBUG_INFO(priv, "Initializing rate scaling for station %pM\n",
+                       sta->addr);
+        iwl3945_rs_rate_init(priv, sta, sta_id);
+
+        return 0;
+
+
+
+        return ret;
+}
 /*****************************************************************************
  *
  * sysfs attributes
@@ -3590,7 +3610,7 @@ static ssize_t store_measurement(struct device *d,
         struct iwl_priv *priv = dev_get_drvdata(d);
         struct ieee80211_measurement_params params = {
                 .channel = le16_to_cpu(priv->active_rxon.channel),
-                .start_time = cpu_to_le64(priv->last_tsf),
+                .start_time = cpu_to_le64(priv->_3945.last_tsf),
                 .duration = cpu_to_le16(1),
         };
         u8 type = IWL_MEASURE_BASIC;
@@ -3660,7 +3680,7 @@ static ssize_t show_statistics(struct device *d,
         struct iwl_priv *priv = dev_get_drvdata(d);
         u32 size = sizeof(struct iwl3945_notif_statistics);
         u32 len = 0, ofs = 0;
-        u8 *data = (u8 *)&priv->statistics_39;
+        u8 *data = (u8 *)&priv->_3945.statistics;
         int rc = 0;
 
         if (!iwl_is_alive(priv))
@@ -3773,7 +3793,7 @@ static void iwl3945_setup_deferred_work(struct iwl_priv *priv)
         INIT_WORK(&priv->beacon_update, iwl3945_bg_beacon_update);
         INIT_DELAYED_WORK(&priv->init_alive_start, iwl3945_bg_init_alive_start);
         INIT_DELAYED_WORK(&priv->alive_start, iwl3945_bg_alive_start);
-        INIT_DELAYED_WORK(&priv->rfkill_poll, iwl3945_rfkill_poll);
+        INIT_DELAYED_WORK(&priv->_3945.rfkill_poll, iwl3945_rfkill_poll);
         INIT_WORK(&priv->scan_completed, iwl_bg_scan_completed);
         INIT_WORK(&priv->request_scan, iwl3945_bg_request_scan);
         INIT_WORK(&priv->abort_scan, iwl_bg_abort_scan);
@@ -3781,6 +3801,13 @@ static void iwl3945_setup_deferred_work(struct iwl_priv *priv)
 
         iwl3945_hw_setup_deferred_work(priv);
 
+        if (priv->cfg->ops->lib->recover_from_tx_stall) {
+                init_timer(&priv->monitor_recover);
+                priv->monitor_recover.data = (unsigned long)priv;
+                priv->monitor_recover.function =
+                        priv->cfg->ops->lib->recover_from_tx_stall;
+        }
+
         tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
                      iwl3945_irq_tasklet, (unsigned long)priv);
 }
@@ -3793,6 +3820,8 @@ static void iwl3945_cancel_deferred_work(struct iwl_priv *priv)
         cancel_delayed_work(&priv->scan_check);
         cancel_delayed_work(&priv->alive_start);
         cancel_work_sync(&priv->beacon_update);
+        if (priv->cfg->ops->lib->recover_from_tx_stall)
+                del_timer_sync(&priv->monitor_recover);
 }
 
 static struct attribute *iwl3945_sysfs_entries[] = {
@@ -3830,7 +3859,9 @@ static struct ieee80211_ops iwl3945_hw_ops = {
         .conf_tx = iwl_mac_conf_tx,
         .reset_tsf = iwl_mac_reset_tsf,
         .bss_info_changed = iwl_bss_info_changed,
-        .hw_scan = iwl_mac_hw_scan
+        .hw_scan = iwl_mac_hw_scan,
+        .sta_add = iwl3945_mac_sta_add,
+        .sta_remove = iwl_mac_sta_remove,
 };
 
 static int iwl3945_init_drv(struct iwl_priv *priv)
@@ -3849,9 +3880,6 @@ static int iwl3945_init_drv(struct iwl_priv *priv)
         mutex_init(&priv->mutex);
         mutex_init(&priv->sync_cmd_mutex);
 
-        /* Clear the driver's (not device's) station table */
-        iwl_clear_stations_table(priv);
-
         priv->ieee_channels = NULL;
         priv->ieee_rates = NULL;
         priv->band = IEEE80211_BAND_2GHZ;
@@ -3859,12 +3887,6 @@ static int iwl3945_init_drv(struct iwl_priv *priv)
         priv->iw_mode = NL80211_IFTYPE_STATION;
         priv->missed_beacon_threshold = IWL_MISSED_BEACON_THRESHOLD_DEF;
 
-        iwl_reset_qos(priv);
-
-        priv->qos_data.qos_active = 0;
-        priv->qos_data.qos_cap.val = 0;
-
-        priv->rates_mask = IWL_RATES_MASK;
         priv->tx_power_user_lmt = IWL_DEFAULT_TX_POWER;
 
         if (eeprom->version < EEPROM_3945_EEPROM_VERSION) {
@@ -4129,7 +4151,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
                 IWL_ERR(priv, "failed to create debugfs files. Ignoring error: %d\n", err);
 
         /* Start monitoring the killswitch */
-        queue_delayed_work(priv->workqueue, &priv->rfkill_poll,
+        queue_delayed_work(priv->workqueue, &priv->_3945.rfkill_poll,
                            2 * HZ);
 
         return 0;
@@ -4203,7 +4225,7 @@ static void __devexit iwl3945_pci_remove(struct pci_dev *pdev)
 
         sysfs_remove_group(&pdev->dev.kobj, &iwl3945_attribute_group);
 
-        cancel_delayed_work_sync(&priv->rfkill_poll);
+        cancel_delayed_work_sync(&priv->_3945.rfkill_poll);
 
         iwl3945_dealloc_ucode_pci(priv);
 
@@ -4212,7 +4234,6 @@ static void __devexit iwl3945_pci_remove(struct pci_dev *pdev)
         iwl3945_hw_txq_ctx_free(priv);
 
         iwl3945_unset_hw_params(priv);
-        iwl_clear_stations_table(priv);
 
         /*netif_stop_queue(dev); */
         flush_workqueue(priv->workqueue);
diff --git a/drivers/net/wireless/iwmc3200wifi/Kconfig b/drivers/net/wireless/iwmc3200wifi/Kconfig
index b9d34a766964..03f998d098c5 100644
--- a/drivers/net/wireless/iwmc3200wifi/Kconfig
+++ b/drivers/net/wireless/iwmc3200wifi/Kconfig
@@ -17,7 +17,7 @@ config IWM
 config IWM_DEBUG
         bool "Enable full debugging output in iwmc3200wifi"
         depends on IWM && DEBUG_FS
-        ---help---
+        help
           This option will enable debug tracing and setting for iwm
 
           You can set the debug level and module through debugfs. By
@@ -30,3 +30,10 @@ config IWM_DEBUG
           Or, if you want the full debug, for all modules:
           echo 0xff > /sys/kernel/debug/iwm/phyN/debug/level
           echo 0xff > /sys/kernel/debug/iwm/phyN/debug/modules
+
+config IWM_TRACING
+        bool "Enable event tracing for iwmc3200wifi"
+        depends on IWM && EVENT_TRACING
+        help
+          Say Y here to trace all the commands and responses between
+          the driver and firmware (including TX/RX frames) with ftrace.
diff --git a/drivers/net/wireless/iwmc3200wifi/Makefile b/drivers/net/wireless/iwmc3200wifi/Makefile
index d34291b652d3..aeed5cd80819 100644
--- a/drivers/net/wireless/iwmc3200wifi/Makefile
+++ b/drivers/net/wireless/iwmc3200wifi/Makefile
@@ -3,3 +3,6 @@ iwmc3200wifi-objs += main.o netdev.o rx.o tx.o sdio.o hal.o fw.o
 iwmc3200wifi-objs += commands.o cfg80211.o eeprom.o
 
 iwmc3200wifi-$(CONFIG_IWM_DEBUG) += debugfs.o
+iwmc3200wifi-$(CONFIG_IWM_TRACING) += trace.o
+
+CFLAGS_trace.o := -I$(src)
diff --git a/drivers/net/wireless/iwmc3200wifi/cfg80211.c b/drivers/net/wireless/iwmc3200wifi/cfg80211.c
index 7c4f44a9c3e6..fc239a32cb6b 100644
--- a/drivers/net/wireless/iwmc3200wifi/cfg80211.c
+++ b/drivers/net/wireless/iwmc3200wifi/cfg80211.c
@@ -263,7 +263,7 @@ static int iwm_cfg80211_get_station(struct wiphy *wiphy,
 int iwm_cfg80211_inform_bss(struct iwm_priv *iwm)
 {
         struct wiphy *wiphy = iwm_to_wiphy(iwm);
-        struct iwm_bss_info *bss, *next;
+        struct iwm_bss_info *bss;
         struct iwm_umac_notif_bss_info *umac_bss;
         struct ieee80211_mgmt *mgmt;
         struct ieee80211_channel *channel;
@@ -271,7 +271,7 @@ int iwm_cfg80211_inform_bss(struct iwm_priv *iwm)
         s32 signal;
         int freq;
 
-        list_for_each_entry_safe(bss, next, &iwm->bss_list, node) {
+        list_for_each_entry(bss, &iwm->bss_list, node) {
                 umac_bss = bss->bss;
                 mgmt = (struct ieee80211_mgmt *)(umac_bss->frame_buf);
 
@@ -725,23 +725,26 @@ static int iwm_cfg80211_set_power_mgmt(struct wiphy *wiphy,
                                        CFG_POWER_INDEX, iwm->conf.power_index);
 }
 
-int iwm_cfg80211_set_pmksa(struct wiphy *wiphy, struct net_device *netdev,
-                           struct cfg80211_pmksa *pmksa)
+static int iwm_cfg80211_set_pmksa(struct wiphy *wiphy,
+                                  struct net_device *netdev,
+                                  struct cfg80211_pmksa *pmksa)
 {
         struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
 
         return iwm_send_pmkid_update(iwm, pmksa, IWM_CMD_PMKID_ADD);
 }
 
-int iwm_cfg80211_del_pmksa(struct wiphy *wiphy, struct net_device *netdev,
-                           struct cfg80211_pmksa *pmksa)
+static int iwm_cfg80211_del_pmksa(struct wiphy *wiphy,
+                                  struct net_device *netdev,
+                                  struct cfg80211_pmksa *pmksa)
 {
         struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
 
         return iwm_send_pmkid_update(iwm, pmksa, IWM_CMD_PMKID_DEL);
 }
 
-int iwm_cfg80211_flush_pmksa(struct wiphy *wiphy, struct net_device *netdev)
+static int iwm_cfg80211_flush_pmksa(struct wiphy *wiphy,
+                                    struct net_device *netdev)
 {
         struct iwm_priv *iwm = wiphy_to_iwm(wiphy);
         struct cfg80211_pmksa pmksa;
diff --git a/drivers/net/wireless/iwmc3200wifi/commands.c b/drivers/net/wireless/iwmc3200wifi/commands.c
index 1e41ad0fcad5..b5cbd2bfd52a 100644
--- a/drivers/net/wireless/iwmc3200wifi/commands.c
+++ b/drivers/net/wireless/iwmc3200wifi/commands.c
@@ -506,7 +506,7 @@ static int iwm_target_read(struct iwm_priv *iwm, __le32 address,
                 return ret;
         }
 
-        /* When succeding, the send_target routine returns the seq number */
+        /* When succeeding, the send_target routine returns the seq number */
         seq_num = ret;
 
         ret = wait_event_interruptible_timeout(iwm->nonwifi_queue,
@@ -781,10 +781,9 @@ int iwm_send_mlme_profile(struct iwm_priv *iwm)
         return 0;
 }
 
-int iwm_invalidate_mlme_profile(struct iwm_priv *iwm)
+int __iwm_invalidate_mlme_profile(struct iwm_priv *iwm)
 {
         struct iwm_umac_invalidate_profile invalid;
-        int ret;
 
         invalid.hdr.oid = UMAC_WIFI_IF_CMD_INVALIDATE_PROFILE;
         invalid.hdr.buf_size =
@@ -793,7 +792,14 @@ int iwm_invalidate_mlme_profile(struct iwm_priv *iwm)
 
         invalid.reason = WLAN_REASON_UNSPECIFIED;
 
-        ret = iwm_send_wifi_if_cmd(iwm, &invalid, sizeof(invalid), 1);
+        return iwm_send_wifi_if_cmd(iwm, &invalid, sizeof(invalid), 1);
+}
+
+int iwm_invalidate_mlme_profile(struct iwm_priv *iwm)
+{
+        int ret;
+
+        ret = __iwm_invalidate_mlme_profile(iwm);
         if (ret)
                 return ret;
 
diff --git a/drivers/net/wireless/iwmc3200wifi/commands.h b/drivers/net/wireless/iwmc3200wifi/commands.h
index 3dfd9f0e9003..7e16bcf59978 100644
--- a/drivers/net/wireless/iwmc3200wifi/commands.h
+++ b/drivers/net/wireless/iwmc3200wifi/commands.h
@@ -488,6 +488,7 @@ int iwm_umac_set_config_var(struct iwm_priv *iwm, u16 key,
                             void *payload, u16 payload_size);
 int iwm_send_umac_config(struct iwm_priv *iwm, __le32 reset_flags);
 int iwm_send_mlme_profile(struct iwm_priv *iwm);
+int __iwm_invalidate_mlme_profile(struct iwm_priv *iwm);
 int iwm_invalidate_mlme_profile(struct iwm_priv *iwm);
 int iwm_send_packet(struct iwm_priv *iwm, struct sk_buff *skb, int pool_id);
 int iwm_set_tx_key(struct iwm_priv *iwm, u8 key_idx);
diff --git a/drivers/net/wireless/iwmc3200wifi/debugfs.c b/drivers/net/wireless/iwmc3200wifi/debugfs.c
index be992ca41cf1..48930c1a0f76 100644
--- a/drivers/net/wireless/iwmc3200wifi/debugfs.c
+++ b/drivers/net/wireless/iwmc3200wifi/debugfs.c
@@ -265,7 +265,7 @@ static ssize_t iwm_debugfs_rx_ticket_read(struct file *filp,
                                           size_t count, loff_t *ppos)
 {
         struct iwm_priv *iwm = filp->private_data;
-        struct iwm_rx_ticket_node *ticket, *next;
+        struct iwm_rx_ticket_node *ticket;
         char *buf;
         int buf_len = 4096, i;
         size_t len = 0;
@@ -280,7 +280,8 @@ static ssize_t iwm_debugfs_rx_ticket_read(struct file *filp,
         if (!buf)
                 return -ENOMEM;
 
-        list_for_each_entry_safe(ticket, next, &iwm->rx_tickets, node) {
+        spin_lock(&iwm->ticket_lock);
+        list_for_each_entry(ticket, &iwm->rx_tickets, node) {
                 len += snprintf(buf + len, buf_len - len, "Ticket #%d\n",
                                 ticket->ticket->id);
                 len += snprintf(buf + len, buf_len - len, "\taction: 0x%x\n",
@@ -288,14 +289,17 @@ static ssize_t iwm_debugfs_rx_ticket_read(struct file *filp,
                 len += snprintf(buf + len, buf_len - len, "\tflags:  0x%x\n",
                                 ticket->ticket->flags);
         }
+        spin_unlock(&iwm->ticket_lock);
 
         for (i = 0; i < IWM_RX_ID_HASH; i++) {
-                struct iwm_rx_packet *packet, *nxt;
+                struct iwm_rx_packet *packet;
                 struct list_head *pkt_list = &iwm->rx_packets[i];
+
                 if (!list_empty(pkt_list)) {
                         len += snprintf(buf + len, buf_len - len,
                                         "Packet hash #%d\n", i);
-                        list_for_each_entry_safe(packet, nxt, pkt_list, node) {
+                        spin_lock(&iwm->packet_lock[i]);
+                        list_for_each_entry(packet, pkt_list, node) {
                                 len += snprintf(buf + len, buf_len - len,
                                                 "\tPacket id:     %d\n",
                                                 packet->id);
@@ -303,6 +307,7 @@ static ssize_t iwm_debugfs_rx_ticket_read(struct file *filp,
                                                 "\tPacket length: %lu\n",
                                                 packet->pkt_size);
                         }
+                        spin_unlock(&iwm->packet_lock[i]);
                 }
         }
 
diff --git a/drivers/net/wireless/iwmc3200wifi/hal.c b/drivers/net/wireless/iwmc3200wifi/hal.c
index d13c8853ee82..373b5b5001d2 100644
--- a/drivers/net/wireless/iwmc3200wifi/hal.c
+++ b/drivers/net/wireless/iwmc3200wifi/hal.c
@@ -104,6 +104,7 @@
 #include "hal.h"
 #include "umac.h"
 #include "debug.h"
+#include "trace.h"
 
 static int iwm_nonwifi_cmd_init(struct iwm_priv *iwm,
                                 struct iwm_nonwifi_cmd *cmd,
@@ -206,9 +207,9 @@ void iwm_cmd_flush(struct iwm_priv *iwm)
 
 struct iwm_wifi_cmd *iwm_get_pending_wifi_cmd(struct iwm_priv *iwm, u16 seq_num)
 {
-        struct iwm_wifi_cmd *cmd, *next;
+        struct iwm_wifi_cmd *cmd;
 
-        list_for_each_entry_safe(cmd, next, &iwm->wifi_pending_cmd, pending)
+        list_for_each_entry(cmd, &iwm->wifi_pending_cmd, pending)
                 if (cmd->seq_num == seq_num) {
                         list_del(&cmd->pending);
                         return cmd;
@@ -217,12 +218,12 @@ struct iwm_wifi_cmd *iwm_get_pending_wifi_cmd(struct iwm_priv *iwm, u16 seq_num)
         return NULL;
 }
 
-struct iwm_nonwifi_cmd *
-iwm_get_pending_nonwifi_cmd(struct iwm_priv *iwm, u8 seq_num, u8 cmd_opcode)
+struct iwm_nonwifi_cmd *iwm_get_pending_nonwifi_cmd(struct iwm_priv *iwm,
+                                                    u8 seq_num, u8 cmd_opcode)
 {
-        struct iwm_nonwifi_cmd *cmd, *next;
+        struct iwm_nonwifi_cmd *cmd;
 
-        list_for_each_entry_safe(cmd, next, &iwm->nonwifi_pending_cmd, pending)
+        list_for_each_entry(cmd, &iwm->nonwifi_pending_cmd, pending)
                 if ((cmd->seq_num == seq_num) &&
                     (cmd->udma_cmd.opcode == cmd_opcode) &&
                     (cmd->resp_received)) {
@@ -276,6 +277,7 @@ static int iwm_send_udma_nonwifi_cmd(struct iwm_priv *iwm,
                     udma_cmd->handle_by_hw, cmd->seq_num, udma_cmd->addr,
                     udma_cmd->op1_sz, udma_cmd->op2);
 
+        trace_iwm_tx_nonwifi_cmd(iwm, udma_hdr);
         return iwm_bus_send_chunk(iwm, buf->start, buf->len);
 }
 
@@ -362,6 +364,7 @@ static int iwm_send_udma_wifi_cmd(struct iwm_priv *iwm,
                 return ret;
         }
 
+        trace_iwm_tx_wifi_cmd(iwm, umac_hdr);
         return iwm_bus_send_chunk(iwm, buf->start, buf->len);
 }
 
diff --git a/drivers/net/wireless/iwmc3200wifi/hal.h b/drivers/net/wireless/iwmc3200wifi/hal.h
index 0adfdc85765d..c20936d9b6b7 100644
--- a/drivers/net/wireless/iwmc3200wifi/hal.h
+++ b/drivers/net/wireless/iwmc3200wifi/hal.h
@@ -75,7 +75,8 @@ do {									  \
 
 
 /* UDMA IN OP CODE -- cmd bits [3:0] */
-#define UDMA_IN_OPCODE_MASK                     0xF
+#define UDMA_HDI_IN_NW_CMD_OPCODE_POS           0
+#define UDMA_HDI_IN_NW_CMD_OPCODE_SEED          0xF
 
 #define UDMA_IN_OPCODE_GENERAL_RESP             0x0
 #define UDMA_IN_OPCODE_READ_RESP                0x1
@@ -130,7 +131,7 @@ do {									  \
 #define IWM_MAX_WIFI_CMD_BUFF_SIZE      (IWM_SDIO_FW_MAX_CHUNK_SIZE - \
                                          IWM_MAX_WIFI_HEADERS_SIZE)
 
-#define IWM_HAL_CONCATENATE_BUF_SIZE    8192
+#define IWM_HAL_CONCATENATE_BUF_SIZE    (32 * 1024)
 
 struct iwm_wifi_cmd_buff {
         u16 len;
diff --git a/drivers/net/wireless/iwmc3200wifi/iwm.h b/drivers/net/wireless/iwmc3200wifi/iwm.h
index 79ffa3b98d73..13266c3842f8 100644
--- a/drivers/net/wireless/iwmc3200wifi/iwm.h
+++ b/drivers/net/wireless/iwmc3200wifi/iwm.h
@@ -48,6 +48,7 @@
 #include "umac.h"
 #include "lmac.h"
 #include "eeprom.h"
+#include "trace.h"
 
 #define IWM_COPYRIGHT "Copyright(c) 2009 Intel Corporation"
 #define IWM_AUTHOR "<ilw@linux.intel.com>"
@@ -268,7 +269,9 @@ struct iwm_priv {
 
         struct sk_buff_head rx_list;
         struct list_head rx_tickets;
+        spinlock_t ticket_lock;
         struct list_head rx_packets[IWM_RX_ID_HASH];
+        spinlock_t packet_lock[IWM_RX_ID_HASH];
         struct workqueue_struct *rx_wq;
         struct work_struct rx_worker;
 
diff --git a/drivers/net/wireless/iwmc3200wifi/main.c b/drivers/net/wireless/iwmc3200wifi/main.c
index 7f34d6dd3c41..3a3510a6223a 100644
--- a/drivers/net/wireless/iwmc3200wifi/main.c
+++ b/drivers/net/wireless/iwmc3200wifi/main.c
@@ -276,8 +276,11 @@ int iwm_priv_init(struct iwm_priv *iwm)
 
         skb_queue_head_init(&iwm->rx_list);
         INIT_LIST_HEAD(&iwm->rx_tickets);
-        for (i = 0; i < IWM_RX_ID_HASH; i++)
+        spin_lock_init(&iwm->ticket_lock);
+        for (i = 0; i < IWM_RX_ID_HASH; i++) {
                 INIT_LIST_HEAD(&iwm->rx_packets[i]);
+                spin_lock_init(&iwm->packet_lock[i]);
+        }
 
         INIT_WORK(&iwm->rx_worker, iwm_rx_worker);
 
@@ -423,9 +426,9 @@ int iwm_notif_send(struct iwm_priv *iwm, struct iwm_wifi_cmd *cmd,
 static struct iwm_notif *iwm_notif_find(struct iwm_priv *iwm, u32 cmd,
                                         u8 source)
 {
-        struct iwm_notif *notif, *next;
+        struct iwm_notif *notif;
 
-        list_for_each_entry_safe(notif, next, &iwm->pending_notif, pending) {
+        list_for_each_entry(notif, &iwm->pending_notif, pending) {
                 if ((notif->cmd_id == cmd) && (notif->src == source)) {
                         list_del(&notif->pending);
                         return notif;
diff --git a/drivers/net/wireless/iwmc3200wifi/rx.c b/drivers/net/wireless/iwmc3200wifi/rx.c
index ad8f7eabb5aa..5090a8a61887 100644
--- a/drivers/net/wireless/iwmc3200wifi/rx.c
+++ b/drivers/net/wireless/iwmc3200wifi/rx.c
@@ -342,15 +342,17 @@ static void iwm_rx_ticket_node_free(struct iwm_rx_ticket_node *ticket_node)
 static struct iwm_rx_packet *iwm_rx_packet_get(struct iwm_priv *iwm, u16 id)
 {
         u8 id_hash = IWM_RX_ID_GET_HASH(id);
-        struct list_head *packet_list;
-        struct iwm_rx_packet *packet, *next;
-
-        packet_list = &iwm->rx_packets[id_hash];
+        struct iwm_rx_packet *packet;
 
-        list_for_each_entry_safe(packet, next, packet_list, node)
-                if (packet->id == id)
+        spin_lock(&iwm->packet_lock[id_hash]);
+        list_for_each_entry(packet, &iwm->rx_packets[id_hash], node)
+                if (packet->id == id) {
+                        list_del(&packet->node);
+                        spin_unlock(&iwm->packet_lock[id_hash]);
                         return packet;
+                }
 
+        spin_unlock(&iwm->packet_lock[id_hash]);
         return NULL;
 }
 
@@ -388,18 +390,22 @@ void iwm_rx_free(struct iwm_priv *iwm)
         struct iwm_rx_packet *packet, *np;
         int i;
 
+        spin_lock(&iwm->ticket_lock);
         list_for_each_entry_safe(ticket, nt, &iwm->rx_tickets, node) {
                 list_del(&ticket->node);
                 iwm_rx_ticket_node_free(ticket);
         }
+        spin_unlock(&iwm->ticket_lock);
 
         for (i = 0; i < IWM_RX_ID_HASH; i++) {
+                spin_lock(&iwm->packet_lock[i]);
                 list_for_each_entry_safe(packet, np, &iwm->rx_packets[i],
                                          node) {
                         list_del(&packet->node);
                         kfree_skb(packet->skb);
                         kfree(packet);
                 }
+                spin_unlock(&iwm->packet_lock[i]);
         }
 }
 
@@ -427,7 +433,9 @@ static int iwm_ntf_rx_ticket(struct iwm_priv *iwm, u8 *buf,
                                    ticket->action ==  IWM_RX_TICKET_RELEASE ?
                                    "RELEASE" : "DROP",
                                    ticket->id);
+                        spin_lock(&iwm->ticket_lock);
                         list_add_tail(&ticket_node->node, &iwm->rx_tickets);
+                        spin_unlock(&iwm->ticket_lock);
 
                         /*
                          * We received an Rx ticket, most likely there's
@@ -460,6 +468,7 @@ static int iwm_ntf_rx_packet(struct iwm_priv *iwm, u8 *buf,
         struct iwm_rx_packet *packet;
         u16 id, buf_offset;
         u32 packet_size;
+        u8 id_hash;
 
         IWM_DBG_RX(iwm, DBG, "\n");
 
@@ -477,7 +486,10 @@ static int iwm_ntf_rx_packet(struct iwm_priv *iwm, u8 *buf,
         if (IS_ERR(packet))
                 return PTR_ERR(packet);
 
-        list_add_tail(&packet->node, &iwm->rx_packets[IWM_RX_ID_GET_HASH(id)]);
+        id_hash = IWM_RX_ID_GET_HASH(id);
+        spin_lock(&iwm->packet_lock[id_hash]);
+        list_add_tail(&packet->node, &iwm->rx_packets[id_hash]);
+        spin_unlock(&iwm->packet_lock[id_hash]);
 
         /* We might (unlikely) have received the packet _after_ the ticket */
         queue_work(iwm->rx_wq, &iwm->rx_worker);
@@ -518,6 +530,8 @@ static int iwm_mlme_assoc_complete(struct iwm_priv *iwm, u8 *buf,
                                    unsigned long buf_size,
                                    struct iwm_wifi_cmd *cmd)
 {
+        struct wiphy *wiphy = iwm_to_wiphy(iwm);
+        struct ieee80211_channel *chan;
         struct iwm_umac_notif_assoc_complete *complete =
                 (struct iwm_umac_notif_assoc_complete *)buf;
 
@@ -526,6 +540,18 @@ static int iwm_mlme_assoc_complete(struct iwm_priv *iwm, u8 *buf,
 
         switch (le32_to_cpu(complete->status)) {
         case UMAC_ASSOC_COMPLETE_SUCCESS:
+                chan = ieee80211_get_channel(wiphy,
+                        ieee80211_channel_to_frequency(complete->channel));
+                if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
+                        /* Associated to a unallowed channel, disassociate. */
+                        __iwm_invalidate_mlme_profile(iwm);
+                        IWM_WARN(iwm, "Couldn't associate with %pM due to "
+                                 "channel %d is disabled. Check your local "
+                                 "regulatory setting.\n",
+                                 complete->bssid, complete->channel);
+                        goto failure;
+                }
+
                 set_bit(IWM_STATUS_ASSOCIATED, &iwm->status);
                 memcpy(iwm->bssid, complete->bssid, ETH_ALEN);
                 iwm->channel = complete->channel;
@@ -562,6 +588,7 @@ static int iwm_mlme_assoc_complete(struct iwm_priv *iwm, u8 *buf,
                                         GFP_KERNEL);
                 break;
         case UMAC_ASSOC_COMPLETE_FAILURE:
+ failure:
                 clear_bit(IWM_STATUS_ASSOCIATED, &iwm->status);
                 memset(iwm->bssid, 0, ETH_ALEN);
                 iwm->channel = 0;
@@ -756,7 +783,7 @@ static int iwm_mlme_update_bss_table(struct iwm_priv *iwm, u8 *buf,
                         (struct iwm_umac_notif_bss_info *)buf;
         struct ieee80211_channel *channel;
         struct ieee80211_supported_band *band;
-        struct iwm_bss_info *bss, *next;
+        struct iwm_bss_info *bss;
         s32 signal;
         int freq;
         u16 frame_len = le16_to_cpu(umac_bss->frame_len);
@@ -775,7 +802,7 @@ static int iwm_mlme_update_bss_table(struct iwm_priv *iwm, u8 *buf,
         IWM_DBG_MLME(iwm, DBG, "\tRSSI: %d\n", umac_bss->rssi);
         IWM_DBG_MLME(iwm, DBG, "\tFrame Length: %d\n", frame_len);
 
-        list_for_each_entry_safe(bss, next, &iwm->bss_list, node)
+        list_for_each_entry(bss, &iwm->bss_list, node)
                 if (bss->bss->table_idx == umac_bss->table_idx)
                         break;
 
@@ -842,16 +869,15 @@ static int iwm_mlme_remove_bss(struct iwm_priv *iwm, u8 *buf,
         int i;
 
         for (i = 0; i < le32_to_cpu(bss_rm->count); i++) {
-                table_idx = (le16_to_cpu(bss_rm->entries[i])
-                             & IWM_BSS_REMOVE_INDEX_MSK);
+                table_idx = le16_to_cpu(bss_rm->entries[i]) &
+                            IWM_BSS_REMOVE_INDEX_MSK;
                 list_for_each_entry_safe(bss, next, &iwm->bss_list, node)
                         if (bss->bss->table_idx == cpu_to_le16(table_idx)) {
                                 struct ieee80211_mgmt *mgmt;
 
                                 mgmt = (struct ieee80211_mgmt *)
                                         (bss->bss->frame_buf);
-                                IWM_DBG_MLME(iwm, ERR,
-                                             "BSS removed: %pM\n",
+                                IWM_DBG_MLME(iwm, ERR, "BSS removed: %pM\n",
                                              mgmt->bssid);
                                 list_del(&bss->node);
                                 kfree(bss->bss);
@@ -1223,18 +1249,24 @@ static int iwm_rx_handle_wifi(struct iwm_priv *iwm, u8 *buf,
         u8 source, cmd_id;
         u16 seq_num;
         u32 count;
-        u8 resp;
 
         wifi_hdr = (struct iwm_umac_wifi_in_hdr *)buf;
         cmd_id = wifi_hdr->sw_hdr.cmd.cmd;
-
         source = GET_VAL32(wifi_hdr->hw_hdr.cmd, UMAC_HDI_IN_CMD_SOURCE);
         if (source >= IWM_SRC_NUM) {
                 IWM_CRIT(iwm, "invalid source %d\n", source);
                 return -EINVAL;
         }
 
-        count = (GET_VAL32(wifi_hdr->sw_hdr.meta_data, UMAC_FW_CMD_BYTE_COUNT));
+        if (cmd_id == REPLY_RX_MPDU_CMD)
+                trace_iwm_rx_packet(iwm, buf, buf_size);
+        else if ((cmd_id == UMAC_NOTIFY_OPCODE_RX_TICKET) &&
+                 (source == UMAC_HDI_IN_SOURCE_FW))
+                trace_iwm_rx_ticket(iwm, buf, buf_size);
+        else
+                trace_iwm_rx_wifi_cmd(iwm, wifi_hdr);
+
+        count = GET_VAL32(wifi_hdr->sw_hdr.meta_data, UMAC_FW_CMD_BYTE_COUNT);
         count += sizeof(struct iwm_umac_wifi_in_hdr) -
                  sizeof(struct iwm_dev_cmd_hdr);
         if (count > buf_size) {
@@ -1242,8 +1274,6 @@ static int iwm_rx_handle_wifi(struct iwm_priv *iwm, u8 *buf,
                 return -EINVAL;
         }
 
-        resp = GET_VAL32(wifi_hdr->sw_hdr.meta_data, UMAC_FW_CMD_STATUS);
-
         seq_num = le16_to_cpu(wifi_hdr->sw_hdr.cmd.seq_num);
 
         IWM_DBG_RX(iwm, DBG, "CMD:0x%x, source: 0x%x, seqnum: %d\n",
@@ -1316,8 +1346,9 @@ static int iwm_rx_handle_nonwifi(struct iwm_priv *iwm, u8 *buf,
 {
         u8 seq_num;
         struct iwm_udma_in_hdr *hdr = (struct iwm_udma_in_hdr *)buf;
-        struct iwm_nonwifi_cmd *cmd, *next;
+        struct iwm_nonwifi_cmd *cmd;
 
+        trace_iwm_rx_nonwifi_cmd(iwm, buf, buf_size);
         seq_num = GET_VAL32(hdr->cmd, UDMA_HDI_IN_CMD_NON_WIFI_HW_SEQ_NUM);
 
         /*
@@ -1328,7 +1359,7 @@ static int iwm_rx_handle_nonwifi(struct iwm_priv *iwm, u8 *buf,
          * That means we only support synchronised non wifi command response
          * schemes.
          */
-        list_for_each_entry_safe(cmd, next, &iwm->nonwifi_pending_cmd, pending)
+        list_for_each_entry(cmd, &iwm->nonwifi_pending_cmd, pending)
                 if (cmd->seq_num == seq_num) {
                         cmd->resp_received = 1;
                         cmd->buf.len = buf_size;
@@ -1647,6 +1678,7 @@ void iwm_rx_worker(struct work_struct *work)
          * We stop whenever a ticket is missing its packet, as we're
          * supposed to send the packets in order.
          */
+        spin_lock(&iwm->ticket_lock);
         list_for_each_entry_safe(ticket, next, &iwm->rx_tickets, node) {
                 struct iwm_rx_packet *packet =
                         iwm_rx_packet_get(iwm, le16_to_cpu(ticket->ticket->id));
@@ -1655,12 +1687,12 @@ void iwm_rx_worker(struct work_struct *work)
                         IWM_DBG_RX(iwm, DBG, "Skip rx_work: Wait for ticket %d "
                                    "to be handled first\n",
                                    le16_to_cpu(ticket->ticket->id));
-                        return;
+                        break;
                 }
 
                 list_del(&ticket->node);
-                list_del(&packet->node);
                 iwm_rx_process_packet(iwm, packet, ticket);
         }
+        spin_unlock(&iwm->ticket_lock);
 }
 
diff --git a/drivers/net/wireless/iwmc3200wifi/trace.c b/drivers/net/wireless/iwmc3200wifi/trace.c
new file mode 100644
index 000000000000..904d36f22311
--- /dev/null
+++ b/drivers/net/wireless/iwmc3200wifi/trace.c
@@ -0,0 +1,3 @@
+#include "iwm.h"
+#define CREATE_TRACE_POINTS
+#include "trace.h"
diff --git a/drivers/net/wireless/iwmc3200wifi/trace.h b/drivers/net/wireless/iwmc3200wifi/trace.h
new file mode 100644
index 000000000000..320e54fbb38c
--- /dev/null
+++ b/drivers/net/wireless/iwmc3200wifi/trace.h
@@ -0,0 +1,283 @@
+#if !defined(__IWM_TRACE_H__) || defined(TRACE_HEADER_MULTI_READ)
+#define __IWM_TRACE_H__
+
+#include <linux/tracepoint.h>
+
+#if !defined(CONFIG_IWM_TRACING)
+#undef TRACE_EVENT
+#define TRACE_EVENT(name, proto, ...) \
+static inline void trace_ ## name(proto) {}
+#endif
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM iwm
+
+#define IWM_ENTRY       __array(char, ndev_name, 16)
+#define IWM_ASSIGN      strlcpy(__entry->ndev_name, iwm_to_ndev(iwm)->name, 16)
+#define IWM_PR_FMT      "%s"
+#define IWM_PR_ARG      __entry->ndev_name
+
+TRACE_EVENT(iwm_tx_nonwifi_cmd,
+        TP_PROTO(struct iwm_priv *iwm, struct iwm_udma_out_nonwifi_hdr *hdr),
+
+        TP_ARGS(iwm, hdr),
+
+        TP_STRUCT__entry(
+                IWM_ENTRY
+                __field(u8, opcode)
+                __field(u8, resp)
+                __field(u8, eot)
+                __field(u8, hw)
+                __field(u16, seq)
+                __field(u32, addr)
+                __field(u32, op1)
+                __field(u32, op2)
+        ),
+
+        TP_fast_assign(
+                IWM_ASSIGN;
+                __entry->opcode = GET_VAL32(hdr->cmd, UMAC_HDI_OUT_CMD_OPCODE);
+                __entry->resp = GET_VAL32(hdr->cmd, UDMA_HDI_OUT_NW_CMD_RESP);
+                __entry->eot = GET_VAL32(hdr->cmd, UMAC_HDI_OUT_CMD_EOT);
+                __entry->hw = GET_VAL32(hdr->cmd, UDMA_HDI_OUT_NW_CMD_HANDLE_BY_HW);
+                __entry->seq = GET_VAL32(hdr->cmd, UDMA_HDI_OUT_CMD_NON_WIFI_HW_SEQ_NUM);
+                __entry->addr = le32_to_cpu(hdr->addr);
+                __entry->op1 = le32_to_cpu(hdr->op1_sz);
+                __entry->op2 = le32_to_cpu(hdr->op2);
+        ),
+
+        TP_printk(
+                IWM_PR_FMT " Tx TARGET CMD: opcode 0x%x, resp %d, eot %d, "
+                "hw %d, seq 0x%x, addr 0x%x, op1 0x%x, op2 0x%x",
+                IWM_PR_ARG, __entry->opcode, __entry->resp, __entry->eot,
+                __entry->hw, __entry->seq, __entry->addr, __entry->op1,
+                __entry->op2
+        )
+);
+
+TRACE_EVENT(iwm_tx_wifi_cmd,
+        TP_PROTO(struct iwm_priv *iwm, struct iwm_umac_wifi_out_hdr *hdr),
+
+        TP_ARGS(iwm, hdr),
+
+        TP_STRUCT__entry(
+                IWM_ENTRY
+                __field(u8, opcode)
+                __field(u8, lmac)
+                __field(u8, resp)
+                __field(u8, eot)
+                __field(u8, ra_tid)
+                __field(u8, credit_group)
+                __field(u8, color)
+                __field(u16, seq)
+        ),
+
+        TP_fast_assign(
+                IWM_ASSIGN;
+                __entry->opcode = hdr->sw_hdr.cmd.cmd;
+                __entry->lmac = 0;
+                __entry->seq = hdr->sw_hdr.cmd.seq_num;
+                __entry->resp = GET_VAL8(hdr->sw_hdr.cmd.flags, UMAC_DEV_CMD_FLAGS_RESP_REQ);
+                __entry->color = GET_VAL32(hdr->sw_hdr.meta_data, UMAC_FW_CMD_TX_STA_COLOR);
+                __entry->eot = GET_VAL32(hdr->hw_hdr.cmd, UMAC_HDI_OUT_CMD_EOT);
+                __entry->ra_tid = GET_VAL32(hdr->hw_hdr.meta_data, UMAC_HDI_OUT_RATID);
+                __entry->credit_group = GET_VAL32(hdr->hw_hdr.meta_data, UMAC_HDI_OUT_CREDIT_GRP);
+                if (__entry->opcode == UMAC_CMD_OPCODE_WIFI_PASS_THROUGH ||
+                    __entry->opcode == UMAC_CMD_OPCODE_WIFI_IF_WRAPPER) {
+                        __entry->lmac = 1;
+                        __entry->opcode = ((struct iwm_lmac_hdr *)(hdr + 1))->id;
+                }
+        ),
+
+        TP_printk(
+                IWM_PR_FMT " Tx %cMAC CMD: opcode 0x%x, resp %d, eot %d, "
+                "seq 0x%x, sta_color 0x%x, ra_tid 0x%x, credit_group 0x%x",
+                IWM_PR_ARG, __entry->lmac ? 'L' : 'U', __entry->opcode,
+                __entry->resp, __entry->eot, __entry->seq, __entry->color,
+                __entry->ra_tid, __entry->credit_group
+        )
+);
+
+TRACE_EVENT(iwm_tx_packets,
+        TP_PROTO(struct iwm_priv *iwm, u8 *buf, int len),
+
+        TP_ARGS(iwm, buf, len),
+
+        TP_STRUCT__entry(
+                IWM_ENTRY
+                __field(u8, eot)
+                __field(u8, ra_tid)
+                __field(u8, credit_group)
+                __field(u8, color)
+                __field(u16, seq)
+                __field(u8, npkt)
+                __field(u32, bytes)
+        ),
+
+        TP_fast_assign(
+                struct iwm_umac_wifi_out_hdr *hdr =
+                        (struct iwm_umac_wifi_out_hdr *)buf;
+
+                IWM_ASSIGN;
+                __entry->eot = GET_VAL32(hdr->hw_hdr.cmd, UMAC_HDI_OUT_CMD_EOT);
+                __entry->ra_tid = GET_VAL32(hdr->hw_hdr.meta_data, UMAC_HDI_OUT_RATID);
+                __entry->credit_group = GET_VAL32(hdr->hw_hdr.meta_data, UMAC_HDI_OUT_CREDIT_GRP);
+                __entry->color = GET_VAL32(hdr->sw_hdr.meta_data, UMAC_FW_CMD_TX_STA_COLOR);
+                __entry->seq = hdr->sw_hdr.cmd.seq_num;
+                __entry->npkt = 1;
+                __entry->bytes = len;
+
+                if (!__entry->eot) {
+                        int count;
+                        u8 *ptr = buf;
+
+                        __entry->npkt = 0;
+                        while (ptr < buf + len) {
+                                count = GET_VAL32(hdr->sw_hdr.meta_data,
+                                                  UMAC_FW_CMD_BYTE_COUNT);
+                                ptr += ALIGN(sizeof(*hdr) + count, 16);
+                                hdr = (struct iwm_umac_wifi_out_hdr *)ptr;
+                                __entry->npkt++;
+                        }
+                }
+        ),
+
+        TP_printk(
+                IWM_PR_FMT " Tx %spacket: eot %d, seq 0x%x, sta_color 0x%x, "
+                "ra_tid 0x%x, credit_group 0x%x, embeded_packets %d, %d bytes",
+                IWM_PR_ARG, !__entry->eot ? "concatenated " : "",
+                __entry->eot, __entry->seq, __entry->color, __entry->ra_tid,
+                __entry->credit_group, __entry->npkt, __entry->bytes
+        )
+);
+
+TRACE_EVENT(iwm_rx_nonwifi_cmd,
+        TP_PROTO(struct iwm_priv *iwm, void *buf, int len),
+
+        TP_ARGS(iwm, buf, len),
+
+        TP_STRUCT__entry(
+                IWM_ENTRY
+                __field(u8, opcode)
+                __field(u16, seq)
+                __field(u32, len)
+        ),
+
+        TP_fast_assign(
+                struct iwm_udma_in_hdr *hdr = buf;
+
+                IWM_ASSIGN;
+                __entry->opcode = GET_VAL32(hdr->cmd, UDMA_HDI_IN_NW_CMD_OPCODE);
+                __entry->seq = GET_VAL32(hdr->cmd, UDMA_HDI_IN_CMD_NON_WIFI_HW_SEQ_NUM);
+                __entry->len = len;
+        ),
+
+        TP_printk(
+                IWM_PR_FMT " Rx TARGET RESP: opcode 0x%x, seq 0x%x, len 0x%x",
+                IWM_PR_ARG, __entry->opcode, __entry->seq, __entry->len
+        )
+);
+
+TRACE_EVENT(iwm_rx_wifi_cmd,
+        TP_PROTO(struct iwm_priv *iwm, struct iwm_umac_wifi_in_hdr *hdr),
+
+        TP_ARGS(iwm, hdr),
+
+        TP_STRUCT__entry(
+                IWM_ENTRY
+                __field(u8, cmd)
+                __field(u8, source)
+                __field(u16, seq)
+                __field(u32, count)
+        ),
+
+        TP_fast_assign(
+                IWM_ASSIGN;
+                __entry->cmd = hdr->sw_hdr.cmd.cmd;
+                __entry->source = GET_VAL32(hdr->hw_hdr.cmd, UMAC_HDI_IN_CMD_SOURCE);
+                __entry->count = GET_VAL32(hdr->sw_hdr.meta_data, UMAC_FW_CMD_BYTE_COUNT);
+                __entry->seq = le16_to_cpu(hdr->sw_hdr.cmd.seq_num);
+        ),
+
+        TP_printk(
+                IWM_PR_FMT " Rx %s RESP: cmd 0x%x, seq 0x%x, count 0x%x",
+                IWM_PR_ARG, __entry->source == UMAC_HDI_IN_SOURCE_FHRX ? "LMAC" :
+                __entry->source == UMAC_HDI_IN_SOURCE_FW ? "UMAC" : "UDMA",
+                __entry->cmd, __entry->seq, __entry->count
+        )
+);
+
+#define iwm_ticket_action_symbol                \
+        { IWM_RX_TICKET_DROP, "DROP" },         \
+        { IWM_RX_TICKET_RELEASE, "RELEASE" },   \
+        { IWM_RX_TICKET_SNIFFER, "SNIFFER" },   \
+        { IWM_RX_TICKET_ENQUEUE, "ENQUEUE" }
+
+TRACE_EVENT(iwm_rx_ticket,
+        TP_PROTO(struct iwm_priv *iwm, void *buf, int len),
+
+        TP_ARGS(iwm, buf, len),
+
+        TP_STRUCT__entry(
+                IWM_ENTRY
+                __field(u8, action)
+                __field(u8, reason)
+                __field(u16, id)
+                __field(u16, flags)
+        ),
+
+        TP_fast_assign(
+                struct iwm_rx_ticket *ticket =
+                        ((struct iwm_umac_notif_rx_ticket *)buf)->tickets;
+
+                IWM_ASSIGN;
+                __entry->id = le16_to_cpu(ticket->id);
+                __entry->action = le16_to_cpu(ticket->action);
+                __entry->flags = le16_to_cpu(ticket->flags);
+                __entry->reason = (__entry->flags & IWM_RX_TICKET_DROP_REASON_MSK) >> IWM_RX_TICKET_DROP_REASON_POS;
+        ),
+
+        TP_printk(
+                IWM_PR_FMT " Rx ticket: id 0x%x, action %s, %s 0x%x%s",
+                IWM_PR_ARG, __entry->id,
+                __print_symbolic(__entry->action, iwm_ticket_action_symbol),
+                __entry->reason ? "reason" : "flags",
+                __entry->reason ? __entry->reason : __entry->flags,
+                __entry->flags & IWM_RX_TICKET_AMSDU_MSK ? ", AMSDU frame" : ""
+        )
+);
+
+TRACE_EVENT(iwm_rx_packet,
+        TP_PROTO(struct iwm_priv *iwm, void *buf, int len),
+
+        TP_ARGS(iwm, buf, len),
+
+        TP_STRUCT__entry(
+                IWM_ENTRY
+                __field(u8, source)
+                __field(u16, id)
+                __field(u32, len)
+        ),
+
+        TP_fast_assign(
+                struct iwm_umac_wifi_in_hdr *hdr = buf;
+
+                IWM_ASSIGN;
+                __entry->source = GET_VAL32(hdr->hw_hdr.cmd, UMAC_HDI_IN_CMD_SOURCE);
+                __entry->id = le16_to_cpu(hdr->sw_hdr.cmd.seq_num);
+                __entry->len = len - sizeof(*hdr);
+        ),
+
+        TP_printk(
+                IWM_PR_FMT " Rx %s packet: id 0x%x, %d bytes",
+                IWM_PR_ARG, __entry->source == UMAC_HDI_IN_SOURCE_FHRX ?
+                "LMAC" : "UMAC", __entry->id, __entry->len
+        )
+);
+#endif
+
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE trace
+#include <trace/define_trace.h>
diff --git a/drivers/net/wireless/iwmc3200wifi/tx.c b/drivers/net/wireless/iwmc3200wifi/tx.c
index 55905f02309c..a20b936ae21f 100644
--- a/drivers/net/wireless/iwmc3200wifi/tx.c
+++ b/drivers/net/wireless/iwmc3200wifi/tx.c
@@ -346,6 +346,7 @@ static int iwm_tx_send_concat_packets(struct iwm_priv *iwm,
         /* mark EOP for the last packet */
         iwm_udma_wifi_hdr_set_eop(iwm, txq->concat_ptr, 1);
 
+        trace_iwm_tx_packets(iwm, txq->concat_buf, txq->concat_count);
         ret = iwm_bus_send_chunk(iwm, txq->concat_buf, txq->concat_count);
 
         txq->concat_count = 0;
@@ -450,7 +451,6 @@ void iwm_tx_worker(struct work_struct *work)
 int iwm_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
 {
         struct iwm_priv *iwm = ndev_to_iwm(netdev);
-        struct net_device *ndev = iwm_to_ndev(iwm);
         struct wireless_dev *wdev = iwm_to_wdev(iwm);
         struct iwm_tx_info *tx_info;
         struct iwm_tx_queue *txq;
@@ -517,12 +517,12 @@ int iwm_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
 
         queue_work(iwm->txq[queue].wq, &iwm->txq[queue].worker);
 
-        ndev->stats.tx_packets++;
-        ndev->stats.tx_bytes += skb->len;
+        netdev->stats.tx_packets++;
+        netdev->stats.tx_bytes += skb->len;
         return NETDEV_TX_OK;
 
  drop:
-        ndev->stats.tx_dropped++;
+        netdev->stats.tx_dropped++;
         dev_kfree_skb_any(skb);
         return NETDEV_TX_OK;
 }
diff --git a/drivers/net/wireless/iwmc3200wifi/umac.h b/drivers/net/wireless/iwmc3200wifi/umac.h
index 7f54a145ca65..0cbba3ecc813 100644
--- a/drivers/net/wireless/iwmc3200wifi/umac.h
+++ b/drivers/net/wireless/iwmc3200wifi/umac.h
@@ -362,7 +362,7 @@ struct iwm_udma_out_wifi_hdr {
 #define IWM_RX_TICKET_SPECIAL_SNAP_MSK    0x4
 #define IWM_RX_TICKET_AMSDU_MSK           0x8
 #define IWM_RX_TICKET_DROP_REASON_POS       4
-#define IWM_RX_TICKET_DROP_REASON_MSK (0x1F << RX_TICKET_FLAGS_DROP_REASON_POS)
+#define IWM_RX_TICKET_DROP_REASON_MSK (0x1F << IWM_RX_TICKET_DROP_REASON_POS)
 
 #define IWM_RX_DROP_NO_DROP                          0x0
 #define IWM_RX_DROP_BAD_CRC                          0x1
diff --git a/drivers/net/wireless/libertas/assoc.c b/drivers/net/wireless/libertas/assoc.c
index f03d5e4e59c3..95d3d4c5e08b 100644
--- a/drivers/net/wireless/libertas/assoc.c
+++ b/drivers/net/wireless/libertas/assoc.c
@@ -31,6 +31,9 @@ u8 lbs_bg_rates[MAX_RATES] =
 0x00, 0x00 };
 
 
+static int assoc_helper_wep_keys(struct lbs_private *priv,
+                struct assoc_request *assoc_req);
+
 /**
  *  @brief This function finds common rates between rates and card rates.
  *
@@ -610,7 +613,7 @@ static int lbs_assoc_post(struct lbs_private *priv,
 
         if (status_code) {
                 lbs_mac_event_disconnected(priv);
-                ret = -1;
+                ret = status_code;
                 goto done;
         }
 
@@ -813,7 +816,24 @@ static int lbs_try_associate(struct lbs_private *priv,
                 goto out;
 
         ret = lbs_associate(priv, assoc_req, CMD_802_11_ASSOCIATE);
+        /* If the association fails with current auth mode, let's
+         * try by changing the auth mode
+         */
+        if ((priv->authtype_auto) &&
+                        (ret == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) &&
+                        (assoc_req->secinfo.wep_enabled) &&
+                        (priv->connect_status != LBS_CONNECTED)) {
+                if (priv->secinfo.auth_mode == IW_AUTH_ALG_OPEN_SYSTEM)
+                        priv->secinfo.auth_mode = IW_AUTH_ALG_SHARED_KEY;
+                else
+                        priv->secinfo.auth_mode = IW_AUTH_ALG_OPEN_SYSTEM;
+                if (!assoc_helper_wep_keys(priv, assoc_req))
+                        ret = lbs_associate(priv, assoc_req,
+                                                CMD_802_11_ASSOCIATE);
+        }
 
+        if (ret)
+                ret = -1;
 out:
         lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
         return ret;
diff --git a/drivers/net/wireless/libertas/debugfs.c b/drivers/net/wireless/libertas/debugfs.c
index 587b0cb0088d..9c3c2f82f033 100644
--- a/drivers/net/wireless/libertas/debugfs.c
+++ b/drivers/net/wireless/libertas/debugfs.c
@@ -74,7 +74,7 @@ static ssize_t lbs_getscantable(struct file *file, char __user *userbuf,
                 return -ENOMEM;
 
         pos += snprintf(buf+pos, len-pos,
-                "# | ch  | rssi |       bssid       |   cap    | Qual | SSID \n");
+                "# | ch  | rssi |       bssid       |   cap    | Qual | SSID\n");
 
         mutex_lock(&priv->lock);
         list_for_each_entry (iter_bss, &priv->network_list, list) {
diff --git a/drivers/net/wireless/libertas/dev.h b/drivers/net/wireless/libertas/dev.h
index 6875e1498bd5..a54880e4ad2b 100644
--- a/drivers/net/wireless/libertas/dev.h
+++ b/drivers/net/wireless/libertas/dev.h
@@ -134,6 +134,7 @@ struct lbs_private {
         u8 wpa_ie_len;
         u16 wep_tx_keyidx;
         struct enc_key wep_keys[4];
+        u8 authtype_auto;
 
         /* Wake On LAN */
         uint32_t wol_criteria;
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index 7a73f625273b..33206a98a572 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -34,6 +34,8 @@
 #include <linux/mmc/card.h>
 #include <linux/mmc/sdio_func.h>
 #include <linux/mmc/sdio_ids.h>
+#include <linux/mmc/sdio.h>
+#include <linux/mmc/host.h>
 
 #include "host.h"
 #include "decl.h"
@@ -942,6 +944,7 @@ static int if_sdio_probe(struct sdio_func *func,
         int ret, i;
         unsigned int model;
         struct if_sdio_packet *packet;
+        struct mmc_host *host = func->card->host;
 
         lbs_deb_enter(LBS_DEB_SDIO);
 
@@ -1022,6 +1025,25 @@ static int if_sdio_probe(struct sdio_func *func,
         if (ret)
                 goto disable;
 
+        /* For 1-bit transfers to the 8686 model, we need to enable the
+         * interrupt flag in the CCCR register. Set the MMC_QUIRK_LENIENT_FN0
+         * bit to allow access to non-vendor registers. */
+        if ((card->model == IF_SDIO_MODEL_8686) &&
+            (host->caps & MMC_CAP_SDIO_IRQ) &&
+            (host->ios.bus_width == MMC_BUS_WIDTH_1)) {
+                u8 reg;
+
+                func->card->quirks |= MMC_QUIRK_LENIENT_FN0;
+                reg = sdio_f0_readb(func, SDIO_CCCR_IF, &ret);
+                if (ret)
+                        goto release_int;
+
+                reg |= SDIO_BUS_ECSI;
+                sdio_f0_writeb(func, reg, SDIO_CCCR_IF, &ret);
+                if (ret)
+                        goto release_int;
+        }
+
         card->ioport = sdio_readb(func, IF_SDIO_IOPORT, &ret);
         if (ret)
                 goto release_int;
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index 28a1c9d1627a..3c889f43d909 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -835,6 +835,7 @@ static int lbs_init_adapter(struct lbs_private *priv)
         priv->is_auto_deep_sleep_enabled = 0;
         priv->wakeup_dev_required = 0;
         init_waitqueue_head(&priv->ds_awake_q);
+        priv->authtype_auto = 1;
 
         mutex_init(&priv->lock);
 
diff --git a/drivers/net/wireless/libertas/rx.c b/drivers/net/wireless/libertas/rx.c
index 2daf8ffdb7e1..7a867e31ca5a 100644
--- a/drivers/net/wireless/libertas/rx.c
+++ b/drivers/net/wireless/libertas/rx.c
@@ -38,10 +38,10 @@ static int process_rxed_802_11_packet(struct lbs_private *priv,
         struct sk_buff *skb);
 
 /**
- *  @brief This function computes the avgSNR .
+ *  @brief      This function computes the avgSNR .
  *
- *  @param priv    A pointer to struct lbs_private structure
- *  @return        avgSNR
+ *  @param      priv    A pointer to struct lbs_private structure
+ *  @return     avgSNR
  */
 static u8 lbs_getavgsnr(struct lbs_private *priv)
 {
@@ -56,10 +56,10 @@ static u8 lbs_getavgsnr(struct lbs_private *priv)
 }
 
 /**
- *  @brief This function computes the AvgNF
+ *  @brief      This function computes the AvgNF
  *
- *  @param priv    A pointer to struct lbs_private structure
- *  @return        AvgNF
+ *  @param      priv    A pointer to struct lbs_private structure
+ *  @return     AvgNF
  */
 static u8 lbs_getavgnf(struct lbs_private *priv)
 {
@@ -74,11 +74,11 @@ static u8 lbs_getavgnf(struct lbs_private *priv)
 }
 
 /**
- *  @brief This function save the raw SNR/NF to our internel buffer
+ *  @brief      This function save the raw SNR/NF to our internel buffer
  *
- *  @param priv    A pointer to struct lbs_private structure
- *  @param prxpd   A pointer to rxpd structure of received packet
- *  @return        n/a
+ *  @param      priv    A pointer to struct lbs_private structure
+ *  @param      prxpd   A pointer to rxpd structure of received packet
+ *  @return     n/a
  */
 static void lbs_save_rawSNRNF(struct lbs_private *priv, struct rxpd *p_rx_pd)
 {
@@ -93,11 +93,11 @@ static void lbs_save_rawSNRNF(struct lbs_private *priv, struct rxpd *p_rx_pd)
 }
 
 /**
- *  @brief This function computes the RSSI in received packet.
+ *  @brief      This function computes the RSSI in received packet.
  *
- *  @param priv    A pointer to struct lbs_private structure
- *  @param prxpd   A pointer to rxpd structure of received packet
- *  @return        n/a
+ *  @param      priv    A pointer to struct lbs_private structure
+ *  @param      prxpd   A pointer to rxpd structure of received packet
+ *  @return     n/a
  */
 static void lbs_compute_rssi(struct lbs_private *priv, struct rxpd *p_rx_pd)
 {
@@ -134,9 +134,9 @@ static void lbs_compute_rssi(struct lbs_private *priv, struct rxpd *p_rx_pd)
  *  @brief This function processes received packet and forwards it
  *  to kernel/upper layer
  *
- *  @param priv    A pointer to struct lbs_private
- *  @param skb     A pointer to skb which includes the received packet
- *  @return        0 or -1
+ *  @param      priv    A pointer to struct lbs_private
+ *  @param      skb             A pointer to skb which includes the received packet
+ *  @return     0 or -1
  */
 int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *skb)
 {
@@ -196,7 +196,7 @@ int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *skb)
                  *    before the snap_type.
                  */
                 p_ethhdr = (struct ethhdr *)
-                    ((u8 *) & p_rx_pkt->eth803_hdr
+                    ((u8 *) &p_rx_pkt->eth803_hdr
                      + sizeof(p_rx_pkt->eth803_hdr) + sizeof(p_rx_pkt->rfc1042_hdr)
                      - sizeof(p_rx_pkt->eth803_hdr.dest_addr)
                      - sizeof(p_rx_pkt->eth803_hdr.src_addr)
@@ -213,7 +213,7 @@ int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *skb)
                 hdrchop = (u8 *)p_ethhdr - (u8 *)p_rx_pd;
         } else {
                 lbs_deb_hex(LBS_DEB_RX, "RX Data: LLC/SNAP",
-                        (u8 *) & p_rx_pkt->rfc1042_hdr,
+                        (u8 *) &p_rx_pkt->rfc1042_hdr,
                         sizeof(p_rx_pkt->rfc1042_hdr));
 
                 /* Chop off the rxpd */
@@ -254,8 +254,8 @@ EXPORT_SYMBOL_GPL(lbs_process_rxed_packet);
  *  @brief This function converts Tx/Rx rates from the Marvell WLAN format
  *  (see Table 2 in Section 3.1) to IEEE80211_RADIOTAP_RATE units (500 Kb/s)
  *
- *  @param rate    Input rate
- *  @return        Output Rate (0 if invalid)
+ *  @param      rate    Input rate
+ *  @return     Output Rate (0 if invalid)
  */
 static u8 convert_mv_rate_to_radiotap(u8 rate)
 {
@@ -294,9 +294,9 @@ static u8 convert_mv_rate_to_radiotap(u8 rate)
  *  @brief This function processes a received 802.11 packet and forwards it
  *  to kernel/upper layer
  *
- *  @param priv    A pointer to struct lbs_private
- *  @param skb     A pointer to skb which includes the received packet
- *  @return        0 or -1
+ *  @param      priv    A pointer to struct lbs_private
+ *  @param      skb             A pointer to skb which includes the received packet
+ *  @return     0 or -1
  */
 static int process_rxed_802_11_packet(struct lbs_private *priv,
         struct sk_buff *skb)
@@ -313,7 +313,7 @@ static int process_rxed_802_11_packet(struct lbs_private *priv,
         p_rx_pkt = (struct rx80211packethdr *) skb->data;
         prxpd = &p_rx_pkt->rx_pd;
 
