110 files changed, 3829 insertions, 2962 deletions

diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index 6d7105b7e8f1..7cf4317a2a84 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -123,14 +123,7 @@ struct ath_ops {
 };
 
 struct ath_common;
-
-struct ath_bus_ops {
-        enum ath_bus_type ath_bus_type;
-        void (*read_cachesize)(struct ath_common *common, int *csz);
-        bool (*eeprom_read)(struct ath_common *common, u32 off, u16 *data);
-        void (*bt_coex_prep)(struct ath_common *common);
-        void (*extn_synch_en)(struct ath_common *common);
-};
+struct ath_bus_ops;
 
 struct ath_common {
         void *ah;
diff --git a/drivers/net/wireless/ath/ath5k/ahb.c b/drivers/net/wireless/ath/ath5k/ahb.c
index 82324e98efef..ea9982781559 100644
--- a/drivers/net/wireless/ath/ath5k/ahb.c
+++ b/drivers/net/wireless/ath/ath5k/ahb.c
@@ -18,6 +18,7 @@
 
 #include <linux/nl80211.h>
 #include <linux/platform_device.h>
+#include <linux/etherdevice.h>
 #include <ar231x_platform.h>
 #include "ath5k.h"
 #include "debug.h"
@@ -62,10 +63,27 @@ int ath5k_hw_read_srev(struct ath5k_hw *ah)
         return 0;
 }
 
+static int ath5k_ahb_eeprom_read_mac(struct ath5k_hw *ah, u8 *mac)
+{
+        struct ath5k_softc *sc = ah->ah_sc;
+        struct platform_device *pdev = to_platform_device(sc->dev);
+        struct ar231x_board_config *bcfg = pdev->dev.platform_data;
+        u8 *cfg_mac;
+
+        if (to_platform_device(sc->dev)->id == 0)
+                cfg_mac = bcfg->config->wlan0_mac;
+        else
+                cfg_mac = bcfg->config->wlan1_mac;
+
+        memcpy(mac, cfg_mac, ETH_ALEN);
+        return 0;
+}
+
 static const struct ath_bus_ops ath_ahb_bus_ops = {
         .ath_bus_type = ATH_AHB,
         .read_cachesize = ath5k_ahb_read_cachesize,
         .eeprom_read = ath5k_ahb_eeprom_read,
+        .eeprom_read_mac = ath5k_ahb_eeprom_read_mac,
 };
 
 /*Initialization*/
@@ -142,6 +160,16 @@ static int ath_ahb_probe(struct platform_device *pdev)
                 else
                         reg |= AR5K_AR5312_ENABLE_WLAN1;
                 __raw_writel(reg, (void __iomem *) AR5K_AR5312_ENABLE);
+
+                /*
+                 * On a dual-band AR5312, the multiband radio is only
+                 * used as pass-through. Disable 2 GHz support in the
+                 * driver for it
+                 */
+                if (to_platform_device(sc->dev)->id == 0 &&
+                    (bcfg->config->flags & (BD_WLAN0|BD_WLAN1)) ==
+                     (BD_WLAN1|BD_WLAN0))
+                        __set_bit(ATH_STAT_2G_DISABLED, sc->status);
         }
 
         ret = ath5k_init_softc(sc, &ath_ahb_bus_ops);
diff --git a/drivers/net/wireless/ath/ath5k/ath5k.h b/drivers/net/wireless/ath/ath5k/ath5k.h
index 8a06dbd39629..bb50700436fe 100644
--- a/drivers/net/wireless/ath/ath5k/ath5k.h
+++ b/drivers/net/wireless/ath/ath5k/ath5k.h
@@ -224,8 +224,7 @@
 
 /* SIFS */
 #define AR5K_INIT_SIFS_TURBO                    6
-/* XXX: 8 from initvals 10 from standard */
-#define AR5K_INIT_SIFS_DEFAULT_BG               8
+#define AR5K_INIT_SIFS_DEFAULT_BG               10
 #define AR5K_INIT_SIFS_DEFAULT_A                16
 #define AR5K_INIT_SIFS_HALF_RATE                32
 #define AR5K_INIT_SIFS_QUARTER_RATE             64
@@ -453,12 +452,10 @@ struct ath5k_tx_status {
         u16     ts_seqnum;
         u16     ts_tstamp;
         u8      ts_status;
-        u8      ts_rate[4];
-        u8      ts_retry[4];
         u8      ts_final_idx;
+        u8      ts_final_retry;
         s8      ts_rssi;
         u8      ts_shortretry;
-        u8      ts_longretry;
         u8      ts_virtcol;
         u8      ts_antenna;
 };
@@ -875,6 +872,19 @@ enum ath5k_int {
         AR5K_INT_QTRIG  =       0x40000000, /* Non common */
         AR5K_INT_GLOBAL =       0x80000000,
 
+        AR5K_INT_TX_ALL = AR5K_INT_TXOK
+                | AR5K_INT_TXDESC
+                | AR5K_INT_TXERR
+                | AR5K_INT_TXEOL
+                | AR5K_INT_TXURN,
+
+        AR5K_INT_RX_ALL = AR5K_INT_RXOK
+                | AR5K_INT_RXDESC
+                | AR5K_INT_RXERR
+                | AR5K_INT_RXNOFRM
+                | AR5K_INT_RXEOL
+                | AR5K_INT_RXORN,
+
         AR5K_INT_COMMON  = AR5K_INT_RXOK
                 | AR5K_INT_RXDESC
                 | AR5K_INT_RXERR
@@ -1058,6 +1068,7 @@ struct ath5k_hw {
         u8                      ah_coverage_class;
         bool                    ah_ack_bitrate_high;
         u8                      ah_bwmode;
+        bool                    ah_short_slot;
 
         /* Antenna Control */
         u32                     ah_ant_ctl[AR5K_EEPROM_N_MODES][AR5K_ANT_MAX];
@@ -1144,6 +1155,13 @@ struct ath5k_hw {
                 struct ath5k_rx_status *);
 };
 
+struct ath_bus_ops {
+        enum ath_bus_type ath_bus_type;
+        void (*read_cachesize)(struct ath_common *common, int *csz);
+        bool (*eeprom_read)(struct ath_common *common, u32 off, u16 *data);
+        int (*eeprom_read_mac)(struct ath5k_hw *ah, u8 *mac);
+};
+
 /*
  * Prototypes
  */
@@ -1227,13 +1245,12 @@ int ath5k_hw_dma_stop(struct ath5k_hw *ah);
 /* EEPROM access functions */
 int ath5k_eeprom_init(struct ath5k_hw *ah);
 void ath5k_eeprom_detach(struct ath5k_hw *ah);
-int ath5k_eeprom_read_mac(struct ath5k_hw *ah, u8 *mac);
 
 
 /* Protocol Control Unit Functions */
 /* Helpers */
 int ath5k_hw_get_frame_duration(struct ath5k_hw *ah,
-                int len, struct ieee80211_rate *rate);
+                int len, struct ieee80211_rate *rate, bool shortpre);
 unsigned int ath5k_hw_get_default_slottime(struct ath5k_hw *ah);
 unsigned int ath5k_hw_get_default_sifs(struct ath5k_hw *ah);
 extern int ath5k_hw_set_opmode(struct ath5k_hw *ah, enum nl80211_iftype opmode);
diff --git a/drivers/net/wireless/ath/ath5k/attach.c b/drivers/net/wireless/ath/ath5k/attach.c
index bc8240560488..1588401de3c4 100644
--- a/drivers/net/wireless/ath/ath5k/attach.c
+++ b/drivers/net/wireless/ath/ath5k/attach.c
@@ -313,12 +313,17 @@ int ath5k_hw_init(struct ath5k_softc *sc)
                 goto err;
         }
 
+        if (test_bit(ATH_STAT_2G_DISABLED, sc->status)) {
+                __clear_bit(AR5K_MODE_11B, ah->ah_capabilities.cap_mode);
+                __clear_bit(AR5K_MODE_11G, ah->ah_capabilities.cap_mode);
+        }
+
         /* Crypto settings */
         common->keymax = (sc->ah->ah_version == AR5K_AR5210 ?
                           AR5K_KEYTABLE_SIZE_5210 : AR5K_KEYTABLE_SIZE_5211);
 
         if (srev >= AR5K_SREV_AR5212_V4 &&
-            (ee->ee_version >= AR5K_EEPROM_VERSION_5_0 &&
+            (ee->ee_version < AR5K_EEPROM_VERSION_5_0 ||
             !AR5K_EEPROM_AES_DIS(ee->ee_misc5)))
                 common->crypt_caps |= ATH_CRYPT_CAP_CIPHER_AESCCM;
 
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 4d7f21ee111c..7583841fc29a 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -1444,6 +1444,21 @@ ath5k_receive_frame_ok(struct ath5k_softc *sc, struct ath5k_rx_status *rs)
 }
 
 static void
+ath5k_set_current_imask(struct ath5k_softc *sc)
+{
+        enum ath5k_int imask = sc->imask;
+        unsigned long flags;
+
+        spin_lock_irqsave(&sc->irqlock, flags);
+        if (sc->rx_pending)
+                imask &= ~AR5K_INT_RX_ALL;
+        if (sc->tx_pending)
+                imask &= ~AR5K_INT_TX_ALL;
+        ath5k_hw_set_imr(sc->ah, imask);
+        spin_unlock_irqrestore(&sc->irqlock, flags);
+}
+
+static void
 ath5k_tasklet_rx(unsigned long data)
 {
         struct ath5k_rx_status rs = {};
@@ -1506,6 +1521,8 @@ next:
         } while (ath5k_rxbuf_setup(sc, bf) == 0);
 unlock:
         spin_unlock(&sc->rxbuflock);
+        sc->rx_pending = false;
+        ath5k_set_current_imask(sc);
 }
 
 
@@ -1573,28 +1590,28 @@ ath5k_tx_frame_completed(struct ath5k_softc *sc, struct sk_buff *skb,
                          struct ath5k_txq *txq, struct ath5k_tx_status *ts)
 {
         struct ieee80211_tx_info *info;
+        u8 tries[3];
         int i;
 
         sc->stats.tx_all_count++;
         sc->stats.tx_bytes_count += skb->len;
         info = IEEE80211_SKB_CB(skb);
 
+        tries[0] = info->status.rates[0].count;
+        tries[1] = info->status.rates[1].count;
+        tries[2] = info->status.rates[2].count;
+
         ieee80211_tx_info_clear_status(info);
-        for (i = 0; i < 4; i++) {
+
+        for (i = 0; i < ts->ts_final_idx; i++) {
                 struct ieee80211_tx_rate *r =
                         &info->status.rates[i];
 
-                if (ts->ts_rate[i]) {
-                        r->idx = ath5k_hw_to_driver_rix(sc, ts->ts_rate[i]);
-                        r->count = ts->ts_retry[i];
-                } else {
-                        r->idx = -1;
-                        r->count = 0;
-                }
+                r->count = tries[i];
         }
 
-        /* count the successful attempt as well */
-        info->status.rates[ts->ts_final_idx].count++;
+        info->status.rates[ts->ts_final_idx].count = ts->ts_final_retry;
+        info->status.rates[ts->ts_final_idx + 1].idx = -1;
 
         if (unlikely(ts->ts_status)) {
                 sc->stats.ack_fail++;
@@ -1609,6 +1626,9 @@ ath5k_tx_frame_completed(struct ath5k_softc *sc, struct sk_buff *skb,
         } else {
                 info->flags |= IEEE80211_TX_STAT_ACK;
                 info->status.ack_signal = ts->ts_rssi;
+
+                /* count the successful attempt as well */
+                info->status.rates[ts->ts_final_idx].count++;
         }
 
         /*
@@ -1690,6 +1710,9 @@ ath5k_tasklet_tx(unsigned long data)
         for (i=0; i < AR5K_NUM_TX_QUEUES; i++)
                 if (sc->txqs[i].setup && (sc->ah->ah_txq_isr & BIT(i)))
                         ath5k_tx_processq(sc, &sc->txqs[i]);
+
+        sc->tx_pending = false;
+        ath5k_set_current_imask(sc);
 }
 
 
@@ -2119,6 +2142,20 @@ ath5k_intr_calibration_poll(struct ath5k_hw *ah)
          * AR5K_REG_ENABLE_BITS(ah, AR5K_CR, AR5K_CR_SWI); */
 }
 
+static void
+ath5k_schedule_rx(struct ath5k_softc *sc)
+{
+        sc->rx_pending = true;
+        tasklet_schedule(&sc->rxtq);
+}
+
+static void
+ath5k_schedule_tx(struct ath5k_softc *sc)
+{
+        sc->tx_pending = true;
+        tasklet_schedule(&sc->txtq);
+}
+
 irqreturn_t
 ath5k_intr(int irq, void *dev_id)
 {
@@ -2161,7 +2198,7 @@ ath5k_intr(int irq, void *dev_id)
                                 ieee80211_queue_work(sc->hw, &sc->reset_work);
                         }
                         else
-                                tasklet_schedule(&sc->rxtq);
+                                ath5k_schedule_rx(sc);
                 } else {
                         if (status & AR5K_INT_SWBA) {
                                 tasklet_hi_schedule(&sc->beacontq);
@@ -2179,10 +2216,10 @@ ath5k_intr(int irq, void *dev_id)
                                 ath5k_hw_update_tx_triglevel(ah, true);
                         }
                         if (status & (AR5K_INT_RXOK | AR5K_INT_RXERR))
-                                tasklet_schedule(&sc->rxtq);
+                                ath5k_schedule_rx(sc);
                         if (status & (AR5K_INT_TXOK | AR5K_INT_TXDESC
                                         | AR5K_INT_TXERR | AR5K_INT_TXEOL))
-                                tasklet_schedule(&sc->txtq);
+                                ath5k_schedule_tx(sc);
                         if (status & AR5K_INT_BMISS) {
                                 /* TODO */
                         }
@@ -2201,6 +2238,9 @@ ath5k_intr(int irq, void *dev_id)
 
         } while (ath5k_hw_is_intr_pending(ah) && --counter > 0);
 
+        if (sc->rx_pending || sc->tx_pending)
+                ath5k_set_current_imask(sc);
+
         if (unlikely(!counter))
                 ATH5K_WARN(sc, "too many interrupts, giving up for now\n");
 
@@ -2572,6 +2612,8 @@ done:
 
 static void stop_tasklets(struct ath5k_softc *sc)
 {
+        sc->rx_pending = false;
+        sc->tx_pending = false;
         tasklet_kill(&sc->rxtq);
         tasklet_kill(&sc->txtq);
         tasklet_kill(&sc->calib);
@@ -2838,7 +2880,7 @@ ath5k_init(struct ieee80211_hw *hw)
         INIT_WORK(&sc->reset_work, ath5k_reset_work);
         INIT_DELAYED_WORK(&sc->tx_complete_work, ath5k_tx_complete_poll_work);
 
-        ret = ath5k_eeprom_read_mac(ah, mac);
+        ret = ath5k_hw_common(ah)->bus_ops->eeprom_read_mac(ah, mac);
         if (ret) {
                 ATH5K_ERR(sc, "unable to read address from EEPROM\n");
                 goto err_queues;
@@ -2898,7 +2940,6 @@ ath5k_deinit_softc(struct ath5k_softc *sc)
          * XXX: ??? detach ath5k_hw ???
          * Other than that, it's straightforward...
          */
-        ath5k_debug_finish_device(sc);
         ieee80211_unregister_hw(hw);
         ath5k_desc_free(sc);
         ath5k_txq_release(sc);
diff --git a/drivers/net/wireless/ath/ath5k/base.h b/drivers/net/wireless/ath/ath5k/base.h
index 978f1f4ac2f3..b294f3305011 100644
--- a/drivers/net/wireless/ath/ath5k/base.h
+++ b/drivers/net/wireless/ath/ath5k/base.h
@@ -193,12 +193,13 @@ struct ath5k_softc {
         dma_addr_t              desc_daddr;     /* DMA (physical) address */
         size_t                  desc_len;       /* size of TX/RX descriptors */
 
-        DECLARE_BITMAP(status, 5);
+        DECLARE_BITMAP(status, 6);
 #define ATH_STAT_INVALID        0               /* disable hardware accesses */
 #define ATH_STAT_MRRETRY        1               /* multi-rate retry support */
 #define ATH_STAT_PROMISC        2
 #define ATH_STAT_LEDSOFT        3               /* enable LED gpio status */
 #define ATH_STAT_STARTED        4               /* opened & irqs enabled */
+#define ATH_STAT_2G_DISABLED    5               /* multiband radio without 2G */
 
         unsigned int            filter_flags;   /* HW flags, AR5K_RX_FILTER_* */
         struct ieee80211_channel *curchan;      /* current h/w channel */
@@ -207,6 +208,10 @@ struct ath5k_softc {
 
         enum ath5k_int          imask;          /* interrupt mask copy */
 
+        spinlock_t              irqlock;
+        bool                    rx_pending;     /* rx tasklet pending */
+        bool                    tx_pending;     /* tx tasklet pending */
+
         u8                      lladdr[ETH_ALEN];
         u8                      bssidmask[ETH_ALEN];
 
diff --git a/drivers/net/wireless/ath/ath5k/caps.c b/drivers/net/wireless/ath/ath5k/caps.c
index f77e8a703c5c..7dd88e1c3ff8 100644
--- a/drivers/net/wireless/ath/ath5k/caps.c
+++ b/drivers/net/wireless/ath/ath5k/caps.c
@@ -94,6 +94,9 @@ int ath5k_hw_set_capabilities(struct ath5k_hw *ah)
                 }
         }
 
+        if ((ah->ah_radio_5ghz_revision & 0xf0) == AR5K_SREV_RAD_2112)
+                __clear_bit(AR5K_MODE_11A, caps->cap_mode);
+
         /* Set number of supported TX queues */
         if (ah->ah_version == AR5K_AR5210)
                 caps->cap_queues.q_tx_num = AR5K_NUM_TX_QUEUES_NOQCU;
diff --git a/drivers/net/wireless/ath/ath5k/debug.c b/drivers/net/wireless/ath/ath5k/debug.c
index 0230f30e9e9a..0bf7313b8a17 100644
--- a/drivers/net/wireless/ath/ath5k/debug.c
+++ b/drivers/net/wireless/ath/ath5k/debug.c
@@ -888,65 +888,38 @@ static const struct file_operations fops_queue = {
 void
 ath5k_debug_init_device(struct ath5k_softc *sc)
 {
-        sc->debug.level = ath5k_debug;
+        struct dentry *phydir;
 
-        sc->debug.debugfs_phydir = debugfs_create_dir("ath5k",
-                                sc->hw->wiphy->debugfsdir);
+        sc->debug.level = ath5k_debug;
 
-        sc->debug.debugfs_debug = debugfs_create_file("debug",
-                                S_IWUSR | S_IRUSR,
-                                sc->debug.debugfs_phydir, sc, &fops_debug);
+        phydir = debugfs_create_dir("ath5k", sc->hw->wiphy->debugfsdir);
+        if (!phydir)
+            return;
 
-        sc->debug.debugfs_registers = debugfs_create_file("registers", S_IRUSR,
-                                sc->debug.debugfs_phydir, sc, &fops_registers);
+        debugfs_create_file("debug", S_IWUSR | S_IRUSR, phydir, sc,
+                            &fops_debug);
 
-        sc->debug.debugfs_beacon = debugfs_create_file("beacon",
-                                S_IWUSR | S_IRUSR,
-                                sc->debug.debugfs_phydir, sc, &fops_beacon);
+        debugfs_create_file("registers", S_IRUSR, phydir, sc, &fops_registers);
 
-        sc->debug.debugfs_reset = debugfs_create_file("reset", S_IWUSR,
-                                sc->debug.debugfs_phydir, sc, &fops_reset);
+        debugfs_create_file("beacon", S_IWUSR | S_IRUSR, phydir, sc,
+                            &fops_beacon);
 
-        sc->debug.debugfs_antenna = debugfs_create_file("antenna",
-                                S_IWUSR | S_IRUSR,
-                                sc->debug.debugfs_phydir, sc, &fops_antenna);
+        debugfs_create_file("reset", S_IWUSR, phydir, sc, &fops_reset);
 
-        sc->debug.debugfs_misc = debugfs_create_file("misc",
-                                S_IRUSR,
-                                sc->debug.debugfs_phydir, sc, &fops_misc);
+        debugfs_create_file("antenna", S_IWUSR | S_IRUSR, phydir, sc,
+                            &fops_antenna);
 
-        sc->debug.debugfs_frameerrors = debugfs_create_file("frameerrors",
-                                S_IWUSR | S_IRUSR,
-                                sc->debug.debugfs_phydir, sc,
-                                &fops_frameerrors);
+        debugfs_create_file("misc", S_IRUSR, phydir, sc, &fops_misc);
 
-        sc->debug.debugfs_ani = debugfs_create_file("ani",
-                                S_IWUSR | S_IRUSR,
-                                sc->debug.debugfs_phydir, sc,
-                                &fops_ani);
+        debugfs_create_file("frameerrors", S_IWUSR | S_IRUSR, phydir, sc,
+                            &fops_frameerrors);
 
-        sc->debug.debugfs_queue = debugfs_create_file("queue",
-                                S_IWUSR | S_IRUSR,
-                                sc->debug.debugfs_phydir, sc,
-                                &fops_queue);
-}
+        debugfs_create_file("ani", S_IWUSR | S_IRUSR, phydir, sc, &fops_ani);
 
-void
-ath5k_debug_finish_device(struct ath5k_softc *sc)
-{
-        debugfs_remove(sc->debug.debugfs_debug);
-        debugfs_remove(sc->debug.debugfs_registers);
-        debugfs_remove(sc->debug.debugfs_beacon);
-        debugfs_remove(sc->debug.debugfs_reset);
-        debugfs_remove(sc->debug.debugfs_antenna);
-        debugfs_remove(sc->debug.debugfs_misc);
-        debugfs_remove(sc->debug.debugfs_frameerrors);
-        debugfs_remove(sc->debug.debugfs_ani);
-        debugfs_remove(sc->debug.debugfs_queue);
-        debugfs_remove(sc->debug.debugfs_phydir);
+        debugfs_create_file("queue", S_IWUSR | S_IRUSR, phydir, sc,
+                            &fops_queue);
 }
 
-
 /* functions used in other places */
 
 void
diff --git a/drivers/net/wireless/ath/ath5k/debug.h b/drivers/net/wireless/ath/ath5k/debug.h
index b0355aef68d3..193dd2d4ea3c 100644
--- a/drivers/net/wireless/ath/ath5k/debug.h
+++ b/drivers/net/wireless/ath/ath5k/debug.h
@@ -68,17 +68,6 @@ struct ath5k_buf;
 
 struct ath5k_dbg_info {
         unsigned int            level;          /* debug level */
-        /* debugfs entries */
-        struct dentry           *debugfs_phydir;
-        struct dentry           *debugfs_debug;
-        struct dentry           *debugfs_registers;
-        struct dentry           *debugfs_beacon;
-        struct dentry           *debugfs_reset;
-        struct dentry           *debugfs_antenna;
-        struct dentry           *debugfs_misc;
-        struct dentry           *debugfs_frameerrors;
-        struct dentry           *debugfs_ani;
-        struct dentry           *debugfs_queue;
 };
 
 /**
@@ -141,9 +130,6 @@ void
 ath5k_debug_init_device(struct ath5k_softc *sc);
 
 void
-ath5k_debug_finish_device(struct ath5k_softc *sc);
-
-void
 ath5k_debug_printrxbuffs(struct ath5k_softc *sc, struct ath5k_hw *ah);
 
 void
@@ -167,9 +153,6 @@ static inline void
 ath5k_debug_init_device(struct ath5k_softc *sc) {}
 
 static inline void
-ath5k_debug_finish_device(struct ath5k_softc *sc) {}
-
-static inline void
 ath5k_debug_printrxbuffs(struct ath5k_softc *sc, struct ath5k_hw *ah) {}
 
 static inline void
diff --git a/drivers/net/wireless/ath/ath5k/desc.c b/drivers/net/wireless/ath/ath5k/desc.c
index 16b44ff7dd3e..dd7cd95c364a 100644
--- a/drivers/net/wireless/ath/ath5k/desc.c
+++ b/drivers/net/wireless/ath/ath5k/desc.c
@@ -185,6 +185,12 @@ static int ath5k_hw_setup_4word_tx_desc(struct ath5k_hw *ah,
         struct ath5k_hw_4w_tx_ctl *tx_ctl;
         unsigned int frame_len;
 
+        /*
+         * Use local variables for these to reduce load/store access on
+         * uncached memory
+         */
+        u32 txctl0 = 0, txctl1 = 0, txctl2 = 0, txctl3 = 0;
+
         tx_ctl = &desc->ud.ds_tx5212.tx_ctl;
 
         /*
@@ -208,8 +214,9 @@ static int ath5k_hw_setup_4word_tx_desc(struct ath5k_hw *ah,
         if (tx_power > AR5K_TUNE_MAX_TXPOWER)
                 tx_power = AR5K_TUNE_MAX_TXPOWER;
 
-        /* Clear descriptor */
-        memset(&desc->ud.ds_tx5212, 0, sizeof(struct ath5k_hw_5212_tx_desc));
+        /* Clear descriptor status area */
+        memset(&desc->ud.ds_tx5212.tx_stat, 0,
+               sizeof(desc->ud.ds_tx5212.tx_stat));
 
         /* Setup control descriptor */
 
@@ -221,7 +228,7 @@ static int ath5k_hw_setup_4word_tx_desc(struct ath5k_hw *ah,
         if (frame_len & ~AR5K_4W_TX_DESC_CTL0_FRAME_LEN)
                 return -EINVAL;
 
-        tx_ctl->tx_control_0 = frame_len & AR5K_4W_TX_DESC_CTL0_FRAME_LEN;
+        txctl0 = frame_len & AR5K_4W_TX_DESC_CTL0_FRAME_LEN;
 
         /* Verify and set buffer length */
 
@@ -232,21 +239,17 @@ static int ath5k_hw_setup_4word_tx_desc(struct ath5k_hw *ah,
         if (pkt_len & ~AR5K_4W_TX_DESC_CTL1_BUF_LEN)
                 return -EINVAL;
 
-        tx_ctl->tx_control_1 = pkt_len & AR5K_4W_TX_DESC_CTL1_BUF_LEN;
+        txctl1 = pkt_len & AR5K_4W_TX_DESC_CTL1_BUF_LEN;
 
-        tx_ctl->tx_control_0 |=
-                AR5K_REG_SM(tx_power, AR5K_4W_TX_DESC_CTL0_XMIT_POWER) |
-                AR5K_REG_SM(antenna_mode, AR5K_4W_TX_DESC_CTL0_ANT_MODE_XMIT);
-        tx_ctl->tx_control_1 |= AR5K_REG_SM(type,
-                                        AR5K_4W_TX_DESC_CTL1_FRAME_TYPE);
-        tx_ctl->tx_control_2 = AR5K_REG_SM(tx_tries0,
-                                        AR5K_4W_TX_DESC_CTL2_XMIT_TRIES0);
-        tx_ctl->tx_control_3 = tx_rate0 & AR5K_4W_TX_DESC_CTL3_XMIT_RATE0;
+        txctl0 |= AR5K_REG_SM(tx_power, AR5K_4W_TX_DESC_CTL0_XMIT_POWER) |
+                  AR5K_REG_SM(antenna_mode, AR5K_4W_TX_DESC_CTL0_ANT_MODE_XMIT);
+        txctl1 |= AR5K_REG_SM(type, AR5K_4W_TX_DESC_CTL1_FRAME_TYPE);
+        txctl2 = AR5K_REG_SM(tx_tries0, AR5K_4W_TX_DESC_CTL2_XMIT_TRIES0);
+        txctl3 = tx_rate0 & AR5K_4W_TX_DESC_CTL3_XMIT_RATE0;
 
 #define _TX_FLAGS(_c, _flag)                                    \
         if (flags & AR5K_TXDESC_##_flag) {                      \
-                tx_ctl->tx_control_##_c |=                      \
-                        AR5K_4W_TX_DESC_CTL##_c##_##_flag;      \
+                txctl##_c |= AR5K_4W_TX_DESC_CTL##_c##_##_flag; \
         }
 
         _TX_FLAGS(0, CLRDMASK);
@@ -262,8 +265,8 @@ static int ath5k_hw_setup_4word_tx_desc(struct ath5k_hw *ah,
          * WEP crap
          */
         if (key_index != AR5K_TXKEYIX_INVALID) {
-                tx_ctl->tx_control_0 |= AR5K_4W_TX_DESC_CTL0_ENCRYPT_KEY_VALID;
-                tx_ctl->tx_control_1 |= AR5K_REG_SM(key_index,
+                txctl0 |= AR5K_4W_TX_DESC_CTL0_ENCRYPT_KEY_VALID;
+                txctl1 |= AR5K_REG_SM(key_index,
                                 AR5K_4W_TX_DESC_CTL1_ENCRYPT_KEY_IDX);
         }
 
@@ -274,12 +277,16 @@ static int ath5k_hw_setup_4word_tx_desc(struct ath5k_hw *ah,
                 if ((flags & AR5K_TXDESC_RTSENA) &&
                                 (flags & AR5K_TXDESC_CTSENA))
                         return -EINVAL;
-                tx_ctl->tx_control_2 |= rtscts_duration &
-                                AR5K_4W_TX_DESC_CTL2_RTS_DURATION;
-                tx_ctl->tx_control_3 |= AR5K_REG_SM(rtscts_rate,
+                txctl2 |= rtscts_duration & AR5K_4W_TX_DESC_CTL2_RTS_DURATION;
+                txctl3 |= AR5K_REG_SM(rtscts_rate,
                                 AR5K_4W_TX_DESC_CTL3_RTS_CTS_RATE);
         }
 
+        tx_ctl->tx_control_0 = txctl0;
+        tx_ctl->tx_control_1 = txctl1;
+        tx_ctl->tx_control_2 = txctl2;
+        tx_ctl->tx_control_3 = txctl3;
+
         return 0;
 }
 
@@ -364,7 +371,7 @@ static int ath5k_hw_proc_2word_tx_status(struct ath5k_hw *ah,
                 AR5K_DESC_TX_STATUS0_SEND_TIMESTAMP);
         ts->ts_shortretry = AR5K_REG_MS(tx_status->tx_status_0,
                 AR5K_DESC_TX_STATUS0_SHORT_RETRY_COUNT);
-        ts->ts_longretry = AR5K_REG_MS(tx_status->tx_status_0,
+        ts->ts_final_retry = AR5K_REG_MS(tx_status->tx_status_0,
                 AR5K_DESC_TX_STATUS0_LONG_RETRY_COUNT);
         /*TODO: ts->ts_virtcol + test*/
         ts->ts_seqnum = AR5K_REG_MS(tx_status->tx_status_1,
@@ -373,9 +380,6 @@ static int ath5k_hw_proc_2word_tx_status(struct ath5k_hw *ah,
                 AR5K_DESC_TX_STATUS1_ACK_SIG_STRENGTH);
         ts->ts_antenna = 1;
         ts->ts_status = 0;
-        ts->ts_rate[0] = AR5K_REG_MS(tx_ctl->tx_control_0,
-                AR5K_2W_TX_DESC_CTL0_XMIT_RATE);
-        ts->ts_retry[0] = ts->ts_longretry;
         ts->ts_final_idx = 0;
 
         if (!(tx_status->tx_status_0 & AR5K_DESC_TX_STATUS0_FRAME_XMIT_OK)) {
@@ -401,81 +405,48 @@ static int ath5k_hw_proc_4word_tx_status(struct ath5k_hw *ah,
 {
         struct ath5k_hw_4w_tx_ctl *tx_ctl;
         struct ath5k_hw_tx_status *tx_status;
+        u32 txstat0, txstat1;
 
         tx_ctl = &desc->ud.ds_tx5212.tx_ctl;
         tx_status = &desc->ud.ds_tx5212.tx_stat;
 
+        txstat1 = ACCESS_ONCE(tx_status->tx_status_1);
+
         /* No frame has been send or error */
-        if (unlikely(!(tx_status->tx_status_1 & AR5K_DESC_TX_STATUS1_DONE)))
+        if (unlikely(!(txstat1 & AR5K_DESC_TX_STATUS1_DONE)))
                 return -EINPROGRESS;
 
+        txstat0 = ACCESS_ONCE(tx_status->tx_status_0);
+
         /*
          * Get descriptor status
          */
-        ts->ts_tstamp = AR5K_REG_MS(tx_status->tx_status_0,
+        ts->ts_tstamp = AR5K_REG_MS(txstat0,
                 AR5K_DESC_TX_STATUS0_SEND_TIMESTAMP);
-        ts->ts_shortretry = AR5K_REG_MS(tx_status->tx_status_0,
+        ts->ts_shortretry = AR5K_REG_MS(txstat0,
                 AR5K_DESC_TX_STATUS0_SHORT_RETRY_COUNT);
-        ts->ts_longretry = AR5K_REG_MS(tx_status->tx_status_0,
+        ts->ts_final_retry = AR5K_REG_MS(txstat0,
                 AR5K_DESC_TX_STATUS0_LONG_RETRY_COUNT);
-        ts->ts_seqnum = AR5K_REG_MS(tx_status->tx_status_1,
+        ts->ts_seqnum = AR5K_REG_MS(txstat1,
                 AR5K_DESC_TX_STATUS1_SEQ_NUM);
-        ts->ts_rssi = AR5K_REG_MS(tx_status->tx_status_1,
+        ts->ts_rssi = AR5K_REG_MS(txstat1,
                 AR5K_DESC_TX_STATUS1_ACK_SIG_STRENGTH);
-        ts->ts_antenna = (tx_status->tx_status_1 &
+        ts->ts_antenna = (txstat1 &
                 AR5K_DESC_TX_STATUS1_XMIT_ANTENNA_5212) ? 2 : 1;
         ts->ts_status = 0;
 
-        ts->ts_final_idx = AR5K_REG_MS(tx_status->tx_status_1,
+        ts->ts_final_idx = AR5K_REG_MS(txstat1,
                         AR5K_DESC_TX_STATUS1_FINAL_TS_IX_5212);
 
-        /* The longretry counter has the number of un-acked retries
-         * for the final rate. To get the total number of retries
-         * we have to add the retry counters for the other rates
-         * as well
-         */
-        ts->ts_retry[ts->ts_final_idx] = ts->ts_longretry;
-        switch (ts->ts_final_idx) {
-        case 3:
-                ts->ts_rate[3] = AR5K_REG_MS(tx_ctl->tx_control_3,
-                        AR5K_4W_TX_DESC_CTL3_XMIT_RATE3);
-
-                ts->ts_retry[2] = AR5K_REG_MS(tx_ctl->tx_control_2,
-                        AR5K_4W_TX_DESC_CTL2_XMIT_TRIES2);
-                ts->ts_longretry += ts->ts_retry[2];
-                /* fall through */
-        case 2:
-                ts->ts_rate[2] = AR5K_REG_MS(tx_ctl->tx_control_3,
-                        AR5K_4W_TX_DESC_CTL3_XMIT_RATE2);
-
-                ts->ts_retry[1] = AR5K_REG_MS(tx_ctl->tx_control_2,
-                        AR5K_4W_TX_DESC_CTL2_XMIT_TRIES1);
-                ts->ts_longretry += ts->ts_retry[1];
-                /* fall through */
-        case 1:
-                ts->ts_rate[1] = AR5K_REG_MS(tx_ctl->tx_control_3,
-                        AR5K_4W_TX_DESC_CTL3_XMIT_RATE1);
-
-                ts->ts_retry[0] = AR5K_REG_MS(tx_ctl->tx_control_2,
-                        AR5K_4W_TX_DESC_CTL2_XMIT_TRIES1);
-                ts->ts_longretry += ts->ts_retry[0];
-                /* fall through */
-        case 0:
-                ts->ts_rate[0] = tx_ctl->tx_control_3 &
-                        AR5K_4W_TX_DESC_CTL3_XMIT_RATE0;
-                break;
-        }
-
         /* TX error */
-        if (!(tx_status->tx_status_0 & AR5K_DESC_TX_STATUS0_FRAME_XMIT_OK)) {
-                if (tx_status->tx_status_0 &
-                                AR5K_DESC_TX_STATUS0_EXCESSIVE_RETRIES)
+        if (!(txstat0 & AR5K_DESC_TX_STATUS0_FRAME_XMIT_OK)) {
+                if (txstat0 & AR5K_DESC_TX_STATUS0_EXCESSIVE_RETRIES)
                         ts->ts_status |= AR5K_TXERR_XRETRY;
 