-        // lbs_deb_hex(LBS_DEB_RX, "RX Data: Before chop rxpd", skb->data, min(skb->len, 100));
+        /* lbs_deb_hex(LBS_DEB_RX, "RX Data: Before chop rxpd", skb->data, min(skb->len, 100)); */
 
         if (skb->len < (ETH_HLEN + 8 + sizeof(struct rxpd))) {
                 lbs_deb_rx("rx err: frame received with bad length\n");
diff --git a/drivers/net/wireless/libertas/wext.c b/drivers/net/wireless/libertas/wext.c
index 71f88a08e090..aad6263dee6d 100644
--- a/drivers/net/wireless/libertas/wext.c
+++ b/drivers/net/wireless/libertas/wext.c
@@ -1440,8 +1440,10 @@ static int lbs_set_encode(struct net_device *dev,
                 set_bit(ASSOC_FLAG_WEP_TX_KEYIDX, &assoc_req->flags);
 
         if (dwrq->flags & IW_ENCODE_RESTRICTED) {
+                priv->authtype_auto = 0;
                 assoc_req->secinfo.auth_mode = IW_AUTH_ALG_SHARED_KEY;
         } else if (dwrq->flags & IW_ENCODE_OPEN) {
+                priv->authtype_auto = 0;
                 assoc_req->secinfo.auth_mode = IW_AUTH_ALG_OPEN_SYSTEM;
         }
 
@@ -1620,8 +1622,10 @@ static int lbs_set_encodeext(struct net_device *dev,
                         goto out;
 
                 if (dwrq->flags & IW_ENCODE_RESTRICTED) {
+                        priv->authtype_auto = 0;
                         assoc_req->secinfo.auth_mode = IW_AUTH_ALG_SHARED_KEY;
                 } else if (dwrq->flags & IW_ENCODE_OPEN) {
+                        priv->authtype_auto = 0;
                         assoc_req->secinfo.auth_mode = IW_AUTH_ALG_OPEN_SYSTEM;
                 }
 
diff --git a/drivers/net/wireless/orinoco/Kconfig b/drivers/net/wireless/orinoco/Kconfig
index e2a2c18920aa..6116b546861d 100644
--- a/drivers/net/wireless/orinoco/Kconfig
+++ b/drivers/net/wireless/orinoco/Kconfig
@@ -27,6 +27,17 @@ config HERMES
           configure your card and that /etc/pcmcia/wireless.opts works :
           <http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Tools.html>
 
+config HERMES_PRISM
+        bool "Support Prism 2/2.5 chipset"
+        depends on HERMES
+        ---help---
+
+          Say Y to enable support for Prism 2 and 2.5 chipsets.  These
+          chipsets are better handled by the hostap driver.  This driver
+          would not support WPA or firmware download for Prism chipset.
+
+          If you are not sure, say N.
+
 config HERMES_CACHE_FW_ON_INIT
         bool "Cache Hermes firmware on driver initialisation"
         depends on HERMES
@@ -86,7 +97,7 @@ config NORTEL_HERMES
 
 config PCI_HERMES
         tristate "Prism 2.5 PCI 802.11b adaptor support"
-        depends on PCI && HERMES
+        depends on PCI && HERMES && HERMES_PRISM
         help
           Enable support for PCI and mini-PCI 802.11b wireless NICs based on
           the Prism 2.5 chipset.  These are true PCI cards, not the 802.11b
diff --git a/drivers/net/wireless/orinoco/hw.c b/drivers/net/wireless/orinoco/hw.c
index e6369242e49c..883b8f868626 100644
--- a/drivers/net/wireless/orinoco/hw.c
+++ b/drivers/net/wireless/orinoco/hw.c
@@ -262,6 +262,13 @@ int determine_fw_capabilities(struct orinoco_private *priv,
         if (fw_name)
                 dev_info(dev, "Firmware determined as %s\n", fw_name);
 
+#ifndef CONFIG_HERMES_PRISM
+        if (priv->firmware_type == FIRMWARE_TYPE_INTERSIL) {
+                dev_err(dev, "Support for Prism chipset is not enabled\n");
+                return -ENODEV;
+        }
+#endif
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/orinoco/orinoco_cs.c b/drivers/net/wireless/orinoco/orinoco_cs.c
index 1d4ada188eda..fdc961379170 100644
--- a/drivers/net/wireless/orinoco/orinoco_cs.c
+++ b/drivers/net/wireless/orinoco/orinoco_cs.c
@@ -374,87 +374,90 @@ static char version[] __initdata = DRIVER_NAME " " DRIVER_VERSION
         "Pavel Roskin <proski@gnu.org>, et al)";
 
 static struct pcmcia_device_id orinoco_cs_ids[] = {
-        PCMCIA_DEVICE_MANF_CARD(0x000b, 0x7100), /* SonicWALL Long Range Wireless Card */
-        PCMCIA_DEVICE_MANF_CARD(0x000b, 0x7300), /* Sohoware NCP110, Philips 802.11b */
-        PCMCIA_DEVICE_MANF_CARD(0x0089, 0x0002), /* AnyPoint(TM) Wireless II PC Card */
         PCMCIA_DEVICE_MANF_CARD(0x0101, 0x0777), /* 3Com AirConnect PCI 777A */
-        PCMCIA_DEVICE_MANF_CARD(0x0126, 0x8000), /* PROXIM RangeLAN-DS/LAN PC CARD */
-        PCMCIA_DEVICE_MANF_CARD(0x0138, 0x0002), /* Compaq WL100 11 Mbps Wireless Adapter */
         PCMCIA_DEVICE_MANF_CARD(0x0156, 0x0002), /* Lucent Orinoco and old Intersil */
         PCMCIA_DEVICE_MANF_CARD(0x016b, 0x0001), /* Ericsson WLAN Card C11 */
         PCMCIA_DEVICE_MANF_CARD(0x01eb, 0x080a), /* Nortel Networks eMobility 802.11 Wireless Adapter */
-        PCMCIA_DEVICE_MANF_CARD(0x01ff, 0x0008), /* Intermec MobileLAN 11Mbps 802.11b WLAN Card */
-        PCMCIA_DEVICE_MANF_CARD(0x0250, 0x0002), /* Samsung SWL2000-N 11Mb/s WLAN Card */
         PCMCIA_DEVICE_MANF_CARD(0x0261, 0x0002), /* AirWay 802.11 Adapter (PCMCIA) */
         PCMCIA_DEVICE_MANF_CARD(0x0268, 0x0001), /* ARtem Onair */
         PCMCIA_DEVICE_MANF_CARD(0x0268, 0x0003), /* ARtem Onair Comcard 11 */
         PCMCIA_DEVICE_MANF_CARD(0x026f, 0x0305), /* Buffalo WLI-PCM-S11 */
-        PCMCIA_DEVICE_MANF_CARD(0x0274, 0x1612), /* Linksys WPC11 Version 2.5 */
-        PCMCIA_DEVICE_MANF_CARD(0x0274, 0x1613), /* Linksys WPC11 Version 3 */
-        PCMCIA_DEVICE_MANF_CARD(0x028a, 0x0002), /* Compaq HNW-100 11 Mbps Wireless Adapter */
-        PCMCIA_DEVICE_MANF_CARD(0x028a, 0x0673), /* Linksys WCF12 Wireless CompactFlash Card */
         PCMCIA_DEVICE_MANF_CARD(0x02aa, 0x0002), /* ASUS SpaceLink WL-100 */
         PCMCIA_DEVICE_MANF_CARD(0x02ac, 0x0002), /* SpeedStream SS1021 Wireless Adapter */
         PCMCIA_DEVICE_MANF_CARD(0x02ac, 0x3021), /* SpeedStream Wireless Adapter */
         PCMCIA_DEVICE_MANF_CARD(0x14ea, 0xb001), /* PLANEX RoadLannerWave GW-NS11H */
+        PCMCIA_DEVICE_PROD_ID12("3Com", "3CRWE737A AirConnect Wireless LAN PC Card", 0x41240e5b, 0x56010af3),
+        PCMCIA_DEVICE_PROD_ID12("Allied Telesyn", "AT-WCL452 Wireless PCMCIA Radio", 0x5cd01705, 0x4271660f),
+        PCMCIA_DEVICE_PROD_ID12("ASUS", "802_11B_CF_CARD_25", 0x78fc06ee, 0x45a50c1e),
+        PCMCIA_DEVICE_PROD_ID12("ASUS", "802_11b_PC_CARD_25", 0x78fc06ee, 0xdb9aa842),
+        PCMCIA_DEVICE_PROD_ID12("Avaya Communication", "Avaya Wireless PC Card", 0xd8a43b78, 0x0d341169),
+        PCMCIA_DEVICE_PROD_ID12("BENQ", "AWL100 PCMCIA ADAPTER", 0x35dadc74, 0x01f7fedb),
+        PCMCIA_DEVICE_PROD_ID12("Cabletron", "RoamAbout 802.11 DS", 0x32d445f5, 0xedeffd90),
+        PCMCIA_DEVICE_PROD_ID12("D-Link Corporation", "D-Link DWL-650H 11Mbps WLAN Adapter", 0xef544d24, 0xcd8ea916),
+        PCMCIA_DEVICE_PROD_ID12("ELSA", "AirLancer MC-11", 0x4507a33a, 0xef54f0e3),
+        PCMCIA_DEVICE_PROD_ID12("HyperLink", "Wireless PC Card 11Mbps", 0x56cc3f1a, 0x0bcf220c),
+        PCMCIA_DEVICE_PROD_ID12("Intel", "PRO/Wireless 2011 LAN PC Card", 0x816cc815, 0x07f58077),
+        PCMCIA_DEVICE_PROD_ID12("LeArtery", "SYNCBYAIR 11Mbps Wireless LAN PC Card", 0x7e3b326a, 0x49893e92),
+        PCMCIA_DEVICE_PROD_ID12("Lucent Technologies", "WaveLAN/IEEE", 0x23eb9949, 0xc562e72a),
+        PCMCIA_DEVICE_PROD_ID12("MELCO", "WLI-PCM-L11", 0x481e0094, 0x7360e410),
+        PCMCIA_DEVICE_PROD_ID12("MELCO", "WLI-PCM-L11G", 0x481e0094, 0xf57ca4b3),
+        PCMCIA_DEVICE_PROD_ID12("NCR", "WaveLAN/IEEE", 0x24358cd4, 0xc562e72a),
+        PCMCIA_DEVICE_PROD_ID12("Nortel Networks", "emobility 802.11 Wireless LAN PC Card", 0x2d617ea0, 0x88cd5767),
+        PCMCIA_DEVICE_PROD_ID12("OTC", "Wireless AirEZY 2411-PCC WLAN Card", 0x4ac44287, 0x235a6bed),
+        PCMCIA_DEVICE_PROD_ID12("PROXIM", "LAN PC CARD HARMONY 80211B", 0xc6536a5e, 0x090c3cd9),
+        PCMCIA_DEVICE_PROD_ID12("PROXIM", "LAN PCI CARD HARMONY 80211B", 0xc6536a5e, 0x9f494e26),
+        PCMCIA_DEVICE_PROD_ID12("SAMSUNG", "11Mbps WLAN Card", 0x43d74cb4, 0x579bd91b),
+        PCMCIA_DEVICE_PROD_ID12("Symbol Technologies", "LA4111 Spectrum24 Wireless LAN PC Card", 0x3f02b4d6, 0x3663cb0e),
+#ifdef CONFIG_HERMES_PRISM
+        /* Only entries that certainly identify Prism chipset */
+        PCMCIA_DEVICE_MANF_CARD(0x000b, 0x7100), /* SonicWALL Long Range Wireless Card */
+        PCMCIA_DEVICE_MANF_CARD(0x000b, 0x7300), /* Sohoware NCP110, Philips 802.11b */
+        PCMCIA_DEVICE_MANF_CARD(0x0089, 0x0002), /* AnyPoint(TM) Wireless II PC Card */
+        PCMCIA_DEVICE_MANF_CARD(0x0126, 0x8000), /* PROXIM RangeLAN-DS/LAN PC CARD */
+        PCMCIA_DEVICE_MANF_CARD(0x0138, 0x0002), /* Compaq WL100 11 Mbps Wireless Adapter */
+        PCMCIA_DEVICE_MANF_CARD(0x01ff, 0x0008), /* Intermec MobileLAN 11Mbps 802.11b WLAN Card */
+        PCMCIA_DEVICE_MANF_CARD(0x0250, 0x0002), /* Samsung SWL2000-N 11Mb/s WLAN Card */
+        PCMCIA_DEVICE_MANF_CARD(0x0274, 0x1612), /* Linksys WPC11 Version 2.5 */
+        PCMCIA_DEVICE_MANF_CARD(0x0274, 0x1613), /* Linksys WPC11 Version 3 */
+        PCMCIA_DEVICE_MANF_CARD(0x028a, 0x0002), /* Compaq HNW-100 11 Mbps Wireless Adapter */
+        PCMCIA_DEVICE_MANF_CARD(0x028a, 0x0673), /* Linksys WCF12 Wireless CompactFlash Card */
         PCMCIA_DEVICE_MANF_CARD(0x50c2, 0x7300), /* Airvast WN-100 */
         PCMCIA_DEVICE_MANF_CARD(0x9005, 0x0021), /* Adaptec Ultra Wireless ANW-8030 */
         PCMCIA_DEVICE_MANF_CARD(0xc001, 0x0008), /* CONTEC FLEXSCAN/FX-DDS110-PCC */
         PCMCIA_DEVICE_MANF_CARD(0xc250, 0x0002), /* Conceptronic CON11Cpro, EMTAC A2424i */
         PCMCIA_DEVICE_MANF_CARD(0xd601, 0x0002), /* Safeway 802.11b, ZCOMAX AirRunner/XI-300 */
         PCMCIA_DEVICE_MANF_CARD(0xd601, 0x0005), /* D-Link DCF660, Sandisk Connect SDWCFB-000 */
-        PCMCIA_DEVICE_PROD_ID12(" ", "IEEE 802.11 Wireless LAN/PC Card", 0x3b6e20c8, 0xefccafe9),
-        PCMCIA_DEVICE_PROD_ID12("3Com", "3CRWE737A AirConnect Wireless LAN PC Card", 0x41240e5b, 0x56010af3),
+        PCMCIA_DEVICE_PROD_ID123("Instant Wireless ", " Network PC CARD", "Version 01.02", 0x11d901af, 0x6e9bd926, 0x4b74baa0),
         PCMCIA_DEVICE_PROD_ID12("ACTIONTEC", "PRISM Wireless LAN PC Card", 0x393089da, 0xa71e69d5),
         PCMCIA_DEVICE_PROD_ID12("Addtron", "AWP-100 Wireless PCMCIA", 0xe6ec52ce, 0x08649af2),
-        PCMCIA_DEVICE_PROD_ID12("Allied Telesyn", "AT-WCL452 Wireless PCMCIA Radio", 0x5cd01705, 0x4271660f),
-        PCMCIA_DEVICE_PROD_ID12("ASUS", "802_11b_PC_CARD_25", 0x78fc06ee, 0xdb9aa842),
-        PCMCIA_DEVICE_PROD_ID12("ASUS", "802_11B_CF_CARD_25", 0x78fc06ee, 0x45a50c1e),
-        PCMCIA_DEVICE_PROD_ID12("Avaya Communication", "Avaya Wireless PC Card", 0xd8a43b78, 0x0d341169),
-        PCMCIA_DEVICE_PROD_ID12("BENQ", "AWL100 PCMCIA ADAPTER", 0x35dadc74, 0x01f7fedb),
-        PCMCIA_DEVICE_PROD_ID12("BUFFALO", "WLI-PCM-L11G", 0x2decece3, 0xf57ca4b3),
         PCMCIA_DEVICE_PROD_ID12("BUFFALO", "WLI-CF-S11G", 0x2decece3, 0x82067c18),
-        PCMCIA_DEVICE_PROD_ID12("Cabletron", "RoamAbout 802.11 DS", 0x32d445f5, 0xedeffd90),
+        PCMCIA_DEVICE_PROD_ID12("BUFFALO", "WLI-PCM-L11G", 0x2decece3, 0xf57ca4b3),
         PCMCIA_DEVICE_PROD_ID12("Compaq", "WL200_11Mbps_Wireless_PCI_Card", 0x54f7c49c, 0x15a75e5b),
         PCMCIA_DEVICE_PROD_ID12("corega K.K.", "Wireless LAN PCC-11", 0x5261440f, 0xa6405584),
         PCMCIA_DEVICE_PROD_ID12("corega K.K.", "Wireless LAN PCCA-11", 0x5261440f, 0xdf6115f9),
         PCMCIA_DEVICE_PROD_ID12("corega_K.K.", "Wireless_LAN_PCCB-11", 0x29e33311, 0xee7a27ae),
+        PCMCIA_DEVICE_PROD_ID12("Digital Data Communications", "WPC-0100", 0xfdd73470, 0xe0b6f146),
         PCMCIA_DEVICE_PROD_ID12("D", "Link DRC-650 11Mbps WLAN Card", 0x71b18589, 0xf144e3ac),
         PCMCIA_DEVICE_PROD_ID12("D", "Link DWL-650 11Mbps WLAN Card", 0x71b18589, 0xb6f1b0ab),
-        PCMCIA_DEVICE_PROD_ID12("D-Link Corporation", "D-Link DWL-650H 11Mbps WLAN Adapter", 0xef544d24, 0xcd8ea916),
-        PCMCIA_DEVICE_PROD_ID12("Digital Data Communications", "WPC-0100", 0xfdd73470, 0xe0b6f146),
-        PCMCIA_DEVICE_PROD_ID12("ELSA", "AirLancer MC-11", 0x4507a33a, 0xef54f0e3),
-        PCMCIA_DEVICE_PROD_ID12("HyperLink", "Wireless PC Card 11Mbps", 0x56cc3f1a, 0x0bcf220c),
-        PCMCIA_DEVICE_PROD_ID123("Instant Wireless ", " Network PC CARD", "Version 01.02", 0x11d901af, 0x6e9bd926, 0x4b74baa0),
-        PCMCIA_DEVICE_PROD_ID12("Intel", "PRO/Wireless 2011 LAN PC Card", 0x816cc815, 0x07f58077),
+        PCMCIA_DEVICE_PROD_ID12(" ", "IEEE 802.11 Wireless LAN/PC Card", 0x3b6e20c8, 0xefccafe9),
         PCMCIA_DEVICE_PROD_ID12("INTERSIL", "HFA384x/IEEE", 0x74c5e40d, 0xdb472a18),
         PCMCIA_DEVICE_PROD_ID12("INTERSIL", "I-GATE 11M PC Card / PC Card plus", 0x74c5e40d, 0x8304ff77),
         PCMCIA_DEVICE_PROD_ID12("Intersil", "PRISM 2_5 PCMCIA ADAPTER", 0x4b801a17, 0x6345a0bf),
-        PCMCIA_DEVICE_PROD_ID12("LeArtery", "SYNCBYAIR 11Mbps Wireless LAN PC Card", 0x7e3b326a, 0x49893e92),
         PCMCIA_DEVICE_PROD_ID12("Linksys", "Wireless CompactFlash Card", 0x0733cc81, 0x0c52f395),
-        PCMCIA_DEVICE_PROD_ID12("Lucent Technologies", "WaveLAN/IEEE", 0x23eb9949, 0xc562e72a),
-        PCMCIA_DEVICE_PROD_ID12("MELCO", "WLI-PCM-L11", 0x481e0094, 0x7360e410),
-        PCMCIA_DEVICE_PROD_ID12("MELCO", "WLI-PCM-L11G", 0x481e0094, 0xf57ca4b3),
         PCMCIA_DEVICE_PROD_ID12("Microsoft", "Wireless Notebook Adapter MN-520", 0x5961bf85, 0x6eec8c01),
-        PCMCIA_DEVICE_PROD_ID12("NCR", "WaveLAN/IEEE", 0x24358cd4, 0xc562e72a),
-        PCMCIA_DEVICE_PROD_ID12("NETGEAR MA401 Wireless PC", "Card", 0xa37434e9, 0x9762e8f1),
         PCMCIA_DEVICE_PROD_ID12("NETGEAR MA401RA Wireless PC", "Card", 0x0306467f, 0x9762e8f1),
-        PCMCIA_DEVICE_PROD_ID12("Nortel Networks", "emobility 802.11 Wireless LAN PC Card", 0x2d617ea0, 0x88cd5767),
+        PCMCIA_DEVICE_PROD_ID12("NETGEAR MA401 Wireless PC", "Card", 0xa37434e9, 0x9762e8f1),
         PCMCIA_DEVICE_PROD_ID12("OEM", "PRISM2 IEEE 802.11 PC-Card", 0xfea54c90, 0x48f2bdd6),
-        PCMCIA_DEVICE_PROD_ID12("OTC", "Wireless AirEZY 2411-PCC WLAN Card", 0x4ac44287, 0x235a6bed),
         PCMCIA_DEVICE_PROD_ID12("PLANEX", "GeoWave/GW-CF110", 0x209f40ab, 0xd9715264),
         PCMCIA_DEVICE_PROD_ID12("PLANEX", "GeoWave/GW-NS110", 0x209f40ab, 0x46263178),
-        PCMCIA_DEVICE_PROD_ID12("PROXIM", "LAN PC CARD HARMONY 80211B", 0xc6536a5e, 0x090c3cd9),
-        PCMCIA_DEVICE_PROD_ID12("PROXIM", "LAN PCI CARD HARMONY 80211B", 0xc6536a5e, 0x9f494e26),
-        PCMCIA_DEVICE_PROD_ID12("SAMSUNG", "11Mbps WLAN Card", 0x43d74cb4, 0x579bd91b),
         PCMCIA_DEVICE_PROD_ID12("SMC", "SMC2532W-B EliteConnect Wireless Adapter", 0xc4f8b18b, 0x196bd757),
         PCMCIA_DEVICE_PROD_ID12("SMC", "SMC2632W", 0xc4f8b18b, 0x474a1f2a),
-        PCMCIA_DEVICE_PROD_ID12("Symbol Technologies", "LA4111 Spectrum24 Wireless LAN PC Card", 0x3f02b4d6, 0x3663cb0e),
         PCMCIA_DEVICE_PROD_ID12("ZoomAir 11Mbps High", "Rate wireless Networking", 0x273fe3db, 0x32a1eaee),
         PCMCIA_DEVICE_PROD_ID3("HFA3863", 0x355cb092),
         PCMCIA_DEVICE_PROD_ID3("ISL37100P", 0x630d52b2),
         PCMCIA_DEVICE_PROD_ID3("ISL37101P-10", 0xdd97a26b),
         PCMCIA_DEVICE_PROD_ID3("ISL37300P", 0xc9049a39),
+#endif
         PCMCIA_DEVICE_NULL,
 };
 MODULE_DEVICE_TABLE(pcmcia, orinoco_cs_ids);
diff --git a/drivers/net/wireless/orinoco/wext.c b/drivers/net/wireless/orinoco/wext.c
index 31ca241f7753..29f9bc03190a 100644
--- a/drivers/net/wireless/orinoco/wext.c
+++ b/drivers/net/wireless/orinoco/wext.c
@@ -1505,46 +1505,44 @@ static const struct iw_priv_args orinoco_privtab[] = {
  * Structures to export the Wireless Handlers
  */
 
-#define STD_IW_HANDLER(id, func) \
-        [IW_IOCTL_IDX(id)] = (iw_handler) func
 static const iw_handler orinoco_handler[] = {
-        STD_IW_HANDLER(SIOCSIWCOMMIT,   orinoco_ioctl_commit),
-        STD_IW_HANDLER(SIOCGIWNAME,     cfg80211_wext_giwname),
-        STD_IW_HANDLER(SIOCSIWFREQ,     orinoco_ioctl_setfreq),
-        STD_IW_HANDLER(SIOCGIWFREQ,     orinoco_ioctl_getfreq),
-        STD_IW_HANDLER(SIOCSIWMODE,     cfg80211_wext_siwmode),
-        STD_IW_HANDLER(SIOCGIWMODE,     cfg80211_wext_giwmode),
-        STD_IW_HANDLER(SIOCSIWSENS,     orinoco_ioctl_setsens),
-        STD_IW_HANDLER(SIOCGIWSENS,     orinoco_ioctl_getsens),
-        STD_IW_HANDLER(SIOCGIWRANGE,    cfg80211_wext_giwrange),
-        STD_IW_HANDLER(SIOCSIWSPY,      iw_handler_set_spy),
-        STD_IW_HANDLER(SIOCGIWSPY,      iw_handler_get_spy),
-        STD_IW_HANDLER(SIOCSIWTHRSPY,   iw_handler_set_thrspy),
-        STD_IW_HANDLER(SIOCGIWTHRSPY,   iw_handler_get_thrspy),
-        STD_IW_HANDLER(SIOCSIWAP,       orinoco_ioctl_setwap),
-        STD_IW_HANDLER(SIOCGIWAP,       orinoco_ioctl_getwap),
-        STD_IW_HANDLER(SIOCSIWSCAN,     cfg80211_wext_siwscan),
-        STD_IW_HANDLER(SIOCGIWSCAN,     cfg80211_wext_giwscan),
-        STD_IW_HANDLER(SIOCSIWESSID,    orinoco_ioctl_setessid),
-        STD_IW_HANDLER(SIOCGIWESSID,    orinoco_ioctl_getessid),
-        STD_IW_HANDLER(SIOCSIWRATE,     orinoco_ioctl_setrate),
-        STD_IW_HANDLER(SIOCGIWRATE,     orinoco_ioctl_getrate),
-        STD_IW_HANDLER(SIOCSIWRTS,      orinoco_ioctl_setrts),
-        STD_IW_HANDLER(SIOCGIWRTS,      orinoco_ioctl_getrts),
-        STD_IW_HANDLER(SIOCSIWFRAG,     orinoco_ioctl_setfrag),
-        STD_IW_HANDLER(SIOCGIWFRAG,     orinoco_ioctl_getfrag),
-        STD_IW_HANDLER(SIOCGIWRETRY,    orinoco_ioctl_getretry),
-        STD_IW_HANDLER(SIOCSIWENCODE,   orinoco_ioctl_setiwencode),
-        STD_IW_HANDLER(SIOCGIWENCODE,   orinoco_ioctl_getiwencode),
-        STD_IW_HANDLER(SIOCSIWPOWER,    orinoco_ioctl_setpower),
-        STD_IW_HANDLER(SIOCGIWPOWER,    orinoco_ioctl_getpower),
-        STD_IW_HANDLER(SIOCSIWGENIE,    orinoco_ioctl_set_genie),
-        STD_IW_HANDLER(SIOCGIWGENIE,    orinoco_ioctl_get_genie),
-        STD_IW_HANDLER(SIOCSIWMLME,     orinoco_ioctl_set_mlme),
-        STD_IW_HANDLER(SIOCSIWAUTH,     orinoco_ioctl_set_auth),
-        STD_IW_HANDLER(SIOCGIWAUTH,     orinoco_ioctl_get_auth),
-        STD_IW_HANDLER(SIOCSIWENCODEEXT, orinoco_ioctl_set_encodeext),
-        STD_IW_HANDLER(SIOCGIWENCODEEXT, orinoco_ioctl_get_encodeext),
+        IW_HANDLER(SIOCSIWCOMMIT,       (iw_handler)orinoco_ioctl_commit),
+        IW_HANDLER(SIOCGIWNAME,         (iw_handler)cfg80211_wext_giwname),
+        IW_HANDLER(SIOCSIWFREQ,         (iw_handler)orinoco_ioctl_setfreq),
+        IW_HANDLER(SIOCGIWFREQ,         (iw_handler)orinoco_ioctl_getfreq),
+        IW_HANDLER(SIOCSIWMODE,         (iw_handler)cfg80211_wext_siwmode),
+        IW_HANDLER(SIOCGIWMODE,         (iw_handler)cfg80211_wext_giwmode),
+        IW_HANDLER(SIOCSIWSENS,         (iw_handler)orinoco_ioctl_setsens),
+        IW_HANDLER(SIOCGIWSENS,         (iw_handler)orinoco_ioctl_getsens),
+        IW_HANDLER(SIOCGIWRANGE,        (iw_handler)cfg80211_wext_giwrange),
+        IW_HANDLER(SIOCSIWSPY,          iw_handler_set_spy),
+        IW_HANDLER(SIOCGIWSPY,          iw_handler_get_spy),
+        IW_HANDLER(SIOCSIWTHRSPY,       iw_handler_set_thrspy),
+        IW_HANDLER(SIOCGIWTHRSPY,       iw_handler_get_thrspy),
+        IW_HANDLER(SIOCSIWAP,           (iw_handler)orinoco_ioctl_setwap),
+        IW_HANDLER(SIOCGIWAP,           (iw_handler)orinoco_ioctl_getwap),
+        IW_HANDLER(SIOCSIWSCAN,         (iw_handler)cfg80211_wext_siwscan),
+        IW_HANDLER(SIOCGIWSCAN,         (iw_handler)cfg80211_wext_giwscan),
+        IW_HANDLER(SIOCSIWESSID,        (iw_handler)orinoco_ioctl_setessid),
+        IW_HANDLER(SIOCGIWESSID,        (iw_handler)orinoco_ioctl_getessid),
+        IW_HANDLER(SIOCSIWRATE,         (iw_handler)orinoco_ioctl_setrate),
+        IW_HANDLER(SIOCGIWRATE,         (iw_handler)orinoco_ioctl_getrate),
+        IW_HANDLER(SIOCSIWRTS,          (iw_handler)orinoco_ioctl_setrts),
+        IW_HANDLER(SIOCGIWRTS,          (iw_handler)orinoco_ioctl_getrts),
+        IW_HANDLER(SIOCSIWFRAG,         (iw_handler)orinoco_ioctl_setfrag),
+        IW_HANDLER(SIOCGIWFRAG,         (iw_handler)orinoco_ioctl_getfrag),
+        IW_HANDLER(SIOCGIWRETRY,        (iw_handler)orinoco_ioctl_getretry),
+        IW_HANDLER(SIOCSIWENCODE,       (iw_handler)orinoco_ioctl_setiwencode),
+        IW_HANDLER(SIOCGIWENCODE,       (iw_handler)orinoco_ioctl_getiwencode),
+        IW_HANDLER(SIOCSIWPOWER,        (iw_handler)orinoco_ioctl_setpower),
+        IW_HANDLER(SIOCGIWPOWER,        (iw_handler)orinoco_ioctl_getpower),
+        IW_HANDLER(SIOCSIWGENIE,        orinoco_ioctl_set_genie),
+        IW_HANDLER(SIOCGIWGENIE,        orinoco_ioctl_get_genie),
+        IW_HANDLER(SIOCSIWMLME,         orinoco_ioctl_set_mlme),
+        IW_HANDLER(SIOCSIWAUTH,         orinoco_ioctl_set_auth),
+        IW_HANDLER(SIOCGIWAUTH,         orinoco_ioctl_get_auth),
+        IW_HANDLER(SIOCSIWENCODEEXT,    orinoco_ioctl_set_encodeext),
+        IW_HANDLER(SIOCGIWENCODEEXT,    orinoco_ioctl_get_encodeext),
 };
 
 
@@ -1552,15 +1550,15 @@ static const iw_handler	orinoco_handler[] = {
   Added typecasting since we no longer use iwreq_data -- Moustafa
  */
 static const iw_handler orinoco_private_handler[] = {
-        [0] = (iw_handler) orinoco_ioctl_reset,
-        [1] = (iw_handler) orinoco_ioctl_reset,
-        [2] = (iw_handler) orinoco_ioctl_setport3,
-        [3] = (iw_handler) orinoco_ioctl_getport3,
-        [4] = (iw_handler) orinoco_ioctl_setpreamble,
-        [5] = (iw_handler) orinoco_ioctl_getpreamble,
-        [6] = (iw_handler) orinoco_ioctl_setibssport,
-        [7] = (iw_handler) orinoco_ioctl_getibssport,
-        [9] = (iw_handler) orinoco_ioctl_getrid,
+        [0] = (iw_handler)orinoco_ioctl_reset,
+        [1] = (iw_handler)orinoco_ioctl_reset,
+        [2] = (iw_handler)orinoco_ioctl_setport3,
+        [3] = (iw_handler)orinoco_ioctl_getport3,
+        [4] = (iw_handler)orinoco_ioctl_setpreamble,
+        [5] = (iw_handler)orinoco_ioctl_getpreamble,
+        [6] = (iw_handler)orinoco_ioctl_setibssport,
+        [7] = (iw_handler)orinoco_ioctl_getibssport,
+        [9] = (iw_handler)orinoco_ioctl_getrid,
 };
 
 const struct iw_handler_def orinoco_handler_def = {
diff --git a/drivers/net/wireless/p54/main.c b/drivers/net/wireless/p54/main.c
index 4f752a21495f..36f4c820ad01 100644
--- a/drivers/net/wireless/p54/main.c
+++ b/drivers/net/wireless/p54/main.c
@@ -545,6 +545,7 @@ struct ieee80211_hw *p54_init_common(size_t priv_data_len)
                      IEEE80211_HW_SUPPORTS_PS |
                      IEEE80211_HW_PS_NULLFUNC_STACK |
                      IEEE80211_HW_BEACON_FILTER |
+                     IEEE80211_HW_REPORTS_TX_ACK_STATUS |
                      IEEE80211_HW_NOISE_DBM;
 
         dev->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
index 66057999a93c..2ceff5480355 100644
--- a/drivers/net/wireless/p54/txrx.c
+++ b/drivers/net/wireless/p54/txrx.c
@@ -38,7 +38,7 @@ static void p54_dump_tx_queue(struct p54_common *priv)
         u32 largest_hole = 0, free;
 
         spin_lock_irqsave(&priv->tx_queue.lock, flags);
-        printk(KERN_DEBUG "%s: / --- tx queue dump (%d entries) --- \n",
+        printk(KERN_DEBUG "%s: / --- tx queue dump (%d entries) ---\n",
                wiphy_name(priv->hw->wiphy), skb_queue_len(&priv->tx_queue));
 
         prev_addr = priv->rx_start;
diff --git a/drivers/net/wireless/prism54/islpci_dev.c b/drivers/net/wireless/prism54/islpci_dev.c
index a3ba3539db02..7c82e432cca7 100644
--- a/drivers/net/wireless/prism54/islpci_dev.c
+++ b/drivers/net/wireless/prism54/islpci_dev.c
@@ -227,14 +227,14 @@ islpci_interrupt(int irq, void *config)
 
 #if VERBOSE > SHOW_ERROR_MESSAGES
                 DEBUG(SHOW_FUNCTION_CALLS,
-                      "IRQ: Identification register 0x%p 0x%x \n", device, reg);
+                      "IRQ: Identification register 0x%p 0x%x\n", device, reg);
 #endif
 
                 /* check for each bit in the register separately */
                 if (reg & ISL38XX_INT_IDENT_UPDATE) {
 #if VERBOSE > SHOW_ERROR_MESSAGES
                         /* Queue has been updated */
-                        DEBUG(SHOW_TRACING, "IRQ: Update flag \n");
+                        DEBUG(SHOW_TRACING, "IRQ: Update flag\n");
 
                         DEBUG(SHOW_QUEUE_INDEXES,
                               "CB drv Qs: [%i][%i][%i][%i][%i][%i]\n",
@@ -300,7 +300,7 @@ islpci_interrupt(int irq, void *config)
                                                 ISL38XX_CB_RX_DATA_LQ) != 0) {
 #if VERBOSE > SHOW_ERROR_MESSAGES
                                 DEBUG(SHOW_TRACING,
-                                      "Received frame in Data Low Queue \n");
+                                      "Received frame in Data Low Queue\n");
 #endif
                                 islpci_eth_receive(priv);
                         }
@@ -325,7 +325,7 @@ islpci_interrupt(int irq, void *config)
                         /* Device has been initialized */
 #if VERBOSE > SHOW_ERROR_MESSAGES
                         DEBUG(SHOW_TRACING,
-                              "IRQ: Init flag, device initialized \n");
+                              "IRQ: Init flag, device initialized\n");
 #endif
                         wake_up(&priv->reset_done);
                 }
@@ -333,7 +333,7 @@ islpci_interrupt(int irq, void *config)
                 if (reg & ISL38XX_INT_IDENT_SLEEP) {
                         /* Device intends to move to powersave state */
 #if VERBOSE > SHOW_ERROR_MESSAGES
-                        DEBUG(SHOW_TRACING, "IRQ: Sleep flag \n");
+                        DEBUG(SHOW_TRACING, "IRQ: Sleep flag\n");
 #endif
                         isl38xx_handle_sleep_request(priv->control_block,
                                                      &powerstate,
@@ -343,7 +343,7 @@ islpci_interrupt(int irq, void *config)
                 if (reg & ISL38XX_INT_IDENT_WAKEUP) {
                         /* Device has been woken up to active state */
 #if VERBOSE > SHOW_ERROR_MESSAGES
-                        DEBUG(SHOW_TRACING, "IRQ: Wakeup flag \n");
+                        DEBUG(SHOW_TRACING, "IRQ: Wakeup flag\n");
 #endif
 
                         isl38xx_handle_wakeup(priv->control_block,
@@ -634,7 +634,7 @@ islpci_alloc_memory(islpci_private *priv)
               ioremap(pci_resource_start(priv->pdev, 0),
                       ISL38XX_PCI_MEM_SIZE))) {
                 /* error in remapping the PCI device memory address range */
-                printk(KERN_ERR "PCI memory remapping failed \n");
+                printk(KERN_ERR "PCI memory remapping failed\n");
                 return -1;
         }
 
@@ -901,7 +901,7 @@ islpci_setup(struct pci_dev *pdev)
 
         if (register_netdev(ndev)) {
                 DEBUG(SHOW_ERROR_MESSAGES,
-                      "ERROR: register_netdev() failed \n");
+                      "ERROR: register_netdev() failed\n");
                 goto do_islpci_free_memory;
         }
 
diff --git a/drivers/net/wireless/prism54/islpci_eth.c b/drivers/net/wireless/prism54/islpci_eth.c
index 872b64783e78..af9e7fbd7640 100644
--- a/drivers/net/wireless/prism54/islpci_eth.c
+++ b/drivers/net/wireless/prism54/islpci_eth.c
@@ -89,7 +89,7 @@ islpci_eth_transmit(struct sk_buff *skb, struct net_device *ndev)
         u32 curr_frag;
 
 #if VERBOSE > SHOW_ERROR_MESSAGES
-        DEBUG(SHOW_FUNCTION_CALLS, "islpci_eth_transmit \n");
+        DEBUG(SHOW_FUNCTION_CALLS, "islpci_eth_transmit\n");
 #endif
 
         /* lock the driver code */
@@ -140,7 +140,7 @@ islpci_eth_transmit(struct sk_buff *skb, struct net_device *ndev)
                         }
 
 #if VERBOSE > SHOW_ERROR_MESSAGES
-                        DEBUG(SHOW_TRACING, "memmove %p %p %i \n", skb->data,
+                        DEBUG(SHOW_TRACING, "memmove %p %p %i\n", skb->data,
                               src, skb->len);
 #endif
                 } else {
@@ -319,7 +319,7 @@ islpci_eth_receive(islpci_private *priv)
         int discard = 0;
 
 #if VERBOSE > SHOW_ERROR_MESSAGES
-        DEBUG(SHOW_FUNCTION_CALLS, "islpci_eth_receive \n");
+        DEBUG(SHOW_FUNCTION_CALLS, "islpci_eth_receive\n");
 #endif
 
         /* the device has written an Ethernet frame in the data area
@@ -431,7 +431,7 @@ islpci_eth_receive(islpci_private *priv)
                 skb = dev_alloc_skb(MAX_FRAGMENT_SIZE_RX + 2);
                 if (unlikely(skb == NULL)) {
                         /* error allocating an sk_buff structure elements */
-                        DEBUG(SHOW_ERROR_MESSAGES, "Error allocating skb \n");
+                        DEBUG(SHOW_ERROR_MESSAGES, "Error allocating skb\n");
                         break;
                 }
                 skb_reserve(skb, (4 - (long) skb->data) & 0x03);
diff --git a/drivers/net/wireless/prism54/islpci_mgt.c b/drivers/net/wireless/prism54/islpci_mgt.c
index 69d2f882fd06..89b0278eb7e8 100644
--- a/drivers/net/wireless/prism54/islpci_mgt.c
+++ b/drivers/net/wireless/prism54/islpci_mgt.c
@@ -113,7 +113,7 @@ islpci_mgmt_rx_fill(struct net_device *ndev)
         u32 curr = le32_to_cpu(cb->driver_curr_frag[ISL38XX_CB_RX_MGMTQ]);
 
 #if VERBOSE > SHOW_ERROR_MESSAGES
-        DEBUG(SHOW_FUNCTION_CALLS, "islpci_mgmt_rx_fill \n");
+        DEBUG(SHOW_FUNCTION_CALLS, "islpci_mgmt_rx_fill\n");
 #endif
 
         while (curr - priv->index_mgmt_rx < ISL38XX_CB_MGMT_QSIZE) {
@@ -211,7 +211,7 @@ islpci_mgt_transmit(struct net_device *ndev, int operation, unsigned long oid,
         {
                 pimfor_header_t *h = buf.mem;
                 DEBUG(SHOW_PIMFOR_FRAMES,
-                      "PIMFOR: op %i, oid 0x%08lx, device %i, flags 0x%x length 0x%x \n",
+                      "PIMFOR: op %i, oid 0x%08lx, device %i, flags 0x%x length 0x%x\n",
                       h->operation, oid, h->device_id, h->flags, length);
 
                 /* display the buffer contents for debugging */
@@ -279,7 +279,7 @@ islpci_mgt_receive(struct net_device *ndev)
         u32 curr_frag;
 
 #if VERBOSE > SHOW_ERROR_MESSAGES
-        DEBUG(SHOW_FUNCTION_CALLS, "islpci_mgt_receive \n");
+        DEBUG(SHOW_FUNCTION_CALLS, "islpci_mgt_receive\n");
 #endif
 
         /* Only once per interrupt, determine fragment range to
@@ -338,7 +338,7 @@ islpci_mgt_receive(struct net_device *ndev)
 
 #if VERBOSE > SHOW_ERROR_MESSAGES
                 DEBUG(SHOW_PIMFOR_FRAMES,
-                      "PIMFOR: op %i, oid 0x%08x, device %i, flags 0x%x length 0x%x \n",
+                      "PIMFOR: op %i, oid 0x%08x, device %i, flags 0x%x length 0x%x\n",
                       header->operation, header->oid, header->device_id,
                       header->flags, header->length);
 
diff --git a/drivers/net/wireless/prism54/oid_mgt.c b/drivers/net/wireless/prism54/oid_mgt.c
index 1187e6112a64..07df70a10071 100644
--- a/drivers/net/wireless/prism54/oid_mgt.c
+++ b/drivers/net/wireless/prism54/oid_mgt.c
@@ -819,7 +819,7 @@ mgt_response_to_str(enum oid_num_t n, union oid_res_t *r, char *str)
                         k = snprintf(str, PRIV_STR_SIZE, "nr=%u\n", list->nr);
                         for (i = 0; i < list->nr; i++)
                                 k += snprintf(str + k, PRIV_STR_SIZE - k,
-                                              "bss[%u] : \nage=%u\nchannel=%u\n"
+                                              "bss[%u] :\nage=%u\nchannel=%u\n"
                                               "capinfo=0x%X\nrates=0x%X\n"
                                               "basic_rates=0x%X\n",
                                               i, list->bsslist[i].age,
diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
index 84c530aa52f9..f1e916a31668 100644
--- a/drivers/net/wireless/ray_cs.c
+++ b/drivers/net/wireless/ray_cs.c
@@ -556,7 +556,7 @@ static int ray_init(struct net_device *dev)
         local->fw_ver = local->startup_res.firmware_version[0];
         local->fw_bld = local->startup_res.firmware_version[1];
         local->fw_var = local->startup_res.firmware_version[2];
-        dev_dbg(&link->dev, "ray_init firmware version %d.%d \n", local->fw_ver,
+        dev_dbg(&link->dev, "ray_init firmware version %d.%d\n", local->fw_ver,
               local->fw_bld);
 
         local->tib_length = 0x20;
@@ -1113,10 +1113,10 @@ static const struct ethtool_ops netdev_ethtool_ops = {
 /*
  * Wireless Handler : get protocol name
  */
-static int ray_get_name(struct net_device *dev,
-                        struct iw_request_info *info, char *cwrq, char *extra)
+static int ray_get_name(struct net_device *dev, struct iw_request_info *info,
+                        union iwreq_data *wrqu, char *extra)
 {
-        strcpy(cwrq, "IEEE 802.11-FH");
+        strcpy(wrqu->name, "IEEE 802.11-FH");
         return 0;
 }
 
@@ -1124,9 +1124,8 @@ static int ray_get_name(struct net_device *dev,
 /*
  * Wireless Handler : set frequency
  */
-static int ray_set_freq(struct net_device *dev,
-                        struct iw_request_info *info,
-                        struct iw_freq *fwrq, char *extra)
+static int ray_set_freq(struct net_device *dev, struct iw_request_info *info,
+                        union iwreq_data *wrqu, char *extra)
 {
         ray_dev_t *local = netdev_priv(dev);
         int err = -EINPROGRESS; /* Call commit handler */
@@ -1136,10 +1135,10 @@ static int ray_set_freq(struct net_device *dev,
                 return -EBUSY;
 
         /* Setting by channel number */
-        if ((fwrq->m > USA_HOP_MOD) || (fwrq->e > 0))
+        if ((wrqu->freq.m > USA_HOP_MOD) || (wrqu->freq.e > 0))
                 err = -EOPNOTSUPP;
         else
-                local->sparm.b5.a_hop_pattern = fwrq->m;
+                local->sparm.b5.a_hop_pattern = wrqu->freq.m;
 
         return err;
 }
@@ -1148,14 +1147,13 @@ static int ray_set_freq(struct net_device *dev,
 /*
  * Wireless Handler : get frequency
  */
-static int ray_get_freq(struct net_device *dev,
-                        struct iw_request_info *info,
-                        struct iw_freq *fwrq, char *extra)
+static int ray_get_freq(struct net_device *dev, struct iw_request_info *info,
+                        union iwreq_data *wrqu, char *extra)
 {
         ray_dev_t *local = netdev_priv(dev);
 
-        fwrq->m = local->sparm.b5.a_hop_pattern;
-        fwrq->e = 0;
+        wrqu->freq.m = local->sparm.b5.a_hop_pattern;
+        wrqu->freq.e = 0;
         return 0;
 }
 
@@ -1163,9 +1161,8 @@ static int ray_get_freq(struct net_device *dev,
 /*
  * Wireless Handler : set ESSID
  */
-static int ray_set_essid(struct net_device *dev,
-                         struct iw_request_info *info,
-                         struct iw_point *dwrq, char *extra)
+static int ray_set_essid(struct net_device *dev, struct iw_request_info *info,
+                         union iwreq_data *wrqu, char *extra)
 {
         ray_dev_t *local = netdev_priv(dev);
 
@@ -1174,19 +1171,17 @@ static int ray_set_essid(struct net_device *dev,
                 return -EBUSY;
 
         /* Check if we asked for `any' */
-        if (dwrq->flags == 0) {
+        if (wrqu->essid.flags == 0)
                 /* Corey : can you do that ? */
                 return -EOPNOTSUPP;
-        } else {
-                /* Check the size of the string */
-                if (dwrq->length > IW_ESSID_MAX_SIZE) {
-                        return -E2BIG;
-                }
 
-                /* Set the ESSID in the card */
-                memset(local->sparm.b5.a_current_ess_id, 0, IW_ESSID_MAX_SIZE);
-                memcpy(local->sparm.b5.a_current_ess_id, extra, dwrq->length);
-        }
+        /* Check the size of the string */
+        if (wrqu->essid.length > IW_ESSID_MAX_SIZE)
+                return -E2BIG;
+
+        /* Set the ESSID in the card */
+        memset(local->sparm.b5.a_current_ess_id, 0, IW_ESSID_MAX_SIZE);
+        memcpy(local->sparm.b5.a_current_ess_id, extra, wrqu->essid.length);
 
         return -EINPROGRESS;    /* Call commit handler */
 }
@@ -1195,9 +1190,8 @@ static int ray_set_essid(struct net_device *dev,
 /*
  * Wireless Handler : get ESSID
  */
-static int ray_get_essid(struct net_device *dev,
-                         struct iw_request_info *info,
-                         struct iw_point *dwrq, char *extra)
+static int ray_get_essid(struct net_device *dev, struct iw_request_info *info,
+                         union iwreq_data *wrqu, char *extra)
 {
         ray_dev_t *local = netdev_priv(dev);
 
@@ -1205,8 +1199,8 @@ static int ray_get_essid(struct net_device *dev,
         memcpy(extra, local->sparm.b5.a_current_ess_id, IW_ESSID_MAX_SIZE);
 
         /* Push it out ! */
-        dwrq->length = strlen(extra);
-        dwrq->flags = 1;        /* active */
+        wrqu->essid.length = strlen(extra);
+        wrqu->essid.flags = 1;  /* active */
 
         return 0;
 }
@@ -1215,14 +1209,13 @@ static int ray_get_essid(struct net_device *dev,
 /*
  * Wireless Handler : get AP address
  */
-static int ray_get_wap(struct net_device *dev,
-                       struct iw_request_info *info,
-                       struct sockaddr *awrq, char *extra)
+static int ray_get_wap(struct net_device *dev, struct iw_request_info *info,
+                       union iwreq_data *wrqu, char *extra)
 {
         ray_dev_t *local = netdev_priv(dev);
 
-        memcpy(awrq->sa_data, local->bss_id, ETH_ALEN);
-        awrq->sa_family = ARPHRD_ETHER;
+        memcpy(wrqu->ap_addr.sa_data, local->bss_id, ETH_ALEN);
+        wrqu->ap_addr.sa_family = ARPHRD_ETHER;
 
         return 0;
 }
@@ -1231,9 +1224,8 @@ static int ray_get_wap(struct net_device *dev,
 /*
  * Wireless Handler : set Bit-Rate
  */
-static int ray_set_rate(struct net_device *dev,
-                        struct iw_request_info *info,
-                        struct iw_param *vwrq, char *extra)
+static int ray_set_rate(struct net_device *dev, struct iw_request_info *info,
+                        union iwreq_data *wrqu, char *extra)
 {
         ray_dev_t *local = netdev_priv(dev);
 
@@ -1242,15 +1234,15 @@ static int ray_set_rate(struct net_device *dev,
                 return -EBUSY;
 
         /* Check if rate is in range */
-        if ((vwrq->value != 1000000) && (vwrq->value != 2000000))
+        if ((wrqu->bitrate.value != 1000000) && (wrqu->bitrate.value != 2000000))
                 return -EINVAL;
 
         /* Hack for 1.5 Mb/s instead of 2 Mb/s */
         if ((local->fw_ver == 0x55) &&  /* Please check */
-            (vwrq->value == 2000000))
+            (wrqu->bitrate.value == 2000000))
                 local->net_default_tx_rate = 3;
         else
-                local->net_default_tx_rate = vwrq->value / 500000;
+                local->net_default_tx_rate = wrqu->bitrate.value / 500000;
 
         return 0;
 }
@@ -1259,17 +1251,16 @@ static int ray_set_rate(struct net_device *dev,
 /*
  * Wireless Handler : get Bit-Rate
  */
-static int ray_get_rate(struct net_device *dev,
-                        struct iw_request_info *info,
-                        struct iw_param *vwrq, char *extra)
+static int ray_get_rate(struct net_device *dev, struct iw_request_info *info,
+                        union iwreq_data *wrqu, char *extra)
 {
         ray_dev_t *local = netdev_priv(dev);
 
         if (local->net_default_tx_rate == 3)
-                vwrq->value = 2000000;  /* Hum... */
+                wrqu->bitrate.value = 2000000;  /* Hum... */
         else
-                vwrq->value = local->net_default_tx_rate * 500000;
-        vwrq->fixed = 0;        /* We are in auto mode */
+                wrqu->bitrate.value = local->net_default_tx_rate * 500000;
+        wrqu->bitrate.fixed = 0;        /* We are in auto mode */
 
         return 0;
 }
@@ -1278,19 +1269,18 @@ static int ray_get_rate(struct net_device *dev,
 /*
  * Wireless Handler : set RTS threshold
  */
-static int ray_set_rts(struct net_device *dev,
-                       struct iw_request_info *info,
-                       struct iw_param *vwrq, char *extra)
+static int ray_set_rts(struct net_device *dev, struct iw_request_info *info,
+                       union iwreq_data *wrqu, char *extra)
 {
         ray_dev_t *local = netdev_priv(dev);
-        int rthr = vwrq->value;
+        int rthr = wrqu->rts.value;
 
         /* Reject if card is already initialised */
         if (local->card_status != CARD_AWAITING_PARAM)
                 return -EBUSY;
 
         /* if(wrq->u.rts.fixed == 0) we should complain */
-        if (vwrq->disabled)
+        if (wrqu->rts.disabled)
                 rthr = 32767;
         else {
                 if ((rthr < 0) || (rthr > 2347))   /* What's the max packet size ??? */
@@ -1306,16 +1296,15 @@ static int ray_set_rts(struct net_device *dev,
 /*
  * Wireless Handler : get RTS threshold
  */
-static int ray_get_rts(struct net_device *dev,
-                       struct iw_request_info *info,
-                       struct iw_param *vwrq, char *extra)
+static int ray_get_rts(struct net_device *dev, struct iw_request_info *info,
+                       union iwreq_data *wrqu, char *extra)
 {
         ray_dev_t *local = netdev_priv(dev);
 
-        vwrq->value = (local->sparm.b5.a_rts_threshold[0] << 8)
+        wrqu->rts.value = (local->sparm.b5.a_rts_threshold[0] << 8)
             + local->sparm.b5.a_rts_threshold[1];
-        vwrq->disabled = (vwrq->value == 32767);
-        vwrq->fixed = 1;
+        wrqu->rts.disabled = (wrqu->rts.value == 32767);
+        wrqu->rts.fixed = 1;
 
         return 0;
 }
@@ -1324,19 +1313,18 @@ static int ray_get_rts(struct net_device *dev,
 /*
  * Wireless Handler : set Fragmentation threshold
  */
-static int ray_set_frag(struct net_device *dev,
-                        struct iw_request_info *info,
-                        struct iw_param *vwrq, char *extra)
+static int ray_set_frag(struct net_device *dev, struct iw_request_info *info,
+                        union iwreq_data *wrqu, char *extra)
 {
         ray_dev_t *local = netdev_priv(dev);
-        int fthr = vwrq->value;
+        int fthr = wrqu->frag.value;
 
         /* Reject if card is already initialised */
         if (local->card_status != CARD_AWAITING_PARAM)
                 return -EBUSY;
 
         /* if(wrq->u.frag.fixed == 0) should complain */
-        if (vwrq->disabled)
+        if (wrqu->frag.disabled)
                 fthr = 32767;
         else {
                 if ((fthr < 256) || (fthr > 2347))      /* To check out ! */
@@ -1352,16 +1340,15 @@ static int ray_set_frag(struct net_device *dev,
 /*
  * Wireless Handler : get Fragmentation threshold
  */
-static int ray_get_frag(struct net_device *dev,
-                        struct iw_request_info *info,
-                        struct iw_param *vwrq, char *extra)
+static int ray_get_frag(struct net_device *dev, struct iw_request_info *info,
+                        union iwreq_data *wrqu, char *extra)
 {
         ray_dev_t *local = netdev_priv(dev);
 
-        vwrq->value = (local->sparm.b5.a_frag_threshold[0] << 8)
+        wrqu->frag.value = (local->sparm.b5.a_frag_threshold[0] << 8)
             + local->sparm.b5.a_frag_threshold[1];
-        vwrq->disabled = (vwrq->value == 32767);
-        vwrq->fixed = 1;
+        wrqu->frag.disabled = (wrqu->frag.value == 32767);
+        wrqu->frag.fixed = 1;
 
         return 0;
 }
@@ -1370,8 +1357,8 @@ static int ray_get_frag(struct net_device *dev,
 /*
  * Wireless Handler : set Mode of Operation
  */
-static int ray_set_mode(struct net_device *dev,
-                        struct iw_request_info *info, __u32 *uwrq, char *extra)
+static int ray_set_mode(struct net_device *dev, struct iw_request_info *info,
+                        union iwreq_data *wrqu, char *extra)
 {
         ray_dev_t *local = netdev_priv(dev);
         int err = -EINPROGRESS; /* Call commit handler */
@@ -1381,7 +1368,7 @@ static int ray_set_mode(struct net_device *dev,
         if (local->card_status != CARD_AWAITING_PARAM)
                 return -EBUSY;
 
-        switch (*uwrq) {
+        switch (wrqu->mode) {
         case IW_MODE_ADHOC:
                 card_mode = 0;
                 /* Fall through */
@@ -1399,15 +1386,15 @@ static int ray_set_mode(struct net_device *dev,
 /*
  * Wireless Handler : get Mode of Operation
  */
-static int ray_get_mode(struct net_device *dev,
-                        struct iw_request_info *info, __u32 *uwrq, char *extra)
+static int ray_get_mode(struct net_device *dev, struct iw_request_info *info,
+                        union iwreq_data *wrqu, char *extra)
 {
         ray_dev_t *local = netdev_priv(dev);
 
         if (local->sparm.b5.a_network_type)
-                *uwrq = IW_MODE_INFRA;
+                wrqu->mode = IW_MODE_INFRA;
         else
-                *uwrq = IW_MODE_ADHOC;
+                wrqu->mode = IW_MODE_ADHOC;
 
         return 0;
 }
@@ -1416,16 +1403,15 @@ static int ray_get_mode(struct net_device *dev,
 /*
  * Wireless Handler : get range info
  */
-static int ray_get_range(struct net_device *dev,
-                         struct iw_request_info *info,
-                         struct iw_point *dwrq, char *extra)
+static int ray_get_range(struct net_device *dev, struct iw_request_info *info,
+                         union iwreq_data *wrqu, char *extra)
 {
         struct iw_range *range = (struct iw_range *)extra;
 
-        memset((char *)range, 0, sizeof(struct iw_range));
+        memset(range, 0, sizeof(struct iw_range));
 
         /* Set the length (very important for backward compatibility) */
-        dwrq->length = sizeof(struct iw_range);
+        wrqu->data.length = sizeof(struct iw_range);
 
         /* Set the Wireless Extension versions */
         range->we_version_compiled = WIRELESS_EXT;
@@ -1448,8 +1434,7 @@ static int ray_get_range(struct net_device *dev,
 /*
  * Wireless Private Handler : set framing mode
  */
-static int ray_set_framing(struct net_device *dev,
-                           struct iw_request_info *info,
+static int ray_set_framing(struct net_device *dev, struct iw_request_info *info,
                            union iwreq_data *wrqu, char *extra)
 {
         translate = *(extra);   /* Set framing mode */
@@ -1461,8 +1446,7 @@ static int ray_set_framing(struct net_device *dev,
 /*
  * Wireless Private Handler : get framing mode
  */
-static int ray_get_framing(struct net_device *dev,
-                           struct iw_request_info *info,
+static int ray_get_framing(struct net_device *dev, struct iw_request_info *info,
                            union iwreq_data *wrqu, char *extra)
 {
         *(extra) = translate;
@@ -1474,8 +1458,7 @@ static int ray_get_framing(struct net_device *dev,
 /*
  * Wireless Private Handler : get country
  */
-static int ray_get_country(struct net_device *dev,
-                           struct iw_request_info *info,
+static int ray_get_country(struct net_device *dev, struct iw_request_info *info,
                            union iwreq_data *wrqu, char *extra)
 {
         *(extra) = country;
@@ -1487,10 +1470,9 @@ static int ray_get_country(struct net_device *dev,
 /*
  * Commit handler : called after a bunch of SET operations
  */
-static int ray_commit(struct net_device *dev, struct iw_request_info *info,     /* NULL */
-                      void *zwrq,       /* NULL */
-                      char *extra)
-{ /* NULL */
+static int ray_commit(struct net_device *dev, struct iw_request_info *info,
+                      union iwreq_data *wrqu, char *extra)
+{
         return 0;
 }
 
@@ -1531,28 +1513,28 @@ static iw_stats *ray_get_wireless_stats(struct net_device *dev)
  */
 
 static const iw_handler ray_handler[] = {
-        [SIOCSIWCOMMIT - SIOCIWFIRST] = (iw_handler) ray_commit,
-        [SIOCGIWNAME - SIOCIWFIRST] = (iw_handler) ray_get_name,
-        [SIOCSIWFREQ - SIOCIWFIRST] = (iw_handler) ray_set_freq,
-        [SIOCGIWFREQ - SIOCIWFIRST] = (iw_handler) ray_get_freq,
-        [SIOCSIWMODE - SIOCIWFIRST] = (iw_handler) ray_set_mode,
-        [SIOCGIWMODE - SIOCIWFIRST] = (iw_handler) ray_get_mode,
-        [SIOCGIWRANGE - SIOCIWFIRST] = (iw_handler) ray_get_range,
+        IW_HANDLER(SIOCSIWCOMMIT, ray_commit),
+        IW_HANDLER(SIOCGIWNAME, ray_get_name),
+        IW_HANDLER(SIOCSIWFREQ, ray_set_freq),
+        IW_HANDLER(SIOCGIWFREQ, ray_get_freq),
+        IW_HANDLER(SIOCSIWMODE, ray_set_mode),
+        IW_HANDLER(SIOCGIWMODE, ray_get_mode),
+        IW_HANDLER(SIOCGIWRANGE, ray_get_range),
 #ifdef WIRELESS_SPY
-        [SIOCSIWSPY - SIOCIWFIRST] = (iw_handler) iw_handler_set_spy,
-        [SIOCGIWSPY - SIOCIWFIRST] = (iw_handler) iw_handler_get_spy,
-        [SIOCSIWTHRSPY - SIOCIWFIRST] = (iw_handler) iw_handler_set_thrspy,
-        [SIOCGIWTHRSPY - SIOCIWFIRST] = (iw_handler) iw_handler_get_thrspy,
+        IW_HANDLER(SIOCSIWSPY, iw_handler_set_spy),
+        IW_HANDLER(SIOCGIWSPY, iw_handler_get_spy),
+        IW_HANDLER(SIOCSIWTHRSPY, iw_handler_set_thrspy),
+        IW_HANDLER(SIOCGIWTHRSPY, iw_handler_get_thrspy),
 #endif /* WIRELESS_SPY */
-        [SIOCGIWAP - SIOCIWFIRST] = (iw_handler) ray_get_wap,
-        [SIOCSIWESSID - SIOCIWFIRST] = (iw_handler) ray_set_essid,
-        [SIOCGIWESSID - SIOCIWFIRST] = (iw_handler) ray_get_essid,
-        [SIOCSIWRATE - SIOCIWFIRST] = (iw_handler) ray_set_rate,
-        [SIOCGIWRATE - SIOCIWFIRST] = (iw_handler) ray_get_rate,
-        [SIOCSIWRTS - SIOCIWFIRST] = (iw_handler) ray_set_rts,
-        [SIOCGIWRTS - SIOCIWFIRST] = (iw_handler) ray_get_rts,
-        [SIOCSIWFRAG - SIOCIWFIRST] = (iw_handler) ray_set_frag,
-        [SIOCGIWFRAG - SIOCIWFIRST] = (iw_handler) ray_get_frag,
+        IW_HANDLER(SIOCGIWAP, ray_get_wap),
+        IW_HANDLER(SIOCSIWESSID, ray_set_essid),
+        IW_HANDLER(SIOCGIWESSID, ray_get_essid),
+        IW_HANDLER(SIOCSIWRATE, ray_set_rate),
+        IW_HANDLER(SIOCGIWRATE, ray_get_rate),
+        IW_HANDLER(SIOCSIWRTS, ray_set_rts),
+        IW_HANDLER(SIOCGIWRTS, ray_get_rts),
+        IW_HANDLER(SIOCSIWFRAG, ray_set_frag),
+        IW_HANDLER(SIOCGIWFRAG, ray_get_frag),
 };
 
 #define SIOCSIPFRAMING  SIOCIWFIRSTPRIV /* Set framing mode */
@@ -1560,9 +1542,9 @@ static const iw_handler ray_handler[] = {
 #define SIOCGIPCOUNTRY  SIOCIWFIRSTPRIV + 3     /* Get country code */
 
 static const iw_handler ray_private_handler[] = {
-        [0] = (iw_handler) ray_set_framing,
-        [1] = (iw_handler) ray_get_framing,
-        [3] = (iw_handler) ray_get_country,
+        [0] = ray_set_framing,
+        [1] = ray_get_framing,
+        [3] = ray_get_country,
 };
 
 static const struct iw_priv_args ray_private_args[] = {
@@ -2252,7 +2234,7 @@ static void rx_data(struct net_device *dev, struct rcs __iomem *prcs,
                             (dev->mtu + RX_MAC_HEADER_LENGTH + ETH_HLEN +
                              FCS_LEN)) {
                                 pr_debug(
-                                      "ray_cs invalid packet length %d received \n",
+                                      "ray_cs invalid packet length %d received\n",
                                       rx_len);
                                 return;
                         }
@@ -2263,7 +2245,7 @@ static void rx_data(struct net_device *dev, struct rcs __iomem *prcs,
                             (dev->mtu + RX_MAC_HEADER_LENGTH + ETH_HLEN +
                              FCS_LEN)) {
                                 pr_debug(
-                                      "ray_cs invalid packet length %d received \n",
+                                      "ray_cs invalid packet length %d received\n",
                                       rx_len);
                                 return;
                         }
@@ -2771,11 +2753,11 @@ static int ray_cs_proc_show(struct seq_file *m, void *v)
                         seq_printf(m, "Hop dwell            = %d Kus\n",
                                    pfh->dwell_time[0] +
                                    256 * pfh->dwell_time[1]);
-                        seq_printf(m, "Hop set              = %d \n",
+                        seq_printf(m, "Hop set              = %d\n",
                                    pfh->hop_set);
-                        seq_printf(m, "Hop pattern          = %d \n",
+                        seq_printf(m, "Hop pattern          = %d\n",
                                    pfh->hop_pattern);
-                        seq_printf(m, "Hop index            = %d \n",
+                        seq_printf(m, "Hop index            = %d\n",
                                    pfh->hop_index);
                         p += p[1] + 2;
                 } else {
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 2887047069f2..aceb95ef7274 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -117,6 +117,7 @@ MODULE_PARM_DESC(workaround_interval,
 #define OID_802_11_ADD_KEY                      cpu_to_le32(0x0d01011d)
 #define OID_802_11_REMOVE_KEY                   cpu_to_le32(0x0d01011e)
 #define OID_802_11_ASSOCIATION_INFORMATION      cpu_to_le32(0x0d01011f)
+#define OID_802_11_CAPABILITY                   cpu_to_le32(0x0d010122)
 #define OID_802_11_PMKID                        cpu_to_le32(0x0d010123)
 #define OID_802_11_NETWORK_TYPES_SUPPORTED      cpu_to_le32(0x0d010203)
 #define OID_802_11_NETWORK_TYPE_IN_USE          cpu_to_le32(0x0d010204)
@@ -358,6 +359,30 @@ struct ndis_80211_assoc_info {
         __le32 offset_resp_ies;
 } __attribute__((packed));
 
+struct ndis_80211_auth_encr_pair {
+        __le32 auth_mode;
+        __le32 encr_mode;
+} __attribute__((packed));
+
+struct ndis_80211_capability {
+        __le32 length;
+        __le32 version;
+        __le32 num_pmkids;
+        __le32 num_auth_encr_pair;
+        struct ndis_80211_auth_encr_pair auth_encr_pair[0];
+} __attribute__((packed));
+
+struct ndis_80211_bssid_info {
+        u8 bssid[6];
+        u8 pmkid[16];
+};
+
+struct ndis_80211_pmkid {
+        __le32 length;
+        __le32 bssid_info_count;
+        struct ndis_80211_bssid_info bssid_info[0];
+};
+
 /*
  *  private data
  */
@@ -476,13 +501,7 @@ struct rndis_wlan_private {
         /* encryption stuff */
         int  encr_tx_key_index;
         struct rndis_wlan_encr_key encr_keys[4];
-        enum nl80211_auth_type wpa_auth_type;
         int  wpa_version;
-        int  wpa_keymgmt;
-        int  wpa_ie_len;
-        u8  *wpa_ie;
-        int  wpa_cipher_pair;
-        int  wpa_cipher_group;
 
         u8 command_buffer[COMMAND_BUFFER_SIZE];
 };
@@ -534,6 +553,14 @@ static int rndis_get_station(struct wiphy *wiphy, struct net_device *dev,
 static int rndis_dump_station(struct wiphy *wiphy, struct net_device *dev,
                                int idx, u8 *mac, struct station_info *sinfo);
 
+static int rndis_set_pmksa(struct wiphy *wiphy, struct net_device *netdev,
+                                struct cfg80211_pmksa *pmksa);
+
+static int rndis_del_pmksa(struct wiphy *wiphy, struct net_device *netdev,
+                                struct cfg80211_pmksa *pmksa);
+
+static int rndis_flush_pmksa(struct wiphy *wiphy, struct net_device *netdev);
+
 static struct cfg80211_ops rndis_config_ops = {
         .change_virtual_intf = rndis_change_virtual_intf,
         .scan = rndis_scan,
@@ -550,6 +577,9 @@ static struct cfg80211_ops rndis_config_ops = {
         .set_default_key = rndis_set_default_key,
         .get_station = rndis_get_station,
         .dump_station = rndis_dump_station,
+        .set_pmksa = rndis_set_pmksa,
+        .del_pmksa = rndis_del_pmksa,
+        .flush_pmksa = rndis_flush_pmksa,
 };
 
 static void *rndis_wiphy_privid = &rndis_wiphy_privid;
@@ -704,6 +734,7 @@ static int rndis_query_oid(struct usbnet *dev, __le32 oid, void *data, int *len)
                 struct rndis_query_c    *get_c;
         } u;
         int ret, buflen;
+        int resplen, respoffs, copylen;
 
         buflen = *len + sizeof(*u.get);
         if (buflen < CONTROL_BUFFER_SIZE)
@@ -733,11 +764,34 @@ static int rndis_query_oid(struct usbnet *dev, __le32 oid, void *data, int *len)
                            le32_to_cpu(u.get_c->status));
 
         if (ret == 0) {
-                memcpy(data, u.buf + le32_to_cpu(u.get_c->offset) + 8, *len);
+                resplen = le32_to_cpu(u.get_c->len);
+                respoffs = le32_to_cpu(u.get_c->offset) + 8;
 
-                ret = le32_to_cpu(u.get_c->len);
-                if (ret > *len)
-                        *len = ret;
+                if (respoffs > buflen) {
+                        /* Device returned data offset outside buffer, error. */
+                        netdev_dbg(dev->net, "%s(%s): received invalid "
+                                "data offset: %d > %d\n", __func__,
+                                oid_to_string(oid), respoffs, buflen);
+
+                        ret = -EINVAL;
+                        goto exit_unlock;
+                }
+
+                if ((resplen + respoffs) > buflen) {
+                        /* Device would have returned more data if buffer would
+                         * have been big enough. Copy just the bits that we got.
+                         */
+                        copylen = buflen - respoffs;
+                } else {
+                        copylen = resplen;
+                }
+
+                if (copylen > *len)
+                        copylen = *len;
+
+                memcpy(data, u.buf + respoffs, copylen);
+
+                *len = resplen;
 
                 ret = rndis_error_status(u.get_c->status);
                 if (ret < 0)
@@ -746,6 +800,7 @@ static int rndis_query_oid(struct usbnet *dev, __le32 oid, void *data, int *len)
                                    le32_to_cpu(u.get_c->status), ret);
         }
 
+exit_unlock:
         mutex_unlock(&priv->command_lock);
 
         if (u.buf != priv->command_buffer)
@@ -1091,8 +1146,6 @@ static int set_auth_mode(struct usbnet *usbdev, u32 wpa_version,
         }
 
         priv->wpa_version = wpa_version;
-        priv->wpa_auth_type = auth_type;
-        priv->wpa_keymgmt = keymgmt;
 
         return 0;
 }
@@ -1117,7 +1170,6 @@ static int set_priv_filter(struct usbnet *usbdev)
 
 static int set_encr_mode(struct usbnet *usbdev, int pairwise, int groupwise)
 {
-        struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
         __le32 tmp;
         int encr_mode, ret;
 
@@ -1146,8 +1198,6 @@ static int set_encr_mode(struct usbnet *usbdev, int pairwise, int groupwise)
                 return ret;
         }
 
-        priv->wpa_cipher_pair = pairwise;
-        priv->wpa_cipher_group = groupwise;
         return 0;
 }
 
@@ -1568,6 +1618,194 @@ set_filter:
                    le32_to_cpu(filter), ret);
 }
 
+#ifdef DEBUG
+static void debug_print_pmkids(struct usbnet *usbdev,
+                                struct ndis_80211_pmkid *pmkids,
+                                const char *func_str)
+{
+        struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
+        int i, len, count, max_pmkids, entry_len;
+
+        max_pmkids = priv->wdev.wiphy->max_num_pmkids;
+        len = le32_to_cpu(pmkids->length);
+        count = le32_to_cpu(pmkids->bssid_info_count);
+
+        entry_len = (count > 0) ? (len - sizeof(*pmkids)) / count : -1;
+
+        netdev_dbg(usbdev->net, "%s(): %d PMKIDs (data len: %d, entry len: "
+                                "%d)\n", func_str, count, len, entry_len);
+
+        if (count > max_pmkids)
+                count = max_pmkids;
+
+        for (i = 0; i < count; i++) {
+                u32 *tmp = (u32 *)pmkids->bssid_info[i].pmkid;
+
+                netdev_dbg(usbdev->net, "%s():  bssid: %pM, "
+                                "pmkid: %08X:%08X:%08X:%08X\n",
+                                func_str, pmkids->bssid_info[i].bssid,
+                                cpu_to_be32(tmp[0]), cpu_to_be32(tmp[1]),
+                                cpu_to_be32(tmp[2]), cpu_to_be32(tmp[3]));
+        }
+}
+#else
+static void debug_print_pmkids(struct usbnet *usbdev,
+                                struct ndis_80211_pmkid *pmkids,
+                                const char *func_str)
+{
+        return;
+}
+#endif
+
+static struct ndis_80211_pmkid *get_device_pmkids(struct usbnet *usbdev)
+{
+        struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
+        struct ndis_80211_pmkid *pmkids;
+        int len, ret, max_pmkids;
+
+        max_pmkids = priv->wdev.wiphy->max_num_pmkids;
+        len = sizeof(*pmkids) + max_pmkids * sizeof(pmkids->bssid_info[0]);
+
+        pmkids = kzalloc(len, GFP_KERNEL);
+        if (!pmkids)
+                return ERR_PTR(-ENOMEM);
+
+        pmkids->length = cpu_to_le32(len);
+        pmkids->bssid_info_count = cpu_to_le32(max_pmkids);
+
+        ret = rndis_query_oid(usbdev, OID_802_11_PMKID, pmkids, &len);
+        if (ret < 0) {
+                netdev_dbg(usbdev->net, "%s(): OID_802_11_PMKID(%d, %d)"
+                                " -> %d\n", __func__, len, max_pmkids, ret);
+
+                kfree(pmkids);
+                return ERR_PTR(ret);
+        }
+
+        if (le32_to_cpu(pmkids->bssid_info_count) > max_pmkids)
+                pmkids->bssid_info_count = cpu_to_le32(max_pmkids);
+
+        debug_print_pmkids(usbdev, pmkids, __func__);
+
+        return pmkids;
+}
+
+static int set_device_pmkids(struct usbnet *usbdev,
+                                struct ndis_80211_pmkid *pmkids)
+{
+        int ret, len, num_pmkids;
+
+        num_pmkids = le32_to_cpu(pmkids->bssid_info_count);
+        len = sizeof(*pmkids) + num_pmkids * sizeof(pmkids->bssid_info[0]);
+        pmkids->length = cpu_to_le32(len);
+
+        debug_print_pmkids(usbdev, pmkids, __func__);
+
+        ret = rndis_set_oid(usbdev, OID_802_11_PMKID, pmkids,
+                                                le32_to_cpu(pmkids->length));
+        if (ret < 0) {
+                netdev_dbg(usbdev->net, "%s(): OID_802_11_PMKID(%d, %d) -> %d"
+                                "\n", __func__, len, num_pmkids, ret);
+        }
+
+        kfree(pmkids);
+        return ret;
+}
+
+static struct ndis_80211_pmkid *remove_pmkid(struct usbnet *usbdev,
+                                                struct ndis_80211_pmkid *pmkids,
+                                                struct cfg80211_pmksa *pmksa,
+                                                int max_pmkids)
+{
+        int i, len, count, newlen, err;
+
+        len = le32_to_cpu(pmkids->length);
+        count = le32_to_cpu(pmkids->bssid_info_count);
+
+        if (count > max_pmkids)
+                count = max_pmkids;
+
+        for (i = 0; i < count; i++)
+                if (!compare_ether_addr(pmkids->bssid_info[i].bssid,
+                                                        pmksa->bssid))
+                        break;
+
+        /* pmkid not found */
+        if (i == count) {
+                netdev_dbg(usbdev->net, "%s(): bssid not found (%pM)\n",
+                                        __func__, pmksa->bssid);
+                err = -ENOENT;
+                goto error;
+        }
+
+        for (; i + 1 < count; i++)
+                pmkids->bssid_info[i] = pmkids->bssid_info[i + 1];
+
+        count--;
+        newlen = sizeof(*pmkids) + count * sizeof(pmkids->bssid_info[0]);
+
+        pmkids->length = cpu_to_le32(newlen);
+        pmkids->bssid_info_count = cpu_to_le32(count);
+
+        return pmkids;
+error:
+        kfree(pmkids);
+        return ERR_PTR(err);
+}
+
+static struct ndis_80211_pmkid *update_pmkid(struct usbnet *usbdev,
+                                                struct ndis_80211_pmkid *pmkids,
+                                                struct cfg80211_pmksa *pmksa,
+                                                int max_pmkids)
+{
+        int i, err, len, count, newlen;
+
+        len = le32_to_cpu(pmkids->length);
+        count = le32_to_cpu(pmkids->bssid_info_count);
+
+        if (count > max_pmkids)
+                count = max_pmkids;
+
+        /* update with new pmkid */
+        for (i = 0; i < count; i++) {
+                if (compare_ether_addr(pmkids->bssid_info[i].bssid,
+                                                        pmksa->bssid))
+                        continue;
+
+                memcpy(pmkids->bssid_info[i].pmkid, pmksa->pmkid,
+                                                                WLAN_PMKID_LEN);
+
+                return pmkids;
+        }
+
+        /* out of space, return error */
+        if (i == max_pmkids) {
+                netdev_dbg(usbdev->net, "%s(): out of space\n", __func__);
+                err = -ENOSPC;
+                goto error;
+        }
+
+        /* add new pmkid */
+        newlen = sizeof(*pmkids) + (count + 1) * sizeof(pmkids->bssid_info[0]);
+
+        pmkids = krealloc(pmkids, newlen, GFP_KERNEL);
+        if (!pmkids) {
+                err = -ENOMEM;
+                goto error;
+        }
+
+        pmkids->length = cpu_to_le32(newlen);
+        pmkids->bssid_info_count = cpu_to_le32(count + 1);
+
+        memcpy(pmkids->bssid_info[count].bssid, pmksa->bssid, ETH_ALEN);
+        memcpy(pmkids->bssid_info[count].pmkid, pmksa->pmkid, WLAN_PMKID_LEN);
+
+        return pmkids;
+error:
+        kfree(pmkids);
+        return ERR_PTR(err);
+}
+
 /*
  * cfg80211 ops
  */
@@ -2178,6 +2416,78 @@ static int rndis_dump_station(struct wiphy *wiphy, struct net_device *dev,
         return 0;
 }
 
+static int rndis_set_pmksa(struct wiphy *wiphy, struct net_device *netdev,
+                                struct cfg80211_pmksa *pmksa)
+{
+        struct rndis_wlan_private *priv = wiphy_priv(wiphy);
+        struct usbnet *usbdev = priv->usbdev;
+        struct ndis_80211_pmkid *pmkids;
+        u32 *tmp = (u32 *)pmksa->pmkid;
+
+        netdev_dbg(usbdev->net, "%s(%pM, %08X:%08X:%08X:%08X)\n", __func__,
+                        pmksa->bssid,
+                        cpu_to_be32(tmp[0]), cpu_to_be32(tmp[1]),
+                        cpu_to_be32(tmp[2]), cpu_to_be32(tmp[3]));
+
+        pmkids = get_device_pmkids(usbdev);
+        if (IS_ERR(pmkids)) {
+                /* couldn't read PMKID cache from device */
+                return PTR_ERR(pmkids);
+        }
+
+        pmkids = update_pmkid(usbdev, pmkids, pmksa, wiphy->max_num_pmkids);
+        if (IS_ERR(pmkids)) {
+                /* not found, list full, etc */
+                return PTR_ERR(pmkids);
+        }
+
+        return set_device_pmkids(usbdev, pmkids);
+}
+
+static int rndis_del_pmksa(struct wiphy *wiphy, struct net_device *netdev,
+                                struct cfg80211_pmksa *pmksa)
+{
+        struct rndis_wlan_private *priv = wiphy_priv(wiphy);
+        struct usbnet *usbdev = priv->usbdev;
+        struct ndis_80211_pmkid *pmkids;
+        u32 *tmp = (u32 *)pmksa->pmkid;
+
+        netdev_dbg(usbdev->net, "%s(%pM, %08X:%08X:%08X:%08X)\n", __func__,
+                        pmksa->bssid,
+                        cpu_to_be32(tmp[0]), cpu_to_be32(tmp[1]),
+                        cpu_to_be32(tmp[2]), cpu_to_be32(tmp[3]));
+
+        pmkids = get_device_pmkids(usbdev);
+        if (IS_ERR(pmkids)) {
+                /* Couldn't read PMKID cache from device */
+                return PTR_ERR(pmkids);
+        }
+
+        pmkids = remove_pmkid(usbdev, pmkids, pmksa, wiphy->max_num_pmkids);
+        if (IS_ERR(pmkids)) {
+                /* not found, etc */
+                return PTR_ERR(pmkids);
+        }
+
+        return set_device_pmkids(usbdev, pmkids);
+}
+
+static int rndis_flush_pmksa(struct wiphy *wiphy, struct net_device *netdev)
+{
+        struct rndis_wlan_private *priv = wiphy_priv(wiphy);
+        struct usbnet *usbdev = priv->usbdev;
+        struct ndis_80211_pmkid pmkid;
+
+        netdev_dbg(usbdev->net, "%s()\n", __func__);
+
+        memset(&pmkid, 0, sizeof(pmkid));
+
+        pmkid.length = cpu_to_le32(sizeof(pmkid));
+        pmkid.bssid_info_count = cpu_to_le32(0);
+
+        return rndis_set_oid(usbdev, OID_802_11_PMKID, &pmkid, sizeof(pmkid));
+}
+
 /*
  * workers, indication handlers, device poller
  */
@@ -2522,12 +2832,14 @@ static void rndis_wlan_indication(struct usbnet *usbdev, void *ind, int buflen)
         }
 }
 
-static int rndis_wlan_get_caps(struct usbnet *usbdev)
+static int rndis_wlan_get_caps(struct usbnet *usbdev, struct wiphy *wiphy)
 {
         struct {
                 __le32  num_items;
                 __le32  items[8];
         } networks_supported;
+        struct ndis_80211_capability *caps;
+        u8 caps_buf[sizeof(*caps) + sizeof(caps->auth_encr_pair) * 16];
         int len, retval, i, n;
         struct rndis_wlan_private *priv = get_rndis_wlan_priv(usbdev);
 
@@ -2555,6 +2867,21 @@ static int rndis_wlan_get_caps(struct usbnet *usbdev)
                 }
         }
 
+        /* get device 802.11 capabilities, number of PMKIDs */
+        caps = (struct ndis_80211_capability *)caps_buf;
+        len = sizeof(caps_buf);
+        retval = rndis_query_oid(usbdev, OID_802_11_CAPABILITY, caps, &len);
+        if (retval >= 0) {
+                netdev_dbg(usbdev->net, "OID_802_11_CAPABILITY -> len %d, "
+                                "ver %d, pmkids %d, auth-encr-pairs %d\n",
+                                le32_to_cpu(caps->length),
+                                le32_to_cpu(caps->version),
+                                le32_to_cpu(caps->num_pmkids),
+                                le32_to_cpu(caps->num_auth_encr_pair));
+                wiphy->max_num_pmkids = le32_to_cpu(caps->num_pmkids);
+        } else
+                wiphy->max_num_pmkids = 0;
+
         return retval;
 }
 
@@ -2802,7 +3129,7 @@ static int rndis_wlan_bind(struct usbnet *usbdev, struct usb_interface *intf)
         wiphy->max_scan_ssids = 1;
 
         /* TODO: fill-out band/encr information based on priv->caps */
-        rndis_wlan_get_caps(usbdev);
+        rndis_wlan_get_caps(usbdev, wiphy);
 
         memcpy(priv->channels, rndis_channels, sizeof(rndis_channels));
         memcpy(priv->rates, rndis_rates, sizeof(rndis_rates));
@@ -2862,9 +3189,6 @@ static void rndis_wlan_unbind(struct usbnet *usbdev, struct usb_interface *intf)
         flush_workqueue(priv->workqueue);
         destroy_workqueue(priv->workqueue);
 
-        if (priv && priv->wpa_ie_len)
-                kfree(priv->wpa_ie);
-
         rndis_unbind(usbdev, intf);
 
         wiphy_unregister(priv->wdev.wiphy);
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index c22b04042d5c..08a4789fc2d8 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -525,6 +525,10 @@ static void rt2400pci_config_ps(struct rt2x00_dev *rt2x00dev,
 
                 rt2x00_set_field32(&reg, CSR20_AUTOWAKE, 1);
                 rt2x00pci_register_write(rt2x00dev, CSR20, reg);
+        } else {
+                rt2x00pci_register_read(rt2x00dev, CSR20, &reg);
+                rt2x00_set_field32(&reg, CSR20_AUTOWAKE, 0);
+                rt2x00pci_register_write(rt2x00dev, CSR20, reg);
         }
 
         rt2x00dev->ops->lib->set_device_state(rt2x00dev, state);
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 52bbcf1bd17c..d084d70e5fe2 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -573,6 +573,10 @@ static void rt2500pci_config_ps(struct rt2x00_dev *rt2x00dev,
 
                 rt2x00_set_field32(&reg, CSR20_AUTOWAKE, 1);
                 rt2x00pci_register_write(rt2x00dev, CSR20, reg);
+        } else {
+                rt2x00pci_register_read(rt2x00dev, CSR20, &reg);
+                rt2x00_set_field32(&reg, CSR20_AUTOWAKE, 0);
+                rt2x00pci_register_write(rt2x00dev, CSR20, reg);
         }
 
         rt2x00dev->ops->lib->set_device_state(rt2x00dev, state);
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index dbaa78138437..54d2716e389c 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -648,6 +648,10 @@ static void rt2500usb_config_ps(struct rt2x00_dev *rt2x00dev,
 
                 rt2x00_set_field16(&reg, MAC_CSR18_AUTO_WAKE, 1);
                 rt2500usb_register_write(rt2x00dev, MAC_CSR18, reg);
+        } else {
+                rt2500usb_register_read(rt2x00dev, MAC_CSR18, &reg);
+                rt2x00_set_field16(&reg, MAC_CSR18_AUTO_WAKE, 0);
+                rt2500usb_register_write(rt2x00dev, MAC_CSR18, reg);
         }
 
         rt2x00dev->ops->lib->set_device_state(rt2x00dev, state);
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 326fce78489d..68d0cfee3f20 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -1014,13 +1014,13 @@ static void rt2800_config_ps(struct rt2x00_dev *rt2x00dev,
 
                 rt2x00dev->ops->lib->set_device_state(rt2x00dev, state);
         } else {
-                rt2x00dev->ops->lib->set_device_state(rt2x00dev, state);
-
                 rt2800_register_read(rt2x00dev, AUTOWAKEUP_CFG, &reg);
                 rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_AUTO_LEAD_TIME, 0);
                 rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_TBCN_BEFORE_WAKE, 0);
                 rt2x00_set_field32(&reg, AUTOWAKEUP_CFG_AUTOWAKE, 0);
                 rt2800_register_write(rt2x00dev, AUTOWAKEUP_CFG, reg);
+
+                rt2x00dev->ops->lib->set_device_state(rt2x00dev, state);
         }
 }
 
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index 91cce2d0f6db..a2b37d38d400 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -60,6 +60,12 @@ static void rt2800pci_mcu_status(struct rt2x00_dev *rt2x00dev, const u8 token)
         unsigned int i;
         u32 reg;
 
+        /*
+         * SOC devices don't support MCU requests.
+         */
+        if (rt2x00_is_soc(rt2x00dev))
+                return;
+
         for (i = 0; i < 200; i++) {
                 rt2800_register_read(rt2x00dev, H2M_MAILBOX_CID, &reg);
 
@@ -907,14 +913,12 @@ static void rt2800pci_txdone(struct rt2x00_dev *rt2x00dev)
 {
         struct data_queue *queue;
         struct queue_entry *entry;
-        struct queue_entry *entry_done;
-        struct queue_entry_priv_pci *entry_priv;
+        __le32 *txwi;
         struct txdone_entry_desc txdesc;
         u32 word;
         u32 reg;
         u32 old_reg;
-        unsigned int type;
-        unsigned int index;
+        int wcid, ack, pid, tx_wcid, tx_ack, tx_pid;
         u16 mcs, real_mcs;
 
         /*
@@ -936,76 +940,89 @@ static void rt2800pci_txdone(struct rt2x00_dev *rt2x00dev)
                         break;
                 old_reg = reg;
 
+                wcid    = rt2x00_get_field32(reg, TX_STA_FIFO_WCID);
+                ack     = rt2x00_get_field32(reg, TX_STA_FIFO_TX_ACK_REQUIRED);
+                pid     = rt2x00_get_field32(reg, TX_STA_FIFO_PID_TYPE);
+
                 /*
                  * Skip this entry when it contains an invalid
                  * queue identication number.
                  */
-                type = rt2x00_get_field32(reg, TX_STA_FIFO_PID_TYPE) - 1;
-                if (type >= QID_RX)
+                if (pid <= 0 || pid > QID_RX)
                         continue;
 
-                queue = rt2x00queue_get_queue(rt2x00dev, type);
+                queue = rt2x00queue_get_queue(rt2x00dev, pid - 1);
                 if (unlikely(!queue))
                         continue;
 
                 /*
-                 * Skip this entry when it contains an invalid
-                 * index number.
+                 * Inside each queue, we process each entry in a chronological
+                 * order. We first check that the queue is not empty.
                  */
-                index = rt2x00_get_field32(reg, TX_STA_FIFO_WCID) - 1;
-                if (unlikely(index >= queue->limit))
+                if (rt2x00queue_empty(queue))
                         continue;
+                entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
 
-                entry = &queue->entries[index];
-                entry_priv = entry->priv_data;
-                rt2x00_desc_read((__le32 *)entry->skb->data, 0, &word);
+                /* Check if we got a match by looking at WCID/ACK/PID
+                 * fields */
+                txwi = (__le32 *)(entry->skb->data -
+                                  rt2x00dev->ops->extra_tx_headroom);
 
-                entry_done = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
-                while (entry != entry_done) {
-                        /*
-                         * Catch up.
-                         * Just report any entries we missed as failed.
-                         */
-                        WARNING(rt2x00dev,
-                                "TX status report missed for entry %d\n",
-                                entry_done->entry_idx);
-
-                        txdesc.flags = 0;
-                        __set_bit(TXDONE_UNKNOWN, &txdesc.flags);
-                        txdesc.retry = 0;
+                rt2x00_desc_read(txwi, 1, &word);
+                tx_wcid = rt2x00_get_field32(word, TXWI_W1_WIRELESS_CLI_ID);
+                tx_ack  = rt2x00_get_field32(word, TXWI_W1_ACK);
+                tx_pid  = rt2x00_get_field32(word, TXWI_W1_PACKETID);
 
-                        rt2x00lib_txdone(entry_done, &txdesc);
-                        entry_done = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
-                }
+                if ((wcid != tx_wcid) || (ack != tx_ack) || (pid != tx_pid))
+                        WARNING(rt2x00dev, "invalid TX_STA_FIFO content\n");
 
                 /*
                  * Obtain the status about this packet.
                  */
                 txdesc.flags = 0;
-                if (rt2x00_get_field32(reg, TX_STA_FIFO_TX_SUCCESS))
-                        __set_bit(TXDONE_SUCCESS, &txdesc.flags);
-                else
-                        __set_bit(TXDONE_FAILURE, &txdesc.flags);
+                rt2x00_desc_read(txwi, 0, &word);
+                mcs = rt2x00_get_field32(word, TXWI_W0_MCS);
+                real_mcs = rt2x00_get_field32(reg, TX_STA_FIFO_MCS);
 
                 /*
                  * Ralink has a retry mechanism using a global fallback
-                 * table. We setup this fallback table to try immediate
-                 * lower rate for all rates. In the TX_STA_FIFO,
-                 * the MCS field contains the MCS used for the successfull
-                 * transmission. If the first transmission succeed,
-                 * we have mcs == tx_mcs. On the second transmission,
-                 * we have mcs = tx_mcs - 1. So the number of
-                 * retry is (tx_mcs - mcs).
+                 * table. We setup this fallback table to try the immediate
+                 * lower rate for all rates. In the TX_STA_FIFO, the MCS field
+                 * always contains the MCS used for the last transmission, be
+                 * it successful or not.
                  */
-                mcs = rt2x00_get_field32(word, TXWI_W0_MCS);
-                real_mcs = rt2x00_get_field32(reg, TX_STA_FIFO_MCS);
+                if (rt2x00_get_field32(reg, TX_STA_FIFO_TX_SUCCESS)) {
+                        /*
+                         * Transmission succeeded. The number of retries is
+                         * mcs - real_mcs
+                         */
+                        __set_bit(TXDONE_SUCCESS, &txdesc.flags);
+                        txdesc.retry = ((mcs > real_mcs) ? mcs - real_mcs : 0);
+                } else {
+                        /*
+                         * Transmission failed. The number of retries is
+                         * always 7 in this case (for a total number of 8
+                         * frames sent).
+                         */
+                        __set_bit(TXDONE_FAILURE, &txdesc.flags);
+                        txdesc.retry = 7;
+                }
+
                 __set_bit(TXDONE_FALLBACK, &txdesc.flags);
-                txdesc.retry = mcs - min(mcs, real_mcs);
+
 
                 rt2x00lib_txdone(entry, &txdesc);
         }
 }
 
+static void rt2800pci_wakeup(struct rt2x00_dev *rt2x00dev)
+{
+        struct ieee80211_conf conf = { .flags = 0 };
+        struct rt2x00lib_conf libconf = { .conf = &conf };
+
+        rt2800_config(rt2x00dev, &libconf, IEEE80211_CONF_CHANGE_PS);
+}
+
 static irqreturn_t rt2800pci_interrupt(int irq, void *dev_instance)
 {
         struct rt2x00_dev *rt2x00dev = dev_instance;
@@ -1030,6 +1047,9 @@ static irqreturn_t rt2800pci_interrupt(int irq, void *dev_instance)
         if (rt2x00_get_field32(reg, INT_SOURCE_CSR_TX_FIFO_STATUS))
                 rt2800pci_txdone(rt2x00dev);
 
+        if (rt2x00_get_field32(reg, INT_SOURCE_CSR_AUTO_WAKEUP))
+                rt2800pci_wakeup(rt2x00dev);
+
         return IRQ_HANDLED;
 }
 
@@ -1184,6 +1204,7 @@ static const struct rt2x00_ops rt2800pci_ops = {
 /*
  * RT2800pci module information.
  */
+#ifdef CONFIG_RT2800PCI_PCI
 static DEFINE_PCI_DEVICE_TABLE(rt2800pci_device_table) = {
         { PCI_DEVICE(0x1814, 0x0601), PCI_DEVICE_DATA(&rt2800pci_ops) },
         { PCI_DEVICE(0x1814, 0x0681), PCI_DEVICE_DATA(&rt2800pci_ops) },
@@ -1208,9 +1229,11 @@ static DEFINE_PCI_DEVICE_TABLE(rt2800pci_device_table) = {
         { PCI_DEVICE(0x1814, 0x3062), PCI_DEVICE_DATA(&rt2800pci_ops) },
         { PCI_DEVICE(0x1814, 0x3562), PCI_DEVICE_DATA(&rt2800pci_ops) },
         { PCI_DEVICE(0x1814, 0x3592), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1814, 0x3593), PCI_DEVICE_DATA(&rt2800pci_ops) },
 #endif
         { 0, }
 };
+#endif /* CONFIG_RT2800PCI_PCI */
 
 MODULE_AUTHOR(DRV_PROJECT);
 MODULE_VERSION(DRV_VERSION);
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 5e4ee2023fcf..39877880869a 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -905,8 +905,13 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x07b8, 0x3072), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* AirTies */
         { USB_DEVICE(0x1eda, 0x2310), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* ASUS */
+        { USB_DEVICE(0x0b05, 0x1784), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* AzureWave */
         { USB_DEVICE(0x13d3, 0x3273), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x13d3, 0x3305), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x13d3, 0x3307), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x13d3, 0x3321), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Conceptronic */
         { USB_DEVICE(0x14b2, 0x3c12), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Corega */
@@ -916,20 +921,46 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x07d1, 0x3c0d), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x07d1, 0x3c0e), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x07d1, 0x3c0f), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07d1, 0x3c16), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Draytek */
+        { USB_DEVICE(0x07fa, 0x7712), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Edimax */
         { USB_DEVICE(0x7392, 0x7711), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Encore */
         { USB_DEVICE(0x203d, 0x1480), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x203d, 0x14a9), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* EnGenius */
         { USB_DEVICE(0x1740, 0x9703), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1740, 0x9705), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1740, 0x9706), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1740, 0x9707), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1740, 0x9708), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1740, 0x9709), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Gigabyte */
         { USB_DEVICE(0x1044, 0x800d), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* I-O DATA */
         { USB_DEVICE(0x04bb, 0x0945), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x04bb, 0x0947), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x04bb, 0x0948), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Logitec */
+        { USB_DEVICE(0x0789, 0x0166), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* MSI */
         { USB_DEVICE(0x0db0, 0x3820), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x3821), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x3822), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x3870), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x3871), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x821a), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x822a), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x822b), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x822c), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x870a), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x871a), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x871b), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x871c), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0db0, 0x899a), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Para */
+        { USB_DEVICE(0x20b8, 0x8888), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Pegatron */
         { USB_DEVICE(0x1d4d, 0x000c), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1d4d, 0x000e), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -945,8 +976,13 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* Sitecom */
         { USB_DEVICE(0x0df6, 0x003e), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0df6, 0x0042), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x0047), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x0048), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* SMC */
         { USB_DEVICE(0x083a, 0x7511), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x083a, 0xa701), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x083a, 0xa702), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x083a, 0xa703), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Zinwell */
         { USB_DEVICE(0x5a57, 0x0283), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x5a57, 0x5257), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -985,18 +1021,14 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* Amigo */
         { USB_DEVICE(0x0e0b, 0x9031), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0e0b, 0x9041), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Askey */
-        { USB_DEVICE(0x0930, 0x0a07), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* ASUS */
         { USB_DEVICE(0x0b05, 0x1760), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0b05, 0x1761), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0b05, 0x1784), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0b05, 0x1790), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1761, 0x0b05), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* AzureWave */
         { USB_DEVICE(0x13d3, 0x3262), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x13d3, 0x3284), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x13d3, 0x3305), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Belkin */
         { USB_DEVICE(0x050d, 0x825a), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Buffalo */
@@ -1015,14 +1047,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x07d1, 0x3c0b), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x07d1, 0x3c13), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x07d1, 0x3c15), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x07d1, 0x3c16), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Encore */
         { USB_DEVICE(0x203d, 0x14a1), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x203d, 0x14a9), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* EnGenius */
-        { USB_DEVICE(0x1740, 0x9707), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x1740, 0x9708), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x1740, 0x9709), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Gemtek */
         { USB_DEVICE(0x15a9, 0x0010), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Gigabyte */
@@ -1030,9 +1056,6 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* Hawking */
         { USB_DEVICE(0x0e66, 0x0009), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0e66, 0x000b), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* I-O DATA */
-        { USB_DEVICE(0x04bb, 0x0947), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x04bb, 0x0948), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* LevelOne */
         { USB_DEVICE(0x1740, 0x0605), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1740, 0x0615), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -1042,20 +1065,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x1737, 0x0079), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Motorola */
         { USB_DEVICE(0x100d, 0x9032), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* MSI */
-        { USB_DEVICE(0x0db0, 0x3821), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0db0, 0x3822), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0db0, 0x3870), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0db0, 0x3871), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0db0, 0x821a), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0db0, 0x822a), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0db0, 0x870a), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0db0, 0x871a), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0db0, 0x899a), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Ovislink */
         { USB_DEVICE(0x1b75, 0x3072), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Para */
-        { USB_DEVICE(0x20b8, 0x8888), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Pegatron */
         { USB_DEVICE(0x05a6, 0x0101), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1d4d, 0x0002), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -1069,14 +1080,10 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x0df6, 0x003c), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0df6, 0x003d), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0df6, 0x0040), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0df6, 0x0047), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0df6, 0x0048), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0df6, 0x004a), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0df6, 0x004d), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* SMC */
         { USB_DEVICE(0x083a, 0xa512), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x083a, 0xa701), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x083a, 0xa702), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x083a, 0xc522), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x083a, 0xd522), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Sweex */
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index e2da928dd9f0..ac69dbe5719b 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -2117,6 +2117,14 @@ static void rt61pci_txdone(struct rt2x00_dev *rt2x00dev)
         }
 }
 
+static void rt61pci_wakeup(struct rt2x00_dev *rt2x00dev)
+{
+        struct ieee80211_conf conf = { .flags = 0 };
+        struct rt2x00lib_conf libconf = { .conf = &conf };
+
+        rt61pci_config(rt2x00dev, &libconf, IEEE80211_CONF_CHANGE_PS);
+}
+
 static irqreturn_t rt61pci_interrupt(int irq, void *dev_instance)
 {
         struct rt2x00_dev *rt2x00dev = dev_instance;
@@ -2164,6 +2172,12 @@ static irqreturn_t rt61pci_interrupt(int irq, void *dev_instance)
                 rt2x00pci_register_write(rt2x00dev,
                                          M2H_CMD_DONE_CSR, 0xffffffff);
 
+        /*
+         * 4 - MCU Autowakeup interrupt.
+         */
+        if (rt2x00_get_field32(reg_mcu, MCU_INT_SOURCE_CSR_TWAKEUP))
+                rt61pci_wakeup(rt2x00dev);
+
         return IRQ_HANDLED;
 }
 
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 47f3e4a26d77..7ebe14b64fe8 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -860,15 +860,15 @@ static void rt73usb_config_ps(struct rt2x00_dev *rt2x00dev,
                 rt2x00usb_vendor_request_sw(rt2x00dev, USB_DEVICE_MODE, 0,
                                             USB_MODE_SLEEP, REGISTER_TIMEOUT);
         } else {
-                rt2x00usb_vendor_request_sw(rt2x00dev, USB_DEVICE_MODE, 0,
-                                            USB_MODE_WAKEUP, REGISTER_TIMEOUT);
-
                 rt2x00usb_register_read(rt2x00dev, MAC_CSR11, &reg);
                 rt2x00_set_field32(&reg, MAC_CSR11_DELAY_AFTER_TBCN, 0);
                 rt2x00_set_field32(&reg, MAC_CSR11_TBCN_BEFORE_WAKEUP, 0);
                 rt2x00_set_field32(&reg, MAC_CSR11_AUTOWAKE, 0);
                 rt2x00_set_field32(&reg, MAC_CSR11_WAKEUP_LATENCY, 0);
                 rt2x00usb_register_write(rt2x00dev, MAC_CSR11, reg);
+
+                rt2x00usb_vendor_request_sw(rt2x00dev, USB_DEVICE_MODE, 0,
+                                            USB_MODE_WAKEUP, REGISTER_TIMEOUT);
         }
 }
 
diff --git a/drivers/net/wireless/wl12xx/Kconfig b/drivers/net/wireless/wl12xx/Kconfig
index 785e0244e305..337fc7bec5a5 100644
--- a/drivers/net/wireless/wl12xx/Kconfig
+++ b/drivers/net/wireless/wl12xx/Kconfig
@@ -51,3 +51,27 @@ config WL1271
 
           If you choose to build a module, it'll be called wl1271. Say N if
           unsure.
+
+config WL1271_SPI
+        tristate "TI wl1271 SPI support"
+        depends on WL1271 && SPI_MASTER
+        ---help---
+          This module adds support for the SPI interface of adapters using
+          TI wl1271 chipset.  Select this if your platform is using
+          the SPI bus.
+
+          If you choose to build a module, it'll be called wl1251_spi.
+          Say N if unsure.
+
+config WL1271_SDIO
+        tristate "TI wl1271 SDIO support"
+        depends on WL1271 && MMC && ARM
+        ---help---
+          This module adds support for the SDIO interface of adapters using
+          TI wl1271 chipset.  Select this if your platform is using
+          the SDIO bus.
+
+          If you choose to build a module, it'll be called
+          wl1271_sdio. Say N if unsure.
+
+
diff --git a/drivers/net/wireless/wl12xx/Makefile b/drivers/net/wireless/wl12xx/Makefile
index f47ec94c16dc..27ddd2be0a91 100644
--- a/drivers/net/wireless/wl12xx/Makefile
+++ b/drivers/net/wireless/wl12xx/Makefile
@@ -7,10 +7,12 @@ obj-$(CONFIG_WL1251)	+= wl1251.o
 obj-$(CONFIG_WL1251_SPI)        += wl1251_spi.o
 obj-$(CONFIG_WL1251_SDIO)       += wl1251_sdio.o
 
-wl1271-objs             = wl1271_main.o  wl1271_spi.o wl1271_cmd.o  \
+wl1271-objs             = wl1271_main.o  wl1271_cmd.o wl1271_io.o \
                           wl1271_event.o wl1271_tx.o  wl1271_rx.o   \
                           wl1271_ps.o    wl1271_acx.o wl1271_boot.o \
-                          wl1271_init.o  wl1271_debugfs.o wl1271_io.o
+                          wl1271_init.o  wl1271_debugfs.o
 
 wl1271-$(CONFIG_NL80211_TESTMODE)       += wl1271_testmode.o
 obj-$(CONFIG_WL1271)    += wl1271.o
+obj-$(CONFIG_WL1271_SPI)        += wl1271_spi.o
+obj-$(CONFIG_WL1271_SDIO)       += wl1271_sdio.o
diff --git a/drivers/net/wireless/wl12xx/wl1251.h b/drivers/net/wireless/wl12xx/wl1251.h
index 37c61c19cae5..4f5f02a26e62 100644
--- a/drivers/net/wireless/wl12xx/wl1251.h
+++ b/drivers/net/wireless/wl12xx/wl1251.h
@@ -256,6 +256,8 @@ struct wl1251_debugfs {
 struct wl1251_if_operations {
         void (*read)(struct wl1251 *wl, int addr, void *buf, size_t len);
         void (*write)(struct wl1251 *wl, int addr, void *buf, size_t len);
+        void (*read_elp)(struct wl1251 *wl, int addr, u32 *val);
+        void (*write_elp)(struct wl1251 *wl, int addr, u32 val);
         void (*reset)(struct wl1251 *wl);
         void (*enable_irq)(struct wl1251 *wl);
         void (*disable_irq)(struct wl1251 *wl);
diff --git a/drivers/net/wireless/wl12xx/wl1251_boot.c b/drivers/net/wireless/wl12xx/wl1251_boot.c
index 28a808674080..acb334184d70 100644
--- a/drivers/net/wireless/wl12xx/wl1251_boot.c
+++ b/drivers/net/wireless/wl12xx/wl1251_boot.c
@@ -496,7 +496,8 @@ int wl1251_boot(struct wl1251 *wl)
         /* 2. start processing NVS file */
         if (wl->use_eeprom) {
                 wl1251_reg_write32(wl, ACX_REG_EE_START, START_EEPROM_MGR);
-                msleep(4000);
+                /* Wait for EEPROM NVS burst read to complete */
+                msleep(40);
                 wl1251_reg_write32(wl, ACX_EEPROMLESS_IND_REG, USE_EEPROM);
         } else {
                 ret = wl1251_boot_upload_nvs(wl);
diff --git a/drivers/net/wireless/wl12xx/wl1251_io.h b/drivers/net/wireless/wl12xx/wl1251_io.h
index b89d2ac62efb..c545e9d5f512 100644
--- a/drivers/net/wireless/wl12xx/wl1251_io.h
+++ b/drivers/net/wireless/wl12xx/wl1251_io.h
@@ -48,6 +48,26 @@ static inline void wl1251_write32(struct wl1251 *wl, int addr, u32 val)
         wl->if_ops->write(wl, addr, &val, sizeof(u32));
 }
 
+static inline u32 wl1251_read_elp(struct wl1251 *wl, int addr)
+{
+        u32 response;
+
+        if (wl->if_ops->read_elp)
+                wl->if_ops->read_elp(wl, addr, &response);
+        else
+                wl->if_ops->read(wl, addr, &response, sizeof(u32));
+
+        return response;
+}
+
+static inline void wl1251_write_elp(struct wl1251 *wl, int addr, u32 val)
+{
+        if (wl->if_ops->write_elp)
+                wl->if_ops->write_elp(wl, addr, val);
+        else
+                wl->if_ops->write(wl, addr, &val, sizeof(u32));
+}
+
 /* Memory target IO, address is translated to partition 0 */
 void wl1251_mem_read(struct wl1251 *wl, int addr, void *buf, size_t len);
 void wl1251_mem_write(struct wl1251 *wl, int addr, void *buf, size_t len);
diff --git a/drivers/net/wireless/wl12xx/wl1251_main.c b/drivers/net/wireless/wl12xx/wl1251_main.c
index 24ae6a360ac8..0155653b7105 100644
--- a/drivers/net/wireless/wl12xx/wl1251_main.c
+++ b/drivers/net/wireless/wl12xx/wl1251_main.c
@@ -146,8 +146,8 @@ static void wl1251_fw_wakeup(struct wl1251 *wl)
         u32 elp_reg;
 
         elp_reg = ELPCTRL_WAKE_UP;
-        wl1251_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, elp_reg);
-        elp_reg = wl1251_read32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR);
+        wl1251_write_elp(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, elp_reg);
+        elp_reg = wl1251_read_elp(wl, HW_ACCESS_ELP_CTRL_REG_ADDR);
 
         if (!(elp_reg & ELPCTRL_WLAN_READY))
                 wl1251_warning("WLAN not ready");
diff --git a/drivers/net/wireless/wl12xx/wl1251_ps.c b/drivers/net/wireless/wl12xx/wl1251_ps.c
index 851dfb65e474..b55cb2bd459a 100644
--- a/drivers/net/wireless/wl12xx/wl1251_ps.c
+++ b/drivers/net/wireless/wl12xx/wl1251_ps.c
@@ -45,7 +45,7 @@ void wl1251_elp_work(struct work_struct *work)
                 goto out;
 
         wl1251_debug(DEBUG_PSM, "chip to elp");
-        wl1251_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_SLEEP);
+        wl1251_write_elp(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_SLEEP);
         wl->elp = true;
 
 out:
@@ -79,9 +79,9 @@ int wl1251_ps_elp_wakeup(struct wl1251 *wl)
         start = jiffies;
         timeout = jiffies + msecs_to_jiffies(WL1251_WAKEUP_TIMEOUT);
 
-        wl1251_write32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_WAKE_UP);
+        wl1251_write_elp(wl, HW_ACCESS_ELP_CTRL_REG_ADDR, ELPCTRL_WAKE_UP);
 
-        elp_reg = wl1251_read32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR);
+        elp_reg = wl1251_read_elp(wl, HW_ACCESS_ELP_CTRL_REG_ADDR);
 
         /*
          * FIXME: we should wait for irq from chip but, as a temporary
@@ -93,7 +93,7 @@ int wl1251_ps_elp_wakeup(struct wl1251 *wl)
                         return -ETIMEDOUT;
                 }
                 msleep(1);
-                elp_reg = wl1251_read32(wl, HW_ACCESS_ELP_CTRL_REG_ADDR);
+                elp_reg = wl1251_read_elp(wl, HW_ACCESS_ELP_CTRL_REG_ADDR);
         }
 
         wl1251_debug(DEBUG_PSM, "wakeup time: %u ms",
diff --git a/drivers/net/wireless/wl12xx/wl1251_sdio.c b/drivers/net/wireless/wl12xx/wl1251_sdio.c
index 9423f22bdced..2051ef06e9ec 100644
--- a/drivers/net/wireless/wl12xx/wl1251_sdio.c
+++ b/drivers/net/wireless/wl12xx/wl1251_sdio.c
@@ -20,20 +20,11 @@
  * Copyright (C) 2009 Bob Copeland (me@bobcopeland.com)
  */
 #include <linux/module.h>
-#include <linux/crc7.h>
 #include <linux/mod_devicetable.h>
-#include <linux/irq.h>
 #include <linux/mmc/sdio_func.h>
 #include <linux/mmc/sdio_ids.h>
-#include <linux/platform_device.h>
 
 #include "wl1251.h"
-#include "wl12xx_80211.h"
-#include "wl1251_reg.h"
-#include "wl1251_ps.h"
-#include "wl1251_io.h"
-#include "wl1251_tx.h"
-#include "wl1251_debugfs.h"
 
 #ifndef SDIO_VENDOR_ID_TI
 #define SDIO_VENDOR_ID_TI               0x104c
@@ -65,7 +56,8 @@ static const struct sdio_device_id wl1251_devices[] = {
 MODULE_DEVICE_TABLE(sdio, wl1251_devices);
 
 
-void wl1251_sdio_read(struct wl1251 *wl, int addr, void *buf, size_t len)
+static void wl1251_sdio_read(struct wl1251 *wl, int addr,
+                             void *buf, size_t len)
 {
         int ret;
         struct sdio_func *func = wl_to_func(wl);
@@ -77,7 +69,8 @@ void wl1251_sdio_read(struct wl1251 *wl, int addr, void *buf, size_t len)
         sdio_release_host(func);
 }
 
-void wl1251_sdio_write(struct wl1251 *wl, int addr, void *buf, size_t len)
+static void wl1251_sdio_write(struct wl1251 *wl, int addr,
+                              void *buf, size_t len)
 {
         int ret;
         struct sdio_func *func = wl_to_func(wl);
@@ -89,7 +82,33 @@ void wl1251_sdio_write(struct wl1251 *wl, int addr, void *buf, size_t len)
         sdio_release_host(func);
 }
 
-void wl1251_sdio_reset(struct wl1251 *wl)
+static void wl1251_sdio_read_elp(struct wl1251 *wl, int addr, u32 *val)
+{
+        int ret = 0;
+        struct sdio_func *func = wl_to_func(wl);
+
+        sdio_claim_host(func);
+        *val = sdio_readb(func, addr, &ret);
+        sdio_release_host(func);
+
+        if (ret)
+                wl1251_error("sdio_readb failed (%d)", ret);
+}
+
+static void wl1251_sdio_write_elp(struct wl1251 *wl, int addr, u32 val)
+{
+        int ret = 0;
+        struct sdio_func *func = wl_to_func(wl);
+
+        sdio_claim_host(func);
+        sdio_writeb(func, val, addr, &ret);
+        sdio_release_host(func);
+
+        if (ret)
+                wl1251_error("sdio_writeb failed (%d)", ret);
+}
+
+static void wl1251_sdio_reset(struct wl1251 *wl)
 {
 }
 
@@ -111,19 +130,22 @@ static void wl1251_sdio_disable_irq(struct wl1251 *wl)
         sdio_release_host(func);
 }
 
-void wl1251_sdio_set_power(bool enable)
+static void wl1251_sdio_set_power(bool enable)
 {
 }
 
-struct wl1251_if_operations wl1251_sdio_ops = {
+static const struct wl1251_if_operations wl1251_sdio_ops = {
         .read = wl1251_sdio_read,
         .write = wl1251_sdio_write,
+        .write_elp = wl1251_sdio_write_elp,
+        .read_elp = wl1251_sdio_read_elp,
         .reset = wl1251_sdio_reset,
         .enable_irq = wl1251_sdio_enable_irq,
         .disable_irq = wl1251_sdio_disable_irq,
 };
 
-int wl1251_sdio_probe(struct sdio_func *func, const struct sdio_device_id *id)
+static int wl1251_sdio_probe(struct sdio_func *func,
+                             const struct sdio_device_id *id)
 {
         int ret;
         struct wl1251 *wl;
diff --git a/drivers/net/wireless/wl12xx/wl1251_spi.c b/drivers/net/wireless/wl12xx/wl1251_spi.c
index 9cc8c323830f..df2ff8bc8ef4 100644
--- a/drivers/net/wireless/wl12xx/wl1251_spi.c
+++ b/drivers/net/wireless/wl12xx/wl1251_spi.c
@@ -309,7 +309,7 @@ static int __devexit wl1251_spi_remove(struct spi_device *spi)
 
 static struct spi_driver wl1251_spi_driver = {
         .driver = {
-                .name           = "wl1251",
+                .name           = DRIVER_NAME,
                 .bus            = &spi_bus_type,
                 .owner          = THIS_MODULE,
         },
diff --git a/drivers/net/wireless/wl12xx/wl1271.h b/drivers/net/wireless/wl12xx/wl1271.h
index 97ea5096bc8c..a29969efc861 100644
--- a/drivers/net/wireless/wl12xx/wl1271.h
+++ b/drivers/net/wireless/wl12xx/wl1271.h
@@ -53,6 +53,9 @@ enum {
         DEBUG_MAC80211  = BIT(11),
         DEBUG_CMD       = BIT(12),
         DEBUG_ACX       = BIT(13),
+        DEBUG_SDIO      = BIT(14),
+        DEBUG_FILTERS   = BIT(15),
+        DEBUG_ADHOC     = BIT(16),
         DEBUG_ALL       = ~0,
 };
 
@@ -110,6 +113,9 @@ enum {
 #define WL1271_FW_NAME "wl1271-fw.bin"
 #define WL1271_NVS_NAME "wl1271-nvs.bin"
 
+#define WL1271_TX_SECURITY_LO16(s) ((u16)((s) & 0xffff))
+#define WL1271_TX_SECURITY_HI32(s) ((u32)(((s) >> 16) & 0xffffffff))
+
 /* NVS data structure */
 #define WL1271_NVS_SECTION_SIZE                  468
 
@@ -142,14 +148,7 @@ struct wl1271_nvs_file {
  */
 #undef WL1271_80211A_ENABLED
 
-/*
- * FIXME: for the wl1271, a busy word count of 1 here will result in a more
- * optimal SPI interface. There is some SPI bug however, causing RXS time outs
- * with this mode occasionally on boot, so lets have three for now. A value of
- * three should make sure, that the chipset will always be ready, though this
- * will impact throughput and latencies slightly.
- */
-#define WL1271_BUSY_WORD_CNT 3
+#define WL1271_BUSY_WORD_CNT 1
 #define WL1271_BUSY_WORD_LEN (WL1271_BUSY_WORD_CNT * sizeof(u32))
 
 #define WL1271_ELP_HW_STATE_ASLEEP 0
@@ -334,11 +333,27 @@ struct wl1271_scan {
         u8 probe_requests;
 };
 
+struct wl1271_if_operations {
+        void (*read)(struct wl1271 *wl, int addr, void *buf, size_t len,
+                     bool fixed);
+        void (*write)(struct wl1271 *wl, int addr, void *buf, size_t len,
+                     bool fixed);
+        void (*reset)(struct wl1271 *wl);
+        void (*init)(struct wl1271 *wl);
+        void (*power)(struct wl1271 *wl, bool enable);
+        struct device* (*dev)(struct wl1271 *wl);
+        void (*enable_irq)(struct wl1271 *wl);
+        void (*disable_irq)(struct wl1271 *wl);
+};
+
 struct wl1271 {
+        struct platform_device *plat_dev;
         struct ieee80211_hw *hw;
         bool mac80211_registered;
 
-        struct spi_device *spi;
+        void *if_priv;
+
+        struct wl1271_if_operations *if_ops;
 
         void (*set_power)(bool enable);
         int irq;
@@ -357,6 +372,8 @@ struct wl1271 {
 #define WL1271_FLAG_IN_ELP             (6)
 #define WL1271_FLAG_PSM                (7)
 #define WL1271_FLAG_PSM_REQUESTED      (8)
+#define WL1271_FLAG_IRQ_PENDING        (9)
+#define WL1271_FLAG_IRQ_RUNNING       (10)
         unsigned long flags;
 
         struct wl1271_partition_set part;
@@ -373,6 +390,7 @@ struct wl1271 {
         u8 bssid[ETH_ALEN];
         u8 mac_addr[ETH_ALEN];
         u8 bss_type;
+        u8 set_bss_type;
         u8 ssid[IW_ESSID_MAX_SIZE + 1];
         u8 ssid_len;
         int channel;
@@ -382,13 +400,13 @@ struct wl1271 {
         /* Accounting for allocated / available TX blocks on HW */
         u32 tx_blocks_freed[NUM_TX_QUEUES];
         u32 tx_blocks_available;
-        u8 tx_results_count;
+        u32 tx_results_count;
 
         /* Transmitted TX packets counter for chipset interface */
-        int tx_packets_count;
+        u32 tx_packets_count;
 
         /* Time-offset between host and chipset clocks */
-        int time_offset;
+        s64 time_offset;
 
         /* Session counter for the chipset */
         int session_counter;
@@ -403,8 +421,7 @@ struct wl1271 {
 
         /* Security sequence number counters */
         u8 tx_security_last_seq;
-        u16 tx_security_seq_16;
-        u32 tx_security_seq_32;
+        s64 tx_security_seq;
 
         /* FW Rx counter */
         u32 rx_counter;
@@ -430,14 +447,19 @@ struct wl1271 {
         /* currently configured rate set */
         u32 sta_rate_set;
         u32 basic_rate_set;
+        u32 basic_rate;
         u32 rate_set;
 
         /* The current band */
         enum ieee80211_band band;
 
+        /* Beaconing interval (needed for ad-hoc) */
+        u32 beacon_int;
+
         /* Default key (for WEP) */
         u32 default_key;
 
+        unsigned int filters;
         unsigned int rx_config;
         unsigned int rx_filter;
 
@@ -465,6 +487,8 @@ struct wl1271 {
         /* Current chipset configuration */
         struct conf_drv_settings conf;
 
+        bool sg_enabled;
+
         struct list_head list;
 };
 
@@ -477,7 +501,8 @@ int wl1271_plt_stop(struct wl1271 *wl);
 
 #define WL1271_DEFAULT_POWER_LEVEL 0
 
-#define WL1271_TX_QUEUE_MAX_LENGTH 20
+#define WL1271_TX_QUEUE_LOW_WATERMARK  10
+#define WL1271_TX_QUEUE_HIGH_WATERMARK 25
 
 /* WL1271 needs a 200ms sleep after power on, and a 20ms sleep before power
    on in case is has been shut down shortly before */
diff --git a/drivers/net/wireless/wl12xx/wl1271_acx.c b/drivers/net/wireless/wl12xx/wl1271_acx.c
index 60f10dce4800..621c94691e7e 100644
--- a/drivers/net/wireless/wl12xx/wl1271_acx.c
+++ b/drivers/net/wireless/wl12xx/wl1271_acx.c
@@ -31,7 +31,6 @@
 #include "wl1271.h"
 #include "wl12xx_80211.h"
 #include "wl1271_reg.h"
-#include "wl1271_spi.h"
 #include "wl1271_ps.h"
 
 int wl1271_acx_wake_up_conditions(struct wl1271 *wl)
@@ -136,12 +135,7 @@ int wl1271_acx_tx_power(struct wl1271 *wl, int power)
                 goto out;
         }
 
-        /*
-         * FIXME: This is a workaround needed while we don't the correct
-         * calibration, to avoid distortions
-         */
-        /* acx->current_tx_power = power * 10; */
-        acx->current_tx_power = 120;
+        acx->current_tx_power = power * 10;
 
         ret = wl1271_cmd_configure(wl, DOT11_CUR_TX_PWR, acx, sizeof(*acx));
         if (ret < 0) {
@@ -510,12 +504,17 @@ out:
         return ret;
 }
 
-int wl1271_acx_conn_monit_params(struct wl1271 *wl)
+#define ACX_CONN_MONIT_DISABLE_VALUE  0xffffffff
+
+int wl1271_acx_conn_monit_params(struct wl1271 *wl, bool enable)
 {
         struct acx_conn_monit_params *acx;
+        u32 threshold = ACX_CONN_MONIT_DISABLE_VALUE;
+        u32 timeout = ACX_CONN_MONIT_DISABLE_VALUE;
         int ret;
 