-                if (tx_status->tx_status_0 & AR5K_DESC_TX_STATUS0_FIFO_UNDERRUN)
+                if (txstat0 & AR5K_DESC_TX_STATUS0_FIFO_UNDERRUN)
                         ts->ts_status |= AR5K_TXERR_FIFO;
 
-                if (tx_status->tx_status_0 & AR5K_DESC_TX_STATUS0_FILTERED)
+                if (txstat0 & AR5K_DESC_TX_STATUS0_FILTERED)
                         ts->ts_status |= AR5K_TXERR_FILT;
         }
 
@@ -609,37 +580,37 @@ static int ath5k_hw_proc_5212_rx_status(struct ath5k_hw *ah,
                                         struct ath5k_rx_status *rs)
 {
         struct ath5k_hw_rx_status *rx_status;
+        u32 rxstat0, rxstat1;
 
         rx_status = &desc->ud.ds_rx.rx_stat;
+        rxstat1 = ACCESS_ONCE(rx_status->rx_status_1);
 
         /* No frame received / not ready */
-        if (unlikely(!(rx_status->rx_status_1 &
-                                AR5K_5212_RX_DESC_STATUS1_DONE)))
+        if (unlikely(!(rxstat1 & AR5K_5212_RX_DESC_STATUS1_DONE)))
                 return -EINPROGRESS;
 
         memset(rs, 0, sizeof(struct ath5k_rx_status));
+        rxstat0 = ACCESS_ONCE(rx_status->rx_status_0);
 
         /*
          * Frame receive status
          */
-        rs->rs_datalen = rx_status->rx_status_0 &
-                AR5K_5212_RX_DESC_STATUS0_DATA_LEN;
-        rs->rs_rssi = AR5K_REG_MS(rx_status->rx_status_0,
+        rs->rs_datalen = rxstat0 & AR5K_5212_RX_DESC_STATUS0_DATA_LEN;
+        rs->rs_rssi = AR5K_REG_MS(rxstat0,
                 AR5K_5212_RX_DESC_STATUS0_RECEIVE_SIGNAL);
-        rs->rs_rate = AR5K_REG_MS(rx_status->rx_status_0,
+        rs->rs_rate = AR5K_REG_MS(rxstat0,
                 AR5K_5212_RX_DESC_STATUS0_RECEIVE_RATE);
-        rs->rs_antenna = AR5K_REG_MS(rx_status->rx_status_0,
+        rs->rs_antenna = AR5K_REG_MS(rxstat0,
                 AR5K_5212_RX_DESC_STATUS0_RECEIVE_ANTENNA);
-        rs->rs_more = !!(rx_status->rx_status_0 &
-                AR5K_5212_RX_DESC_STATUS0_MORE);
-        rs->rs_tstamp = AR5K_REG_MS(rx_status->rx_status_1,
+        rs->rs_more = !!(rxstat0 & AR5K_5212_RX_DESC_STATUS0_MORE);
+        rs->rs_tstamp = AR5K_REG_MS(rxstat1,
                 AR5K_5212_RX_DESC_STATUS1_RECEIVE_TIMESTAMP);
 
         /*
          * Key table status
          */
-        if (rx_status->rx_status_1 & AR5K_5212_RX_DESC_STATUS1_KEY_INDEX_VALID)
-                rs->rs_keyix = AR5K_REG_MS(rx_status->rx_status_1,
+        if (rxstat1 & AR5K_5212_RX_DESC_STATUS1_KEY_INDEX_VALID)
+                rs->rs_keyix = AR5K_REG_MS(rxstat1,
                                            AR5K_5212_RX_DESC_STATUS1_KEY_INDEX);
         else
                 rs->rs_keyix = AR5K_RXKEYIX_INVALID;
@@ -647,27 +618,22 @@ static int ath5k_hw_proc_5212_rx_status(struct ath5k_hw *ah,
         /*
          * Receive/descriptor errors
          */
-        if (!(rx_status->rx_status_1 &
-            AR5K_5212_RX_DESC_STATUS1_FRAME_RECEIVE_OK)) {
-                if (rx_status->rx_status_1 &
-                                AR5K_5212_RX_DESC_STATUS1_CRC_ERROR)
+        if (!(rxstat1 & AR5K_5212_RX_DESC_STATUS1_FRAME_RECEIVE_OK)) {
+                if (rxstat1 & AR5K_5212_RX_DESC_STATUS1_CRC_ERROR)
                         rs->rs_status |= AR5K_RXERR_CRC;
 
-                if (rx_status->rx_status_1 &
-                                AR5K_5212_RX_DESC_STATUS1_PHY_ERROR) {
+                if (rxstat1 & AR5K_5212_RX_DESC_STATUS1_PHY_ERROR) {
                         rs->rs_status |= AR5K_RXERR_PHY;
-                        rs->rs_phyerr = AR5K_REG_MS(rx_status->rx_status_1,
+                        rs->rs_phyerr = AR5K_REG_MS(rxstat1,
                                 AR5K_5212_RX_DESC_STATUS1_PHY_ERROR_CODE);
                         if (!ah->ah_capabilities.cap_has_phyerr_counters)
                                 ath5k_ani_phy_error_report(ah, rs->rs_phyerr);
                 }
 
-                if (rx_status->rx_status_1 &
-                                AR5K_5212_RX_DESC_STATUS1_DECRYPT_CRC_ERROR)
+                if (rxstat1 & AR5K_5212_RX_DESC_STATUS1_DECRYPT_CRC_ERROR)
                         rs->rs_status |= AR5K_RXERR_DECRYPT;
 
-                if (rx_status->rx_status_1 &
-                                AR5K_5212_RX_DESC_STATUS1_MIC_ERROR)
+                if (rxstat1 & AR5K_5212_RX_DESC_STATUS1_MIC_ERROR)
                         rs->rs_status |= AR5K_RXERR_MIC;
         }
         return 0;
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
index b6561f785c6e..e9263e4c7f3e 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.c
+++ b/drivers/net/wireless/ath/ath5k/eeprom.c
@@ -660,6 +660,53 @@ ath5k_get_pcdac_intercepts(struct ath5k_hw *ah, u8 min, u8 max, u8 *vp)
                 vp[i] = (ip[i] * max + (100 - ip[i]) * min) / 100;
 }
 
+static int
+ath5k_eeprom_free_pcal_info(struct ath5k_hw *ah, int mode)
+{
+        struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
+        struct ath5k_chan_pcal_info *chinfo;
+        u8 pier, pdg;
+
+        switch (mode) {
+        case AR5K_EEPROM_MODE_11A:
+                if (!AR5K_EEPROM_HDR_11A(ee->ee_header))
+                        return 0;
+                chinfo = ee->ee_pwr_cal_a;
+                break;
+        case AR5K_EEPROM_MODE_11B:
+                if (!AR5K_EEPROM_HDR_11B(ee->ee_header))
+                        return 0;
+                chinfo = ee->ee_pwr_cal_b;
+                break;
+        case AR5K_EEPROM_MODE_11G:
+                if (!AR5K_EEPROM_HDR_11G(ee->ee_header))
+                        return 0;
+                chinfo = ee->ee_pwr_cal_g;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        for (pier = 0; pier < ee->ee_n_piers[mode]; pier++) {
+                if (!chinfo[pier].pd_curves)
+                        continue;
+
+                for (pdg = 0; pdg < ee->ee_pd_gains[mode]; pdg++) {
+                        struct ath5k_pdgain_info *pd =
+                                        &chinfo[pier].pd_curves[pdg];
+
+                        if (pd != NULL) {
+                                kfree(pd->pd_step);
+                                kfree(pd->pd_pwr);
+                        }
+                }
+
+                kfree(chinfo[pier].pd_curves);
+        }
+
+        return 0;
+}
+
 /* Convert RF5111 specific data to generic raw data
  * used by interpolation code */
 static int
@@ -684,7 +731,7 @@ ath5k_eeprom_convert_pcal_info_5111(struct ath5k_hw *ah, int mode,
                                 GFP_KERNEL);
 
                 if (!chinfo[pier].pd_curves)
-                        return -ENOMEM;
+                        goto err_out;
 
                 /* Only one curve for RF5111
                  * find out which one and place
@@ -708,12 +755,12 @@ ath5k_eeprom_convert_pcal_info_5111(struct ath5k_hw *ah, int mode,
                 pd->pd_step = kcalloc(AR5K_EEPROM_N_PWR_POINTS_5111,
                                         sizeof(u8), GFP_KERNEL);
                 if (!pd->pd_step)
-                        return -ENOMEM;
+                        goto err_out;
 
                 pd->pd_pwr = kcalloc(AR5K_EEPROM_N_PWR_POINTS_5111,
                                         sizeof(s16), GFP_KERNEL);
                 if (!pd->pd_pwr)
-                        return -ENOMEM;
+                        goto err_out;
 
                 /* Fill raw dataset
                  * (convert power to 0.25dB units
@@ -734,6 +781,10 @@ ath5k_eeprom_convert_pcal_info_5111(struct ath5k_hw *ah, int mode,
         }
 
         return 0;
+
+err_out:
+        ath5k_eeprom_free_pcal_info(ah, mode);
+        return -ENOMEM;
 }
 
 /* Parse EEPROM data */
@@ -867,7 +918,7 @@ ath5k_eeprom_convert_pcal_info_5112(struct ath5k_hw *ah, int mode,
                                         GFP_KERNEL);
 
                 if (!chinfo[pier].pd_curves)
-                        return -ENOMEM;
+                        goto err_out;
 
                 /* Fill pd_curves */
                 for (pdg = 0; pdg < ee->ee_pd_gains[mode]; pdg++) {
@@ -886,14 +937,13 @@ ath5k_eeprom_convert_pcal_info_5112(struct ath5k_hw *ah, int mode,
                                                 sizeof(u8), GFP_KERNEL);
 
                                 if (!pd->pd_step)
-                                        return -ENOMEM;
+                                        goto err_out;
 
                                 pd->pd_pwr = kcalloc(pd->pd_points,
                                                 sizeof(s16), GFP_KERNEL);
 
                                 if (!pd->pd_pwr)
-                                        return -ENOMEM;
-
+                                        goto err_out;
 
                                 /* Fill raw dataset
                                  * (all power levels are in 0.25dB units) */
@@ -925,13 +975,13 @@ ath5k_eeprom_convert_pcal_info_5112(struct ath5k_hw *ah, int mode,
                                                 sizeof(u8), GFP_KERNEL);
 
                                 if (!pd->pd_step)
-                                        return -ENOMEM;
+                                        goto err_out;
 
                                 pd->pd_pwr = kcalloc(pd->pd_points,
                                                 sizeof(s16), GFP_KERNEL);
 
                                 if (!pd->pd_pwr)
-                                        return -ENOMEM;
+                                        goto err_out;
 
                                 /* Fill raw dataset
                                  * (all power levels are in 0.25dB units) */
@@ -954,6 +1004,10 @@ ath5k_eeprom_convert_pcal_info_5112(struct ath5k_hw *ah, int mode,
         }
 
         return 0;
+
+err_out:
+        ath5k_eeprom_free_pcal_info(ah, mode);
+        return -ENOMEM;
 }
 
 /* Parse EEPROM data */
@@ -1156,7 +1210,7 @@ ath5k_eeprom_convert_pcal_info_2413(struct ath5k_hw *ah, int mode,
                                         GFP_KERNEL);
 
                 if (!chinfo[pier].pd_curves)
-                        return -ENOMEM;
+                        goto err_out;
 
                 /* Fill pd_curves */
                 for (pdg = 0; pdg < ee->ee_pd_gains[mode]; pdg++) {
@@ -1177,13 +1231,13 @@ ath5k_eeprom_convert_pcal_info_2413(struct ath5k_hw *ah, int mode,
                                         sizeof(u8), GFP_KERNEL);
 
                         if (!pd->pd_step)
-                                return -ENOMEM;
+                                goto err_out;
 
                         pd->pd_pwr = kcalloc(pd->pd_points,
                                         sizeof(s16), GFP_KERNEL);
 
                         if (!pd->pd_pwr)
-                                return -ENOMEM;
+                                goto err_out;
 
                         /* Fill raw dataset
                          * convert all pwr levels to
@@ -1213,6 +1267,10 @@ ath5k_eeprom_convert_pcal_info_2413(struct ath5k_hw *ah, int mode,
         }
 
         return 0;
+
+err_out:
+        ath5k_eeprom_free_pcal_info(ah, mode);
+        return -ENOMEM;
 }
 
 /* Parse EEPROM data */
@@ -1534,53 +1592,6 @@ ath5k_eeprom_read_pcal_info(struct ath5k_hw *ah)
         return 0;
 }
 
-static int
-ath5k_eeprom_free_pcal_info(struct ath5k_hw *ah, int mode)
-{
-        struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
-        struct ath5k_chan_pcal_info *chinfo;
-        u8 pier, pdg;
-
-        switch (mode) {
-        case AR5K_EEPROM_MODE_11A:
-                if (!AR5K_EEPROM_HDR_11A(ee->ee_header))
-                        return 0;
-                chinfo = ee->ee_pwr_cal_a;
-                break;
-        case AR5K_EEPROM_MODE_11B:
-                if (!AR5K_EEPROM_HDR_11B(ee->ee_header))
-                        return 0;
-                chinfo = ee->ee_pwr_cal_b;
-                break;
-        case AR5K_EEPROM_MODE_11G:
-                if (!AR5K_EEPROM_HDR_11G(ee->ee_header))
-                        return 0;
-                chinfo = ee->ee_pwr_cal_g;
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        for (pier = 0; pier < ee->ee_n_piers[mode]; pier++) {
-                if (!chinfo[pier].pd_curves)
-                        continue;
-
-                for (pdg = 0; pdg < ee->ee_pd_gains[mode]; pdg++) {
-                        struct ath5k_pdgain_info *pd =
-                                        &chinfo[pier].pd_curves[pdg];
-
-                        if (pd != NULL) {
-                                kfree(pd->pd_step);
-                                kfree(pd->pd_pwr);
-                        }
-                }
-
-                kfree(chinfo[pier].pd_curves);
-        }
-
-        return 0;
-}
-
 /* Read conformance test limits used for regulatory control */
 static int
 ath5k_eeprom_read_ctl_info(struct ath5k_hw *ah)
@@ -1721,35 +1732,6 @@ ath5k_eeprom_read_spur_chans(struct ath5k_hw *ah)
         return ret;
 }
 
-/*
- * Read the MAC address from eeprom
- */
-int ath5k_eeprom_read_mac(struct ath5k_hw *ah, u8 *mac)
-{
-        u8 mac_d[ETH_ALEN] = {};
-        u32 total, offset;
-        u16 data;
-        int octet;
-
-        AR5K_EEPROM_READ(0x20, data);
-
-        for (offset = 0x1f, octet = 0, total = 0; offset >= 0x1d; offset--) {
-                AR5K_EEPROM_READ(offset, data);
-
-                total += data;
-                mac_d[octet + 1] = data & 0xff;
-                mac_d[octet] = data >> 8;
-                octet += 2;
-        }
-
-        if (!total || total == 3 * 0xffff)
-                return -EINVAL;
-
-        memcpy(mac, mac_d, ETH_ALEN);
-
-        return 0;
-}
-
 
 /***********************\
 * Init/Detach functions *
diff --git a/drivers/net/wireless/ath/ath5k/mac80211-ops.c b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
index 9be29b728b1c..807bd6440169 100644
--- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c
+++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
@@ -282,6 +282,15 @@ ath5k_bss_info_changed(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         if (changes & BSS_CHANGED_BEACON_INT)
                 sc->bintval = bss_conf->beacon_int;
 
+        if (changes & BSS_CHANGED_ERP_SLOT) {
+                int slot_time;
+
+                ah->ah_short_slot = bss_conf->use_short_slot;
+                slot_time = ath5k_hw_get_default_slottime(ah) +
+                            3 * ah->ah_coverage_class;
+                ath5k_hw_set_ifs_intervals(ah, slot_time);
+        }
+
         if (changes & BSS_CHANGED_ASSOC) {
                 avf->assoc = bss_conf->assoc;
                 if (bss_conf->assoc)
diff --git a/drivers/net/wireless/ath/ath5k/pci.c b/drivers/net/wireless/ath/ath5k/pci.c
index 66598a0d1df0..5cc4a2fe47b6 100644
--- a/drivers/net/wireless/ath/ath5k/pci.c
+++ b/drivers/net/wireless/ath/ath5k/pci.c
@@ -17,6 +17,7 @@
 #include <linux/nl80211.h>
 #include <linux/pci.h>
 #include <linux/pci-aspm.h>
+#include <linux/etherdevice.h>
 #include "../ath.h"
 #include "ath5k.h"
 #include "debug.h"
@@ -108,11 +109,42 @@ int ath5k_hw_read_srev(struct ath5k_hw *ah)
         return 0;
 }
 
+/*
+ * Read the MAC address from eeprom or platform_data
+ */
+static int ath5k_pci_eeprom_read_mac(struct ath5k_hw *ah, u8 *mac)
+{
+        u8 mac_d[ETH_ALEN] = {};
+        u32 total, offset;
+        u16 data;
+        int octet;
+
+        AR5K_EEPROM_READ(0x20, data);
+
+        for (offset = 0x1f, octet = 0, total = 0; offset >= 0x1d; offset--) {
+                AR5K_EEPROM_READ(offset, data);
+
+                total += data;
+                mac_d[octet + 1] = data & 0xff;
+                mac_d[octet] = data >> 8;
+                octet += 2;
+        }
+
+        if (!total || total == 3 * 0xffff)
+                return -EINVAL;
+
+        memcpy(mac, mac_d, ETH_ALEN);
+
+        return 0;
+}
+
+
 /* Common ath_bus_opts structure */
 static const struct ath_bus_ops ath_pci_bus_ops = {
         .ath_bus_type = ATH_PCI,
         .read_cachesize = ath5k_pci_read_cachesize,
         .eeprom_read = ath5k_pci_eeprom_read,
+        .eeprom_read_mac = ath5k_pci_eeprom_read_mac,
 };
 
 /********************\
diff --git a/drivers/net/wireless/ath/ath5k/pcu.c b/drivers/net/wireless/ath/ath5k/pcu.c
index a702817daf72..71b60b7c617e 100644
--- a/drivers/net/wireless/ath/ath5k/pcu.c
+++ b/drivers/net/wireless/ath/ath5k/pcu.c
@@ -75,7 +75,7 @@ static const unsigned int ack_rates_high[] =
  * bwmodes.
  */
 int ath5k_hw_get_frame_duration(struct ath5k_hw *ah,
-                int len, struct ieee80211_rate *rate)
+                int len, struct ieee80211_rate *rate, bool shortpre)
 {
         struct ath5k_softc *sc = ah->ah_sc;
         int sifs, preamble, plcp_bits, sym_time;
@@ -84,9 +84,15 @@ int ath5k_hw_get_frame_duration(struct ath5k_hw *ah,
 
         /* Fallback */
         if (!ah->ah_bwmode) {
-                dur = ieee80211_generic_frame_duration(sc->hw,
-                                                NULL, len, rate);
-                return le16_to_cpu(dur);
+                __le16 raw_dur = ieee80211_generic_frame_duration(sc->hw,
+                                        NULL, len, rate);
+
+                /* subtract difference between long and short preamble */
+                dur = le16_to_cpu(raw_dur);
+                if (shortpre)
+                        dur -= 96;
+
+                return dur;
         }
 
         bitrate = rate->bitrate;
@@ -145,9 +151,9 @@ unsigned int ath5k_hw_get_default_slottime(struct ath5k_hw *ah)
                 slot_time = AR5K_INIT_SLOT_TIME_QUARTER_RATE;
                 break;
         case AR5K_BWMODE_DEFAULT:
-                slot_time = AR5K_INIT_SLOT_TIME_DEFAULT;
         default:
-                if (channel->hw_value & CHANNEL_CCK)
+                slot_time = AR5K_INIT_SLOT_TIME_DEFAULT;
+                if ((channel->hw_value & CHANNEL_CCK) && !ah->ah_short_slot)
                         slot_time = AR5K_INIT_SLOT_TIME_B;
                 break;
         }
@@ -263,27 +269,14 @@ static inline void ath5k_hw_write_rate_duration(struct ath5k_hw *ah)
                  * actual rate for this rate. See mac80211 tx.c
                  * ieee80211_duration() for a brief description of
                  * what rate we should choose to TX ACKs. */
-                tx_time = ath5k_hw_get_frame_duration(ah, 10, rate);
+                tx_time = ath5k_hw_get_frame_duration(ah, 10, rate, false);
 
                 ath5k_hw_reg_write(ah, tx_time, reg);
 
                 if (!(rate->flags & IEEE80211_RATE_SHORT_PREAMBLE))
                         continue;
 
-                /*
-                 * We're not distinguishing short preamble here,
-                 * This is true, all we'll get is a longer value here
-                 * which is not necessarilly bad. We could use
-                 * export ieee80211_frame_duration() but that needs to be
-                 * fixed first to be properly used by mac802111 drivers:
-                 *
-                 *  - remove erp stuff and let the routine figure ofdm
-                 *    erp rates
-                 *  - remove passing argument ieee80211_local as
-                 *    drivers don't have access to it
-                 *  - move drivers using ieee80211_generic_frame_duration()
-                 *    to this
-                 */
+                tx_time = ath5k_hw_get_frame_duration(ah, 10, rate, true);
                 ath5k_hw_reg_write(ah, tx_time,
                         reg + (AR5K_SET_SHORT_PREAMBLE << 2));
         }
diff --git a/drivers/net/wireless/ath/ath5k/qcu.c b/drivers/net/wireless/ath/ath5k/qcu.c
index 3343fb9e4940..b18c5021aac3 100644
--- a/drivers/net/wireless/ath/ath5k/qcu.c
+++ b/drivers/net/wireless/ath/ath5k/qcu.c
@@ -519,7 +519,7 @@ int ath5k_hw_set_ifs_intervals(struct ath5k_hw *ah, unsigned int slot_time)
                 return -EINVAL;
 
         sifs = ath5k_hw_get_default_sifs(ah);
-        sifs_clock = ath5k_hw_htoclock(ah, sifs);
+        sifs_clock = ath5k_hw_htoclock(ah, sifs - 2);
 
         /* EIFS
          * Txtime of ack at lowest rate + SIFS + DIFS
@@ -550,7 +550,7 @@ int ath5k_hw_set_ifs_intervals(struct ath5k_hw *ah, unsigned int slot_time)
         else
                 rate = &sc->sbands[IEEE80211_BAND_2GHZ].bitrates[0];
 
-        ack_tx_time = ath5k_hw_get_frame_duration(ah, 10, rate);
+        ack_tx_time = ath5k_hw_get_frame_duration(ah, 10, rate, false);
 
         /* ack_tx_time includes an SIFS already */
         eifs = ack_tx_time + sifs + 2 * slot_time;
diff --git a/drivers/net/wireless/ath/ath9k/Kconfig b/drivers/net/wireless/ath/ath9k/Kconfig
index ad57a6d23110..d9ff8413ab9a 100644
--- a/drivers/net/wireless/ath/ath9k/Kconfig
+++ b/drivers/net/wireless/ath/ath9k/Kconfig
@@ -5,7 +5,7 @@ config ATH9K_COMMON
 
 config ATH9K
         tristate "Atheros 802.11n wireless cards support"
-        depends on PCI && MAC80211
+        depends on MAC80211
         select ATH9K_HW
         select MAC80211_LEDS
         select LEDS_CLASS
@@ -23,6 +23,25 @@ config ATH9K
 
           If you choose to build a module, it'll be called ath9k.
 
+config ATH9K_PCI
+        bool "Atheros ath9k PCI/PCIe bus support"
+        depends on ATH9K && PCI
+        default PCI
+        ---help---
+          This option enables the PCI bus support in ath9k.
+
+          Say Y, if you have a compatible PCI/PCIe wireless card.
+
+config ATH9K_AHB
+        bool "Atheros ath9k AHB bus support"
+        depends on ATH9K
+        default n
+        ---help---
+          This option enables the AHB bus support in ath9k.
+
+          Say Y, if you have a SoC with a compatible built-in
+          wireless MAC. Say N if unsure.
+
 config ATH9K_DEBUGFS
         bool "Atheros ath9k debugging"
         depends on ATH9K && DEBUG_FS
diff --git a/drivers/net/wireless/ath/ath9k/Makefile b/drivers/net/wireless/ath/ath9k/Makefile
index 4d66ca8042eb..05a6fade7b1c 100644
--- a/drivers/net/wireless/ath/ath9k/Makefile
+++ b/drivers/net/wireless/ath/ath9k/Makefile
@@ -6,8 +6,8 @@ ath9k-y +=	beacon.o \
                 xmit.o \
 
 ath9k-$(CONFIG_ATH9K_RATE_CONTROL) += rc.o
-ath9k-$(CONFIG_PCI) += pci.o
-ath9k-$(CONFIG_ATHEROS_AR71XX) += ahb.o
+ath9k-$(CONFIG_ATH9K_PCI) += pci.o
+ath9k-$(CONFIG_ATH9K_AHB) += ahb.o
 ath9k-$(CONFIG_ATH9K_DEBUGFS) += debug.o
 
 obj-$(CONFIG_ATH9K) += ath9k.o
@@ -48,4 +48,6 @@ ath9k_htc-y +=	htc_hst.o \
                 htc_drv_init.o \
                 htc_drv_gpio.o
 
+ath9k_htc-$(CONFIG_ATH9K_HTC_DEBUGFS) += htc_drv_debug.o
+
 obj-$(CONFIG_ATH9K_HTC) += ath9k_htc.o
diff --git a/drivers/net/wireless/ath/ath9k/ahb.c b/drivers/net/wireless/ath/ath9k/ahb.c
index 9cb0efa9b4c0..5193ed58a17b 100644
--- a/drivers/net/wireless/ath/ath9k/ahb.c
+++ b/drivers/net/wireless/ath/ath9k/ahb.c
@@ -21,6 +21,14 @@
 #include <linux/ath9k_platform.h>
 #include "ath9k.h"
 
+const struct platform_device_id ath9k_platform_id_table[] = {
+        {
+                .name = "ath9k",
+                .driver_data = AR5416_AR9100_DEVID,
+        },
+        {},
+};
+
 /* return bus cachesize in 4B word units */
 static void ath_ahb_read_cachesize(struct ath_common *common, int *csz)
 {
@@ -57,6 +65,7 @@ static int ath_ahb_probe(struct platform_device *pdev)
         struct ath_softc *sc;
         struct ieee80211_hw *hw;
         struct resource *res;
+        const struct platform_device_id *id = platform_get_device_id(pdev);
         int irq;
         int ret = 0;
         struct ath_hw *ah;
@@ -116,7 +125,7 @@ static int ath_ahb_probe(struct platform_device *pdev)
                 goto err_free_hw;
         }
 
-        ret = ath9k_init_device(AR5416_AR9100_DEVID, sc, 0x0, &ath_ahb_bus_ops);
+        ret = ath9k_init_device(id->driver_data, sc, 0x0, &ath_ahb_bus_ops);
         if (ret) {
                 dev_err(&pdev->dev, "failed to initialize device\n");
                 goto err_irq;
@@ -165,8 +174,11 @@ static struct platform_driver ath_ahb_driver = {
                 .name   = "ath9k",
                 .owner  = THIS_MODULE,
         },
+        .id_table    = ath9k_platform_id_table,
 };
 
+MODULE_DEVICE_TABLE(platform, ath9k_platform_id_table);
+
 int ath_ahb_init(void)
 {
         return platform_driver_register(&ath_ahb_driver);
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_phy.h b/drivers/net/wireless/ath/ath9k/ar9002_phy.h
index 37663dbbcf57..47780ef1c892 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9002_phy.h
@@ -483,7 +483,11 @@
 #define AR_PHY_TX_PWRCTRL_INIT_TX_GAIN     0x01F80000
 #define AR_PHY_TX_PWRCTRL_INIT_TX_GAIN_S   19
 
+#define AR_PHY_TX_PWRCTRL8       0xa278
+
 #define AR_PHY_TX_PWRCTRL9       0xa27C
+
+#define AR_PHY_TX_PWRCTRL10       0xa394
 #define AR_PHY_TX_DESIRED_SCALE_CCK        0x00007C00
 #define AR_PHY_TX_DESIRED_SCALE_CCK_S      10
 #define AR_PHY_TX_PWRCTRL9_RES_DC_REMOVAL  0x80000000
@@ -495,6 +499,8 @@
 
 #define AR_PHY_CH0_TX_PWRCTRL11  0xa398
 #define AR_PHY_CH1_TX_PWRCTRL11  0xb398
+#define AR_PHY_CH0_TX_PWRCTRL12  0xa3dc
+#define AR_PHY_CH0_TX_PWRCTRL13  0xa3e0
 #define AR_PHY_TX_PWRCTRL_OLPC_TEMP_COMP   0x0000FC00
 #define AR_PHY_TX_PWRCTRL_OLPC_TEMP_COMP_S 10
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
index 9ecca93392e8..f915a3dbfcad 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
@@ -34,10 +34,10 @@ static const u32 ar9300_2p2_radio_postamble[][5] = {
 
 static const u32 ar9300Modes_lowest_ob_db_tx_gain_table_2p2[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x0000a2dc, 0x00033800, 0x00033800, 0x00637800, 0x00637800},
-        {0x0000a2e0, 0x0003c000, 0x0003c000, 0x03838000, 0x03838000},
-        {0x0000a2e4, 0x03fc0000, 0x03fc0000, 0x03fc0000, 0x03fc0000},
-        {0x0000a2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352},
+        {0x0000a2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584},
+        {0x0000a2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
         {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
         {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
@@ -119,14 +119,14 @@ static const u32 ar9300Modes_lowest_ob_db_tx_gain_table_2p2[][5] = {
         {0x0000a634, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
         {0x0000a638, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
         {0x0000a63c, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
-        {0x0000b2dc, 0x00033800, 0x00033800, 0x00637800, 0x00637800},
-        {0x0000b2e0, 0x0003c000, 0x0003c000, 0x03838000, 0x03838000},
-        {0x0000b2e4, 0x03fc0000, 0x03fc0000, 0x03fc0000, 0x03fc0000},
-        {0x0000b2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000c2dc, 0x00033800, 0x00033800, 0x00637800, 0x00637800},
-        {0x0000c2e0, 0x0003c000, 0x0003c000, 0x03838000, 0x03838000},
-        {0x0000c2e4, 0x03fc0000, 0x03fc0000, 0x03fc0000, 0x03fc0000},
-        {0x0000c2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352},
+        {0x0000b2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584},
+        {0x0000b2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800},
+        {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x0000c2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352},
+        {0x0000c2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584},
+        {0x0000c2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800},
+        {0x0000c2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
         {0x00016044, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
         {0x00016048, 0x62480001, 0x62480001, 0x62480001, 0x62480001},
         {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
@@ -835,10 +835,10 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
 
 static const u32 ar9300Modes_high_power_tx_gain_table_2p2[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x0000a2dc, 0x0380c7fc, 0x0380c7fc, 0x00637800, 0x00637800},
-        {0x0000a2e0, 0x0000f800, 0x0000f800, 0x03838000, 0x03838000},
-        {0x0000a2e4, 0x03ff0000, 0x03ff0000, 0x03fc0000, 0x03fc0000},
-        {0x0000a2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a2dc, 0x0380c7fc, 0x0380c7fc, 0x03aaa352, 0x03aaa352},
+        {0x0000a2e0, 0x0000f800, 0x0000f800, 0x03ccc584, 0x03ccc584},
+        {0x0000a2e4, 0x03ff0000, 0x03ff0000, 0x03f0f800, 0x03f0f800},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
         {0x0000a410, 0x000050d8, 0x000050d8, 0x000050d9, 0x000050d9},
         {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
         {0x0000a504, 0x04002222, 0x04002222, 0x04000002, 0x04000002},
@@ -920,14 +920,14 @@ static const u32 ar9300Modes_high_power_tx_gain_table_2p2[][5] = {
         {0x0000a634, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
         {0x0000a638, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
         {0x0000a63c, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
-        {0x0000b2dc, 0x0380c7fc, 0x0380c7fc, 0x00637800, 0x00637800},
-        {0x0000b2e0, 0x0000f800, 0x0000f800, 0x03838000, 0x03838000},
-        {0x0000b2e4, 0x03ff0000, 0x03ff0000, 0x03fc0000, 0x03fc0000},
-        {0x0000b2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000c2dc, 0x0380c7fc, 0x0380c7fc, 0x00637800, 0x00637800},
-        {0x0000c2e0, 0x0000f800, 0x0000f800, 0x03838000, 0x03838000},
-        {0x0000c2e4, 0x03ff0000, 0x03ff0000, 0x03fc0000, 0x03fc0000},
-        {0x0000c2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b2dc, 0x0380c7fc, 0x0380c7fc, 0x03aaa352, 0x03aaa352},
+        {0x0000b2e0, 0x0000f800, 0x0000f800, 0x03ccc584, 0x03ccc584},
+        {0x0000b2e4, 0x03ff0000, 0x03ff0000, 0x03f0f800, 0x03f0f800},
+        {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x0000c2dc, 0x0380c7fc, 0x0380c7fc, 0x03aaa352, 0x03aaa352},
+        {0x0000c2e0, 0x0000f800, 0x0000f800, 0x03ccc584, 0x03ccc584},
+        {0x0000c2e4, 0x03ff0000, 0x03ff0000, 0x03f0f800, 0x03f0f800},
+        {0x0000c2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
         {0x00016044, 0x056db2e6, 0x056db2e6, 0x056db2e6, 0x056db2e6},
         {0x00016048, 0xae480001, 0xae480001, 0xae480001, 0xae480001},
         {0x00016068, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c},
@@ -941,10 +941,10 @@ static const u32 ar9300Modes_high_power_tx_gain_table_2p2[][5] = {
 