-        wl1271_debug(DEBUG_ACX, "acx connection monitor parameters");
+        wl1271_debug(DEBUG_ACX, "acx connection monitor parameters: %s",
+                     enable ? "enabled" : "disabled");
 
         acx = kzalloc(sizeof(*acx), GFP_KERNEL);
         if (!acx) {
@@ -523,8 +522,13 @@ int wl1271_acx_conn_monit_params(struct wl1271 *wl)
                 goto out;
         }
 
-        acx->synch_fail_thold = cpu_to_le32(wl->conf.conn.synch_fail_thold);
-        acx->bss_lose_timeout = cpu_to_le32(wl->conf.conn.bss_lose_timeout);
+        if (enable) {
+                threshold = wl->conf.conn.synch_fail_thold;
+                timeout = wl->conf.conn.bss_lose_timeout;
+        }
+
+        acx->synch_fail_thold = cpu_to_le32(threshold);
+        acx->bss_lose_timeout = cpu_to_le32(timeout);
 
         ret = wl1271_cmd_configure(wl, ACX_CONN_MONIT_PARAMS,
                                    acx, sizeof(*acx));
@@ -540,7 +544,7 @@ out:
 }
 
 
-int wl1271_acx_sg_enable(struct wl1271 *wl)
+int wl1271_acx_sg_enable(struct wl1271 *wl, bool enable)
 {
         struct acx_bt_wlan_coex *pta;
         int ret;
@@ -553,7 +557,10 @@ int wl1271_acx_sg_enable(struct wl1271 *wl)
                 goto out;
         }
 
-        pta->enable = SG_ENABLE;
+        if (enable)
+                pta->enable = wl->conf.sg.state;
+        else
+                pta->enable = CONF_SG_DISABLE;
 
         ret = wl1271_cmd_configure(wl, ACX_SG_ENABLE, pta, sizeof(*pta));
         if (ret < 0) {
@@ -570,7 +577,7 @@ int wl1271_acx_sg_cfg(struct wl1271 *wl)
 {
         struct acx_bt_wlan_coex_param *param;
         struct conf_sg_settings *c = &wl->conf.sg;
-        int ret;
+        int i, ret;
 
         wl1271_debug(DEBUG_ACX, "acx sg cfg");
 
@@ -581,19 +588,9 @@ int wl1271_acx_sg_cfg(struct wl1271 *wl)
         }
 
         /* BT-WLAN coext parameters */
-        param->per_threshold = cpu_to_le32(c->per_threshold);
-        param->max_scan_compensation_time =
-                cpu_to_le32(c->max_scan_compensation_time);
-        param->nfs_sample_interval = cpu_to_le16(c->nfs_sample_interval);
-        param->load_ratio = c->load_ratio;
-        param->auto_ps_mode = c->auto_ps_mode;
-        param->probe_req_compensation = c->probe_req_compensation;
-        param->scan_window_compensation = c->scan_window_compensation;
-        param->antenna_config = c->antenna_config;
-        param->beacon_miss_threshold = c->beacon_miss_threshold;
-        param->rate_adaptation_threshold =
-                cpu_to_le32(c->rate_adaptation_threshold);
-        param->rate_adaptation_snr = c->rate_adaptation_snr;
+        for (i = 0; i < CONF_SG_PARAMS_MAX; i++)
+                param->params[i] = c->params[i];
+        param->param_idx = CONF_SG_PARAMS_ALL;
 
         ret = wl1271_cmd_configure(wl, ACX_SG_CFG, param, sizeof(*param));
         if (ret < 0) {
@@ -805,7 +802,7 @@ int wl1271_acx_rate_policies(struct wl1271 *wl)
 
         /* configure one basic rate class */
         idx = ACX_TX_BASIC_RATE;
-        acx->rate_class[idx].enabled_rates = cpu_to_le32(wl->basic_rate_set);
+        acx->rate_class[idx].enabled_rates = cpu_to_le32(wl->basic_rate);
         acx->rate_class[idx].short_retry_limit = c->short_retry_limit;
         acx->rate_class[idx].long_retry_limit = c->long_retry_limit;
         acx->rate_class[idx].aflags = c->aflags;
@@ -1142,3 +1139,58 @@ out:
         kfree(acx);
         return ret;
 }
+
+int wl1271_acx_keep_alive_mode(struct wl1271 *wl, bool enable)
+{
+        struct wl1271_acx_keep_alive_mode *acx = NULL;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_ACX, "acx keep alive mode: %d", enable);
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->enabled = enable;
+
+        ret = wl1271_cmd_configure(wl, ACX_KEEP_ALIVE_MODE, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("acx keep alive mode failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+int wl1271_acx_keep_alive_config(struct wl1271 *wl, u8 index, u8 tpl_valid)
+{
+        struct wl1271_acx_keep_alive_config *acx = NULL;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_ACX, "acx keep alive config");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->period = cpu_to_le32(wl->conf.conn.keep_alive_interval);
+        acx->index = index;
+        acx->tpl_validation = tpl_valid;
+        acx->trigger = ACX_KEEP_ALIVE_NO_TX;
+
+        ret = wl1271_cmd_configure(wl, ACX_SET_KEEP_ALIVE_CONFIG,
+                                   acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("acx keep alive config failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
diff --git a/drivers/net/wireless/wl12xx/wl1271_acx.h b/drivers/net/wireless/wl12xx/wl1271_acx.h
index aeccc98581eb..15cc56192de9 100644
--- a/drivers/net/wireless/wl12xx/wl1271_acx.h
+++ b/drivers/net/wireless/wl12xx/wl1271_acx.h
@@ -392,81 +392,27 @@ struct acx_conn_monit_params {
        __le32 bss_lose_timeout; /* number of TU's from synch fail */
 } __attribute__ ((packed));
 
-enum {
-        SG_ENABLE = 0,
-        SG_DISABLE,
-        SG_SENSE_NO_ACTIVITY,
-        SG_SENSE_ACTIVE
-};
-
 struct acx_bt_wlan_coex {
         struct acx_header header;
 
-        /*
-         * 0 -> PTA enabled
-         * 1 -> PTA disabled
-         * 2 -> sense no active mode, i.e.
-         *      an interrupt is sent upon
-         *      BT activity.
-         * 3 -> PTA is switched on in response
-         *      to the interrupt sending.
-         */
         u8 enable;
         u8 pad[3];
 } __attribute__ ((packed));
 
-struct acx_dco_itrim_params {
+struct acx_bt_wlan_coex_param {
         struct acx_header header;
 
-        u8 enable;
+        __le32 params[CONF_SG_PARAMS_MAX];
+        u8 param_idx;
         u8 padding[3];
-        __le32 timeout;
 } __attribute__ ((packed));
 
-#define PTA_ANTENNA_TYPE_DEF              (0)
-#define PTA_BT_HP_MAXTIME_DEF             (2000)
-#define PTA_WLAN_HP_MAX_TIME_DEF          (5000)
-#define PTA_SENSE_DISABLE_TIMER_DEF       (1350)
-#define PTA_PROTECTIVE_RX_TIME_DEF        (1500)
-#define PTA_PROTECTIVE_TX_TIME_DEF        (1500)
-#define PTA_TIMEOUT_NEXT_BT_LP_PACKET_DEF (3000)
-#define PTA_SIGNALING_TYPE_DEF            (1)
-#define PTA_AFH_LEVERAGE_ON_DEF           (0)
-#define PTA_NUMBER_QUIET_CYCLE_DEF        (0)
-#define PTA_MAX_NUM_CTS_DEF               (3)
-#define PTA_NUMBER_OF_WLAN_PACKETS_DEF    (2)
-#define PTA_NUMBER_OF_BT_PACKETS_DEF      (2)
-#define PTA_PROTECTIVE_RX_TIME_FAST_DEF   (1500)
-#define PTA_PROTECTIVE_TX_TIME_FAST_DEF   (3000)
-#define PTA_CYCLE_TIME_FAST_DEF           (8700)
-#define PTA_RX_FOR_AVALANCHE_DEF          (5)
-#define PTA_ELP_HP_DEF                    (0)
-#define PTA_ANTI_STARVE_PERIOD_DEF        (500)
-#define PTA_ANTI_STARVE_NUM_CYCLE_DEF     (4)
-#define PTA_ALLOW_PA_SD_DEF               (1)
-#define PTA_TIME_BEFORE_BEACON_DEF        (6300)
-#define PTA_HPDM_MAX_TIME_DEF             (1600)
-#define PTA_TIME_OUT_NEXT_WLAN_DEF        (2550)
-#define PTA_AUTO_MODE_NO_CTS_DEF          (0)
-#define PTA_BT_HP_RESPECTED_DEF           (3)
-#define PTA_WLAN_RX_MIN_RATE_DEF          (24)
-#define PTA_ACK_MODE_DEF                  (1)
-
-struct acx_bt_wlan_coex_param {
+struct acx_dco_itrim_params {
         struct acx_header header;
 
-        __le32 per_threshold;
-        __le32 max_scan_compensation_time;
-        __le16 nfs_sample_interval;
-        u8 load_ratio;
-        u8 auto_ps_mode;
-        u8 probe_req_compensation;
-        u8 scan_window_compensation;
-        u8 antenna_config;
-        u8 beacon_miss_threshold;
-        __le32 rate_adaptation_threshold;
-        s8 rate_adaptation_snr;
+        u8 enable;
         u8 padding[3];
+        __le32 timeout;
 } __attribute__ ((packed));
 
 struct acx_energy_detection {
@@ -969,6 +915,33 @@ struct wl1271_acx_pm_config {
         u8 padding[3];
 } __attribute__ ((packed));
 
+struct wl1271_acx_keep_alive_mode {
+        struct acx_header header;
+
+        u8 enabled;
+        u8 padding[3];
+} __attribute__ ((packed));
+
+enum {
+        ACX_KEEP_ALIVE_NO_TX = 0,
+        ACX_KEEP_ALIVE_PERIOD_ONLY
+};
+
+enum {
+        ACX_KEEP_ALIVE_TPL_INVALID = 0,
+        ACX_KEEP_ALIVE_TPL_VALID
+};
+
+struct wl1271_acx_keep_alive_config {
+        struct acx_header header;
+
+        __le32 period;
+        u8 index;
+        u8 tpl_validation;
+        u8 trigger;
+        u8 padding;
+} __attribute__ ((packed));
+
 enum {
         ACX_WAKE_UP_CONDITIONS      = 0x0002,
         ACX_MEM_CFG                 = 0x0003,
@@ -1018,7 +991,7 @@ enum {
         ACX_BET_ENABLE              = 0x0050,
         ACX_RSSI_SNR_TRIGGER        = 0x0051,
         ACX_RSSI_SNR_WEIGHTS        = 0x0051,
-        ACX_KEEP_ALIVE_MODE         = 0x0052,
+        ACX_KEEP_ALIVE_MODE         = 0x0053,
         ACX_SET_KEEP_ALIVE_CONFIG   = 0x0054,
         ACX_BA_SESSION_RESPONDER_POLICY = 0x0055,
         ACX_BA_SESSION_INITIATOR_POLICY = 0x0056,
@@ -1058,8 +1031,8 @@ int wl1271_acx_rts_threshold(struct wl1271 *wl, u16 rts_threshold);
 int wl1271_acx_dco_itrim_params(struct wl1271 *wl);
 int wl1271_acx_beacon_filter_opt(struct wl1271 *wl, bool enable_filter);
 int wl1271_acx_beacon_filter_table(struct wl1271 *wl);
-int wl1271_acx_conn_monit_params(struct wl1271 *wl);
-int wl1271_acx_sg_enable(struct wl1271 *wl);
+int wl1271_acx_conn_monit_params(struct wl1271 *wl, bool enable);
+int wl1271_acx_sg_enable(struct wl1271 *wl, bool enable);
 int wl1271_acx_sg_cfg(struct wl1271 *wl);
 int wl1271_acx_cca_threshold(struct wl1271 *wl);
 int wl1271_acx_bcn_dtim_options(struct wl1271 *wl);
@@ -1085,5 +1058,7 @@ int wl1271_acx_bet_enable(struct wl1271 *wl, bool enable);
 int wl1271_acx_arp_ip_filter(struct wl1271 *wl, bool enable, u8 *address,
                              u8 version);
 int wl1271_acx_pm_config(struct wl1271 *wl);
+int wl1271_acx_keep_alive_mode(struct wl1271 *wl, bool enable);
+int wl1271_acx_keep_alive_config(struct wl1271 *wl, u8 index, u8 tpl_valid);
 
 #endif /* __WL1271_ACX_H__ */
diff --git a/drivers/net/wireless/wl12xx/wl1271_boot.c b/drivers/net/wireless/wl12xx/wl1271_boot.c
index 2be76ee42bb9..7acef88df1fe 100644
--- a/drivers/net/wireless/wl12xx/wl1271_boot.c
+++ b/drivers/net/wireless/wl12xx/wl1271_boot.c
@@ -1,7 +1,7 @@
 /*
  * This file is part of wl1271
  *
- * Copyright (C) 2008-2009 Nokia Corporation
+ * Copyright (C) 2008-2010 Nokia Corporation
  *
  * Contact: Luciano Coelho <luciano.coelho@nokia.com>
  *
@@ -26,7 +26,6 @@
 #include "wl1271_acx.h"
 #include "wl1271_reg.h"
 #include "wl1271_boot.h"
-#include "wl1271_spi.h"
 #include "wl1271_io.h"
 #include "wl1271_event.h"
 
@@ -229,6 +228,14 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
         nvs_len = sizeof(wl->nvs->nvs);
         nvs_ptr = (u8 *)wl->nvs->nvs;
 
+        /* update current MAC address to NVS */
+        nvs_ptr[11] = wl->mac_addr[0];
+        nvs_ptr[10] = wl->mac_addr[1];
+        nvs_ptr[6] = wl->mac_addr[2];
+        nvs_ptr[5] = wl->mac_addr[3];
+        nvs_ptr[4] = wl->mac_addr[4];
+        nvs_ptr[3] = wl->mac_addr[5];
+
         /*
          * Layout before the actual NVS tables:
          * 1 byte : burst length.
@@ -299,7 +306,7 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
 
 static void wl1271_boot_enable_interrupts(struct wl1271 *wl)
 {
-        enable_irq(wl->irq);
+        wl1271_enable_interrupts(wl);
         wl1271_write32(wl, ACX_REG_INTERRUPT_MASK,
                        WL1271_ACX_INTR_ALL & ~(WL1271_INTR_MASK));
         wl1271_write32(wl, HI_CFG, HI_CFG_DEF_VAL);
@@ -403,7 +410,9 @@ static int wl1271_boot_run_firmware(struct wl1271 *wl)
         /* unmask required mbox events  */
         wl->event_mask = BSS_LOSE_EVENT_ID |
                 SCAN_COMPLETE_EVENT_ID |
-                PS_REPORT_EVENT_ID;
+                PS_REPORT_EVENT_ID |
+                JOIN_EVENT_COMPLETE_ID |
+                DISCONNECT_EVENT_COMPLETE_ID;
 
         ret = wl1271_event_unmask(wl);
         if (ret < 0) {
@@ -444,11 +453,15 @@ int wl1271_boot(struct wl1271 *wl)
 
         if (REF_CLOCK != 0) {
                 u16 val;
-                /* Set clock type */
+                /* Set clock type (open drain) */
                 val = wl1271_top_reg_read(wl, OCP_REG_CLK_TYPE);
                 val &= FREF_CLK_TYPE_BITS;
-                val |= CLK_REQ_PRCM;
                 wl1271_top_reg_write(wl, OCP_REG_CLK_TYPE, val);
+
+                /* Set clock pull mode (no pull) */
+                val = wl1271_top_reg_read(wl, OCP_REG_CLK_PULL);
+                val |= NO_PULL;
+                wl1271_top_reg_write(wl, OCP_REG_CLK_PULL, val);
         } else {
                 u16 val;
                 /* Set clock polarity */
diff --git a/drivers/net/wireless/wl12xx/wl1271_boot.h b/drivers/net/wireless/wl12xx/wl1271_boot.h
index 412443ee655a..95ecc5241959 100644
--- a/drivers/net/wireless/wl12xx/wl1271_boot.h
+++ b/drivers/net/wireless/wl12xx/wl1271_boot.h
@@ -53,10 +53,13 @@ struct wl1271_static_data {
 #define OCP_REG_POLARITY     0x0064
 #define OCP_REG_CLK_TYPE     0x0448
 #define OCP_REG_CLK_POLARITY 0x0cb2
+#define OCP_REG_CLK_PULL     0x0cb4
 
-#define CMD_MBOX_ADDRESS 0x407B4
 
-#define POLARITY_LOW BIT(1)
+#define CMD_MBOX_ADDRESS     0x407B4
+
+#define POLARITY_LOW         BIT(1)
+#define NO_PULL              (BIT(14) | BIT(15))
 
 #define FREF_CLK_TYPE_BITS     0xfffffe7f
 #define CLK_REQ_PRCM           0x100
diff --git a/drivers/net/wireless/wl12xx/wl1271_cmd.c b/drivers/net/wireless/wl12xx/wl1271_cmd.c
index 36a64e06f290..b19090334bc0 100644
--- a/drivers/net/wireless/wl12xx/wl1271_cmd.c
+++ b/drivers/net/wireless/wl12xx/wl1271_cmd.c
@@ -1,7 +1,7 @@
 /*
  * This file is part of wl1271
  *
- * Copyright (C) 2009 Nokia Corporation
+ * Copyright (C) 2009-2010 Nokia Corporation
  *
  * Contact: Luciano Coelho <luciano.coelho@nokia.com>
  *
@@ -26,14 +26,17 @@
 #include <linux/crc7.h>
 #include <linux/spi/spi.h>
 #include <linux/etherdevice.h>
+#include <linux/ieee80211.h>
 
 #include "wl1271.h"
 #include "wl1271_reg.h"
-#include "wl1271_spi.h"
 #include "wl1271_io.h"
 #include "wl1271_acx.h"
 #include "wl12xx_80211.h"
 #include "wl1271_cmd.h"
+#include "wl1271_event.h"
+
+#define WL1271_CMD_POLL_COUNT       5
 
 /*
  * send command to firmware
@@ -51,6 +54,7 @@ int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len,
         u32 intr;
         int ret = 0;
         u16 status;
+        u16 poll_count = 0;
 
         cmd = buf;
         cmd->id = cpu_to_le16(id);
@@ -72,7 +76,11 @@ int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len,
                         goto out;
                 }
 
-                msleep(1);
+                udelay(10);
+                poll_count++;
+                if (poll_count == WL1271_CMD_POLL_COUNT)
+                        wl1271_info("cmd polling took over %d cycles",
+                                    poll_count);
 
                 intr = wl1271_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
         }
@@ -248,7 +256,36 @@ int wl1271_cmd_radio_parms(struct wl1271 *wl)
         return ret;
 }
 
-int wl1271_cmd_join(struct wl1271 *wl)
+/*
+ * Poll the mailbox event field until any of the bits in the mask is set or a
+ * timeout occurs (WL1271_EVENT_TIMEOUT in msecs)
+ */
+static int wl1271_cmd_wait_for_event(struct wl1271 *wl, u32 mask)
+{
+        u32 events_vector, event;
+        unsigned long timeout;
+
+        timeout = jiffies + msecs_to_jiffies(WL1271_EVENT_TIMEOUT);
+
+        do {
+                if (time_after(jiffies, timeout))
+                        return -ETIMEDOUT;
+
+                msleep(1);
+
+                /* read from both event fields */
+                wl1271_read(wl, wl->mbox_ptr[0], &events_vector,
+                            sizeof(events_vector), false);
+                event = events_vector & mask;
+                wl1271_read(wl, wl->mbox_ptr[1], &events_vector,
+                            sizeof(events_vector), false);
+                event |= events_vector & mask;
+        } while (!event);
+
+        return 0;
+}
+
+int wl1271_cmd_join(struct wl1271 *wl, u8 bss_type)
 {
         static bool do_cal = true;
         struct wl1271_cmd_join *join;
@@ -279,30 +316,13 @@ int wl1271_cmd_join(struct wl1271 *wl)
 
         join->rx_config_options = cpu_to_le32(wl->rx_config);
         join->rx_filter_options = cpu_to_le32(wl->rx_filter);
-        join->bss_type = wl->bss_type;
+        join->bss_type = bss_type;
+        join->basic_rate_set = wl->basic_rate_set;
 
-        /*
-         * FIXME: disable temporarily all filters because after commit
-         * 9cef8737 "mac80211: fix managed mode BSSID handling" broke
-         * association. The filter logic needs to be implemented properly
-         * and once that is done, this hack can be removed.
-         */
-        join->rx_config_options = cpu_to_le32(0);
-        join->rx_filter_options = cpu_to_le32(WL1271_DEFAULT_RX_FILTER);
-
-        if (wl->band == IEEE80211_BAND_2GHZ)
-                join->basic_rate_set = cpu_to_le32(CONF_HW_BIT_RATE_1MBPS   |
-                                                   CONF_HW_BIT_RATE_2MBPS   |
-                                                   CONF_HW_BIT_RATE_5_5MBPS |
-                                                   CONF_HW_BIT_RATE_11MBPS);
-        else {
+        if (wl->band == IEEE80211_BAND_5GHZ)
                 join->bss_type |= WL1271_JOIN_CMD_BSS_TYPE_5GHZ;
-                join->basic_rate_set = cpu_to_le32(CONF_HW_BIT_RATE_6MBPS  |
-                                                   CONF_HW_BIT_RATE_12MBPS |
-                                                   CONF_HW_BIT_RATE_24MBPS);
-        }
 
-        join->beacon_interval = cpu_to_le16(WL1271_DEFAULT_BEACON_INT);
+        join->beacon_interval = cpu_to_le16(wl->beacon_int);
         join->dtim_interval = WL1271_DEFAULT_DTIM_PERIOD;
 
         join->channel = wl->channel;
@@ -319,8 +339,7 @@ int wl1271_cmd_join(struct wl1271 *wl)
 
         /* reset TX security counters */
         wl->tx_security_last_seq = 0;
-        wl->tx_security_seq_16 = 0;
-        wl->tx_security_seq_32 = 0;
+        wl->tx_security_seq = 0;
 
         ret = wl1271_cmd_send(wl, CMD_START_JOIN, join, sizeof(*join), 0);
         if (ret < 0) {
@@ -328,11 +347,9 @@ int wl1271_cmd_join(struct wl1271 *wl)
                 goto out_free;
         }
 
-        /*
-         * ugly hack: we should wait for JOIN_EVENT_COMPLETE_ID but to
-         * simplify locking we just sleep instead, for now
-         */
-        msleep(10);
+        ret = wl1271_cmd_wait_for_event(wl, JOIN_EVENT_COMPLETE_ID);
+        if (ret < 0)
+                wl1271_error("cmd join event completion error");
 
 out_free:
         kfree(join);
@@ -464,7 +481,7 @@ int wl1271_cmd_data_path(struct wl1271 *wl, bool enable)
         if (ret < 0) {
                 wl1271_error("tx %s cmd for channel %d failed",
                              enable ? "start" : "stop", cmd->channel);
-                return ret;
+                goto out;
         }
 
         wl1271_debug(DEBUG_BOOT, "tx %s cmd channel %d",
@@ -548,25 +565,29 @@ out:
         return ret;
 }
 
-int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
-                    u8 active_scan, u8 high_prio, u8 band,
-                    u8 probe_requests)
+int wl1271_cmd_scan(struct wl1271 *wl, const u8 *ssid, size_t ssid_len,
+                    const u8 *ie, size_t ie_len, u8 active_scan,
+                    u8 high_prio, u8 band, u8 probe_requests)
 {
 
         struct wl1271_cmd_trigger_scan_to *trigger = NULL;
         struct wl1271_cmd_scan *params = NULL;
         struct ieee80211_channel *channels;
+        u32 rate;
         int i, j, n_ch, ret;
         u16 scan_options = 0;
         u8 ieee_band;
 
-        if (band == WL1271_SCAN_BAND_2_4_GHZ)
+        if (band == WL1271_SCAN_BAND_2_4_GHZ) {
                 ieee_band = IEEE80211_BAND_2GHZ;
-        else if (band == WL1271_SCAN_BAND_DUAL && wl1271_11a_enabled())
+                rate = wl->conf.tx.basic_rate;
+        } else if (band == WL1271_SCAN_BAND_DUAL && wl1271_11a_enabled()) {
                 ieee_band = IEEE80211_BAND_2GHZ;
-        else if (band == WL1271_SCAN_BAND_5_GHZ && wl1271_11a_enabled())
+                rate = wl->conf.tx.basic_rate;
+        } else if (band == WL1271_SCAN_BAND_5_GHZ && wl1271_11a_enabled()) {
                 ieee_band = IEEE80211_BAND_5GHZ;
-        else
+                rate = wl->conf.tx.basic_rate_5;
+        } else
                 return -EINVAL;
 
         if (wl->hw->wiphy->bands[ieee_band]->channels == NULL)
@@ -593,8 +614,7 @@ int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
         params->params.scan_options = cpu_to_le16(scan_options);
 
         params->params.num_probe_requests = probe_requests;
-        /* Let the fw autodetect suitable tx_rate for probes */
-        params->params.tx_rate = 0;
+        params->params.tx_rate = rate;
         params->params.tid_trigger = 0;
         params->params.scan_tag = WL1271_SCAN_DEFAULT_TAG;
 
@@ -621,12 +641,13 @@ int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
 
         params->params.num_channels = j;
 
-        if (len && ssid) {
-                params->params.ssid_len = len;
-                memcpy(params->params.ssid, ssid, len);
+        if (ssid_len && ssid) {
+                params->params.ssid_len = ssid_len;
+                memcpy(params->params.ssid, ssid, ssid_len);
         }
 
-        ret = wl1271_cmd_build_probe_req(wl, ssid, len, ieee_band);
+        ret = wl1271_cmd_build_probe_req(wl, ssid, ssid_len,
+                                         ie, ie_len, ieee_band);
         if (ret < 0) {
                 wl1271_error("PROBE request template failed");
                 goto out;
@@ -657,9 +678,9 @@ int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
                         wl->scan.active = active_scan;
                         wl->scan.high_prio = high_prio;
                         wl->scan.probe_requests = probe_requests;
-                        if (len && ssid) {
-                                wl->scan.ssid_len = len;
-                                memcpy(wl->scan.ssid, ssid, len);
+                        if (ssid_len && ssid) {
+                                wl->scan.ssid_len = ssid_len;
+                                memcpy(wl->scan.ssid, ssid, ssid_len);
                         } else
                                 wl->scan.ssid_len = 0;
                 }
@@ -674,11 +695,12 @@ int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
 
 out:
         kfree(params);
+        kfree(trigger);
         return ret;
 }
 
 int wl1271_cmd_template_set(struct wl1271 *wl, u16 template_id,
-                            void *buf, size_t buf_len)
+                            void *buf, size_t buf_len, int index, u32 rates)
 {
         struct wl1271_cmd_template_set *cmd;
         int ret = 0;
@@ -696,9 +718,10 @@ int wl1271_cmd_template_set(struct wl1271 *wl, u16 template_id,
 
         cmd->len = cpu_to_le16(buf_len);
         cmd->template_type = template_id;
-        cmd->enabled_rates = cpu_to_le32(wl->conf.tx.rc_conf.enabled_rates);
+        cmd->enabled_rates = cpu_to_le32(rates);
         cmd->short_retry_limit = wl->conf.tx.rc_conf.short_retry_limit;
         cmd->long_retry_limit = wl->conf.tx.rc_conf.long_retry_limit;
+        cmd->index = index;
 
         if (buf)
                 memcpy(cmd->template_data, buf, buf_len);
@@ -716,155 +739,129 @@ out:
         return ret;
 }
 
-static int wl1271_build_basic_rates(u8 *rates, u8 band)
+int wl1271_cmd_build_null_data(struct wl1271 *wl)
 {
-        u8 index = 0;
-
-        if (band == IEEE80211_BAND_2GHZ) {
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_1MB;
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_2MB;
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_5MB;
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_11MB;
-        } else if (band == IEEE80211_BAND_5GHZ) {
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_6MB;
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_12MB;
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_24MB;
-        } else {
-                wl1271_error("build_basic_rates invalid band: %d", band);
-        }
+        struct sk_buff *skb = NULL;
+        int size;
+        void *ptr;
+        int ret = -ENOMEM;
 
-        return index;
-}
 
-static int wl1271_build_extended_rates(u8 *rates, u8 band)
-{
-        u8 index = 0;
-
-        if (band == IEEE80211_BAND_2GHZ) {
-                rates[index++] = IEEE80211_OFDM_RATE_6MB;
-                rates[index++] = IEEE80211_OFDM_RATE_9MB;
-                rates[index++] = IEEE80211_OFDM_RATE_12MB;
-                rates[index++] = IEEE80211_OFDM_RATE_18MB;
-                rates[index++] = IEEE80211_OFDM_RATE_24MB;
-                rates[index++] = IEEE80211_OFDM_RATE_36MB;
-                rates[index++] = IEEE80211_OFDM_RATE_48MB;
-                rates[index++] = IEEE80211_OFDM_RATE_54MB;
-        } else if (band == IEEE80211_BAND_5GHZ) {
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_9MB;
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_18MB;
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_24MB;
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_36MB;
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_48MB;
-                rates[index++] =
-                        IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_54MB;
+        if (wl->bss_type == BSS_TYPE_IBSS) {
+                size = sizeof(struct wl12xx_null_data_template);
+                ptr = NULL;
         } else {
-                wl1271_error("build_basic_rates invalid band: %d", band);
+                skb = ieee80211_nullfunc_get(wl->hw, wl->vif);
+                if (!skb)
+                        goto out;
+                size = skb->len;
+                ptr = skb->data;
         }
 
-        return index;
+        ret = wl1271_cmd_template_set(wl, CMD_TEMPL_NULL_DATA, ptr, size, 0,
+                                      WL1271_RATE_AUTOMATIC);
+
+out:
+        dev_kfree_skb(skb);
+        if (ret)
+                wl1271_warning("cmd buld null data failed %d", ret);
+
+        return ret;
+
 }
 
-int wl1271_cmd_build_null_data(struct wl1271 *wl)
+int wl1271_cmd_build_klv_null_data(struct wl1271 *wl)
 {
-        struct wl12xx_null_data_template template;
+        struct sk_buff *skb = NULL;
+        int ret = -ENOMEM;
 
-        if (!is_zero_ether_addr(wl->bssid)) {
-                memcpy(template.header.da, wl->bssid, ETH_ALEN);
-                memcpy(template.header.bssid, wl->bssid, ETH_ALEN);
-        } else {
-                memset(template.header.da, 0xff, ETH_ALEN);
-                memset(template.header.bssid, 0xff, ETH_ALEN);
-        }
+        skb = ieee80211_nullfunc_get(wl->hw, wl->vif);
+        if (!skb)
+                goto out;
+
+        ret = wl1271_cmd_template_set(wl, CMD_TEMPL_KLV,
+                                      skb->data, skb->len,
+                                      CMD_TEMPL_KLV_IDX_NULL_DATA,
+                                      WL1271_RATE_AUTOMATIC);
 
-        memcpy(template.header.sa, wl->mac_addr, ETH_ALEN);
-        template.header.frame_ctl = cpu_to_le16(IEEE80211_FTYPE_DATA |
-                                                IEEE80211_STYPE_NULLFUNC |
-                                                IEEE80211_FCTL_TODS);
+out:
+        dev_kfree_skb(skb);
+        if (ret)
+                wl1271_warning("cmd build klv null data failed %d", ret);
 
-        return wl1271_cmd_template_set(wl, CMD_TEMPL_NULL_DATA, &template,
-                                       sizeof(template));
+        return ret;
 
 }
 
 int wl1271_cmd_build_ps_poll(struct wl1271 *wl, u16 aid)
 {
-        struct wl12xx_ps_poll_template template;
-
-        memcpy(template.bssid, wl->bssid, ETH_ALEN);
-        memcpy(template.ta, wl->mac_addr, ETH_ALEN);
-
-        /* aid in PS-Poll has its two MSBs each set to 1 */
-        template.aid = cpu_to_le16(1 << 15 | 1 << 14 | aid);
+        struct sk_buff *skb;
+        int ret = 0;
 
-        template.fc = cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_PSPOLL);
+        skb = ieee80211_pspoll_get(wl->hw, wl->vif);
+        if (!skb)
+                goto out;
 
-        return wl1271_cmd_template_set(wl, CMD_TEMPL_PS_POLL, &template,
-                                       sizeof(template));
+        ret = wl1271_cmd_template_set(wl, CMD_TEMPL_PS_POLL, skb->data,
+                                      skb->len, 0, wl->basic_rate);
 
+out:
+        dev_kfree_skb(skb);
+        return ret;
 }
 
-int wl1271_cmd_build_probe_req(struct wl1271 *wl, u8 *ssid, size_t ssid_len,
-                               u8 band)
+int wl1271_cmd_build_probe_req(struct wl1271 *wl,
+                               const u8 *ssid, size_t ssid_len,
+                               const u8 *ie, size_t ie_len, u8 band)
 {
-        struct wl12xx_probe_req_template template;
-        struct wl12xx_ie_rates *rates;
-        char *ptr;
-        u16 size;
+        struct sk_buff *skb;
         int ret;
 
-        ptr = (char *)&template;
-        size = sizeof(struct ieee80211_header);
-
-        memset(template.header.da, 0xff, ETH_ALEN);
-        memset(template.header.bssid, 0xff, ETH_ALEN);
-        memcpy(template.header.sa, wl->mac_addr, ETH_ALEN);
-        template.header.frame_ctl = cpu_to_le16(IEEE80211_STYPE_PROBE_REQ);
-
-        /* IEs */
-        /* SSID */
-        template.ssid.header.id = WLAN_EID_SSID;
-        template.ssid.header.len = ssid_len;
-        if (ssid_len && ssid)
-                memcpy(template.ssid.ssid, ssid, ssid_len);
-        size += sizeof(struct wl12xx_ie_header) + ssid_len;
-        ptr += size;
-
-        /* Basic Rates */
-        rates = (struct wl12xx_ie_rates *)ptr;
-        rates->header.id = WLAN_EID_SUPP_RATES;
-        rates->header.len = wl1271_build_basic_rates(rates->rates, band);
-        size += sizeof(struct wl12xx_ie_header) + rates->header.len;
-        ptr += sizeof(struct wl12xx_ie_header) + rates->header.len;
-
-        /* Extended rates */
-        rates = (struct wl12xx_ie_rates *)ptr;
-        rates->header.id = WLAN_EID_EXT_SUPP_RATES;
-        rates->header.len = wl1271_build_extended_rates(rates->rates, band);
-        size += sizeof(struct wl12xx_ie_header) + rates->header.len;
-
-        wl1271_dump(DEBUG_SCAN, "PROBE REQ: ", &template, size);
+        skb = ieee80211_probereq_get(wl->hw, wl->vif, ssid, ssid_len,
+                                     ie, ie_len);
+        if (!skb) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        wl1271_dump(DEBUG_SCAN, "PROBE REQ: ", skb->data, skb->len);
 
         if (band == IEEE80211_BAND_2GHZ)
                 ret = wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_2_4,
-                                              &template, size);
+                                              skb->data, skb->len, 0,
+                                              wl->conf.tx.basic_rate);
         else
                 ret = wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_5,
-                                              &template, size);
+                                              skb->data, skb->len, 0,
+                                              wl->conf.tx.basic_rate_5);
+
+out:
+        dev_kfree_skb(skb);
         return ret;
 }
 
+int wl1271_build_qos_null_data(struct wl1271 *wl)
+{
+        struct ieee80211_qos_hdr template;
+
+        memset(&template, 0, sizeof(template));
+
+        memcpy(template.addr1, wl->bssid, ETH_ALEN);
+        memcpy(template.addr2, wl->mac_addr, ETH_ALEN);
+        memcpy(template.addr3, wl->bssid, ETH_ALEN);
+
+        template.frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
+                                             IEEE80211_STYPE_QOS_NULLFUNC |
+                                             IEEE80211_FCTL_TODS);
+
+        /* FIXME: not sure what priority to use here */
+        template.qos_ctrl = cpu_to_le16(0);
+
+        return wl1271_cmd_template_set(wl, CMD_TEMPL_QOS_NULL_DATA, &template,
+                                       sizeof(template), 0,
+                                       WL1271_RATE_AUTOMATIC);
+}
+
 int wl1271_cmd_set_default_wep_key(struct wl1271 *wl, u8 id)
 {
         struct wl1271_cmd_set_keys *cmd;
@@ -975,6 +972,10 @@ int wl1271_cmd_disconnect(struct wl1271 *wl)
                 goto out_free;
         }
 
+        ret = wl1271_cmd_wait_for_event(wl, DISCONNECT_EVENT_COMPLETE_ID);
+        if (ret < 0)
+                wl1271_error("cmd disconnect event completion error");
+
 out_free:
         kfree(cmd);
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_cmd.h b/drivers/net/wireless/wl12xx/wl1271_cmd.h
index 2dc06c73532b..00f78b7aa384 100644
--- a/drivers/net/wireless/wl12xx/wl1271_cmd.h
+++ b/drivers/net/wireless/wl12xx/wl1271_cmd.h
@@ -33,7 +33,7 @@ int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len,
                     size_t res_len);
 int wl1271_cmd_general_parms(struct wl1271 *wl);
 int wl1271_cmd_radio_parms(struct wl1271 *wl);
-int wl1271_cmd_join(struct wl1271 *wl);
+int wl1271_cmd_join(struct wl1271 *wl, u8 bss_type);
 int wl1271_cmd_test(struct wl1271 *wl, void *buf, size_t buf_len, u8 answer);
 int wl1271_cmd_interrogate(struct wl1271 *wl, u16 id, void *buf, size_t len);
 int wl1271_cmd_configure(struct wl1271 *wl, u16 id, void *buf, size_t len);
@@ -41,15 +41,18 @@ int wl1271_cmd_data_path(struct wl1271 *wl, bool enable);
 int wl1271_cmd_ps_mode(struct wl1271 *wl, u8 ps_mode, bool send);
 int wl1271_cmd_read_memory(struct wl1271 *wl, u32 addr, void *answer,
                            size_t len);
-int wl1271_cmd_scan(struct wl1271 *wl, u8 *ssid, size_t len,
-                    u8 active_scan, u8 high_prio, u8 band,
-                    u8 probe_requests);
+int wl1271_cmd_scan(struct wl1271 *wl, const u8 *ssid, size_t ssid_len,
+                    const u8 *ie, size_t ie_len, u8 active_scan,
+                    u8 high_prio, u8 band, u8 probe_requests);
 int wl1271_cmd_template_set(struct wl1271 *wl, u16 template_id,
-                            void *buf, size_t buf_len);
+                            void *buf, size_t buf_len, int index, u32 rates);
 int wl1271_cmd_build_null_data(struct wl1271 *wl);
 int wl1271_cmd_build_ps_poll(struct wl1271 *wl, u16 aid);
-int wl1271_cmd_build_probe_req(struct wl1271 *wl, u8 *ssid, size_t ssid_len,
-                               u8 band);
+int wl1271_cmd_build_probe_req(struct wl1271 *wl,
+                               const u8 *ssid, size_t ssid_len,
+                               const u8 *ie, size_t ie_len, u8 band);
+int wl1271_build_qos_null_data(struct wl1271 *wl);
+int wl1271_cmd_build_klv_null_data(struct wl1271 *wl);
 int wl1271_cmd_set_default_wep_key(struct wl1271 *wl, u8 id);
 int wl1271_cmd_set_key(struct wl1271 *wl, u16 action, u8 id, u8 key_type,
                        u8 key_size, const u8 *key, const u8 *addr,
@@ -99,6 +102,11 @@ enum wl1271_commands {
 
 #define MAX_CMD_PARAMS 572
 
+enum {
+        CMD_TEMPL_KLV_IDX_NULL_DATA = 0,
+        CMD_TEMPL_KLV_IDX_MAX = 4
+};
+
 enum cmd_templ {
         CMD_TEMPL_NULL_DATA = 0,
         CMD_TEMPL_BEACON,
@@ -121,6 +129,7 @@ enum cmd_templ {
 /* unit ms */
 #define WL1271_COMMAND_TIMEOUT     2000
 #define WL1271_CMD_TEMPL_MAX_SIZE  252
+#define WL1271_EVENT_TIMEOUT       100
 
 struct wl1271_cmd_header {
         __le16 id;
@@ -243,6 +252,8 @@ struct cmd_enabledisable_path {
         u8 padding[3];
 } __attribute__ ((packed));
 
+#define WL1271_RATE_AUTOMATIC  0
+
 struct wl1271_cmd_template_set {
         struct wl1271_cmd_header header;
 
@@ -509,6 +520,8 @@ enum wl1271_disconnect_type {
 };
 
 struct wl1271_cmd_disconnect {
+        struct wl1271_cmd_header header;
+
         __le32 rx_config_options;
         __le32 rx_filter_options;
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_conf.h b/drivers/net/wireless/wl12xx/wl1271_conf.h
index 6f9e75cc5640..d76ae03762a3 100644
--- a/drivers/net/wireless/wl12xx/wl1271_conf.h
+++ b/drivers/net/wireless/wl12xx/wl1271_conf.h
@@ -65,110 +65,344 @@ enum {
         CONF_HW_RATE_INDEX_MAX     = CONF_HW_RATE_INDEX_54MBPS,
 };
 
-struct conf_sg_settings {
+enum {
+        CONF_HW_RXTX_RATE_MCS7 = 0,
+        CONF_HW_RXTX_RATE_MCS6,
+        CONF_HW_RXTX_RATE_MCS5,
+        CONF_HW_RXTX_RATE_MCS4,
+        CONF_HW_RXTX_RATE_MCS3,
+        CONF_HW_RXTX_RATE_MCS2,
+        CONF_HW_RXTX_RATE_MCS1,
+        CONF_HW_RXTX_RATE_MCS0,
+        CONF_HW_RXTX_RATE_54,
+        CONF_HW_RXTX_RATE_48,
+        CONF_HW_RXTX_RATE_36,
+        CONF_HW_RXTX_RATE_24,
+        CONF_HW_RXTX_RATE_22,
+        CONF_HW_RXTX_RATE_18,
+        CONF_HW_RXTX_RATE_12,
+        CONF_HW_RXTX_RATE_11,
+        CONF_HW_RXTX_RATE_9,
+        CONF_HW_RXTX_RATE_6,
+        CONF_HW_RXTX_RATE_5_5,
+        CONF_HW_RXTX_RATE_2,
+        CONF_HW_RXTX_RATE_1,
+        CONF_HW_RXTX_RATE_MAX,
+        CONF_HW_RXTX_RATE_UNSUPPORTED = 0xff
+};
+
+enum {
+        CONF_SG_DISABLE = 0,
+        CONF_SG_PROTECTIVE,
+        CONF_SG_OPPORTUNISTIC
+};
+
+enum {
         /*
-         * Defines the PER threshold in PPM of the BT voice of which reaching
-         * this value will trigger raising the priority of the BT voice by
-         * the BT IP until next NFS sample interval time as defined in
-         * nfs_sample_interval.
+         * PER threshold in PPM of the BT voice
          *
-         * Unit: PER value in PPM (parts per million)
-         * #Error_packets / #Total_packets
+         * Range: 0 - 10000000
+         */
+        CONF_SG_BT_PER_THRESHOLD = 0,
 
-         * Range: u32
+        /*
+         * Number of consequent RX_ACTIVE activities to override BT voice
+         * frames to ensure WLAN connection
+         *
+         * Range: 0 - 100
+         */
+        CONF_SG_HV3_MAX_OVERRIDE,
+
+        /*
+         * Defines the PER threshold of the BT voice
+         *
+         * Range: 0 - 65000
+         */
+        CONF_SG_BT_NFS_SAMPLE_INTERVAL,
+
+        /*
+         * Defines the load ratio of BT
+         *
+         * Range: 0 - 100 (%)
+         */
+        CONF_SG_BT_LOAD_RATIO,
+
+        /*
+         * Defines whether the SG will force WLAN host to enter/exit PSM
+         *
+         * Range: 1 - SG can force, 0 - host handles PSM
+         */
+        CONF_SG_AUTO_PS_MODE,
+
+        /*
+         * Compensation percentage of probe requests when scan initiated
+         * during BT voice/ACL link.
+         *
+         * Range: 0 - 255 (%)
+         */
+        CONF_SG_AUTO_SCAN_PROBE_REQ,
+
+        /*
+         * Compensation percentage of probe requests when active scan initiated
+         * during BT voice
+         *
+         * Range: 0 - 255 (%)
+         */
+        CONF_SG_ACTIVE_SCAN_DURATION_FACTOR_HV3,
+
+        /*
+         * Defines antenna configuration (single/dual antenna)
+         *
+         * Range: 0 - single antenna, 1 - dual antenna
+         */
+        CONF_SG_ANTENNA_CONFIGURATION,
+
+        /*
+         * The threshold (percent) of max consequtive beacon misses before
+         * increasing priority of beacon reception.
+         *
+         * Range: 0 - 100 (%)
+         */
+        CONF_SG_BEACON_MISS_PERCENT,
+
+        /*
+         * The rate threshold below which receiving a data frame from the AP
+         * will increase the priority of the data frame above BT traffic.
+         *
+         * Range: 0,2, 5(=5.5), 6, 9, 11, 12, 18, 24, 36, 48, 54
+         */
+        CONF_SG_RATE_ADAPT_THRESH,
+
+        /*
+         * Not used currently.
+         *
+         * Range: 0
+         */
+        CONF_SG_RATE_ADAPT_SNR,
+
+        /*
+         * Configure the min and max time BT gains the antenna
+         * in WLAN PSM / BT master basic rate
+         *
+         * Range: 0 - 255 (ms)
          */
-        u32 per_threshold;
+        CONF_SG_WLAN_PS_BT_ACL_MASTER_MIN_BR,
+        CONF_SG_WLAN_PS_BT_ACL_MASTER_MAX_BR,
 
         /*
-         * This value is an absolute time in micro-seconds to limit the
-         * maximum scan duration compensation while in SG
+         * The time after it expires no new WLAN trigger frame is trasmitted
+         * in WLAN PSM / BT master basic rate
+         *
+         * Range: 0 - 255 (ms)
          */
-        u32 max_scan_compensation_time;
+        CONF_SG_WLAN_PS_MAX_BT_ACL_MASTER_BR,
 
-        /* Defines the PER threshold of the BT voice of which reaching this
-         * value will trigger raising the priority of the BT voice until next
-         * NFS sample interval time as defined in sample_interval.
+        /*
+         * Configure the min and max time BT gains the antenna
+         * in WLAN PSM / BT slave basic rate
          *
-         * Unit: msec
-         * Range: 1-65000
+         * Range: 0 - 255 (ms)
          */
-        u16 nfs_sample_interval;
+        CONF_SG_WLAN_PS_BT_ACL_SLAVE_MIN_BR,
+        CONF_SG_WLAN_PS_BT_ACL_SLAVE_MAX_BR,
 
         /*
-         * Defines the load ratio for the BT.
-         * The WLAN ratio is: 100 - load_ratio
+         * The time after it expires no new WLAN trigger frame is trasmitted
+         * in WLAN PSM / BT slave basic rate
          *
-         * Unit: Percent
-         * Range: 0-100
+         * Range: 0 - 255 (ms)
          */
-        u8 load_ratio;
+        CONF_SG_WLAN_PS_MAX_BT_ACL_SLAVE_BR,
 
         /*
-         * true - Co-ex is allowed to enter/exit P.S automatically and
-         *        transparently to the host
+         * Configure the min and max time BT gains the antenna
+         * in WLAN PSM / BT master EDR
          *
-         * false - Co-ex is disallowed to enter/exit P.S and will trigger an
-         *         event to the host to notify for the need to enter/exit P.S
-         *         due to BT change state
+         * Range: 0 - 255 (ms)
+         */
+        CONF_SG_WLAN_PS_BT_ACL_MASTER_MIN_EDR,
+        CONF_SG_WLAN_PS_BT_ACL_MASTER_MAX_EDR,
+
+        /*
+         * The time after it expires no new WLAN trigger frame is trasmitted
+         * in WLAN PSM / BT master EDR
          *
+         * Range: 0 - 255 (ms)
          */
-        u8 auto_ps_mode;
+        CONF_SG_WLAN_PS_MAX_BT_ACL_MASTER_EDR,
 
         /*
-         * This parameter defines the compensation percentage of num of probe
-         * requests in case scan is initiated during BT voice/BT ACL
-         * guaranteed link.
+         * Configure the min and max time BT gains the antenna
+         * in WLAN PSM / BT slave EDR
          *
-         * Unit: Percent
-         * Range: 0-255 (0 - No compensation)
+         * Range: 0 - 255 (ms)
          */
-        u8 probe_req_compensation;
+        CONF_SG_WLAN_PS_BT_ACL_SLAVE_MIN_EDR,
+        CONF_SG_WLAN_PS_BT_ACL_SLAVE_MAX_EDR,
 
         /*
-         * This parameter defines the compensation percentage of scan window
-         * size in case scan is initiated during BT voice/BT ACL Guaranteed
-         * link.
+         * The time after it expires no new WLAN trigger frame is trasmitted
+         * in WLAN PSM / BT slave EDR
          *
-         * Unit: Percent
-         * Range: 0-255 (0 - No compensation)
+         * Range: 0 - 255 (ms)
          */
-        u8 scan_window_compensation;
+        CONF_SG_WLAN_PS_MAX_BT_ACL_SLAVE_EDR,
 
         /*
-         * Defines the antenna configuration.
+         * RX guard time before the beginning of a new BT voice frame during
+         * which no new WLAN trigger frame is transmitted.
          *
-         * Range: 0 - Single Antenna; 1 - Dual Antenna
+         * Range: 0 - 100000 (us)
          */
-        u8 antenna_config;
+        CONF_SG_RXT,
 
         /*
-         * The percent out of the Max consecutive beacon miss roaming trigger
-         * which is the threshold for raising the priority of beacon
-         * reception.
+         * TX guard time before the beginning of a new BT voice frame during
+         * which no new WLAN frame is transmitted.
          *
-         * Range: 1-100
-         * N = MaxConsecutiveBeaconMiss
-         * P = coexMaxConsecutiveBeaconMissPrecent
-         * Threshold = MIN( N-1, round(N * P / 100))
+         * Range: 0 - 100000 (us)
          */
-        u8 beacon_miss_threshold;
+
+        CONF_SG_TXT,
 
         /*
-         * The RX rate threshold below which rate adaptation is assumed to be
-         * occurring at the AP which will raise priority for ACTIVE_RX and RX
-         * SP.
+         * Enable adaptive RXT/TXT algorithm. If disabled, the host values
+         * will be utilized.
          *
-         * Range: HW_BIT_RATE_*
+         * Range: 0 - disable, 1 - enable
          */
-        u32 rate_adaptation_threshold;
+        CONF_SG_ADAPTIVE_RXT_TXT,
 
         /*
-         * The SNR above which the RX rate threshold indicating AP rate
-         * adaptation is valid
+         * The used WLAN legacy service period during active BT ACL link
          *
-         * Range: -128 - 127
+         * Range: 0 - 255 (ms)
          */
-        s8 rate_adaptation_snr;
+        CONF_SG_PS_POLL_TIMEOUT,
+
+        /*
+         * The used WLAN UPSD service period during active BT ACL link
+         *
+         * Range: 0 - 255 (ms)
+         */
+        CONF_SG_UPSD_TIMEOUT,
+
+        /*
+         * Configure the min and max time BT gains the antenna
+         * in WLAN Active / BT master EDR
+         *
+         * Range: 0 - 255 (ms)
+         */
+        CONF_SG_WLAN_ACTIVE_BT_ACL_MASTER_MIN_EDR,
+        CONF_SG_WLAN_ACTIVE_BT_ACL_MASTER_MAX_EDR,
+
+        /*
+         * The maximum time WLAN can gain the antenna for
+         * in WLAN Active / BT master EDR
+         *
+         * Range: 0 - 255 (ms)
+         */
+        CONF_SG_WLAN_ACTIVE_MAX_BT_ACL_MASTER_EDR,
+
+        /*
+         * Configure the min and max time BT gains the antenna
+         * in WLAN Active / BT slave EDR
+         *
+         * Range: 0 - 255 (ms)
+         */
+        CONF_SG_WLAN_ACTIVE_BT_ACL_SLAVE_MIN_EDR,
+        CONF_SG_WLAN_ACTIVE_BT_ACL_SLAVE_MAX_EDR,
+
+        /*
+         * The maximum time WLAN can gain the antenna for
+         * in WLAN Active / BT slave EDR
+         *
+         * Range: 0 - 255 (ms)
+         */
+        CONF_SG_WLAN_ACTIVE_MAX_BT_ACL_SLAVE_EDR,
+
+        /*
+         * Configure the min and max time BT gains the antenna
+         * in WLAN Active / BT basic rate
+         *
+         * Range: 0 - 255 (ms)
+         */
+        CONF_SG_WLAN_ACTIVE_BT_ACL_MIN_BR,
+        CONF_SG_WLAN_ACTIVE_BT_ACL_MAX_BR,
+
+        /*
+         * The maximum time WLAN can gain the antenna for
+         * in WLAN Active / BT basic rate
+         *
+         * Range: 0 - 255 (ms)
+         */
+        CONF_SG_WLAN_ACTIVE_MAX_BT_ACL_BR,
+
+        /*
+         * Compensation percentage of WLAN passive scan window if initiated
+         * during BT voice
+         *
+         * Range: 0 - 1000 (%)
+         */
+        CONF_SG_PASSIVE_SCAN_DURATION_FACTOR_HV3,
+
+        /*
+         * Compensation percentage of WLAN passive scan window if initiated
+         * during BT A2DP
+         *
+         * Range: 0 - 1000 (%)
+         */
+        CONF_SG_PASSIVE_SCAN_DURATION_FACTOR_A2DP,
+
+        /*
+         * Fixed time ensured for BT traffic to gain the antenna during WLAN
+         * passive scan.
+         *
+         * Range: 0 - 1000 ms
+         */
+        CONF_SG_PASSIVE_SCAN_A2DP_BT_TIME,
+
+        /*
+         * Fixed time ensured for WLAN traffic to gain the antenna during WLAN
+         * passive scan.
+         *
+         * Range: 0 - 1000 ms
+         */
+        CONF_SG_PASSIVE_SCAN_A2DP_WLAN_TIME,
+
+        /*
+         * Number of consequent BT voice frames not interrupted by WLAN
+         *
+         * Range: 0 - 100
+         */
+        CONF_SG_HV3_MAX_SERVED,
+
+        /*
+         * Protection time of the DHCP procedure.
+         *
+         * Range: 0 - 100000 (ms)
+         */
+        CONF_SG_DHCP_TIME,
+
+        /*
+         * Compensation percentage of WLAN active scan window if initiated
+         * during BT A2DP
+         *
+         * Range: 0 - 1000 (%)
+         */
+        CONF_SG_ACTIVE_SCAN_DURATION_FACTOR_A2DP,
+        CONF_SG_TEMP_PARAM_1,
+        CONF_SG_TEMP_PARAM_2,
+        CONF_SG_TEMP_PARAM_3,
+        CONF_SG_TEMP_PARAM_4,
+        CONF_SG_TEMP_PARAM_5,
+        CONF_SG_PARAMS_MAX,
+        CONF_SG_PARAMS_ALL = 0xff
+};
+
+struct conf_sg_settings {
+        __le32 params[CONF_SG_PARAMS_MAX];
+        u8 state;
 };
 
 enum conf_rx_queue_type {
@@ -440,6 +674,19 @@ struct conf_tx_settings {
          */
         u16 tx_compl_threshold;
 
+        /*
+         * The rate used for control messages and scanning on the 2.4GHz band
+         *
+         * Range: CONF_HW_BIT_RATE_* bit mask
+         */
+        u32 basic_rate;
+
+        /*
+         * The rate used for control messages and scanning on the 5GHz band
+         *
+         * Range: CONF_HW_BIT_RATE_* bit mask
+         */
+        u32 basic_rate_5;
 };
 
 enum {
@@ -721,6 +968,22 @@ struct conf_conn_settings {
          * Range 0 - 255
          */
         u8 psm_entry_retries;
+
+        /*
+         *
+         * Specifies the interval of the connection keep-alive null-func
+         * frame in ms.
+         *
+         * Range: 1000 - 3600000
+         */
+        u32 keep_alive_interval;
+
+        /*
+         * Maximum listen interval supported by the driver in units of beacons.
+         *
+         * Range: u16
+         */
+        u8 max_listen_interval;
 };
 
 enum {
diff --git a/drivers/net/wireless/wl12xx/wl1271_debugfs.c b/drivers/net/wireless/wl12xx/wl1271_debugfs.c
index 8d7588ca68fd..3c0f5b1ac272 100644
--- a/drivers/net/wireless/wl12xx/wl1271_debugfs.c
+++ b/drivers/net/wireless/wl12xx/wl1271_debugfs.c
@@ -28,6 +28,7 @@
 #include "wl1271.h"
 #include "wl1271_acx.h"
 #include "wl1271_ps.h"
+#include "wl1271_io.h"
 
 /* ms */
 #define WL1271_DEBUGFS_STATS_LIFETIME 1000
@@ -276,13 +277,10 @@ static ssize_t gpio_power_write(struct file *file,
                 goto out;
         }
 
-        if (value) {
-                wl->set_power(true);
-                set_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
-        } else {
-                wl->set_power(false);
-                clear_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
-        }
+        if (value)
+                wl1271_power_on(wl);
+        else
+                wl1271_power_off(wl);
 
 out:
         mutex_unlock(&wl->mutex);
diff --git a/drivers/net/wireless/wl12xx/wl1271_event.c b/drivers/net/wireless/wl12xx/wl1271_event.c
index 7468ef10194b..daacf176cf09 100644
--- a/drivers/net/wireless/wl12xx/wl1271_event.c
+++ b/drivers/net/wireless/wl12xx/wl1271_event.c
@@ -23,7 +23,6 @@
 
 #include "wl1271.h"
 #include "wl1271_reg.h"
-#include "wl1271_spi.h"
 #include "wl1271_io.h"
 #include "wl1271_event.h"
 #include "wl1271_ps.h"
@@ -32,34 +31,24 @@
 static int wl1271_event_scan_complete(struct wl1271 *wl,
                                       struct event_mailbox *mbox)
 {
-        int size = sizeof(struct wl12xx_probe_req_template);
         wl1271_debug(DEBUG_EVENT, "status: 0x%x",
                      mbox->scheduled_scan_status);
 
         if (test_bit(WL1271_FLAG_SCANNING, &wl->flags)) {
                 if (wl->scan.state == WL1271_SCAN_BAND_DUAL) {
-                        wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_2_4,
-                                                NULL, size);
                         /* 2.4 GHz band scanned, scan 5 GHz band, pretend
                          * to the wl1271_cmd_scan function that we are not
                          * scanning as it checks that.
                          */
                         clear_bit(WL1271_FLAG_SCANNING, &wl->flags);
+                        /* FIXME: ie missing! */
                         wl1271_cmd_scan(wl, wl->scan.ssid, wl->scan.ssid_len,
+                                                NULL, 0,
                                                 wl->scan.active,
                                                 wl->scan.high_prio,
                                                 WL1271_SCAN_BAND_5_GHZ,
                                                 wl->scan.probe_requests);
                 } else {
-                        if (wl->scan.state == WL1271_SCAN_BAND_2_4_GHZ)
-                                wl1271_cmd_template_set(wl,
-                                                CMD_TEMPL_CFG_PROBE_REQ_2_4,
-                                                NULL, size);
-                        else
-                                wl1271_cmd_template_set(wl,
-                                                CMD_TEMPL_CFG_PROBE_REQ_5,
-                                                NULL, size);
-
                         mutex_unlock(&wl->mutex);
                         ieee80211_scan_completed(wl->hw, false);
                         mutex_lock(&wl->mutex);
@@ -92,16 +81,9 @@ static int wl1271_event_ps_report(struct wl1271 *wl,
                         ret = wl1271_ps_set_mode(wl, STATION_POWER_SAVE_MODE,
                                                  true);
                 } else {
-                        wl1271_error("PSM entry failed, giving up.\n");
-                        /* FIXME: this may need to be reconsidered. for now it
-                           is not possible to indicate to the mac80211
-                           afterwards that PSM entry failed. To maximize
-                           functionality (receiving data and remaining
-                           associated) make sure that we are in sync with the
-                           AP in regard of PSM mode. */
-                        ret = wl1271_ps_set_mode(wl, STATION_ACTIVE_MODE,
-                                                 false);
+                        wl1271_info("No ack to nullfunc from AP.");
                         wl->psm_entry_retry = 0;
+                        *beacon_loss = true;
                 }
                 break;
         case EVENT_ENTER_POWER_SAVE_SUCCESS:
@@ -172,10 +154,13 @@ static int wl1271_event_process(struct wl1271 *wl, struct event_mailbox *mbox)
          * The BSS_LOSE_EVENT_ID is only needed while psm (and hence beacon
          * filtering) is enabled. Without PSM, the stack will receive all
          * beacons and can detect beacon loss by itself.
+         *
+         * As there's possibility that the driver disables PSM before receiving
+         * BSS_LOSE_EVENT, beacon loss has to be reported to the stack.
+         *
          */
-        if (vector & BSS_LOSE_EVENT_ID &&
-            test_bit(WL1271_FLAG_PSM, &wl->flags)) {
-                wl1271_debug(DEBUG_EVENT, "BSS_LOSE_EVENT");
+        if (vector & BSS_LOSE_EVENT_ID) {
+                wl1271_info("Beacon loss detected.");
 
                 /* indicate to the stack, that beacons have been lost */
                 beacon_loss = true;
@@ -188,16 +173,8 @@ static int wl1271_event_process(struct wl1271 *wl, struct event_mailbox *mbox)
                         return ret;
         }
 
-        if (wl->vif && beacon_loss) {
-                /* Obviously, it's dangerous to release the mutex while
-                   we are holding many of the variables in the wl struct.
-                   That's why it's done last in the function, and care must
-                   be taken that nothing more is done after this function
-                   returns. */
-                mutex_unlock(&wl->mutex);
-                ieee80211_beacon_loss(wl->vif);
-                mutex_lock(&wl->mutex);
-        }
+        if (wl->vif && beacon_loss)
+                ieee80211_connection_loss(wl->vif);
 
         return 0;
 }
diff --git a/drivers/net/wireless/wl12xx/wl1271_init.c b/drivers/net/wireless/wl12xx/wl1271_init.c
index 86c30a86a456..9ab336829044 100644
--- a/drivers/net/wireless/wl12xx/wl1271_init.c
+++ b/drivers/net/wireless/wl12xx/wl1271_init.c
@@ -51,50 +51,65 @@ static int wl1271_init_hwenc_config(struct wl1271 *wl)
 
 int wl1271_init_templates_config(struct wl1271 *wl)
 {
-        int ret;
+        int ret, i;
 