 static const u32 ar9300Modes_high_ob_db_tx_gain_table_2p2[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x0000a2dc, 0x01feee00, 0x01feee00, 0x00637800, 0x00637800},
-        {0x0000a2e0, 0x0000f000, 0x0000f000, 0x03838000, 0x03838000},
-        {0x0000a2e4, 0x01ff0000, 0x01ff0000, 0x03fc0000, 0x03fc0000},
-        {0x0000a2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a2dc, 0x01feee00, 0x01feee00, 0x03aaa352, 0x03aaa352},
+        {0x0000a2e0, 0x0000f000, 0x0000f000, 0x03ccc584, 0x03ccc584},
+        {0x0000a2e4, 0x01ff0000, 0x01ff0000, 0x03f0f800, 0x03f0f800},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
         {0x0000a410, 0x000050d8, 0x000050d8, 0x000050d9, 0x000050d9},
         {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
         {0x0000a504, 0x04002222, 0x04002222, 0x04000002, 0x04000002},
@@ -1026,14 +1026,14 @@ static const u32 ar9300Modes_high_ob_db_tx_gain_table_2p2[][5] = {
         {0x0000a634, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
         {0x0000a638, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
         {0x0000a63c, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
-        {0x0000b2dc, 0x01feee00, 0x01feee00, 0x00637800, 0x00637800},
-        {0x0000b2e0, 0x0000f000, 0x0000f000, 0x03838000, 0x03838000},
-        {0x0000b2e4, 0x01ff0000, 0x01ff0000, 0x03fc0000, 0x03fc0000},
-        {0x0000b2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000c2dc, 0x01feee00, 0x01feee00, 0x00637800, 0x00637800},
-        {0x0000c2e0, 0x0000f000, 0x0000f000, 0x03838000, 0x03838000},
-        {0x0000c2e4, 0x01ff0000, 0x01ff0000, 0x03fc0000, 0x03fc0000},
-        {0x0000c2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000b2dc, 0x01feee00, 0x01feee00, 0x03aaa352, 0x03aaa352},
+        {0x0000b2e0, 0x0000f000, 0x0000f000, 0x03ccc584, 0x03ccc584},
+        {0x0000b2e4, 0x01ff0000, 0x01ff0000, 0x03f0f800, 0x03f0f800},
+        {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x0000c2dc, 0x01feee00, 0x01feee00, 0x03aaa352, 0x03aaa352},
+        {0x0000c2e0, 0x0000f000, 0x0000f000, 0x03ccc584, 0x03ccc584},
+        {0x0000c2e4, 0x01ff0000, 0x01ff0000, 0x03f0f800, 0x03f0f800},
+        {0x0000c2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
         {0x00016044, 0x056db2e4, 0x056db2e4, 0x056db2e4, 0x056db2e4},
         {0x00016048, 0x8e480001, 0x8e480001, 0x8e480001, 0x8e480001},
         {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
@@ -1307,10 +1307,10 @@ static const u32 ar9300Common_rx_gain_table_2p2[][2] = {
 
 static const u32 ar9300Modes_low_ob_db_tx_gain_table_2p2[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x0000a2dc, 0x0380c7fc, 0x0380c7fc, 0x00637800, 0x00637800},
-        {0x0000a2e0, 0x0000f800, 0x0000f800, 0x03838000, 0x03838000},
-        {0x0000a2e4, 0x03ff0000, 0x03ff0000, 0x03fc0000, 0x03fc0000},
-        {0x0000a2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352},
+        {0x0000a2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584},
+        {0x0000a2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
         {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
         {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
@@ -1329,21 +1329,21 @@ static const u32 ar9300Modes_low_ob_db_tx_gain_table_2p2[][5] = {
         {0x0000a538, 0x4702244a, 0x4702244a, 0x34000e24, 0x34000e24},
         {0x0000a53c, 0x4b02244c, 0x4b02244c, 0x38001640, 0x38001640},
         {0x0000a540, 0x4e02246c, 0x4e02246c, 0x3c001660, 0x3c001660},
-        {0x0000a544, 0x5302266c, 0x5302266c, 0x3f001861, 0x3f001861},
-        {0x0000a548, 0x5702286c, 0x5702286c, 0x43001a81, 0x43001a81},
-        {0x0000a54c, 0x5c02486b, 0x5c02486b, 0x47001a83, 0x47001a83},
-        {0x0000a550, 0x61024a6c, 0x61024a6c, 0x4a001c84, 0x4a001c84},
-        {0x0000a554, 0x66026a6c, 0x66026a6c, 0x4e001ce3, 0x4e001ce3},
-        {0x0000a558, 0x6b026e6c, 0x6b026e6c, 0x52001ce5, 0x52001ce5},
-        {0x0000a55c, 0x7002708c, 0x7002708c, 0x56001ce9, 0x56001ce9},
-        {0x0000a560, 0x7302b08a, 0x7302b08a, 0x5a001ceb, 0x5a001ceb},
-        {0x0000a564, 0x7702b08c, 0x7702b08c, 0x5d001eec, 0x5d001eec},
-        {0x0000a568, 0x7702b08c, 0x7702b08c, 0x5d001eec, 0x5d001eec},
-        {0x0000a56c, 0x7702b08c, 0x7702b08c, 0x5d001eec, 0x5d001eec},
-        {0x0000a570, 0x7702b08c, 0x7702b08c, 0x5d001eec, 0x5d001eec},
-        {0x0000a574, 0x7702b08c, 0x7702b08c, 0x5d001eec, 0x5d001eec},
-        {0x0000a578, 0x7702b08c, 0x7702b08c, 0x5d001eec, 0x5d001eec},
-        {0x0000a57c, 0x7702b08c, 0x7702b08c, 0x5d001eec, 0x5d001eec},
+        {0x0000a544, 0x52022470, 0x52022470, 0x3f001861, 0x3f001861},
+        {0x0000a548, 0x55022490, 0x55022490, 0x43001a81, 0x43001a81},
+        {0x0000a54c, 0x59022492, 0x59022492, 0x47001a83, 0x47001a83},
+        {0x0000a550, 0x5d022692, 0x5d022692, 0x4a001c84, 0x4a001c84},
+        {0x0000a554, 0x61022892, 0x61022892, 0x4e001ce3, 0x4e001ce3},
+        {0x0000a558, 0x65024890, 0x65024890, 0x52001ce5, 0x52001ce5},
+        {0x0000a55c, 0x69024892, 0x69024892, 0x56001ce9, 0x56001ce9},
+        {0x0000a560, 0x6e024c92, 0x6e024c92, 0x5a001ceb, 0x5a001ceb},
+        {0x0000a564, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
+        {0x0000a568, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
+        {0x0000a56c, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
+        {0x0000a570, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
+        {0x0000a574, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
+        {0x0000a578, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
+        {0x0000a57c, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec},
         {0x0000a580, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
         {0x0000a584, 0x06800003, 0x06800003, 0x04800002, 0x04800002},
         {0x0000a588, 0x0a800020, 0x0a800020, 0x08800004, 0x08800004},
@@ -1361,45 +1361,45 @@ static const u32 ar9300Modes_low_ob_db_tx_gain_table_2p2[][5] = {
         {0x0000a5b8, 0x4782244a, 0x4782244a, 0x34800e24, 0x34800e24},
         {0x0000a5bc, 0x4b82244c, 0x4b82244c, 0x38801640, 0x38801640},
         {0x0000a5c0, 0x4e82246c, 0x4e82246c, 0x3c801660, 0x3c801660},
-        {0x0000a5c4, 0x5382266c, 0x5382266c, 0x3f801861, 0x3f801861},
-        {0x0000a5c8, 0x5782286c, 0x5782286c, 0x43801a81, 0x43801a81},
-        {0x0000a5cc, 0x5c82486b, 0x5c82486b, 0x47801a83, 0x47801a83},
-        {0x0000a5d0, 0x61824a6c, 0x61824a6c, 0x4a801c84, 0x4a801c84},
-        {0x0000a5d4, 0x66826a6c, 0x66826a6c, 0x4e801ce3, 0x4e801ce3},
-        {0x0000a5d8, 0x6b826e6c, 0x6b826e6c, 0x52801ce5, 0x52801ce5},
-        {0x0000a5dc, 0x7082708c, 0x7082708c, 0x56801ce9, 0x56801ce9},
-        {0x0000a5e0, 0x7382b08a, 0x7382b08a, 0x5a801ceb, 0x5a801ceb},
-        {0x0000a5e4, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
-        {0x0000a5e8, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
-        {0x0000a5ec, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
-        {0x0000a5f0, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
-        {0x0000a5f4, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
-        {0x0000a5f8, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
-        {0x0000a5fc, 0x7782b08c, 0x7782b08c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5c4, 0x52822470, 0x52822470, 0x3f801861, 0x3f801861},
+        {0x0000a5c8, 0x55822490, 0x55822490, 0x43801a81, 0x43801a81},
+        {0x0000a5cc, 0x59822492, 0x59822492, 0x47801a83, 0x47801a83},
+        {0x0000a5d0, 0x5d822692, 0x5d822692, 0x4a801c84, 0x4a801c84},
+        {0x0000a5d4, 0x61822892, 0x61822892, 0x4e801ce3, 0x4e801ce3},
+        {0x0000a5d8, 0x65824890, 0x65824890, 0x52801ce5, 0x52801ce5},
+        {0x0000a5dc, 0x69824892, 0x69824892, 0x56801ce9, 0x56801ce9},
+        {0x0000a5e0, 0x6e824c92, 0x6e824c92, 0x5a801ceb, 0x5a801ceb},
+        {0x0000a5e4, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
+        {0x0000a5e8, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
+        {0x0000a5ec, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f0, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f4, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f8, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
+        {0x0000a5fc, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec},
         {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a610, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a614, 0x01404000, 0x01404000, 0x01404000, 0x01404000},
-        {0x0000a618, 0x01404501, 0x01404501, 0x01404501, 0x01404501},
-        {0x0000a61c, 0x02008802, 0x02008802, 0x02008501, 0x02008501},
-        {0x0000a620, 0x0300cc03, 0x0300cc03, 0x0280ca03, 0x0280ca03},
-        {0x0000a624, 0x0300cc03, 0x0300cc03, 0x03010c04, 0x03010c04},
-        {0x0000a628, 0x0300cc03, 0x0300cc03, 0x04014c04, 0x04014c04},
-        {0x0000a62c, 0x03810c03, 0x03810c03, 0x04015005, 0x04015005},
-        {0x0000a630, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
-        {0x0000a634, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
-        {0x0000a638, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
-        {0x0000a63c, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
-        {0x0000b2dc, 0x0380c7fc, 0x0380c7fc, 0x00637800, 0x00637800},
-        {0x0000b2e0, 0x0000f800, 0x0000f800, 0x03838000, 0x03838000},
-        {0x0000b2e4, 0x03ff0000, 0x03ff0000, 0x03fc0000, 0x03fc0000},
-        {0x0000b2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000c2dc, 0x0380c7fc, 0x0380c7fc, 0x00637800, 0x00637800},
-        {0x0000c2e0, 0x0000f800, 0x0000f800, 0x03838000, 0x03838000},
-        {0x0000c2e4, 0x03ff0000, 0x03ff0000, 0x03fc0000, 0x03fc0000},
-        {0x0000c2e8, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a614, 0x02004000, 0x02004000, 0x01404000, 0x01404000},
+        {0x0000a618, 0x02004801, 0x02004801, 0x01404501, 0x01404501},
+        {0x0000a61c, 0x02808a02, 0x02808a02, 0x02008501, 0x02008501},
+        {0x0000a620, 0x0380ce03, 0x0380ce03, 0x0280ca03, 0x0280ca03},
+        {0x0000a624, 0x04411104, 0x04411104, 0x03010c04, 0x03010c04},
+        {0x0000a628, 0x04411104, 0x04411104, 0x04014c04, 0x04014c04},
+        {0x0000a62c, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
+        {0x0000a630, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
+        {0x0000a634, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
+        {0x0000a638, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
+        {0x0000a63c, 0x04411104, 0x04411104, 0x04015005, 0x04015005},
+        {0x0000b2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352},
+        {0x0000b2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584},
+        {0x0000b2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800},
+        {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x0000c2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352},
+        {0x0000c2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584},
+        {0x0000c2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800},
+        {0x0000c2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
         {0x00016044, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
         {0x00016048, 0x66480001, 0x66480001, 0x66480001, 0x66480001},
         {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index eb250d6b8038..1bc33f51e466 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -75,9 +75,18 @@ static int ar9003_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
         freq = centers.synth_center;
 
         if (freq < 4800) {     /* 2 GHz, fractional mode */
-                if (AR_SREV_9485(ah))
-                        channelSel = CHANSEL_2G_9485(freq);
-                else
+                if (AR_SREV_9485(ah)) {
+                        u32 chan_frac;
+
+                        /*
+                         * freq_ref = 40 / (refdiva >> amoderefsel); where refdiva=1 and amoderefsel=0
+                         * ndiv = ((chan_mhz * 4) / 3) / freq_ref;
+                         * chansel = int(ndiv), chanfrac = (ndiv - chansel) * 0x20000
+                         */
+                        channelSel = (freq * 4) / 120;
+                        chan_frac = (((freq * 4) % 120) * 0x20000) / 120;
+                        channelSel = (channelSel << 17) | chan_frac;
+                } else
                         channelSel = CHANSEL_2G(freq);
                 /* Set to 2G mode */
                 bMode = 1;
@@ -401,7 +410,7 @@ static void ar9003_hw_spur_mitigate_ofdm(struct ath_hw *ah,
 
         ar9003_hw_spur_ofdm_clear(ah);
 
-        for (i = 0; spurChansPtr[i] && i < 5; i++) {
+        for (i = 0; i < AR_EEPROM_MODAL_SPURS && spurChansPtr[i]; i++) {
                 freq_offset = FBIN2FREQ(spurChansPtr[i], mode) - synth_freq;
                 if (abs(freq_offset) < range) {
                         ar9003_hw_spur_ofdm_work(ah, chan, freq_offset);
diff --git a/drivers/net/wireless/ath/ath9k/ar9485_initvals.h b/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
index f91f73e50d00..fbdde29f0ab8 100644
--- a/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
@@ -396,7 +396,7 @@ static const u32 ar9485Modes_high_ob_db_tx_gain_1_1[][5] = {
         {0x0000a54c, 0x7203feca, 0x7203feca, 0x51001865, 0x51001865},
         {0x0000a550, 0x7703ff0b, 0x7703ff0b, 0x55001a86, 0x55001a86},
         {0x0000a554, 0x7d06ffcb, 0x7d06ffcb, 0x57001ce9, 0x57001ce9},
-        {0x0000a558, 0x8407ff0b, 0x8407ff0b, 0x5a001eeb, 0x5a001eeb},
+        {0x0000a558, 0x8407ff0b, 0x8407ff0b, 0x5a001ceb, 0x5a001ceb},
         {0x0000a55c, 0x8907ffcb, 0x8907ffcb, 0x5e001eeb, 0x5e001eeb},
         {0x0000a560, 0x900fff0b, 0x900fff0b, 0x5e001eeb, 0x5e001eeb},
         {0x0000a564, 0x960fffcb, 0x960fffcb, 0x5e001eeb, 0x5e001eeb},
@@ -469,7 +469,7 @@ static const u32 ar9485_modes_lowest_ob_db_tx_gain_1_1[][5] = {
         {0x0000a54c, 0x7203feca, 0x7203feca, 0x51001865, 0x51001865},
         {0x0000a550, 0x7703ff0b, 0x7703ff0b, 0x55001a86, 0x55001a86},
         {0x0000a554, 0x7d06ffcb, 0x7d06ffcb, 0x57001ce9, 0x57001ce9},
-        {0x0000a558, 0x8407ff0b, 0x8407ff0b, 0x5a001eeb, 0x5a001eeb},
+        {0x0000a558, 0x8407ff0b, 0x8407ff0b, 0x5a001ceb, 0x5a001ceb},
         {0x0000a55c, 0x8907ffcb, 0x8907ffcb, 0x5e001eeb, 0x5e001eeb},
         {0x0000a560, 0x900fff0b, 0x900fff0b, 0x5e001eeb, 0x5e001eeb},
         {0x0000a564, 0x960fffcb, 0x960fffcb, 0x5e001eeb, 0x5e001eeb},
@@ -635,7 +635,7 @@ static const u32 ar9485Modes_high_power_tx_gain_1_1[][5] = {
         {0x0000a54c, 0x7203feca, 0x7203feca, 0x51001865, 0x51001865},
         {0x0000a550, 0x7703ff0b, 0x7703ff0b, 0x55001a86, 0x55001a86},
         {0x0000a554, 0x7d06ffcb, 0x7d06ffcb, 0x57001ce9, 0x57001ce9},
-        {0x0000a558, 0x8407ff0b, 0x8407ff0b, 0x5a001eeb, 0x5a001eeb},
+        {0x0000a558, 0x8407ff0b, 0x8407ff0b, 0x5a001ceb, 0x5a001ceb},
         {0x0000a55c, 0x8907ffcb, 0x8907ffcb, 0x5e001eeb, 0x5e001eeb},
         {0x0000a560, 0x900fff0b, 0x900fff0b, 0x5e001eeb, 0x5e001eeb},
         {0x0000a564, 0x960fffcb, 0x960fffcb, 0x5e001eeb, 0x5e001eeb},
@@ -728,7 +728,7 @@ static const u32 ar9485_modes_green_ob_db_tx_gain_1_1[][5] = {
         {0x0000a54c, 0x7203feca, 0x7203feca, 0x51001865, 0x51001865},
         {0x0000a550, 0x7703ff0b, 0x7703ff0b, 0x55001a86, 0x55001a86},
         {0x0000a554, 0x7d06ffcb, 0x7d06ffcb, 0x57001ce9, 0x57001ce9},
-        {0x0000a558, 0x8407ff0b, 0x8407ff0b, 0x5a001eeb, 0x5a001eeb},
+        {0x0000a558, 0x8407ff0b, 0x8407ff0b, 0x5a001ceb, 0x5a001ceb},
         {0x0000a55c, 0x8907ffcb, 0x8907ffcb, 0x5e001eeb, 0x5e001eeb},
         {0x0000a560, 0x900fff0b, 0x900fff0b, 0x5e001eeb, 0x5e001eeb},
         {0x0000a564, 0x960fffcb, 0x960fffcb, 0x5e001eeb, 0x5e001eeb},
@@ -827,7 +827,7 @@ static const u32 ar9485Modes_low_ob_db_tx_gain_1_1[][5] = {
         {0x0000a54c, 0x7203feca, 0x7203feca, 0x51001865, 0x51001865},
         {0x0000a550, 0x7703ff0b, 0x7703ff0b, 0x55001a86, 0x55001a86},
         {0x0000a554, 0x7d06ffcb, 0x7d06ffcb, 0x57001ce9, 0x57001ce9},
-        {0x0000a558, 0x8407ff0b, 0x8407ff0b, 0x5a001eeb, 0x5a001eeb},
+        {0x0000a558, 0x8407ff0b, 0x8407ff0b, 0x5a001ceb, 0x5a001ceb},
         {0x0000a55c, 0x8907ffcb, 0x8907ffcb, 0x5e001eeb, 0x5e001eeb},
         {0x0000a560, 0x900fff0b, 0x900fff0b, 0x5e001eeb, 0x5e001eeb},
         {0x0000a564, 0x960fffcb, 0x960fffcb, 0x5e001eeb, 0x5e001eeb},
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 38835bc324b2..77ad407e9fa3 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -665,7 +665,7 @@ void ath_radio_disable(struct ath_softc *sc, struct ieee80211_hw *hw);
 bool ath9k_setpower(struct ath_softc *sc, enum ath9k_power_mode mode);
 bool ath9k_uses_beacons(int type);
 
-#ifdef CONFIG_PCI
+#ifdef CONFIG_ATH9K_PCI
 int ath_pci_init(void);
 void ath_pci_exit(void);
 #else
@@ -673,7 +673,7 @@ static inline int ath_pci_init(void) { return 0; };
 static inline void ath_pci_exit(void) {};
 #endif
 
-#ifdef CONFIG_ATHEROS_AR71XX
+#ifdef CONFIG_ATH9K_AHB
 int ath_ahb_init(void);
 void ath_ahb_exit(void);
 #else
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index eccb0ec87adb..9193a385ceb2 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -320,6 +320,7 @@ void ath_beacon_return(struct ath_softc *sc, struct ath_vif *avp)
         if (avp->av_bcbuf != NULL) {
                 struct ath_buf *bf;
 
+                avp->is_bslot_active = false;
                 if (avp->av_bslot != -1) {
                         sc->beacon.bslot[avp->av_bslot] = NULL;
                         sc->nbcnvifs--;
@@ -743,7 +744,6 @@ void ath_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif)
                 cur_conf->dtim_period = 1;
 
         ath_set_beacon(sc);
-        sc->ps_flags |= PS_BEACON_SYNC | PS_WAIT_FOR_BEACON;
 }
 
 void ath_set_beacon(struct ath_softc *sc)
@@ -761,6 +761,12 @@ void ath_set_beacon(struct ath_softc *sc)
                 break;
         case NL80211_IFTYPE_STATION:
                 ath_beacon_config_sta(sc, cur_conf);
+                /*
+                 * Request a re-configuration of Beacon related timers
+                 * on the receipt of the first Beacon frame (i.e.,
+                 * after time sync with the AP).
+                 */
+                sc->ps_flags |= PS_BEACON_SYNC | PS_WAIT_FOR_BEACON;
                 break;
         default:
                 ath_dbg(common, ATH_DBG_CONFIG,
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index a762cadb3ab7..34f191ec8e8c 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -845,7 +845,7 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
 
         struct ath_softc *sc = file->private_data;
         char *buf;
-        unsigned int len = 0, size = 1152;
+        unsigned int len = 0, size = 1400;
         ssize_t retval = 0;
 
         buf = kzalloc(size, GFP_KERNEL);
@@ -874,6 +874,34 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
                         "%18s : %10u\n", "DECRYPT BUSY ERR",
                         sc->debug.stats.rxstats.decrypt_busy_err);
 
+        len += snprintf(buf + len, size - len,
+                        "%18s : %10d\n", "RSSI-CTL0",
+                        sc->debug.stats.rxstats.rs_rssi_ctl0);
+
+        len += snprintf(buf + len, size - len,
+                        "%18s : %10d\n", "RSSI-CTL1",
+                        sc->debug.stats.rxstats.rs_rssi_ctl1);
+
+        len += snprintf(buf + len, size - len,
+                        "%18s : %10d\n", "RSSI-CTL2",
+                        sc->debug.stats.rxstats.rs_rssi_ctl2);
+
+        len += snprintf(buf + len, size - len,
+                        "%18s : %10d\n", "RSSI-EXT0",
+                        sc->debug.stats.rxstats.rs_rssi_ext0);
+
+        len += snprintf(buf + len, size - len,
+                        "%18s : %10d\n", "RSSI-EXT1",
+                        sc->debug.stats.rxstats.rs_rssi_ext1);
+
+        len += snprintf(buf + len, size - len,
+                        "%18s : %10d\n", "RSSI-EXT2",
+                        sc->debug.stats.rxstats.rs_rssi_ext2);
+
+        len += snprintf(buf + len, size - len,
+                        "%18s : %10d\n", "Rx Antenna",
+                        sc->debug.stats.rxstats.rs_antenna);
+
         PHY_ERR("UNDERRUN", ATH9K_PHYERR_UNDERRUN);
         PHY_ERR("TIMING", ATH9K_PHYERR_TIMING);
         PHY_ERR("PARITY", ATH9K_PHYERR_PARITY);
@@ -948,6 +976,16 @@ void ath_debug_stat_rx(struct ath_softc *sc, struct ath_rx_status *rs)
                 RX_PHY_ERR_INC(phyerr);
         }
 
+        sc->debug.stats.rxstats.rs_rssi_ctl0 = rs->rs_rssi_ctl0;
+        sc->debug.stats.rxstats.rs_rssi_ctl1 = rs->rs_rssi_ctl1;
+        sc->debug.stats.rxstats.rs_rssi_ctl2 = rs->rs_rssi_ctl2;
+
+        sc->debug.stats.rxstats.rs_rssi_ext0 = rs->rs_rssi_ext0;
+        sc->debug.stats.rxstats.rs_rssi_ext1 = rs->rs_rssi_ext1;
+        sc->debug.stats.rxstats.rs_rssi_ext2 = rs->rs_rssi_ext2;
+
+        sc->debug.stats.rxstats.rs_antenna = rs->rs_antenna;
+
 #undef RX_STAT_INC
 #undef RX_PHY_ERR_INC
 }
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index 59338de0ce19..1f9f8eada465 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -157,6 +157,13 @@ struct ath_rx_stats {
         u32 post_delim_crc_err;
         u32 decrypt_busy_err;
         u32 phy_err_stats[ATH9K_PHYERR_MAX];
+        int8_t rs_rssi_ctl0;
+        int8_t rs_rssi_ctl1;
+        int8_t rs_rssi_ctl2;
+        int8_t rs_rssi_ext0;
+        int8_t rs_rssi_ext1;
+        int8_t rs_rssi_ext2;
+        u8 rs_antenna;
 };
 
 struct ath_stats {
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.h b/drivers/net/wireless/ath/ath9k/eeprom.h
index bd82447f5b78..3e316133f114 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/eeprom.h
@@ -436,7 +436,11 @@ struct modal_eep_4k_header {
         u8 db2_2:4, db2_3:4;
         u8 db2_4:4, reserved:4;
 #endif
-        u8 futureModal[4];
+        u8 tx_diversity;
+        u8 flc_pwr_thresh;
+        u8 bb_scale_smrt_antenna;
+#define EEP_4K_BB_DESIRED_SCALE_MASK    0x1f
+        u8 futureModal[1];
         struct spur_chan spurChans[AR_EEPROM_MODAL_SPURS];
 } __packed;
 
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_4k.c b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
index bc77a308c901..6f714dd72365 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_4k.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
@@ -781,6 +781,7 @@ static void ath9k_hw_4k_set_board_values(struct ath_hw *ah,
 {
         struct modal_eep_4k_header *pModal;
         struct ar5416_eeprom_4k *eep = &ah->eeprom.map4k;
+        struct base_eep_header_4k *pBase = &eep->baseEepHeader;
         u8 txRxAttenLocal;
         u8 ob[5], db1[5], db2[5];
         u8 ant_div_control1, ant_div_control2;
@@ -1003,6 +1004,31 @@ static void ath9k_hw_4k_set_board_values(struct ath_hw *ah,
                                       AR_PHY_SETTLING_SWITCH,
                                       pModal->swSettleHt40);
         }
+        if (AR_SREV_9271(ah) || AR_SREV_9285(ah)) {
+                u8 bb_desired_scale = (pModal->bb_scale_smrt_antenna &
+                                EEP_4K_BB_DESIRED_SCALE_MASK);
+                if ((pBase->txGainType == 0) && (bb_desired_scale != 0)) {
+                        u32 pwrctrl, mask, clr;
+
+                        mask = BIT(0)|BIT(5)|BIT(10)|BIT(15)|BIT(20)|BIT(25);
+                        pwrctrl = mask * bb_desired_scale;
+                        clr = mask * 0x1f;
+                        REG_RMW(ah, AR_PHY_TX_PWRCTRL8, pwrctrl, clr);
+                        REG_RMW(ah, AR_PHY_TX_PWRCTRL10, pwrctrl, clr);
+                        REG_RMW(ah, AR_PHY_CH0_TX_PWRCTRL12, pwrctrl, clr);
+
+                        mask = BIT(0)|BIT(5)|BIT(15);
+                        pwrctrl = mask * bb_desired_scale;
+                        clr = mask * 0x1f;
+                        REG_RMW(ah, AR_PHY_TX_PWRCTRL9, pwrctrl, clr);
+
+                        mask = BIT(0)|BIT(5);
+                        pwrctrl = mask * bb_desired_scale;
+                        clr = mask * 0x1f;
+                        REG_RMW(ah, AR_PHY_CH0_TX_PWRCTRL11, pwrctrl, clr);
+                        REG_RMW(ah, AR_PHY_CH0_TX_PWRCTRL13, pwrctrl, clr);
+                }
+        }
 }
 
 static u16 ath9k_hw_4k_get_spur_channel(struct ath_hw *ah, u16 i, bool is2GHz)
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
index 2f0712ea49a6..13579752a300 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
@@ -858,35 +858,12 @@ static void ath9k_hw_ar9287_set_board_values(struct ath_hw *ah,
 {
         struct ar9287_eeprom *eep = &ah->eeprom.map9287;
         struct modal_eep_ar9287_header *pModal = &eep->modalHeader;
-        u16 antWrites[AR9287_ANT_16S];
         u32 regChainOffset, regval;
         u8 txRxAttenLocal;
-        int i, j, offset_num;
+        int i;
 
         pModal = &eep->modalHeader;
 
-        antWrites[0] = (u16)((pModal->antCtrlCommon >> 28) & 0xF);
-        antWrites[1] = (u16)((pModal->antCtrlCommon >> 24) & 0xF);
-        antWrites[2] = (u16)((pModal->antCtrlCommon >> 20) & 0xF);
-        antWrites[3] = (u16)((pModal->antCtrlCommon >> 16) & 0xF);
-        antWrites[4] = (u16)((pModal->antCtrlCommon >> 12) & 0xF);
-        antWrites[5] = (u16)((pModal->antCtrlCommon >> 8) & 0xF);
-        antWrites[6] = (u16)((pModal->antCtrlCommon >> 4)  & 0xF);
-        antWrites[7] = (u16)(pModal->antCtrlCommon & 0xF);
-
-        offset_num = 8;
-
-        for (i = 0, j = offset_num; i < AR9287_MAX_CHAINS; i++) {
-                antWrites[j++] = (u16)((pModal->antCtrlChain[i] >> 28) & 0xf);
-                antWrites[j++] = (u16)((pModal->antCtrlChain[i] >> 10) & 0x3);
-                antWrites[j++] = (u16)((pModal->antCtrlChain[i] >> 8) & 0x3);
-                antWrites[j++] = 0;
-                antWrites[j++] = (u16)((pModal->antCtrlChain[i] >> 6) & 0x3);
-                antWrites[j++] = (u16)((pModal->antCtrlChain[i] >> 4) & 0x3);
-                antWrites[j++] = (u16)((pModal->antCtrlChain[i] >> 2) & 0x3);
-                antWrites[j++] = (u16)(pModal->antCtrlChain[i] & 0x3);
-        }
-
         REG_WRITE(ah, AR_PHY_SWITCH_COM, pModal->antCtrlCommon);
 
         for (i = 0; i < AR9287_MAX_CHAINS; i++) {
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index f1b8af64569c..48bcc1a21076 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -17,11 +17,9 @@
 #include "htc.h"
 
 /* identify firmware images */
-#define FIRMWARE_AR7010         "ar7010.fw"
-#define FIRMWARE_AR7010_1_1     "ar7010_1_1.fw"
-#define FIRMWARE_AR9271         "ar9271.fw"
+#define FIRMWARE_AR7010_1_1     "htc_7010.fw"
+#define FIRMWARE_AR9271         "htc_9271.fw"
 
-MODULE_FIRMWARE(FIRMWARE_AR7010);
 MODULE_FIRMWARE(FIRMWARE_AR7010_1_1);
 MODULE_FIRMWARE(FIRMWARE_AR9271);
 
@@ -80,7 +78,7 @@ static void hif_usb_regout_cb(struct urb *urb)
 
         if (cmd) {
                 ath9k_htc_txcompletion_cb(cmd->hif_dev->htc_handle,
-                                          cmd->skb, 1);
+                                          cmd->skb, true);
                 kfree(cmd);
         }
 
@@ -126,6 +124,90 @@ static int hif_usb_send_regout(struct hif_device_usb *hif_dev,
         return ret;
 }
 
+static void hif_usb_mgmt_cb(struct urb *urb)
+{
+        struct cmd_buf *cmd = (struct cmd_buf *)urb->context;
+        struct hif_device_usb *hif_dev = cmd->hif_dev;
+        bool txok = true;
+
+        if (!cmd || !cmd->skb || !cmd->hif_dev)
+                return;
+
+        switch (urb->status) {
+        case 0:
+                break;
+        case -ENOENT:
+        case -ECONNRESET:
+        case -ENODEV:
+        case -ESHUTDOWN:
+                txok = false;
+
+                /*
+                 * If the URBs are being flushed, no need to complete
+                 * this packet.
+                 */
+                spin_lock(&hif_dev->tx.tx_lock);
+                if (hif_dev->tx.flags & HIF_USB_TX_FLUSH) {
+                        spin_unlock(&hif_dev->tx.tx_lock);
+                        dev_kfree_skb_any(cmd->skb);
+                        kfree(cmd);
+                        return;
+                }
+                spin_unlock(&hif_dev->tx.tx_lock);
+
+                break;
+        default:
+                txok = false;
+                break;
+        }
+
+        skb_pull(cmd->skb, 4);
+        ath9k_htc_txcompletion_cb(cmd->hif_dev->htc_handle,
+                                  cmd->skb, txok);
+        kfree(cmd);
+}
+
+static int hif_usb_send_mgmt(struct hif_device_usb *hif_dev,
+                             struct sk_buff *skb)
+{
+        struct urb *urb;
+        struct cmd_buf *cmd;
+        int ret = 0;
+        __le16 *hdr;
+
+        urb = usb_alloc_urb(0, GFP_ATOMIC);
+        if (urb == NULL)
+                return -ENOMEM;
+
+        cmd = kzalloc(sizeof(*cmd), GFP_ATOMIC);
+        if (cmd == NULL) {
+                usb_free_urb(urb);
+                return -ENOMEM;
+        }
+
+        cmd->skb = skb;
+        cmd->hif_dev = hif_dev;
+
+        hdr = (__le16 *) skb_push(skb, 4);
+        *hdr++ = cpu_to_le16(skb->len - 4);
+        *hdr++ = cpu_to_le16(ATH_USB_TX_STREAM_MODE_TAG);
+
+        usb_fill_bulk_urb(urb, hif_dev->udev,
+                         usb_sndbulkpipe(hif_dev->udev, USB_WLAN_TX_PIPE),
+                         skb->data, skb->len,
+                         hif_usb_mgmt_cb, cmd);
+
+        usb_anchor_urb(urb, &hif_dev->mgmt_submitted);
+        ret = usb_submit_urb(urb, GFP_ATOMIC);
+        if (ret) {
+                usb_unanchor_urb(urb);
+                kfree(cmd);
+        }
+        usb_free_urb(urb);
+
+        return ret;
+}
+
 static inline void ath9k_skb_queue_purge(struct hif_device_usb *hif_dev,
                                          struct sk_buff_head *list)
 {
@@ -133,7 +215,22 @@ static inline void ath9k_skb_queue_purge(struct hif_device_usb *hif_dev,
 
         while ((skb = __skb_dequeue(list)) != NULL) {
                 dev_kfree_skb_any(skb);
-                TX_STAT_INC(skb_dropped);
+        }
+}
+
+static inline void ath9k_skb_queue_complete(struct hif_device_usb *hif_dev,
+                                            struct sk_buff_head *queue,
+                                            bool txok)
+{
+        struct sk_buff *skb;
+
+        while ((skb = __skb_dequeue(queue)) != NULL) {
+                ath9k_htc_txcompletion_cb(hif_dev->htc_handle,
+                                          skb, txok);
+                if (txok)
+                        TX_STAT_INC(skb_success);
+                else
+                        TX_STAT_INC(skb_failed);
         }
 }
 
@@ -141,7 +238,7 @@ static void hif_usb_tx_cb(struct urb *urb)
 {
         struct tx_buf *tx_buf = (struct tx_buf *) urb->context;
         struct hif_device_usb *hif_dev;
-        struct sk_buff *skb;
+        bool txok = true;
 
         if (!tx_buf || !tx_buf->hif_dev)
                 return;
@@ -155,10 +252,7 @@ static void hif_usb_tx_cb(struct urb *urb)
         case -ECONNRESET:
         case -ENODEV:
         case -ESHUTDOWN:
-                /*
-                 * The URB has been killed, free the SKBs.
-                 */
-                ath9k_skb_queue_purge(hif_dev, &tx_buf->skb_queue);
+                txok = false;
 