         /* send empty templates for fw memory reservation */
         ret = wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_2_4, NULL,
-                                      sizeof(struct wl12xx_probe_req_template));
+                                      sizeof(struct wl12xx_probe_req_template),
+                                      0, WL1271_RATE_AUTOMATIC);
         if (ret < 0)
                 return ret;
 
         if (wl1271_11a_enabled()) {
+                size_t size = sizeof(struct wl12xx_probe_req_template);
                 ret = wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_5,
-                                NULL,
-                                sizeof(struct wl12xx_probe_req_template));
+                                              NULL, size, 0,
+                                              WL1271_RATE_AUTOMATIC);
                 if (ret < 0)
                         return ret;
         }
 
         ret = wl1271_cmd_template_set(wl, CMD_TEMPL_NULL_DATA, NULL,
-                                      sizeof(struct wl12xx_null_data_template));
+                                      sizeof(struct wl12xx_null_data_template),
+                                      0, WL1271_RATE_AUTOMATIC);
         if (ret < 0)
                 return ret;
 
         ret = wl1271_cmd_template_set(wl, CMD_TEMPL_PS_POLL, NULL,
-                                      sizeof(struct wl12xx_ps_poll_template));
+                                      sizeof(struct wl12xx_ps_poll_template),
+                                      0, WL1271_RATE_AUTOMATIC);
         if (ret < 0)
                 return ret;
 
         ret = wl1271_cmd_template_set(wl, CMD_TEMPL_QOS_NULL_DATA, NULL,
                                       sizeof
-                                      (struct wl12xx_qos_null_data_template));
+                                      (struct wl12xx_qos_null_data_template),
+                                      0, WL1271_RATE_AUTOMATIC);
         if (ret < 0)
                 return ret;
 
         ret = wl1271_cmd_template_set(wl, CMD_TEMPL_PROBE_RESPONSE, NULL,
                                       sizeof
-                                      (struct wl12xx_probe_resp_template));
+                                      (struct wl12xx_probe_resp_template),
+                                      0, WL1271_RATE_AUTOMATIC);
         if (ret < 0)
                 return ret;
 
         ret = wl1271_cmd_template_set(wl, CMD_TEMPL_BEACON, NULL,
                                       sizeof
-                                      (struct wl12xx_beacon_template));
+                                      (struct wl12xx_beacon_template),
+                                      0, WL1271_RATE_AUTOMATIC);
         if (ret < 0)
                 return ret;
 
+        for (i = 0; i < CMD_TEMPL_KLV_IDX_MAX; i++) {
+                ret = wl1271_cmd_template_set(wl, CMD_TEMPL_KLV, NULL,
+                                              WL1271_CMD_TEMPL_MAX_SIZE, i,
+                                              WL1271_RATE_AUTOMATIC);
+                if (ret < 0)
+                        return ret;
+        }
+
         return 0;
 }
 
@@ -160,11 +175,11 @@ int wl1271_init_pta(struct wl1271 *wl)
 {
         int ret;
 
-        ret = wl1271_acx_sg_enable(wl);
+        ret = wl1271_acx_sg_cfg(wl);
         if (ret < 0)
                 return ret;
 
-        ret = wl1271_acx_sg_cfg(wl);
+        ret = wl1271_acx_sg_enable(wl, wl->sg_enabled);
         if (ret < 0)
                 return ret;
 
@@ -236,7 +251,7 @@ int wl1271_hw_init(struct wl1271 *wl)
                 goto out_free_memmap;
 
         /* Initialize connection monitoring thresholds */
-        ret = wl1271_acx_conn_monit_params(wl);
+        ret = wl1271_acx_conn_monit_params(wl, false);
         if (ret < 0)
                 goto out_free_memmap;
 
@@ -324,6 +339,19 @@ int wl1271_hw_init(struct wl1271 *wl)
         if (ret < 0)
                 goto out_free_memmap;
 
+        /* disable all keep-alive templates */
+        for (i = 0; i < CMD_TEMPL_KLV_IDX_MAX; i++) {
+                ret = wl1271_acx_keep_alive_config(wl, i,
+                                                   ACX_KEEP_ALIVE_TPL_INVALID);
+                if (ret < 0)
+                        goto out_free_memmap;
+        }
+
+        /* disable the keep-alive feature */
+        ret = wl1271_acx_keep_alive_mode(wl, false);
+        if (ret < 0)
+                goto out_free_memmap;
+
         return 0;
 
  out_free_memmap:
diff --git a/drivers/net/wireless/wl12xx/wl1271_io.c b/drivers/net/wireless/wl12xx/wl1271_io.c
index 5cd94d5666c2..c8759acef131 100644
--- a/drivers/net/wireless/wl12xx/wl1271_io.c
+++ b/drivers/net/wireless/wl12xx/wl1271_io.c
@@ -28,30 +28,29 @@
 
 #include "wl1271.h"
 #include "wl12xx_80211.h"
-#include "wl1271_spi.h"
 #include "wl1271_io.h"
 
-static int wl1271_translate_addr(struct wl1271 *wl, int addr)
+#define OCP_CMD_LOOP  32
+
+#define OCP_CMD_WRITE 0x1
+#define OCP_CMD_READ  0x2
+
+#define OCP_READY_MASK  BIT(18)
+#define OCP_STATUS_MASK (BIT(16) | BIT(17))
+
+#define OCP_STATUS_NO_RESP    0x00000
+#define OCP_STATUS_OK         0x10000
+#define OCP_STATUS_REQ_FAILED 0x20000
+#define OCP_STATUS_RESP_ERROR 0x30000
+
+void wl1271_disable_interrupts(struct wl1271 *wl)
 {
-        /*
-         * To translate, first check to which window of addresses the
-         * particular address belongs. Then subtract the starting address
-         * of that window from the address. Then, add offset of the
-         * translated region.
-         *
-         * The translated regions occur next to each other in physical device
-         * memory, so just add the sizes of the preceeding address regions to
-         * get the offset to the new region.
-         *
-         * Currently, only the two first regions are addressed, and the
-         * assumption is that all addresses will fall into either of those
-         * two.
-         */
-        if ((addr >= wl->part.reg.start) &&
-            (addr < wl->part.reg.start + wl->part.reg.size))
-                return addr - wl->part.reg.start + wl->part.mem.size;
-        else
-                return addr - wl->part.mem.start;
+        wl->if_ops->disable_irq(wl);
+}
+
+void wl1271_enable_interrupts(struct wl1271 *wl)
+{
+        wl->if_ops->enable_irq(wl);
 }
 
 /* Set the SPI partitions to access the chip addresses
@@ -117,54 +116,12 @@ int wl1271_set_partition(struct wl1271 *wl,
 
 void wl1271_io_reset(struct wl1271 *wl)
 {
-        wl1271_spi_reset(wl);
+        wl->if_ops->reset(wl);
 }
 
 void wl1271_io_init(struct wl1271 *wl)
 {
-        wl1271_spi_init(wl);
-}
-
-void wl1271_raw_write(struct wl1271 *wl, int addr, void *buf,
-                      size_t len, bool fixed)
-{
-        wl1271_spi_raw_write(wl, addr, buf, len, fixed);
-}
-
-void wl1271_raw_read(struct wl1271 *wl, int addr, void *buf,
-                     size_t len, bool fixed)
-{
-        wl1271_spi_raw_read(wl, addr, buf, len, fixed);
-}
-
-void wl1271_read(struct wl1271 *wl, int addr, void *buf, size_t len,
-                     bool fixed)
-{
-        int physical;
-
-        physical = wl1271_translate_addr(wl, addr);
-
-        wl1271_spi_raw_read(wl, physical, buf, len, fixed);
-}
-
-void wl1271_write(struct wl1271 *wl, int addr, void *buf, size_t len,
-                  bool fixed)
-{
-        int physical;
-
-        physical = wl1271_translate_addr(wl, addr);
-
-        wl1271_spi_raw_write(wl, physical, buf, len, fixed);
-}
-
-u32 wl1271_read32(struct wl1271 *wl, int addr)
-{
-        return wl1271_raw_read32(wl, wl1271_translate_addr(wl, addr));
-}
-
-void wl1271_write32(struct wl1271 *wl, int addr, u32 val)
-{
-        wl1271_raw_write32(wl, wl1271_translate_addr(wl, addr), val);
+        wl->if_ops->init(wl);
 }
 
 void wl1271_top_reg_write(struct wl1271 *wl, int addr, u16 val)
diff --git a/drivers/net/wireless/wl12xx/wl1271_io.h b/drivers/net/wireless/wl12xx/wl1271_io.h
index fa9a0b35788f..d8837ef0bb40 100644
--- a/drivers/net/wireless/wl12xx/wl1271_io.h
+++ b/drivers/net/wireless/wl12xx/wl1271_io.h
@@ -25,31 +25,49 @@
 #ifndef __WL1271_IO_H__
 #define __WL1271_IO_H__
 
+#include "wl1271_reg.h"
+
+#define HW_ACCESS_MEMORY_MAX_RANGE      0x1FFC0
+
+#define HW_PARTITION_REGISTERS_ADDR     0x1FFC0
+#define HW_PART0_SIZE_ADDR              (HW_PARTITION_REGISTERS_ADDR)
+#define HW_PART0_START_ADDR             (HW_PARTITION_REGISTERS_ADDR + 4)
+#define HW_PART1_SIZE_ADDR              (HW_PARTITION_REGISTERS_ADDR + 8)
+#define HW_PART1_START_ADDR             (HW_PARTITION_REGISTERS_ADDR + 12)
+#define HW_PART2_SIZE_ADDR              (HW_PARTITION_REGISTERS_ADDR + 16)
+#define HW_PART2_START_ADDR             (HW_PARTITION_REGISTERS_ADDR + 20)
+#define HW_PART3_START_ADDR             (HW_PARTITION_REGISTERS_ADDR + 24)
+
+#define HW_ACCESS_REGISTER_SIZE         4
+
+#define HW_ACCESS_PRAM_MAX_RANGE        0x3c000
+
 struct wl1271;
 
+void wl1271_disable_interrupts(struct wl1271 *wl);
+void wl1271_enable_interrupts(struct wl1271 *wl);
+
 void wl1271_io_reset(struct wl1271 *wl);
 void wl1271_io_init(struct wl1271 *wl);
 
-/* Raw target IO, address is not translated */
-void wl1271_raw_write(struct wl1271 *wl, int addr, void *buf,
-                      size_t len, bool fixed);
-void wl1271_raw_read(struct wl1271 *wl, int addr, void *buf,
-                     size_t len, bool fixed);
+static inline struct device *wl1271_wl_to_dev(struct wl1271 *wl)
+{
+        return wl->if_ops->dev(wl);
+}
 
-/* Translated target IO */
-void wl1271_read(struct wl1271 *wl, int addr, void *buf, size_t len,
-                     bool fixed);
-void wl1271_write(struct wl1271 *wl, int addr, void *buf, size_t len,
-                      bool fixed);
-u32 wl1271_read32(struct wl1271 *wl, int addr);
-void wl1271_write32(struct wl1271 *wl, int addr, u32 val);
 
-/* Top Register IO */
-void wl1271_top_reg_write(struct wl1271 *wl, int addr, u16 val);
-u16 wl1271_top_reg_read(struct wl1271 *wl, int addr);
+/* Raw target IO, address is not translated */
+static inline void wl1271_raw_write(struct wl1271 *wl, int addr, void *buf,
+                                    size_t len, bool fixed)
+{
+        wl->if_ops->write(wl, addr, buf, len, fixed);
+}
 
-int wl1271_set_partition(struct wl1271 *wl,
-                         struct wl1271_partition_set *p);
+static inline void wl1271_raw_read(struct wl1271 *wl, int addr, void *buf,
+                                   size_t len, bool fixed)
+{
+        wl->if_ops->read(wl, addr, buf, len, fixed);
+}
 
 static inline u32 wl1271_raw_read32(struct wl1271 *wl, int addr)
 {
@@ -65,4 +83,87 @@ static inline void wl1271_raw_write32(struct wl1271 *wl, int addr, u32 val)
         wl1271_raw_write(wl, addr, &wl->buffer_32,
                              sizeof(wl->buffer_32), false);
 }
+
+/* Translated target IO */
+static inline int wl1271_translate_addr(struct wl1271 *wl, int addr)
+{
+        /*
+         * To translate, first check to which window of addresses the
+         * particular address belongs. Then subtract the starting address
+         * of that window from the address. Then, add offset of the
+         * translated region.
+         *
+         * The translated regions occur next to each other in physical device
+         * memory, so just add the sizes of the preceeding address regions to
+         * get the offset to the new region.
+         *
+         * Currently, only the two first regions are addressed, and the
+         * assumption is that all addresses will fall into either of those
+         * two.
+         */
+        if ((addr >= wl->part.reg.start) &&
+            (addr < wl->part.reg.start + wl->part.reg.size))
+                return addr - wl->part.reg.start + wl->part.mem.size;
+        else
+                return addr - wl->part.mem.start;
+}
+
+static inline void wl1271_read(struct wl1271 *wl, int addr, void *buf,
+                               size_t len, bool fixed)
+{
+        int physical;
+
+        physical = wl1271_translate_addr(wl, addr);
+
+        wl1271_raw_read(wl, physical, buf, len, fixed);
+}
+
+static inline void wl1271_write(struct wl1271 *wl, int addr, void *buf,
+                                size_t len, bool fixed)
+{
+        int physical;
+
+        physical = wl1271_translate_addr(wl, addr);
+
+        wl1271_raw_write(wl, physical, buf, len, fixed);
+}
+
+static inline u32 wl1271_read32(struct wl1271 *wl, int addr)
+{
+        return wl1271_raw_read32(wl, wl1271_translate_addr(wl, addr));
+}
+
+static inline void wl1271_write32(struct wl1271 *wl, int addr, u32 val)
+{
+        wl1271_raw_write32(wl, wl1271_translate_addr(wl, addr), val);
+}
+
+static inline void wl1271_power_off(struct wl1271 *wl)
+{
+        wl->if_ops->power(wl, false);
+        clear_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
+}
+
+static inline void wl1271_power_on(struct wl1271 *wl)
+{
+        wl->if_ops->power(wl, true);
+        set_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
+}
+
+
+/* Top Register IO */
+void wl1271_top_reg_write(struct wl1271 *wl, int addr, u16 val);
+u16 wl1271_top_reg_read(struct wl1271 *wl, int addr);
+
+int wl1271_set_partition(struct wl1271 *wl,
+                         struct wl1271_partition_set *p);
+
+/* Functions from wl1271_main.c */
+
+int wl1271_register_hw(struct wl1271 *wl);
+void wl1271_unregister_hw(struct wl1271 *wl);
+int wl1271_init_ieee80211(struct wl1271 *wl);
+struct ieee80211_hw *wl1271_alloc_hw(void);
+int wl1271_free_hw(struct wl1271 *wl);
+
 #endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_main.c b/drivers/net/wireless/wl12xx/wl1271_main.c
index 2a864b24291d..5c32d8d72361 100644
--- a/drivers/net/wireless/wl12xx/wl1271_main.c
+++ b/drivers/net/wireless/wl12xx/wl1271_main.c
@@ -22,22 +22,18 @@
  */
 
 #include <linux/module.h>
-#include <linux/platform_device.h>
-#include <linux/interrupt.h>
 #include <linux/firmware.h>
 #include <linux/delay.h>
-#include <linux/irq.h>
 #include <linux/spi/spi.h>
 #include <linux/crc32.h>
 #include <linux/etherdevice.h>
 #include <linux/vmalloc.h>
-#include <linux/spi/wl12xx.h>
 #include <linux/inetdevice.h>
+#include <linux/platform_device.h>
 
 #include "wl1271.h"
 #include "wl12xx_80211.h"
 #include "wl1271_reg.h"
-#include "wl1271_spi.h"
 #include "wl1271_io.h"
 #include "wl1271_event.h"
 #include "wl1271_tx.h"
@@ -53,17 +49,57 @@
 
 static struct conf_drv_settings default_conf = {
         .sg = {
-                .per_threshold               = 7500,
-                .max_scan_compensation_time  = 120000,
-                .nfs_sample_interval         = 400,
-                .load_ratio                  = 50,
-                .auto_ps_mode                = 0,
-                .probe_req_compensation      = 170,
-                .scan_window_compensation    = 50,
-                .antenna_config              = 0,
-                .beacon_miss_threshold       = 60,
-                .rate_adaptation_threshold   = CONF_HW_BIT_RATE_12MBPS,
-                .rate_adaptation_snr         = 0
+                .params = {
+                        [CONF_SG_BT_PER_THRESHOLD]                  = 7500,
+                        [CONF_SG_HV3_MAX_OVERRIDE]                  = 0,
+                        [CONF_SG_BT_NFS_SAMPLE_INTERVAL]            = 400,
+                        [CONF_SG_BT_LOAD_RATIO]                     = 50,
+                        [CONF_SG_AUTO_PS_MODE]                      = 0,
+                        [CONF_SG_AUTO_SCAN_PROBE_REQ]               = 170,
+                        [CONF_SG_ACTIVE_SCAN_DURATION_FACTOR_HV3]   = 50,
+                        [CONF_SG_ANTENNA_CONFIGURATION]             = 0,
+                        [CONF_SG_BEACON_MISS_PERCENT]               = 60,
+                        [CONF_SG_RATE_ADAPT_THRESH]                 = 12,
+                        [CONF_SG_RATE_ADAPT_SNR]                    = 0,
+                        [CONF_SG_WLAN_PS_BT_ACL_MASTER_MIN_BR]      = 10,
+                        [CONF_SG_WLAN_PS_BT_ACL_MASTER_MAX_BR]      = 30,
+                        [CONF_SG_WLAN_PS_MAX_BT_ACL_MASTER_BR]      = 8,
+                        [CONF_SG_WLAN_PS_BT_ACL_SLAVE_MIN_BR]       = 20,
+                        [CONF_SG_WLAN_PS_BT_ACL_SLAVE_MAX_BR]       = 50,
+                        /* Note: with UPSD, this should be 4 */
+                        [CONF_SG_WLAN_PS_MAX_BT_ACL_SLAVE_BR]       = 8,
+                        [CONF_SG_WLAN_PS_BT_ACL_MASTER_MIN_EDR]     = 7,
+                        [CONF_SG_WLAN_PS_BT_ACL_MASTER_MAX_EDR]     = 25,
+                        [CONF_SG_WLAN_PS_MAX_BT_ACL_MASTER_EDR]     = 20,
+                        /* Note: with UPDS, this should be 15 */
+                        [CONF_SG_WLAN_PS_BT_ACL_SLAVE_MIN_EDR]      = 8,
+                        /* Note: with UPDS, this should be 50 */
+                        [CONF_SG_WLAN_PS_BT_ACL_SLAVE_MAX_EDR]      = 40,
+                        /* Note: with UPDS, this should be 10 */
+                        [CONF_SG_WLAN_PS_MAX_BT_ACL_SLAVE_EDR]      = 20,
+                        [CONF_SG_RXT]                               = 1200,
+                        [CONF_SG_TXT]                               = 1000,
+                        [CONF_SG_ADAPTIVE_RXT_TXT]                  = 1,
+                        [CONF_SG_PS_POLL_TIMEOUT]                   = 10,
+                        [CONF_SG_UPSD_TIMEOUT]                      = 10,
+                        [CONF_SG_WLAN_ACTIVE_BT_ACL_MASTER_MIN_EDR] = 7,
+                        [CONF_SG_WLAN_ACTIVE_BT_ACL_MASTER_MAX_EDR] = 15,
+                        [CONF_SG_WLAN_ACTIVE_MAX_BT_ACL_MASTER_EDR] = 15,
+                        [CONF_SG_WLAN_ACTIVE_BT_ACL_SLAVE_MIN_EDR]  = 8,
+                        [CONF_SG_WLAN_ACTIVE_BT_ACL_SLAVE_MAX_EDR]  = 20,
+                        [CONF_SG_WLAN_ACTIVE_MAX_BT_ACL_SLAVE_EDR]  = 15,
+                        [CONF_SG_WLAN_ACTIVE_BT_ACL_MIN_BR]         = 20,
+                        [CONF_SG_WLAN_ACTIVE_BT_ACL_MAX_BR]         = 50,
+                        [CONF_SG_WLAN_ACTIVE_MAX_BT_ACL_BR]         = 10,
+                        [CONF_SG_PASSIVE_SCAN_DURATION_FACTOR_HV3]  = 200,
+                        [CONF_SG_PASSIVE_SCAN_DURATION_FACTOR_A2DP] = 800,
+                        [CONF_SG_PASSIVE_SCAN_A2DP_BT_TIME]         = 75,
+                        [CONF_SG_PASSIVE_SCAN_A2DP_WLAN_TIME]       = 15,
+                        [CONF_SG_HV3_MAX_SERVED]                    = 6,
+                        [CONF_SG_DHCP_TIME]                         = 5000,
+                        [CONF_SG_ACTIVE_SCAN_DURATION_FACTOR_A2DP]  = 100,
+                },
+                .state = CONF_SG_PROTECTIVE,
         },
         .rx = {
                 .rx_msdu_life_time           = 512000,
@@ -80,8 +116,7 @@ static struct conf_drv_settings default_conf = {
         .tx = {
                 .tx_energy_detection         = 0,
                 .rc_conf                     = {
-                        .enabled_rates       = CONF_HW_BIT_RATE_1MBPS |
-                                               CONF_HW_BIT_RATE_2MBPS,
+                        .enabled_rates       = 0,
                         .short_retry_limit   = 10,
                         .long_retry_limit    = 10,
                         .aflags              = 0
@@ -178,11 +213,13 @@ static struct conf_drv_settings default_conf = {
                 },
                 .frag_threshold              = IEEE80211_MAX_FRAG_THRESHOLD,
                 .tx_compl_timeout            = 700,
-                .tx_compl_threshold          = 4
+                .tx_compl_threshold          = 4,
+                .basic_rate                  = CONF_HW_BIT_RATE_1MBPS,
+                .basic_rate_5                = CONF_HW_BIT_RATE_6MBPS,
         },
         .conn = {
                 .wake_up_event               = CONF_WAKE_UP_EVENT_DTIM,
-                .listen_interval             = 0,
+                .listen_interval             = 1,
                 .bcn_filt_mode               = CONF_BCN_FILT_MODE_ENABLED,
                 .bcn_filt_ie_count           = 1,
                 .bcn_filt_ie = {
@@ -228,7 +265,9 @@ static struct conf_drv_settings default_conf = {
                 },
                 .bet_enable                  = CONF_BET_MODE_ENABLE,
                 .bet_max_consecutive         = 10,
-                .psm_entry_retries           = 3
+                .psm_entry_retries           = 3,
+                .keep_alive_interval         = 55000,
+                .max_listen_interval         = 20,
         },
         .init = {
                 .radioparam = {
@@ -245,6 +284,21 @@ static struct conf_drv_settings default_conf = {
         }
 };
 
+static void wl1271_device_release(struct device *dev)
+{
+
+}
+
+static struct platform_device wl1271_device = {
+        .name           = "wl1271",
+        .id             = -1,
+
+        /* device model insists to have a release function */
+        .dev            = {
+                .release = wl1271_device_release,
+        },
+};
+
 static LIST_HEAD(wl_list);
 
 static void wl1271_conf_init(struct wl1271 *wl)
@@ -297,7 +351,7 @@ static int wl1271_plt_init(struct wl1271 *wl)
                 goto out_free_memmap;
 
         /* Initialize connection monitoring thresholds */
-        ret = wl1271_acx_conn_monit_params(wl);
+        ret = wl1271_acx_conn_monit_params(wl, false);
         if (ret < 0)
                 goto out_free_memmap;
 
@@ -364,30 +418,14 @@ static int wl1271_plt_init(struct wl1271 *wl)
         return ret;
 }
 
-static void wl1271_disable_interrupts(struct wl1271 *wl)
-{
-        disable_irq(wl->irq);
-}
-
-static void wl1271_power_off(struct wl1271 *wl)
-{
-        wl->set_power(false);
-        clear_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
-}
-
-static void wl1271_power_on(struct wl1271 *wl)
-{
-        wl->set_power(true);
-        set_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
-}
-
 static void wl1271_fw_status(struct wl1271 *wl,
                              struct wl1271_fw_status *status)
 {
+        struct timespec ts;
         u32 total = 0;
         int i;
 
-        wl1271_read(wl, FW_STATUS_ADDR, status, sizeof(*status), false);
+        wl1271_raw_read(wl, FW_STATUS_ADDR, status, sizeof(*status), false);
 
         wl1271_debug(DEBUG_IRQ, "intr: 0x%x (fw_rx_counter = %d, "
                      "drv_rx_counter = %d, tx_results_counter = %d)",
@@ -412,14 +450,19 @@ static void wl1271_fw_status(struct wl1271 *wl,
                 ieee80211_queue_work(wl->hw, &wl->tx_work);
 
         /* update the host-chipset time offset */
-        wl->time_offset = jiffies_to_usecs(jiffies) -
-                le32_to_cpu(status->fw_localtime);
+        getnstimeofday(&ts);
+        wl->time_offset = (timespec_to_ns(&ts) >> 10) -
+                (s64)le32_to_cpu(status->fw_localtime);
 }
 
+#define WL1271_IRQ_MAX_LOOPS 10
+
 static void wl1271_irq_work(struct work_struct *work)
 {
         int ret;
         u32 intr;
+        int loopcount = WL1271_IRQ_MAX_LOOPS;
+        unsigned long flags;
         struct wl1271 *wl =
                 container_of(work, struct wl1271, irq_work);
 
@@ -427,91 +470,77 @@ static void wl1271_irq_work(struct work_struct *work)
 
         wl1271_debug(DEBUG_IRQ, "IRQ work");
 
-        if (wl->state == WL1271_STATE_OFF)
+        if (unlikely(wl->state == WL1271_STATE_OFF))
                 goto out;
 
         ret = wl1271_ps_elp_wakeup(wl, true);
         if (ret < 0)
                 goto out;
 
-        wl1271_write32(wl, ACX_REG_INTERRUPT_MASK, WL1271_ACX_INTR_ALL);
-
-        wl1271_fw_status(wl, wl->fw_status);
-        intr = le32_to_cpu(wl->fw_status->intr);
-        if (!intr) {
-                wl1271_debug(DEBUG_IRQ, "Zero interrupt received.");
-                goto out_sleep;
-        }
+        spin_lock_irqsave(&wl->wl_lock, flags);
+        while (test_bit(WL1271_FLAG_IRQ_PENDING, &wl->flags) && loopcount) {
+                clear_bit(WL1271_FLAG_IRQ_PENDING, &wl->flags);
+                spin_unlock_irqrestore(&wl->wl_lock, flags);
+                loopcount--;
+
+                wl1271_fw_status(wl, wl->fw_status);
+                intr = le32_to_cpu(wl->fw_status->intr);
+                if (!intr) {
+                        wl1271_debug(DEBUG_IRQ, "Zero interrupt received.");
+                        continue;
+                }
 
-        intr &= WL1271_INTR_MASK;
+                intr &= WL1271_INTR_MASK;
 
-        if (intr & WL1271_ACX_INTR_EVENT_A) {
-                wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_EVENT_A");
-                wl1271_event_handle(wl, 0);
-        }
+                if (intr & WL1271_ACX_INTR_DATA) {
+                        wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_DATA");
 
-        if (intr & WL1271_ACX_INTR_EVENT_B) {
-                wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_EVENT_B");
-                wl1271_event_handle(wl, 1);
-        }
+                        /* check for tx results */
+                        if (wl->fw_status->tx_results_counter !=
+                            (wl->tx_results_count & 0xff))
+                                wl1271_tx_complete(wl);
 
-        if (intr & WL1271_ACX_INTR_INIT_COMPLETE)
-                wl1271_debug(DEBUG_IRQ,
-                             "WL1271_ACX_INTR_INIT_COMPLETE");
+                        wl1271_rx(wl, wl->fw_status);
+                }
 
-        if (intr & WL1271_ACX_INTR_HW_AVAILABLE)
-                wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_HW_AVAILABLE");
+                if (intr & WL1271_ACX_INTR_EVENT_A) {
+                        wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_EVENT_A");
+                        wl1271_event_handle(wl, 0);
+                }
 
-        if (intr & WL1271_ACX_INTR_DATA) {
-                u8 tx_res_cnt = wl->fw_status->tx_results_counter -
-                        wl->tx_results_count;
+                if (intr & WL1271_ACX_INTR_EVENT_B) {
+                        wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_EVENT_B");
+                        wl1271_event_handle(wl, 1);
+                }
 
-                wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_DATA");
+                if (intr & WL1271_ACX_INTR_INIT_COMPLETE)
+                        wl1271_debug(DEBUG_IRQ,
+                                     "WL1271_ACX_INTR_INIT_COMPLETE");
 
-                /* check for tx results */
-                if (tx_res_cnt)
-                        wl1271_tx_complete(wl, tx_res_cnt);
+                if (intr & WL1271_ACX_INTR_HW_AVAILABLE)
+                        wl1271_debug(DEBUG_IRQ, "WL1271_ACX_INTR_HW_AVAILABLE");
 
-                wl1271_rx(wl, wl->fw_status);
+                spin_lock_irqsave(&wl->wl_lock, flags);
         }
 
-out_sleep:
-        wl1271_write32(wl, ACX_REG_INTERRUPT_MASK,
-                       WL1271_ACX_INTR_ALL & ~(WL1271_INTR_MASK));
+        if (test_bit(WL1271_FLAG_IRQ_PENDING, &wl->flags))
+                ieee80211_queue_work(wl->hw, &wl->irq_work);
+        else
+                clear_bit(WL1271_FLAG_IRQ_RUNNING, &wl->flags);
+        spin_unlock_irqrestore(&wl->wl_lock, flags);
+
         wl1271_ps_elp_sleep(wl);
 
 out:
         mutex_unlock(&wl->mutex);
 }
 
-static irqreturn_t wl1271_irq(int irq, void *cookie)
-{
-        struct wl1271 *wl;
-        unsigned long flags;
-
-        wl1271_debug(DEBUG_IRQ, "IRQ");
-
-        wl = cookie;
-
-        /* complete the ELP completion */
-        spin_lock_irqsave(&wl->wl_lock, flags);
-        if (wl->elp_compl) {
-                complete(wl->elp_compl);
-                wl->elp_compl = NULL;
-        }
-
-        ieee80211_queue_work(wl->hw, &wl->irq_work);
-        spin_unlock_irqrestore(&wl->wl_lock, flags);
-
-        return IRQ_HANDLED;
-}
-
 static int wl1271_fetch_firmware(struct wl1271 *wl)
 {
         const struct firmware *fw;
         int ret;
 
-        ret = request_firmware(&fw, WL1271_FW_NAME, &wl->spi->dev);
+        ret = request_firmware(&fw, WL1271_FW_NAME, wl1271_wl_to_dev(wl));
 
         if (ret < 0) {
                 wl1271_error("could not get firmware: %d", ret);
@@ -544,46 +573,12 @@ out:
         return ret;
 }
 
-static int wl1271_update_mac_addr(struct wl1271 *wl)
-{
-        int ret = 0;
-        u8 *nvs_ptr = (u8 *)wl->nvs->nvs;
-
-        /* get mac address from the NVS */
-        wl->mac_addr[0] = nvs_ptr[11];
-        wl->mac_addr[1] = nvs_ptr[10];
-        wl->mac_addr[2] = nvs_ptr[6];
-        wl->mac_addr[3] = nvs_ptr[5];
-        wl->mac_addr[4] = nvs_ptr[4];
-        wl->mac_addr[5] = nvs_ptr[3];
-
-        /* FIXME: if it is a zero-address, we should bail out. Now, instead,
-           we randomize an address */
-        if (is_zero_ether_addr(wl->mac_addr)) {
-                static const u8 nokia_oui[3] = {0x00, 0x1f, 0xdf};
-                memcpy(wl->mac_addr, nokia_oui, 3);
-                get_random_bytes(wl->mac_addr + 3, 3);
-
-                /* update this address to the NVS */
-                nvs_ptr[11] = wl->mac_addr[0];
-                nvs_ptr[10] = wl->mac_addr[1];
-                nvs_ptr[6] = wl->mac_addr[2];
-                nvs_ptr[5] = wl->mac_addr[3];
-                nvs_ptr[4] = wl->mac_addr[4];
-                nvs_ptr[3] = wl->mac_addr[5];
-        }
-
-        SET_IEEE80211_PERM_ADDR(wl->hw, wl->mac_addr);
-
-        return ret;
-}
-
 static int wl1271_fetch_nvs(struct wl1271 *wl)
 {
         const struct firmware *fw;
         int ret;
 
-        ret = request_firmware(&fw, WL1271_NVS_NAME, &wl->spi->dev);
+        ret = request_firmware(&fw, WL1271_NVS_NAME, wl1271_wl_to_dev(wl));
 
         if (ret < 0) {
                 wl1271_error("could not get nvs file: %d", ret);
@@ -607,8 +602,6 @@ static int wl1271_fetch_nvs(struct wl1271 *wl)
 
         memcpy(wl->nvs, fw->data, sizeof(struct wl1271_nvs_file));
 
-        ret = wl1271_update_mac_addr(wl);
-
 out:
         release_firmware(fw);
 
@@ -825,15 +818,13 @@ static int wl1271_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
          * The workqueue is slow to process the tx_queue and we need stop
          * the queue here, otherwise the queue will get too long.
          */
-        if (skb_queue_len(&wl->tx_queue) >= WL1271_TX_QUEUE_MAX_LENGTH) {
-                ieee80211_stop_queues(wl->hw);
+        if (skb_queue_len(&wl->tx_queue) >= WL1271_TX_QUEUE_HIGH_WATERMARK) {
+                wl1271_debug(DEBUG_TX, "op_tx: stopping queues");
 
-                /*
-                 * FIXME: this is racy, the variable is not properly
-                 * protected. Maybe fix this by removing the stupid
-                 * variable altogether and checking the real queue state?
-                 */
+                spin_lock_irqsave(&wl->wl_lock, flags);
+                ieee80211_stop_queues(wl->hw);
                 set_bit(WL1271_FLAG_TX_QUEUE_STOPPED, &wl->flags);
+                spin_unlock_irqrestore(&wl->wl_lock, flags);
         }
 
         return NETDEV_TX_OK;
@@ -928,13 +919,60 @@ static struct notifier_block wl1271_dev_notifier = {
 
 static int wl1271_op_start(struct ieee80211_hw *hw)
 {
+        wl1271_debug(DEBUG_MAC80211, "mac80211 start");
+
+        /*
+         * We have to delay the booting of the hardware because
+         * we need to know the local MAC address before downloading and
+         * initializing the firmware. The MAC address cannot be changed
+         * after boot, and without the proper MAC address, the firmware
+         * will not function properly.
+         *
+         * The MAC address is first known when the corresponding interface
+         * is added. That is where we will initialize the hardware.
+         */
+
+        return 0;
+}
+
+static void wl1271_op_stop(struct ieee80211_hw *hw)
+{
+        wl1271_debug(DEBUG_MAC80211, "mac80211 stop");
+}
+
+static int wl1271_op_add_interface(struct ieee80211_hw *hw,
+                                   struct ieee80211_vif *vif)
+{
         struct wl1271 *wl = hw->priv;
         int retries = WL1271_BOOT_RETRIES;
         int ret = 0;
 
-        wl1271_debug(DEBUG_MAC80211, "mac80211 start");
+        wl1271_debug(DEBUG_MAC80211, "mac80211 add interface type %d mac %pM",
+                     vif->type, vif->addr);
 
         mutex_lock(&wl->mutex);
+        if (wl->vif) {
+                ret = -EBUSY;
+                goto out;
+        }
+
+        wl->vif = vif;
+
+        switch (vif->type) {
+        case NL80211_IFTYPE_STATION:
+                wl->bss_type = BSS_TYPE_STA_BSS;
+                wl->set_bss_type = BSS_TYPE_STA_BSS;
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                wl->bss_type = BSS_TYPE_IBSS;
+                wl->set_bss_type = BSS_TYPE_STA_BSS;
+                break;
+        default:
+                ret = -EOPNOTSUPP;
+                goto out;
+        }
+
+        memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
 
         if (wl->state != WL1271_STATE_OFF) {
                 wl1271_error("cannot start because not in off state: %d",
@@ -990,19 +1028,20 @@ out:
         return ret;
 }
 
-static void wl1271_op_stop(struct ieee80211_hw *hw)
+static void wl1271_op_remove_interface(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif)
 {
         struct wl1271 *wl = hw->priv;
         int i;
 
-        wl1271_info("down");
-
-        wl1271_debug(DEBUG_MAC80211, "mac80211 stop");
-
         unregister_inetaddr_notifier(&wl1271_dev_notifier);
-        list_del(&wl->list);
 
         mutex_lock(&wl->mutex);
+        wl1271_debug(DEBUG_MAC80211, "mac80211 remove interface");
+
+        wl1271_info("down");
+
+        list_del(&wl->list);
 
         WARN_ON(wl->state != WL1271_STATE_ON);
 
@@ -1031,6 +1070,7 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
         memset(wl->ssid, 0, IW_ESSID_MAX_SIZE + 1);
         wl->ssid_len = 0;
         wl->bss_type = MAX_BSS_TYPE;
+        wl->set_bss_type = MAX_BSS_TYPE;
         wl->band = IEEE80211_BAND_2GHZ;
 
         wl->rx_counter = 0;
@@ -1040,13 +1080,14 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
         wl->tx_results_count = 0;
         wl->tx_packets_count = 0;
         wl->tx_security_last_seq = 0;
-        wl->tx_security_seq_16 = 0;
-        wl->tx_security_seq_32 = 0;
+        wl->tx_security_seq = 0;
         wl->time_offset = 0;
         wl->session_counter = 0;
         wl->rate_set = CONF_TX_RATE_MASK_BASIC;
         wl->sta_rate_set = 0;
         wl->flags = 0;
+        wl->vif = NULL;
+        wl->filters = 0;
 
         for (i = 0; i < NUM_TX_QUEUES; i++)
                 wl->tx_blocks_freed[i] = 0;
@@ -1055,119 +1096,39 @@ static void wl1271_op_stop(struct ieee80211_hw *hw)
         mutex_unlock(&wl->mutex);
 }
 
-static int wl1271_op_add_interface(struct ieee80211_hw *hw,
-                                   struct ieee80211_vif *vif)
+static void wl1271_configure_filters(struct wl1271 *wl, unsigned int filters)
 {
-        struct wl1271 *wl = hw->priv;
-        int ret = 0;
-
-        wl1271_debug(DEBUG_MAC80211, "mac80211 add interface type %d mac %pM",
-                     vif->type, vif->addr);
+        wl->rx_config = WL1271_DEFAULT_RX_CONFIG;
+        wl->rx_filter = WL1271_DEFAULT_RX_FILTER;
 
-        mutex_lock(&wl->mutex);
-        if (wl->vif) {
-                ret = -EBUSY;
-                goto out;
-        }
+        /* combine requested filters with current filter config */
+        filters = wl->filters | filters;
 
-        wl->vif = vif;
+        wl1271_debug(DEBUG_FILTERS, "RX filters set: ");
 
-        switch (vif->type) {
-        case NL80211_IFTYPE_STATION:
-                wl->bss_type = BSS_TYPE_STA_BSS;
-                break;
-        case NL80211_IFTYPE_ADHOC:
-                wl->bss_type = BSS_TYPE_IBSS;
-                break;
-        default:
-                ret = -EOPNOTSUPP;
-                goto out;
+        if (filters & FIF_PROMISC_IN_BSS) {
+                wl1271_debug(DEBUG_FILTERS, " - FIF_PROMISC_IN_BSS");
+                wl->rx_config &= ~CFG_UNI_FILTER_EN;
+                wl->rx_config |= CFG_BSSID_FILTER_EN;
         }
-
-        /* FIXME: what if conf->mac_addr changes? */
-
-out:
-        mutex_unlock(&wl->mutex);
-        return ret;
-}
-
-static void wl1271_op_remove_interface(struct ieee80211_hw *hw,
-                                         struct ieee80211_vif *vif)
-{
-        struct wl1271 *wl = hw->priv;
-
-        mutex_lock(&wl->mutex);
-        wl1271_debug(DEBUG_MAC80211, "mac80211 remove interface");
-        wl->vif = NULL;
-        mutex_unlock(&wl->mutex);
-}
-
-#if 0
-static int wl1271_op_config_interface(struct ieee80211_hw *hw,
-                                      struct ieee80211_vif *vif,
-                                      struct ieee80211_if_conf *conf)
-{
-        struct wl1271 *wl = hw->priv;
-        struct sk_buff *beacon;
-        int ret;
-
-        wl1271_debug(DEBUG_MAC80211, "mac80211 config_interface bssid %pM",
-                     conf->bssid);
-        wl1271_dump_ascii(DEBUG_MAC80211, "ssid: ", conf->ssid,
-                          conf->ssid_len);
-
-        mutex_lock(&wl->mutex);
-
-        ret = wl1271_ps_elp_wakeup(wl, false);
-        if (ret < 0)
-                goto out;
-
-        if (memcmp(wl->bssid, conf->bssid, ETH_ALEN)) {
-                wl1271_debug(DEBUG_MAC80211, "bssid changed");
-
-                memcpy(wl->bssid, conf->bssid, ETH_ALEN);
-
-                ret = wl1271_cmd_join(wl);
-                if (ret < 0)
-                        goto out_sleep;
-
-                ret = wl1271_cmd_build_null_data(wl);
-                if (ret < 0)
-                        goto out_sleep;
+        if (filters & FIF_BCN_PRBRESP_PROMISC) {
+                wl1271_debug(DEBUG_FILTERS, " - FIF_BCN_PRBRESP_PROMISC");
+                wl->rx_config &= ~CFG_BSSID_FILTER_EN;
+                wl->rx_config &= ~CFG_SSID_FILTER_EN;
         }
-
-        wl->ssid_len = conf->ssid_len;
-        if (wl->ssid_len)
-                memcpy(wl->ssid, conf->ssid, wl->ssid_len);
-
-        if (conf->changed & IEEE80211_IFCC_BEACON) {
-                beacon = ieee80211_beacon_get(hw, vif);
-                ret = wl1271_cmd_template_set(wl, CMD_TEMPL_BEACON,
-                                              beacon->data, beacon->len);
-
-                if (ret < 0) {
-                        dev_kfree_skb(beacon);
-                        goto out_sleep;
-                }
-
-                ret = wl1271_cmd_template_set(wl, CMD_TEMPL_PROBE_RESPONSE,
-                                              beacon->data, beacon->len);
-
-                dev_kfree_skb(beacon);
-
-                if (ret < 0)
-                        goto out_sleep;
+        if (filters & FIF_OTHER_BSS) {
+                wl1271_debug(DEBUG_FILTERS, " - FIF_OTHER_BSS");
+                wl->rx_config &= ~CFG_BSSID_FILTER_EN;
+        }
+        if (filters & FIF_CONTROL) {
+                wl1271_debug(DEBUG_FILTERS, " - FIF_CONTROL");
+                wl->rx_filter |= CFG_RX_CTL_EN;
+        }
+        if (filters & FIF_FCSFAIL) {
+                wl1271_debug(DEBUG_FILTERS, " - FIF_FCSFAIL");
+                wl->rx_filter |= CFG_RX_FCS_ERROR;
         }
-
-out_sleep:
-        wl1271_ps_elp_sleep(wl);
-
-out:
-        mutex_unlock(&wl->mutex);
-
-        return ret;
 }
-#endif
 
 static int wl1271_join_channel(struct wl1271 *wl, int channel)
 {
@@ -1176,17 +1137,13 @@ static int wl1271_join_channel(struct wl1271 *wl, int channel)
         static const u8 dummy_bssid[ETH_ALEN] = { 0x0b, 0xad, 0xde,
                                                   0xad, 0xbe, 0xef };
 
-        /* the dummy join is not required for ad-hoc */
-        if (wl->bss_type == BSS_TYPE_IBSS)
-                goto out;
-
-        /* disable mac filter, so we hear everything */
-        wl->rx_config &= ~CFG_BSSID_FILTER_EN;
-
         wl->channel = channel;
         memcpy(wl->bssid, dummy_bssid, ETH_ALEN);
 
-        ret = wl1271_cmd_join(wl);
+        /* pass through frames from all BSS */
+        wl1271_configure_filters(wl, FIF_OTHER_BSS);
+
+        ret = wl1271_cmd_join(wl, wl->set_bss_type);
         if (ret < 0)
                 goto out;
 
@@ -1208,12 +1165,40 @@ static int wl1271_unjoin_channel(struct wl1271 *wl)
         clear_bit(WL1271_FLAG_JOINED, &wl->flags);
         wl->channel = 0;
         memset(wl->bssid, 0, ETH_ALEN);
-        wl->rx_config = WL1271_DEFAULT_RX_CONFIG;
+
+        /* stop filterting packets based on bssid */
+        wl1271_configure_filters(wl, FIF_OTHER_BSS);
 
 out:
         return ret;
 }
 
+static void wl1271_set_band_rate(struct wl1271 *wl)
+{
+        if (wl->band == IEEE80211_BAND_2GHZ)
+                wl->basic_rate_set = wl->conf.tx.basic_rate;
+        else
+                wl->basic_rate_set = wl->conf.tx.basic_rate_5;
+}
+
+static u32 wl1271_min_rate_get(struct wl1271 *wl)
+{
+        int i;
+        u32 rate = 0;
+
+        if (!wl->basic_rate_set) {
+                WARN_ON(1);
+                wl->basic_rate_set = wl->conf.tx.basic_rate;
+        }
+
+        for (i = 0; !rate; i++) {
+                if ((wl->basic_rate_set >> i) & 0x1)
+                        rate = 1 << i;
+        }
+
+        return rate;
+}
+
 static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
 {
         struct wl1271 *wl = hw->priv;
@@ -1230,12 +1215,38 @@ static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
 
         mutex_lock(&wl->mutex);
 
-        wl->band = conf->channel->band;
-
         ret = wl1271_ps_elp_wakeup(wl, false);
         if (ret < 0)
                 goto out;
 
+        /* if the channel changes while joined, join again */
+        if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
+                wl->band = conf->channel->band;
+                wl->channel = channel;
+
+                /*
+                 * FIXME: the mac80211 should really provide a fixed rate
+                 * to use here. for now, just use the smallest possible rate
+                 * for the band as a fixed rate for association frames and
+                 * other control messages.
+                 */
+                if (!test_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags))
+                        wl1271_set_band_rate(wl);
+
+                wl->basic_rate = wl1271_min_rate_get(wl);
+                ret = wl1271_acx_rate_policies(wl);
+                if (ret < 0)
+                        wl1271_warning("rate policy for update channel "
+                                       "failed %d", ret);
+
+                if (test_bit(WL1271_FLAG_JOINED, &wl->flags)) {
+                        ret = wl1271_cmd_join(wl, wl->set_bss_type);
+                        if (ret < 0)
+                                wl1271_warning("cmd join to update channel "
+                                               "failed %d", ret);
+                }
+        }
+
         if (changed & IEEE80211_CONF_CHANGE_IDLE) {
                 if (conf->flags & IEEE80211_CONF_IDLE &&
                     test_bit(WL1271_FLAG_JOINED, &wl->flags))
@@ -1244,24 +1255,15 @@ static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
                         wl1271_join_channel(wl, channel);
 
                 if (conf->flags & IEEE80211_CONF_IDLE) {
-                        wl->rate_set = CONF_TX_RATE_MASK_BASIC;
+                        wl->rate_set = wl1271_min_rate_get(wl);
                         wl->sta_rate_set = 0;
                         wl1271_acx_rate_policies(wl);
+                        wl1271_acx_keep_alive_config(
+                                wl, CMD_TEMPL_KLV_IDX_NULL_DATA,
+                                ACX_KEEP_ALIVE_TPL_INVALID);
                 }
         }
 
-        /* if the channel changes while joined, join again */
-        if (channel != wl->channel &&
-            test_bit(WL1271_FLAG_JOINED, &wl->flags)) {
-                wl->channel = channel;
-                /* FIXME: maybe use CMD_CHANNEL_SWITCH for this? */
-                ret = wl1271_cmd_join(wl);
-                if (ret < 0)
-                        wl1271_warning("cmd join to update channel failed %d",
-                                       ret);
-        } else
-                wl->channel = channel;
-
         if (conf->flags & IEEE80211_CONF_PS &&
             !test_bit(WL1271_FLAG_PSM_REQUESTED, &wl->flags)) {
                 set_bit(WL1271_FLAG_PSM_REQUESTED, &wl->flags);
@@ -1272,13 +1274,13 @@ static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
                  * through the bss_info_changed() hook.
                  */
                 if (test_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags)) {
-                        wl1271_info("psm enabled");
+                        wl1271_debug(DEBUG_PSM, "psm enabled");
                         ret = wl1271_ps_set_mode(wl, STATION_POWER_SAVE_MODE,
                                                  true);
                 }
         } else if (!(conf->flags & IEEE80211_CONF_PS) &&
                    test_bit(WL1271_FLAG_PSM_REQUESTED, &wl->flags)) {
-                wl1271_info("psm disabled");
+                wl1271_debug(DEBUG_PSM, "psm disabled");
 
                 clear_bit(WL1271_FLAG_PSM_REQUESTED, &wl->flags);
 
@@ -1381,14 +1383,14 @@ static void wl1271_op_configure_filter(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out_sleep;
 
-        kfree(fp);
-
-        /* FIXME: We still need to set our filters properly */
-
         /* determine, whether supported filter values have changed */
         if (changed == 0)
                 goto out_sleep;
 
+        /* configure filters */
+        wl->filters = *total;
+        wl1271_configure_filters(wl, 0);
+
         /* apply configured filters */
         ret = wl1271_acx_rx_config(wl, wl->rx_config, wl->rx_filter);
         if (ret < 0)
@@ -1399,6 +1401,7 @@ out_sleep:
 
 out:
         mutex_unlock(&wl->mutex);
+        kfree(fp);
 }
 
 static int wl1271_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
@@ -1449,15 +1452,15 @@ static int wl1271_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 key_type = KEY_TKIP;
 
                 key_conf->hw_key_idx = key_conf->keyidx;
-                tx_seq_32 = wl->tx_security_seq_32;
-                tx_seq_16 = wl->tx_security_seq_16;
+                tx_seq_32 = WL1271_TX_SECURITY_HI32(wl->tx_security_seq);
+                tx_seq_16 = WL1271_TX_SECURITY_LO16(wl->tx_security_seq);
                 break;
         case ALG_CCMP:
                 key_type = KEY_AES;
 
                 key_conf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
-                tx_seq_32 = wl->tx_security_seq_32;
-                tx_seq_16 = wl->tx_security_seq_16;
+                tx_seq_32 = WL1271_TX_SECURITY_HI32(wl->tx_security_seq);
+                tx_seq_16 = WL1271_TX_SECURITY_LO16(wl->tx_security_seq);
                 break;
         default:
                 wl1271_error("Unknown key algo 0x%x", key_conf->alg);
@@ -1544,10 +1547,12 @@ static int wl1271_op_hw_scan(struct ieee80211_hw *hw,
                 goto out;
 
         if (wl1271_11a_enabled())
-                ret = wl1271_cmd_scan(hw->priv, ssid, len, 1, 0,
+                ret = wl1271_cmd_scan(hw->priv, ssid, len,
+                                      req->ie, req->ie_len, 1, 0,
                                       WL1271_SCAN_BAND_DUAL, 3);
         else
-                ret = wl1271_cmd_scan(hw->priv, ssid, len, 1, 0,
+                ret = wl1271_cmd_scan(hw->priv, ssid, len,
+                                      req->ie, req->ie_len, 1, 0,
                                       WL1271_SCAN_BAND_2_4_GHZ, 3);
 
         wl1271_ps_elp_sleep(wl);
@@ -1606,6 +1611,7 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
         enum wl1271_cmd_ps_mode mode;
         struct wl1271 *wl = hw->priv;
         bool do_join = false;
+        bool do_keepalive = false;
         int ret;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 bss info changed");
@@ -1616,20 +1622,29 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out;
 
-        if (wl->bss_type == BSS_TYPE_IBSS) {
-                /* FIXME: This implements rudimentary ad-hoc support -
-                   proper templates are on the wish list and notification
-                   on when they change. This patch will update the templates
-                   on every call to this function. */
+        if ((changed && BSS_CHANGED_BEACON_INT) &&
+            (wl->bss_type == BSS_TYPE_IBSS)) {
+                wl1271_debug(DEBUG_ADHOC, "ad-hoc beacon interval updated: %d",
+                        bss_conf->beacon_int);
+
+                wl->beacon_int = bss_conf->beacon_int;
+                do_join = true;
+        }
+
+        if ((changed && BSS_CHANGED_BEACON) &&
+            (wl->bss_type == BSS_TYPE_IBSS)) {
                 struct sk_buff *beacon = ieee80211_beacon_get(hw, vif);
 
+                wl1271_debug(DEBUG_ADHOC, "ad-hoc beacon updated");
+
                 if (beacon) {
                         struct ieee80211_hdr *hdr;
 
                         wl1271_ssid_set(wl, beacon);
                         ret = wl1271_cmd_template_set(wl, CMD_TEMPL_BEACON,
                                                       beacon->data,
-                                                      beacon->len);
+                                                      beacon->len, 0,
+                                                      wl1271_min_rate_get(wl));
 
                         if (ret < 0) {
                                 dev_kfree_skb(beacon);
@@ -1644,7 +1659,8 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                         ret = wl1271_cmd_template_set(wl,
                                                       CMD_TEMPL_PROBE_RESPONSE,
                                                       beacon->data,
-                                                      beacon->len);
+                                                      beacon->len, 0,
+                                                      wl1271_min_rate_get(wl));
                         dev_kfree_skb(beacon);
                         if (ret < 0)
                                 goto out_sleep;
@@ -1654,20 +1670,32 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                 }
         }
 
+        if ((changed & BSS_CHANGED_BEACON_ENABLED) &&
+            (wl->bss_type == BSS_TYPE_IBSS)) {
+                wl1271_debug(DEBUG_ADHOC, "ad-hoc beaconing: %s",
+                             bss_conf->enable_beacon ? "enabled" : "disabled");
+
+                if (bss_conf->enable_beacon)
+                        wl->set_bss_type = BSS_TYPE_IBSS;
+                else
+                        wl->set_bss_type = BSS_TYPE_STA_BSS;
+                do_join = true;
+        }
+
         if ((changed & BSS_CHANGED_BSSID) &&
             /*
              * Now we know the correct bssid, so we send a new join command
              * and enable the BSSID filter
              */
             memcmp(wl->bssid, bss_conf->bssid, ETH_ALEN)) {
-                        wl->rx_config |= CFG_BSSID_FILTER_EN;
                         memcpy(wl->bssid, bss_conf->bssid, ETH_ALEN);
+
                         ret = wl1271_cmd_build_null_data(wl);
-                        if (ret < 0) {
-                                wl1271_warning("cmd buld null data failed %d",
-                                               ret);
+                        if (ret < 0)
                                 goto out_sleep;
-                        }
+
+                        /* filter out all packets not from this BSSID */
+                        wl1271_configure_filters(wl, 0);
 
                         /* Need to update the BSSID (for filtering etc) */
                         do_join = true;
@@ -1675,10 +1703,23 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
 
         if (changed & BSS_CHANGED_ASSOC) {
                 if (bss_conf->assoc) {
+                        u32 rates;
                         wl->aid = bss_conf->aid;
                         set_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags);
 
                         /*
+                         * use basic rates from AP, and determine lowest rate
+                         * to use with control frames.
+                         */
+                        rates = bss_conf->basic_rates;
+                        wl->basic_rate_set = wl1271_tx_enabled_rates_get(wl,
+                                                                         rates);
+                        wl->basic_rate = wl1271_min_rate_get(wl);
+                        ret = wl1271_acx_rate_policies(wl);
+                        if (ret < 0)
+                                goto out_sleep;
+
+                        /*
                          * with wl1271, we don't need to update the
                          * beacon_int and dtim_period, because the firmware
                          * updates it by itself when the first beacon is
@@ -1688,7 +1729,30 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                         if (ret < 0)
                                 goto out_sleep;
 
-                        ret = wl1271_acx_aid(wl, wl->aid);
+                        /*
+                         * The SSID is intentionally set to NULL here - the
+                         * firmware will set the probe request with a
+                         * broadcast SSID regardless of what we set in the
+                         * template.
+                         */
+                        ret = wl1271_cmd_build_probe_req(wl, NULL, 0,
+                                                         NULL, 0, wl->band);
+
+                        /* Enable the keep-alive feature */
+                        ret = wl1271_acx_keep_alive_mode(wl, true);
+                        if (ret < 0)
+                                goto out_sleep;
+
+                        /*
+                         * This is awkward. The keep-alive configs must be done
+                         * *after* the join command, because otherwise it will
+                         * not work, but it must only be done *once* because
+                         * otherwise the firmware will start complaining.
+                         */
+                        do_keepalive = true;
+
+                        /* enable the connection monitoring feature */
+                        ret = wl1271_acx_conn_monit_params(wl, true);
                         if (ret < 0)
                                 goto out_sleep;
 
@@ -1704,6 +1768,22 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                         /* use defaults when not associated */
                         clear_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags);
                         wl->aid = 0;
+
+                        /* revert back to minimum rates for the current band */
+                        wl1271_set_band_rate(wl);
+                        wl->basic_rate = wl1271_min_rate_get(wl);
+                        ret = wl1271_acx_rate_policies(wl);
+                        if (ret < 0)
+                                goto out_sleep;
+
+                        /* disable connection monitor features */
+                        ret = wl1271_acx_conn_monit_params(wl, false);
+
+                        /* Disable the keep-alive feature */
+                        ret = wl1271_acx_keep_alive_mode(wl, false);
+
+                        if (ret < 0)
+                                goto out_sleep;
                 }
 
         }
@@ -1738,7 +1818,7 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
         }
 
         if (do_join) {
-                ret = wl1271_cmd_join(wl);
+                ret = wl1271_cmd_join(wl, wl->set_bss_type);
                 if (ret < 0) {
                         wl1271_warning("cmd join failed %d", ret);
                         goto out_sleep;
@@ -1746,6 +1826,29 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                 set_bit(WL1271_FLAG_JOINED, &wl->flags);
         }
 
+        /*
+         * The JOIN operation shuts down the firmware keep-alive as a side
+         * effect, and the ACX_AID will start the keep-alive as a side effect.
+         * Hence, for non-IBSS, the ACX_AID must always happen *after* the
+         * JOIN operation, and the template config after the ACX_AID.
+         */
+        if (test_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags)) {
+                ret = wl1271_acx_aid(wl, wl->aid);
+                if (ret < 0)
+                        goto out_sleep;
+        }
+
+        if (do_keepalive) {
+                ret = wl1271_cmd_build_klv_null_data(wl);
+                if (ret < 0)
+                        goto out_sleep;
+                ret = wl1271_acx_keep_alive_config(
+                        wl, CMD_TEMPL_KLV_IDX_NULL_DATA,
+                        ACX_KEEP_ALIVE_TPL_VALID);
+                if (ret < 0)
+                        goto out_sleep;
+        }
+
 out_sleep:
         wl1271_ps_elp_sleep(wl);
 
@@ -1757,6 +1860,7 @@ static int wl1271_op_conf_tx(struct ieee80211_hw *hw, u16 queue,
                              const struct ieee80211_tx_queue_params *params)
 {
         struct wl1271 *wl = hw->priv;
+        u8 ps_scheme;
         int ret;
 
         mutex_lock(&wl->mutex);
@@ -1767,17 +1871,22 @@ static int wl1271_op_conf_tx(struct ieee80211_hw *hw, u16 queue,
         if (ret < 0)
                 goto out;
 
+        /* the txop is confed in units of 32us by the mac80211, we need us */
         ret = wl1271_acx_ac_cfg(wl, wl1271_tx_get_queue(queue),
                                 params->cw_min, params->cw_max,
-                                params->aifs, params->txop);
+                                params->aifs, params->txop << 5);
         if (ret < 0)
                 goto out_sleep;
 
+        if (params->uapsd)
+                ps_scheme = CONF_PS_SCHEME_UPSD_TRIGGER;
+        else
+                ps_scheme = CONF_PS_SCHEME_LEGACY;
+
         ret = wl1271_acx_tid_cfg(wl, wl1271_tx_get_queue(queue),
                                  CONF_CHANNEL_TYPE_EDCF,
                                  wl1271_tx_get_queue(queue),
-                                 CONF_PS_SCHEME_LEGACY_PSPOLL,
-                                 CONF_ACK_POLICY_LEGACY, 0, 0);
+                                 ps_scheme, CONF_ACK_POLICY_LEGACY, 0, 0);
         if (ret < 0)
                 goto out_sleep;
 
@@ -1851,6 +1960,36 @@ static struct ieee80211_channel wl1271_channels[] = {
         { .hw_value = 13, .center_freq = 2472, .max_power = 25 },
 };
 
+/* mapping to indexes for wl1271_rates */
+const static u8 wl1271_rate_to_idx_2ghz[] = {
+        /* MCS rates are used only with 11n */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS7 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS6 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS5 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS4 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS3 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS2 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS1 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS0 */
+
+        11,                            /* CONF_HW_RXTX_RATE_54   */
+        10,                            /* CONF_HW_RXTX_RATE_48   */
+        9,                             /* CONF_HW_RXTX_RATE_36   */
+        8,                             /* CONF_HW_RXTX_RATE_24   */
+
+        /* TI-specific rate */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_22   */
+
+        7,                             /* CONF_HW_RXTX_RATE_18   */
+        6,                             /* CONF_HW_RXTX_RATE_12   */
+        3,                             /* CONF_HW_RXTX_RATE_11   */
+        5,                             /* CONF_HW_RXTX_RATE_9    */
+        4,                             /* CONF_HW_RXTX_RATE_6    */
+        2,                             /* CONF_HW_RXTX_RATE_5_5  */
+        1,                             /* CONF_HW_RXTX_RATE_2    */
+        0                              /* CONF_HW_RXTX_RATE_1    */
+};
+
 /* can't be const, mac80211 writes to this */
 static struct ieee80211_supported_band wl1271_band_2ghz = {
         .channels = wl1271_channels,
@@ -1933,6 +2072,35 @@ static struct ieee80211_channel wl1271_channels_5ghz[] = {
         { .hw_value = 165, .center_freq = 5825},
 };
 
+/* mapping to indexes for wl1271_rates_5ghz */
+const static u8 wl1271_rate_to_idx_5ghz[] = {
+        /* MCS rates are used only with 11n */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS7 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS6 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS5 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS4 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS3 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS2 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS1 */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_MCS0 */
+
+        7,                             /* CONF_HW_RXTX_RATE_54   */
+        6,                             /* CONF_HW_RXTX_RATE_48   */
+        5,                             /* CONF_HW_RXTX_RATE_36   */
+        4,                             /* CONF_HW_RXTX_RATE_24   */
+
+        /* TI-specific rate */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_22   */
+
+        3,                             /* CONF_HW_RXTX_RATE_18   */
+        2,                             /* CONF_HW_RXTX_RATE_12   */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_11   */
+        1,                             /* CONF_HW_RXTX_RATE_9    */
+        0,                             /* CONF_HW_RXTX_RATE_6    */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_5_5  */
+        CONF_HW_RXTX_RATE_UNSUPPORTED, /* CONF_HW_RXTX_RATE_2    */
+        CONF_HW_RXTX_RATE_UNSUPPORTED  /* CONF_HW_RXTX_RATE_1    */
+};
 
 static struct ieee80211_supported_band wl1271_band_5ghz = {
         .channels = wl1271_channels_5ghz,
@@ -1941,13 +2109,17 @@ static struct ieee80211_supported_band wl1271_band_5ghz = {
         .n_bitrates = ARRAY_SIZE(wl1271_rates_5ghz),
 };
 
+const static u8 *wl1271_band_rate_to_idx[] = {
+        [IEEE80211_BAND_2GHZ] = wl1271_rate_to_idx_2ghz,
+        [IEEE80211_BAND_5GHZ] = wl1271_rate_to_idx_5ghz
+};
+
 static const struct ieee80211_ops wl1271_ops = {
         .start = wl1271_op_start,
         .stop = wl1271_op_stop,
         .add_interface = wl1271_op_add_interface,
         .remove_interface = wl1271_op_remove_interface,
         .config = wl1271_op_config,
-/*      .config_interface = wl1271_op_config_interface, */
         .prepare_multicast = wl1271_op_prepare_multicast,
         .configure_filter = wl1271_op_configure_filter,
         .tx = wl1271_op_tx,
@@ -1959,7 +2131,90 @@ static const struct ieee80211_ops wl1271_ops = {
         CFG80211_TESTMODE_CMD(wl1271_tm_cmd)
 };
 
-static int wl1271_register_hw(struct wl1271 *wl)
+
+u8 wl1271_rate_to_idx(struct wl1271 *wl, int rate)
+{
+        u8 idx;
+
+        BUG_ON(wl->band >= sizeof(wl1271_band_rate_to_idx)/sizeof(u8 *));
+
+        if (unlikely(rate >= CONF_HW_RXTX_RATE_MAX)) {
+                wl1271_error("Illegal RX rate from HW: %d", rate);
+                return 0;
+        }
+
+        idx = wl1271_band_rate_to_idx[wl->band][rate];
+        if (unlikely(idx == CONF_HW_RXTX_RATE_UNSUPPORTED)) {
+                wl1271_error("Unsupported RX rate from HW: %d", rate);
+                return 0;
+        }
+
+        return idx;
+}
+
+static ssize_t wl1271_sysfs_show_bt_coex_state(struct device *dev,
+                                               struct device_attribute *attr,
+                                               char *buf)
+{
+        struct wl1271 *wl = dev_get_drvdata(dev);
+        ssize_t len;
+
+        /* FIXME: what's the maximum length of buf? page size?*/
+        len = 500;
+
+        mutex_lock(&wl->mutex);
+        len = snprintf(buf, len, "%d\n\n0 - off\n1 - on\n",
+                       wl->sg_enabled);
+        mutex_unlock(&wl->mutex);
+
+        return len;
+
+}
+
+static ssize_t wl1271_sysfs_store_bt_coex_state(struct device *dev,
+                                                struct device_attribute *attr,
+                                                const char *buf, size_t count)
+{
+        struct wl1271 *wl = dev_get_drvdata(dev);
+        unsigned long res;
+        int ret;
+
+        ret = strict_strtoul(buf, 10, &res);
+
+        if (ret < 0) {
+                wl1271_warning("incorrect value written to bt_coex_mode");
+                return count;
+        }
+
+        mutex_lock(&wl->mutex);
+
+        res = !!res;
+
+        if (res == wl->sg_enabled)
+                goto out;
+
+        wl->sg_enabled = res;
+
+        if (wl->state == WL1271_STATE_OFF)
+                goto out;
+
+        ret = wl1271_ps_elp_wakeup(wl, false);
+        if (ret < 0)
+                goto out;
+
+        wl1271_acx_sg_enable(wl, wl->sg_enabled);
+        wl1271_ps_elp_sleep(wl);
+
+ out:
+        mutex_unlock(&wl->mutex);
+        return count;
+}
+
+static DEVICE_ATTR(bt_coex_state, S_IRUGO | S_IWUSR,
+                   wl1271_sysfs_show_bt_coex_state,
+                   wl1271_sysfs_store_bt_coex_state);
+
+int wl1271_register_hw(struct wl1271 *wl)
 {
         int ret;
 
@@ -1980,8 +2235,17 @@ static int wl1271_register_hw(struct wl1271 *wl)
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(wl1271_register_hw);
 
-static int wl1271_init_ieee80211(struct wl1271 *wl)
+void wl1271_unregister_hw(struct wl1271 *wl)
+{
+        ieee80211_unregister_hw(wl->hw);
+        wl->mac80211_registered = false;
+
+}
+EXPORT_SYMBOL_GPL(wl1271_unregister_hw);
+
+int wl1271_init_ieee80211(struct wl1271 *wl)
 {
         /* The tx descriptor buffer and the TKIP space. */
         wl->hw->extra_tx_headroom = WL1271_TKIP_IV_SPACE +
@@ -1990,11 +2254,15 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
         /* unit us */
         /* FIXME: find a proper value */
         wl->hw->channel_change_time = 10000;
+        wl->hw->max_listen_interval = wl->conf.conn.max_listen_interval;
 
         wl->hw->flags = IEEE80211_HW_SIGNAL_DBM |
                 IEEE80211_HW_NOISE_DBM |
                 IEEE80211_HW_BEACON_FILTER |
-                IEEE80211_HW_SUPPORTS_PS;
+                IEEE80211_HW_SUPPORTS_PS |
+                IEEE80211_HW_SUPPORTS_UAPSD |
+                IEEE80211_HW_HAS_RATE_CONTROL |
+                IEEE80211_HW_CONNECTION_MONITOR;
 
         wl->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
                 BIT(NL80211_IFTYPE_ADHOC);
@@ -2004,51 +2272,53 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
         if (wl1271_11a_enabled())
                 wl->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &wl1271_band_5ghz;
 
-        SET_IEEE80211_DEV(wl->hw, &wl->spi->dev);
+        wl->hw->queues = 4;
+        wl->hw->max_rates = 1;
 
-        return 0;
-}
-
-static void wl1271_device_release(struct device *dev)
-{
+        SET_IEEE80211_DEV(wl->hw, wl1271_wl_to_dev(wl));
 
+        return 0;
 }
-
-static struct platform_device wl1271_device = {
-        .name           = "wl1271",
-        .id             = -1,
-
-        /* device model insists to have a release function */
-        .dev            = {
-                .release = wl1271_device_release,
-        },
-};
+EXPORT_SYMBOL_GPL(wl1271_init_ieee80211);
 
 #define WL1271_DEFAULT_CHANNEL 0
 
-static struct ieee80211_hw *wl1271_alloc_hw(void)
+struct ieee80211_hw *wl1271_alloc_hw(void)
 {
         struct ieee80211_hw *hw;
+        struct platform_device *plat_dev = NULL;
         struct wl1271 *wl;
-        int i;
+        int i, ret;
 
         hw = ieee80211_alloc_hw(sizeof(*wl), &wl1271_ops);
         if (!hw) {
                 wl1271_error("could not alloc ieee80211_hw");
-                return ERR_PTR(-ENOMEM);
+                ret = -ENOMEM;
+                goto err_hw_alloc;
+        }
+
+        plat_dev = kmalloc(sizeof(wl1271_device), GFP_KERNEL);
+        if (!plat_dev) {
+                wl1271_error("could not allocate platform_device");
+                ret = -ENOMEM;
+                goto err_plat_alloc;
         }
 
+        memcpy(plat_dev, &wl1271_device, sizeof(wl1271_device));
+
         wl = hw->priv;
         memset(wl, 0, sizeof(*wl));
 
         INIT_LIST_HEAD(&wl->list);
 
         wl->hw = hw;
+        wl->plat_dev = plat_dev;
 
         skb_queue_head_init(&wl->tx_queue);
 
         INIT_DELAYED_WORK(&wl->elp_work, wl1271_elp_work);
         wl->channel = WL1271_DEFAULT_CHANNEL;
+        wl->beacon_int = WL1271_DEFAULT_BEACON_INT;
         wl->default_key = 0;
         wl->rx_counter = 0;
         wl->rx_config = WL1271_DEFAULT_RX_CONFIG;
@@ -2056,11 +2326,13 @@ static struct ieee80211_hw *wl1271_alloc_hw(void)
         wl->psm_entry_retry = 0;
         wl->power_level = WL1271_DEFAULT_POWER_LEVEL;
         wl->basic_rate_set = CONF_TX_RATE_MASK_BASIC;
+        wl->basic_rate = CONF_TX_RATE_MASK_BASIC;
         wl->rate_set = CONF_TX_RATE_MASK_BASIC;
         wl->sta_rate_set = 0;
         wl->band = IEEE80211_BAND_2GHZ;
         wl->vif = NULL;
         wl->flags = 0;
+        wl->sg_enabled = true;
 
         for (i = 0; i < ACX_TX_DESCRIPTORS; i++)
                 wl->tx_frames[i] = NULL;
@@ -2073,12 +2345,45 @@ static struct ieee80211_hw *wl1271_alloc_hw(void)
         /* Apply default driver configuration. */
         wl1271_conf_init(wl);
 
+        wl1271_debugfs_init(wl);
+
+        /* Register platform device */
+        ret = platform_device_register(wl->plat_dev);
+        if (ret) {
+                wl1271_error("couldn't register platform device");
+                goto err_hw;
+        }
+        dev_set_drvdata(&wl->plat_dev->dev, wl);
+
+        /* Create sysfs file to control bt coex state */
+        ret = device_create_file(&wl->plat_dev->dev, &dev_attr_bt_coex_state);
+        if (ret < 0) {
+                wl1271_error("failed to create sysfs file bt_coex_state");
+                goto err_platform;
+        }
+
         return hw;
+
+err_platform:
+        platform_device_unregister(wl->plat_dev);
+
+err_hw:
+        wl1271_debugfs_exit(wl);
+        kfree(plat_dev);
+
+err_plat_alloc:
+        ieee80211_free_hw(hw);
+
+err_hw_alloc:
+
+        return ERR_PTR(ret);
 }
+EXPORT_SYMBOL_GPL(wl1271_alloc_hw);
 
 int wl1271_free_hw(struct wl1271 *wl)
 {
-        ieee80211_unregister_hw(wl->hw);
+        platform_device_unregister(wl->plat_dev);
+        kfree(wl->plat_dev);
 
         wl1271_debugfs_exit(wl);
 
@@ -2095,145 +2400,8 @@ int wl1271_free_hw(struct wl1271 *wl)
 
         return 0;
 }
-
-static int __devinit wl1271_probe(struct spi_device *spi)
-{
-        struct wl12xx_platform_data *pdata;
-        struct ieee80211_hw *hw;
-        struct wl1271 *wl;
-        int ret;
-
-        pdata = spi->dev.platform_data;
-        if (!pdata) {
-                wl1271_error("no platform data");
-                return -ENODEV;
-        }
-
-        hw = wl1271_alloc_hw();
-        if (IS_ERR(hw))
-                return PTR_ERR(hw);
-
-        wl = hw->priv;
-
-        dev_set_drvdata(&spi->dev, wl);
-        wl->spi = spi;
-
-        /* This is the only SPI value that we need to set here, the rest
-         * comes from the board-peripherals file */
-        spi->bits_per_word = 32;
-
-        ret = spi_setup(spi);
-        if (ret < 0) {
-                wl1271_error("spi_setup failed");
-                goto out_free;
-        }
-
-        wl->set_power = pdata->set_power;
-        if (!wl->set_power) {
-                wl1271_error("set power function missing in platform data");
-                ret = -ENODEV;
-                goto out_free;
-        }
-
-        wl->irq = spi->irq;
-        if (wl->irq < 0) {
-                wl1271_error("irq missing in platform data");
-                ret = -ENODEV;
-                goto out_free;
-        }
-
-        ret = request_irq(wl->irq, wl1271_irq, 0, DRIVER_NAME, wl);
-        if (ret < 0) {
-                wl1271_error("request_irq() failed: %d", ret);
-                goto out_free;
-        }
-
-        set_irq_type(wl->irq, IRQ_TYPE_EDGE_RISING);
-
-        disable_irq(wl->irq);
-
-        ret = platform_device_register(&wl1271_device);
-        if (ret) {
-                wl1271_error("couldn't register platform device");
-                goto out_irq;
-        }
-        dev_set_drvdata(&wl1271_device.dev, wl);
-
-        ret = wl1271_init_ieee80211(wl);
-        if (ret)
-                goto out_platform;
-
-        ret = wl1271_register_hw(wl);
-        if (ret)
-                goto out_platform;
-
-        wl1271_debugfs_init(wl);
-
-        wl1271_notice("initialized");
-
-        return 0;
-
- out_platform:
-        platform_device_unregister(&wl1271_device);
-
- out_irq:
-        free_irq(wl->irq, wl);
-
- out_free:
-        ieee80211_free_hw(hw);
-
-        return ret;
-}
-
-static int __devexit wl1271_remove(struct spi_device *spi)
-{
-        struct wl1271 *wl = dev_get_drvdata(&spi->dev);
-
-        platform_device_unregister(&wl1271_device);
-        free_irq(wl->irq, wl);
-
-        wl1271_free_hw(wl);
-
-        return 0;
-}
-
-
-static struct spi_driver wl1271_spi_driver = {
-        .driver = {
-                .name           = "wl1271",
-                .bus            = &spi_bus_type,
-                .owner          = THIS_MODULE,
-        },
-
-        .probe          = wl1271_probe,
-        .remove         = __devexit_p(wl1271_remove),
-};
-
-static int __init wl1271_init(void)
-{
-        int ret;
-
-        ret = spi_register_driver(&wl1271_spi_driver);
-        if (ret < 0) {
-                wl1271_error("failed to register spi driver: %d", ret);
-                goto out;
-        }
-
-out:
-        return ret;
-}
-
-static void __exit wl1271_exit(void)
-{
-        spi_unregister_driver(&wl1271_spi_driver);
-
-        wl1271_notice("unloaded");
-}
-
-module_init(wl1271_init);
-module_exit(wl1271_exit);
+EXPORT_SYMBOL_GPL(wl1271_free_hw);
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Luciano Coelho <luciano.coelho@nokia.com>");
 MODULE_AUTHOR("Juuso Oikarinen <juuso.oikarinen@nokia.com>");
-MODULE_FIRMWARE(WL1271_FW_NAME);
diff --git a/drivers/net/wireless/wl12xx/wl1271_ps.c b/drivers/net/wireless/wl12xx/wl1271_ps.c
index e2b1ebf096e8..5a04482b9353 100644
--- a/drivers/net/wireless/wl12xx/wl1271_ps.c
+++ b/drivers/net/wireless/wl12xx/wl1271_ps.c
@@ -23,7 +23,6 @@
 
 #include "wl1271_reg.h"
 #include "wl1271_ps.h"
-#include "wl1271_spi.h"
 #include "wl1271_io.h"
 
 #define WL1271_WAKEUP_TIMEOUT 500
diff --git a/drivers/net/wireless/wl12xx/wl1271_rx.c b/drivers/net/wireless/wl12xx/wl1271_rx.c
index 6730f5b96e76..ca442703d1ab 100644
--- a/drivers/net/wireless/wl12xx/wl1271_rx.c
+++ b/drivers/net/wireless/wl12xx/wl1271_rx.c
@@ -25,7 +25,6 @@
 #include "wl1271_acx.h"
 #include "wl1271_reg.h"
 #include "wl1271_rx.h"
-#include "wl1271_spi.h"
 #include "wl1271_io.h"
 
 static u8 wl1271_rx_get_mem_block(struct wl1271_fw_status *status,
@@ -42,66 +41,6 @@ static u32 wl1271_rx_get_buf_size(struct wl1271_fw_status *status,
                 RX_BUF_SIZE_MASK) >> RX_BUF_SIZE_SHIFT_DIV;
 }
 
-/* The values of this table must match the wl1271_rates[] array */
-static u8 wl1271_rx_rate_to_idx[] = {
-        /* MCS rates are used only with 11n */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS7 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS6 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS5 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS4 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS3 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS2 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS1 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS0 */
-
-        11,                         /* WL1271_RATE_54   */
-        10,                         /* WL1271_RATE_48   */
-        9,                          /* WL1271_RATE_36   */
-        8,                          /* WL1271_RATE_24   */
-
-        /* TI-specific rate */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_22   */
-
-        7,                          /* WL1271_RATE_18   */
-        6,                          /* WL1271_RATE_12   */
-        3,                          /* WL1271_RATE_11   */
-        5,                          /* WL1271_RATE_9    */
-        4,                          /* WL1271_RATE_6    */
-        2,                          /* WL1271_RATE_5_5  */
-        1,                          /* WL1271_RATE_2    */
-        0                           /* WL1271_RATE_1    */
-};
-
-/* The values of this table must match the wl1271_rates[] array */
-static u8 wl1271_5_ghz_rx_rate_to_idx[] = {
-        /* MCS rates are used only with 11n */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS7 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS6 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS5 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS4 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS3 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS2 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS1 */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_MCS0 */
-
-        7,                          /* WL1271_RATE_54   */
-        6,                          /* WL1271_RATE_48   */
-        5,                          /* WL1271_RATE_36   */
-        4,                          /* WL1271_RATE_24   */
-
-        /* TI-specific rate */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_22   */
-
-        3,                          /* WL1271_RATE_18   */
-        2,                          /* WL1271_RATE_12   */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_11   */
-        1,                          /* WL1271_RATE_9    */
-        0,                          /* WL1271_RATE_6    */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_5_5  */
-        WL1271_RX_RATE_UNSUPPORTED, /* WL1271_RATE_2    */
-        WL1271_RX_RATE_UNSUPPORTED  /* WL1271_RATE_1    */
-};
-
 static void wl1271_rx_status(struct wl1271 *wl,
                              struct wl1271_rx_descriptor *desc,
                              struct ieee80211_rx_status *status,
@@ -109,20 +48,8 @@ static void wl1271_rx_status(struct wl1271 *wl,
 {
         memset(status, 0, sizeof(struct ieee80211_rx_status));
 
-        if ((desc->flags & WL1271_RX_DESC_BAND_MASK) ==
-            WL1271_RX_DESC_BAND_BG) {
-                status->band = IEEE80211_BAND_2GHZ;
-                status->rate_idx = wl1271_rx_rate_to_idx[desc->rate];
-        } else if ((desc->flags & WL1271_RX_DESC_BAND_MASK) ==
-                 WL1271_RX_DESC_BAND_A) {
-                status->band = IEEE80211_BAND_5GHZ;
-                status->rate_idx = wl1271_5_ghz_rx_rate_to_idx[desc->rate];
-        } else
-                wl1271_warning("unsupported band 0x%x",
-                               desc->flags & WL1271_RX_DESC_BAND_MASK);
-
-        if (unlikely(status->rate_idx == WL1271_RX_RATE_UNSUPPORTED))
-                wl1271_warning("unsupported rate");
+        status->band = wl->band;
+        status->rate_idx = wl1271_rate_to_idx(wl, desc->rate);
 
         /*
          * FIXME: Add mactime handling.  For IBSS (ad-hoc) we need to get the
@@ -132,13 +59,6 @@ static void wl1271_rx_status(struct wl1271 *wl,
          */
         status->signal = desc->rssi;
 
-        /*
-         * FIXME: In wl1251, the SNR should be divided by two.  In wl1271 we
-         * need to divide by two for now, but TI has been discussing about
-         * changing it.  This needs to be rechecked.
-         */
-        status->noise = desc->rssi - (desc->snr >> 1);
-
         status->freq = ieee80211_channel_to_frequency(desc->channel);
 
         if (desc->flags & WL1271_RX_DESC_ENCRYPT_MASK) {
@@ -160,6 +80,13 @@ static void wl1271_rx_handle_data(struct wl1271 *wl, u32 length)
         u8 *buf;
         u8 beacon = 0;
 
+        /*
+         * In PLT mode we seem to get frames and mac80211 warns about them,
+         * workaround this by not retrieving them at all.
+         */
+        if (unlikely(wl->state == WL1271_STATE_PLT))
+                return;
+
         skb = __dev_alloc_skb(length, GFP_KERNEL);
         if (!skb) {
                 wl1271_error("Couldn't allocate RX frame");
@@ -218,6 +145,7 @@ void wl1271_rx(struct wl1271 *wl, struct wl1271_fw_status *status)
 
                 wl->rx_counter++;
                 drv_rx_counter = wl->rx_counter & NUM_RX_PKT_DESC_MOD_MASK;
-                wl1271_write32(wl, RX_DRIVER_COUNTER_ADDRESS, wl->rx_counter);
         }
+
+        wl1271_write32(wl, RX_DRIVER_COUNTER_ADDRESS, wl->rx_counter);
 }
diff --git a/drivers/net/wireless/wl12xx/wl1271_rx.h b/drivers/net/wireless/wl12xx/wl1271_rx.h
index 1ae6d1783ed4..b89be4758e78 100644
--- a/drivers/net/wireless/wl12xx/wl1271_rx.h
+++ b/drivers/net/wireless/wl12xx/wl1271_rx.h
@@ -43,7 +43,6 @@
 #define RX_MAX_PACKET_ID 3
 
 #define NUM_RX_PKT_DESC_MOD_MASK   7
-#define WL1271_RX_RATE_UNSUPPORTED 0xFF
 
 #define RX_DESC_VALID_FCS         0x0001
 #define RX_DESC_MATCH_RXADDR1     0x0002
@@ -117,5 +116,6 @@ struct wl1271_rx_descriptor {
 } __attribute__ ((packed));
 
 void wl1271_rx(struct wl1271 *wl, struct wl1271_fw_status *status);
+u8 wl1271_rate_to_idx(struct wl1271 *wl, int rate);
 
 #endif
diff --git a/drivers/net/wireless/wl12xx/wl1271_sdio.c b/drivers/net/wireless/wl12xx/wl1271_sdio.c
new file mode 100644
index 000000000000..d3d6f302f705
--- /dev/null
+++ b/drivers/net/wireless/wl12xx/wl1271_sdio.c
@@ -0,0 +1,291 @@
+/*
+ * This file is part of wl1271
+ *
+ * Copyright (C) 2009-2010 Nokia Corporation
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <linux/irq.h>
+#include <linux/module.h>
+#include <linux/crc7.h>
+#include <linux/vmalloc.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/mmc/sdio_ids.h>
+#include <linux/mmc/card.h>
+#include <plat/gpio.h>
+
+#include "wl1271.h"
+#include "wl12xx_80211.h"
+#include "wl1271_io.h"
+
+
+#define RX71_WL1271_IRQ_GPIO            42
+
+#ifndef SDIO_VENDOR_ID_TI
+#define SDIO_VENDOR_ID_TI               0x0097
+#endif
+
+#ifndef SDIO_DEVICE_ID_TI_WL1271
+#define SDIO_DEVICE_ID_TI_WL1271        0x4076
+#endif
+
+static const struct sdio_device_id wl1271_devices[] = {
+        { SDIO_DEVICE(SDIO_VENDOR_ID_TI, SDIO_DEVICE_ID_TI_WL1271) },
+        {}
+};
+MODULE_DEVICE_TABLE(sdio, wl1271_devices);
+
+static inline struct sdio_func *wl_to_func(struct wl1271 *wl)
+{
+        return wl->if_priv;
+}
+
+static struct device *wl1271_sdio_wl_to_dev(struct wl1271 *wl)
+{
+        return &(wl_to_func(wl)->dev);
+}
+
+static irqreturn_t wl1271_irq(int irq, void *cookie)
+{
+        struct wl1271 *wl = cookie;
+        unsigned long flags;
+
+        wl1271_debug(DEBUG_IRQ, "IRQ");
+
+        /* complete the ELP completion */
+        spin_lock_irqsave(&wl->wl_lock, flags);
+        if (wl->elp_compl) {
+                complete(wl->elp_compl);
+                wl->elp_compl = NULL;
+        }
+
+        if (!test_and_set_bit(WL1271_FLAG_IRQ_RUNNING, &wl->flags))
+                ieee80211_queue_work(wl->hw, &wl->irq_work);
+        set_bit(WL1271_FLAG_IRQ_PENDING, &wl->flags);
+        spin_unlock_irqrestore(&wl->wl_lock, flags);
+
+        return IRQ_HANDLED;
+}
+
+static void wl1271_sdio_disable_interrupts(struct wl1271 *wl)
+{
+        disable_irq(wl->irq);
+}
+
+static void wl1271_sdio_enable_interrupts(struct wl1271 *wl)
+{
+        enable_irq(wl->irq);
+}
+
+static void wl1271_sdio_reset(struct wl1271 *wl)
+{
+}
+
+static void wl1271_sdio_init(struct wl1271 *wl)
+{
+}
+
+static void wl1271_sdio_raw_read(struct wl1271 *wl, int addr, void *buf,
+                                 size_t len, bool fixed)
+{
+        int ret;
+        struct sdio_func *func = wl_to_func(wl);
+
+        if (unlikely(addr == HW_ACCESS_ELP_CTRL_REG_ADDR)) {
+                ((u8 *)buf)[0] = sdio_f0_readb(func, addr, &ret);
+                wl1271_debug(DEBUG_SDIO, "sdio read 52 addr 0x%x, byte 0x%02x",
+                             addr, ((u8 *)buf)[0]);
+        } else {
+                if (fixed)
+                        ret = sdio_readsb(func, buf, addr, len);
+                else
+                        ret = sdio_memcpy_fromio(func, buf, addr, len);
+
+                wl1271_debug(DEBUG_SDIO, "sdio read 53 addr 0x%x, %zu bytes",
+                             addr, len);
+                wl1271_dump_ascii(DEBUG_SDIO, "data: ", buf, len);
+        }
+
+        if (ret)
+                wl1271_error("sdio read failed (%d)", ret);
+
+}
+
+static void wl1271_sdio_raw_write(struct wl1271 *wl, int addr, void *buf,
+                                  size_t len, bool fixed)
+{
+        int ret;
+        struct sdio_func *func = wl_to_func(wl);
+
+        if (unlikely(addr == HW_ACCESS_ELP_CTRL_REG_ADDR)) {
+                sdio_f0_writeb(func, ((u8 *)buf)[0], addr, &ret);
+                wl1271_debug(DEBUG_SDIO, "sdio write 52 addr 0x%x, byte 0x%02x",
+                             addr, ((u8 *)buf)[0]);
+        } else {
+                wl1271_debug(DEBUG_SDIO, "sdio write 53 addr 0x%x, %zu bytes",
+                             addr, len);
+                wl1271_dump_ascii(DEBUG_SDIO, "data: ", buf, len);
+
+                if (fixed)
+                        ret = sdio_writesb(func, addr, buf, len);
+                else
+                        ret = sdio_memcpy_toio(func, addr, buf, len);
+        }
+        if (ret)
+                wl1271_error("sdio write failed (%d)", ret);
+
+}
+
+static void wl1271_sdio_set_power(struct wl1271 *wl, bool enable)
+{
+        struct sdio_func *func = wl_to_func(wl);
+
+        /* Let the SDIO stack handle wlan_enable control, so we
+         * keep host claimed while wlan is in use to keep wl1271
+         * alive.
+         */
+        if (enable) {
+                sdio_claim_host(func);
+                sdio_enable_func(func);
+        } else {
+                sdio_disable_func(func);
+                sdio_release_host(func);
+        }
+}
+
+static struct wl1271_if_operations sdio_ops = {
+        .read           = wl1271_sdio_raw_read,
+        .write          = wl1271_sdio_raw_write,
+        .reset          = wl1271_sdio_reset,
+        .init           = wl1271_sdio_init,
+        .power          = wl1271_sdio_set_power,
+        .dev            = wl1271_sdio_wl_to_dev,
+        .enable_irq     = wl1271_sdio_enable_interrupts,
+        .disable_irq    = wl1271_sdio_disable_interrupts
+};
+
+static int __devinit wl1271_probe(struct sdio_func *func,
+                                  const struct sdio_device_id *id)
+{
+        struct ieee80211_hw *hw;
+        struct wl1271 *wl;
+        int ret;
+
+        /* We are only able to handle the wlan function */
+        if (func->num != 0x02)
+                return -ENODEV;
+
+        hw = wl1271_alloc_hw();
+        if (IS_ERR(hw))
+                return PTR_ERR(hw);
+
+        wl = hw->priv;
+
+        wl->if_priv = func;
+        wl->if_ops = &sdio_ops;
+
+        /* Grab access to FN0 for ELP reg. */
+        func->card->quirks |= MMC_QUIRK_LENIENT_FN0;
+
+        wl->irq = gpio_to_irq(RX71_WL1271_IRQ_GPIO);
+        if (wl->irq < 0) {
+                ret = wl->irq;
+                wl1271_error("could not get irq!");
+                goto out_free;
+        }
+
+        ret = request_irq(wl->irq, wl1271_irq, 0, DRIVER_NAME, wl);
+        if (ret < 0) {
+                wl1271_error("request_irq() failed: %d", ret);
+                goto out_free;
+        }
+
+        set_irq_type(wl->irq, IRQ_TYPE_EDGE_RISING);
+
+        disable_irq(wl->irq);
+
+        ret = wl1271_init_ieee80211(wl);
+        if (ret)
+                goto out_irq;
+
+        ret = wl1271_register_hw(wl);
+        if (ret)
+                goto out_irq;
+
+        sdio_set_drvdata(func, wl);
+
+        wl1271_notice("initialized");
+
+        return 0;
+
+ out_irq:
+        free_irq(wl->irq, wl);
+
+
+ out_free:
+        wl1271_free_hw(wl);
+
+        return ret;
+}
+
+static void __devexit wl1271_remove(struct sdio_func *func)
+{
+        struct wl1271 *wl = sdio_get_drvdata(func);
+
+        free_irq(wl->irq, wl);
+
+        wl1271_unregister_hw(wl);
+        wl1271_free_hw(wl);
+}
+
+static struct sdio_driver wl1271_sdio_driver = {
+        .name           = "wl1271_sdio",
+        .id_table       = wl1271_devices,
+        .probe          = wl1271_probe,
+        .remove         = __devexit_p(wl1271_remove),
+};
+
+static int __init wl1271_init(void)
+{
+        int ret;
+
+        ret = sdio_register_driver(&wl1271_sdio_driver);
+        if (ret < 0) {
+                wl1271_error("failed to register sdio driver: %d", ret);
+                goto out;
+        }
+
+out:
+        return ret;
+}
+
+static void __exit wl1271_exit(void)
+{
+        sdio_unregister_driver(&wl1271_sdio_driver);
+
+        wl1271_notice("unloaded");
+}
+
+module_init(wl1271_init);
+module_exit(wl1271_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Luciano Coelho <luciano.coelho@nokia.com>");
+MODULE_AUTHOR("Juuso Oikarinen <juuso.oikarinen@nokia.com>");
+MODULE_FIRMWARE(WL1271_FW_NAME);
diff --git a/drivers/net/wireless/wl12xx/wl1271_spi.c b/drivers/net/wireless/wl12xx/wl1271_spi.c
index 67a82934f36e..7a7db011a797 100644
--- a/drivers/net/wireless/wl12xx/wl1271_spi.c
+++ b/drivers/net/wireless/wl12xx/wl1271_spi.c
@@ -21,17 +21,68 @@
  *
  */
 
+#include <linux/irq.h>
 #include <linux/module.h>
-#include <linux/platform_device.h>
 #include <linux/crc7.h>
 #include <linux/spi/spi.h>
+#include <linux/spi/wl12xx.h>
 
 #include "wl1271.h"
 #include "wl12xx_80211.h"
-#include "wl1271_spi.h"
+#include "wl1271_io.h"
+
+#include "wl1271_reg.h"
+
+#define WSPI_CMD_READ                 0x40000000
+#define WSPI_CMD_WRITE                0x00000000
+#define WSPI_CMD_FIXED                0x20000000
+#define WSPI_CMD_BYTE_LENGTH          0x1FFE0000
+#define WSPI_CMD_BYTE_LENGTH_OFFSET   17
+#define WSPI_CMD_BYTE_ADDR            0x0001FFFF
+
+#define WSPI_INIT_CMD_CRC_LEN       5
+
+#define WSPI_INIT_CMD_START         0x00
+#define WSPI_INIT_CMD_TX            0x40
+/* the extra bypass bit is sampled by the TNET as '1' */
+#define WSPI_INIT_CMD_BYPASS_BIT    0x80
+#define WSPI_INIT_CMD_FIXEDBUSY_LEN 0x07
+#define WSPI_INIT_CMD_EN_FIXEDBUSY  0x80
+#define WSPI_INIT_CMD_DIS_FIXEDBUSY 0x00
+#define WSPI_INIT_CMD_IOD           0x40
+#define WSPI_INIT_CMD_IP            0x20
+#define WSPI_INIT_CMD_CS            0x10
+#define WSPI_INIT_CMD_WS            0x08
+#define WSPI_INIT_CMD_WSPI          0x01
+#define WSPI_INIT_CMD_END           0x01
+
+#define WSPI_INIT_CMD_LEN           8
+
+#define HW_ACCESS_WSPI_FIXED_BUSY_LEN \
+                ((WL1271_BUSY_WORD_LEN - 4) / sizeof(u32))
+#define HW_ACCESS_WSPI_INIT_CMD_MASK  0
+
+static inline struct spi_device *wl_to_spi(struct wl1271 *wl)
+{
+        return wl->if_priv;
+}
 
+static struct device *wl1271_spi_wl_to_dev(struct wl1271 *wl)
+{
+        return &(wl_to_spi(wl)->dev);
+}
 
-void wl1271_spi_reset(struct wl1271 *wl)
+static void wl1271_spi_disable_interrupts(struct wl1271 *wl)
+{
+        disable_irq(wl->irq);
+}
+
+static void wl1271_spi_enable_interrupts(struct wl1271 *wl)
+{
+        enable_irq(wl->irq);
+}
+
+static void wl1271_spi_reset(struct wl1271 *wl)
 {
         u8 *cmd;
         struct spi_transfer t;
@@ -52,12 +103,13 @@ void wl1271_spi_reset(struct wl1271 *wl)
         t.len = WSPI_INIT_CMD_LEN;
         spi_message_add_tail(&t, &m);
 
-        spi_sync(wl->spi, &m);
+        spi_sync(wl_to_spi(wl), &m);
+        kfree(cmd);
 
         wl1271_dump(DEBUG_SPI, "spi reset -> ", cmd, WSPI_INIT_CMD_LEN);
 }
 
-void wl1271_spi_init(struct wl1271 *wl)
+static void wl1271_spi_init(struct wl1271 *wl)
 {
         u8 crc[WSPI_INIT_CMD_CRC_LEN], *cmd;
         struct spi_transfer t;
@@ -106,48 +158,25 @@ void wl1271_spi_init(struct wl1271 *wl)
         t.len = WSPI_INIT_CMD_LEN;
         spi_message_add_tail(&t, &m);
 
-        spi_sync(wl->spi, &m);
+        spi_sync(wl_to_spi(wl), &m);
+        kfree(cmd);
 
         wl1271_dump(DEBUG_SPI, "spi init -> ", cmd, WSPI_INIT_CMD_LEN);
 }
 
 #define WL1271_BUSY_WORD_TIMEOUT 1000
 
-/* FIXME: Check busy words, removed due to SPI bug */
-#if 0
-static void wl1271_spi_read_busy(struct wl1271 *wl, void *buf, size_t len)
+static int wl1271_spi_read_busy(struct wl1271 *wl)
 {
         struct spi_transfer t[1];
         struct spi_message m;
         u32 *busy_buf;
         int num_busy_bytes = 0;
 
-        wl1271_info("spi read BUSY!");
-
-        /*
-         * Look for the non-busy word in the read buffer, and if found,
-         * read in the remaining data into the buffer.
-         */
-        busy_buf = (u32 *)buf;
-        for (; (u32)busy_buf < (u32)buf + len; busy_buf++) {
-                num_busy_bytes += sizeof(u32);
-                if (*busy_buf & 0x1) {
-                        spi_message_init(&m);
-                        memset(t, 0, sizeof(t));
-                        memmove(buf, busy_buf, len - num_busy_bytes);
-                        t[0].rx_buf = buf + (len - num_busy_bytes);
-                        t[0].len = num_busy_bytes;
-                        spi_message_add_tail(&t[0], &m);
-                        spi_sync(wl->spi, &m);
-                        return;
-                }
-        }
-
         /*
          * Read further busy words from SPI until a non-busy word is
          * encountered, then read the data itself into the buffer.
          */
-        wl1271_info("spi read BUSY-polling needed!");
 
         num_busy_bytes = WL1271_BUSY_WORD_TIMEOUT;
         busy_buf = wl->buffer_busyword;
@@ -157,28 +186,21 @@ static void wl1271_spi_read_busy(struct wl1271 *wl, void *buf, size_t len)
                 memset(t, 0, sizeof(t));
                 t[0].rx_buf = busy_buf;
                 t[0].len = sizeof(u32);
+                t[0].cs_change = true;
                 spi_message_add_tail(&t[0], &m);
-                spi_sync(wl->spi, &m);
-
-                if (*busy_buf & 0x1) {
-                        spi_message_init(&m);
-                        memset(t, 0, sizeof(t));
-                        t[0].rx_buf = buf;
-                        t[0].len = len;
-                        spi_message_add_tail(&t[0], &m);
-                        spi_sync(wl->spi, &m);
-                        return;
-                }
+                spi_sync(wl_to_spi(wl), &m);
+
+                if (*busy_buf & 0x1)
+                        return 0;
         }
 
         /* The SPI bus is unresponsive, the read failed. */
-        memset(buf, 0, len);
         wl1271_error("SPI read busy-word timeout!\n");
+        return -ETIMEDOUT;
 }
-#endif
 
-void wl1271_spi_raw_read(struct wl1271 *wl, int addr, void *buf,
-                         size_t len, bool fixed)
+static void wl1271_spi_raw_read(struct wl1271 *wl, int addr, void *buf,
+                                size_t len, bool fixed)
 {
         struct spi_transfer t[3];
         struct spi_message m;
@@ -201,28 +223,38 @@ void wl1271_spi_raw_read(struct wl1271 *wl, int addr, void *buf,
 
         t[0].tx_buf = cmd;
         t[0].len = 4;
+        t[0].cs_change = true;
         spi_message_add_tail(&t[0], &m);
 
         /* Busy and non busy words read */
         t[1].rx_buf = busy_buf;
         t[1].len = WL1271_BUSY_WORD_LEN;
+        t[1].cs_change = true;
         spi_message_add_tail(&t[1], &m);
 
-        t[2].rx_buf = buf;
-        t[2].len = len;
-        spi_message_add_tail(&t[2], &m);
+        spi_sync(wl_to_spi(wl), &m);
 
-        spi_sync(wl->spi, &m);
+        if (!(busy_buf[WL1271_BUSY_WORD_CNT - 1] & 0x1) &&
+            wl1271_spi_read_busy(wl)) {
+                memset(buf, 0, len);
+                return;
+        }
 
-        /* FIXME: Check busy words, removed due to SPI bug */
-        /* if (!(busy_buf[WL1271_BUSY_WORD_CNT - 1] & 0x1))
-           wl1271_spi_read_busy(wl, buf, len); */
+        spi_message_init(&m);
+        memset(t, 0, sizeof(t));
+
+        t[0].rx_buf = buf;
+        t[0].len = len;
+        t[0].cs_change = true;
+        spi_message_add_tail(&t[0], &m);
+
+        spi_sync(wl_to_spi(wl), &m);
 
         wl1271_dump(DEBUG_SPI, "spi_read cmd -> ", cmd, sizeof(*cmd));
         wl1271_dump(DEBUG_SPI, "spi_read buf <- ", buf, len);
 }
 
-void wl1271_spi_raw_write(struct wl1271 *wl, int addr, void *buf,
+static void wl1271_spi_raw_write(struct wl1271 *wl, int addr, void *buf,
                           size_t len, bool fixed)
 {
         struct spi_transfer t[2];
@@ -250,8 +282,181 @@ void wl1271_spi_raw_write(struct wl1271 *wl, int addr, void *buf,
         t[1].len = len;
         spi_message_add_tail(&t[1], &m);
 
-        spi_sync(wl->spi, &m);
+        spi_sync(wl_to_spi(wl), &m);
 
         wl1271_dump(DEBUG_SPI, "spi_write cmd -> ", cmd, sizeof(*cmd));
         wl1271_dump(DEBUG_SPI, "spi_write buf -> ", buf, len);
 }
+
+static irqreturn_t wl1271_irq(int irq, void *cookie)
+{
+        struct wl1271 *wl;
+        unsigned long flags;
+
+        wl1271_debug(DEBUG_IRQ, "IRQ");
+
+        wl = cookie;
+
+        /* complete the ELP completion */
+        spin_lock_irqsave(&wl->wl_lock, flags);
+        if (wl->elp_compl) {
+                complete(wl->elp_compl);
+                wl->elp_compl = NULL;
+        }
+
+        if (!test_and_set_bit(WL1271_FLAG_IRQ_RUNNING, &wl->flags))
+                ieee80211_queue_work(wl->hw, &wl->irq_work);
+        set_bit(WL1271_FLAG_IRQ_PENDING, &wl->flags);
+        spin_unlock_irqrestore(&wl->wl_lock, flags);
+
+        return IRQ_HANDLED;
+}
+
+static void wl1271_spi_set_power(struct wl1271 *wl, bool enable)
+{
+        if (wl->set_power)
+                wl->set_power(enable);
+}
+
+static struct wl1271_if_operations spi_ops = {
+        .read           = wl1271_spi_raw_read,
+        .write          = wl1271_spi_raw_write,
+        .reset          = wl1271_spi_reset,
+        .init           = wl1271_spi_init,
+        .power          = wl1271_spi_set_power,
+        .dev            = wl1271_spi_wl_to_dev,
+        .enable_irq     = wl1271_spi_enable_interrupts,
+        .disable_irq    = wl1271_spi_disable_interrupts
+};
+
+static int __devinit wl1271_probe(struct spi_device *spi)
+{
+        struct wl12xx_platform_data *pdata;
+        struct ieee80211_hw *hw;
+        struct wl1271 *wl;
+        int ret;
+
+        pdata = spi->dev.platform_data;
+        if (!pdata) {
+                wl1271_error("no platform data");
+                return -ENODEV;
+        }
+
+        hw = wl1271_alloc_hw();
+        if (IS_ERR(hw))
+                return PTR_ERR(hw);
+
+        wl = hw->priv;
+
+        dev_set_drvdata(&spi->dev, wl);
+        wl->if_priv = spi;
+
+        wl->if_ops = &spi_ops;
+
+        /* This is the only SPI value that we need to set here, the rest
+         * comes from the board-peripherals file */
+        spi->bits_per_word = 32;
+
+        ret = spi_setup(spi);
+        if (ret < 0) {
+                wl1271_error("spi_setup failed");
+                goto out_free;
+        }
+
+        wl->set_power = pdata->set_power;
+        if (!wl->set_power) {
+                wl1271_error("set power function missing in platform data");
+                ret = -ENODEV;
+                goto out_free;
+        }
+
+        wl->irq = spi->irq;
+        if (wl->irq < 0) {
+                wl1271_error("irq missing in platform data");
+                ret = -ENODEV;
+                goto out_free;
+        }
+
+        ret = request_irq(wl->irq, wl1271_irq, 0, DRIVER_NAME, wl);
+        if (ret < 0) {
+                wl1271_error("request_irq() failed: %d", ret);
+                goto out_free;
+        }
+
+        set_irq_type(wl->irq, IRQ_TYPE_EDGE_RISING);
+
+        disable_irq(wl->irq);
+
+        ret = wl1271_init_ieee80211(wl);
+        if (ret)
+                goto out_irq;
+
+        ret = wl1271_register_hw(wl);
+        if (ret)
+                goto out_irq;
+
+        wl1271_notice("initialized");
+
+        return 0;
+
+ out_irq:
+        free_irq(wl->irq, wl);
+
+ out_free:
+        wl1271_free_hw(wl);
+
+        return ret;
+}
+
+static int __devexit wl1271_remove(struct spi_device *spi)
+{
+        struct wl1271 *wl = dev_get_drvdata(&spi->dev);
+
+        free_irq(wl->irq, wl);
+
+        wl1271_unregister_hw(wl);
+        wl1271_free_hw(wl);
+
+        return 0;
+}
+
+
+static struct spi_driver wl1271_spi_driver = {
+        .driver = {
+                .name           = "wl1271_spi",
+                .bus            = &spi_bus_type,
+                .owner          = THIS_MODULE,
+        },
+
+        .probe          = wl1271_probe,
+        .remove         = __devexit_p(wl1271_remove),
+};
+
+static int __init wl1271_init(void)
+{
+        int ret;
+
+        ret = spi_register_driver(&wl1271_spi_driver);
+        if (ret < 0) {
+                wl1271_error("failed to register spi driver: %d", ret);
+                goto out;
+        }
+
+out:
+        return ret;
+}
+
+static void __exit wl1271_exit(void)
+{
+        spi_unregister_driver(&wl1271_spi_driver);
+
+        wl1271_notice("unloaded");
+}
+
+module_init(wl1271_init);
+module_exit(wl1271_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Luciano Coelho <luciano.coelho@nokia.com>");
+MODULE_AUTHOR("Juuso Oikarinen <juuso.oikarinen@nokia.com>");
+MODULE_FIRMWARE(WL1271_FW_NAME);
diff --git a/drivers/net/wireless/wl12xx/wl1271_spi.h b/drivers/net/wireless/wl12xx/wl1271_spi.h
deleted file mode 100644
index a803596dad4a..000000000000
--- a/drivers/net/wireless/wl12xx/wl1271_spi.h
+++ /dev/null
@@ -1,96 +0,0 @@
-/*
- * This file is part of wl1271
- *
- * Copyright (C) 1998-2009 Texas Instruments. All rights reserved.
- * Copyright (C) 2008-2009 Nokia Corporation
- *
- * Contact: Luciano Coelho <luciano.coelho@nokia.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * version 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
- * 02110-1301 USA
- *
- */
-
-#ifndef __WL1271_SPI_H__
-#define __WL1271_SPI_H__
-
-#include "wl1271_reg.h"
-
-#define HW_ACCESS_MEMORY_MAX_RANGE              0x1FFC0
-
-#define HW_PARTITION_REGISTERS_ADDR         0x1ffc0
-#define HW_PART0_SIZE_ADDR                  (HW_PARTITION_REGISTERS_ADDR)
-#define HW_PART0_START_ADDR                 (HW_PARTITION_REGISTERS_ADDR + 4)
-#define HW_PART1_SIZE_ADDR                  (HW_PARTITION_REGISTERS_ADDR + 8)
-#define HW_PART1_START_ADDR                 (HW_PARTITION_REGISTERS_ADDR + 12)
-#define HW_PART2_SIZE_ADDR                  (HW_PARTITION_REGISTERS_ADDR + 16)
-#define HW_PART2_START_ADDR                 (HW_PARTITION_REGISTERS_ADDR + 20)
-#define HW_PART3_START_ADDR                 (HW_PARTITION_REGISTERS_ADDR + 24)
-
-#define HW_ACCESS_REGISTER_SIZE             4
-
-#define HW_ACCESS_PRAM_MAX_RANGE                0x3c000
-
-#define WSPI_CMD_READ                 0x40000000
-#define WSPI_CMD_WRITE                0x00000000
-#define WSPI_CMD_FIXED                0x20000000
-#define WSPI_CMD_BYTE_LENGTH          0x1FFE0000
-#define WSPI_CMD_BYTE_LENGTH_OFFSET   17
-#define WSPI_CMD_BYTE_ADDR            0x0001FFFF
-
-#define WSPI_INIT_CMD_CRC_LEN       5
-
-#define WSPI_INIT_CMD_START         0x00
-#define WSPI_INIT_CMD_TX            0x40
-/* the extra bypass bit is sampled by the TNET as '1' */
-#define WSPI_INIT_CMD_BYPASS_BIT    0x80
-#define WSPI_INIT_CMD_FIXEDBUSY_LEN 0x07
-#define WSPI_INIT_CMD_EN_FIXEDBUSY  0x80
-#define WSPI_INIT_CMD_DIS_FIXEDBUSY 0x00
-#define WSPI_INIT_CMD_IOD           0x40
-#define WSPI_INIT_CMD_IP            0x20
-#define WSPI_INIT_CMD_CS            0x10
-#define WSPI_INIT_CMD_WS            0x08
-#define WSPI_INIT_CMD_WSPI          0x01
-#define WSPI_INIT_CMD_END           0x01
-
-#define WSPI_INIT_CMD_LEN           8
-
-#define HW_ACCESS_WSPI_FIXED_BUSY_LEN \
-                ((WL1271_BUSY_WORD_LEN - 4) / sizeof(u32))
-#define HW_ACCESS_WSPI_INIT_CMD_MASK  0
-
-#define OCP_CMD_LOOP  32
-
-#define OCP_CMD_WRITE 0x1
-#define OCP_CMD_READ  0x2
-
-#define OCP_READY_MASK  BIT(18)
-#define OCP_STATUS_MASK (BIT(16) | BIT(17))
-
-#define OCP_STATUS_NO_RESP    0x00000
-#define OCP_STATUS_OK         0x10000
-#define OCP_STATUS_REQ_FAILED 0x20000
-#define OCP_STATUS_RESP_ERROR 0x30000
-
-/* Raw target IO, address is not translated */
-void wl1271_spi_raw_write(struct wl1271 *wl, int addr, void *buf,
-                      size_t len, bool fixed);
-void wl1271_spi_raw_read(struct wl1271 *wl, int addr, void *buf,
-                     size_t len, bool fixed);
-
-/* INIT and RESET words */
-void wl1271_spi_reset(struct wl1271 *wl);
-void wl1271_spi_init(struct wl1271 *wl);
-#endif /* __WL1271_SPI_H__ */
diff --git a/drivers/net/wireless/wl12xx/wl1271_testmode.c b/drivers/net/wireless/wl12xx/wl1271_testmode.c
index 3919102e942e..2401e6035d51 100644
--- a/drivers/net/wireless/wl12xx/wl1271_testmode.c
+++ b/drivers/net/wireless/wl12xx/wl1271_testmode.c
@@ -25,7 +25,6 @@
 #include <net/genetlink.h>
 
 #include "wl1271.h"
-#include "wl1271_spi.h"
 #include "wl1271_acx.h"
 
 #define WL1271_TM_MAX_DATA_LENGTH 1024
diff --git a/drivers/net/wireless/wl12xx/wl1271_tx.c b/drivers/net/wireless/wl12xx/wl1271_tx.c
index 811e739d05bf..62db79508ddf 100644
--- a/drivers/net/wireless/wl12xx/wl1271_tx.c
+++ b/drivers/net/wireless/wl12xx/wl1271_tx.c
@@ -25,7 +25,6 @@
 #include <linux/module.h>
 
 #include "wl1271.h"
-#include "wl1271_spi.h"
 #include "wl1271_io.h"
 #include "wl1271_reg.h"
 #include "wl1271_ps.h"
@@ -47,7 +46,7 @@ static int wl1271_tx_allocate(struct wl1271 *wl, struct sk_buff *skb, u32 extra)
 {
         struct wl1271_tx_hw_descr *desc;
         u32 total_len = skb->len + sizeof(struct wl1271_tx_hw_descr) + extra;
-        u32 total_blocks, excluded;
+        u32 total_blocks;
         int id, ret = -EBUSY;
 
         /* allocate free identifier for the packet */
@@ -57,12 +56,8 @@ static int wl1271_tx_allocate(struct wl1271 *wl, struct sk_buff *skb, u32 extra)
 
         /* approximate the number of blocks required for this packet
            in the firmware */
-        /* FIXME: try to figure out what is done here and make it cleaner */
-        total_blocks = (total_len + 20) >> TX_HW_BLOCK_SHIFT_DIV;
-        excluded = (total_blocks << 2) + ((total_len + 20) & 0xff) + 34;
-        total_blocks += (excluded > 252) ? 2 : 1;
-        total_blocks += TX_HW_BLOCK_SPARE;
-
+        total_blocks = total_len + TX_HW_BLOCK_SIZE - 1;
+        total_blocks = total_blocks / TX_HW_BLOCK_SIZE + TX_HW_BLOCK_SPARE;
         if (total_blocks <= wl->tx_blocks_available) {
                 desc = (struct wl1271_tx_hw_descr *)skb_push(
                         skb, total_len - skb->len);
@@ -87,8 +82,10 @@ static int wl1271_tx_allocate(struct wl1271 *wl, struct sk_buff *skb, u32 extra)
 static int wl1271_tx_fill_hdr(struct wl1271 *wl, struct sk_buff *skb,
                               u32 extra, struct ieee80211_tx_info *control)
 {
+        struct timespec ts;
         struct wl1271_tx_hw_descr *desc;
         int pad, ac;
+        s64 hosttime;
         u16 tx_attr;
 
         desc = (struct wl1271_tx_hw_descr *) skb->data;
@@ -102,8 +99,9 @@ static int wl1271_tx_fill_hdr(struct wl1271 *wl, struct sk_buff *skb,
         }
 
         /* configure packet life time */
-        desc->start_time = cpu_to_le32(jiffies_to_usecs(jiffies) -
-                                       wl->time_offset);
+        getnstimeofday(&ts);
+        hosttime = (timespec_to_ns(&ts) >> 10);
+        desc->start_time = cpu_to_le32(hosttime - wl->time_offset);
         desc->life_time = cpu_to_le16(TX_HW_MGMT_PKT_LIFETIME_TU);
 
         /* configure the tx attributes */
@@ -170,7 +168,6 @@ static int wl1271_tx_send_packet(struct wl1271 *wl, struct sk_buff *skb,
 
         /* write packet new counter into the write access register */
         wl->tx_packets_count++;
-        wl1271_write32(wl, WL1271_HOST_WR_ACCESS, wl->tx_packets_count);
 
         desc = (struct wl1271_tx_hw_descr *) skb->data;
         wl1271_debug(DEBUG_TX, "tx id %u skb 0x%p payload %u (%u words)",
@@ -223,7 +220,7 @@ static int wl1271_tx_frame(struct wl1271 *wl, struct sk_buff *skb)
         return ret;
 }
 
-static u32 wl1271_tx_enabled_rates_get(struct wl1271 *wl, u32 rate_set)
+u32 wl1271_tx_enabled_rates_get(struct wl1271 *wl, u32 rate_set)
 {
         struct ieee80211_supported_band *band;
         u32 enabled_rates = 0;
@@ -245,6 +242,7 @@ void wl1271_tx_work(struct work_struct *work)
         struct sk_buff *skb;
         bool woken_up = false;
         u32 sta_rates = 0;
+        u32 prev_tx_packets_count;
         int ret;
 
         /* check if the rates supported by the AP have changed */
@@ -261,6 +259,8 @@ void wl1271_tx_work(struct work_struct *work)
         if (unlikely(wl->state == WL1271_STATE_OFF))
                 goto out;
 
+        prev_tx_packets_count = wl->tx_packets_count;
+
         /* if rates have changed, re-configure the rate policy */
         if (unlikely(sta_rates)) {
                 wl->rate_set = wl1271_tx_enabled_rates_get(wl, sta_rates);
@@ -271,31 +271,26 @@ void wl1271_tx_work(struct work_struct *work)
                 if (!woken_up) {
                         ret = wl1271_ps_elp_wakeup(wl, false);
                         if (ret < 0)
-                                goto out;
+                                goto out_ack;
                         woken_up = true;
                 }
 
                 ret = wl1271_tx_frame(wl, skb);
                 if (ret == -EBUSY) {
-                        /* firmware buffer is full, stop queues */
-                        wl1271_debug(DEBUG_TX, "tx_work: fw buffer full, "
-                                     "stop queues");
-                        ieee80211_stop_queues(wl->hw);
-                        set_bit(WL1271_FLAG_TX_QUEUE_STOPPED, &wl->flags);
+                        /* firmware buffer is full, lets stop transmitting. */
                         skb_queue_head(&wl->tx_queue, skb);
-                        goto out;
+                        goto out_ack;
                 } else if (ret < 0) {
                         dev_kfree_skb(skb);
-                        goto out;
-                } else if (test_and_clear_bit(WL1271_FLAG_TX_QUEUE_STOPPED,
-                                              &wl->flags)) {
-                        /* firmware buffer has space, restart queues */
-                        wl1271_debug(DEBUG_TX,
-                                     "complete_packet: waking queues");
-                        ieee80211_wake_queues(wl->hw);
+                        goto out_ack;
                 }
         }
 
+out_ack:
+        /* interrupt the firmware with the new packets */
+        if (prev_tx_packets_count != wl->tx_packets_count)
+                wl1271_write32(wl, WL1271_HOST_WR_ACCESS, wl->tx_packets_count);
+
 out:
         if (woken_up)
                 wl1271_ps_elp_sleep(wl);
@@ -308,11 +303,12 @@ static void wl1271_tx_complete_packet(struct wl1271 *wl,
 {
         struct ieee80211_tx_info *info;
         struct sk_buff *skb;
-        u16 seq;
         int id = result->id;
+        int rate = -1;
+        u8 retries = 0;
 
         /* check for id legality */
-        if (id >= ACX_TX_DESCRIPTORS || wl->tx_frames[id] == NULL) {
+        if (unlikely(id >= ACX_TX_DESCRIPTORS || wl->tx_frames[id] == NULL)) {
                 wl1271_warning("TX result illegal id: %d", id);
                 return;
         }
@@ -320,31 +316,29 @@ static void wl1271_tx_complete_packet(struct wl1271 *wl,
         skb = wl->tx_frames[id];
         info = IEEE80211_SKB_CB(skb);
 
-        /* update packet status */
-        if (!(info->flags & IEEE80211_TX_CTL_NO_ACK)) {
-                if (result->status == TX_SUCCESS)
+        /* update the TX status info */
+        if (result->status == TX_SUCCESS) {
+                if (!(info->flags & IEEE80211_TX_CTL_NO_ACK))
                         info->flags |= IEEE80211_TX_STAT_ACK;
-                if (result->status & TX_RETRY_EXCEEDED) {
-                        /* FIXME */
-                        /* info->status.excessive_retries = 1; */
-                        wl->stats.excessive_retries++;
-                }
+                rate = wl1271_rate_to_idx(wl, result->rate_class_index);
+                retries = result->ack_failures;
+        } else if (result->status == TX_RETRY_EXCEEDED) {
+                wl->stats.excessive_retries++;
+                retries = result->ack_failures;
         }
 
-        /* FIXME */
-        /* info->status.retry_count = result->ack_failures; */
+        info->status.rates[0].idx = rate;
+        info->status.rates[0].count = retries;
+        info->status.rates[0].flags = 0;
+        info->status.ack_signal = -1;
+
         wl->stats.retry_count += result->ack_failures;
 
         /* update security sequence number */
-        seq = wl->tx_security_seq_16 +
-                (result->lsb_security_sequence_number -
-                 wl->tx_security_last_seq);
+        wl->tx_security_seq += (result->lsb_security_sequence_number -
+                                wl->tx_security_last_seq);
         wl->tx_security_last_seq = result->lsb_security_sequence_number;
 
-        if (seq < wl->tx_security_seq_16)
-                wl->tx_security_seq_32++;
-        wl->tx_security_seq_16 = seq;
-
         /* remove private header from packet */
         skb_pull(skb, sizeof(struct wl1271_tx_hw_descr));
 
@@ -367,23 +361,29 @@ static void wl1271_tx_complete_packet(struct wl1271 *wl,
 }
 
 /* Called upon reception of a TX complete interrupt */
-void wl1271_tx_complete(struct wl1271 *wl, u32 count)
+void wl1271_tx_complete(struct wl1271 *wl)
 {
         struct wl1271_acx_mem_map *memmap =
                 (struct wl1271_acx_mem_map *)wl->target_mem_map;
+        u32 count, fw_counter;
         u32 i;
 
-        wl1271_debug(DEBUG_TX, "tx_complete received, packets: %d", count);
-
         /* read the tx results from the chipset */
         wl1271_read(wl, le32_to_cpu(memmap->tx_result),
                     wl->tx_res_if, sizeof(*wl->tx_res_if), false);
+        fw_counter = le32_to_cpu(wl->tx_res_if->tx_result_fw_counter);
+
+        /* write host counter to chipset (to ack) */
+        wl1271_write32(wl, le32_to_cpu(memmap->tx_result) +
+                       offsetof(struct wl1271_tx_hw_res_if,
+                                tx_result_host_counter), fw_counter);
+
+        count = fw_counter - wl->tx_results_count;
+        wl1271_debug(DEBUG_TX, "tx_complete received, packets: %d", count);
 
         /* verify that the result buffer is not getting overrun */
-        if (count > TX_HW_RESULT_QUEUE_LEN) {
+        if (unlikely(count > TX_HW_RESULT_QUEUE_LEN))
                 wl1271_warning("TX result overflow from chipset: %d", count);
-                count = TX_HW_RESULT_QUEUE_LEN;
-        }
 
         /* process the results */
         for (i = 0; i < count; i++) {
@@ -397,11 +397,18 @@ void wl1271_tx_complete(struct wl1271 *wl, u32 count)
                 wl->tx_results_count++;
         }
 
-        /* write host counter to chipset (to ack) */
-        wl1271_write32(wl, le32_to_cpu(memmap->tx_result) +
-                       offsetof(struct wl1271_tx_hw_res_if,
-                       tx_result_host_counter),
-                       le32_to_cpu(wl->tx_res_if->tx_result_fw_counter));
+        if (test_bit(WL1271_FLAG_TX_QUEUE_STOPPED, &wl->flags) &&
+            skb_queue_len(&wl->tx_queue) <= WL1271_TX_QUEUE_LOW_WATERMARK) {
+                unsigned long flags;
+
+                /* firmware buffer has space, restart queues */
+                wl1271_debug(DEBUG_TX, "tx_complete: waking queues");
+                spin_lock_irqsave(&wl->wl_lock, flags);
+                ieee80211_wake_queues(wl->hw);
+                clear_bit(WL1271_FLAG_TX_QUEUE_STOPPED, &wl->flags);
+                spin_unlock_irqrestore(&wl->wl_lock, flags);
+                ieee80211_queue_work(wl->hw, &wl->tx_work);
+        }
 }
 