                 /*
                  * If the URBs are being flushed, no need to add this
@@ -167,41 +261,19 @@ static void hif_usb_tx_cb(struct urb *urb)
                 spin_lock(&hif_dev->tx.tx_lock);
                 if (hif_dev->tx.flags & HIF_USB_TX_FLUSH) {
                         spin_unlock(&hif_dev->tx.tx_lock);
+                        ath9k_skb_queue_purge(hif_dev, &tx_buf->skb_queue);
                         return;
                 }
                 spin_unlock(&hif_dev->tx.tx_lock);
 
-                /*
-                 * In the stop() case, this URB has to be added to
-                 * the free list.
-                 */
-                goto add_free;
+                break;
         default:
+                txok = false;
                 break;
         }
 
-        /*
-         * Check if TX has been stopped, this is needed because
-         * this CB could have been invoked just after the TX lock
-         * was released in hif_stop() and kill_urb() hasn't been
-         * called yet.
-         */
-        spin_lock(&hif_dev->tx.tx_lock);
-        if (hif_dev->tx.flags & HIF_USB_TX_STOP) {
-                spin_unlock(&hif_dev->tx.tx_lock);
-                ath9k_skb_queue_purge(hif_dev, &tx_buf->skb_queue);
-                goto add_free;
-        }
-        spin_unlock(&hif_dev->tx.tx_lock);
-
-        /* Complete the queued SKBs. */
-        while ((skb = __skb_dequeue(&tx_buf->skb_queue)) != NULL) {
-                ath9k_htc_txcompletion_cb(hif_dev->htc_handle,
-                                          skb, 1);
-                TX_STAT_INC(skb_completed);
-        }
+        ath9k_skb_queue_complete(hif_dev, &tx_buf->skb_queue, txok);
 
-add_free:
         /* Re-initialize the SKB queue */
         tx_buf->len = tx_buf->offset = 0;
         __skb_queue_head_init(&tx_buf->skb_queue);
@@ -274,7 +346,7 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev)
         ret = usb_submit_urb(tx_buf->urb, GFP_ATOMIC);
         if (ret) {
                 tx_buf->len = tx_buf->offset = 0;
-                ath9k_skb_queue_purge(hif_dev, &tx_buf->skb_queue);
+                ath9k_skb_queue_complete(hif_dev, &tx_buf->skb_queue, false);
                 __skb_queue_head_init(&tx_buf->skb_queue);
                 list_move_tail(&tx_buf->list, &hif_dev->tx.tx_buf);
                 hif_dev->tx.tx_buf_cnt++;
@@ -286,10 +358,11 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev)
         return ret;
 }
 
-static int hif_usb_send_tx(struct hif_device_usb *hif_dev, struct sk_buff *skb,
-                           struct ath9k_htc_tx_ctl *tx_ctl)
+static int hif_usb_send_tx(struct hif_device_usb *hif_dev, struct sk_buff *skb)
 {
+        struct ath9k_htc_tx_ctl *tx_ctl;
         unsigned long flags;
+        int ret = 0;
 
         spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
 
@@ -304,26 +377,36 @@ static int hif_usb_send_tx(struct hif_device_usb *hif_dev, struct sk_buff *skb,
                 return -ENOMEM;
         }
 
-        __skb_queue_tail(&hif_dev->tx.tx_skb_queue, skb);
-        hif_dev->tx.tx_skb_cnt++;
+        spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
 
-        /* Send normal frames immediately */
-        if (!tx_ctl || (tx_ctl && (tx_ctl->type == ATH9K_HTC_NORMAL)))
-                __hif_usb_tx(hif_dev);
+        tx_ctl = HTC_SKB_CB(skb);
+
+        /* Mgmt/Beacon frames don't use the TX buffer pool */
+        if ((tx_ctl->type == ATH9K_HTC_MGMT) ||
+            (tx_ctl->type == ATH9K_HTC_BEACON)) {
+                ret = hif_usb_send_mgmt(hif_dev, skb);
+        }
+
+        spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
+
+        if ((tx_ctl->type == ATH9K_HTC_NORMAL) ||
+            (tx_ctl->type == ATH9K_HTC_AMPDU)) {
+                __skb_queue_tail(&hif_dev->tx.tx_skb_queue, skb);
+                hif_dev->tx.tx_skb_cnt++;
+        }
 
         /* Check if AMPDUs have to be sent immediately */
-        if (tx_ctl && (tx_ctl->type == ATH9K_HTC_AMPDU) &&
-            (hif_dev->tx.tx_buf_cnt == MAX_TX_URB_NUM) &&
+        if ((hif_dev->tx.tx_buf_cnt == MAX_TX_URB_NUM) &&
             (hif_dev->tx.tx_skb_cnt < 2)) {
                 __hif_usb_tx(hif_dev);
         }
 
         spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
 
-        return 0;
+        return ret;
 }
 
-static void hif_usb_start(void *hif_handle, u8 pipe_id)
+static void hif_usb_start(void *hif_handle)
 {
         struct hif_device_usb *hif_dev = (struct hif_device_usb *)hif_handle;
         unsigned long flags;
@@ -335,14 +418,14 @@ static void hif_usb_start(void *hif_handle, u8 pipe_id)
         spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
 }
 
-static void hif_usb_stop(void *hif_handle, u8 pipe_id)
+static void hif_usb_stop(void *hif_handle)
 {
         struct hif_device_usb *hif_dev = (struct hif_device_usb *)hif_handle;
         struct tx_buf *tx_buf = NULL, *tx_buf_tmp = NULL;
         unsigned long flags;
 
         spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
-        ath9k_skb_queue_purge(hif_dev, &hif_dev->tx.tx_skb_queue);
+        ath9k_skb_queue_complete(hif_dev, &hif_dev->tx.tx_skb_queue, false);
         hif_dev->tx.tx_skb_cnt = 0;
         hif_dev->tx.flags |= HIF_USB_TX_STOP;
         spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
@@ -352,17 +435,18 @@ static void hif_usb_stop(void *hif_handle, u8 pipe_id)
                                  &hif_dev->tx.tx_pending, list) {
                 usb_kill_urb(tx_buf->urb);
         }
+
+        usb_kill_anchored_urbs(&hif_dev->mgmt_submitted);
 }
 
-static int hif_usb_send(void *hif_handle, u8 pipe_id, struct sk_buff *skb,
-                        struct ath9k_htc_tx_ctl *tx_ctl)
+static int hif_usb_send(void *hif_handle, u8 pipe_id, struct sk_buff *skb)
 {
         struct hif_device_usb *hif_dev = (struct hif_device_usb *)hif_handle;
         int ret = 0;
 
         switch (pipe_id) {
         case USB_WLAN_TX_PIPE:
-                ret = hif_usb_send_tx(hif_dev, skb, tx_ctl);
+                ret = hif_usb_send_tx(hif_dev, skb);
                 break;
         case USB_REG_OUT_PIPE:
                 ret = hif_usb_send_regout(hif_dev, skb);
@@ -377,6 +461,40 @@ static int hif_usb_send(void *hif_handle, u8 pipe_id, struct sk_buff *skb,
         return ret;
 }
 
+static inline bool check_index(struct sk_buff *skb, u8 idx)
+{
+        struct ath9k_htc_tx_ctl *tx_ctl;
+
+        tx_ctl = HTC_SKB_CB(skb);
+
+        if ((tx_ctl->type == ATH9K_HTC_AMPDU) &&
+            (tx_ctl->sta_idx == idx))
+                return true;
+
+        return false;
+}
+
+static void hif_usb_sta_drain(void *hif_handle, u8 idx)
+{
+        struct hif_device_usb *hif_dev = (struct hif_device_usb *)hif_handle;
+        struct sk_buff *skb, *tmp;
+        unsigned long flags;
+
+        spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
+
+        skb_queue_walk_safe(&hif_dev->tx.tx_skb_queue, skb, tmp) {
+                if (check_index(skb, idx)) {
+                        __skb_unlink(skb, &hif_dev->tx.tx_skb_queue);
+                        ath9k_htc_txcompletion_cb(hif_dev->htc_handle,
+                                                  skb, false);
+                        hif_dev->tx.tx_skb_cnt--;
+                        TX_STAT_INC(skb_failed);
+                }
+        }
+
+        spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
+}
+
 static struct ath9k_htc_hif hif_usb = {
         .transport = ATH9K_HIF_USB,
         .name = "ath9k_hif_usb",
@@ -386,6 +504,7 @@ static struct ath9k_htc_hif hif_usb = {
 
         .start = hif_usb_start,
         .stop = hif_usb_stop,
+        .sta_drain = hif_usb_sta_drain,
         .send = hif_usb_send,
 };
 
@@ -567,6 +686,9 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
         case -ESHUTDOWN:
                 goto free;
         default:
+                skb_reset_tail_pointer(skb);
+                skb_trim(skb, 0);
+
                 goto resubmit;
         }
 
@@ -591,23 +713,15 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
                                                  USB_REG_IN_PIPE),
                                  nskb->data, MAX_REG_IN_BUF_SIZE,
                                  ath9k_hif_usb_reg_in_cb, nskb);
-
-                ret = usb_submit_urb(urb, GFP_ATOMIC);
-                if (ret) {
-                        kfree_skb(nskb);
-                        urb->context = NULL;
-                }
-
-                return;
         }
 
 resubmit:
-        skb_reset_tail_pointer(skb);
-        skb_trim(skb, 0);
-
+        usb_anchor_urb(urb, &hif_dev->reg_in_submitted);
         ret = usb_submit_urb(urb, GFP_ATOMIC);
-        if (ret)
+        if (ret) {
+                usb_unanchor_urb(urb);
                 goto free;
+        }
 
         return;
 free:
@@ -641,6 +755,8 @@ static void ath9k_hif_usb_dealloc_tx_urbs(struct hif_device_usb *hif_dev)
                 kfree(tx_buf->buf);
                 kfree(tx_buf);
         }
+
+        usb_kill_anchored_urbs(&hif_dev->mgmt_submitted);
 }
 
 static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev)
@@ -652,6 +768,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev)
         INIT_LIST_HEAD(&hif_dev->tx.tx_pending);
         spin_lock_init(&hif_dev->tx.tx_lock);
         __skb_queue_head_init(&hif_dev->tx.tx_skb_queue);
+        init_usb_anchor(&hif_dev->mgmt_submitted);
 
         for (i = 0; i < MAX_TX_URB_NUM; i++) {
                 tx_buf = kzalloc(sizeof(struct tx_buf), GFP_KERNEL);
@@ -748,43 +865,67 @@ err_urb:
         return ret;
 }
 
-static void ath9k_hif_usb_dealloc_reg_in_urb(struct hif_device_usb *hif_dev)
+static void ath9k_hif_usb_dealloc_reg_in_urbs(struct hif_device_usb *hif_dev)
 {
-        if (hif_dev->reg_in_urb) {
-                usb_kill_urb(hif_dev->reg_in_urb);
-                if (hif_dev->reg_in_urb->context)
-                        kfree_skb((void *)hif_dev->reg_in_urb->context);
-                usb_free_urb(hif_dev->reg_in_urb);
-                hif_dev->reg_in_urb = NULL;
-        }
+        usb_kill_anchored_urbs(&hif_dev->reg_in_submitted);
 }
 
-static int ath9k_hif_usb_alloc_reg_in_urb(struct hif_device_usb *hif_dev)
+static int ath9k_hif_usb_alloc_reg_in_urbs(struct hif_device_usb *hif_dev)
 {
-        struct sk_buff *skb;
+        struct urb *urb = NULL;
+        struct sk_buff *skb = NULL;
+        int i, ret;
 
-        hif_dev->reg_in_urb = usb_alloc_urb(0, GFP_KERNEL);
-        if (hif_dev->reg_in_urb == NULL)
-                return -ENOMEM;
+        init_usb_anchor(&hif_dev->reg_in_submitted);
 
-        skb = alloc_skb(MAX_REG_IN_BUF_SIZE, GFP_KERNEL);
-        if (!skb)
-                goto err;
+        for (i = 0; i < MAX_REG_IN_URB_NUM; i++) {
 
-        usb_fill_bulk_urb(hif_dev->reg_in_urb, hif_dev->udev,
-                         usb_rcvbulkpipe(hif_dev->udev,
-                                         USB_REG_IN_PIPE),
-                         skb->data, MAX_REG_IN_BUF_SIZE,
-                         ath9k_hif_usb_reg_in_cb, skb);
+                /* Allocate URB */
+                urb = usb_alloc_urb(0, GFP_KERNEL);
+                if (urb == NULL) {
+                        ret = -ENOMEM;
+                        goto err_urb;
+                }
 
-        if (usb_submit_urb(hif_dev->reg_in_urb, GFP_KERNEL) != 0)
-                goto err;
+                /* Allocate buffer */
+                skb = alloc_skb(MAX_REG_IN_BUF_SIZE, GFP_KERNEL);
+                if (!skb) {
+                        ret = -ENOMEM;
+                        goto err_skb;
+                }
+
+                usb_fill_bulk_urb(urb, hif_dev->udev,
+                                  usb_rcvbulkpipe(hif_dev->udev,
+                                                  USB_REG_IN_PIPE),
+                                  skb->data, MAX_REG_IN_BUF_SIZE,
+                                  ath9k_hif_usb_reg_in_cb, skb);
+
+                /* Anchor URB */
+                usb_anchor_urb(urb, &hif_dev->reg_in_submitted);
+
+                /* Submit URB */
+                ret = usb_submit_urb(urb, GFP_KERNEL);
+                if (ret) {
+                        usb_unanchor_urb(urb);
+                        goto err_submit;
+                }
+
+                /*
+                 * Drop reference count.
+                 * This ensures that the URB is freed when killing them.
+                 */
+                usb_free_urb(urb);
+        }
 
         return 0;
 
-err:
-        ath9k_hif_usb_dealloc_reg_in_urb(hif_dev);
-        return -ENOMEM;
+err_submit:
+        kfree_skb(skb);
+err_skb:
+        usb_free_urb(urb);
+err_urb:
+        ath9k_hif_usb_dealloc_reg_in_urbs(hif_dev);
+        return ret;
 }
 
 static int ath9k_hif_usb_alloc_urbs(struct hif_device_usb *hif_dev)
@@ -801,7 +942,7 @@ static int ath9k_hif_usb_alloc_urbs(struct hif_device_usb *hif_dev)
                 goto err_rx;
 
         /* Register Read */
-        if (ath9k_hif_usb_alloc_reg_in_urb(hif_dev) < 0)
+        if (ath9k_hif_usb_alloc_reg_in_urbs(hif_dev) < 0)
                 goto err_reg;
 
         return 0;
@@ -816,7 +957,7 @@ err:
 static void ath9k_hif_usb_dealloc_urbs(struct hif_device_usb *hif_dev)
 {
         usb_kill_anchored_urbs(&hif_dev->regout_submitted);
-        ath9k_hif_usb_dealloc_reg_in_urb(hif_dev);
+        ath9k_hif_usb_dealloc_reg_in_urbs(hif_dev);
         ath9k_hif_usb_dealloc_tx_urbs(hif_dev);
         ath9k_hif_usb_dealloc_rx_urbs(hif_dev);
 }
@@ -1026,10 +1167,7 @@ static int ath9k_hif_usb_probe(struct usb_interface *interface,
         /* Find out which firmware to load */
 
         if (IS_AR7010_DEVICE(id->driver_info))
-                if (le16_to_cpu(udev->descriptor.bcdDevice) == 0x0202)
-                        hif_dev->fw_name = FIRMWARE_AR7010_1_1;
-                else
-                        hif_dev->fw_name = FIRMWARE_AR7010;
+                hif_dev->fw_name = FIRMWARE_AR7010_1_1;
         else
                 hif_dev->fw_name = FIRMWARE_AR9271;
 
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.h b/drivers/net/wireless/ath/ath9k/hif_usb.h
index 7b9d863d4035..f59df48a86e2 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.h
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.h
@@ -31,7 +31,7 @@
 
 /* FIXME: Verify these numbers (with Windows) */
 #define MAX_TX_URB_NUM  8
-#define MAX_TX_BUF_NUM  1024
+#define MAX_TX_BUF_NUM  256
 #define MAX_TX_BUF_SIZE 32768
 #define MAX_TX_AGGR_NUM 20
 
@@ -40,7 +40,7 @@
 #define MAX_PKT_NUM_IN_TRANSFER 10
 
 #define MAX_REG_OUT_URB_NUM  1
-#define MAX_REG_OUT_BUF_NUM  8
+#define MAX_REG_IN_URB_NUM   64
 
 #define MAX_REG_IN_BUF_SIZE 64
 
@@ -90,9 +90,10 @@ struct hif_device_usb {
         const struct firmware *firmware;
         struct htc_target *htc_handle;
         struct hif_usb_tx tx;
-        struct urb *reg_in_urb;
         struct usb_anchor regout_submitted;
         struct usb_anchor rx_submitted;
+        struct usb_anchor reg_in_submitted;
+        struct usb_anchor mgmt_submitted;
         struct sk_buff *remain_skb;
         const char *fw_name;
         int rx_remain_len;
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index ec47be94b74f..cc5d0a4b9da2 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -67,8 +67,11 @@ enum htc_opmode {
 };
 
 #define ATH9K_HTC_HDRSPACE sizeof(struct htc_frame_hdr)
-#define ATH9K_HTC_AMPDU 1
+
+#define ATH9K_HTC_AMPDU  1
 #define ATH9K_HTC_NORMAL 2
+#define ATH9K_HTC_BEACON 3
+#define ATH9K_HTC_MGMT   4
 
 #define ATH9K_HTC_TX_CTSONLY      0x1
 #define ATH9K_HTC_TX_RTSCTS       0x2
@@ -82,7 +85,8 @@ struct tx_frame_hdr {
         __be32 flags; /* ATH9K_HTC_TX_* */
         u8 key_type;
         u8 keyix;
-        u8 reserved[26];
+        u8 cookie;
+        u8 pad;
 } __packed;
 
 struct tx_mgmt_hdr {
@@ -92,26 +96,16 @@ struct tx_mgmt_hdr {
         u8 flags;
         u8 key_type;
         u8 keyix;
-        u16 reserved;
+        u8 cookie;
+        u8 pad;
 } __packed;
 
 struct tx_beacon_header {
-        u8 len_changed;
         u8 vif_index;
+        u8 len_changed;
         u16 rev;
 } __packed;
 
-struct ath9k_htc_target_hw {
-        u32 flags;
-        u32 flags_ext;
-        u32 ampdu_limit;
-        u8 ampdu_subframes;
-        u8 tx_chainmask;
-        u8 tx_chainmask_legacy;
-        u8 rtscts_ratecode;
-        u8 protmode;
-} __packed;
-
 struct ath9k_htc_cap_target {
         u32 flags;
         u32 flags_ext;
@@ -121,21 +115,16 @@ struct ath9k_htc_cap_target {
         u8 tx_chainmask_legacy;
         u8 rtscts_ratecode;
         u8 protmode;
+        u8 pad;
 } __packed;
 
 struct ath9k_htc_target_vif {
         u8 index;
-        u8 des_bssid[ETH_ALEN];
-        __be32 opmode;
+        u8 opmode;
         u8 myaddr[ETH_ALEN];
-        u8 bssid[ETH_ALEN];
-        u32 flags;
-        u32 flags_ext;
-        u16 ps_sta;
-        __be16 rtsthreshold;
         u8 ath_cap;
-        u8 node;
-        s8 mcast_rate;
+        __be16 rtsthreshold;
+        u8 pad;
 } __packed;
 
 #define ATH_HTC_STA_AUTH  0x0001
@@ -143,27 +132,16 @@ struct ath9k_htc_target_vif {
 #define ATH_HTC_STA_ERP   0x0004
 #define ATH_HTC_STA_HT    0x0008
 
-/* FIXME: UAPSD variables */
 struct ath9k_htc_target_sta {
-        u16 associd;
-        u16 txpower;
-        u32 ucastkey;
         u8 macaddr[ETH_ALEN];
         u8 bssid[ETH_ALEN];
         u8 sta_index;
         u8 vif_index;
-        u8 vif_sta;
-        __be16 flags; /* ATH_HTC_STA_* */
-        u16 htcap;
-        u8 valid;
-        u16 capinfo;
-        struct ath9k_htc_target_hw *hw;
-        struct ath9k_htc_target_vif *vif;
-        u16 txseqmgmt;
         u8 is_vif_sta;
-        u16 maxampdu;
-        u16 iv16;
-        u32 iv32;
+        __be16 flags; /* ATH_HTC_STA_* */
+        __be16 htcap;
+        __be16 maxampdu;
+        u8 pad;
 } __packed;
 
 struct ath9k_htc_target_aggr {
@@ -197,12 +175,31 @@ struct ath9k_htc_target_rate {
         struct ath9k_htc_rate rates;
 };
 
-struct ath9k_htc_target_stats {
-        __be32 tx_shortretry;
-        __be32 tx_longretry;
-        __be32 tx_xretries;
-        __be32 ht_txunaggr_xretry;
-        __be32 ht_tx_xretries;
+struct ath9k_htc_target_int_stats {
+        __be32 rx;
+        __be32 rxorn;
+        __be32 rxeol;
+        __be32 txurn;
+        __be32 txto;
+        __be32 cst;
+} __packed;
+
+struct ath9k_htc_target_tx_stats {
+        __be32 xretries;
+        __be32 fifoerr;
+        __be32 filtered;
+        __be32 timer_exp;
+        __be32 shortretries;
+        __be32 longretries;
+        __be32 qnull;
+        __be32 encap_fail;
+        __be32 nobuf;
+} __packed;
+
+struct ath9k_htc_target_rx_stats {
+        __be32 nobuf;
+        __be32 host_send;
+        __be32 host_done;
 } __packed;
 
 #define ATH9K_HTC_MAX_VIF 2
@@ -244,6 +241,8 @@ struct ath9k_htc_vif {
         u8 index;
         u16 seq_no;
         bool beacon_configured;
+        int bslot;
+        __le64 tsfadjust;
 };
 
 struct ath9k_vif_iter_data {
@@ -282,23 +281,65 @@ struct ath9k_htc_rx {
         spinlock_t rxbuflock;
 };
 
+#define ATH9K_HTC_TX_CLEANUP_INTERVAL 50 /* ms */
+#define ATH9K_HTC_TX_TIMEOUT_INTERVAL 2500 /* ms */
+#define ATH9K_HTC_TX_RESERVE 10
+#define ATH9K_HTC_TX_TIMEOUT_COUNT 20
+#define ATH9K_HTC_TX_THRESHOLD (MAX_TX_BUF_NUM - ATH9K_HTC_TX_RESERVE)
+
+#define ATH9K_HTC_OP_TX_QUEUES_STOP BIT(0)
+#define ATH9K_HTC_OP_TX_DRAIN       BIT(1)
+
+struct ath9k_htc_tx {
+        u8 flags;
+        int queued_cnt;
+        struct sk_buff_head mgmt_ep_queue;
+        struct sk_buff_head cab_ep_queue;
+        struct sk_buff_head data_be_queue;
+        struct sk_buff_head data_bk_queue;
+        struct sk_buff_head data_vi_queue;
+        struct sk_buff_head data_vo_queue;
+        struct sk_buff_head tx_failed;
+        DECLARE_BITMAP(tx_slot, MAX_TX_BUF_NUM);
+        struct timer_list cleanup_timer;
+        spinlock_t tx_lock;
+};
+
 struct ath9k_htc_tx_ctl {
         u8 type; /* ATH9K_HTC_* */
+        u8 epid;
+        u8 txok;
+        u8 sta_idx;
+        unsigned long timestamp;
 };
 
+static inline struct ath9k_htc_tx_ctl *HTC_SKB_CB(struct sk_buff *skb)
+{
+        struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
+
+        BUILD_BUG_ON(sizeof(struct ath9k_htc_tx_ctl) >
+                     IEEE80211_TX_INFO_DRIVER_DATA_SIZE);
+        return (struct ath9k_htc_tx_ctl *) &tx_info->driver_data;
+}
+
 #ifdef CONFIG_ATH9K_HTC_DEBUGFS
 
 #define TX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c++)
 #define RX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.rx_stats.c++)
+#define CAB_STAT_INC   priv->debug.tx_stats.cab_queued++
 
 #define TX_QSTAT_INC(q) (priv->debug.tx_stats.queue_stats[q]++)
 
+void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv,
+                           struct ath_htc_rx_status *rxs);
+
 struct ath_tx_stats {
         u32 buf_queued;
         u32 buf_completed;
         u32 skb_queued;
-        u32 skb_completed;
-        u32 skb_dropped;
+        u32 skb_success;
+        u32 skb_failed;
+        u32 cab_queued;
         u32 queue_stats[WME_NUM_AC];
 };
 
@@ -306,25 +347,42 @@ struct ath_rx_stats {
         u32 skb_allocated;
         u32 skb_completed;
         u32 skb_dropped;
+        u32 err_crc;
+        u32 err_decrypt_crc;
+        u32 err_mic;
+        u32 err_pre_delim;
+        u32 err_post_delim;
+        u32 err_decrypt_busy;
+        u32 err_phy;
+        u32 err_phy_stats[ATH9K_PHYERR_MAX];
 };
 
 struct ath9k_debug {
         struct dentry *debugfs_phy;
-        struct dentry *debugfs_tgt_stats;
+        struct dentry *debugfs_tgt_int_stats;
+        struct dentry *debugfs_tgt_tx_stats;
+        struct dentry *debugfs_tgt_rx_stats;
         struct dentry *debugfs_xmit;
         struct dentry *debugfs_recv;
+        struct dentry *debugfs_slot;
+        struct dentry *debugfs_queue;
         struct ath_tx_stats tx_stats;
         struct ath_rx_stats rx_stats;
-        u32 txrate;
 };
 
 #else
 
 #define TX_STAT_INC(c) do { } while (0)
 #define RX_STAT_INC(c) do { } while (0)
+#define CAB_STAT_INC   do { } while (0)
 
 #define TX_QSTAT_INC(c) do { } while (0)
 
+static inline void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv,
+                                         struct ath_htc_rx_status *rxs)
+{
+}
+
 #endif /* CONFIG_ATH9K_HTC_DEBUGFS */
 
 #define ATH_LED_PIN_DEF             1
@@ -351,10 +409,21 @@ struct ath_led {
         int brightness;
 };
 
+#define BSTUCK_THRESHOLD 10
+
+/*
+ * Adjust these when the max. no of beaconing interfaces is
+ * increased.
+ */
+#define DEFAULT_SWBA_RESPONSE 40 /* in TUs */
+#define MIN_SWBA_RESPONSE     10 /* in TUs */
+
 struct htc_beacon_config {
+        struct ieee80211_vif *bslot[ATH9K_HTC_MAX_BCN_VIF];
         u16 beacon_interval;
         u16 dtim_period;
         u16 bmiss_timeout;
+        u32 bmiss_cnt;
 };
 
 struct ath_btcoex {
@@ -388,6 +457,9 @@ struct ath9k_htc_priv {
         struct htc_target *htc;
         struct wmi *wmi;
 
+        u16 fw_version_major;
+        u16 fw_version_minor;
+
         enum htc_endpoint_id wmi_cmd_ep;
         enum htc_endpoint_id beacon_ep;
         enum htc_endpoint_id cab_ep;
@@ -411,27 +483,23 @@ struct ath9k_htc_priv {
         u16 txpowlimit;
         u16 nvifs;
         u16 nstations;
-        u32 bmiss_cnt;
         bool rearm_ani;
         bool reconfig_beacon;
+        unsigned int rxfilter;
 
         struct ath9k_hw_cal_data caldata;
+        struct ieee80211_supported_band sbands[IEEE80211_NUM_BANDS];
 
         spinlock_t beacon_lock;
+        struct htc_beacon_config cur_beacon_conf;
 
-        bool tx_queues_stop;
-        spinlock_t tx_lock;
+        struct ath9k_htc_rx rx;
+        struct ath9k_htc_tx tx;
 
-        struct ieee80211_vif *vif;
-        struct htc_beacon_config cur_beacon_conf;
-        unsigned int rxfilter;
         struct tasklet_struct swba_tasklet;
         struct tasklet_struct rx_tasklet;
-        struct ieee80211_supported_band sbands[IEEE80211_NUM_BANDS];
-        struct ath9k_htc_rx rx;
-        struct tasklet_struct tx_tasklet;
-        struct sk_buff_head tx_queue;
         struct delayed_work ani_work;
+        struct tasklet_struct tx_failed_tasklet;
         struct work_struct ps_work;
         struct work_struct fatal_work;
 
@@ -470,11 +538,18 @@ static inline void ath_read_cachesize(struct ath_common *common, int *csz)
 
 void ath9k_htc_reset(struct ath9k_htc_priv *priv);
 
+void ath9k_htc_assign_bslot(struct ath9k_htc_priv *priv,
+                            struct ieee80211_vif *vif);
+void ath9k_htc_remove_bslot(struct ath9k_htc_priv *priv,
+                            struct ieee80211_vif *vif);
+void ath9k_htc_set_tsfadjust(struct ath9k_htc_priv *priv,
+                             struct ieee80211_vif *vif);
 void ath9k_htc_beaconq_config(struct ath9k_htc_priv *priv);
 void ath9k_htc_beacon_config(struct ath9k_htc_priv *priv,
                              struct ieee80211_vif *vif);
 void ath9k_htc_beacon_reconfig(struct ath9k_htc_priv *priv);
-void ath9k_htc_swba(struct ath9k_htc_priv *priv, u8 beacon_pending);
+void ath9k_htc_swba(struct ath9k_htc_priv *priv,
+                    struct wmi_event_swba *swba);
 
 void ath9k_htc_rxep(void *priv, struct sk_buff *skb,
                     enum htc_endpoint_id ep_id);
@@ -491,14 +566,23 @@ void ath9k_htc_start_ani(struct ath9k_htc_priv *priv);
 void ath9k_htc_stop_ani(struct ath9k_htc_priv *priv);
 
 int ath9k_tx_init(struct ath9k_htc_priv *priv);
-void ath9k_tx_tasklet(unsigned long data);
-int ath9k_htc_tx_start(struct ath9k_htc_priv *priv, struct sk_buff *skb);
+int ath9k_htc_tx_start(struct ath9k_htc_priv *priv,
+                       struct sk_buff *skb, u8 slot, bool is_cab);
 void ath9k_tx_cleanup(struct ath9k_htc_priv *priv);
 bool ath9k_htc_txq_setup(struct ath9k_htc_priv *priv, int subtype);
 int ath9k_htc_cabq_setup(struct ath9k_htc_priv *priv);
 int get_hw_qnum(u16 queue, int *hwq_map);
 int ath_htc_txq_update(struct ath9k_htc_priv *priv, int qnum,
                        struct ath9k_tx_queue_info *qinfo);
+void ath9k_htc_check_stop_queues(struct ath9k_htc_priv *priv);
+void ath9k_htc_check_wake_queues(struct ath9k_htc_priv *priv);
+int ath9k_htc_tx_get_slot(struct ath9k_htc_priv *priv);
+void ath9k_htc_tx_clear_slot(struct ath9k_htc_priv *priv, int slot);
+void ath9k_htc_tx_drain(struct ath9k_htc_priv *priv);
+void ath9k_htc_txstatus(struct ath9k_htc_priv *priv, void *wmi_event);
+void ath9k_htc_tx_failed(struct ath9k_htc_priv *priv);
+void ath9k_tx_failed_tasklet(unsigned long data);
+void ath9k_htc_tx_cleanup_timer(unsigned long data);
 
 int ath9k_rx_init(struct ath9k_htc_priv *priv);
 void ath9k_rx_cleanup(struct ath9k_htc_priv *priv);
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
index 8f56158e5887..bf7ef1b7eb3f 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
@@ -18,6 +18,50 @@
 
 #define FUDGE 2
 
+void ath9k_htc_beaconq_config(struct ath9k_htc_priv *priv)
+{
+        struct ath_hw *ah = priv->ah;
+        struct ath9k_tx_queue_info qi, qi_be;
+
+        memset(&qi, 0, sizeof(struct ath9k_tx_queue_info));
+        memset(&qi_be, 0, sizeof(struct ath9k_tx_queue_info));
+
+        ath9k_hw_get_txq_props(ah, priv->beaconq, &qi);
+
+        if (priv->ah->opmode == NL80211_IFTYPE_AP) {
+                qi.tqi_aifs = 1;
+                qi.tqi_cwmin = 0;
+                qi.tqi_cwmax = 0;
+        } else if (priv->ah->opmode == NL80211_IFTYPE_ADHOC) {
+                int qnum = priv->hwq_map[WME_AC_BE];
+
+                ath9k_hw_get_txq_props(ah, qnum, &qi_be);
+
+                qi.tqi_aifs = qi_be.tqi_aifs;
+
+                /*
+                 * For WIFI Beacon Distribution
+                 * Long slot time  : 2x cwmin
+                 * Short slot time : 4x cwmin
+                 */
+                if (ah->slottime == ATH9K_SLOT_TIME_20)
+                        qi.tqi_cwmin = 2*qi_be.tqi_cwmin;
+                else
+                        qi.tqi_cwmin = 4*qi_be.tqi_cwmin;
+
+                qi.tqi_cwmax = qi_be.tqi_cwmax;
+
+        }
+
+        if (!ath9k_hw_set_txq_props(ah, priv->beaconq, &qi)) {
+                ath_err(ath9k_hw_common(ah),
+                        "Unable to update beacon queue %u!\n", priv->beaconq);
+        } else {
+                ath9k_hw_resettxqueue(ah, priv->beaconq);
+        }
+}
+
+
 static void ath9k_htc_beacon_config_sta(struct ath9k_htc_priv *priv,
                                         struct htc_beacon_config *bss_conf)
 {
@@ -154,6 +198,15 @@ static void ath9k_htc_beacon_config_ap(struct ath9k_htc_priv *priv,
         intval /= ATH9K_HTC_MAX_BCN_VIF;
         nexttbtt = intval;
 
+        /*
+         * To reduce beacon misses under heavy TX load,
+         * set the beacon response time to a larger value.
+         */
+        if (intval > DEFAULT_SWBA_RESPONSE)
+                priv->ah->config.sw_beacon_response_time = DEFAULT_SWBA_RESPONSE;
+        else
+                priv->ah->config.sw_beacon_response_time = MIN_SWBA_RESPONSE;
+
         if (priv->op_flags & OP_TSF_RESET) {
                 ath9k_hw_reset_tsf(priv->ah);
                 priv->op_flags &= ~OP_TSF_RESET;
@@ -172,12 +225,16 @@ static void ath9k_htc_beacon_config_ap(struct ath9k_htc_priv *priv,
                 imask |= ATH9K_INT_SWBA;
 
         ath_dbg(common, ATH_DBG_CONFIG,
-                "AP Beacon config, intval: %d, nexttbtt: %u imask: 0x%x\n",
-                bss_conf->beacon_interval, nexttbtt, imask);
+                "AP Beacon config, intval: %d, nexttbtt: %u, resp_time: %d "
+                "imask: 0x%x\n",
+                bss_conf->beacon_interval, nexttbtt,
+                priv->ah->config.sw_beacon_response_time, imask);
+
+        ath9k_htc_beaconq_config(priv);
 
         WMI_CMD(WMI_DISABLE_INTR_CMDID);
         ath9k_hw_beaconinit(priv->ah, TU_TO_USEC(nexttbtt), TU_TO_USEC(intval));
-        priv->bmiss_cnt = 0;
+        priv->cur_beacon_conf.bmiss_cnt = 0;
         htc_imask = cpu_to_be32(imask);
         WMI_CMD_BUF(WMI_ENABLE_INTR_CMDID, &htc_imask);
 }
@@ -205,16 +262,26 @@ static void ath9k_htc_beacon_config_adhoc(struct ath9k_htc_priv *priv,
                 nexttbtt += intval;
         } while (nexttbtt < tsftu);
 
+        /*
+         * Only one IBSS interfce is allowed.
+         */
+        if (intval > DEFAULT_SWBA_RESPONSE)
+                priv->ah->config.sw_beacon_response_time = DEFAULT_SWBA_RESPONSE;
+        else
+                priv->ah->config.sw_beacon_response_time = MIN_SWBA_RESPONSE;
+
         if (priv->op_flags & OP_ENABLE_BEACON)
                 imask |= ATH9K_INT_SWBA;
 
         ath_dbg(common, ATH_DBG_CONFIG,
-                "IBSS Beacon config, intval: %d, nexttbtt: %u, imask: 0x%x\n",
-                bss_conf->beacon_interval, nexttbtt, imask);
+                "IBSS Beacon config, intval: %d, nexttbtt: %u, "
+                "resp_time: %d, imask: 0x%x\n",
+                bss_conf->beacon_interval, nexttbtt,
+                priv->ah->config.sw_beacon_response_time, imask);
 
         WMI_CMD(WMI_DISABLE_INTR_CMDID);
         ath9k_hw_beaconinit(priv->ah, TU_TO_USEC(nexttbtt), TU_TO_USEC(intval));
-        priv->bmiss_cnt = 0;
+        priv->cur_beacon_conf.bmiss_cnt = 0;
         htc_imask = cpu_to_be32(imask);
         WMI_CMD_BUF(WMI_ENABLE_INTR_CMDID, &htc_imask);
 }
@@ -225,38 +292,101 @@ void ath9k_htc_beaconep(void *drv_priv, struct sk_buff *skb,
         dev_kfree_skb_any(skb);
 }
 
-void ath9k_htc_swba(struct ath9k_htc_priv *priv, u8 beacon_pending)
+static void ath9k_htc_send_buffered(struct ath9k_htc_priv *priv,
+                                    int slot)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ieee80211_vif *vif;
+        struct sk_buff *skb;
+        struct ieee80211_hdr *hdr;
+        int padpos, padsize, ret, tx_slot;
+
+        spin_lock_bh(&priv->beacon_lock);
+
+        vif = priv->cur_beacon_conf.bslot[slot];
+
+        skb = ieee80211_get_buffered_bc(priv->hw, vif);
+
+        while(skb) {
+                hdr = (struct ieee80211_hdr *) skb->data;
+
+                padpos = ath9k_cmn_padpos(hdr->frame_control);
+                padsize = padpos & 3;
+                if (padsize && skb->len > padpos) {
+                        if (skb_headroom(skb) < padsize) {
+                                dev_kfree_skb_any(skb);
+                                goto next;
+                        }
+                        skb_push(skb, padsize);
+                        memmove(skb->data, skb->data + padsize, padpos);
+                }
+
+                tx_slot = ath9k_htc_tx_get_slot(priv);
+                if (tx_slot != 0) {
+                        ath_dbg(common, ATH_DBG_XMIT, "No free CAB slot\n");
+                        dev_kfree_skb_any(skb);
+                        goto next;
+                }
+
+                ret = ath9k_htc_tx_start(priv, skb, tx_slot, true);
+                if (ret != 0) {
+                        ath9k_htc_tx_clear_slot(priv, tx_slot);
+                        dev_kfree_skb_any(skb);
+
+                        ath_dbg(common, ATH_DBG_XMIT,
+                                "Failed to send CAB frame\n");
+                } else {
+                        spin_lock_bh(&priv->tx.tx_lock);
+                        priv->tx.queued_cnt++;
+                        spin_unlock_bh(&priv->tx.tx_lock);
+                }
+        next:
+                skb = ieee80211_get_buffered_bc(priv->hw, vif);
+        }
+
+        spin_unlock_bh(&priv->beacon_lock);
+}
+
+static void ath9k_htc_send_beacon(struct ath9k_htc_priv *priv,
+                                  int slot)
 {
-        struct ath9k_htc_vif *avp = (void *)priv->vif->drv_priv;
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ieee80211_vif *vif;
+        struct ath9k_htc_vif *avp;
         struct tx_beacon_header beacon_hdr;
-        struct ath9k_htc_tx_ctl tx_ctl;
+        struct ath9k_htc_tx_ctl *tx_ctl;
         struct ieee80211_tx_info *info;
+        struct ieee80211_mgmt *mgmt;
         struct sk_buff *beacon;
         u8 *tx_fhdr;
+        int ret;
 
         memset(&beacon_hdr, 0, sizeof(struct tx_beacon_header));
-        memset(&tx_ctl, 0, sizeof(struct ath9k_htc_tx_ctl));
-
-        /* FIXME: Handle BMISS */
-        if (beacon_pending != 0) {
-                priv->bmiss_cnt++;
-                return;
-        }
 
         spin_lock_bh(&priv->beacon_lock);
 
+        vif = priv->cur_beacon_conf.bslot[slot];
+        avp = (struct ath9k_htc_vif *)vif->drv_priv;
+
         if (unlikely(priv->op_flags & OP_SCANNING)) {
                 spin_unlock_bh(&priv->beacon_lock);
                 return;
         }
 
         /* Get a new beacon */
-        beacon = ieee80211_beacon_get(priv->hw, priv->vif);
+        beacon = ieee80211_beacon_get(priv->hw, vif);
         if (!beacon) {
                 spin_unlock_bh(&priv->beacon_lock);
                 return;
         }
 
+        /*
+         * Update the TSF adjust value here, the HW will
+         * add this value for every beacon.
+         */
+        mgmt = (struct ieee80211_mgmt *)beacon->data;
+        mgmt->u.beacon.timestamp = avp->tsfadjust;
+
         info = IEEE80211_SKB_CB(beacon);
         if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
                 struct ieee80211_hdr *hdr =
@@ -266,45 +396,149 @@ void ath9k_htc_swba(struct ath9k_htc_priv *priv, u8 beacon_pending)
                 hdr->seq_ctrl |= cpu_to_le16(avp->seq_no);
         }
 
-        tx_ctl.type = ATH9K_HTC_NORMAL;
+        tx_ctl = HTC_SKB_CB(beacon);
+        memset(tx_ctl, 0, sizeof(*tx_ctl));
+
+        tx_ctl->type = ATH9K_HTC_BEACON;
+        tx_ctl->epid = priv->beacon_ep;
+
         beacon_hdr.vif_index = avp->index;
         tx_fhdr = skb_push(beacon, sizeof(beacon_hdr));
         memcpy(tx_fhdr, (u8 *) &beacon_hdr, sizeof(beacon_hdr));
 
-        htc_send(priv->htc, beacon, priv->beacon_ep, &tx_ctl);
+        ret = htc_send(priv->htc, beacon);
+        if (ret != 0) {
+                if (ret == -ENOMEM) {
+                        ath_dbg(common, ATH_DBG_BSTUCK,
+                                "Failed to send beacon, no free TX buffer\n");
+                }
+                dev_kfree_skb_any(beacon);
+        }
+
+        spin_unlock_bh(&priv->beacon_lock);
+}
+
+static int ath9k_htc_choose_bslot(struct ath9k_htc_priv *priv,
+                                  struct wmi_event_swba *swba)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        u64 tsf;
+        u32 tsftu;
+        u16 intval;
+        int slot;
+
+        intval = priv->cur_beacon_conf.beacon_interval & ATH9K_BEACON_PERIOD;
 
+        tsf = be64_to_cpu(swba->tsf);
+        tsftu = TSF_TO_TU(tsf >> 32, tsf);
+        slot = ((tsftu % intval) * ATH9K_HTC_MAX_BCN_VIF) / intval;
+        slot = ATH9K_HTC_MAX_BCN_VIF - slot - 1;
+
+        ath_dbg(common, ATH_DBG_BEACON,
+                "Choose slot: %d, tsf: %llu, tsftu: %u, intval: %u\n",
+                slot, tsf, tsftu, intval);
+
+        return slot;
+}
+
+void ath9k_htc_swba(struct ath9k_htc_priv *priv,
+                    struct wmi_event_swba *swba)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        int slot;
+
+        if (swba->beacon_pending != 0) {
+                priv->cur_beacon_conf.bmiss_cnt++;
+                if (priv->cur_beacon_conf.bmiss_cnt > BSTUCK_THRESHOLD) {
+                        ath_dbg(common, ATH_DBG_BSTUCK,
+                                "Beacon stuck, HW reset\n");
+                        ieee80211_queue_work(priv->hw,
+                                             &priv->fatal_work);
+                }
+                return;
+        }
+
+        if (priv->cur_beacon_conf.bmiss_cnt) {
+                ath_dbg(common, ATH_DBG_BSTUCK,
+                        "Resuming beacon xmit after %u misses\n",
+                        priv->cur_beacon_conf.bmiss_cnt);
+                priv->cur_beacon_conf.bmiss_cnt = 0;
+        }
+
+        slot = ath9k_htc_choose_bslot(priv, swba);
+        spin_lock_bh(&priv->beacon_lock);
+        if (priv->cur_beacon_conf.bslot[slot] == NULL) {
+                spin_unlock_bh(&priv->beacon_lock);
+                return;
+        }
         spin_unlock_bh(&priv->beacon_lock);
+
+        ath9k_htc_send_buffered(priv, slot);
+        ath9k_htc_send_beacon(priv, slot);
 }
 
-/* Currently, only for IBSS */
-void ath9k_htc_beaconq_config(struct ath9k_htc_priv *priv)
+void ath9k_htc_assign_bslot(struct ath9k_htc_priv *priv,
+                            struct ieee80211_vif *vif)
 {
-        struct ath_hw *ah = priv->ah;
-        struct ath9k_tx_queue_info qi, qi_be;
-        int qnum = priv->hwq_map[WME_AC_BE];
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ath9k_htc_vif *avp = (struct ath9k_htc_vif *)vif->drv_priv;
+        int i = 0;
 
-        memset(&qi, 0, sizeof(struct ath9k_tx_queue_info));
-        memset(&qi_be, 0, sizeof(struct ath9k_tx_queue_info));
+        spin_lock_bh(&priv->beacon_lock);
+        for (i = 0; i < ATH9K_HTC_MAX_BCN_VIF; i++) {
+                if (priv->cur_beacon_conf.bslot[i] == NULL) {
+                        avp->bslot = i;
+                        break;
+                }
+        }
+
+        priv->cur_beacon_conf.bslot[avp->bslot] = vif;
+        spin_unlock_bh(&priv->beacon_lock);
+
+        ath_dbg(common, ATH_DBG_CONFIG,
+                "Added interface at beacon slot: %d\n", avp->bslot);
+}
+
+void ath9k_htc_remove_bslot(struct ath9k_htc_priv *priv,
+                            struct ieee80211_vif *vif)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ath9k_htc_vif *avp = (struct ath9k_htc_vif *)vif->drv_priv;
+
+        spin_lock_bh(&priv->beacon_lock);
+        priv->cur_beacon_conf.bslot[avp->bslot] = NULL;
+        spin_unlock_bh(&priv->beacon_lock);
+
+        ath_dbg(common, ATH_DBG_CONFIG,
+                "Removed interface at beacon slot: %d\n", avp->bslot);
+}
 
-        ath9k_hw_get_txq_props(ah, qnum, &qi_be);
+/*
+ * Calculate the TSF adjustment value for all slots
+ * other than zero.
+ */
+void ath9k_htc_set_tsfadjust(struct ath9k_htc_priv *priv,
+                             struct ieee80211_vif *vif)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ath9k_htc_vif *avp = (struct ath9k_htc_vif *)vif->drv_priv;
+        struct htc_beacon_config *cur_conf = &priv->cur_beacon_conf;
+        u64 tsfadjust;
+
+        if (avp->bslot == 0)
+                return;
 
-        qi.tqi_aifs = qi_be.tqi_aifs;
-        /* For WIFI Beacon Distribution
-         * Long slot time  : 2x cwmin
-         * Short slot time : 4x cwmin
+        /*
+         * The beacon interval cannot be different for multi-AP mode,
+         * and we reach here only for VIF slots greater than zero,
+         * so beacon_interval is guaranteed to be set in cur_conf.
          */
-        if (ah->slottime == ATH9K_SLOT_TIME_20)
-                qi.tqi_cwmin = 2*qi_be.tqi_cwmin;
-        else
-                qi.tqi_cwmin = 4*qi_be.tqi_cwmin;
-        qi.tqi_cwmax = qi_be.tqi_cwmax;
+        tsfadjust = cur_conf->beacon_interval * avp->bslot / ATH9K_HTC_MAX_BCN_VIF;
+        avp->tsfadjust = cpu_to_le64(TU_TO_USEC(tsfadjust));
 
-        if (!ath9k_hw_set_txq_props(ah, priv->beaconq, &qi)) {
-                ath_err(ath9k_hw_common(ah),
-                        "Unable to update beacon queue %u!\n", qnum);
-        } else {
-                ath9k_hw_resettxqueue(ah, priv->beaconq);
-        }
+        ath_dbg(common, ATH_DBG_CONFIG,
+                "tsfadjust is: %llu for bslot: %d\n",
+                (unsigned long long)tsfadjust, avp->bslot);
 }
 
 static void ath9k_htc_beacon_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
new file mode 100644
index 000000000000..8d0de60e0c27
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
@@ -0,0 +1,531 @@
+/*
+ * Copyright (c) 2010-2011 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "htc.h"
+
+static struct dentry *ath9k_debugfs_root;
+
+static int ath9k_debugfs_open(struct inode *inode, struct file *file)
+{
+        file->private_data = inode->i_private;
+        return 0;
+}
+
+static ssize_t read_file_tgt_int_stats(struct file *file, char __user *user_buf,
+                                       size_t count, loff_t *ppos)
+{
+        struct ath9k_htc_priv *priv = file->private_data;
+        struct ath9k_htc_target_int_stats cmd_rsp;
+        char buf[512];
+        unsigned int len = 0;
+        int ret = 0;
+
+        memset(&cmd_rsp, 0, sizeof(cmd_rsp));
+
+        WMI_CMD(WMI_INT_STATS_CMDID);
+        if (ret)
+                return -EINVAL;
+
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "RX",
+                        be32_to_cpu(cmd_rsp.rx));
+
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "RXORN",
+                        be32_to_cpu(cmd_rsp.rxorn));
+
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "RXEOL",
+                        be32_to_cpu(cmd_rsp.rxeol));
+
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "TXURN",
+                        be32_to_cpu(cmd_rsp.txurn));
+
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "TXTO",
+                        be32_to_cpu(cmd_rsp.txto));
+
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "CST",
+                        be32_to_cpu(cmd_rsp.cst));
+
+        if (len > sizeof(buf))
+                len = sizeof(buf);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static const struct file_operations fops_tgt_int_stats = {
+        .read = read_file_tgt_int_stats,
+        .open = ath9k_debugfs_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+static ssize_t read_file_tgt_tx_stats(struct file *file, char __user *user_buf,
+                                      size_t count, loff_t *ppos)
+{
+        struct ath9k_htc_priv *priv = file->private_data;
+        struct ath9k_htc_target_tx_stats cmd_rsp;
+        char buf[512];
+        unsigned int len = 0;
+        int ret = 0;
+
+        memset(&cmd_rsp, 0, sizeof(cmd_rsp));
+
+        WMI_CMD(WMI_TX_STATS_CMDID);
+        if (ret)
+                return -EINVAL;
+
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "Xretries",
+                        be32_to_cpu(cmd_rsp.xretries));
+
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "FifoErr",
+                        be32_to_cpu(cmd_rsp.fifoerr));
+
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "Filtered",
+                        be32_to_cpu(cmd_rsp.filtered));
+
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "TimerExp",
+                        be32_to_cpu(cmd_rsp.timer_exp));
+
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "ShortRetries",
+                        be32_to_cpu(cmd_rsp.shortretries));
+
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "LongRetries",
+                        be32_to_cpu(cmd_rsp.longretries));
+
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "QueueNull",
+                        be32_to_cpu(cmd_rsp.qnull));
+
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "EncapFail",
+                        be32_to_cpu(cmd_rsp.encap_fail));
+
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "NoBuf",
+                        be32_to_cpu(cmd_rsp.nobuf));
+
+        if (len > sizeof(buf))
+                len = sizeof(buf);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static const struct file_operations fops_tgt_tx_stats = {
+        .read = read_file_tgt_tx_stats,
+        .open = ath9k_debugfs_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+static ssize_t read_file_tgt_rx_stats(struct file *file, char __user *user_buf,
+                                      size_t count, loff_t *ppos)
+{
+        struct ath9k_htc_priv *priv = file->private_data;
+        struct ath9k_htc_target_rx_stats cmd_rsp;
+        char buf[512];
+        unsigned int len = 0;
+        int ret = 0;
+
+        memset(&cmd_rsp, 0, sizeof(cmd_rsp));
+
+        WMI_CMD(WMI_RX_STATS_CMDID);
+        if (ret)
+                return -EINVAL;
+
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "NoBuf",
+                        be32_to_cpu(cmd_rsp.nobuf));
+
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "HostSend",
+                        be32_to_cpu(cmd_rsp.host_send));
+
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "HostDone",
+                        be32_to_cpu(cmd_rsp.host_done));
+
+        if (len > sizeof(buf))
+                len = sizeof(buf);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static const struct file_operations fops_tgt_rx_stats = {
+        .read = read_file_tgt_rx_stats,
+        .open = ath9k_debugfs_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+static ssize_t read_file_xmit(struct file *file, char __user *user_buf,
+                              size_t count, loff_t *ppos)
+{
+        struct ath9k_htc_priv *priv = file->private_data;
+        char buf[512];
+        unsigned int len = 0;
+
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "Buffers queued",
+                        priv->debug.tx_stats.buf_queued);
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "Buffers completed",
+                        priv->debug.tx_stats.buf_completed);
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "SKBs queued",
+                        priv->debug.tx_stats.skb_queued);
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "SKBs success",
+                        priv->debug.tx_stats.skb_success);
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "SKBs failed",
+                        priv->debug.tx_stats.skb_failed);
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "CAB queued",
+                        priv->debug.tx_stats.cab_queued);
+
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "BE queued",
+                        priv->debug.tx_stats.queue_stats[WME_AC_BE]);
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "BK queued",
+                        priv->debug.tx_stats.queue_stats[WME_AC_BK]);
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "VI queued",
+                        priv->debug.tx_stats.queue_stats[WME_AC_VI]);
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "VO queued",
+                        priv->debug.tx_stats.queue_stats[WME_AC_VO]);
+
+        if (len > sizeof(buf))
+                len = sizeof(buf);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static const struct file_operations fops_xmit = {
+        .read = read_file_xmit,
+        .open = ath9k_debugfs_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv,
+                           struct ath_htc_rx_status *rxs)
+{
+#define RX_PHY_ERR_INC(c) priv->debug.rx_stats.err_phy_stats[c]++
+
+        if (rxs->rs_status & ATH9K_RXERR_CRC)
+                priv->debug.rx_stats.err_crc++;
+        if (rxs->rs_status & ATH9K_RXERR_DECRYPT)
+                priv->debug.rx_stats.err_decrypt_crc++;
+        if (rxs->rs_status & ATH9K_RXERR_MIC)
+                priv->debug.rx_stats.err_mic++;
+        if (rxs->rs_status & ATH9K_RX_DELIM_CRC_PRE)
+                priv->debug.rx_stats.err_pre_delim++;
+        if (rxs->rs_status & ATH9K_RX_DELIM_CRC_POST)
+                priv->debug.rx_stats.err_post_delim++;
+        if (rxs->rs_status & ATH9K_RX_DECRYPT_BUSY)
+                priv->debug.rx_stats.err_decrypt_busy++;
+
+        if (rxs->rs_status & ATH9K_RXERR_PHY) {
+                priv->debug.rx_stats.err_phy++;
+                if (rxs->rs_phyerr < ATH9K_PHYERR_MAX)
+                        RX_PHY_ERR_INC(rxs->rs_phyerr);
+        }
+
+#undef RX_PHY_ERR_INC
+}
+
+static ssize_t read_file_recv(struct file *file, char __user *user_buf,
+                              size_t count, loff_t *ppos)
+{
+#define PHY_ERR(s, p)                                                   \
+        len += snprintf(buf + len, size - len, "%20s : %10u\n", s,      \
+                        priv->debug.rx_stats.err_phy_stats[p]);
+
+        struct ath9k_htc_priv *priv = file->private_data;
+        char *buf;
+        unsigned int len = 0, size = 1500;
+        ssize_t retval = 0;
+
+        buf = kzalloc(size, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
+
+        len += snprintf(buf + len, size - len,
+                        "%20s : %10u\n", "SKBs allocated",
+                        priv->debug.rx_stats.skb_allocated);
+        len += snprintf(buf + len, size - len,
+                        "%20s : %10u\n", "SKBs completed",
+                        priv->debug.rx_stats.skb_completed);
+        len += snprintf(buf + len, size - len,
+                        "%20s : %10u\n", "SKBs Dropped",
+                        priv->debug.rx_stats.skb_dropped);
+
+        len += snprintf(buf + len, size - len,
+                        "%20s : %10u\n", "CRC ERR",
+                        priv->debug.rx_stats.err_crc);
+        len += snprintf(buf + len, size - len,
+                        "%20s : %10u\n", "DECRYPT CRC ERR",
+                        priv->debug.rx_stats.err_decrypt_crc);
+        len += snprintf(buf + len, size - len,
+                        "%20s : %10u\n", "MIC ERR",
+                        priv->debug.rx_stats.err_mic);
+        len += snprintf(buf + len, size - len,
+                        "%20s : %10u\n", "PRE-DELIM CRC ERR",
+                        priv->debug.rx_stats.err_pre_delim);
+        len += snprintf(buf + len, size - len,
+                        "%20s : %10u\n", "POST-DELIM CRC ERR",
+                        priv->debug.rx_stats.err_post_delim);
+        len += snprintf(buf + len, size - len,
+                        "%20s : %10u\n", "DECRYPT BUSY ERR",
+                        priv->debug.rx_stats.err_decrypt_busy);
+        len += snprintf(buf + len, size - len,
+                        "%20s : %10u\n", "TOTAL PHY ERR",
+                        priv->debug.rx_stats.err_phy);
+
+
+        PHY_ERR("UNDERRUN", ATH9K_PHYERR_UNDERRUN);
+        PHY_ERR("TIMING", ATH9K_PHYERR_TIMING);
+        PHY_ERR("PARITY", ATH9K_PHYERR_PARITY);
+        PHY_ERR("RATE", ATH9K_PHYERR_RATE);
+        PHY_ERR("LENGTH", ATH9K_PHYERR_LENGTH);
+        PHY_ERR("RADAR", ATH9K_PHYERR_RADAR);
+        PHY_ERR("SERVICE", ATH9K_PHYERR_SERVICE);
+        PHY_ERR("TOR", ATH9K_PHYERR_TOR);
+        PHY_ERR("OFDM-TIMING", ATH9K_PHYERR_OFDM_TIMING);
+        PHY_ERR("OFDM-SIGNAL-PARITY", ATH9K_PHYERR_OFDM_SIGNAL_PARITY);
+        PHY_ERR("OFDM-RATE", ATH9K_PHYERR_OFDM_RATE_ILLEGAL);
+        PHY_ERR("OFDM-LENGTH", ATH9K_PHYERR_OFDM_LENGTH_ILLEGAL);
+        PHY_ERR("OFDM-POWER-DROP", ATH9K_PHYERR_OFDM_POWER_DROP);
+        PHY_ERR("OFDM-SERVICE", ATH9K_PHYERR_OFDM_SERVICE);
+        PHY_ERR("OFDM-RESTART", ATH9K_PHYERR_OFDM_RESTART);
+        PHY_ERR("FALSE-RADAR-EXT", ATH9K_PHYERR_FALSE_RADAR_EXT);
+        PHY_ERR("CCK-TIMING", ATH9K_PHYERR_CCK_TIMING);
+        PHY_ERR("CCK-HEADER-CRC", ATH9K_PHYERR_CCK_HEADER_CRC);
+        PHY_ERR("CCK-RATE", ATH9K_PHYERR_CCK_RATE_ILLEGAL);
+        PHY_ERR("CCK-SERVICE", ATH9K_PHYERR_CCK_SERVICE);
+        PHY_ERR("CCK-RESTART", ATH9K_PHYERR_CCK_RESTART);
+        PHY_ERR("CCK-LENGTH", ATH9K_PHYERR_CCK_LENGTH_ILLEGAL);
+        PHY_ERR("CCK-POWER-DROP", ATH9K_PHYERR_CCK_POWER_DROP);
+        PHY_ERR("HT-CRC", ATH9K_PHYERR_HT_CRC_ERROR);
+        PHY_ERR("HT-LENGTH", ATH9K_PHYERR_HT_LENGTH_ILLEGAL);
+        PHY_ERR("HT-RATE", ATH9K_PHYERR_HT_RATE_ILLEGAL);
+
+        if (len > size)
+                len = size;
+
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
+
+#undef PHY_ERR
+}
+
+static const struct file_operations fops_recv = {
+        .read = read_file_recv,
+        .open = ath9k_debugfs_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+static ssize_t read_file_slot(struct file *file, char __user *user_buf,
+                              size_t count, loff_t *ppos)
+{
+        struct ath9k_htc_priv *priv = file->private_data;
+        char buf[512];
+        unsigned int len = 0;
+
+        spin_lock_bh(&priv->tx.tx_lock);
+
+        len += snprintf(buf + len, sizeof(buf) - len, "TX slot bitmap : ");
+
+        len += bitmap_scnprintf(buf + len, sizeof(buf) - len,
+                               priv->tx.tx_slot, MAX_TX_BUF_NUM);
+
+        len += snprintf(buf + len, sizeof(buf) - len, "\n");
+
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "Used slots     : %d\n",
+                        bitmap_weight(priv->tx.tx_slot, MAX_TX_BUF_NUM));
+
+        spin_unlock_bh(&priv->tx.tx_lock);
+
+        if (len > sizeof(buf))
+                len = sizeof(buf);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static const struct file_operations fops_slot = {
+        .read = read_file_slot,
+        .open = ath9k_debugfs_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+static ssize_t read_file_queue(struct file *file, char __user *user_buf,
+                               size_t count, loff_t *ppos)
+{
+        struct ath9k_htc_priv *priv = file->private_data;
+        char buf[512];
+        unsigned int len = 0;
+
+        len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
+                        "Mgmt endpoint", skb_queue_len(&priv->tx.mgmt_ep_queue));
+
+        len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
+                        "Cab endpoint", skb_queue_len(&priv->tx.cab_ep_queue));
+
+        len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
+                        "Data BE endpoint", skb_queue_len(&priv->tx.data_be_queue));
+
+        len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
+                        "Data BK endpoint", skb_queue_len(&priv->tx.data_bk_queue));
+
+        len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
+                        "Data VI endpoint", skb_queue_len(&priv->tx.data_vi_queue));
+
+        len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
+                        "Data VO endpoint", skb_queue_len(&priv->tx.data_vo_queue));
+
+        len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
+                        "Failed queue", skb_queue_len(&priv->tx.tx_failed));
+
+        spin_lock_bh(&priv->tx.tx_lock);
+        len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
+                        "Queued count", priv->tx.queued_cnt);
+        spin_unlock_bh(&priv->tx.tx_lock);
+
+        if (len > sizeof(buf))
+                len = sizeof(buf);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+
+}
+
+static const struct file_operations fops_queue = {
+        .read = read_file_queue,
+        .open = ath9k_debugfs_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+int ath9k_htc_init_debug(struct ath_hw *ah)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) common->priv;
+
+        if (!ath9k_debugfs_root)
+                return -ENOENT;
+
+        priv->debug.debugfs_phy = debugfs_create_dir(wiphy_name(priv->hw->wiphy),
+                                                     ath9k_debugfs_root);
+        if (!priv->debug.debugfs_phy)
+                goto err;
+
+        priv->debug.debugfs_tgt_int_stats = debugfs_create_file("tgt_int_stats",
+                                                        S_IRUSR,
+                                                        priv->debug.debugfs_phy,
+                                                        priv, &fops_tgt_int_stats);
+        if (!priv->debug.debugfs_tgt_int_stats)
+                goto err;
+
+        priv->debug.debugfs_tgt_tx_stats = debugfs_create_file("tgt_tx_stats",
+                                                       S_IRUSR,
+                                                       priv->debug.debugfs_phy,
+                                                       priv, &fops_tgt_tx_stats);
+        if (!priv->debug.debugfs_tgt_tx_stats)
+                goto err;
+
+        priv->debug.debugfs_tgt_rx_stats = debugfs_create_file("tgt_rx_stats",
+                                                       S_IRUSR,
+                                                       priv->debug.debugfs_phy,
+                                                       priv, &fops_tgt_rx_stats);
+        if (!priv->debug.debugfs_tgt_rx_stats)
+                goto err;
+
+        priv->debug.debugfs_xmit = debugfs_create_file("xmit", S_IRUSR,
+                                                       priv->debug.debugfs_phy,
+                                                       priv, &fops_xmit);
+        if (!priv->debug.debugfs_xmit)
+                goto err;
+
+        priv->debug.debugfs_recv = debugfs_create_file("recv", S_IRUSR,
+                                                       priv->debug.debugfs_phy,
+                                                       priv, &fops_recv);
+        if (!priv->debug.debugfs_recv)
+                goto err;
+
+        priv->debug.debugfs_slot = debugfs_create_file("slot", S_IRUSR,
+                                                       priv->debug.debugfs_phy,
+                                                       priv, &fops_slot);
+        if (!priv->debug.debugfs_slot)
+                goto err;
+
+        priv->debug.debugfs_queue = debugfs_create_file("queue", S_IRUSR,
+                                                        priv->debug.debugfs_phy,
+                                                        priv, &fops_queue);
+        if (!priv->debug.debugfs_queue)
+                goto err;
+
+        return 0;
+
+err:
+        ath9k_htc_exit_debug(ah);
+        return -ENOMEM;
+}
+
+void ath9k_htc_exit_debug(struct ath_hw *ah)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) common->priv;
+
+        debugfs_remove(priv->debug.debugfs_queue);
+        debugfs_remove(priv->debug.debugfs_slot);
+        debugfs_remove(priv->debug.debugfs_recv);
+        debugfs_remove(priv->debug.debugfs_xmit);
+        debugfs_remove(priv->debug.debugfs_tgt_int_stats);
+        debugfs_remove(priv->debug.debugfs_tgt_tx_stats);
+        debugfs_remove(priv->debug.debugfs_tgt_rx_stats);
+        debugfs_remove(priv->debug.debugfs_phy);
+}
+
+int ath9k_htc_debug_create_root(void)
+{
+        ath9k_debugfs_root = debugfs_create_dir(KBUILD_MODNAME, NULL);
+        if (!ath9k_debugfs_root)
+                return -ENOENT;
+
+        return 0;
+}
+
+void ath9k_htc_debug_remove_root(void)
+{
+        debugfs_remove(ath9k_debugfs_root);
+        ath9k_debugfs_root = NULL;
+}
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_gpio.c b/drivers/net/wireless/ath/ath9k/htc_drv_gpio.c
index 7e630a81b453..dc0b33d01210 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_gpio.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_gpio.c
@@ -398,9 +398,9 @@ void ath9k_htc_radio_enable(struct ieee80211_hw *hw)
 
         /* Start TX */
         htc_start(priv->htc);
-        spin_lock_bh(&priv->tx_lock);
-        priv->tx_queues_stop = false;
-        spin_unlock_bh(&priv->tx_lock);
+        spin_lock_bh(&priv->tx.tx_lock);
+        priv->tx.flags &= ~ATH9K_HTC_OP_TX_QUEUES_STOP;
+        spin_unlock_bh(&priv->tx.tx_lock);
         ieee80211_wake_queues(hw);
 
         WMI_CMD(WMI_ENABLE_INTR_CMDID);
@@ -429,13 +429,15 @@ void ath9k_htc_radio_disable(struct ieee80211_hw *hw)
 
         /* Stop TX */
         ieee80211_stop_queues(hw);
-        htc_stop(priv->htc);
+        ath9k_htc_tx_drain(priv);
         WMI_CMD(WMI_DRAIN_TXQ_ALL_CMDID);
-        skb_queue_purge(&priv->tx_queue);
 
         /* Stop RX */
         WMI_CMD(WMI_STOP_RECV_CMDID);
 
+        /* Clear the WMI event queue */
+        ath9k_wmi_event_drain(priv);
+
         /*
          * The MIB counters have to be disabled here,
          * since the target doesn't do it.
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 8303b34bdc90..22736eb901cf 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -643,7 +643,7 @@ static int ath9k_init_priv(struct ath9k_htc_priv *priv,
 {
         struct ath_hw *ah = NULL;
         struct ath_common *common;
-        int ret = 0, csz = 0;
+        int i, ret = 0, csz = 0;
 
         priv->op_flags |= OP_INVALID;
 
@@ -671,20 +671,19 @@ static int ath9k_init_priv(struct ath9k_htc_priv *priv,
         common->priv = priv;
         common->debug_mask = ath9k_debug;
 
-        spin_lock_init(&priv->wmi->wmi_lock);
         spin_lock_init(&priv->beacon_lock);
-        spin_lock_init(&priv->tx_lock);
+        spin_lock_init(&priv->tx.tx_lock);
         mutex_init(&priv->mutex);
         mutex_init(&priv->htc_pm_lock);
-        tasklet_init(&priv->swba_tasklet, ath9k_swba_tasklet,
-                     (unsigned long)priv);
         tasklet_init(&priv->rx_tasklet, ath9k_rx_tasklet,
                      (unsigned long)priv);
-        tasklet_init(&priv->tx_tasklet, ath9k_tx_tasklet,
+        tasklet_init(&priv->tx_failed_tasklet, ath9k_tx_failed_tasklet,
                      (unsigned long)priv);
         INIT_DELAYED_WORK(&priv->ani_work, ath9k_htc_ani_work);
         INIT_WORK(&priv->ps_work, ath9k_ps_work);
         INIT_WORK(&priv->fatal_work, ath9k_fatal_work);
+        setup_timer(&priv->tx.cleanup_timer, ath9k_htc_tx_cleanup_timer,
+                    (unsigned long)priv);
 
         /*
          * Cache line size is used to size and align various
@@ -711,6 +710,9 @@ static int ath9k_init_priv(struct ath9k_htc_priv *priv,
         if (ret)
                 goto err_queues;
 
+        for (i = 0; i < ATH9K_HTC_MAX_BCN_VIF; i++)
+                priv->cur_beacon_conf.bslot[i] = NULL;
+
         ath9k_init_crypto(priv);
         ath9k_init_channels_rates(priv);
         ath9k_init_misc(priv);
@@ -745,11 +747,15 @@ static void ath9k_set_hw_capab(struct ath9k_htc_priv *priv,
                 IEEE80211_HW_HAS_RATE_CONTROL |
                 IEEE80211_HW_RX_INCLUDES_FCS |
                 IEEE80211_HW_SUPPORTS_PS |
-                IEEE80211_HW_PS_NULLFUNC_STACK;
+                IEEE80211_HW_PS_NULLFUNC_STACK |
+                IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING;
 
         hw->wiphy->interface_modes =
                 BIT(NL80211_IFTYPE_STATION) |
-                BIT(NL80211_IFTYPE_ADHOC);
+                BIT(NL80211_IFTYPE_ADHOC) |
+                BIT(NL80211_IFTYPE_AP) |
+                BIT(NL80211_IFTYPE_P2P_GO) |
+                BIT(NL80211_IFTYPE_P2P_CLIENT);
 
         hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 
@@ -782,6 +788,32 @@ static void ath9k_set_hw_capab(struct ath9k_htc_priv *priv,
         SET_IEEE80211_PERM_ADDR(hw, common->macaddr);
 }
 