 /* caller must hold wl->mutex */
@@ -409,31 +416,19 @@ void wl1271_tx_flush(struct wl1271 *wl)
 {
         int i;
         struct sk_buff *skb;
-        struct ieee80211_tx_info *info;
 
         /* TX failure */
 /*      control->flags = 0; FIXME */
 
         while ((skb = skb_dequeue(&wl->tx_queue))) {
-                info = IEEE80211_SKB_CB(skb);
-
                 wl1271_debug(DEBUG_TX, "flushing skb 0x%p", skb);
-
-                if (!(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS))
-                                continue;
-
                 ieee80211_tx_status(wl->hw, skb);
         }
 
         for (i = 0; i < ACX_TX_DESCRIPTORS; i++)
                 if (wl->tx_frames[i] != NULL) {
                         skb = wl->tx_frames[i];
-                        info = IEEE80211_SKB_CB(skb);
-
-                        if (!(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS))
-                                continue;
-
-                        ieee80211_tx_status(wl->hw, skb);
                         wl->tx_frames[i] = NULL;
+                        ieee80211_tx_status(wl->hw, skb);
                 }
 }
diff --git a/drivers/net/wireless/wl12xx/wl1271_tx.h b/drivers/net/wireless/wl12xx/wl1271_tx.h
index 17e405a09caa..3b8b7ac253fd 100644
--- a/drivers/net/wireless/wl12xx/wl1271_tx.h
+++ b/drivers/net/wireless/wl12xx/wl1271_tx.h
@@ -26,7 +26,7 @@
 #define __WL1271_TX_H__
 
 #define TX_HW_BLOCK_SPARE                2
-#define TX_HW_BLOCK_SHIFT_DIV            8
+#define TX_HW_BLOCK_SIZE                 252
 
 #define TX_HW_MGMT_PKT_LIFETIME_TU       2000
 /* The chipset reference driver states, that the "aid" value 1
@@ -125,9 +125,6 @@ struct wl1271_tx_hw_res_if {
 
 static inline int wl1271_tx_get_queue(int queue)
 {
-        /* FIXME: use best effort until WMM is enabled */
-        return CONF_TX_AC_BE;
-
         switch (queue) {
         case 0:
                 return CONF_TX_AC_VO;
@@ -160,7 +157,9 @@ static inline int wl1271_tx_ac_to_tid(int ac)
 }
 
 void wl1271_tx_work(struct work_struct *work);
-void wl1271_tx_complete(struct wl1271 *wl, u32 count);
+void wl1271_tx_complete(struct wl1271 *wl);
 void wl1271_tx_flush(struct wl1271 *wl);
+u8 wl1271_rate_to_idx(struct wl1271 *wl, int rate);
+u32 wl1271_tx_enabled_rates_get(struct wl1271 *wl, u32 rate_set);
 
 #endif
diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c
index 7b9621de239f..65dd502eab0d 100644
--- a/drivers/net/wireless/wl3501_cs.c
+++ b/drivers/net/wireless/wl3501_cs.c
@@ -1834,32 +1834,32 @@ out:
 }
 
 static const iw_handler wl3501_handler[] = {
-        [SIOCGIWNAME    - SIOCIWFIRST] = wl3501_get_name,
-        [SIOCSIWFREQ    - SIOCIWFIRST] = wl3501_set_freq,
-        [SIOCGIWFREQ    - SIOCIWFIRST] = wl3501_get_freq,
-        [SIOCSIWMODE    - SIOCIWFIRST] = wl3501_set_mode,
-        [SIOCGIWMODE    - SIOCIWFIRST] = wl3501_get_mode,
-        [SIOCGIWSENS    - SIOCIWFIRST] = wl3501_get_sens,
-        [SIOCGIWRANGE   - SIOCIWFIRST] = wl3501_get_range,
-        [SIOCSIWSPY     - SIOCIWFIRST] = iw_handler_set_spy,
-        [SIOCGIWSPY     - SIOCIWFIRST] = iw_handler_get_spy,
-        [SIOCSIWTHRSPY  - SIOCIWFIRST] = iw_handler_set_thrspy,
-        [SIOCGIWTHRSPY  - SIOCIWFIRST] = iw_handler_get_thrspy,
-        [SIOCSIWAP      - SIOCIWFIRST] = wl3501_set_wap,
-        [SIOCGIWAP      - SIOCIWFIRST] = wl3501_get_wap,
-        [SIOCSIWSCAN    - SIOCIWFIRST] = wl3501_set_scan,
-        [SIOCGIWSCAN    - SIOCIWFIRST] = wl3501_get_scan,
-        [SIOCSIWESSID   - SIOCIWFIRST] = wl3501_set_essid,
-        [SIOCGIWESSID   - SIOCIWFIRST] = wl3501_get_essid,
-        [SIOCSIWNICKN   - SIOCIWFIRST] = wl3501_set_nick,
-        [SIOCGIWNICKN   - SIOCIWFIRST] = wl3501_get_nick,
-        [SIOCGIWRATE    - SIOCIWFIRST] = wl3501_get_rate,
-        [SIOCGIWRTS     - SIOCIWFIRST] = wl3501_get_rts_threshold,
-        [SIOCGIWFRAG    - SIOCIWFIRST] = wl3501_get_frag_threshold,
-        [SIOCGIWTXPOW   - SIOCIWFIRST] = wl3501_get_txpow,
-        [SIOCGIWRETRY   - SIOCIWFIRST] = wl3501_get_retry,
-        [SIOCGIWENCODE  - SIOCIWFIRST] = wl3501_get_encode,
-        [SIOCGIWPOWER   - SIOCIWFIRST] = wl3501_get_power,
+        IW_HANDLER(SIOCGIWNAME, wl3501_get_name),
+        IW_HANDLER(SIOCSIWFREQ, wl3501_set_freq),
+        IW_HANDLER(SIOCGIWFREQ, wl3501_get_freq),
+        IW_HANDLER(SIOCSIWMODE, wl3501_set_mode),
+        IW_HANDLER(SIOCGIWMODE, wl3501_get_mode),
+        IW_HANDLER(SIOCGIWSENS, wl3501_get_sens),
+        IW_HANDLER(SIOCGIWRANGE, wl3501_get_range),
+        IW_HANDLER(SIOCSIWSPY, iw_handler_set_spy),
+        IW_HANDLER(SIOCGIWSPY, iw_handler_get_spy),
+        IW_HANDLER(SIOCSIWTHRSPY, iw_handler_set_thrspy),
+        IW_HANDLER(SIOCGIWTHRSPY, iw_handler_get_thrspy),
+        IW_HANDLER(SIOCSIWAP, wl3501_set_wap),
+        IW_HANDLER(SIOCGIWAP, wl3501_get_wap),
+        IW_HANDLER(SIOCSIWSCAN, wl3501_set_scan),
+        IW_HANDLER(SIOCGIWSCAN, wl3501_get_scan),
+        IW_HANDLER(SIOCSIWESSID, wl3501_set_essid),
+        IW_HANDLER(SIOCGIWESSID, wl3501_get_essid),
+        IW_HANDLER(SIOCSIWNICKN, wl3501_set_nick),
+        IW_HANDLER(SIOCGIWNICKN, wl3501_get_nick),
+        IW_HANDLER(SIOCGIWRATE, wl3501_get_rate),
+        IW_HANDLER(SIOCGIWRTS, wl3501_get_rts_threshold),
+        IW_HANDLER(SIOCGIWFRAG, wl3501_get_frag_threshold),
+        IW_HANDLER(SIOCGIWTXPOW, wl3501_get_txpow),
+        IW_HANDLER(SIOCGIWRETRY, wl3501_get_retry),
+        IW_HANDLER(SIOCGIWENCODE, wl3501_get_encode),
+        IW_HANDLER(SIOCGIWPOWER, wl3501_get_power),
 };
 
 static const struct iw_handler_def wl3501_handler_def = {
diff --git a/drivers/ssb/driver_chipcommon.c b/drivers/ssb/driver_chipcommon.c
index 9681536163ca..59c3c0fdbecd 100644
--- a/drivers/ssb/driver_chipcommon.c
+++ b/drivers/ssb/driver_chipcommon.c
@@ -370,6 +370,7 @@ u32 ssb_chipco_gpio_control(struct ssb_chipcommon *cc, u32 mask, u32 value)
 {
         return chipco_write32_masked(cc, SSB_CHIPCO_GPIOCTL, mask, value);
 }
+EXPORT_SYMBOL(ssb_chipco_gpio_control);
 
 u32 ssb_chipco_gpio_intmask(struct ssb_chipcommon *cc, u32 mask, u32 value)
 {
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 19984958ab7b..e9e03b02cb08 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -1324,7 +1324,6 @@ enum ieee80211_back_actioncode {
 enum ieee80211_back_parties {
         WLAN_BACK_RECIPIENT = 0,
         WLAN_BACK_INITIATOR = 1,
-        WLAN_BACK_TIMER = 2,
 };
 
 /* SA Query action */
diff --git a/include/linux/mmc/sdio.h b/include/linux/mmc/sdio.h
index 47ba464f5170..118f0295a575 100644
--- a/include/linux/mmc/sdio.h
+++ b/include/linux/mmc/sdio.h
@@ -94,6 +94,8 @@
 
 #define  SDIO_BUS_WIDTH_1BIT    0x00
 #define  SDIO_BUS_WIDTH_4BIT    0x02
+#define  SDIO_BUS_ECSI          0x20    /* Enable continuous SPI interrupt */
+#define  SDIO_BUS_SCSI          0x40    /* Support continuous SPI interrupt */
 
 #define  SDIO_BUS_CD_DISABLE     0x80   /* disable pull-up on DAT3 (pin 1) */
 
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index 28ba20fda3e2..2ea3edeee7aa 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -323,6 +323,12 @@
  *      the TX command and %NL80211_ATTR_FRAME includes the contents of the
  *      frame. %NL80211_ATTR_ACK flag is included if the recipient acknowledged
  *      the frame.
+ * @NL80211_CMD_SET_CQM: Connection quality monitor configuration. This command
+ *      is used to configure connection quality monitoring notification trigger
+ *      levels.
+ * @NL80211_CMD_NOTIFY_CQM: Connection quality monitor notification. This
+ *      command is used as an event to indicate the that a trigger level was
+ *      reached.
  *
  * @NL80211_CMD_MAX: highest used command number
  * @__NL80211_CMD_AFTER_LAST: internal use
@@ -419,6 +425,9 @@ enum nl80211_commands {
         NL80211_CMD_SET_POWER_SAVE,
         NL80211_CMD_GET_POWER_SAVE,
 
+        NL80211_CMD_SET_CQM,
+        NL80211_CMD_NOTIFY_CQM,
+
         /* add new commands above here */
 
         /* used to define NL80211_CMD_MAX below */
@@ -691,6 +700,15 @@ enum nl80211_commands {
  * @NL80211_ATTR_ACK: Flag attribute indicating that the frame was
  *      acknowledged by the recipient.
  *
+ * @NL80211_ATTR_CQM: connection quality monitor configuration in a
+ *      nested attribute with %NL80211_ATTR_CQM_* sub-attributes.
+ *
+ * @NL80211_ATTR_LOCAL_STATE_CHANGE: Flag attribute to indicate that a command
+ *      is requesting a local authentication/association state change without
+ *      invoking actual management frame exchange. This can be used with
+ *      NL80211_CMD_AUTHENTICATE, NL80211_CMD_DEAUTHENTICATE,
+ *      NL80211_CMD_DISASSOCIATE.
+ *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -842,6 +860,10 @@ enum nl80211_attrs {
 
         NL80211_ATTR_PS_STATE,
 
+        NL80211_ATTR_CQM,
+
+        NL80211_ATTR_LOCAL_STATE_CHANGE,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -1583,4 +1605,40 @@ enum nl80211_ps_state {
         NL80211_PS_ENABLED,
 };
 
+/**
+ * enum nl80211_attr_cqm - connection quality monitor attributes
+ * @__NL80211_ATTR_CQM_INVALID: invalid
+ * @NL80211_ATTR_CQM_RSSI_THOLD: RSSI threshold in dBm. This value specifies
+ *      the threshold for the RSSI level at which an event will be sent. Zero
+ *      to disable.
+ * @NL80211_ATTR_CQM_RSSI_HYST: RSSI hysteresis in dBm. This value specifies
+ *      the minimum amount the RSSI level must change after an event before a
+ *      new event may be issued (to reduce effects of RSSI oscillation).
+ * @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT: RSSI threshold event
+ * @__NL80211_ATTR_CQM_AFTER_LAST: internal
+ * @NL80211_ATTR_CQM_MAX: highest key attribute
+ */
+enum nl80211_attr_cqm {
+        __NL80211_ATTR_CQM_INVALID,
+        NL80211_ATTR_CQM_RSSI_THOLD,
+        NL80211_ATTR_CQM_RSSI_HYST,
+        NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
+
+        /* keep last */
+        __NL80211_ATTR_CQM_AFTER_LAST,
+        NL80211_ATTR_CQM_MAX = __NL80211_ATTR_CQM_AFTER_LAST - 1
+};
+
+/**
+ * enum nl80211_cqm_rssi_threshold_event - RSSI threshold event
+ * @NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW - The RSSI level is lower than the
+ *      configured threshold
+ * @NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH - The RSSI is higher than the
+ *      configured threshold
+ */
+enum nl80211_cqm_rssi_threshold_event {
+        NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
+        NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
+};
+
 #endif /* __LINUX_NL80211_H */
diff --git a/include/linux/wireless.h b/include/linux/wireless.h
index 5b4c6c772a9b..e6827eedf18b 100644
--- a/include/linux/wireless.h
+++ b/include/linux/wireless.h
@@ -346,6 +346,8 @@
 #define SIOCIWFIRST     0x8B00
 #define SIOCIWLAST      SIOCIWLASTPRIV          /* 0x8BFF */
 #define IW_IOCTL_IDX(cmd)       ((cmd) - SIOCIWFIRST)
+#define IW_HANDLER(id, func)                    \
+        [IW_IOCTL_IDX(id)] = func
 
 /* Odd : get (world access), even : set (root access) */
 #define IW_IS_SET(cmd)  (!((cmd) & 0x1))
@@ -648,7 +650,7 @@
  * 32 bit bitmasks. Note : 32 bits = 0x20 = 2^5. */
 #define IW_EVENT_CAPA_BASE(cmd)         ((cmd >= SIOCIWFIRSTPRIV) ? \
                                          (cmd - SIOCIWFIRSTPRIV + 0x60) : \
-                                         (cmd - SIOCSIWCOMMIT))
+                                         (cmd - SIOCIWFIRST))
 #define IW_EVENT_CAPA_INDEX(cmd)        (IW_EVENT_CAPA_BASE(cmd) >> 5)
 #define IW_EVENT_CAPA_MASK(cmd)         (1 << (IW_EVENT_CAPA_BASE(cmd) & 0x1F))
 /* Event capability constants - event autogenerated by the kernel
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 3d134a1fb96b..37cebd3aa0f7 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -704,6 +704,10 @@ struct cfg80211_crypto_settings {
  * @key_len: length of WEP key for shared key authentication
  * @key_idx: index of WEP key for shared key authentication
  * @key: WEP key for shared key authentication
+ * @local_state_change: This is a request for a local state only, i.e., no
+ *      Authentication frame is to be transmitted and authentication state is
+ *      to be changed without having to wait for a response from the peer STA
+ *      (AP).
  */
 struct cfg80211_auth_request {
         struct cfg80211_bss *bss;
@@ -712,6 +716,7 @@ struct cfg80211_auth_request {
         enum nl80211_auth_type auth_type;
         const u8 *key;
         u8 key_len, key_idx;
+        bool local_state_change;
 };
 
 /**
@@ -744,12 +749,15 @@ struct cfg80211_assoc_request {
  * @ie: Extra IEs to add to Deauthentication frame or %NULL
  * @ie_len: Length of ie buffer in octets
  * @reason_code: The reason code for the deauthentication
+ * @local_state_change: This is a request for a local state only, i.e., no
+ *      Deauthentication frame is to be transmitted.
  */
 struct cfg80211_deauth_request {
         struct cfg80211_bss *bss;
         const u8 *ie;
         size_t ie_len;
         u16 reason_code;
+        bool local_state_change;
 };
 
 /**
@@ -762,12 +770,15 @@ struct cfg80211_deauth_request {
  * @ie: Extra IEs to add to Disassociation frame or %NULL
  * @ie_len: Length of ie buffer in octets
  * @reason_code: The reason code for the disassociation
+ * @local_state_change: This is a request for a local state only, i.e., no
+ *      Disassociation frame is to be transmitted.
  */
 struct cfg80211_disassoc_request {
         struct cfg80211_bss *bss;
         const u8 *ie;
         size_t ie_len;
         u16 reason_code;
+        bool local_state_change;
 };
 
 /**
@@ -1007,6 +1018,7 @@ struct cfg80211_pmksa {
  *      RSN IE. It allows for faster roaming between WPA2 BSSIDs.
  * @del_pmksa: Delete a cached PMKID.
  * @flush_pmksa: Flush all cached PMKIDs.
+ * @set_cqm_rssi_config: Configure connection quality monitor RSSI threshold.
  *
  */
 struct cfg80211_ops {
@@ -1152,6 +1164,10 @@ struct cfg80211_ops {
 
         int     (*set_power_mgmt)(struct wiphy *wiphy, struct net_device *dev,
                                   bool enabled, int timeout);
+
+        int     (*set_cqm_rssi_config)(struct wiphy *wiphy,
+                                       struct net_device *dev,
+                                       s32 rssi_thold, u32 rssi_hyst);
 };
 
 /*
@@ -2337,4 +2353,18 @@ bool cfg80211_rx_action(struct net_device *dev, int freq, const u8 *buf,
 void cfg80211_action_tx_status(struct net_device *dev, u64 cookie,
                                const u8 *buf, size_t len, bool ack, gfp_t gfp);
 
+
+/**
+ * cfg80211_cqm_rssi_notify - connection quality monitoring rssi event
+ * @dev: network device
+ * @rssi_event: the triggered RSSI event
+ * @gfp: context flags
+ *
+ * This function is called when a configured connection quality monitoring
+ * rssi threshold reached event occurs.
+ */
+void cfg80211_cqm_rssi_notify(struct net_device *dev,
+                              enum nl80211_cqm_rssi_threshold_event rssi_event,
+                              gfp_t gfp);
+
 #endif /* __NET_CFG80211_H */
diff --git a/include/net/iw_handler.h b/include/net/iw_handler.h
index b2b98f3fa265..3afdb21cc31d 100644
--- a/include/net/iw_handler.h
+++ b/include/net/iw_handler.h
@@ -323,7 +323,7 @@ typedef int (*iw_handler)(struct net_device *dev, struct iw_request_info *info,
 struct iw_handler_def {
 
         /* Array of handlers for standard ioctls
-         * We will call dev->wireless_handlers->standard[ioctl - SIOCSIWCOMMIT]
+         * We will call dev->wireless_handlers->standard[ioctl - SIOCIWFIRST]
          */
         const iw_handler *      standard;
         /* Number of handlers defined (more precisely, index of the
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 45d7d44d7cbe..dcf3c5f23c96 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -144,6 +144,7 @@ struct ieee80211_low_level_stats {
  *      new beacon (beaconing modes)
  * @BSS_CHANGED_BEACON_ENABLED: Beaconing should be
  *      enabled/disabled (beaconing modes)
+ * @BSS_CHANGED_CQM: Connection quality monitor config changed
  */
 enum ieee80211_bss_change {
         BSS_CHANGED_ASSOC               = 1<<0,
@@ -156,6 +157,7 @@ enum ieee80211_bss_change {
         BSS_CHANGED_BSSID               = 1<<7,
         BSS_CHANGED_BEACON              = 1<<8,
         BSS_CHANGED_BEACON_ENABLED      = 1<<9,
+        BSS_CHANGED_CQM                 = 1<<10,
 };
 
 /**
@@ -185,6 +187,9 @@ enum ieee80211_bss_change {
  * @enable_beacon: whether beaconing should be enabled or not
  * @ht_operation_mode: HT operation mode (like in &struct ieee80211_ht_info).
  *      This field is only valid when the channel type is one of the HT types.
+ * @cqm_rssi_thold: Connection quality monitor RSSI threshold, a zero value
+ *      implies disabled
+ * @cqm_rssi_hyst: Connection quality monitor RSSI hysteresis
  */
 struct ieee80211_bss_conf {
         const u8 *bssid;
@@ -202,6 +207,8 @@ struct ieee80211_bss_conf {
         u64 timestamp;
         u32 basic_rates;
         u16 ht_operation_mode;
+        s32 cqm_rssi_thold;
+        u32 cqm_rssi_hyst;
 };
 
 /**
@@ -543,7 +550,7 @@ enum mac80211_rx_flags {
  * @signal: signal strength when receiving this frame, either in dBm, in dB or
  *      unspecified depending on the hardware capabilities flags
  *      @IEEE80211_HW_SIGNAL_*
- * @noise: noise when receiving this frame, in dBm.
+ * @noise: noise when receiving this frame, in dBm (DEPRECATED).
  * @antenna: antenna used
  * @rate_idx: index of data rate into band's supported rates or MCS index if
  *      HT rates are use (RX_FLAG_HT)
@@ -554,7 +561,7 @@ struct ieee80211_rx_status {
         enum ieee80211_band band;
         int freq;
         int signal;
-        int noise;
+        int noise __deprecated;
         int antenna;
         int rate_idx;
         int flag;
@@ -580,11 +587,15 @@ struct ieee80211_rx_status {
  *      may turn the device off as much as possible. Typically, this flag will
  *      be set when an interface is set UP but not associated or scanning, but
  *      it can also be unset in that case when monitor interfaces are active.
+ * @IEEE80211_CONF_QOS: Enable 802.11e QoS also know as WMM (Wireless
+ *      Multimedia). On some drivers (iwlwifi is one of know) we have
+ *      to enable/disable QoS explicitly.
  */
 enum ieee80211_conf_flags {
         IEEE80211_CONF_MONITOR          = (1<<0),
         IEEE80211_CONF_PS               = (1<<1),
         IEEE80211_CONF_IDLE             = (1<<2),
+        IEEE80211_CONF_QOS              = (1<<3),
 };
 
 
@@ -609,6 +620,7 @@ enum ieee80211_conf_changed {
         IEEE80211_CONF_CHANGE_CHANNEL           = BIT(6),
         IEEE80211_CONF_CHANGE_RETRY_LIMITS      = BIT(7),
         IEEE80211_CONF_CHANGE_IDLE              = BIT(8),
+        IEEE80211_CONF_CHANGE_QOS               = BIT(9),
 };
 
 /**
@@ -954,6 +966,17 @@ enum ieee80211_tkip_key_type {
  *      Hardware can provide ack status reports of Tx frames to
  *      the stack.
  *
+ * @IEEE80211_HW_CONNECTION_MONITOR:
+ *      The hardware performs its own connection monitoring, including
+ *      periodic keep-alives to the AP and probing the AP on beacon loss.
+ *      When this flag is set, signaling beacon-loss will cause an immediate
+ *      change to disassociated state.
+ *
+ * @IEEE80211_HW_SUPPORTS_CQM_RSSI:
+ *      Hardware can do connection quality monitoring - i.e. it can monitor
+ *      connection quality related parameters, such as the RSSI level and
+ *      provide notifications if configured trigger levels are reached.
+ *
  */
 enum ieee80211_hw_flags {
         IEEE80211_HW_HAS_RATE_CONTROL                   = 1<<0,
@@ -975,6 +998,8 @@ enum ieee80211_hw_flags {
         IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS              = 1<<16,
         IEEE80211_HW_SUPPORTS_UAPSD                     = 1<<17,
         IEEE80211_HW_REPORTS_TX_ACK_STATUS              = 1<<18,
+        IEEE80211_HW_CONNECTION_MONITOR                 = 1<<19,
+        IEEE80211_HW_SUPPORTS_CQM_RSSI                  = 1<<20,
 };
 
 /**
@@ -1802,7 +1827,10 @@ void ieee80211_restart_hw(struct ieee80211_hw *hw);
  * ieee80211_rx - receive frame
  *
  * Use this function to hand received frames to mac80211. The receive
- * buffer in @skb must start with an IEEE 802.11 header.
+ * buffer in @skb must start with an IEEE 802.11 header. In case of a
+ * paged @skb is used, the driver is recommended to put the ieee80211
+ * header of the frame on the linear part of the @skb to avoid memory
+ * allocation and/or memcpy by the stack.
  *
  * This function may not be called in IRQ context. Calls to this function
  * for a single hardware must be synchronized against each other. Calls to
@@ -2364,12 +2392,42 @@ void ieee80211_sta_block_awake(struct ieee80211_hw *hw,
  *
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  *
- * When beacon filtering is enabled with IEEE80211_HW_BEACON_FILTERING and
- * IEEE80211_CONF_PS is set, the driver needs to inform whenever the
+ * When beacon filtering is enabled with %IEEE80211_HW_BEACON_FILTERING and
+ * %IEEE80211_CONF_PS is set, the driver needs to inform whenever the
  * hardware is not receiving beacons with this function.
  */
 void ieee80211_beacon_loss(struct ieee80211_vif *vif);
 
+/**
+ * ieee80211_connection_loss - inform hardware has lost connection to the AP
+ *
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ *
+ * When beacon filtering is enabled with %IEEE80211_HW_BEACON_FILTERING, and
+ * %IEEE80211_CONF_PS and %IEEE80211_HW_CONNECTION_MONITOR are set, the driver
+ * needs to inform if the connection to the AP has been lost.
+ *
+ * This function will cause immediate change to disassociated state,
+ * without connection recovery attempts.
+ */
+void ieee80211_connection_loss(struct ieee80211_vif *vif);
+
+/**
+ * ieee80211_cqm_rssi_notify - inform a configured connection quality monitoring
+ *      rssi threshold triggered
+ *
+ * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ * @rssi_event: the RSSI trigger event type
+ * @gfp: context flags
+ *
+ * When the %IEEE80211_HW_SUPPORTS_CQM_RSSI is set, and a connection quality
+ * monitoring is configured with an rssi threshold, the driver will inform
+ * whenever the rssi level reaches the threshold.
+ */
+void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
+                               enum nl80211_cqm_rssi_threshold_event rssi_event,
+                               gfp_t gfp);
+
 /* Rate control API */
 
 /**
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index a952b7f8c648..334c359da5e8 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -15,8 +15,12 @@ comment "CFG80211 needs to be enabled for MAC80211"
 
 if MAC80211 != n
 
+config MAC80211_HAS_RC
+        def_bool n
+
 config MAC80211_RC_PID
         bool "PID controller based rate control algorithm" if EMBEDDED
+        select MAC80211_HAS_RC
         ---help---
           This option enables a TX rate control algorithm for
           mac80211 that uses a PID controller to select the TX
@@ -24,12 +28,14 @@ config MAC80211_RC_PID
 
 config MAC80211_RC_MINSTREL
         bool "Minstrel" if EMBEDDED
+        select MAC80211_HAS_RC
         default y
         ---help---
           This option enables the 'minstrel' TX rate control algorithm
 
 choice
         prompt "Default rate control algorithm"
+        depends on MAC80211_HAS_RC
         default MAC80211_RC_DEFAULT_MINSTREL
         ---help---
           This option selects the default rate control algorithm
@@ -62,6 +68,9 @@ config MAC80211_RC_DEFAULT
 
 endif
 
+comment "Some wireless drivers require a rate control algorithm"
+        depends on MAC80211_HAS_RC=n
+
 config MAC80211_MESH
         bool "Enable mac80211 mesh networking (pre-802.11s) support"
         depends on MAC80211 && EXPERIMENTAL
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index a978e666ed6f..53233ab50f65 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -22,19 +22,20 @@ void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
                                     u16 initiator, u16 reason)
 {
         struct ieee80211_local *local = sta->local;
+        struct tid_ampdu_rx *tid_rx;
         int i;
 
-        /* check if TID is in operational state */
         spin_lock_bh(&sta->lock);
-        if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL) {
+
+        /* check if TID is in operational state */
+        if (!sta->ampdu_mlme.tid_active_rx[tid]) {
                 spin_unlock_bh(&sta->lock);
                 return;
         }
 
-        sta->ampdu_mlme.tid_state_rx[tid] =
-                HT_AGG_STATE_REQ_STOP_BA_MSK |
-                (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
-        spin_unlock_bh(&sta->lock);
+        sta->ampdu_mlme.tid_active_rx[tid] = false;
+
+        tid_rx = sta->ampdu_mlme.tid_rx[tid];
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "Rx BA session stop requested for %pM tid %u\n",
@@ -46,61 +47,35 @@ void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
                 printk(KERN_DEBUG "HW problem - can not stop rx "
                                 "aggregation for tid %d\n", tid);
 
-        /* shutdown timer has not expired */
-        if (initiator != WLAN_BACK_TIMER)
-                del_timer_sync(&sta->ampdu_mlme.tid_rx[tid]->session_timer);
-
         /* check if this is a self generated aggregation halt */
-        if (initiator == WLAN_BACK_RECIPIENT || initiator == WLAN_BACK_TIMER)
+        if (initiator == WLAN_BACK_RECIPIENT)
                 ieee80211_send_delba(sta->sdata, sta->sta.addr,
                                      tid, 0, reason);
 
         /* free the reordering buffer */
-        for (i = 0; i < sta->ampdu_mlme.tid_rx[tid]->buf_size; i++) {
-                if (sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]) {
+        for (i = 0; i < tid_rx->buf_size; i++) {
+                if (tid_rx->reorder_buf[i]) {
                         /* release the reordered frames */
-                        dev_kfree_skb(sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i]);
-                        sta->ampdu_mlme.tid_rx[tid]->stored_mpdu_num--;
-                        sta->ampdu_mlme.tid_rx[tid]->reorder_buf[i] = NULL;
+                        dev_kfree_skb(tid_rx->reorder_buf[i]);
+                        tid_rx->stored_mpdu_num--;
+                        tid_rx->reorder_buf[i] = NULL;
                 }
         }
 
-        spin_lock_bh(&sta->lock);
         /* free resources */
-        kfree(sta->ampdu_mlme.tid_rx[tid]->reorder_buf);
-        kfree(sta->ampdu_mlme.tid_rx[tid]->reorder_time);
+        kfree(tid_rx->reorder_buf);
+        kfree(tid_rx->reorder_time);
+        sta->ampdu_mlme.tid_rx[tid] = NULL;
 
-        if (!sta->ampdu_mlme.tid_rx[tid]->shutdown) {
-                kfree(sta->ampdu_mlme.tid_rx[tid]);
-                sta->ampdu_mlme.tid_rx[tid] = NULL;
-        }
-
-        sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_IDLE;
         spin_unlock_bh(&sta->lock);
-}
-
-void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid,
-                                        u16 initiator, u16 reason)
-{
-        struct sta_info *sta;
-
-        rcu_read_lock();
-
-        sta = sta_info_get(sdata, ra);
-        if (!sta) {
-                rcu_read_unlock();
-                return;
-        }
-
-        __ieee80211_stop_rx_ba_session(sta, tid, initiator, reason);
 
-        rcu_read_unlock();
+        del_timer_sync(&tid_rx->session_timer);
+        kfree(tid_rx);
 }
 
 /*
  * After accepting the AddBA Request we activated a timer,
  * resetting it after each frame that arrives from the originator.
- * if this timer expires ieee80211_sta_stop_rx_ba_session will be executed.
  */
 static void sta_rx_agg_session_timer_expired(unsigned long data)
 {
@@ -116,9 +91,8 @@ static void sta_rx_agg_session_timer_expired(unsigned long data)
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
 #endif
-        ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
-                                         (u16)*ptid, WLAN_BACK_TIMER,
-                                         WLAN_REASON_QSTA_TIMEOUT);
+        __ieee80211_stop_rx_ba_session(sta, *ptid, WLAN_BACK_RECIPIENT,
+                                       WLAN_REASON_QSTA_TIMEOUT);
 }
 
 static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *da, u16 tid,
@@ -193,7 +167,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
 
         status = WLAN_STATUS_REQUEST_DECLINED;
 
-        if (test_sta_flags(sta, WLAN_STA_SUSPEND)) {
+        if (test_sta_flags(sta, WLAN_STA_BLOCK_BA)) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "Suspend in progress. "
                        "Denying ADDBA request\n");
@@ -231,7 +205,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
         /* examine state machine */
         spin_lock_bh(&sta->lock);
 
-        if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_IDLE) {
+        if (sta->ampdu_mlme.tid_active_rx[tid]) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 if (net_ratelimit())
                         printk(KERN_DEBUG "unexpected AddBA Req from "
@@ -293,7 +267,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
         }
 
         /* change state and send addba resp */
-        sta->ampdu_mlme.tid_state_rx[tid] = HT_AGG_STATE_OPERATIONAL;
+        sta->ampdu_mlme.tid_active_rx[tid] = true;
         tid_agg_rx->dialog_token = dialog_token;
         tid_agg_rx->ssn = start_seq_num;
         tid_agg_rx->head_seq_num = start_seq_num;
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 5538e1b4a697..32d2148b5b98 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -245,7 +245,7 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
                 return -EINVAL;
         }
 
-        if (test_sta_flags(sta, WLAN_STA_SUSPEND)) {
+        if (test_sta_flags(sta, WLAN_STA_BLOCK_BA)) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "Suspend in progress. "
                        "Denying BA session request\n");
@@ -414,7 +414,7 @@ static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
                                          struct sta_info *sta, u16 tid)
 {
 #ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "Aggregation is on for tid %d \n", tid);
+        printk(KERN_DEBUG "Aggregation is on for tid %d\n", tid);
 #endif
 
         spin_lock(&local->ampdu_lock);
@@ -674,7 +674,7 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
         del_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
-        printk(KERN_DEBUG "switched off addBA timer for tid %d \n", tid);
+        printk(KERN_DEBUG "switched off addBA timer for tid %d\n", tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
         if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index b7116ef84a3b..4edd73cbf052 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1136,6 +1136,10 @@ static int ieee80211_set_txq_params(struct wiphy *wiphy,
                 return -EINVAL;
         }
 
+        /* enable WMM or activate new settings */
+        local->hw.conf.flags |= IEEE80211_CONF_QOS;
+        drv_config(local, IEEE80211_CONF_CHANGE_QOS);
+
         return 0;
 }
 
@@ -1402,6 +1406,35 @@ static int ieee80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
         return 0;
 }
 
+static int ieee80211_set_cqm_rssi_config(struct wiphy *wiphy,
+                                         struct net_device *dev,
+                                         s32 rssi_thold, u32 rssi_hyst)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_vif *vif = &sdata->vif;
+        struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
+
+        if (rssi_thold == bss_conf->cqm_rssi_thold &&
+            rssi_hyst == bss_conf->cqm_rssi_hyst)
+                return 0;
+
+        bss_conf->cqm_rssi_thold = rssi_thold;
+        bss_conf->cqm_rssi_hyst = rssi_hyst;
+
+        if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_CQM_RSSI)) {
+                if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                        return -EOPNOTSUPP;
+                return 0;
+        }
+
+        /* tell the driver upon association, unless already associated */
+        if (sdata->u.mgd.associated)
+                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_CQM);
+
+        return 0;
+}
+
 static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,
                                       struct net_device *dev,
                                       const u8 *addr,
@@ -1506,4 +1539,5 @@ struct cfg80211_ops mac80211_config_ops = {
         .remain_on_channel = ieee80211_remain_on_channel,
         .cancel_remain_on_channel = ieee80211_cancel_remain_on_channel,
         .action = ieee80211_action,
+        .set_cqm_rssi_config = ieee80211_set_cqm_rssi_config,
 };
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index b4ddb2f83914..623e6644b80c 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -99,6 +99,14 @@ static ssize_t ieee80211_if_fmt_##name(					\
         return scnprintf(buf, buflen, "%pM\n", sdata->field);           \
 }
 
+#define IEEE80211_IF_FMT_DEC_DIV_16(name, field)                        \
+static ssize_t ieee80211_if_fmt_##name(                                 \
+        const struct ieee80211_sub_if_data *sdata,                      \
+        char *buf, int buflen)                                          \
+{                                                                       \
+        return scnprintf(buf, buflen, "%d\n", sdata->field / 16);       \
+}
+
 #define __IEEE80211_IF_FILE(name, _write)                               \
 static ssize_t ieee80211_if_read_##name(struct file *file,              \
                                         char __user *userbuf,           \
@@ -139,6 +147,8 @@ IEEE80211_IF_FILE(rc_rateidx_mask_5ghz, rc_rateidx_mask[IEEE80211_BAND_5GHZ],
 /* STA attributes */
 IEEE80211_IF_FILE(bssid, u.mgd.bssid, MAC);
 IEEE80211_IF_FILE(aid, u.mgd.aid, DEC);
+IEEE80211_IF_FILE(last_beacon, u.mgd.last_beacon_signal, DEC);
+IEEE80211_IF_FILE(ave_beacon, u.mgd.ave_beacon_signal, DEC_DIV_16);
 
 static int ieee80211_set_smps(struct ieee80211_sub_if_data *sdata,
                               enum ieee80211_smps_mode smps_mode)
@@ -275,6 +285,8 @@ static void add_sta_files(struct ieee80211_sub_if_data *sdata)
 
         DEBUGFS_ADD(bssid);
         DEBUGFS_ADD(aid);
+        DEBUGFS_ADD(last_beacon);
+        DEBUGFS_ADD(ave_beacon);
         DEBUGFS_ADD_MODE(smps, 0600);
 }
 
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index d92800bb2d2f..740ff6c5b92c 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -57,7 +57,6 @@ STA_FILE(tx_filtered, tx_filtered_count, LU);
 STA_FILE(tx_retry_failed, tx_retry_failed, LU);
 STA_FILE(tx_retry_count, tx_retry_count, LU);
 STA_FILE(last_signal, last_signal, D);
-STA_FILE(last_noise, last_noise, D);
 STA_FILE(wep_weak_iv_count, wep_weak_iv_count, LU);
 
 static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
@@ -120,7 +119,7 @@ STA_OPS(last_seq_ctrl);
 static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
                                         size_t count, loff_t *ppos)
 {
-        char buf[64 + STA_TID_NUM * 40], *p = buf;
+        char buf[71 + STA_TID_NUM * 40], *p = buf;
         int i;
         struct sta_info *sta = file->private_data;
 
@@ -128,16 +127,16 @@ static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
         p += scnprintf(p, sizeof(buf) + buf - p, "next dialog_token: %#02x\n",
                         sta->ampdu_mlme.dialog_token_allocator + 1);
         p += scnprintf(p, sizeof(buf) + buf - p,
-                       "TID\t\tRX\tDTKN\tSSN\t\tTX\tDTKN\tSSN\tpending\n");
+                       "TID\t\tRX active\tDTKN\tSSN\t\tTX\tDTKN\tSSN\tpending\n");
         for (i = 0; i < STA_TID_NUM; i++) {
                 p += scnprintf(p, sizeof(buf) + buf - p, "%02d", i);
                 p += scnprintf(p, sizeof(buf) + buf - p, "\t\t%x",
-                                sta->ampdu_mlme.tid_state_rx[i]);
+                                sta->ampdu_mlme.tid_active_rx[i]);
                 p += scnprintf(p, sizeof(buf) + buf - p, "\t%#.2x",
-                                sta->ampdu_mlme.tid_state_rx[i] ?
+                                sta->ampdu_mlme.tid_active_rx[i] ?
                                 sta->ampdu_mlme.tid_rx[i]->dialog_token : 0);
                 p += scnprintf(p, sizeof(buf) + buf - p, "\t%#.3x",
-                                sta->ampdu_mlme.tid_state_rx[i] ?
+                                sta->ampdu_mlme.tid_active_rx[i] ?
                                 sta->ampdu_mlme.tid_rx[i]->ssn : 0);
 
                 p += scnprintf(p, sizeof(buf) + buf - p, "\t\t%x",
@@ -289,7 +288,6 @@ void ieee80211_sta_debugfs_add(struct sta_info *sta)
         DEBUGFS_ADD(tx_retry_failed);
         DEBUGFS_ADD(tx_retry_count);
         DEBUGFS_ADD(last_signal);
-        DEBUGFS_ADD(last_noise);
         DEBUGFS_ADD(wep_weak_iv_count);
         DEBUGFS_ADD(ht_capa);
 }
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index bb677a73b7c9..2ab106a0a491 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -175,8 +175,7 @@ void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
         if (initiator == WLAN_BACK_INITIATOR)
-                ieee80211_sta_stop_rx_ba_session(sdata, sta->sta.addr, tid,
-                                                 WLAN_BACK_INITIATOR, 0);
+                __ieee80211_stop_rx_ba_session(sta, tid, WLAN_BACK_INITIATOR, 0);
         else { /* WLAN_BACK_RECIPIENT */
                 spin_lock_bh(&sta->lock);
                 if (sta->ampdu_mlme.tid_state_tx[tid] & HT_ADDBA_REQUESTED_MSK)
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index f3e942486749..01974c2510a8 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -264,17 +264,16 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                         sta->sta.supp_rates[band] = supp_rates |
                                 ieee80211_mandatory_rates(local, band);
 
+                        if (sta->sta.supp_rates[band] != prev_rates) {
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
-                        if (sta->sta.supp_rates[band] != prev_rates)
                                 printk(KERN_DEBUG "%s: updated supp_rates set "
-                                    "for %pM based on beacon info (0x%llx | "
-                                    "0x%llx -> 0x%llx)\n",
-                                    sdata->name,
-                                    sta->sta.addr,
-                                    (unsigned long long) prev_rates,
-                                    (unsigned long long) supp_rates,
-                                    (unsigned long long) sta->sta.supp_rates[band]);
+                                    "for %pM based on beacon/probe_response "
+                                    "(0x%x -> 0x%x)\n",
+                                    sdata->name, sta->sta.addr,
+                                    prev_rates, sta->sta.supp_rates[band]);
 #endif
+                                rate_control_rate_init(sta);
+                        }
                         rcu_read_unlock();
                 } else {
                         rcu_read_unlock();
@@ -370,6 +369,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                        sdata->name, mgmt->bssid);
 #endif
                 ieee80211_sta_join_ibss(sdata, bss);
+                supp_rates = ieee80211_sta_get_rates(local, elems, band);
                 ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa,
                                        supp_rates, GFP_KERNEL);
         }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 241533e1bc03..4e73660ebe99 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -317,6 +317,7 @@ enum ieee80211_sta_flags {
         IEEE80211_STA_MFP_ENABLED       = BIT(6),
         IEEE80211_STA_UAPSD_ENABLED     = BIT(7),
         IEEE80211_STA_NULLFUNC_ACKED    = BIT(8),
+        IEEE80211_STA_RESET_SIGNAL_AVE  = BIT(9),
 };
 
 struct ieee80211_if_managed {
@@ -327,7 +328,7 @@ struct ieee80211_if_managed {
         struct work_struct work;
         struct work_struct monitor_work;
         struct work_struct chswitch_work;
-        struct work_struct beacon_loss_work;
+        struct work_struct beacon_connection_loss_work;
 
         unsigned long probe_timeout;
         int probe_send_count;
@@ -359,6 +360,24 @@ struct ieee80211_if_managed {
         int wmm_last_param_set;
 
         u8 use_4addr;
+
+        /* Signal strength from the last Beacon frame in the current BSS. */
+        int last_beacon_signal;
+
+        /*
+         * Weighted average of the signal strength from Beacon frames in the
+         * current BSS. This is in units of 1/16 of the signal unit to maintain
+         * accuracy and to speed up calculations, i.e., the value need to be
+         * divided by 16 to get the actual value.
+         */
+        int ave_beacon_signal;
+
+        /*
+         * Last Beacon frame signal strength average (ave_beacon_signal / 16)
+         * that triggered a cqm event. 0 indicates that no event has been
+         * generated for the current association.
+         */
+        int last_cqm_event_signal;
 };
 
 enum ieee80211_ibss_request {
@@ -745,6 +764,7 @@ struct ieee80211_local {
         int scan_channel_idx;
         int scan_ies_len;
 
+        unsigned long leave_oper_channel_time;
         enum mac80211_scan_state next_scan_state;
         struct delayed_work scan_work;
         struct ieee80211_sub_if_data *scan_sdata;
@@ -1078,8 +1098,6 @@ int ieee80211_send_smps_action(struct ieee80211_sub_if_data *sdata,
                                enum ieee80211_smps_mode smps, const u8 *da,
                                const u8 *bssid);
 
-void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *da,
-                                u16 tid, u16 initiator, u16 reason);
 void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
                                     u16 initiator, u16 reason);
 void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta);
@@ -1155,7 +1173,7 @@ void ieee80211_send_nullfunc(struct ieee80211_local *local,
                              int powersave);
 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
                              struct ieee80211_hdr *hdr);
-void ieee80211_beacon_loss_work(struct work_struct *work);
+void ieee80211_beacon_connection_loss_work(struct work_struct *work);
 
 void ieee80211_wake_queues_by_reason(struct ieee80211_hw *hw,
                                      enum queue_stop_reason reason);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 0793d7a8d743..b4ec59a8dc03 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -486,7 +486,7 @@ static int ieee80211_stop(struct net_device *dev)
                 cancel_work_sync(&sdata->u.mgd.work);
                 cancel_work_sync(&sdata->u.mgd.chswitch_work);
                 cancel_work_sync(&sdata->u.mgd.monitor_work);
-                cancel_work_sync(&sdata->u.mgd.beacon_loss_work);
+                cancel_work_sync(&sdata->u.mgd.beacon_connection_loss_work);
 
                 /*
                  * When we get here, the interface is marked down.
@@ -815,6 +815,118 @@ int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
+static void ieee80211_assign_perm_addr(struct ieee80211_local *local,
+                                       struct net_device *dev,
+                                       enum nl80211_iftype type)
+{
+        struct ieee80211_sub_if_data *sdata;
+        u64 mask, start, addr, val, inc;
+        u8 *m;
+        u8 tmp_addr[ETH_ALEN];
+        int i;
+
+        /* default ... something at least */
+        memcpy(dev->perm_addr, local->hw.wiphy->perm_addr, ETH_ALEN);
+
+        if (is_zero_ether_addr(local->hw.wiphy->addr_mask) &&
+            local->hw.wiphy->n_addresses <= 1)
+                return;
+
+
+        mutex_lock(&local->iflist_mtx);
+
+        switch (type) {
+        case NL80211_IFTYPE_MONITOR:
+                /* doesn't matter */
+                break;
+        case NL80211_IFTYPE_WDS:
+        case NL80211_IFTYPE_AP_VLAN:
+                /* match up with an AP interface */
+                list_for_each_entry(sdata, &local->interfaces, list) {
+                        if (sdata->vif.type != NL80211_IFTYPE_AP)
+                                continue;
+                        memcpy(dev->perm_addr, sdata->vif.addr, ETH_ALEN);
+                        break;
+                }
+                /* keep default if no AP interface present */
+                break;
+        default:
+                /* assign a new address if possible -- try n_addresses first */
+                for (i = 0; i < local->hw.wiphy->n_addresses; i++) {
+                        bool used = false;
+
+                        list_for_each_entry(sdata, &local->interfaces, list) {
+                                if (memcmp(local->hw.wiphy->addresses[i].addr,
+                                           sdata->vif.addr, ETH_ALEN) == 0) {
+                                        used = true;
+                                        break;
+                                }
+                        }
+
+                        if (!used) {
+                                memcpy(dev->perm_addr,
+                                       local->hw.wiphy->addresses[i].addr,
+                                       ETH_ALEN);
+                                break;
+                        }
+                }
+
+                /* try mask if available */
+                if (is_zero_ether_addr(local->hw.wiphy->addr_mask))
+                        break;
+
+                m = local->hw.wiphy->addr_mask;
+                mask =  ((u64)m[0] << 5*8) | ((u64)m[1] << 4*8) |
+                        ((u64)m[2] << 3*8) | ((u64)m[3] << 2*8) |
+                        ((u64)m[4] << 1*8) | ((u64)m[5] << 0*8);
+
+                if (__ffs64(mask) + hweight64(mask) != fls64(mask)) {
+                        /* not a contiguous mask ... not handled now! */
+                        printk(KERN_DEBUG "not contiguous\n");
+                        break;
+                }
+
+                m = local->hw.wiphy->perm_addr;
+                start = ((u64)m[0] << 5*8) | ((u64)m[1] << 4*8) |
+                        ((u64)m[2] << 3*8) | ((u64)m[3] << 2*8) |
+                        ((u64)m[4] << 1*8) | ((u64)m[5] << 0*8);
+
+                inc = 1ULL<<__ffs64(mask);
+                val = (start & mask);
+                addr = (start & ~mask) | (val & mask);
+                do {
+                        bool used = false;
+
+                        tmp_addr[5] = addr >> 0*8;
+                        tmp_addr[4] = addr >> 1*8;
+                        tmp_addr[3] = addr >> 2*8;
+                        tmp_addr[2] = addr >> 3*8;
+                        tmp_addr[1] = addr >> 4*8;
+                        tmp_addr[0] = addr >> 5*8;
+
+                        val += inc;
+
+                        list_for_each_entry(sdata, &local->interfaces, list) {
+                                if (memcmp(tmp_addr, sdata->vif.addr,
+                                                        ETH_ALEN) == 0) {
+                                        used = true;
+                                        break;
+                                }
+                        }
+
+                        if (!used) {
+                                memcpy(dev->perm_addr, tmp_addr, ETH_ALEN);
+                                break;
+                        }
+                        addr = (start & ~mask) | (val & mask);
+                } while (addr != start);
+
+                break;
+        }
+
+        mutex_unlock(&local->iflist_mtx);
+}
+
 int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                      struct net_device **new_dev, enum nl80211_iftype type,
                      struct vif_params *params)
@@ -844,8 +956,8 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
         if (ret < 0)
                 goto fail;
 
-        memcpy(ndev->dev_addr, local->hw.wiphy->perm_addr, ETH_ALEN);
-        memcpy(ndev->perm_addr, ndev->dev_addr, ETH_ALEN);
+        ieee80211_assign_perm_addr(local, ndev, type);
+        memcpy(ndev->dev_addr, ndev->perm_addr, ETH_ALEN);
         SET_NETDEV_DEV(ndev, wiphy_dev(local->hw.wiphy));
 
         /* don't use IEEE80211_DEV_TO_SUB_IF because it checks too much */
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index be5f723d643a..461167dfa42c 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -46,6 +46,13 @@
  */
 #define IEEE80211_PROBE_WAIT            (HZ / 2)
 
+/*
+ * Weight given to the latest Beacon frame when calculating average signal
+ * strength for Beacon frames received in the current BSS. This must be
+ * between 1 and 15.
+ */
+#define IEEE80211_SIGNAL_AVE_WEIGHT     3
+
 #define TMR_RUNNING_TIMER       0
 #define TMR_RUNNING_CHANSW      1
 
@@ -203,7 +210,7 @@ static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
 
 static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
                                            const u8 *bssid, u16 stype, u16 reason,
-                                           void *cookie)
+                                           void *cookie, bool send_frame)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
@@ -240,7 +247,11 @@ static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
                         cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len);
         if (!(ifmgd->flags & IEEE80211_STA_MFP_ENABLED))
                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
-        ieee80211_tx_skb(sdata, skb);
+
+        if (send_frame)
+                ieee80211_tx_skb(sdata, skb);
+        else
+                kfree_skb(skb);
 }
 
 void ieee80211_send_pspoll(struct ieee80211_local *local,
@@ -589,6 +600,9 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
         int count;
         u8 *pos, uapsd_queues = 0;
 
+        if (!local->ops->conf_tx)
+                return;
+
         if (local->hw.queues < 4)
                 return;
 
@@ -663,11 +677,15 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
                        params.aifs, params.cw_min, params.cw_max, params.txop,
                        params.uapsd);
 #endif
-                if (drv_conf_tx(local, queue, &params) && local->ops->conf_tx)
+                if (drv_conf_tx(local, queue, &params))
                         printk(KERN_DEBUG "%s: failed to set TX queue "
                                "parameters for queue %d\n",
                                wiphy_name(local->hw.wiphy), queue);
         }
+
+        /* enable WMM or activate new settings */
+        local->hw.conf.flags |= IEEE80211_CONF_QOS;
+        drv_config(local, IEEE80211_CONF_CHANGE_QOS);
 }
 
 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
@@ -728,6 +746,8 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
         sdata->u.mgd.associated = cbss;
         memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
 
+        sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;
+
         /* just to be sure */
         sdata->u.mgd.flags &= ~(IEEE80211_STA_CONNECTION_POLL |
                                 IEEE80211_STA_BEACON_POLL);
@@ -753,6 +773,11 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
         /* And the BSSID changed - we're associated now */
         bss_info_changed |= BSS_CHANGED_BSSID;
 
+        /* Tell the driver to monitor connection quality (if supported) */
+        if ((local->hw.flags & IEEE80211_HW_SUPPORTS_CQM_RSSI) &&
+            sdata->vif.bss_conf.cqm_rssi_thold)
+                bss_info_changed |= BSS_CHANGED_CQM;
+
         ieee80211_bss_info_change_notify(sdata, bss_info_changed);
 
         mutex_lock(&local->iflist_mtx);
@@ -764,7 +789,8 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
         netif_carrier_on(sdata->dev);
 }
 
-static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata)
+static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
+                                   bool remove_sta)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
@@ -837,7 +863,8 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata)
         changed |= BSS_CHANGED_BSSID;
         ieee80211_bss_info_change_notify(sdata, changed);
 
-        sta_info_destroy_addr(sdata, bssid);
+        if (remove_sta)
+                sta_info_destroy_addr(sdata, bssid);
 }
 
 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
@@ -854,6 +881,9 @@ void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
         if (is_multicast_ether_addr(hdr->addr1))
                 return;
 
+        if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
+                return;
+
         mod_timer(&sdata->u.mgd.conn_mon_timer,
                   round_jiffies_up(jiffies + IEEE80211_CONNECTION_IDLE_TIME));
 }
@@ -931,23 +961,68 @@ static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
         mutex_unlock(&ifmgd->mtx);
 }
 
-void ieee80211_beacon_loss_work(struct work_struct *work)
+static void __ieee80211_connection_loss(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_local *local = sdata->local;
+        u8 bssid[ETH_ALEN];
+
+        mutex_lock(&ifmgd->mtx);
+        if (!ifmgd->associated) {
+                mutex_unlock(&ifmgd->mtx);
+                return;
+        }
+
+        memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
+
+        printk(KERN_DEBUG "Connection to AP %pM lost.\n", bssid);
+
+        ieee80211_set_disassoc(sdata, true);
+        ieee80211_recalc_idle(local);
+        mutex_unlock(&ifmgd->mtx);
+        /*
+         * must be outside lock due to cfg80211,
+         * but that's not a problem.
+         */
+        ieee80211_send_deauth_disassoc(sdata, bssid,
+                                       IEEE80211_STYPE_DEAUTH,
+                                       WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
+                                       NULL, true);
+}
+
+void ieee80211_beacon_connection_loss_work(struct work_struct *work)
 {
         struct ieee80211_sub_if_data *sdata =
                 container_of(work, struct ieee80211_sub_if_data,
-                             u.mgd.beacon_loss_work);
+                             u.mgd.beacon_connection_loss_work);
 
-        ieee80211_mgd_probe_ap(sdata, true);
+        if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
+                __ieee80211_connection_loss(sdata);
+        else
+                ieee80211_mgd_probe_ap(sdata, true);
 }
 
 void ieee80211_beacon_loss(struct ieee80211_vif *vif)
 {
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_hw *hw = &sdata->local->hw;
 
-        ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.beacon_loss_work);
+        WARN_ON(hw->flags & IEEE80211_HW_CONNECTION_MONITOR);
+        ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
 }
 EXPORT_SYMBOL(ieee80211_beacon_loss);
 
+void ieee80211_connection_loss(struct ieee80211_vif *vif)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_hw *hw = &sdata->local->hw;
+
+        WARN_ON(!(hw->flags & IEEE80211_HW_CONNECTION_MONITOR));
+        ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
+}
+EXPORT_SYMBOL(ieee80211_connection_loss);
+
+
 static enum rx_mgmt_action __must_check
 ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
                          struct ieee80211_mgmt *mgmt, size_t len)
@@ -968,7 +1043,7 @@ ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
         printk(KERN_DEBUG "%s: deauthenticated from %pM (Reason: %u)\n",
                         sdata->name, bssid, reason_code);
 
-        ieee80211_set_disassoc(sdata);
+        ieee80211_set_disassoc(sdata, true);
         ieee80211_recalc_idle(sdata->local);
 
         return RX_MGMT_CFG80211_DEAUTH;
@@ -998,7 +1073,7 @@ ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
         printk(KERN_DEBUG "%s: disassociated from %pM (Reason: %u)\n",
                         sdata->name, mgmt->sa, reason_code);
 
-        ieee80211_set_disassoc(sdata);
+        ieee80211_set_disassoc(sdata, true);
         ieee80211_recalc_idle(sdata->local);
         return RX_MGMT_CFG80211_DISASSOC;
 }
@@ -1290,6 +1365,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_rx_status *rx_status)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
         size_t baselen;
         struct ieee802_11_elems elems;
         struct ieee80211_local *local = sdata->local;
@@ -1325,6 +1401,41 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         if (memcmp(bssid, mgmt->bssid, ETH_ALEN) != 0)
                 return;
 
+        /* Track average RSSI from the Beacon frames of the current AP */
+        ifmgd->last_beacon_signal = rx_status->signal;
+        if (ifmgd->flags & IEEE80211_STA_RESET_SIGNAL_AVE) {
+                ifmgd->flags &= ~IEEE80211_STA_RESET_SIGNAL_AVE;
+                ifmgd->ave_beacon_signal = rx_status->signal;
+                ifmgd->last_cqm_event_signal = 0;
+        } else {
+                ifmgd->ave_beacon_signal =
+                        (IEEE80211_SIGNAL_AVE_WEIGHT * rx_status->signal * 16 +
+                         (16 - IEEE80211_SIGNAL_AVE_WEIGHT) *
+                         ifmgd->ave_beacon_signal) / 16;
+        }
+        if (bss_conf->cqm_rssi_thold &&
+            !(local->hw.flags & IEEE80211_HW_SUPPORTS_CQM_RSSI)) {
+                int sig = ifmgd->ave_beacon_signal / 16;
+                int last_event = ifmgd->last_cqm_event_signal;
+                int thold = bss_conf->cqm_rssi_thold;
+                int hyst = bss_conf->cqm_rssi_hyst;
+                if (sig < thold &&
+                    (last_event == 0 || sig < last_event - hyst)) {
+                        ifmgd->last_cqm_event_signal = sig;
+                        ieee80211_cqm_rssi_notify(
+                                &sdata->vif,
+                                NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW,
+                                GFP_KERNEL);
+                } else if (sig > thold &&
+                           (last_event == 0 || sig > last_event + hyst)) {
+                        ifmgd->last_cqm_event_signal = sig;
+                        ieee80211_cqm_rssi_notify(
+                                &sdata->vif,
+                                NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH,
+                                GFP_KERNEL);
+                }
+        }
+
         if (ifmgd->flags & IEEE80211_STA_BEACON_POLL) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                 if (net_ratelimit()) {
@@ -1610,7 +1721,7 @@ static void ieee80211_sta_work(struct work_struct *work)
                         printk(KERN_DEBUG "No probe response from AP %pM"
                                 " after %dms, disconnecting.\n",
                                 bssid, (1000 * IEEE80211_PROBE_WAIT)/HZ);
-                        ieee80211_set_disassoc(sdata);
+                        ieee80211_set_disassoc(sdata, true);
                         ieee80211_recalc_idle(local);
                         mutex_unlock(&ifmgd->mtx);
                         /*
@@ -1620,7 +1731,7 @@ static void ieee80211_sta_work(struct work_struct *work)
                         ieee80211_send_deauth_disassoc(sdata, bssid,
                                         IEEE80211_STYPE_DEAUTH,
                                         WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
-                                        NULL);
+                                        NULL, true);
                         mutex_lock(&ifmgd->mtx);
                 }
         }
@@ -1637,7 +1748,8 @@ static void ieee80211_sta_bcn_mon_timer(unsigned long data)
         if (local->quiescing)
                 return;
 
-        ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.beacon_loss_work);
+        ieee80211_queue_work(&sdata->local->hw,
+                             &sdata->u.mgd.beacon_connection_loss_work);
 }
 
 static void ieee80211_sta_conn_mon_timer(unsigned long data)
@@ -1689,7 +1801,7 @@ void ieee80211_sta_quiesce(struct ieee80211_sub_if_data *sdata)
          */
 
         cancel_work_sync(&ifmgd->work);
-        cancel_work_sync(&ifmgd->beacon_loss_work);
+        cancel_work_sync(&ifmgd->beacon_connection_loss_work);
         if (del_timer_sync(&ifmgd->timer))
                 set_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running);
 
@@ -1723,7 +1835,8 @@ void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
         INIT_WORK(&ifmgd->work, ieee80211_sta_work);
         INIT_WORK(&ifmgd->monitor_work, ieee80211_sta_monitor_work);
         INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
-        INIT_WORK(&ifmgd->beacon_loss_work, ieee80211_beacon_loss_work);
+        INIT_WORK(&ifmgd->beacon_connection_loss_work,
+                  ieee80211_beacon_connection_loss_work);
         setup_timer(&ifmgd->timer, ieee80211_sta_timer,
                     (unsigned long) sdata);
         setup_timer(&ifmgd->bcn_mon_timer, ieee80211_sta_bcn_mon_timer,
@@ -1802,6 +1915,9 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_work *wk;
         u16 auth_alg;
 
+        if (req->local_state_change)
+                return 0; /* no need to update mac80211 state */
+
         switch (req->auth_type) {
         case NL80211_AUTHTYPE_OPEN_SYSTEM:
                 auth_alg = WLAN_AUTH_OPEN;
@@ -1910,7 +2026,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                 }
 
                 /* Trying to reassociate - clear previous association state */
-                ieee80211_set_disassoc(sdata);
+                ieee80211_set_disassoc(sdata, true);
         }
         mutex_unlock(&ifmgd->mtx);
 
@@ -2014,7 +2130,7 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
 
         if (ifmgd->associated == req->bss) {
                 bssid = req->bss->bssid;
-                ieee80211_set_disassoc(sdata);
+                ieee80211_set_disassoc(sdata, true);
                 mutex_unlock(&ifmgd->mtx);
         } else {
                 bool not_auth_yet = false;
@@ -2057,9 +2173,9 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
         printk(KERN_DEBUG "%s: deauthenticating from %pM by local choice (reason=%d)\n",
                sdata->name, bssid, req->reason_code);
 
-        ieee80211_send_deauth_disassoc(sdata, bssid,
-                        IEEE80211_STYPE_DEAUTH, req->reason_code,
-                        cookie);
+        ieee80211_send_deauth_disassoc(sdata, bssid, IEEE80211_STYPE_DEAUTH,
+                                       req->reason_code, cookie,
+                                       !req->local_state_change);
 
         ieee80211_recalc_idle(sdata->local);
 
@@ -2071,6 +2187,7 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
                            void *cookie)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        u8 bssid[ETH_ALEN];
 
         mutex_lock(&ifmgd->mtx);
 
@@ -2088,13 +2205,15 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
         printk(KERN_DEBUG "%s: disassociating from %pM by local choice (reason=%d)\n",
                sdata->name, req->bss->bssid, req->reason_code);
 
-        ieee80211_set_disassoc(sdata);
+        memcpy(bssid, req->bss->bssid, ETH_ALEN);
+        ieee80211_set_disassoc(sdata, false);
 
         mutex_unlock(&ifmgd->mtx);
 
         ieee80211_send_deauth_disassoc(sdata, req->bss->bssid,
                         IEEE80211_STYPE_DISASSOC, req->reason_code,
-                        cookie);
+                        cookie, !req->local_state_change);
+        sta_info_destroy_addr(sdata, bssid);
 
         ieee80211_recalc_idle(sdata->local);
 
@@ -2135,3 +2254,13 @@ int ieee80211_mgd_action(struct ieee80211_sub_if_data *sdata,
         *cookie = (unsigned long) skb;
         return 0;
 }
+
+void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
+                               enum nl80211_cqm_rssi_threshold_event rssi_event,
+                               gfp_t gfp)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+
+        cfg80211_cqm_rssi_notify(sdata->dev, rssi_event, gfp);
+}
+EXPORT_SYMBOL(ieee80211_cqm_rssi_notify);
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 0e64484e861c..75202b295a4e 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -46,7 +46,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
 
         if (hw->flags & IEEE80211_HW_AMPDU_AGGREGATION) {
                 list_for_each_entry_rcu(sta, &local->sta_list, list) {
-                        set_sta_flags(sta, WLAN_STA_SUSPEND);
+                        set_sta_flags(sta, WLAN_STA_BLOCK_BA);
                         ieee80211_sta_tear_down_BA_sessions(sta);
                 }
         }
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 6e5d68b4e427..4926d929fd9f 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -541,7 +541,7 @@ minstrel_free(void *priv)
         kfree(priv);
 }
 
-static struct rate_control_ops mac80211_minstrel = {
+struct rate_control_ops mac80211_minstrel = {
         .name = "minstrel",
         .tx_status = minstrel_tx_status,
         .get_rate = minstrel_get_rate,
diff --git a/net/mac80211/rc80211_minstrel.h b/net/mac80211/rc80211_minstrel.h
index 38bf4168fc3a..0f5a83370aa6 100644
--- a/net/mac80211/rc80211_minstrel.h
+++ b/net/mac80211/rc80211_minstrel.h
@@ -80,7 +80,18 @@ struct minstrel_priv {
         unsigned int lookaround_rate_mrr;
 };
 
+struct minstrel_debugfs_info {
+        size_t len;
+        char buf[];
+};
+
+extern struct rate_control_ops mac80211_minstrel;
 void minstrel_add_sta_debugfs(void *priv, void *priv_sta, struct dentry *dir);
 void minstrel_remove_sta_debugfs(void *priv, void *priv_sta);
 
+/* debugfs */
+int minstrel_stats_open(struct inode *inode, struct file *file);
+ssize_t minstrel_stats_read(struct file *file, char __user *buf, size_t len, loff_t *ppos);
+int minstrel_stats_release(struct inode *inode, struct file *file);
+
 #endif
diff --git a/net/mac80211/rc80211_minstrel_debugfs.c b/net/mac80211/rc80211_minstrel_debugfs.c
index a715d9454f64..56d0f24957d9 100644
--- a/net/mac80211/rc80211_minstrel_debugfs.c
+++ b/net/mac80211/rc80211_minstrel_debugfs.c
@@ -52,21 +52,15 @@
 #include <net/mac80211.h>
 #include "rc80211_minstrel.h"
 
-struct minstrel_stats_info {
-        struct minstrel_sta_info *mi;
-        char buf[4096];
-        size_t len;
-};
-
-static int
+int
 minstrel_stats_open(struct inode *inode, struct file *file)
 {
         struct minstrel_sta_info *mi = inode->i_private;
-        struct minstrel_stats_info *ms;
+        struct minstrel_debugfs_info *ms;
         unsigned int i, tp, prob, eprob;
         char *p;
 
-        ms = kmalloc(sizeof(*ms), GFP_KERNEL);
+        ms = kmalloc(sizeof(*ms) + 4096, GFP_KERNEL);
         if (!ms)
                 return -ENOMEM;
 
@@ -106,36 +100,19 @@ minstrel_stats_open(struct inode *inode, struct file *file)
         return 0;
 }
 
-static ssize_t
-minstrel_stats_read(struct file *file, char __user *buf, size_t len, loff_t *o)
+ssize_t
+minstrel_stats_read(struct file *file, char __user *buf, size_t len, loff_t *ppos)
 {
-        struct minstrel_stats_info *ms;
-        char *src;
+        struct minstrel_debugfs_info *ms;
 
         ms = file->private_data;
-        src = ms->buf;
-
-        len = min(len, ms->len);
-        if (len <= *o)
-                return 0;
-
-        src += *o;
-        len -= *o;
-        *o += len;
-
-        if (copy_to_user(buf, src, len))
-                return -EFAULT;
-
-        return len;
+        return simple_read_from_buffer(buf, len, ppos, ms->buf, ms->len);
 }
 
-static int
+int
 minstrel_stats_release(struct inode *inode, struct file *file)
 {
-        struct minstrel_stats_info *ms = file->private_data;
-
-        kfree(ms);
-
+        kfree(file->private_data);
         return 0;
 }
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 13fcd2d17c6b..c0ad7e879a6e 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -38,7 +38,7 @@ static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
 {
         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
                 if (likely(skb->len > FCS_LEN))
-                        skb_trim(skb, skb->len - FCS_LEN);
+                        __pskb_trim(skb, skb->len - FCS_LEN);
                 else {
                         /* driver bug */
                         WARN_ON(1);
@@ -178,14 +178,6 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                 pos++;
         }
 
-        /* IEEE80211_RADIOTAP_DBM_ANTNOISE */
-        if (local->hw.flags & IEEE80211_HW_NOISE_DBM) {
-                *pos = status->noise;
-                rthdr->it_present |=
-                        cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTNOISE);
-                pos++;
-        }
-
         /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
 
         /* IEEE80211_RADIOTAP_ANTENNA */
@@ -235,6 +227,12 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
                 present_fcs_len = FCS_LEN;
 
+        /* make sure hdr->frame_control is on the linear part */
+        if (!pskb_may_pull(origskb, 2)) {
+                dev_kfree_skb(origskb);
+                return NULL;
+        }
+
         if (!local->monitors) {
                 if (should_drop_frame(origskb, present_fcs_len)) {
                         dev_kfree_skb(origskb);
@@ -722,14 +720,16 @@ static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
 
         tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
 
-        if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL)
-                goto dont_reorder;
+        spin_lock(&sta->lock);
+
+        if (!sta->ampdu_mlme.tid_active_rx[tid])
+                goto dont_reorder_unlock;
 
         tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
 
         /* qos null data frames are excluded */
         if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
-                goto dont_reorder;
+                goto dont_reorder_unlock;
 
         /* new, potentially un-ordered, ampdu frame - process it */
 
@@ -741,15 +741,20 @@ static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
         /* if this mpdu is fragmented - terminate rx aggregation session */
         sc = le16_to_cpu(hdr->seq_ctrl);
         if (sc & IEEE80211_SCTL_FRAG) {
-                ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
-                        tid, 0, WLAN_REASON_QSTA_REQUIRE_SETUP);
+                spin_unlock(&sta->lock);
+                __ieee80211_stop_rx_ba_session(sta, tid, WLAN_BACK_RECIPIENT,
+                                               WLAN_REASON_QSTA_REQUIRE_SETUP);
                 dev_kfree_skb(skb);
                 return;
         }
 
-        if (ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb, frames))
+        if (ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb, frames)) {
+                spin_unlock(&sta->lock);
                 return;
+        }
 
+ dont_reorder_unlock:
+        spin_unlock(&sta->lock);
  dont_reorder:
         __skb_queue_tail(frames, skb);
 }
@@ -815,7 +820,7 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
 {
         struct sk_buff *skb = rx->skb;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        struct ieee80211_hdr *hdr;
         int keyidx;
         int hdrlen;
         ieee80211_rx_result result = RX_DROP_UNUSABLE;
@@ -856,6 +861,11 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
                 return RX_CONTINUE;
 
+        if (skb_linearize(rx->skb))
+                return RX_DROP_UNUSABLE;
+
+        hdr = (struct ieee80211_hdr *)skb->data;
+
         /* start without a key */
         rx->key = NULL;
 
@@ -1077,7 +1087,6 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
         sta->rx_fragments++;
         sta->rx_bytes += rx->skb->len;
         sta->last_signal = status->signal;
-        sta->last_noise = status->noise;
 
         /*
          * Change STA power saving mode only at the end of a frame
@@ -1240,6 +1249,9 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
         }
         I802_DEBUG_INC(rx->local->rx_handlers_fragments);
 
+        if (skb_linearize(rx->skb))
+                return RX_DROP_UNUSABLE;
+
         seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
 
         if (frag == 0) {
@@ -1405,21 +1417,24 @@ static int
 ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
         __le16 fc = hdr->frame_control;
-        int res;
 
-        res = ieee80211_drop_unencrypted(rx, fc);
-        if (unlikely(res))
-                return res;
+        /*
+         * Pass through unencrypted frames if the hardware has
+         * decrypted them already.
+         */
+        if (status->flag & RX_FLAG_DECRYPTED)
+                return 0;
 
         if (rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP)) {
-                if (unlikely(ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
+                if (unlikely(!ieee80211_has_protected(fc) &&
+                             ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
                              rx->key))
                         return -EACCES;
                 /* BIP does not use Protected field, so need to check MMIE */
                 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
-                             ieee80211_get_mmie_keyidx(rx->skb) < 0 &&
-                             rx->key))
+                             ieee80211_get_mmie_keyidx(rx->skb) < 0))
                         return -EACCES;
                 /*
                  * When using MFP, Action frames are not allowed prior to
@@ -1597,6 +1612,9 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
         skb->dev = dev;
         __skb_queue_head_init(&frame_list);
 
+        if (skb_linearize(skb))
+                return RX_DROP_UNUSABLE;
+
         ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
                                  rx->sdata->vif.type,
                                  rx->local->hw.extra_tx_headroom);
@@ -1795,10 +1813,12 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
         if (ieee80211_is_back_req(bar->frame_control)) {
                 if (!rx->sta)
                         return RX_DROP_MONITOR;
+                spin_lock(&rx->sta->lock);
                 tid = le16_to_cpu(bar->control) >> 12;
-                if (rx->sta->ampdu_mlme.tid_state_rx[tid]
-                                        != HT_AGG_STATE_OPERATIONAL)
+                if (!rx->sta->ampdu_mlme.tid_active_rx[tid]) {
+                        spin_unlock(&rx->sta->lock);
                         return RX_DROP_MONITOR;
+                }
                 tid_agg_rx = rx->sta->ampdu_mlme.tid_rx[tid];
 
                 start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4;
@@ -1812,6 +1832,7 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
                 ieee80211_release_reorder_frames(hw, tid_agg_rx, start_seq_num,
                                                  frames);
                 kfree_skb(skb);
+                spin_unlock(&rx->sta->lock);
                 return RX_QUEUED;
         }
 
@@ -2371,29 +2392,42 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_hdr *hdr;
+        __le16 fc;
         struct ieee80211_rx_data rx;
         int prepares;
         struct ieee80211_sub_if_data *prev = NULL;
         struct sk_buff *skb_new;
         struct sta_info *sta, *tmp;
         bool found_sta = false;
+        int err = 0;
 
-        hdr = (struct ieee80211_hdr *)skb->data;
+        fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
         memset(&rx, 0, sizeof(rx));
         rx.skb = skb;
         rx.local = local;
 
-        if (ieee80211_is_data(hdr->frame_control) || ieee80211_is_mgmt(hdr->frame_control))
+        if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
                 local->dot11ReceivedFragmentCount++;
 
         if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
                      test_bit(SCAN_OFF_CHANNEL, &local->scanning)))
                 rx.flags |= IEEE80211_RX_IN_SCAN;
 
+        if (ieee80211_is_mgmt(fc))
+                err = skb_linearize(skb);
+        else
+                err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
+
+        if (err) {
+                dev_kfree_skb(skb);
+                return;
+        }
+
+        hdr = (struct ieee80211_hdr *)skb->data;
         ieee80211_parse_qos(&rx);
         ieee80211_verify_alignment(&rx);
 
-        if (ieee80211_is_data(hdr->frame_control)) {
+        if (ieee80211_is_data(fc)) {
                 for_each_sta_info(local, hdr->addr2, sta, tmp) {
                         rx.sta = sta;
                         found_sta = true;
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index b822dce97867..75a85978c3b3 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -14,6 +14,8 @@
 
 #include <linux/if_arp.h>
 #include <linux/rtnetlink.h>
+#include <linux/pm_qos_params.h>
+#include <net/sch_generic.h>
 #include <net/mac80211.h>
 
 #include "ieee80211_i.h"
@@ -321,6 +323,7 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
 
         ieee80211_offchannel_stop_beaconing(local);
 
+        local->leave_oper_channel_time = 0;
         local->next_scan_state = SCAN_DECISION;
         local->scan_channel_idx = 0;
 
@@ -425,11 +428,28 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
         return rc;
 }
 
+static unsigned long
+ieee80211_scan_get_channel_time(struct ieee80211_channel *chan)
+{
+        /*
+         * TODO: channel switching also consumes quite some time,
+         * add that delay as well to get a better estimation
+         */
+        if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
+                return IEEE80211_PASSIVE_CHANNEL_TIME;
+        return IEEE80211_PROBE_DELAY + IEEE80211_CHANNEL_TIME;
+}
+
 static int ieee80211_scan_state_decision(struct ieee80211_local *local,
                                          unsigned long *next_delay)
 {
         bool associated = false;
+        bool tx_empty = true;
+        bool bad_latency;
+        bool listen_int_exceeded;
+        unsigned long min_beacon_int = 0;
         struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_channel *next_chan;
 
         /* if no more bands/channels left, complete scan and advance to the idle state */
         if (local->scan_channel_idx >= local->scan_req->n_channels) {
@@ -437,7 +457,11 @@ static int ieee80211_scan_state_decision(struct ieee80211_local *local,
                 return 1;
         }
 
-        /* check if at least one STA interface is associated */
+        /*
+         * check if at least one STA interface is associated,
+         * check if at least one STA interface has pending tx frames
+         * and grab the lowest used beacon interval
+         */
         mutex_lock(&local->iflist_mtx);
         list_for_each_entry(sdata, &local->interfaces, list) {
                 if (!ieee80211_sdata_running(sdata))
@@ -446,7 +470,16 @@ static int ieee80211_scan_state_decision(struct ieee80211_local *local,
                 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                         if (sdata->u.mgd.associated) {
                                 associated = true;
-                                break;
+
+                                if (sdata->vif.bss_conf.beacon_int <
+                                    min_beacon_int || min_beacon_int == 0)
+                                        min_beacon_int =
+                                                sdata->vif.bss_conf.beacon_int;
+
+                                if (!qdisc_all_tx_empty(sdata->dev)) {
+                                        tx_empty = false;
+                                        break;
+                                }
                         }
                 }
         }
@@ -455,11 +488,34 @@ static int ieee80211_scan_state_decision(struct ieee80211_local *local,
         if (local->scan_channel) {
                 /*
                  * we're currently scanning a different channel, let's
-                 * switch back to the operating channel now if at least
-                 * one interface is associated. Otherwise just scan the
-                 * next channel
+                 * see if we can scan another channel without interfering
+                 * with the current traffic situation.
+                 *
+                 * Since we don't know if the AP has pending frames for us
+                 * we can only check for our tx queues and use the current
+                 * pm_qos requirements for rx. Hence, if no tx traffic occurs
+                 * at all we will scan as many channels in a row as the pm_qos
+                 * latency allows us to. Additionally we also check for the
+                 * currently negotiated listen interval to prevent losing
+                 * frames unnecessarily.
+                 *
+                 * Otherwise switch back to the operating channel.
                  */
-                if (associated)
+                next_chan = local->scan_req->channels[local->scan_channel_idx];
+
+                bad_latency = time_after(jiffies +
+                                ieee80211_scan_get_channel_time(next_chan),
+                                local->leave_oper_channel_time +
+                                usecs_to_jiffies(pm_qos_requirement(PM_QOS_NETWORK_LATENCY)));
+
+                listen_int_exceeded = time_after(jiffies +
+                                ieee80211_scan_get_channel_time(next_chan),
+                                local->leave_oper_channel_time +
+                                usecs_to_jiffies(min_beacon_int * 1024) *
+                                local->hw.conf.listen_interval);
+
+                if (associated && ( !tx_empty || bad_latency ||
+                    listen_int_exceeded))
                         local->next_scan_state = SCAN_ENTER_OPER_CHANNEL;
                 else
                         local->next_scan_state = SCAN_SET_CHANNEL;
@@ -491,6 +547,9 @@ static void ieee80211_scan_state_leave_oper_channel(struct ieee80211_local *loca
         else
                 *next_delay = HZ / 10;
 
+        /* remember when we left the operating channel */
+        local->leave_oper_channel_time = jiffies;
+
         /* advance to the next channel to be scanned */
         local->next_scan_state = SCAN_SET_CHANNEL;
 }
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index fb12cec4d333..4de987cbda1c 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -250,9 +250,6 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
                  * enable session_timer's data differentiation. refer to
                  * sta_rx_agg_session_timer_expired for useage */
                 sta->timer_to_tid[i] = i;
-                /* rx */
-                sta->ampdu_mlme.tid_state_rx[i] = HT_AGG_STATE_IDLE;
-                sta->ampdu_mlme.tid_rx[i] = NULL;
                 /* tx */
                 sta->ampdu_mlme.tid_state_tx[i] = HT_AGG_STATE_IDLE;
                 sta->ampdu_mlme.tid_tx[i] = NULL;
@@ -619,7 +616,7 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
         struct ieee80211_sub_if_data *sdata;
         struct sk_buff *skb;
         unsigned long flags;
-        int ret, i;
+        int ret;
 
         might_sleep();
 
@@ -629,6 +626,15 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
         local = sta->local;
         sdata = sta->sdata;
 
+        /*
+         * Before removing the station from the driver and
+         * rate control, it might still start new aggregation
+         * sessions -- block that to make sure the tear-down
+         * will be sufficient.
+         */
+        set_sta_flags(sta, WLAN_STA_BLOCK_BA);
+        ieee80211_sta_tear_down_BA_sessions(sta);
+
         spin_lock_irqsave(&local->sta_lock, flags);
         ret = sta_info_hash_del(local, sta);
         /* this might still be the pending list ... which is fine */
@@ -645,9 +651,6 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
                  * may mean it is removed from hardware which requires that
                  * the key->sta pointer is still valid, so flush the key todo
                  * list here.
-                 *
-                 * ieee80211_key_todo() will synchronize_rcu() so after this
-                 * nothing can reference this sta struct any more.
                  */
                 ieee80211_key_todo();
 
@@ -679,11 +682,17 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
                 sdata = sta->sdata;
         }
 
+        /*
+         * At this point, after we wait for an RCU grace period,
+         * neither mac80211 nor the driver can reference this
+         * sta struct any more except by still existing timers
+         * associated with this station that we clean up below.
+         */
+        synchronize_rcu();
+
 #ifdef CONFIG_MAC80211_MESH
-        if (ieee80211_vif_is_mesh(&sdata->vif)) {
+        if (ieee80211_vif_is_mesh(&sdata->vif))
                 mesh_accept_plinks_update(sdata);
-                del_timer(&sta->plink_timer);
-        }
 #endif
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
@@ -710,50 +719,6 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
         while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL)
                 dev_kfree_skb_any(skb);
 
-        for (i = 0; i <  STA_TID_NUM; i++) {
-                struct tid_ampdu_rx *tid_rx;
-                struct tid_ampdu_tx *tid_tx;
-
-                spin_lock_bh(&sta->lock);
-                tid_rx = sta->ampdu_mlme.tid_rx[i];
-                /* Make sure timer won't free the tid_rx struct, see below */
-                if (tid_rx)
-                        tid_rx->shutdown = true;
-
-                spin_unlock_bh(&sta->lock);
-
-                /*
-                 * Outside spinlock - shutdown is true now so that the timer
-                 * won't free tid_rx, we have to do that now. Can't let the
-                 * timer do it because we have to sync the timer outside the
-                 * lock that it takes itself.
-                 */
-                if (tid_rx) {
-                        del_timer_sync(&tid_rx->session_timer);
-                        kfree(tid_rx);
-                }
-
-                /*
-                 * No need to do such complications for TX agg sessions, the
-                 * path leading to freeing the tid_tx struct goes via a call
-                 * from the driver, and thus needs to look up the sta struct
-                 * again, which cannot be found when we get here. Hence, we
-                 * just need to delete the timer and free the aggregation
-                 * info; we won't be telling the peer about it then but that
-                 * doesn't matter if we're not talking to it again anyway.
-                 */
-                tid_tx = sta->ampdu_mlme.tid_tx[i];
-                if (tid_tx) {
-                        del_timer_sync(&tid_tx->addba_resp_timer);
-                        /*
-                         * STA removed while aggregation session being
-                         * started? Bit odd, but purge frames anyway.
-                         */
-                        skb_queue_purge(&tid_tx->pending);
-                        kfree(tid_tx);
-                }
-        }
-
         __sta_info_free(local, sta);
 
         return 0;
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 822d84522937..48a5e80957f0 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -35,8 +35,8 @@
  *      IEEE80211_TX_CTL_CLEAR_PS_FILT control flag) when the next
  *      frame to this station is transmitted.
  * @WLAN_STA_MFP: Management frame protection is used with this STA.
- * @WLAN_STA_SUSPEND: Set/cleared during a suspend/resume cycle.
- *      Used to deny ADDBA requests (both TX and RX).
+ * @WLAN_STA_BLOCK_BA: Used to deny ADDBA requests (both TX and RX)
+ *      during suspend/resume and station removal.
  * @WLAN_STA_PS_DRIVER: driver requires keeping this station in
  *      power-save mode logically to flush frames that might still
  *      be in the queues
@@ -57,7 +57,7 @@ enum ieee80211_sta_info_flags {
         WLAN_STA_WDS            = 1<<7,
         WLAN_STA_CLEAR_PS_FILT  = 1<<9,
         WLAN_STA_MFP            = 1<<10,
-        WLAN_STA_SUSPEND        = 1<<11,
+        WLAN_STA_BLOCK_BA       = 1<<11,
         WLAN_STA_PS_DRIVER      = 1<<12,
         WLAN_STA_PSPOLL         = 1<<13,
         WLAN_STA_DISASSOC       = 1<<14,
@@ -106,7 +106,6 @@ struct tid_ampdu_tx {
  * @buf_size: buffer size for incoming A-MPDUs
  * @timeout: reset timer value (in TUs).
  * @dialog_token: dialog token for aggregation session
- * @shutdown: this session is being shut down due to STA removal
  */
 struct tid_ampdu_rx {
         struct sk_buff **reorder_buf;
@@ -118,7 +117,6 @@ struct tid_ampdu_rx {
         u16 buf_size;
         u16 timeout;
         u8 dialog_token;
-        bool shutdown;
 };
 
 /**
@@ -156,7 +154,7 @@ enum plink_state {
  */
 struct sta_ampdu_mlme {
         /* rx */
-        u8 tid_state_rx[STA_TID_NUM];
+        bool tid_active_rx[STA_TID_NUM];
         struct tid_ampdu_rx *tid_rx[STA_TID_NUM];
         /* tx */
         u8 tid_state_tx[STA_TID_NUM];
@@ -200,7 +198,6 @@ struct sta_ampdu_mlme {
  * @rx_fragments: number of received MPDUs
  * @rx_dropped: number of dropped MPDUs from this STA
  * @last_signal: signal of last received frame from this STA
- * @last_noise: noise of last received frame from this STA
  * @last_seq_ctrl: last received seq/frag number from this STA (per RX queue)
  * @tx_filtered_count: number of frames the hardware filtered for this STA
  * @tx_retry_failed: number of frames that failed retry
@@ -267,7 +264,6 @@ struct sta_info {
         unsigned long rx_fragments;
         unsigned long rx_dropped;
         int last_signal;
-        int last_noise;
         __le16 last_seq_ctrl[NUM_RX_DATA_QUEUES];
 
         /* Updated from TX status path only, no locking requirements */
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 56d5b9a6ec5b..11805a3a626f 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -171,7 +171,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         struct net_device *prev_dev = NULL;
         struct sta_info *sta, *tmp;
         int retry_count = -1, i;
-        bool injected;
+        bool send_to_cooked;
 
         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
                 /* the HW cannot have attempted that rate */
@@ -296,11 +296,15 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         /* this was a transmitted frame, but now we want to reuse it */
         skb_orphan(skb);
 
+        /* Need to make a copy before skb->cb gets cleared */
+        send_to_cooked = !!(info->flags & IEEE80211_TX_CTL_INJECTED) ||
+                        (type != IEEE80211_FTYPE_DATA);
+
         /*
          * This is a bit racy but we can avoid a lot of work
          * with this test...
          */
-        if (!local->monitors && !local->cooked_mntrs) {
+        if (!local->monitors && (!send_to_cooked || !local->cooked_mntrs)) {
                 dev_kfree_skb(skb);
                 return;
         }
@@ -345,9 +349,6 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         /* for now report the total retry_count */
         rthdr->data_retries = retry_count;
 
-        /* Need to make a copy before skb->cb gets cleared */
-        injected = !!(info->flags & IEEE80211_TX_CTL_INJECTED);
-
         /* XXX: is this sufficient for BPF? */
         skb_set_mac_header(skb, 0);
         skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -362,8 +363,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                                 continue;
 
                         if ((sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) &&
-                            !injected &&
-                            (type == IEEE80211_FTYPE_DATA))
+                            !send_to_cooked)
                                 continue;
 
                         if (prev_dev) {
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index cfc473e1b050..2cb77267f733 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -513,6 +513,8 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
         else if (tx->sta && (key = rcu_dereference(tx->sta->key)))
                 tx->key = key;
         else if (ieee80211_is_mgmt(hdr->frame_control) &&
+                 is_multicast_ether_addr(hdr->addr1) &&
+                 ieee80211_is_robust_mgmt_frame(hdr) &&
                  (key = rcu_dereference(tx->sdata->default_mgmt_key)))
                 tx->key = key;
         else if ((key = rcu_dereference(tx->sdata->default_key)))
@@ -1142,13 +1144,12 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
 
         if (tx->sta && ieee80211_is_data_qos(hdr->frame_control) &&
             (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION)) {
-                unsigned long flags;
                 struct tid_ampdu_tx *tid_tx;
 
                 qc = ieee80211_get_qos_ctl(hdr);
                 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
 
-                spin_lock_irqsave(&tx->sta->lock, flags);
+                spin_lock(&tx->sta->lock);
                 /*
                  * XXX: This spinlock could be fairly expensive, but see the
                  *      comment in agg-tx.c:ieee80211_agg_tx_operational().
@@ -1173,7 +1174,7 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
                         info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
                         __skb_queue_tail(&tid_tx->pending, skb);
                 }
-                spin_unlock_irqrestore(&tx->sta->lock, flags);
+                spin_unlock(&tx->sta->lock);
 
                 if (unlikely(queued))
                         return TX_QUEUED;
@@ -2011,14 +2012,12 @@ void ieee80211_tx_pending(unsigned long data)
                 while (!skb_queue_empty(&local->pending[i])) {
                         struct sk_buff *skb = __skb_dequeue(&local->pending[i]);
                         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-                        struct ieee80211_sub_if_data *sdata;
 
                         if (WARN_ON(!info->control.vif)) {
                                 kfree_skb(skb);
                                 continue;
                         }
 
-                        sdata = vif_to_sdata(info->control.vif);
                         spin_unlock_irqrestore(&local->queue_stop_reason_lock,
                                                 flags);
 
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 53af57047435..ad9009f717ed 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -796,6 +796,11 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata)
 
                 drv_conf_tx(local, queue, &qparam);
         }
+
+        /* after reinitialize QoS TX queues setting to default,
+         * disable QoS at all */
+        local->hw.conf.flags &= ~IEEE80211_CONF_QOS;
+        drv_config(local, IEEE80211_CONF_CHANGE_QOS);
 }
 
 void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
@@ -1135,7 +1140,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
 
         if (hw->flags & IEEE80211_HW_AMPDU_AGGREGATION) {
                 list_for_each_entry_rcu(sta, &local->sta_list, list) {
-                        clear_sta_flags(sta, WLAN_STA_SUSPEND);
+                        clear_sta_flags(sta, WLAN_STA_BLOCK_BA);
                 }
         }
 
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index c218e07e5caf..7ae58b5b5a08 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -628,6 +628,49 @@ static ssize_t rfkill_persistent_show(struct device *dev,
         return sprintf(buf, "%d\n", rfkill->persistent);
 }
 
+static ssize_t rfkill_hard_show(struct device *dev,
+                                 struct device_attribute *attr,
+                                 char *buf)
+{
+        struct rfkill *rfkill = to_rfkill(dev);
+
+        return sprintf(buf, "%d\n", (rfkill->state & RFKILL_BLOCK_HW) ? 1 : 0 );
+}
+
+static ssize_t rfkill_soft_show(struct device *dev,
+                                 struct device_attribute *attr,
+                                 char *buf)
+{
+        struct rfkill *rfkill = to_rfkill(dev);
+
+        return sprintf(buf, "%d\n", (rfkill->state & RFKILL_BLOCK_SW) ? 1 : 0 );
+}
+
+static ssize_t rfkill_soft_store(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t count)
+{
+        struct rfkill *rfkill = to_rfkill(dev);
+        unsigned long state;
+        int err;
+
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
+        err = strict_strtoul(buf, 0, &state);
+        if (err)
+                return err;
+
+        if (state > 1 )
+                return -EINVAL;
+
+        mutex_lock(&rfkill_global_mutex);
+        rfkill_set_block(rfkill, state);
+        mutex_unlock(&rfkill_global_mutex);
+
+        return err ?: count;
+}
+
 static u8 user_state_from_blocked(unsigned long state)
 {
         if (state & RFKILL_BLOCK_HW)
@@ -643,14 +686,8 @@ static ssize_t rfkill_state_show(struct device *dev,
                                  char *buf)
 {
         struct rfkill *rfkill = to_rfkill(dev);
-        unsigned long flags;
-        u32 state;
-
-        spin_lock_irqsave(&rfkill->lock, flags);
-        state = rfkill->state;
-        spin_unlock_irqrestore(&rfkill->lock, flags);
 
-        return sprintf(buf, "%d\n", user_state_from_blocked(state));
+        return sprintf(buf, "%d\n", user_state_from_blocked(rfkill->state));
 }
 
 static ssize_t rfkill_state_store(struct device *dev,
@@ -700,6 +737,8 @@ static struct device_attribute rfkill_dev_attrs[] = {
         __ATTR(persistent, S_IRUGO, rfkill_persistent_show, NULL),
         __ATTR(state, S_IRUGO|S_IWUSR, rfkill_state_show, rfkill_state_store),
         __ATTR(claim, S_IRUGO|S_IWUSR, rfkill_claim_show, rfkill_claim_store),
+        __ATTR(soft, S_IRUGO|S_IWUSR, rfkill_soft_show, rfkill_soft_store),
+        __ATTR(hard, S_IRUGO, rfkill_hard_show, NULL),
         __ATTR_NULL
 };
 
diff --git a/net/wireless/core.h b/net/wireless/core.h
index d52da913145a..b2234b436ead 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -293,13 +293,15 @@ int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
                          const u8 *bssid,
                          const u8 *ssid, int ssid_len,
                          const u8 *ie, int ie_len,
-                         const u8 *key, int key_len, int key_idx);
+                         const u8 *key, int key_len, int key_idx,
+                         bool local_state_change);
 int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
                        struct net_device *dev, struct ieee80211_channel *chan,
                        enum nl80211_auth_type auth_type, const u8 *bssid,
                        const u8 *ssid, int ssid_len,
                        const u8 *ie, int ie_len,
-                       const u8 *key, int key_len, int key_idx);
+                       const u8 *key, int key_len, int key_idx,
+                       bool local_state_change);
 int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
                           struct net_device *dev,
                           struct ieee80211_channel *chan,
@@ -315,13 +317,16 @@ int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
                         struct cfg80211_crypto_settings *crypt);
 int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
                            struct net_device *dev, const u8 *bssid,
-                           const u8 *ie, int ie_len, u16 reason);
+                           const u8 *ie, int ie_len, u16 reason,
+                           bool local_state_change);
 int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
                          struct net_device *dev, const u8 *bssid,
-                         const u8 *ie, int ie_len, u16 reason);
+                         const u8 *ie, int ie_len, u16 reason,
+                         bool local_state_change);
 int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
                            struct net_device *dev, const u8 *bssid,
-                           const u8 *ie, int ie_len, u16 reason);
+                           const u8 *ie, int ie_len, u16 reason,
+                           bool local_state_change);
 void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
                         struct net_device *dev);
 void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 62bc8855e123..387dd2a27d2f 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -377,7 +377,8 @@ int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
                          const u8 *bssid,
                          const u8 *ssid, int ssid_len,
                          const u8 *ie, int ie_len,
-                         const u8 *key, int key_len, int key_idx)
+                         const u8 *key, int key_len, int key_idx,
+                         bool local_state_change)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_auth_request req;
@@ -407,6 +408,7 @@ int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
 
         memset(&req, 0, sizeof(req));
 
+        req.local_state_change = local_state_change;
         req.ie = ie;
         req.ie_len = ie_len;
         req.auth_type = auth_type;
@@ -433,12 +435,18 @@ int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
                 goto out;
         }
 
-        wdev->authtry_bsses[slot] = bss;
+        if (local_state_change)
+                wdev->auth_bsses[slot] = bss;
+        else
+                wdev->authtry_bsses[slot] = bss;
         cfg80211_hold_bss(bss);
 
         err = rdev->ops->auth(&rdev->wiphy, dev, &req);
         if (err) {
-                wdev->authtry_bsses[slot] = NULL;
+                if (local_state_change)
+                        wdev->auth_bsses[slot] = NULL;
+                else
+                        wdev->authtry_bsses[slot] = NULL;
                 cfg80211_unhold_bss(bss);
         }
 
@@ -453,14 +461,15 @@ int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
                        enum nl80211_auth_type auth_type, const u8 *bssid,
                        const u8 *ssid, int ssid_len,
                        const u8 *ie, int ie_len,
-                       const u8 *key, int key_len, int key_idx)
+                       const u8 *key, int key_len, int key_idx,
+                       bool local_state_change)
 {
         int err;
 
         wdev_lock(dev->ieee80211_ptr);
         err = __cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
                                    ssid, ssid_len, ie, ie_len,
-                                   key, key_len, key_idx);
+                                   key, key_len, key_idx, local_state_change);
         wdev_unlock(dev->ieee80211_ptr);
 
         return err;
@@ -554,7 +563,8 @@ int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
 
 int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
                            struct net_device *dev, const u8 *bssid,
-                           const u8 *ie, int ie_len, u16 reason)
+                           const u8 *ie, int ie_len, u16 reason,
+                           bool local_state_change)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_deauth_request req;
@@ -564,6 +574,7 @@ int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
 
         memset(&req, 0, sizeof(req));
         req.reason_code = reason;
+        req.local_state_change = local_state_change;
         req.ie = ie;
         req.ie_len = ie_len;
         if (wdev->current_bss &&
@@ -590,13 +601,15 @@ int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
 
 int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
                          struct net_device *dev, const u8 *bssid,
-                         const u8 *ie, int ie_len, u16 reason)
+                         const u8 *ie, int ie_len, u16 reason,
+                         bool local_state_change)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err;
 
         wdev_lock(wdev);
-        err = __cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason);
+        err = __cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason,
+                                     local_state_change);
         wdev_unlock(wdev);
 
         return err;
@@ -604,7 +617,8 @@ int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
 
 static int __cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
                                     struct net_device *dev, const u8 *bssid,
-                                    const u8 *ie, int ie_len, u16 reason)
+                                    const u8 *ie, int ie_len, u16 reason,
+                                    bool local_state_change)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_disassoc_request req;
@@ -619,6 +633,7 @@ static int __cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
 
         memset(&req, 0, sizeof(req));
         req.reason_code = reason;
+        req.local_state_change = local_state_change;
         req.ie = ie;
         req.ie_len = ie_len;
         if (memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0)
@@ -631,13 +646,15 @@ static int __cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
 
 int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
                            struct net_device *dev, const u8 *bssid,
-                           const u8 *ie, int ie_len, u16 reason)
+                           const u8 *ie, int ie_len, u16 reason,
+                           bool local_state_change)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err;
 
         wdev_lock(wdev);
-        err = __cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason);
+        err = __cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason,
+                                       local_state_change);
         wdev_unlock(wdev);
 
         return err;
@@ -894,3 +911,16 @@ void cfg80211_action_tx_status(struct net_device *dev, u64 cookie,
         nl80211_send_action_tx_status(rdev, dev, cookie, buf, len, ack, gfp);
 }
 EXPORT_SYMBOL(cfg80211_action_tx_status);
+
+void cfg80211_cqm_rssi_notify(struct net_device *dev,
+                              enum nl80211_cqm_rssi_threshold_event rssi_event,
+                              gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        /* Indicate roaming trigger event to user space */
+        nl80211_send_cqm_rssi_notify(rdev, dev, rssi_event, gfp);
+}
+EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index e447db04cf76..df5505b3930c 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -149,6 +149,8 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
                                  .len = IEEE80211_MAX_DATA_LEN },
         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
+        [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
+        [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 };
 
 /* policy for the attributes */
@@ -2095,7 +2097,8 @@ static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
                 goto out_rtnl;
 
         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
-            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
                 err = -EINVAL;
                 goto out;
         }
@@ -3391,6 +3394,7 @@ static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
         int err, ssid_len, ie_len = 0;
         enum nl80211_auth_type auth_type;
         struct key_parse key;
+        bool local_state_change;
 
         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
                 return -EINVAL;
@@ -3469,9 +3473,12 @@ static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
                 goto out;
         }
 
+        local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
+
         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
                                  ssid, ssid_len, ie, ie_len,
-                                 key.p.key, key.p.key_len, key.idx);
+                                 key.p.key, key.p.key_len, key.idx,
+                                 local_state_change);
 
 out:
         cfg80211_unlock_rdev(rdev);
@@ -3648,6 +3655,7 @@ static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
         const u8 *ie = NULL, *bssid;
         int err, ie_len = 0;
         u16 reason_code;
+        bool local_state_change;
 
         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
                 return -EINVAL;
@@ -3693,7 +3701,10 @@ static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
         }
 
-        err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code);
+        local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
+
+        err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
+                                   local_state_change);
 
 out:
         cfg80211_unlock_rdev(rdev);
@@ -3710,6 +3721,7 @@ static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
         const u8 *ie = NULL, *bssid;
         int err, ie_len = 0;
         u16 reason_code;
+        bool local_state_change;
 
         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
                 return -EINVAL;
@@ -3755,7 +3767,10 @@ static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
         }
 
-        err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code);
+        local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
+
+        err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
+                                     local_state_change);
 
 out:
         cfg80211_unlock_rdev(rdev);
@@ -4778,6 +4793,84 @@ unlock_rtnl:
         return err;
 }
 
+static struct nla_policy
+nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
+        [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
+        [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
+        [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
+};
+
+static int nl80211_set_cqm_rssi(struct genl_info *info,
+                                s32 threshold, u32 hysteresis)
+{
+        struct cfg80211_registered_device *rdev;
+        struct wireless_dev *wdev;
+        struct net_device *dev;
+        int err;
+
+        if (threshold > 0)
+                return -EINVAL;
+
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
+        if (err)
+                goto unlock_rdev;
+
+        wdev = dev->ieee80211_ptr;
+
+        if (!rdev->ops->set_cqm_rssi_config) {
+                err = -EOPNOTSUPP;
+                goto unlock_rdev;
+        }
+
+        if (wdev->iftype != NL80211_IFTYPE_STATION) {
+                err = -EOPNOTSUPP;
+                goto unlock_rdev;
+        }
+
+        err = rdev->ops->set_cqm_rssi_config(wdev->wiphy, dev,
+                                             threshold, hysteresis);
+
+unlock_rdev:
+        cfg80211_unlock_rdev(rdev);
+        dev_put(dev);
+        rtnl_unlock();
+
+        return err;
+}
+
+static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
+{
+        struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
+        struct nlattr *cqm;
+        int err;
+
+        cqm = info->attrs[NL80211_ATTR_CQM];
+        if (!cqm) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
+                               nl80211_attr_cqm_policy);
+        if (err)
+                goto out;
+
+        if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
+            attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
+                s32 threshold;
+                u32 hysteresis;
+                threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
+                hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
+                err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
+        } else
+                err = -EINVAL;
+
+out:
+        return err;
+}
+
 static struct genl_ops nl80211_ops[] = {
         {
                 .cmd = NL80211_CMD_GET_WIPHY,
@@ -5082,6 +5175,12 @@ static struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 /* can be retrieved by unprivileged users */
         },
+        {
+                .cmd = NL80211_CMD_SET_CQM,
+                .doit = nl80211_set_cqm,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
 };
 
 static struct genl_multicast_group nl80211_mlme_mcgrp = {
@@ -5832,6 +5931,52 @@ void nl80211_send_action_tx_status(struct cfg80211_registered_device *rdev,
         nlmsg_free(msg);
 }
 
+void
+nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
+                             struct net_device *netdev,
+                             enum nl80211_cqm_rssi_threshold_event rssi_event,
+                             gfp_t gfp)
+{
+        struct sk_buff *msg;
+        struct nlattr *pinfoattr;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+
+        pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
+        if (!pinfoattr)
+                goto nla_put_failure;
+
+        NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
+                    rssi_event);
+
+        nla_nest_end(msg, pinfoattr);
+
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+
 static int nl80211_netlink_notify(struct notifier_block * nb,
                                   unsigned long state,
                                   void *_notify)
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index 4ca511102c6c..2ad7fbc7d9f1 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -82,4 +82,10 @@ void nl80211_send_action_tx_status(struct cfg80211_registered_device *rdev,
                                    const u8 *buf, size_t len, bool ack,
                                    gfp_t gfp);
 
+void
+nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
+                             struct net_device *netdev,
+                             enum nl80211_cqm_rssi_threshold_event rssi_event,
+                             gfp_t gfp);
+
 #endif /* __NET_WIRELESS_NL80211_H */
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 81fcafc60150..496348c48506 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2355,10 +2355,10 @@ static void print_regdomain(const struct ieee80211_regdomain *rd)
                                         rdev->country_ie_alpha2[1]);
                         } else
                                 printk(KERN_INFO "cfg80211: Current regulatory "
-                                        "domain intersected: \n");
+                                        "domain intersected:\n");
                 } else
-                                printk(KERN_INFO "cfg80211: Current regulatory "
-                                        "domain intersected: \n");
+                        printk(KERN_INFO "cfg80211: Current regulatory "
+                                "domain intersected:\n");
         } else if (is_world_regdom(rd->alpha2))
                 printk(KERN_INFO "cfg80211: World regulatory "
                         "domain updated:\n");
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 17fde0da1b08..17465777eb47 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -170,7 +170,7 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
                                             params->ssid, params->ssid_len,
                                             NULL, 0,
                                             params->key, params->key_len,
-                                            params->key_idx);
+                                            params->key_idx, false);
         case CFG80211_CONN_ASSOCIATE_NEXT:
                 BUG_ON(!rdev->ops->assoc);
                 wdev->conn->state = CFG80211_CONN_ASSOCIATING;
@@ -185,12 +185,13 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
                 if (err)
                         __cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
                                                NULL, 0,
-                                               WLAN_REASON_DEAUTH_LEAVING);
+                                               WLAN_REASON_DEAUTH_LEAVING,
+                                               false);
                 return err;
         case CFG80211_CONN_DEAUTH_ASSOC_FAIL:
                 __cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
                                        NULL, 0,
-                                       WLAN_REASON_DEAUTH_LEAVING);
+                                       WLAN_REASON_DEAUTH_LEAVING, false);
                 /* return an error so that we call __cfg80211_connect_result() */
                 return -EINVAL;
         default:
@@ -675,7 +676,8 @@ void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
                                 continue;
                         bssid = wdev->auth_bsses[i]->pub.bssid;
                         ret = __cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0,
-                                                WLAN_REASON_DEAUTH_LEAVING);
+                                                WLAN_REASON_DEAUTH_LEAVING,
+                                                false);
                         WARN(ret, "deauth failed: %d\n", ret);
                 }
         }
@@ -934,7 +936,7 @@ int __cfg80211_disconnect(struct cfg80211_registered_device *rdev,
                 /* wdev->conn->params.bssid must be set if > SCANNING */
                 err = __cfg80211_mlme_deauth(rdev, dev,
                                              wdev->conn->params.bssid,
-                                             NULL, 0, reason);
+                                             NULL, 0, reason, false);
                 if (err)
                         return err;
         } else {
@@ -990,7 +992,8 @@ void cfg80211_sme_disassoc(struct net_device *dev, int idx)
 
         memcpy(bssid, wdev->auth_bsses[idx]->pub.bssid, ETH_ALEN);
         if (__cfg80211_mlme_deauth(rdev, dev, bssid,
-                                   NULL, 0, WLAN_REASON_DEAUTH_LEAVING)) {
+                                   NULL, 0, WLAN_REASON_DEAUTH_LEAVING,
+                                   false)) {
                 /* whatever -- assume gone anyway */
                 cfg80211_unhold_bss(wdev->auth_bsses[idx]);
                 cfg80211_put_bss(&wdev->auth_bsses[idx]->pub);
diff --git a/net/wireless/util.c b/net/wireless/util.c
index be2ab8c59e3a..7acb81b9675d 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -330,11 +330,18 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
                 if (iftype == NL80211_IFTYPE_MESH_POINT) {
                         struct ieee80211s_hdr *meshdr =
                                 (struct ieee80211s_hdr *) (skb->data + hdrlen);
-                        hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
+                        /* make sure meshdr->flags is on the linear part */
+                        if (!pskb_may_pull(skb, hdrlen + 1))
+                                return -1;
                         if (meshdr->flags & MESH_FLAGS_AE_A5_A6) {
-                                memcpy(dst, meshdr->eaddr1, ETH_ALEN);
-                                memcpy(src, meshdr->eaddr2, ETH_ALEN);
+                                skb_copy_bits(skb, hdrlen +
+                                        offsetof(struct ieee80211s_hdr, eaddr1),
+                                        dst, ETH_ALEN);
+                                skb_copy_bits(skb, hdrlen +
+                                        offsetof(struct ieee80211s_hdr, eaddr2),
+                                        src, ETH_ALEN);
                         }
+                        hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
                 }
                 break;
         case cpu_to_le16(IEEE80211_FCTL_FROMDS):
@@ -346,9 +353,14 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
                 if (iftype == NL80211_IFTYPE_MESH_POINT) {
                         struct ieee80211s_hdr *meshdr =
                                 (struct ieee80211s_hdr *) (skb->data + hdrlen);
-                        hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
+                        /* make sure meshdr->flags is on the linear part */
+                        if (!pskb_may_pull(skb, hdrlen + 1))
+                                return -1;
                         if (meshdr->flags & MESH_FLAGS_AE_A4)
-                                memcpy(src, meshdr->eaddr1, ETH_ALEN);
+                                skb_copy_bits(skb, hdrlen +
+                                        offsetof(struct ieee80211s_hdr, eaddr1),
+                                        src, ETH_ALEN);
+                        hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
                 }
                 break;
         case cpu_to_le16(0):
@@ -357,7 +369,7 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
                 break;
         }
 
-        if (unlikely(skb->len - hdrlen < 8))
+        if (!pskb_may_pull(skb, hdrlen + 8))
                 return -1;
 
         payload = skb->data + hdrlen;
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index 5e1656bdf23b..bfcbeee23f9c 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -28,226 +28,226 @@ typedef int (*wext_ioctl_func)(struct net_device *, struct iwreq *,
  * know about.
  */
 static const struct iw_ioctl_description standard_ioctl[] = {
-        [SIOCSIWCOMMIT  - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWCOMMIT)] = {
                 .header_type    = IW_HEADER_TYPE_NULL,
         },
-        [SIOCGIWNAME    - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCGIWNAME)] = {
                 .header_type    = IW_HEADER_TYPE_CHAR,
                 .flags          = IW_DESCR_FLAG_DUMP,
         },
-        [SIOCSIWNWID    - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWNWID)] = {
                 .header_type    = IW_HEADER_TYPE_PARAM,
                 .flags          = IW_DESCR_FLAG_EVENT,
         },
-        [SIOCGIWNWID    - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCGIWNWID)] = {
                 .header_type    = IW_HEADER_TYPE_PARAM,
                 .flags          = IW_DESCR_FLAG_DUMP,
         },
-        [SIOCSIWFREQ    - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWFREQ)] = {
                 .header_type    = IW_HEADER_TYPE_FREQ,
                 .flags          = IW_DESCR_FLAG_EVENT,
         },
-        [SIOCGIWFREQ    - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCGIWFREQ)] = {
                 .header_type    = IW_HEADER_TYPE_FREQ,
                 .flags          = IW_DESCR_FLAG_DUMP,
         },
-        [SIOCSIWMODE    - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWMODE)] = {
                 .header_type    = IW_HEADER_TYPE_UINT,
                 .flags          = IW_DESCR_FLAG_EVENT,
         },
-        [SIOCGIWMODE    - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCGIWMODE)] = {
                 .header_type    = IW_HEADER_TYPE_UINT,
                 .flags          = IW_DESCR_FLAG_DUMP,
         },
-        [SIOCSIWSENS    - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWSENS)] = {
                 .header_type    = IW_HEADER_TYPE_PARAM,
         },
-        [SIOCGIWSENS    - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCGIWSENS)] = {
                 .header_type    = IW_HEADER_TYPE_PARAM,
         },
-        [SIOCSIWRANGE   - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWRANGE)] = {
                 .header_type    = IW_HEADER_TYPE_NULL,
         },
-        [SIOCGIWRANGE   - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCGIWRANGE)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
                 .max_tokens     = sizeof(struct iw_range),
                 .flags          = IW_DESCR_FLAG_DUMP,
         },
-        [SIOCSIWPRIV    - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWPRIV)] = {
                 .header_type    = IW_HEADER_TYPE_NULL,
         },
-        [SIOCGIWPRIV    - SIOCIWFIRST] = { /* (handled directly by us) */
+        [IW_IOCTL_IDX(SIOCGIWPRIV)] = { /* (handled directly by us) */
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = sizeof(struct iw_priv_args),
                 .max_tokens     = 16,
                 .flags          = IW_DESCR_FLAG_NOMAX,
         },
-        [SIOCSIWSTATS   - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWSTATS)] = {
                 .header_type    = IW_HEADER_TYPE_NULL,
         },
-        [SIOCGIWSTATS   - SIOCIWFIRST] = { /* (handled directly by us) */
+        [IW_IOCTL_IDX(SIOCGIWSTATS)] = { /* (handled directly by us) */
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
                 .max_tokens     = sizeof(struct iw_statistics),
                 .flags          = IW_DESCR_FLAG_DUMP,
         },
-        [SIOCSIWSPY     - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWSPY)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = sizeof(struct sockaddr),
                 .max_tokens     = IW_MAX_SPY,
         },
-        [SIOCGIWSPY     - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCGIWSPY)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = sizeof(struct sockaddr) +
                                   sizeof(struct iw_quality),
                 .max_tokens     = IW_MAX_SPY,
         },
-        [SIOCSIWTHRSPY  - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWTHRSPY)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = sizeof(struct iw_thrspy),
                 .min_tokens     = 1,
                 .max_tokens     = 1,
         },
-        [SIOCGIWTHRSPY  - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCGIWTHRSPY)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = sizeof(struct iw_thrspy),
                 .min_tokens     = 1,
                 .max_tokens     = 1,
         },
-        [SIOCSIWAP      - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWAP)] = {
                 .header_type    = IW_HEADER_TYPE_ADDR,
         },
-        [SIOCGIWAP      - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCGIWAP)] = {
                 .header_type    = IW_HEADER_TYPE_ADDR,
                 .flags          = IW_DESCR_FLAG_DUMP,
         },
-        [SIOCSIWMLME    - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWMLME)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
                 .min_tokens     = sizeof(struct iw_mlme),
                 .max_tokens     = sizeof(struct iw_mlme),
         },
-        [SIOCGIWAPLIST  - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCGIWAPLIST)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = sizeof(struct sockaddr) +
                                   sizeof(struct iw_quality),
                 .max_tokens     = IW_MAX_AP,
                 .flags          = IW_DESCR_FLAG_NOMAX,
         },
-        [SIOCSIWSCAN    - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWSCAN)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
                 .min_tokens     = 0,
                 .max_tokens     = sizeof(struct iw_scan_req),
         },
-        [SIOCGIWSCAN    - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCGIWSCAN)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
                 .max_tokens     = IW_SCAN_MAX_DATA,
                 .flags          = IW_DESCR_FLAG_NOMAX,
         },
-        [SIOCSIWESSID   - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWESSID)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
                 .max_tokens     = IW_ESSID_MAX_SIZE,
                 .flags          = IW_DESCR_FLAG_EVENT,
         },
-        [SIOCGIWESSID   - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCGIWESSID)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
                 .max_tokens     = IW_ESSID_MAX_SIZE,
                 .flags          = IW_DESCR_FLAG_DUMP,
         },
-        [SIOCSIWNICKN   - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWNICKN)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
                 .max_tokens     = IW_ESSID_MAX_SIZE,
         },
-        [SIOCGIWNICKN   - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCGIWNICKN)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
                 .max_tokens     = IW_ESSID_MAX_SIZE,
         },
-        [SIOCSIWRATE    - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWRATE)] = {
                 .header_type    = IW_HEADER_TYPE_PARAM,
         },
-        [SIOCGIWRATE    - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCGIWRATE)] = {
                 .header_type    = IW_HEADER_TYPE_PARAM,
         },
-        [SIOCSIWRTS     - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWRTS)] = {
                 .header_type    = IW_HEADER_TYPE_PARAM,
         },
-        [SIOCGIWRTS     - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCGIWRTS)] = {
                 .header_type    = IW_HEADER_TYPE_PARAM,
         },
-        [SIOCSIWFRAG    - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWFRAG)] = {
                 .header_type    = IW_HEADER_TYPE_PARAM,
         },
-        [SIOCGIWFRAG    - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCGIWFRAG)] = {
                 .header_type    = IW_HEADER_TYPE_PARAM,
         },
-        [SIOCSIWTXPOW   - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWTXPOW)] = {
                 .header_type    = IW_HEADER_TYPE_PARAM,
         },
-        [SIOCGIWTXPOW   - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCGIWTXPOW)] = {
                 .header_type    = IW_HEADER_TYPE_PARAM,
         },
-        [SIOCSIWRETRY   - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWRETRY)] = {
                 .header_type    = IW_HEADER_TYPE_PARAM,
         },
-        [SIOCGIWRETRY   - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCGIWRETRY)] = {
                 .header_type    = IW_HEADER_TYPE_PARAM,
         },
-        [SIOCSIWENCODE  - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWENCODE)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
                 .max_tokens     = IW_ENCODING_TOKEN_MAX,
                 .flags          = IW_DESCR_FLAG_EVENT | IW_DESCR_FLAG_RESTRICT,
         },
-        [SIOCGIWENCODE  - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCGIWENCODE)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
                 .max_tokens     = IW_ENCODING_TOKEN_MAX,
                 .flags          = IW_DESCR_FLAG_DUMP | IW_DESCR_FLAG_RESTRICT,
         },
-        [SIOCSIWPOWER   - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWPOWER)] = {
                 .header_type    = IW_HEADER_TYPE_PARAM,
         },
-        [SIOCGIWPOWER   - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCGIWPOWER)] = {
                 .header_type    = IW_HEADER_TYPE_PARAM,
         },
-        [SIOCSIWGENIE   - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWGENIE)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
                 .max_tokens     = IW_GENERIC_IE_MAX,
         },
-        [SIOCGIWGENIE   - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCGIWGENIE)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
                 .max_tokens     = IW_GENERIC_IE_MAX,
         },
-        [SIOCSIWAUTH    - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWAUTH)] = {
                 .header_type    = IW_HEADER_TYPE_PARAM,
         },
-        [SIOCGIWAUTH    - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCGIWAUTH)] = {
                 .header_type    = IW_HEADER_TYPE_PARAM,
         },
-        [SIOCSIWENCODEEXT - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWENCODEEXT)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
                 .min_tokens     = sizeof(struct iw_encode_ext),
                 .max_tokens     = sizeof(struct iw_encode_ext) +
                                   IW_ENCODING_TOKEN_MAX,
         },
-        [SIOCGIWENCODEEXT - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCGIWENCODEEXT)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
                 .min_tokens     = sizeof(struct iw_encode_ext),
                 .max_tokens     = sizeof(struct iw_encode_ext) +
                                   IW_ENCODING_TOKEN_MAX,
         },
-        [SIOCSIWPMKSA - SIOCIWFIRST] = {
+        [IW_IOCTL_IDX(SIOCSIWPMKSA)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
                 .min_tokens     = sizeof(struct iw_pmksa),
@@ -261,44 +261,44 @@ static const unsigned standard_ioctl_num = ARRAY_SIZE(standard_ioctl);
  * we know about.
  */
 static const struct iw_ioctl_description standard_event[] = {
-        [IWEVTXDROP     - IWEVFIRST] = {
+        [IW_EVENT_IDX(IWEVTXDROP)] = {
                 .header_type    = IW_HEADER_TYPE_ADDR,
         },
-        [IWEVQUAL       - IWEVFIRST] = {
+        [IW_EVENT_IDX(IWEVQUAL)] = {
                 .header_type    = IW_HEADER_TYPE_QUAL,
         },
-        [IWEVCUSTOM     - IWEVFIRST] = {
+        [IW_EVENT_IDX(IWEVCUSTOM)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
                 .max_tokens     = IW_CUSTOM_MAX,
         },
-        [IWEVREGISTERED - IWEVFIRST] = {
+        [IW_EVENT_IDX(IWEVREGISTERED)] = {
                 .header_type    = IW_HEADER_TYPE_ADDR,
         },
-        [IWEVEXPIRED    - IWEVFIRST] = {
+        [IW_EVENT_IDX(IWEVEXPIRED)] = {
                 .header_type    = IW_HEADER_TYPE_ADDR,
         },
-        [IWEVGENIE      - IWEVFIRST] = {
+        [IW_EVENT_IDX(IWEVGENIE)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
                 .max_tokens     = IW_GENERIC_IE_MAX,
         },
-        [IWEVMICHAELMICFAILURE  - IWEVFIRST] = {
+        [IW_EVENT_IDX(IWEVMICHAELMICFAILURE)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
                 .max_tokens     = sizeof(struct iw_michaelmicfailure),
         },
-        [IWEVASSOCREQIE - IWEVFIRST] = {
+        [IW_EVENT_IDX(IWEVASSOCREQIE)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
                 .max_tokens     = IW_GENERIC_IE_MAX,
         },
-        [IWEVASSOCRESPIE        - IWEVFIRST] = {
+        [IW_EVENT_IDX(IWEVASSOCRESPIE)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
                 .max_tokens     = IW_GENERIC_IE_MAX,
         },
-        [IWEVPMKIDCAND  - IWEVFIRST] = {
+        [IW_EVENT_IDX(IWEVPMKIDCAND)] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
                 .max_tokens     = sizeof(struct iw_pmkid_cand),
@@ -449,11 +449,11 @@ void wireless_send_event(struct net_device *	dev,
 
         /* Get the description of the Event */
         if (cmd <= SIOCIWLAST) {
-                cmd_index = cmd - SIOCIWFIRST;
+                cmd_index = IW_IOCTL_IDX(cmd);
                 if (cmd_index < standard_ioctl_num)
                         descr = &(standard_ioctl[cmd_index]);
         } else {
-                cmd_index = cmd - IWEVFIRST;
+                cmd_index = IW_EVENT_IDX(cmd);
                 if (cmd_index < standard_event_num)
                         descr = &(standard_event[cmd_index]);
         }
@@ -662,7 +662,7 @@ static iw_handler get_handler(struct net_device *dev, unsigned int cmd)
                 return NULL;
 
         /* Try as a standard command */
-        index = cmd - SIOCIWFIRST;
+        index = IW_IOCTL_IDX(cmd);
         if (index < handlers->num_standard)
                 return handlers->standard[index];
 
@@ -954,9 +954,9 @@ static int ioctl_standard_call(struct net_device *	dev,
         int                                     ret = -EINVAL;
 
         /* Get the description of the IOCTL */
-        if ((cmd - SIOCIWFIRST) >= standard_ioctl_num)
+        if (IW_IOCTL_IDX(cmd) >= standard_ioctl_num)
                 return -EOPNOTSUPP;
-        descr = &(standard_ioctl[cmd - SIOCIWFIRST]);
+        descr = &(standard_ioctl[IW_IOCTL_IDX(cmd)]);
 
         /* Check if we have a pointer to user space data or not */
         if (descr->header_type != IW_HEADER_TYPE_POINT) {
@@ -1012,7 +1012,7 @@ static int compat_standard_call(struct net_device	*dev,
         struct iw_point iwp;
         int err;
 
-        descr = standard_ioctl + (cmd - SIOCIWFIRST);
+        descr = standard_ioctl + IW_IOCTL_IDX(cmd);
 
         if (descr->header_type != IW_HEADER_TYPE_POINT)
                 return ioctl_standard_call(dev, iwr, cmd, info, handler);