+static int ath9k_init_firmware_version(struct ath9k_htc_priv *priv)
+{
+        struct ieee80211_hw *hw = priv->hw;
+        struct wmi_fw_version cmd_rsp;
+        int ret;
+
+        memset(&cmd_rsp, 0, sizeof(cmd_rsp));
+
+        WMI_CMD(WMI_GET_FW_VERSION);
+        if (ret)
+                return -EINVAL;
+
+        priv->fw_version_major = be16_to_cpu(cmd_rsp.major);
+        priv->fw_version_minor = be16_to_cpu(cmd_rsp.minor);
+
+        snprintf(hw->wiphy->fw_version, ETHTOOL_BUSINFO_LEN, "%d.%d",
+                 priv->fw_version_major,
+                 priv->fw_version_minor);
+
+        dev_info(priv->dev, "ath9k_htc: FW Version: %d.%d\n",
+                 priv->fw_version_major,
+                 priv->fw_version_minor);
+
+        return 0;
+}
+
 static int ath9k_init_device(struct ath9k_htc_priv *priv,
                              u16 devid, char *product, u32 drv_info)
 {
@@ -801,6 +833,10 @@ static int ath9k_init_device(struct ath9k_htc_priv *priv,
         common = ath9k_hw_common(ah);
         ath9k_set_hw_capab(priv, hw);
 
+        error = ath9k_init_firmware_version(priv);
+        if (error != 0)
+                goto err_fw;
+
         /* Initialize regulatory */
         error = ath_regd_init(&common->regulatory, priv->hw->wiphy,
                               ath9k_reg_notifier);
@@ -861,6 +897,8 @@ err_rx:
 err_tx:
         /* Nothing */
 err_regd:
+        /* Nothing */
+err_fw:
         ath9k_deinit_priv(priv);
 err_init:
         return error;
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index db8c0c044e9e..4de38643cb53 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -16,10 +16,6 @@
 
 #include "htc.h"
 
-#ifdef CONFIG_ATH9K_HTC_DEBUGFS
-static struct dentry *ath9k_debugfs_root;
-#endif
-
 /*************/
 /* Utilities */
 /*************/
@@ -197,11 +193,16 @@ void ath9k_htc_reset(struct ath9k_htc_priv *priv)
 
         ath9k_htc_stop_ani(priv);
         ieee80211_stop_queues(priv->hw);
-        htc_stop(priv->htc);
+
+        del_timer_sync(&priv->tx.cleanup_timer);
+        ath9k_htc_tx_drain(priv);
+
         WMI_CMD(WMI_DISABLE_INTR_CMDID);
         WMI_CMD(WMI_DRAIN_TXQ_ALL_CMDID);
         WMI_CMD(WMI_STOP_RECV_CMDID);
 
+        ath9k_wmi_event_drain(priv);
+
         caldata = &priv->caldata;
         ret = ath9k_hw_reset(ah, ah->curchan, caldata, false);
         if (ret) {
@@ -225,6 +226,9 @@ void ath9k_htc_reset(struct ath9k_htc_priv *priv)
         ath9k_htc_vif_reconfig(priv);
         ieee80211_wake_queues(priv->hw);
 
+        mod_timer(&priv->tx.cleanup_timer,
+                  jiffies + msecs_to_jiffies(ATH9K_HTC_TX_CLEANUP_INTERVAL));
+
         ath9k_htc_ps_restore(priv);
         mutex_unlock(&priv->mutex);
 }
@@ -250,11 +254,16 @@ static int ath9k_htc_set_channel(struct ath9k_htc_priv *priv,
         fastcc = !!(hw->conf.flags & IEEE80211_CONF_OFFCHANNEL);
 
         ath9k_htc_ps_wakeup(priv);
-        htc_stop(priv->htc);
+
+        del_timer_sync(&priv->tx.cleanup_timer);
+        ath9k_htc_tx_drain(priv);
+
         WMI_CMD(WMI_DISABLE_INTR_CMDID);
         WMI_CMD(WMI_DRAIN_TXQ_ALL_CMDID);
         WMI_CMD(WMI_STOP_RECV_CMDID);
 
+        ath9k_wmi_event_drain(priv);
+
         ath_dbg(common, ATH_DBG_CONFIG,
                 "(%u MHz) -> (%u MHz), HT: %d, HT40: %d fastcc: %d\n",
                 priv->ah->curchan->channel,
@@ -263,6 +272,7 @@ static int ath9k_htc_set_channel(struct ath9k_htc_priv *priv,
 
         if (!fastcc)
                 caldata = &priv->caldata;
+
         ret = ath9k_hw_reset(ah, hchan, caldata, fastcc);
         if (ret) {
                 ath_err(common,
@@ -296,6 +306,9 @@ static int ath9k_htc_set_channel(struct ath9k_htc_priv *priv,
             !(hw->conf.flags & IEEE80211_CONF_OFFCHANNEL))
                 ath9k_htc_vif_reconfig(priv);
 
+        mod_timer(&priv->tx.cleanup_timer,
+                  jiffies + msecs_to_jiffies(ATH9K_HTC_TX_CLEANUP_INTERVAL));
+
 err:
         ath9k_htc_ps_restore(priv);
         return ret;
@@ -349,7 +362,7 @@ static int ath9k_htc_add_monitor_interface(struct ath9k_htc_priv *priv)
         memset(&hvif, 0, sizeof(struct ath9k_htc_target_vif));
         memcpy(&hvif.myaddr, common->macaddr, ETH_ALEN);
 
-        hvif.opmode = cpu_to_be32(HTC_M_MONITOR);
+        hvif.opmode = HTC_M_MONITOR;
         hvif.index = ffz(priv->vif_slot);
 
         WMI_CMD_BUF(WMI_VAP_CREATE_CMDID, &hvif);
@@ -382,7 +395,7 @@ static int ath9k_htc_add_monitor_interface(struct ath9k_htc_priv *priv)
         tsta.is_vif_sta = 1;
         tsta.sta_index = sta_idx;
         tsta.vif_index = hvif.index;
-        tsta.maxampdu = 0xffff;
+        tsta.maxampdu = cpu_to_be16(0xffff);
 
         WMI_CMD_BUF(WMI_NODE_CREATE_CMDID, &tsta);
         if (ret) {
@@ -463,9 +476,7 @@ static int ath9k_htc_add_station(struct ath9k_htc_priv *priv,
                 ista = (struct ath9k_htc_sta *) sta->drv_priv;
                 memcpy(&tsta.macaddr, sta->addr, ETH_ALEN);
                 memcpy(&tsta.bssid, common->curbssid, ETH_ALEN);
-                tsta.associd = common->curaid;
                 tsta.is_vif_sta = 0;
-                tsta.valid = true;
                 ista->index = sta_idx;
         } else {
                 memcpy(&tsta.macaddr, vif->addr, ETH_ALEN);
@@ -474,7 +485,7 @@ static int ath9k_htc_add_station(struct ath9k_htc_priv *priv,
 
         tsta.sta_index = sta_idx;
         tsta.vif_index = avp->index;
-        tsta.maxampdu = 0xffff;
+        tsta.maxampdu = cpu_to_be16(0xffff);
         if (sta && sta->ht_cap.ht_supported)
                 tsta.flags = cpu_to_be16(ATH_HTC_STA_HT);
 
@@ -709,218 +720,13 @@ static int ath9k_htc_tx_aggr_oper(struct ath9k_htc_priv *priv,
                         (aggr.aggr_enable) ? "Starting" : "Stopping",
                         sta->addr, tid);
 
-        spin_lock_bh(&priv->tx_lock);
+        spin_lock_bh(&priv->tx.tx_lock);
         ista->tid_state[tid] = (aggr.aggr_enable && !ret) ? AGGR_START : AGGR_STOP;
-        spin_unlock_bh(&priv->tx_lock);
+        spin_unlock_bh(&priv->tx.tx_lock);
 
         return ret;
 }
 
-/*********/
-/* DEBUG */
-/*********/
-
-#ifdef CONFIG_ATH9K_HTC_DEBUGFS
-
-static int ath9k_debugfs_open(struct inode *inode, struct file *file)
-{
-        file->private_data = inode->i_private;
-        return 0;
-}
-
-static ssize_t read_file_tgt_stats(struct file *file, char __user *user_buf,
-                                   size_t count, loff_t *ppos)
-{
-        struct ath9k_htc_priv *priv = file->private_data;
-        struct ath9k_htc_target_stats cmd_rsp;
-        char buf[512];
-        unsigned int len = 0;
-        int ret = 0;
-
-        memset(&cmd_rsp, 0, sizeof(cmd_rsp));
-
-        WMI_CMD(WMI_TGT_STATS_CMDID);
-        if (ret)
-                return -EINVAL;
-
-
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%19s : %10u\n", "TX Short Retries",
-                        be32_to_cpu(cmd_rsp.tx_shortretry));
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%19s : %10u\n", "TX Long Retries",
-                        be32_to_cpu(cmd_rsp.tx_longretry));
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%19s : %10u\n", "TX Xretries",
-                        be32_to_cpu(cmd_rsp.tx_xretries));
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%19s : %10u\n", "TX Unaggr. Xretries",
-                        be32_to_cpu(cmd_rsp.ht_txunaggr_xretry));
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%19s : %10u\n", "TX Xretries (HT)",
-                        be32_to_cpu(cmd_rsp.ht_tx_xretries));
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%19s : %10u\n", "TX Rate", priv->debug.txrate);
-
-        if (len > sizeof(buf))
-                len = sizeof(buf);
-
-        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
-}
-
-static const struct file_operations fops_tgt_stats = {
-        .read = read_file_tgt_stats,
-        .open = ath9k_debugfs_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
-static ssize_t read_file_xmit(struct file *file, char __user *user_buf,
-                              size_t count, loff_t *ppos)
-{
-        struct ath9k_htc_priv *priv = file->private_data;
-        char buf[512];
-        unsigned int len = 0;
-
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "Buffers queued",
-                        priv->debug.tx_stats.buf_queued);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "Buffers completed",
-                        priv->debug.tx_stats.buf_completed);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "SKBs queued",
-                        priv->debug.tx_stats.skb_queued);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "SKBs completed",
-                        priv->debug.tx_stats.skb_completed);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "SKBs dropped",
-                        priv->debug.tx_stats.skb_dropped);
-
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "BE queued",
-                        priv->debug.tx_stats.queue_stats[WME_AC_BE]);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "BK queued",
-                        priv->debug.tx_stats.queue_stats[WME_AC_BK]);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "VI queued",
-                        priv->debug.tx_stats.queue_stats[WME_AC_VI]);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "VO queued",
-                        priv->debug.tx_stats.queue_stats[WME_AC_VO]);
-
-        if (len > sizeof(buf))
-                len = sizeof(buf);
-
-        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
-}
-
-static const struct file_operations fops_xmit = {
-        .read = read_file_xmit,
-        .open = ath9k_debugfs_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
-static ssize_t read_file_recv(struct file *file, char __user *user_buf,
-                              size_t count, loff_t *ppos)
-{
-        struct ath9k_htc_priv *priv = file->private_data;
-        char buf[512];
-        unsigned int len = 0;
-
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "SKBs allocated",
-                        priv->debug.rx_stats.skb_allocated);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "SKBs completed",
-                        priv->debug.rx_stats.skb_completed);
-        len += snprintf(buf + len, sizeof(buf) - len,
-                        "%20s : %10u\n", "SKBs Dropped",
-                        priv->debug.rx_stats.skb_dropped);
-
-        if (len > sizeof(buf))
-                len = sizeof(buf);
-
-        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
-}
-
-static const struct file_operations fops_recv = {
-        .read = read_file_recv,
-        .open = ath9k_debugfs_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
-int ath9k_htc_init_debug(struct ath_hw *ah)
-{
-        struct ath_common *common = ath9k_hw_common(ah);
-        struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) common->priv;
-
-        if (!ath9k_debugfs_root)
-                return -ENOENT;
-
-        priv->debug.debugfs_phy = debugfs_create_dir(wiphy_name(priv->hw->wiphy),
-                                                     ath9k_debugfs_root);
-        if (!priv->debug.debugfs_phy)
-                goto err;
-
-        priv->debug.debugfs_tgt_stats = debugfs_create_file("tgt_stats", S_IRUSR,
-                                                    priv->debug.debugfs_phy,
-                                                    priv, &fops_tgt_stats);
-        if (!priv->debug.debugfs_tgt_stats)
-                goto err;
-
-
-        priv->debug.debugfs_xmit = debugfs_create_file("xmit", S_IRUSR,
-                                                       priv->debug.debugfs_phy,
-                                                       priv, &fops_xmit);
-        if (!priv->debug.debugfs_xmit)
-                goto err;
-
-        priv->debug.debugfs_recv = debugfs_create_file("recv", S_IRUSR,
-                                                       priv->debug.debugfs_phy,
-                                                       priv, &fops_recv);
-        if (!priv->debug.debugfs_recv)
-                goto err;
-
-        return 0;
-
-err:
-        ath9k_htc_exit_debug(ah);
-        return -ENOMEM;
-}
-
-void ath9k_htc_exit_debug(struct ath_hw *ah)
-{
-        struct ath_common *common = ath9k_hw_common(ah);
-        struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) common->priv;
-
-        debugfs_remove(priv->debug.debugfs_recv);
-        debugfs_remove(priv->debug.debugfs_xmit);
-        debugfs_remove(priv->debug.debugfs_tgt_stats);
-        debugfs_remove(priv->debug.debugfs_phy);
-}
-
-int ath9k_htc_debug_create_root(void)
-{
-        ath9k_debugfs_root = debugfs_create_dir(KBUILD_MODNAME, NULL);
-        if (!ath9k_debugfs_root)
-                return -ENOENT;
-
-        return 0;
-}
-
-void ath9k_htc_debug_remove_root(void)
-{
-        debugfs_remove(ath9k_debugfs_root);
-        ath9k_debugfs_root = NULL;
-}
-
-#endif /* CONFIG_ATH9K_HTC_DEBUGFS */
-
 /*******/
 /* ANI */
 /*******/
@@ -1040,7 +846,8 @@ static void ath9k_htc_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr;
         struct ath9k_htc_priv *priv = hw->priv;
-        int padpos, padsize, ret;
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        int padpos, padsize, ret, slot;
 
         hdr = (struct ieee80211_hdr *) skb->data;
 
@@ -1048,30 +855,32 @@ static void ath9k_htc_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         padpos = ath9k_cmn_padpos(hdr->frame_control);
         padsize = padpos & 3;
         if (padsize && skb->len > padpos) {
-                if (skb_headroom(skb) < padsize)
+                if (skb_headroom(skb) < padsize) {
+                        ath_dbg(common, ATH_DBG_XMIT, "No room for padding\n");
                         goto fail_tx;
+                }
                 skb_push(skb, padsize);
                 memmove(skb->data, skb->data + padsize, padpos);
         }
 
-        ret = ath9k_htc_tx_start(priv, skb);
-        if (ret != 0) {
-                if (ret == -ENOMEM) {
-                        ath_dbg(ath9k_hw_common(priv->ah), ATH_DBG_XMIT,
-                                "Stopping TX queues\n");
-                        ieee80211_stop_queues(hw);
-                        spin_lock_bh(&priv->tx_lock);
-                        priv->tx_queues_stop = true;
-                        spin_unlock_bh(&priv->tx_lock);
-                } else {
-                        ath_dbg(ath9k_hw_common(priv->ah), ATH_DBG_XMIT,
-                                "Tx failed\n");
-                }
+        slot = ath9k_htc_tx_get_slot(priv);
+        if (slot < 0) {
+                ath_dbg(common, ATH_DBG_XMIT, "No free TX slot\n");
                 goto fail_tx;
         }
 
+        ret = ath9k_htc_tx_start(priv, skb, slot, false);
+        if (ret != 0) {
+                ath_dbg(common, ATH_DBG_XMIT, "Tx failed\n");
+                goto clear_slot;
+        }
+
+        ath9k_htc_check_stop_queues(priv);
+
         return;
 
+clear_slot:
+        ath9k_htc_tx_clear_slot(priv, slot);
 fail_tx:
         dev_kfree_skb_any(skb);
 }
@@ -1130,12 +939,15 @@ static int ath9k_htc_start(struct ieee80211_hw *hw)
         priv->op_flags &= ~OP_INVALID;
         htc_start(priv->htc);
 
-        spin_lock_bh(&priv->tx_lock);
-        priv->tx_queues_stop = false;
-        spin_unlock_bh(&priv->tx_lock);
+        spin_lock_bh(&priv->tx.tx_lock);
+        priv->tx.flags &= ~ATH9K_HTC_OP_TX_QUEUES_STOP;
+        spin_unlock_bh(&priv->tx.tx_lock);
 
         ieee80211_wake_queues(hw);
 
+        mod_timer(&priv->tx.cleanup_timer,
+                  jiffies + msecs_to_jiffies(ATH9K_HTC_TX_CLEANUP_INTERVAL));
+
         if (ah->btcoex_hw.scheme == ATH_BTCOEX_CFG_3WIRE) {
                 ath9k_hw_btcoex_set_weight(ah, AR_BT_COEX_WGHT,
                                            AR_STOMP_LOW_WLAN_WGHT);
@@ -1164,16 +976,16 @@ static void ath9k_htc_stop(struct ieee80211_hw *hw)
         }
 
         ath9k_htc_ps_wakeup(priv);
-        htc_stop(priv->htc);
+
         WMI_CMD(WMI_DISABLE_INTR_CMDID);
         WMI_CMD(WMI_DRAIN_TXQ_ALL_CMDID);
         WMI_CMD(WMI_STOP_RECV_CMDID);
 
-        tasklet_kill(&priv->swba_tasklet);
         tasklet_kill(&priv->rx_tasklet);
-        tasklet_kill(&priv->tx_tasklet);
 
-        skb_queue_purge(&priv->tx_queue);
+        del_timer_sync(&priv->tx.cleanup_timer);
+        ath9k_htc_tx_drain(priv);
+        ath9k_wmi_event_drain(priv);
 
         mutex_unlock(&priv->mutex);
 
@@ -1245,13 +1057,13 @@ static int ath9k_htc_add_interface(struct ieee80211_hw *hw,
 
         switch (vif->type) {
         case NL80211_IFTYPE_STATION:
-                hvif.opmode = cpu_to_be32(HTC_M_STA);
+                hvif.opmode = HTC_M_STA;
                 break;
         case NL80211_IFTYPE_ADHOC:
-                hvif.opmode = cpu_to_be32(HTC_M_IBSS);
+                hvif.opmode = HTC_M_IBSS;
                 break;
         case NL80211_IFTYPE_AP:
-                hvif.opmode = cpu_to_be32(HTC_M_HOSTAP);
+                hvif.opmode = HTC_M_HOSTAP;
                 break;
         default:
                 ath_err(common,
@@ -1281,14 +1093,20 @@ static int ath9k_htc_add_interface(struct ieee80211_hw *hw,
 
         priv->vif_slot |= (1 << avp->index);
         priv->nvifs++;
-        priv->vif = vif;
 
         INC_VIF(priv, vif->type);
+
+        if ((vif->type == NL80211_IFTYPE_AP) ||
+            (vif->type == NL80211_IFTYPE_ADHOC))
+                ath9k_htc_assign_bslot(priv, vif);
+
         ath9k_htc_set_opmode(priv);
 
         if ((priv->ah->opmode == NL80211_IFTYPE_AP) &&
-            !(priv->op_flags & OP_ANI_RUNNING))
+            !(priv->op_flags & OP_ANI_RUNNING)) {
+                ath9k_hw_set_tsfadjust(priv->ah, 1);
                 ath9k_htc_start_ani(priv);
+        }
 
         ath_dbg(common, ATH_DBG_CONFIG,
                 "Attach a VIF of type: %d at idx: %d\n", vif->type, avp->index);
@@ -1321,9 +1139,13 @@ static void ath9k_htc_remove_interface(struct ieee80211_hw *hw,
         priv->vif_slot &= ~(1 << avp->index);
 
         ath9k_htc_remove_station(priv, vif, NULL);
-        priv->vif = NULL;
 
         DEC_VIF(priv, vif->type);
+
+        if ((vif->type == NL80211_IFTYPE_AP) ||
+            (vif->type == NL80211_IFTYPE_ADHOC))
+                ath9k_htc_remove_bslot(priv, vif);
+
         ath9k_htc_set_opmode(priv);
 
         /*
@@ -1493,10 +1315,13 @@ static int ath9k_htc_sta_remove(struct ieee80211_hw *hw,
                                 struct ieee80211_sta *sta)
 {
         struct ath9k_htc_priv *priv = hw->priv;
+        struct ath9k_htc_sta *ista;
         int ret;
 
         mutex_lock(&priv->mutex);
         ath9k_htc_ps_wakeup(priv);
+        ista = (struct ath9k_htc_sta *) sta->drv_priv;
+        htc_sta_drain(priv->htc, ista->index);
         ret = ath9k_htc_remove_station(priv, vif, sta);
         ath9k_htc_ps_restore(priv);
         mutex_unlock(&priv->mutex);
@@ -1644,6 +1469,7 @@ static void ath9k_htc_bss_info_changed(struct ieee80211_hw *hw,
         if ((changed & BSS_CHANGED_BEACON_ENABLED) && bss_conf->enable_beacon) {
                 ath_dbg(common, ATH_DBG_CONFIG,
                         "Beacon enabled for BSS: %pM\n", bss_conf->bssid);
+                ath9k_htc_set_tsfadjust(priv, vif);
                 priv->op_flags |= OP_ENABLE_BEACON;
                 ath9k_htc_beacon_config(priv, vif);
         }
@@ -1758,9 +1584,9 @@ static int ath9k_htc_ampdu_action(struct ieee80211_hw *hw,
                 break;
         case IEEE80211_AMPDU_TX_OPERATIONAL:
                 ista = (struct ath9k_htc_sta *) sta->drv_priv;
-                spin_lock_bh(&priv->tx_lock);
+                spin_lock_bh(&priv->tx.tx_lock);
                 ista->tid_state[tid] = AGGR_OPERATIONAL;
-                spin_unlock_bh(&priv->tx_lock);
+                spin_unlock_bh(&priv->tx.tx_lock);
                 break;
         default:
                 ath_err(ath9k_hw_common(priv->ah), "Unknown AMPDU action\n");
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 4a4f27ba96af..723a3a9c5cd9 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -53,6 +53,138 @@ int get_hw_qnum(u16 queue, int *hwq_map)
         }
 }
 
+void ath9k_htc_check_stop_queues(struct ath9k_htc_priv *priv)
+{
+        spin_lock_bh(&priv->tx.tx_lock);
+        priv->tx.queued_cnt++;
+        if ((priv->tx.queued_cnt >= ATH9K_HTC_TX_THRESHOLD) &&
+            !(priv->tx.flags & ATH9K_HTC_OP_TX_QUEUES_STOP)) {
+                priv->tx.flags |= ATH9K_HTC_OP_TX_QUEUES_STOP;
+                ieee80211_stop_queues(priv->hw);
+        }
+        spin_unlock_bh(&priv->tx.tx_lock);
+}
+
+void ath9k_htc_check_wake_queues(struct ath9k_htc_priv *priv)
+{
+        spin_lock_bh(&priv->tx.tx_lock);
+        if ((priv->tx.queued_cnt < ATH9K_HTC_TX_THRESHOLD) &&
+            (priv->tx.flags & ATH9K_HTC_OP_TX_QUEUES_STOP)) {
+                priv->tx.flags &= ~ATH9K_HTC_OP_TX_QUEUES_STOP;
+                ieee80211_wake_queues(priv->hw);
+        }
+        spin_unlock_bh(&priv->tx.tx_lock);
+}
+
+int ath9k_htc_tx_get_slot(struct ath9k_htc_priv *priv)
+{
+        int slot;
+
+        spin_lock_bh(&priv->tx.tx_lock);
+        slot = find_first_zero_bit(priv->tx.tx_slot, MAX_TX_BUF_NUM);
+        if (slot >= MAX_TX_BUF_NUM) {
+                spin_unlock_bh(&priv->tx.tx_lock);
+                return -ENOBUFS;
+        }
+        __set_bit(slot, priv->tx.tx_slot);
+        spin_unlock_bh(&priv->tx.tx_lock);
+
+        return slot;
+}
+
+void ath9k_htc_tx_clear_slot(struct ath9k_htc_priv *priv, int slot)
+{
+        spin_lock_bh(&priv->tx.tx_lock);
+        __clear_bit(slot, priv->tx.tx_slot);
+        spin_unlock_bh(&priv->tx.tx_lock);
+}
+
+static inline enum htc_endpoint_id get_htc_epid(struct ath9k_htc_priv *priv,
+                                                u16 qnum)
+{
+        enum htc_endpoint_id epid;
+
+        switch (qnum) {
+        case 0:
+                TX_QSTAT_INC(WME_AC_VO);
+                epid = priv->data_vo_ep;
+                break;
+        case 1:
+                TX_QSTAT_INC(WME_AC_VI);
+                epid = priv->data_vi_ep;
+                break;
+        case 2:
+                TX_QSTAT_INC(WME_AC_BE);
+                epid = priv->data_be_ep;
+                break;
+        case 3:
+        default:
+                TX_QSTAT_INC(WME_AC_BK);
+                epid = priv->data_bk_ep;
+                break;
+        }
+
+        return epid;
+}
+
+static inline struct sk_buff_head*
+get_htc_epid_queue(struct ath9k_htc_priv *priv, u8 epid)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct sk_buff_head *epid_queue = NULL;
+
+        if (epid == priv->mgmt_ep)
+                epid_queue = &priv->tx.mgmt_ep_queue;
+        else if (epid == priv->cab_ep)
+                epid_queue = &priv->tx.cab_ep_queue;
+        else if (epid == priv->data_be_ep)
+                epid_queue = &priv->tx.data_be_queue;
+        else if (epid == priv->data_bk_ep)
+                epid_queue = &priv->tx.data_bk_queue;
+        else if (epid == priv->data_vi_ep)
+                epid_queue = &priv->tx.data_vi_queue;
+        else if (epid == priv->data_vo_ep)
+                epid_queue = &priv->tx.data_vo_queue;
+        else
+                ath_err(common, "Invalid EPID: %d\n", epid);
+
+        return epid_queue;
+}
+
+/*
+ * Removes the driver header and returns the TX slot number
+ */
+static inline int strip_drv_header(struct ath9k_htc_priv *priv,
+                                   struct sk_buff *skb)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ath9k_htc_tx_ctl *tx_ctl;
+        int slot;
+
+        tx_ctl = HTC_SKB_CB(skb);
+
+        if (tx_ctl->epid == priv->mgmt_ep) {
+                struct tx_mgmt_hdr *tx_mhdr =
+                        (struct tx_mgmt_hdr *)skb->data;
+                slot = tx_mhdr->cookie;
+                skb_pull(skb, sizeof(struct tx_mgmt_hdr));
+        } else if ((tx_ctl->epid == priv->data_bk_ep) ||
+                   (tx_ctl->epid == priv->data_be_ep) ||
+                   (tx_ctl->epid == priv->data_vi_ep) ||
+                   (tx_ctl->epid == priv->data_vo_ep) ||
+                   (tx_ctl->epid == priv->cab_ep)) {
+                struct tx_frame_hdr *tx_fhdr =
+                        (struct tx_frame_hdr *)skb->data;
+                slot = tx_fhdr->cookie;
+                skb_pull(skb, sizeof(struct tx_frame_hdr));
+        } else {
+                ath_err(common, "Unsupported EPID: %d\n", tx_ctl->epid);
+                slot = -EINVAL;
+        }
+
+        return slot;
+}
+
 int ath_htc_txq_update(struct ath9k_htc_priv *priv, int qnum,
                        struct ath9k_tx_queue_info *qinfo)
 {
@@ -79,23 +211,140 @@ int ath_htc_txq_update(struct ath9k_htc_priv *priv, int qnum,
         return error;
 }
 
-int ath9k_htc_tx_start(struct ath9k_htc_priv *priv, struct sk_buff *skb)
+static void ath9k_htc_tx_mgmt(struct ath9k_htc_priv *priv,
+                              struct ath9k_htc_vif *avp,
+                              struct sk_buff *skb,
+                              u8 sta_idx, u8 vif_idx, u8 slot)
+{
+        struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_mgmt *mgmt;
+        struct ieee80211_hdr *hdr;
+        struct tx_mgmt_hdr mgmt_hdr;
+        struct ath9k_htc_tx_ctl *tx_ctl;
+        u8 *tx_fhdr;
+
+        tx_ctl = HTC_SKB_CB(skb);
+        hdr = (struct ieee80211_hdr *) skb->data;
+
+        memset(tx_ctl, 0, sizeof(*tx_ctl));
+        memset(&mgmt_hdr, 0, sizeof(struct tx_mgmt_hdr));
+
+        /*
+         * Set the TSF adjust value for probe response
+         * frame also.
+         */
+        if (avp && unlikely(ieee80211_is_probe_resp(hdr->frame_control))) {
+                mgmt = (struct ieee80211_mgmt *)skb->data;
+                mgmt->u.probe_resp.timestamp = avp->tsfadjust;
+        }
+
+        tx_ctl->type = ATH9K_HTC_MGMT;
+
+        mgmt_hdr.node_idx = sta_idx;
+        mgmt_hdr.vif_idx = vif_idx;
+        mgmt_hdr.tidno = 0;
+        mgmt_hdr.flags = 0;
+        mgmt_hdr.cookie = slot;
+
+        mgmt_hdr.key_type = ath9k_cmn_get_hw_crypto_keytype(skb);
+        if (mgmt_hdr.key_type == ATH9K_KEY_TYPE_CLEAR)
+                mgmt_hdr.keyix = (u8) ATH9K_TXKEYIX_INVALID;
+        else
+                mgmt_hdr.keyix = tx_info->control.hw_key->hw_key_idx;
+
+        tx_fhdr = skb_push(skb, sizeof(mgmt_hdr));
+        memcpy(tx_fhdr, (u8 *) &mgmt_hdr, sizeof(mgmt_hdr));
+        tx_ctl->epid = priv->mgmt_ep;
+}
+
+static void ath9k_htc_tx_data(struct ath9k_htc_priv *priv,
+                              struct ieee80211_vif *vif,
+                              struct sk_buff *skb,
+                              u8 sta_idx, u8 vif_idx, u8 slot,
+                              bool is_cab)
+{
+        struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_hdr *hdr;
+        struct ath9k_htc_tx_ctl *tx_ctl;
+        struct tx_frame_hdr tx_hdr;
+        u32 flags = 0;
+        u8 *qc, *tx_fhdr;
+        u16 qnum;
+
+        tx_ctl = HTC_SKB_CB(skb);
+        hdr = (struct ieee80211_hdr *) skb->data;
+
+        memset(tx_ctl, 0, sizeof(*tx_ctl));
+        memset(&tx_hdr, 0, sizeof(struct tx_frame_hdr));
+
+        tx_hdr.node_idx = sta_idx;
+        tx_hdr.vif_idx = vif_idx;
+        tx_hdr.cookie = slot;
+
+        /*
+         * This is a bit redundant but it helps to get
+         * the per-packet index quickly when draining the
+         * TX queue in the HIF layer. Otherwise we would
+         * have to parse the packet contents ...
+         */
+        tx_ctl->sta_idx = sta_idx;
+
+        if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
+                tx_ctl->type = ATH9K_HTC_AMPDU;
+                tx_hdr.data_type = ATH9K_HTC_AMPDU;
+        } else {
+                tx_ctl->type = ATH9K_HTC_NORMAL;
+                tx_hdr.data_type = ATH9K_HTC_NORMAL;
+        }
+
+        if (ieee80211_is_data_qos(hdr->frame_control)) {
+                qc = ieee80211_get_qos_ctl(hdr);
+                tx_hdr.tidno = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
+        }
+
+        /* Check for RTS protection */
+        if (priv->hw->wiphy->rts_threshold != (u32) -1)
+                if (skb->len > priv->hw->wiphy->rts_threshold)
+                        flags |= ATH9K_HTC_TX_RTSCTS;
+
+        /* CTS-to-self */
+        if (!(flags & ATH9K_HTC_TX_RTSCTS) &&
+            (vif && vif->bss_conf.use_cts_prot))
+                flags |= ATH9K_HTC_TX_CTSONLY;
+
+        tx_hdr.flags = cpu_to_be32(flags);
+        tx_hdr.key_type = ath9k_cmn_get_hw_crypto_keytype(skb);
+        if (tx_hdr.key_type == ATH9K_KEY_TYPE_CLEAR)
+                tx_hdr.keyix = (u8) ATH9K_TXKEYIX_INVALID;
+        else
+                tx_hdr.keyix = tx_info->control.hw_key->hw_key_idx;
+
+        tx_fhdr = skb_push(skb, sizeof(tx_hdr));
+        memcpy(tx_fhdr, (u8 *) &tx_hdr, sizeof(tx_hdr));
+
+        if (is_cab) {
+                CAB_STAT_INC;
+                tx_ctl->epid = priv->cab_ep;
+                return;
+        }
+
+        qnum = skb_get_queue_mapping(skb);
+        tx_ctl->epid = get_htc_epid(priv, qnum);
+}
+
+int ath9k_htc_tx_start(struct ath9k_htc_priv *priv,
+                       struct sk_buff *skb,
+                       u8 slot, bool is_cab)
 {
         struct ieee80211_hdr *hdr;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         struct ieee80211_sta *sta = tx_info->control.sta;
         struct ieee80211_vif *vif = tx_info->control.vif;
         struct ath9k_htc_sta *ista;
-        struct ath9k_htc_vif *avp;
-        struct ath9k_htc_tx_ctl tx_ctl;
-        enum htc_endpoint_id epid;
-        u16 qnum;
-        __le16 fc;
-        u8 *tx_fhdr;
+        struct ath9k_htc_vif *avp = NULL;
         u8 sta_idx, vif_idx;
 
         hdr = (struct ieee80211_hdr *) skb->data;
-        fc = hdr->frame_control;
 
         /*
          * Find out on which interface this packet has to be
@@ -124,218 +373,432 @@ int ath9k_htc_tx_start(struct ath9k_htc_priv *priv, struct sk_buff *skb)
                 sta_idx = priv->vif_sta_pos[vif_idx];
         }
 
-        memset(&tx_ctl, 0, sizeof(struct ath9k_htc_tx_ctl));
+        if (ieee80211_is_data(hdr->frame_control))
+                ath9k_htc_tx_data(priv, vif, skb,
+                                  sta_idx, vif_idx, slot, is_cab);
+        else
+                ath9k_htc_tx_mgmt(priv, avp, skb,
+                                  sta_idx, vif_idx, slot);
 
-        if (ieee80211_is_data(fc)) {
-                struct tx_frame_hdr tx_hdr;
-                u32 flags = 0;
-                u8 *qc;
 
-                memset(&tx_hdr, 0, sizeof(struct tx_frame_hdr));
+        return htc_send(priv->htc, skb);
+}
 
-                tx_hdr.node_idx = sta_idx;
-                tx_hdr.vif_idx = vif_idx;
+static inline bool __ath9k_htc_check_tx_aggr(struct ath9k_htc_priv *priv,
+                                             struct ath9k_htc_sta *ista, u8 tid)
+{
+        bool ret = false;
 
-                if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
-                        tx_ctl.type = ATH9K_HTC_AMPDU;
-                        tx_hdr.data_type = ATH9K_HTC_AMPDU;
-                } else {
-                        tx_ctl.type = ATH9K_HTC_NORMAL;
-                        tx_hdr.data_type = ATH9K_HTC_NORMAL;
-                }
+        spin_lock_bh(&priv->tx.tx_lock);
+        if ((tid < ATH9K_HTC_MAX_TID) && (ista->tid_state[tid] == AGGR_STOP))
+                ret = true;
+        spin_unlock_bh(&priv->tx.tx_lock);
+
+        return ret;
+}
+
+static void ath9k_htc_check_tx_aggr(struct ath9k_htc_priv *priv,
+                                    struct ieee80211_vif *vif,
+                                    struct sk_buff *skb)
+{
+        struct ieee80211_sta *sta;
+        struct ieee80211_hdr *hdr;
+        __le16 fc;
+
+        hdr = (struct ieee80211_hdr *) skb->data;
+        fc = hdr->frame_control;
+
+        rcu_read_lock();
+
+        sta = ieee80211_find_sta(vif, hdr->addr1);
+        if (!sta) {
+                rcu_read_unlock();
+                return;
+        }
 
+        if (sta && conf_is_ht(&priv->hw->conf) &&
+            !(skb->protocol == cpu_to_be16(ETH_P_PAE))) {
                 if (ieee80211_is_data_qos(fc)) {
+                        u8 *qc, tid;
+                        struct ath9k_htc_sta *ista;
+
                         qc = ieee80211_get_qos_ctl(hdr);
-                        tx_hdr.tidno = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
+                        tid = qc[0] & 0xf;
+                        ista = (struct ath9k_htc_sta *)sta->drv_priv;
+                        if (__ath9k_htc_check_tx_aggr(priv, ista, tid)) {
+                                ieee80211_start_tx_ba_session(sta, tid, 0);
+                                spin_lock_bh(&priv->tx.tx_lock);
+                                ista->tid_state[tid] = AGGR_PROGRESS;
+                                spin_unlock_bh(&priv->tx.tx_lock);
+                        }
                 }
+        }
 
-                /* Check for RTS protection */
-                if (priv->hw->wiphy->rts_threshold != (u32) -1)
-                        if (skb->len > priv->hw->wiphy->rts_threshold)
-                                flags |= ATH9K_HTC_TX_RTSCTS;
+        rcu_read_unlock();
+}
 
-                /* CTS-to-self */
-                if (!(flags & ATH9K_HTC_TX_RTSCTS) &&
-                    (vif && vif->bss_conf.use_cts_prot))
-                        flags |= ATH9K_HTC_TX_CTSONLY;
+static void ath9k_htc_tx_process(struct ath9k_htc_priv *priv,
+                                 struct sk_buff *skb,
+                                 struct __wmi_event_txstatus *txs)
+{
+        struct ieee80211_vif *vif;
+        struct ath9k_htc_tx_ctl *tx_ctl;
+        struct ieee80211_tx_info *tx_info;
+        struct ieee80211_tx_rate *rate;
+        struct ieee80211_conf *cur_conf = &priv->hw->conf;
+        struct ieee80211_supported_band *sband;
+        bool txok;
+        int slot;
 
-                tx_hdr.flags = cpu_to_be32(flags);
-                tx_hdr.key_type = ath9k_cmn_get_hw_crypto_keytype(skb);
-                if (tx_hdr.key_type == ATH9K_KEY_TYPE_CLEAR)
-                        tx_hdr.keyix = (u8) ATH9K_TXKEYIX_INVALID;
-                else
-                        tx_hdr.keyix = tx_info->control.hw_key->hw_key_idx;
+        slot = strip_drv_header(priv, skb);
+        if (slot < 0) {
+                dev_kfree_skb_any(skb);
+                return;
+        }
 
-                tx_fhdr = skb_push(skb, sizeof(tx_hdr));
-                memcpy(tx_fhdr, (u8 *) &tx_hdr, sizeof(tx_hdr));
+        tx_ctl = HTC_SKB_CB(skb);
+        txok = tx_ctl->txok;
+        tx_info = IEEE80211_SKB_CB(skb);
+        vif = tx_info->control.vif;
+        rate = &tx_info->status.rates[0];
+        sband = priv->hw->wiphy->bands[cur_conf->channel->band];
 
-                qnum = skb_get_queue_mapping(skb);
+        memset(&tx_info->status, 0, sizeof(tx_info->status));
 
-                switch (qnum) {
-                case 0:
-                        TX_QSTAT_INC(WME_AC_VO);
-                        epid = priv->data_vo_ep;
-                        break;
-                case 1:
-                        TX_QSTAT_INC(WME_AC_VI);
-                        epid = priv->data_vi_ep;
-                        break;
-                case 2:
-                        TX_QSTAT_INC(WME_AC_BE);
-                        epid = priv->data_be_ep;
-                        break;
-                case 3:
-                default:
-                        TX_QSTAT_INC(WME_AC_BK);
-                        epid = priv->data_bk_ep;
-                        break;
-                }
-        } else {
-                struct tx_mgmt_hdr mgmt_hdr;
+        /*
+         * URB submission failed for this frame, it never reached
+         * the target.
+         */
+        if (!txok || !vif || !txs)
+                goto send_mac80211;
 
-                memset(&mgmt_hdr, 0, sizeof(struct tx_mgmt_hdr));
+        if (txs->ts_flags & ATH9K_HTC_TXSTAT_ACK)
+                tx_info->flags |= IEEE80211_TX_STAT_ACK;
+
+        if (txs->ts_flags & ATH9K_HTC_TXSTAT_FILT)
+                tx_info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
 
-                tx_ctl.type = ATH9K_HTC_NORMAL;
+        if (txs->ts_flags & ATH9K_HTC_TXSTAT_RTC_CTS)
+                rate->flags |= IEEE80211_TX_RC_USE_RTS_CTS;
 
-                mgmt_hdr.node_idx = sta_idx;
-                mgmt_hdr.vif_idx = vif_idx;
-                mgmt_hdr.tidno = 0;
-                mgmt_hdr.flags = 0;
+        rate->count = 1;
+        rate->idx = MS(txs->ts_rate, ATH9K_HTC_TXSTAT_RATE);
 
-                mgmt_hdr.key_type = ath9k_cmn_get_hw_crypto_keytype(skb);
-                if (mgmt_hdr.key_type == ATH9K_KEY_TYPE_CLEAR)
-                        mgmt_hdr.keyix = (u8) ATH9K_TXKEYIX_INVALID;
-                else
-                        mgmt_hdr.keyix = tx_info->control.hw_key->hw_key_idx;
+        if (txs->ts_flags & ATH9K_HTC_TXSTAT_MCS) {
+                rate->flags |= IEEE80211_TX_RC_MCS;
 
-                tx_fhdr = skb_push(skb, sizeof(mgmt_hdr));
-                memcpy(tx_fhdr, (u8 *) &mgmt_hdr, sizeof(mgmt_hdr));
-                epid = priv->mgmt_ep;
+                if (txs->ts_flags & ATH9K_HTC_TXSTAT_CW40)
+                        rate->flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
+                if (txs->ts_flags & ATH9K_HTC_TXSTAT_SGI)
+                        rate->flags |= IEEE80211_TX_RC_SHORT_GI;
+        } else {
+                if (cur_conf->channel->band == IEEE80211_BAND_5GHZ)
+                        rate->idx += 4; /* No CCK rates */
         }
 
-        return htc_send(priv->htc, skb, epid, &tx_ctl);
+        ath9k_htc_check_tx_aggr(priv, vif, skb);
+
+send_mac80211:
+        spin_lock_bh(&priv->tx.tx_lock);
+        if (WARN_ON(--priv->tx.queued_cnt < 0))
+                priv->tx.queued_cnt = 0;
+        spin_unlock_bh(&priv->tx.tx_lock);
+
+        ath9k_htc_tx_clear_slot(priv, slot);
+
+        /* Send status to mac80211 */
+        ieee80211_tx_status(priv->hw, skb);
 }
 
-static bool ath9k_htc_check_tx_aggr(struct ath9k_htc_priv *priv,
-                                    struct ath9k_htc_sta *ista, u8 tid)
+static inline void ath9k_htc_tx_drainq(struct ath9k_htc_priv *priv,
+                                       struct sk_buff_head *queue)
 {
-        bool ret = false;
+        struct sk_buff *skb;
 
-        spin_lock_bh(&priv->tx_lock);
-        if ((tid < ATH9K_HTC_MAX_TID) && (ista->tid_state[tid] == AGGR_STOP))
-                ret = true;
-        spin_unlock_bh(&priv->tx_lock);
+        while ((skb = skb_dequeue(queue)) != NULL) {
+                ath9k_htc_tx_process(priv, skb, NULL);
+        }
+}
 
-        return ret;
+void ath9k_htc_tx_drain(struct ath9k_htc_priv *priv)
+{
+        struct ath9k_htc_tx_event *event, *tmp;
+
+        spin_lock_bh(&priv->tx.tx_lock);
+        priv->tx.flags |= ATH9K_HTC_OP_TX_DRAIN;
+        spin_unlock_bh(&priv->tx.tx_lock);
+
+        /*
+         * Ensure that all pending TX frames are flushed,
+         * and that the TX completion/failed tasklets is killed.
+         */
+        htc_stop(priv->htc);
+        tasklet_kill(&priv->wmi->wmi_event_tasklet);
+        tasklet_kill(&priv->tx_failed_tasklet);
+
+        ath9k_htc_tx_drainq(priv, &priv->tx.mgmt_ep_queue);
+        ath9k_htc_tx_drainq(priv, &priv->tx.cab_ep_queue);
+        ath9k_htc_tx_drainq(priv, &priv->tx.data_be_queue);
+        ath9k_htc_tx_drainq(priv, &priv->tx.data_bk_queue);
+        ath9k_htc_tx_drainq(priv, &priv->tx.data_vi_queue);
+        ath9k_htc_tx_drainq(priv, &priv->tx.data_vo_queue);
+        ath9k_htc_tx_drainq(priv, &priv->tx.tx_failed);
+
+        /*
+         * The TX cleanup timer has already been killed.
+         */
+        spin_lock_bh(&priv->wmi->event_lock);
+        list_for_each_entry_safe(event, tmp, &priv->wmi->pending_tx_events, list) {
+                list_del(&event->list);
+                kfree(event);
+        }
+        spin_unlock_bh(&priv->wmi->event_lock);
+
+        spin_lock_bh(&priv->tx.tx_lock);
+        priv->tx.flags &= ~ATH9K_HTC_OP_TX_DRAIN;
+        spin_unlock_bh(&priv->tx.tx_lock);
 }
 
-void ath9k_tx_tasklet(unsigned long data)
+void ath9k_tx_failed_tasklet(unsigned long data)
 {
         struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *)data;
-        struct ieee80211_vif *vif;
-        struct ieee80211_sta *sta;
-        struct ieee80211_hdr *hdr;
-        struct ieee80211_tx_info *tx_info;
-        struct sk_buff *skb = NULL;
-        __le16 fc;
 
-        while ((skb = skb_dequeue(&priv->tx_queue)) != NULL) {
+        spin_lock_bh(&priv->tx.tx_lock);
+        if (priv->tx.flags & ATH9K_HTC_OP_TX_DRAIN) {
+                spin_unlock_bh(&priv->tx.tx_lock);
+                return;
+        }
+        spin_unlock_bh(&priv->tx.tx_lock);
 
-                hdr = (struct ieee80211_hdr *) skb->data;
-                fc = hdr->frame_control;
-                tx_info = IEEE80211_SKB_CB(skb);
-                vif = tx_info->control.vif;
+        ath9k_htc_tx_drainq(priv, &priv->tx.tx_failed);
+}
 
-                memset(&tx_info->status, 0, sizeof(tx_info->status));
+static inline bool check_cookie(struct ath9k_htc_priv *priv,
+                                struct sk_buff *skb,
+                                u8 cookie, u8 epid)
+{
+        u8 fcookie = 0;
+
+        if (epid == priv->mgmt_ep) {
+                struct tx_mgmt_hdr *hdr;
+                hdr = (struct tx_mgmt_hdr *) skb->data;
+                fcookie = hdr->cookie;
+        } else if ((epid == priv->data_bk_ep) ||
+                   (epid == priv->data_be_ep) ||
+                   (epid == priv->data_vi_ep) ||
+                   (epid == priv->data_vo_ep) ||
+                   (epid == priv->cab_ep)) {
+                struct tx_frame_hdr *hdr;
+                hdr = (struct tx_frame_hdr *) skb->data;
+                fcookie = hdr->cookie;
+        }
 
-                if (!vif)
-                        goto send_mac80211;
+        if (fcookie == cookie)
+                return true;
 
-                rcu_read_lock();
+        return false;
+}
 
-                sta = ieee80211_find_sta(vif, hdr->addr1);
-                if (!sta) {
-                        rcu_read_unlock();
-                        ieee80211_tx_status(priv->hw, skb);
-                        continue;
+static struct sk_buff* ath9k_htc_tx_get_packet(struct ath9k_htc_priv *priv,
+                                               struct __wmi_event_txstatus *txs)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct sk_buff_head *epid_queue;
+        struct sk_buff *skb, *tmp;
+        unsigned long flags;
+        u8 epid = MS(txs->ts_rate, ATH9K_HTC_TXSTAT_EPID);
+
+        epid_queue = get_htc_epid_queue(priv, epid);
+        if (!epid_queue)
+                return NULL;
+
+        spin_lock_irqsave(&epid_queue->lock, flags);
+        skb_queue_walk_safe(epid_queue, skb, tmp) {
+                if (check_cookie(priv, skb, txs->cookie, epid)) {
+                        __skb_unlink(skb, epid_queue);
+                        spin_unlock_irqrestore(&epid_queue->lock, flags);
+                        return skb;
                 }
+        }
+        spin_unlock_irqrestore(&epid_queue->lock, flags);
 
-                /* Check if we need to start aggregation */
+        ath_dbg(common, ATH_DBG_XMIT,
+                "No matching packet for cookie: %d, epid: %d\n",
+                txs->cookie, epid);
 
-                if (sta && conf_is_ht(&priv->hw->conf) &&
-                    !(skb->protocol == cpu_to_be16(ETH_P_PAE))) {
-                        if (ieee80211_is_data_qos(fc)) {
-                                u8 *qc, tid;
-                                struct ath9k_htc_sta *ista;
+        return NULL;
+}
 
-                                qc = ieee80211_get_qos_ctl(hdr);
-                                tid = qc[0] & 0xf;
-                                ista = (struct ath9k_htc_sta *)sta->drv_priv;
+void ath9k_htc_txstatus(struct ath9k_htc_priv *priv, void *wmi_event)
+{
+        struct wmi_event_txstatus *txs = (struct wmi_event_txstatus *)wmi_event;
+        struct __wmi_event_txstatus *__txs;
+        struct sk_buff *skb;
+        struct ath9k_htc_tx_event *tx_pend;
+        int i;
 
-                                if (ath9k_htc_check_tx_aggr(priv, ista, tid)) {
-                                        ieee80211_start_tx_ba_session(sta, tid, 0);
-                                        spin_lock_bh(&priv->tx_lock);
-                                        ista->tid_state[tid] = AGGR_PROGRESS;
-                                        spin_unlock_bh(&priv->tx_lock);
-                                }
-                        }
-                }
+        for (i = 0; i < txs->cnt; i++) {
+                WARN_ON(txs->cnt > HTC_MAX_TX_STATUS);
 
-                rcu_read_unlock();
+                __txs = &txs->txstatus[i];
+
+                skb = ath9k_htc_tx_get_packet(priv, __txs);
+                if (!skb) {
+                        /*
+                         * Store this event, so that the TX cleanup
+                         * routine can check later for the needed packet.
+                         */
+                        tx_pend = kzalloc(sizeof(struct ath9k_htc_tx_event),
+                                          GFP_ATOMIC);
+                        if (!tx_pend)
+                                continue;
+
+                        memcpy(&tx_pend->txs, __txs,
+                               sizeof(struct __wmi_event_txstatus));
+
+                        spin_lock(&priv->wmi->event_lock);
+                        list_add_tail(&tx_pend->list,
+                                      &priv->wmi->pending_tx_events);
+                        spin_unlock(&priv->wmi->event_lock);
 
-        send_mac80211:
-                /* Send status to mac80211 */
-                ieee80211_tx_status(priv->hw, skb);
+                        continue;
+                }
+
+                ath9k_htc_tx_process(priv, skb, __txs);
         }
 
         /* Wake TX queues if needed */
-        spin_lock_bh(&priv->tx_lock);
-        if (priv->tx_queues_stop) {
-                priv->tx_queues_stop = false;
-                spin_unlock_bh(&priv->tx_lock);
-                ath_dbg(ath9k_hw_common(priv->ah), ATH_DBG_XMIT,
-                        "Waking up TX queues\n");
-                ieee80211_wake_queues(priv->hw);
-                return;
-        }
-        spin_unlock_bh(&priv->tx_lock);
+        ath9k_htc_check_wake_queues(priv);
 }
 
 void ath9k_htc_txep(void *drv_priv, struct sk_buff *skb,
                     enum htc_endpoint_id ep_id, bool txok)
 {
         struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) drv_priv;
-        struct ath_common *common = ath9k_hw_common(priv->ah);
-        struct ieee80211_tx_info *tx_info;
+        struct ath9k_htc_tx_ctl *tx_ctl;
+        struct sk_buff_head *epid_queue;
 
-        if (!skb)
+        tx_ctl = HTC_SKB_CB(skb);
+        tx_ctl->txok = txok;
+        tx_ctl->timestamp = jiffies;
+
+        if (!txok) {
+                skb_queue_tail(&priv->tx.tx_failed, skb);
+                tasklet_schedule(&priv->tx_failed_tasklet);
                 return;
+        }
 
-        if (ep_id == priv->mgmt_ep) {
-                skb_pull(skb, sizeof(struct tx_mgmt_hdr));
-        } else if ((ep_id == priv->data_bk_ep) ||
-                   (ep_id == priv->data_be_ep) ||
-                   (ep_id == priv->data_vi_ep) ||
-                   (ep_id == priv->data_vo_ep)) {
-                skb_pull(skb, sizeof(struct tx_frame_hdr));
-        } else {
-                ath_err(common, "Unsupported TX EPID: %d\n", ep_id);
+        epid_queue = get_htc_epid_queue(priv, ep_id);
+        if (!epid_queue) {
                 dev_kfree_skb_any(skb);
                 return;
         }
 
-        tx_info = IEEE80211_SKB_CB(skb);
+        skb_queue_tail(epid_queue, skb);
+}
 
-        if (txok)
-                tx_info->flags |= IEEE80211_TX_STAT_ACK;
+static inline bool check_packet(struct ath9k_htc_priv *priv, struct sk_buff *skb)
+{
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ath9k_htc_tx_ctl *tx_ctl;
 
-        skb_queue_tail(&priv->tx_queue, skb);
-        tasklet_schedule(&priv->tx_tasklet);
+        tx_ctl = HTC_SKB_CB(skb);
+
+        if (time_after(jiffies,
+                       tx_ctl->timestamp +
+                       msecs_to_jiffies(ATH9K_HTC_TX_TIMEOUT_INTERVAL))) {
+                ath_dbg(common, ATH_DBG_XMIT,
+                        "Dropping a packet due to TX timeout\n");
+                return true;
+        }
+
+        return false;
+}
+
+static void ath9k_htc_tx_cleanup_queue(struct ath9k_htc_priv *priv,
+                                       struct sk_buff_head *epid_queue)
+{
+        bool process = false;
+        unsigned long flags;
+        struct sk_buff *skb, *tmp;
+        struct sk_buff_head queue;
+
+        skb_queue_head_init(&queue);
+
+        spin_lock_irqsave(&epid_queue->lock, flags);
+        skb_queue_walk_safe(epid_queue, skb, tmp) {
+                if (check_packet(priv, skb)) {
+                        __skb_unlink(skb, epid_queue);
+                        __skb_queue_tail(&queue, skb);
+                        process = true;
+                }
+        }
+        spin_unlock_irqrestore(&epid_queue->lock, flags);
+
+        if (process) {
+                skb_queue_walk_safe(&queue, skb, tmp) {
+                        __skb_unlink(skb, &queue);
+                        ath9k_htc_tx_process(priv, skb, NULL);
+                }
+        }
+}
+
+void ath9k_htc_tx_cleanup_timer(unsigned long data)
+{
+        struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) data;
+        struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ath9k_htc_tx_event *event, *tmp;
+        struct sk_buff *skb;
+
+        spin_lock(&priv->wmi->event_lock);
+        list_for_each_entry_safe(event, tmp, &priv->wmi->pending_tx_events, list) {
+
+                skb = ath9k_htc_tx_get_packet(priv, &event->txs);
+                if (skb) {
+                        ath_dbg(common, ATH_DBG_XMIT,
+                                "Found packet for cookie: %d, epid: %d\n",
+                                event->txs.cookie,
+                                MS(event->txs.ts_rate, ATH9K_HTC_TXSTAT_EPID));
+
+                        ath9k_htc_tx_process(priv, skb, &event->txs);
+                        list_del(&event->list);
+                        kfree(event);
+                        continue;
+                }
+
+                if (++event->count >= ATH9K_HTC_TX_TIMEOUT_COUNT) {
+                        list_del(&event->list);
+                        kfree(event);
+                }
+        }
+        spin_unlock(&priv->wmi->event_lock);
+
+        /*
+         * Check if status-pending packets have to be cleaned up.
+         */
+        ath9k_htc_tx_cleanup_queue(priv, &priv->tx.mgmt_ep_queue);
+        ath9k_htc_tx_cleanup_queue(priv, &priv->tx.cab_ep_queue);
+        ath9k_htc_tx_cleanup_queue(priv, &priv->tx.data_be_queue);
+        ath9k_htc_tx_cleanup_queue(priv, &priv->tx.data_bk_queue);
+        ath9k_htc_tx_cleanup_queue(priv, &priv->tx.data_vi_queue);
+        ath9k_htc_tx_cleanup_queue(priv, &priv->tx.data_vo_queue);
+
+        /* Wake TX queues if needed */
+        ath9k_htc_check_wake_queues(priv);
+
+        mod_timer(&priv->tx.cleanup_timer,
+                  jiffies + msecs_to_jiffies(ATH9K_HTC_TX_CLEANUP_INTERVAL));
 }
 
 int ath9k_tx_init(struct ath9k_htc_priv *priv)
 {
-        skb_queue_head_init(&priv->tx_queue);
+        skb_queue_head_init(&priv->tx.mgmt_ep_queue);
+        skb_queue_head_init(&priv->tx.cab_ep_queue);
+        skb_queue_head_init(&priv->tx.data_be_queue);
+        skb_queue_head_init(&priv->tx.data_bk_queue);
+        skb_queue_head_init(&priv->tx.data_vi_queue);
+        skb_queue_head_init(&priv->tx.data_vo_queue);
+        skb_queue_head_init(&priv->tx.tx_failed);
         return 0;
 }
 
@@ -507,8 +970,9 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
         int last_rssi = ATH_RSSI_DUMMY_MARKER;
         __le16 fc;
 
-        if (skb->len <= HTC_RX_FRAME_HEADER_SIZE) {
-                ath_err(common, "Corrupted RX frame, dropping\n");
+        if (skb->len < HTC_RX_FRAME_HEADER_SIZE) {
+                ath_err(common, "Corrupted RX frame, dropping (len: %d)\n",
+                        skb->len);
                 goto rx_next;
         }
 
@@ -522,6 +986,8 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
                 goto rx_next;
         }
 
+        ath9k_htc_err_stat_rx(priv, rxstatus);
+
         /* Get the RX status information */
         memcpy(&rxbuf->rxstatus, rxstatus, HTC_RX_FRAME_HEADER_SIZE);
         skb_pull(skb, HTC_RX_FRAME_HEADER_SIZE);
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index c41ab8c30161..5c76352b1319 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -17,8 +17,8 @@
 #include "htc.h"
 
 static int htc_issue_send(struct htc_target *target, struct sk_buff* skb,
-                          u16 len, u8 flags, u8 epid,
-                          struct ath9k_htc_tx_ctl *tx_ctl)
+                          u16 len, u8 flags, u8 epid)
+
 {
         struct htc_frame_hdr *hdr;
         struct htc_endpoint *endpoint = &target->endpoint[epid];
@@ -30,8 +30,8 @@ static int htc_issue_send(struct htc_target *target, struct sk_buff* skb,
         hdr->flags = flags;
         hdr->payload_len = cpu_to_be16(len);
 
-        status = target->hif->send(target->hif_dev, endpoint->ul_pipeid, skb,
-                                   tx_ctl);
+        status = target->hif->send(target->hif_dev, endpoint->ul_pipeid, skb);
+
         return status;
 }
 
@@ -162,7 +162,7 @@ static int htc_config_pipe_credits(struct htc_target *target)
 
         target->htc_flags |= HTC_OP_CONFIG_PIPE_CREDITS;
 
-        ret = htc_issue_send(target, skb, skb->len, 0, ENDPOINT0, NULL);
+        ret = htc_issue_send(target, skb, skb->len, 0, ENDPOINT0);
         if (ret)
                 goto err;
 
@@ -197,7 +197,7 @@ static int htc_setup_complete(struct htc_target *target)
 
         target->htc_flags |= HTC_OP_START_WAIT;
 
-        ret = htc_issue_send(target, skb, skb->len, 0, ENDPOINT0, NULL);
+        ret = htc_issue_send(target, skb, skb->len, 0, ENDPOINT0);
         if (ret)
                 goto err;
 
@@ -268,7 +268,7 @@ int htc_connect_service(struct htc_target *target,
         conn_msg->dl_pipeid = endpoint->dl_pipeid;
         conn_msg->ul_pipeid = endpoint->ul_pipeid;
 
-        ret = htc_issue_send(target, skb, skb->len, 0, ENDPOINT0, NULL);
+        ret = htc_issue_send(target, skb, skb->len, 0, ENDPOINT0);
         if (ret)
                 goto err;
 
@@ -286,35 +286,33 @@ err:
         return ret;
 }
 
-int htc_send(struct htc_target *target, struct sk_buff *skb,
-             enum htc_endpoint_id epid, struct ath9k_htc_tx_ctl *tx_ctl)
+int htc_send(struct htc_target *target, struct sk_buff *skb)
 {
-        return htc_issue_send(target, skb, skb->len, 0, epid, tx_ctl);
+        struct ath9k_htc_tx_ctl *tx_ctl;
+
+        tx_ctl = HTC_SKB_CB(skb);
+        return htc_issue_send(target, skb, skb->len, 0, tx_ctl->epid);
 }
 
-void htc_stop(struct htc_target *target)
+int htc_send_epid(struct htc_target *target, struct sk_buff *skb,
+                  enum htc_endpoint_id epid)
 {
-        enum htc_endpoint_id epid;
-        struct htc_endpoint *endpoint;
+        return htc_issue_send(target, skb, skb->len, 0, epid);
+}
 
-        for (epid = ENDPOINT0; epid < ENDPOINT_MAX; epid++) {
-                endpoint = &target->endpoint[epid];
-                if (endpoint->service_id != 0)
-                        target->hif->stop(target->hif_dev, endpoint->ul_pipeid);
-        }
+void htc_stop(struct htc_target *target)
+{
+        target->hif->stop(target->hif_dev);
 }
 
 void htc_start(struct htc_target *target)
 {
-        enum htc_endpoint_id epid;
-        struct htc_endpoint *endpoint;
+        target->hif->start(target->hif_dev);
+}
 
-        for (epid = ENDPOINT0; epid < ENDPOINT_MAX; epid++) {
-                endpoint = &target->endpoint[epid];
-                if (endpoint->service_id != 0)
-                        target->hif->start(target->hif_dev,
-                                           endpoint->ul_pipeid);
-        }
+void htc_sta_drain(struct htc_target *target, u8 idx)
+{
+        target->hif->sta_drain(target->hif_dev, idx);
 }
 
 void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle,
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.h b/drivers/net/wireless/ath/ath9k/htc_hst.h
index ecd018798c47..cb9174ade53e 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.h
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.h
@@ -33,10 +33,10 @@ struct ath9k_htc_hif {
         u8 control_dl_pipe;
         u8 control_ul_pipe;
 
-        void (*start) (void *hif_handle, u8 pipe);
-        void (*stop) (void *hif_handle, u8 pipe);
-        int (*send) (void *hif_handle, u8 pipe, struct sk_buff *buf,
-                     struct ath9k_htc_tx_ctl *tx_ctl);
+        void (*start) (void *hif_handle);
+        void (*stop) (void *hif_handle);
+        void (*sta_drain) (void *hif_handle, u8 idx);
+        int (*send) (void *hif_handle, u8 pipe, struct sk_buff *buf);
 };
 
 enum htc_endpoint_id {
@@ -205,10 +205,12 @@ int htc_init(struct htc_target *target);
 int htc_connect_service(struct htc_target *target,
                           struct htc_service_connreq *service_connreq,
                           enum htc_endpoint_id *conn_rsp_eid);
-int htc_send(struct htc_target *target, struct sk_buff *skb,
-             enum htc_endpoint_id eid, struct ath9k_htc_tx_ctl *tx_ctl);
+int htc_send(struct htc_target *target, struct sk_buff *skb);
+int htc_send_epid(struct htc_target *target, struct sk_buff *skb,
+                  enum htc_endpoint_id epid);
 void htc_stop(struct htc_target *target);
 void htc_start(struct htc_target *target);
+void htc_sta_drain(struct htc_target *target, u8 idx);
 
 void ath9k_htc_rx_msg(struct htc_target *htc_handle,
                       struct sk_buff *skb, u32 len, u8 pipe_id);
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 1b5bd13b0a6c..3a8c41c782e9 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -676,42 +676,55 @@ unsigned long ar9003_get_pll_sqsum_dvc(struct ath_hw *ah)
 }
 EXPORT_SYMBOL(ar9003_get_pll_sqsum_dvc);
 
-#define DPLL2_KD_VAL            0x3D
-#define DPLL2_KI_VAL            0x06
-#define DPLL3_PHASE_SHIFT_VAL   0x1
-
+#define DPLL3_PHASE_SHIFT_VAL 0x1
 static void ath9k_hw_init_pll(struct ath_hw *ah,
                               struct ath9k_channel *chan)
 {
         u32 pll;
 
         if (AR_SREV_9485(ah)) {
-                REG_WRITE(ah, AR_RTC_PLL_CONTROL2, 0x886666);
-                REG_WRITE(ah, AR_CH0_DDR_DPLL2, 0x19e82f01);
-
-                REG_RMW_FIELD(ah, AR_CH0_DDR_DPLL3,
-                              AR_CH0_DPLL3_PHASE_SHIFT, DPLL3_PHASE_SHIFT_VAL);
 
-                REG_WRITE(ah, AR_RTC_PLL_CONTROL, 0x1142c);
-                udelay(1000);
+                /* program BB PLL ki and kd value, ki=0x4, kd=0x40 */
+                REG_RMW_FIELD(ah, AR_CH0_BB_DPLL2,
+                              AR_CH0_BB_DPLL2_PLL_PWD, 0x1);
+                REG_RMW_FIELD(ah, AR_CH0_BB_DPLL2,
+                              AR_CH0_DPLL2_KD, 0x40);
+                REG_RMW_FIELD(ah, AR_CH0_BB_DPLL2,
+                              AR_CH0_DPLL2_KI, 0x4);
 
-                REG_WRITE(ah, AR_RTC_PLL_CONTROL2, 0x886666);
+                REG_RMW_FIELD(ah, AR_CH0_BB_DPLL1,
+                              AR_CH0_BB_DPLL1_REFDIV, 0x5);
+                REG_RMW_FIELD(ah, AR_CH0_BB_DPLL1,
+                              AR_CH0_BB_DPLL1_NINI, 0x58);
+                REG_RMW_FIELD(ah, AR_CH0_BB_DPLL1,
+                              AR_CH0_BB_DPLL1_NFRAC, 0x0);
 
                 REG_RMW_FIELD(ah, AR_CH0_BB_DPLL2,
-                              AR_CH0_DPLL2_KD, DPLL2_KD_VAL);
+                              AR_CH0_BB_DPLL2_OUTDIV, 0x1);
+                REG_RMW_FIELD(ah, AR_CH0_BB_DPLL2,
+                              AR_CH0_BB_DPLL2_LOCAL_PLL, 0x1);
                 REG_RMW_FIELD(ah, AR_CH0_BB_DPLL2,
-                              AR_CH0_DPLL2_KI, DPLL2_KI_VAL);
+                              AR_CH0_BB_DPLL2_EN_NEGTRIG, 0x1);
 
+                /* program BB PLL phase_shift to 0x6 */
                 REG_RMW_FIELD(ah, AR_CH0_BB_DPLL3,
-                              AR_CH0_DPLL3_PHASE_SHIFT, DPLL3_PHASE_SHIFT_VAL);
-                REG_WRITE(ah, AR_RTC_PLL_CONTROL, 0x142c);
+                              AR_CH0_BB_DPLL3_PHASE_SHIFT, 0x6);
+
+                REG_RMW_FIELD(ah, AR_CH0_BB_DPLL2,
+                              AR_CH0_BB_DPLL2_PLL_PWD, 0x0);
                 udelay(1000);
+
+                REG_RMW_FIELD(ah, AR_CH0_BB_DPLL3,
+                              AR_CH0_DPLL3_PHASE_SHIFT, DPLL3_PHASE_SHIFT_VAL);
         }
 
         pll = ath9k_hw_compute_pll_control(ah, chan);
 
         REG_WRITE(ah, AR_RTC_PLL_CONTROL, pll);
 
+        if (AR_SREV_9485(ah))
+                udelay(1000);
+
         /* Switch the core clock for ar9271 to 117Mhz */
         if (AR_SREV_9271(ah)) {
                 udelay(500);
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index a778b66f4438..073bc9e1c792 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -846,6 +846,14 @@ struct ath_hw {
         u32 ent_mode;
 };
 
+struct ath_bus_ops {
+        enum ath_bus_type ath_bus_type;
+        void (*read_cachesize)(struct ath_common *common, int *csz);
+        bool (*eeprom_read)(struct ath_common *common, u32 off, u16 *data);
+        void (*bt_coex_prep)(struct ath_common *common);
+        void (*extn_synch_en)(struct ath_common *common);
+};
+
 static inline struct ath_common *ath9k_hw_common(struct ath_hw *ah)
 {
         return &ah->common;
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index ba1c9a684eff..a55a8929810b 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1375,6 +1375,9 @@ static void ath9k_calculate_summary_state(struct ieee80211_hw *hw,
         if ((iter_data.naps + iter_data.nadhocs) > 0) {
                 sc->sc_flags |= SC_OP_ANI_RUN;
                 ath_start_ani(common);
+        } else {
+                sc->sc_flags &= ~SC_OP_ANI_RUN;
+                del_timer_sync(&common->ani.timer);
         }
 }
 
@@ -2201,6 +2204,21 @@ out:
         ath9k_ps_restore(sc);
 }
 
+static bool ath9k_tx_frames_pending(struct ieee80211_hw *hw)
+{
+        struct ath_softc *sc = hw->priv;
+        int i;
+
+        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
+                if (!ATH_TXQ_SETUP(sc, i))
+                        continue;
+
+                if (ath9k_has_pending_frames(sc, &sc->tx.txq[i]))
+                        return true;
+        }
+        return false;
+}
+
 struct ieee80211_ops ath9k_ops = {
         .tx                 = ath9k_tx,
         .start              = ath9k_start,
@@ -2223,4 +2241,5 @@ struct ieee80211_ops ath9k_ops = {
         .rfkill_poll        = ath9k_rfkill_poll_state,
         .set_coverage_class = ath9k_set_coverage_class,
         .flush              = ath9k_flush,
+        .tx_frames_pending  = ath9k_tx_frames_pending,
 };
diff --git a/drivers/net/wireless/ath/ath9k/phy.h b/drivers/net/wireless/ath/ath9k/phy.h
index f50e2c29f71e..8e5fe9d7f174 100644
--- a/drivers/net/wireless/ath/ath9k/phy.h
+++ b/drivers/net/wireless/ath/ath9k/phy.h
@@ -19,7 +19,6 @@
 
 #define CHANSEL_DIV             15
 #define CHANSEL_2G(_freq)       (((_freq) * 0x10000) / CHANSEL_DIV)
-#define CHANSEL_2G_9485(_freq)  ((((_freq) * 0x10000) - 215) / CHANSEL_DIV)
 #define CHANSEL_5G(_freq)       (((_freq) * 0x8000) / CHANSEL_DIV)
 
 #define AR_PHY_BASE     0x9800
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index a3241cd089b1..2a40532126f3 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -1092,8 +1092,7 @@ static int ath_rc_get_rateindex(const struct ath_rate_table *rate_table,
         if (!(rate->flags & IEEE80211_TX_RC_MCS))
                 return rate->idx;
 
-        while (rate->idx > mcs_rix_off[i] &&
-               i < ARRAY_SIZE(mcs_rix_off)) {
+        while (i < ARRAY_SIZE(mcs_rix_off) && rate->idx > mcs_rix_off[i]) {
                 rix++; i++;
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 3842b7518661..b81bfc4d66ef 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -75,7 +75,6 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
                 *sc->rx.rxlink = bf->bf_daddr;
 
         sc->rx.rxlink = &ds->ds_link;
-        ath9k_hw_rxena(ah);
 }
 
 static void ath_setdefantenna(struct ath_softc *sc, u32 antenna)
@@ -426,9 +425,7 @@ u32 ath_calcrxfilter(struct ath_softc *sc)
         else
                 rfilt |= ATH9K_RX_FILTER_BEACON;
 
-        if ((AR_SREV_9280_20_OR_LATER(sc->sc_ah) ||
-            AR_SREV_9285_12_OR_LATER(sc->sc_ah)) &&
-            (sc->sc_ah->opmode == NL80211_IFTYPE_AP) &&
+        if ((sc->sc_ah->opmode == NL80211_IFTYPE_AP) ||
             (sc->rx.rxfilter & FIF_PSPOLL))
                 rfilt |= ATH9K_RX_FILTER_PSPOLL;
 
@@ -1767,6 +1764,7 @@ requeue:
                 } else {
                         list_move_tail(&bf->list, &sc->rx.rxbuf);
                         ath_rx_buf_link(sc, bf);
+                        ath9k_hw_rxena(ah);
                 }
         } while (1);
 
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index 693d543937b5..6acbf0e2240b 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -858,9 +858,7 @@
 #define AR_SREV_9300(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9300))
 #define AR_SREV_9300_20_OR_LATER(_ah) \
-        (((_ah)->hw_version.macVersion > AR_SREV_VERSION_9300) || \
-         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9300) && \
-          ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9300_20)))
+        ((_ah)->hw_version.macVersion >= AR_SREV_VERSION_9300)
 
 #define AR_SREV_9485(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9485))
@@ -1088,14 +1086,35 @@ enum {
 #define AR_ENT_OTP                0x40d8
 #define AR_ENT_OTP_CHAIN2_DISABLE               0x00020000
 #define AR_ENT_OTP_MPSD         0x00800000
-#define AR_CH0_BB_DPLL2          0x16184
+
+#define AR_CH0_BB_DPLL1          0x16180
+#define AR_CH0_BB_DPLL1_REFDIV   0xF8000000
+#define AR_CH0_BB_DPLL1_REFDIV_S 27
+#define AR_CH0_BB_DPLL1_NINI     0x07FC0000
+#define AR_CH0_BB_DPLL1_NINI_S   18
+#define AR_CH0_BB_DPLL1_NFRAC    0x0003FFFF
+#define AR_CH0_BB_DPLL1_NFRAC_S  0
+
+#define AR_CH0_BB_DPLL2              0x16184
+#define AR_CH0_BB_DPLL2_LOCAL_PLL       0x40000000
+#define AR_CH0_BB_DPLL2_LOCAL_PLL_S     30
+#define AR_CH0_DPLL2_KI              0x3C000000
+#define AR_CH0_DPLL2_KI_S            26
+#define AR_CH0_DPLL2_KD              0x03F80000
+#define AR_CH0_DPLL2_KD_S            19
+#define AR_CH0_BB_DPLL2_EN_NEGTRIG   0x00040000
+#define AR_CH0_BB_DPLL2_EN_NEGTRIG_S 18
+#define AR_CH0_BB_DPLL2_PLL_PWD      0x00010000
+#define AR_CH0_BB_DPLL2_PLL_PWD_S    16
+#define AR_CH0_BB_DPLL2_OUTDIV       0x0000E000
+#define AR_CH0_BB_DPLL2_OUTDIV_S     13
+
 #define AR_CH0_BB_DPLL3          0x16188
+#define AR_CH0_BB_DPLL3_PHASE_SHIFT     0x3F800000
+#define AR_CH0_BB_DPLL3_PHASE_SHIFT_S   23
+
 #define AR_CH0_DDR_DPLL2         0x16244
 #define AR_CH0_DDR_DPLL3         0x16248
-#define AR_CH0_DPLL2_KD              0x03F80000
-#define AR_CH0_DPLL2_KD_S            19
-#define AR_CH0_DPLL2_KI              0x3C000000
-#define AR_CH0_DPLL2_KI_S            26
 #define AR_CH0_DPLL3_PHASE_SHIFT     0x3F800000
 #define AR_CH0_DPLL3_PHASE_SHIFT_S   23
 #define AR_PHY_CCA_NOM_VAL_2GHZ      -118
diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
index d3d24904f62f..8f095ad0a3db 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.c
+++ b/drivers/net/wireless/ath/ath9k/wmi.c
@@ -23,20 +23,18 @@ static const char *wmi_cmd_to_name(enum wmi_cmd_id wmi_cmd)
                 return "WMI_ECHO_CMDID";
         case WMI_ACCESS_MEMORY_CMDID:
                 return "WMI_ACCESS_MEMORY_CMDID";
+        case WMI_GET_FW_VERSION:
+                return "WMI_GET_FW_VERSION";
         case WMI_DISABLE_INTR_CMDID:
                 return "WMI_DISABLE_INTR_CMDID";
         case WMI_ENABLE_INTR_CMDID:
                 return "WMI_ENABLE_INTR_CMDID";
-        case WMI_RX_LINK_CMDID:
-                return "WMI_RX_LINK_CMDID";
         case WMI_ATH_INIT_CMDID:
                 return "WMI_ATH_INIT_CMDID";
         case WMI_ABORT_TXQ_CMDID:
                 return "WMI_ABORT_TXQ_CMDID";
         case WMI_STOP_TX_DMA_CMDID:
                 return "WMI_STOP_TX_DMA_CMDID";
-        case WMI_STOP_DMA_RECV_CMDID:
-                return "WMI_STOP_DMA_RECV_CMDID";
         case WMI_ABORT_TX_DMA_CMDID:
                 return "WMI_ABORT_TX_DMA_CMDID";
         case WMI_DRAIN_TXQ_CMDID:
@@ -51,8 +49,6 @@ static const char *wmi_cmd_to_name(enum wmi_cmd_id wmi_cmd)
                 return "WMI_FLUSH_RECV_CMDID";
         case WMI_SET_MODE_CMDID:
                 return "WMI_SET_MODE_CMDID";
-        case WMI_RESET_CMDID:
-                return "WMI_RESET_CMDID";
         case WMI_NODE_CREATE_CMDID:
                 return "WMI_NODE_CREATE_CMDID";
         case WMI_NODE_REMOVE_CMDID:
@@ -61,8 +57,6 @@ static const char *wmi_cmd_to_name(enum wmi_cmd_id wmi_cmd)
                 return "WMI_VAP_REMOVE_CMDID";
         case WMI_VAP_CREATE_CMDID:
                 return "WMI_VAP_CREATE_CMDID";
-        case WMI_BEACON_UPDATE_CMDID:
-                return "WMI_BEACON_UPDATE_CMDID";
         case WMI_REG_READ_CMDID:
                 return "WMI_REG_READ_CMDID";
         case WMI_REG_WRITE_CMDID:
@@ -71,20 +65,20 @@ static const char *wmi_cmd_to_name(enum wmi_cmd_id wmi_cmd)
                 return "WMI_RC_STATE_CHANGE_CMDID";
         case WMI_RC_RATE_UPDATE_CMDID:
                 return "WMI_RC_RATE_UPDATE_CMDID";
-        case WMI_DEBUG_INFO_CMDID:
-                return "WMI_DEBUG_INFO_CMDID";
-        case WMI_HOST_ATTACH:
-                return "WMI_HOST_ATTACH";
         case WMI_TARGET_IC_UPDATE_CMDID:
                 return "WMI_TARGET_IC_UPDATE_CMDID";
-        case WMI_TGT_STATS_CMDID:
-                return "WMI_TGT_STATS_CMDID";
         case WMI_TX_AGGR_ENABLE_CMDID:
                 return "WMI_TX_AGGR_ENABLE_CMDID";
         case WMI_TGT_DETACH_CMDID:
                 return "WMI_TGT_DETACH_CMDID";
-        case WMI_TGT_TXQ_ENABLE_CMDID:
-                return "WMI_TGT_TXQ_ENABLE_CMDID";
+        case WMI_NODE_UPDATE_CMDID:
+                return "WMI_NODE_UPDATE_CMDID";
+        case WMI_INT_STATS_CMDID:
+                return "WMI_INT_STATS_CMDID";
+        case WMI_TX_STATS_CMDID:
+                return "WMI_TX_STATS_CMDID";
+        case WMI_RX_STATS_CMDID:
+                return "WMI_RX_STATS_CMDID";
         case WMI_AGGR_LIMIT_CMD:
                 return "WMI_AGGR_LIMIT_CMD";
         }
@@ -102,9 +96,15 @@ struct wmi *ath9k_init_wmi(struct ath9k_htc_priv *priv)
 
         wmi->drv_priv = priv;
         wmi->stopped = false;
+        skb_queue_head_init(&wmi->wmi_event_queue);
+        spin_lock_init(&wmi->wmi_lock);
+        spin_lock_init(&wmi->event_lock);
         mutex_init(&wmi->op_mutex);
         mutex_init(&wmi->multi_write_mutex);
         init_completion(&wmi->cmd_wait);
+        INIT_LIST_HEAD(&wmi->pending_tx_events);
+        tasklet_init(&wmi->wmi_event_tasklet, ath9k_wmi_event_tasklet,
+                     (unsigned long)wmi);
 
         return wmi;
 }
@@ -120,11 +120,65 @@ void ath9k_deinit_wmi(struct ath9k_htc_priv *priv)
         kfree(priv->wmi);
 }
 
-void ath9k_swba_tasklet(unsigned long data)
+void ath9k_wmi_event_drain(struct ath9k_htc_priv *priv)
 {
-        struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *)data;
+        unsigned long flags;
 
-        ath9k_htc_swba(priv, priv->wmi->beacon_pending);
+        tasklet_kill(&priv->wmi->wmi_event_tasklet);
+        spin_lock_irqsave(&priv->wmi->wmi_lock, flags);
+        __skb_queue_purge(&priv->wmi->wmi_event_queue);
+        spin_unlock_irqrestore(&priv->wmi->wmi_lock, flags);
+}
+
+void ath9k_wmi_event_tasklet(unsigned long data)
+{
+        struct wmi *wmi = (struct wmi *)data;
+        struct ath9k_htc_priv *priv = wmi->drv_priv;
+        struct wmi_cmd_hdr *hdr;
+        void *wmi_event;
+        struct wmi_event_swba *swba;
+        struct sk_buff *skb = NULL;
+        unsigned long flags;
+        u16 cmd_id;
+
+        do {
+                spin_lock_irqsave(&wmi->wmi_lock, flags);
+                skb = __skb_dequeue(&wmi->wmi_event_queue);
+                if (!skb) {
+                        spin_unlock_irqrestore(&wmi->wmi_lock, flags);
+                        return;
+                }
+                spin_unlock_irqrestore(&wmi->wmi_lock, flags);
+
+                hdr = (struct wmi_cmd_hdr *) skb->data;
+                cmd_id = be16_to_cpu(hdr->command_id);
+                wmi_event = skb_pull(skb, sizeof(struct wmi_cmd_hdr));
+
+                switch (cmd_id) {
+                case WMI_SWBA_EVENTID:
+                        swba = (struct wmi_event_swba *) wmi_event;
+                        ath9k_htc_swba(priv, swba);
+                        break;
+                case WMI_FATAL_EVENTID:
+                        ieee80211_queue_work(wmi->drv_priv->hw,
+                                             &wmi->drv_priv->fatal_work);
+                        break;
+                case WMI_TXSTATUS_EVENTID:
+                        spin_lock_bh(&priv->tx.tx_lock);
+                        if (priv->tx.flags & ATH9K_HTC_OP_TX_DRAIN) {
+                                spin_unlock_bh(&priv->tx.tx_lock);
+                                break;
+                        }
+                        spin_unlock_bh(&priv->tx.tx_lock);
+
+                        ath9k_htc_txstatus(priv, wmi_event);
+                        break;
+                default:
+                        break;
+                }
+
+                kfree_skb(skb);
+        } while (1);
 }
 
 void ath9k_fatal_work(struct work_struct *work)
@@ -153,10 +207,6 @@ static void ath9k_wmi_ctrl_rx(void *priv, struct sk_buff *skb,
         struct wmi *wmi = (struct wmi *) priv;
         struct wmi_cmd_hdr *hdr;
         u16 cmd_id;
-        void *wmi_event;
-#ifdef CONFIG_ATH9K_HTC_DEBUGFS
-        __be32 txrate;
-#endif
 
         if (unlikely(wmi->stopped))
                 goto free_skb;
@@ -165,26 +215,10 @@ static void ath9k_wmi_ctrl_rx(void *priv, struct sk_buff *skb,
         cmd_id = be16_to_cpu(hdr->command_id);
 
         if (cmd_id & 0x1000) {
-                wmi_event = skb_pull(skb, sizeof(struct wmi_cmd_hdr));
-                switch (cmd_id) {
-                case WMI_SWBA_EVENTID:
-                        wmi->beacon_pending = *(u8 *)wmi_event;
-                        tasklet_schedule(&wmi->drv_priv->swba_tasklet);
-                        break;
-                case WMI_FATAL_EVENTID:
-                        ieee80211_queue_work(wmi->drv_priv->hw,
-                                             &wmi->drv_priv->fatal_work);
-                        break;
-                case WMI_TXRATE_EVENTID:
-#ifdef CONFIG_ATH9K_HTC_DEBUGFS
-                        txrate = ((struct wmi_event_txrate *)wmi_event)->txrate;
-                        wmi->drv_priv->debug.txrate = be32_to_cpu(txrate);
-#endif
-                        break;
-                default:
-                        break;
-                }
-                kfree_skb(skb);
+                spin_lock(&wmi->wmi_lock);
+                __skb_queue_tail(&wmi->wmi_event_queue, skb);
+                spin_unlock(&wmi->wmi_lock);
+                tasklet_schedule(&wmi->wmi_event_tasklet);
                 return;
         }
 
@@ -243,7 +277,7 @@ static int ath9k_wmi_cmd_issue(struct wmi *wmi,
         hdr->command_id = cpu_to_be16(cmd);
         hdr->seq_no = cpu_to_be16(++wmi->tx_seq_id);
 
-        return htc_send(wmi->htc, skb, wmi->ctrl_epid, NULL);
+        return htc_send_epid(wmi->htc, skb, wmi->ctrl_epid);
 }
 
 int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
diff --git a/drivers/net/wireless/ath/ath9k/wmi.h b/drivers/net/wireless/ath/ath9k/wmi.h
index 42084277522d..02ecb9f06db0 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.h
+++ b/drivers/net/wireless/ath/ath9k/wmi.h
@@ -17,7 +17,6 @@
 #ifndef WMI_H
 #define WMI_H
 
-
 struct wmi_event_txrate {
         __be32 txrate;
         struct {
@@ -31,18 +30,65 @@ struct wmi_cmd_hdr {
         __be16 seq_no;
 } __packed;
 
+struct wmi_fw_version {
+        __be16 major;
+        __be16 minor;
+
+} __packed;
+
+struct wmi_event_swba {
+        __be64 tsf;
+        u8 beacon_pending;
+};
+
+/*
+ * 64 - HTC header - WMI header - 1 / txstatus
+ * And some other hdr. space is also accounted for.
+ * 12 seems to be the magic number.
+ */
+#define HTC_MAX_TX_STATUS 12
+
+#define ATH9K_HTC_TXSTAT_ACK        BIT(0)
+#define ATH9K_HTC_TXSTAT_FILT       BIT(1)
+#define ATH9K_HTC_TXSTAT_RTC_CTS    BIT(2)
+#define ATH9K_HTC_TXSTAT_MCS        BIT(3)
+#define ATH9K_HTC_TXSTAT_CW40       BIT(4)
+#define ATH9K_HTC_TXSTAT_SGI        BIT(5)
+
+/*
+ * Legacy rates are indicated as indices.
+ * HT rates are indicated as dot11 numbers.
+ * This allows us to resrict the rate field
+ * to 4 bits.
+ */
+#define ATH9K_HTC_TXSTAT_RATE       0x0f
+#define ATH9K_HTC_TXSTAT_RATE_S     0
+
+#define ATH9K_HTC_TXSTAT_EPID       0xf0
+#define ATH9K_HTC_TXSTAT_EPID_S     4
+
+struct __wmi_event_txstatus {
+        u8 cookie;
+        u8 ts_rate; /* Also holds EP ID */
+        u8 ts_flags;
+};
+
+struct wmi_event_txstatus {
+        u8 cnt;
+        struct __wmi_event_txstatus txstatus[HTC_MAX_TX_STATUS];
+} __packed;
+
 enum wmi_cmd_id {
         WMI_ECHO_CMDID = 0x0001,
         WMI_ACCESS_MEMORY_CMDID,
 
         /* Commands to Target */
+        WMI_GET_FW_VERSION,
         WMI_DISABLE_INTR_CMDID,
         WMI_ENABLE_INTR_CMDID,
-        WMI_RX_LINK_CMDID,
         WMI_ATH_INIT_CMDID,
         WMI_ABORT_TXQ_CMDID,
         WMI_STOP_TX_DMA_CMDID,
-        WMI_STOP_DMA_RECV_CMDID,
         WMI_ABORT_TX_DMA_CMDID,
         WMI_DRAIN_TXQ_CMDID,
         WMI_DRAIN_TXQ_ALL_CMDID,
@@ -50,23 +96,21 @@ enum wmi_cmd_id {
         WMI_STOP_RECV_CMDID,
         WMI_FLUSH_RECV_CMDID,
         WMI_SET_MODE_CMDID,
-        WMI_RESET_CMDID,
         WMI_NODE_CREATE_CMDID,
         WMI_NODE_REMOVE_CMDID,
         WMI_VAP_REMOVE_CMDID,
         WMI_VAP_CREATE_CMDID,
-        WMI_BEACON_UPDATE_CMDID,
         WMI_REG_READ_CMDID,
         WMI_REG_WRITE_CMDID,
         WMI_RC_STATE_CHANGE_CMDID,
         WMI_RC_RATE_UPDATE_CMDID,
-        WMI_DEBUG_INFO_CMDID,
-        WMI_HOST_ATTACH,
         WMI_TARGET_IC_UPDATE_CMDID,
-        WMI_TGT_STATS_CMDID,
         WMI_TX_AGGR_ENABLE_CMDID,
         WMI_TGT_DETACH_CMDID,
-        WMI_TGT_TXQ_ENABLE_CMDID,
+        WMI_NODE_UPDATE_CMDID,
+        WMI_INT_STATS_CMDID,
+        WMI_TX_STATS_CMDID,
+        WMI_RX_STATS_CMDID,
         WMI_AGGR_LIMIT_CMD = 0x0026,
 };
 
@@ -76,9 +120,8 @@ enum wmi_event_id {
         WMI_FATAL_EVENTID,
         WMI_TXTO_EVENTID,
         WMI_BMISS_EVENTID,
-        WMI_WLAN_TXCOMP_EVENTID,
         WMI_DELBA_EVENTID,
-        WMI_TXRATE_EVENTID,
+        WMI_TXSTATUS_EVENTID,
 };
 
 #define MAX_CMD_NUMBER 62
@@ -88,6 +131,12 @@ struct register_write {
         __be32 val;
 };
 
+struct ath9k_htc_tx_event {
+        int count;
+        struct __wmi_event_txstatus txs;
+        struct list_head list;
+};
+
 struct wmi {
         struct ath9k_htc_priv *drv_priv;
         struct htc_target *htc;
@@ -95,12 +144,16 @@ struct wmi {
         struct mutex op_mutex;
         struct completion cmd_wait;
         enum wmi_cmd_id last_cmd_id;
+        struct sk_buff_head wmi_event_queue;
+        struct tasklet_struct wmi_event_tasklet;
         u16 tx_seq_id;
         u8 *cmd_rsp_buf;
         u32 cmd_rsp_len;
         bool stopped;
 
-        u8 beacon_pending;
+        struct list_head pending_tx_events;
+        spinlock_t event_lock;
+
         spinlock_t wmi_lock;
 
         atomic_t mwrite_cnt;
@@ -117,8 +170,9 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
                   u8 *cmd_buf, u32 cmd_len,
                   u8 *rsp_buf, u32 rsp_len,
                   u32 timeout);
-void ath9k_swba_tasklet(unsigned long data);
+void ath9k_wmi_event_tasklet(unsigned long data);
 void ath9k_fatal_work(struct work_struct *work);
+void ath9k_wmi_event_drain(struct ath9k_htc_priv *priv);
 
 #define WMI_CMD(_wmi_cmd)                                               \
         do {                                                            \
diff --git a/drivers/net/wireless/ath/regd.c b/drivers/net/wireless/ath/regd.c
index f828f294ba89..7e3b29015dda 100644
--- a/drivers/net/wireless/ath/regd.c
+++ b/drivers/net/wireless/ath/regd.c
@@ -97,8 +97,8 @@ static const struct ieee80211_regdomain ath_world_regdom_66_69 = {
         }
 };
 
-/* Can be used by 0x67, 0x6A and 0x68 */
-static const struct ieee80211_regdomain ath_world_regdom_67_68_6A = {
+/* Can be used by 0x67, 0x68, 0x6A and 0x6C */
+static const struct ieee80211_regdomain ath_world_regdom_67_68_6A_6C = {
         .n_reg_rules = 4,
         .alpha2 =  "99",
         .reg_rules = {
@@ -151,7 +151,8 @@ ieee80211_regdomain *ath_world_regdomain(struct ath_regulatory *reg)
         case 0x67:
         case 0x68:
         case 0x6A:
-                return &ath_world_regdom_67_68_6A;
+        case 0x6C:
+                return &ath_world_regdom_67_68_6A_6C;
         default:
                 WARN_ON(1);
                 return ath_default_world_regdomain();
diff --git a/drivers/net/wireless/ath/regd_common.h b/drivers/net/wireless/ath/regd_common.h
index 5c2cfe694152..24b53839fc3a 100644
--- a/drivers/net/wireless/ath/regd_common.h
+++ b/drivers/net/wireless/ath/regd_common.h
@@ -86,6 +86,7 @@ enum EnumRd {
         WOR9_WORLD = 0x69,
         WORA_WORLD = 0x6A,
         WORB_WORLD = 0x6B,
+        WORC_WORLD = 0x6C,
 
         MKK3_MKKB = 0x80,
         MKK3_MKKA2 = 0x81,
@@ -282,6 +283,7 @@ static struct reg_dmn_pair_mapping regDomainPairs[] = {
         {WOR9_WORLD, NO_CTL, NO_CTL},
         {WORA_WORLD, NO_CTL, NO_CTL},
         {WORB_WORLD, NO_CTL, NO_CTL},
+        {WORC_WORLD, NO_CTL, NO_CTL},
 };
 
 static struct country_code_to_enum_rd allCountries[] = {
diff --git a/drivers/net/wireless/iwlegacy/iwl-4965-rs.c b/drivers/net/wireless/iwlegacy/iwl-4965-rs.c
index 31ac672b64e1..89509392ef5d 100644
--- a/drivers/net/wireless/iwlegacy/iwl-4965-rs.c
+++ b/drivers/net/wireless/iwlegacy/iwl-4965-rs.c
@@ -2860,7 +2860,6 @@ static struct rate_control_ops rs_4965_ops = {
 
 int iwl4965_rate_control_register(void)
 {
-        pr_err("Registering 4965 rate control operations\n");
         return ieee80211_rate_control_register(&rs_4965_ops);
 }
 
diff --git a/drivers/net/wireless/mwifiex/11n.c b/drivers/net/wireless/mwifiex/11n.c
index 73a6e62f5680..d64065ff235c 100644
--- a/drivers/net/wireless/mwifiex/11n.c
+++ b/drivers/net/wireless/mwifiex/11n.c
@@ -242,9 +242,7 @@ int mwifiex_ret_11n_addba_req(struct mwifiex_private *priv,
  *
  * Handling includes changing the header fields into CPU format.
  */
-int mwifiex_ret_11n_cfg(struct mwifiex_private *priv,
-                        struct host_cmd_ds_command *resp,
-                        void *data_buf)
+int mwifiex_ret_11n_cfg(struct host_cmd_ds_command *resp, void *data_buf)
 {
         struct mwifiex_ds_11n_tx_cfg *tx_cfg = NULL;
         struct host_cmd_ds_11n_cfg *htcfg = &resp->params.htcfg;
@@ -298,8 +296,7 @@ int mwifiex_cmd_recfg_tx_buf(struct mwifiex_private *priv,
  *      - Setting AMSDU control parameters (for SET only)
  *      - Ensuring correct endian-ness
  */
-int mwifiex_cmd_amsdu_aggr_ctrl(struct mwifiex_private *priv,
-                                struct host_cmd_ds_command *cmd,
+int mwifiex_cmd_amsdu_aggr_ctrl(struct host_cmd_ds_command *cmd,
                                 int cmd_action, void *data_buf)
 {
         struct host_cmd_ds_amsdu_aggr_ctrl *amsdu_ctrl =
@@ -331,8 +328,7 @@ int mwifiex_cmd_amsdu_aggr_ctrl(struct mwifiex_private *priv,
  *
  * Handling includes changing the header fields into CPU format.
  */
-int mwifiex_ret_amsdu_aggr_ctrl(struct mwifiex_private *priv,
-                                struct host_cmd_ds_command *resp,
+int mwifiex_ret_amsdu_aggr_ctrl(struct host_cmd_ds_command *resp,
                                 void *data_buf)
 {
         struct mwifiex_ds_11n_amsdu_aggr_ctrl *amsdu_aggr_ctrl = NULL;
@@ -357,8 +353,7 @@ int mwifiex_ret_amsdu_aggr_ctrl(struct mwifiex_private *priv,
  *      - Setting HT Tx capability and HT Tx information fields
  *      - Ensuring correct endian-ness
  */
-int mwifiex_cmd_11n_cfg(struct mwifiex_private *priv,
-                        struct host_cmd_ds_command *cmd,
+int mwifiex_cmd_11n_cfg(struct host_cmd_ds_command *cmd,
                         u16 cmd_action, void *data_buf)
 {
         struct host_cmd_ds_11n_cfg *htcfg = &cmd->params.htcfg;
@@ -541,11 +536,8 @@ mwifiex_cfg_tx_buf(struct mwifiex_private *priv,
         else if (priv->adapter->curr_tx_buf_size <= MWIFIEX_TX_DATA_BUF_SIZE_8K)
                 curr_tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_8K;
         if (curr_tx_buf_size != tx_buf)
-                mwifiex_prepare_cmd(priv, HostCmd_CMD_RECONFIGURE_TX_BUFF,
-                        HostCmd_ACT_GEN_SET, 0,
-                        NULL, &tx_buf);
-
-        return;
+                mwifiex_send_cmd_async(priv, HostCmd_CMD_RECONFIGURE_TX_BUFF,
+                                       HostCmd_ACT_GEN_SET, 0, &tx_buf);
 }
 
 /*
@@ -583,8 +575,6 @@ void mwifiex_11n_delete_tx_ba_stream_tbl_entry(struct mwifiex_private *priv,
         list_del(&tx_ba_tsr_tbl->list);
 
         kfree(tx_ba_tsr_tbl);
-
-        return;
 }
 
 /*
@@ -663,8 +653,6 @@ void mwifiex_11n_create_tx_ba_stream_tbl(struct mwifiex_private *priv,
                 list_add_tail(&new_node->list, &priv->tx_ba_stream_tbl_ptr);
                 spin_unlock_irqrestore(&priv->tx_ba_stream_tbl_lock, flags);
         }
-
-        return;
 }
 
 /*
@@ -694,8 +682,8 @@ int mwifiex_send_addba(struct mwifiex_private *priv, int tid, u8 *peer_mac)
         memcpy(&add_ba_req.peer_mac_addr, peer_mac, ETH_ALEN);
 
         /* We don't wait for the response of this command */
-        ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_11N_ADDBA_REQ,
-                                  0, 0, NULL, &add_ba_req);
+        ret = mwifiex_send_cmd_async(priv, HostCmd_CMD_11N_ADDBA_REQ,
+                                     0, 0, &add_ba_req);
 
         return ret;
 }
@@ -722,8 +710,8 @@ int mwifiex_send_delba(struct mwifiex_private *priv, int tid, u8 *peer_mac,
         memcpy(&delba.peer_mac_addr, peer_mac, ETH_ALEN);
 
         /* We don't wait for the response of this command */
-        ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_11N_DELBA,
-                                  HostCmd_ACT_GEN_SET, 0, NULL, &delba);
+        ret = mwifiex_send_cmd_async(priv, HostCmd_CMD_11N_DELBA,
+                                     HostCmd_ACT_GEN_SET, 0, &delba);
 
         return ret;
 }
diff --git a/drivers/net/wireless/mwifiex/11n.h b/drivers/net/wireless/mwifiex/11n.h
index 71a853e61b61..02602ff30cbf 100644
--- a/drivers/net/wireless/mwifiex/11n.h
+++ b/drivers/net/wireless/mwifiex/11n.h
@@ -28,15 +28,9 @@ int mwifiex_ret_11n_delba(struct mwifiex_private *priv,
                           struct host_cmd_ds_command *resp);
 int mwifiex_ret_11n_addba_req(struct mwifiex_private *priv,
                               struct host_cmd_ds_command *resp);
-int mwifiex_ret_11n_cfg(struct mwifiex_private *priv,
-                        struct host_cmd_ds_command *resp,
+int mwifiex_ret_11n_cfg(struct host_cmd_ds_command *resp,
                         void *data_buf);
-int mwifiex_cmd_11n_cfg(struct mwifiex_private *priv,
-                        struct host_cmd_ds_command *cmd,
-                        u16 cmd_action, void *data_buf);
-
-int mwifiex_cmd_11n_cfg(struct mwifiex_private *priv,
-                        struct host_cmd_ds_command *cmd,
+int mwifiex_cmd_11n_cfg(struct host_cmd_ds_command *cmd,
                         u16 cmd_action, void *data_buf);
 
 int mwifiex_cmd_append_11n_tlv(struct mwifiex_private *priv,
@@ -67,24 +61,19 @@ int mwifiex_get_rx_reorder_tbl(struct mwifiex_private *priv,
                               struct mwifiex_ds_rx_reorder_tbl *buf);
 int mwifiex_get_tx_ba_stream_tbl(struct mwifiex_private *priv,
                                struct mwifiex_ds_tx_ba_stream_tbl *buf);
-int mwifiex_ret_amsdu_aggr_ctrl(struct mwifiex_private *priv,
-                                struct host_cmd_ds_command
-                                *resp,
+int mwifiex_ret_amsdu_aggr_ctrl(struct host_cmd_ds_command *resp,
                                 void *data_buf);
 int mwifiex_cmd_recfg_tx_buf(struct mwifiex_private *priv,
                              struct host_cmd_ds_command *cmd,
                              int cmd_action, void *data_buf);
-int mwifiex_cmd_amsdu_aggr_ctrl(struct mwifiex_private *priv,
-                                struct host_cmd_ds_command *cmd,
-                                int cmd_action,
-                                void *data_buf);
+int mwifiex_cmd_amsdu_aggr_ctrl(struct host_cmd_ds_command *cmd,
+                                int cmd_action, void *data_buf);
 
 /*
  * This function checks whether AMPDU is allowed or not for a particular TID.
  */
 static inline u8
-mwifiex_is_ampdu_allowed(struct mwifiex_private *priv,
-                         struct mwifiex_ra_list_tbl *ptr, int tid)
+mwifiex_is_ampdu_allowed(struct mwifiex_private *priv, int tid)
 {
         return ((priv->aggr_prio_tbl[tid].ampdu_ap != BA_STREAM_NOT_ALLOWED)
                 ? true : false);
@@ -94,8 +83,7 @@ mwifiex_is_ampdu_allowed(struct mwifiex_private *priv,
  * This function checks whether AMSDU is allowed or not for a particular TID.
  */
 static inline u8
-mwifiex_is_amsdu_allowed(struct mwifiex_private *priv,
-                         struct mwifiex_ra_list_tbl *ptr, int tid)
+mwifiex_is_amsdu_allowed(struct mwifiex_private *priv, int tid)
 {
         return (((priv->aggr_prio_tbl[tid].amsdu != BA_STREAM_NOT_ALLOWED)
                         && ((priv->is_data_rate_auto)
@@ -104,23 +92,21 @@ mwifiex_is_amsdu_allowed(struct mwifiex_private *priv,
 }
 
 /*
- * This function checks whether a BA stream is available or not.
+ * This function checks whether a space is available for new BA stream or not.
  */
-static inline u8
-mwifiex_is_ba_stream_avail(struct mwifiex_private *priv)
+static inline u8 mwifiex_space_avail_for_new_ba_stream(
+                                        struct mwifiex_adapter *adapter)
 {
-        struct mwifiex_private *pmpriv = NULL;
-        u8 i = 0;
+        struct mwifiex_private *priv;
+        u8 i;
         u32 ba_stream_num = 0;
 
-        for (i = 0; i < priv->adapter->priv_num; i++) {
-                pmpriv = priv->adapter->priv[i];
-                if (pmpriv)
-                        ba_stream_num +=
-                                mwifiex_wmm_list_len(priv->adapter,
-                                                     (struct list_head
-                                                      *) &pmpriv->
-                                                     tx_ba_stream_tbl_ptr);
+        for (i = 0; i < adapter->priv_num; i++) {
+                priv = adapter->priv[i];
+                if (priv)
+                        ba_stream_num += mwifiex_wmm_list_len(
+                                                (struct list_head *)
+                                                &priv->tx_ba_stream_tbl_ptr);
         }
 
         return ((ba_stream_num <
@@ -133,8 +119,7 @@ mwifiex_is_ba_stream_avail(struct mwifiex_private *priv)
  * Upon successfully locating, both the TID and the RA are returned.
  */
 static inline u8
-mwifiex_find_stream_to_delete(struct mwifiex_private *priv,
-                              struct mwifiex_ra_list_tbl *ptr, int ptr_tid,
+mwifiex_find_stream_to_delete(struct mwifiex_private *priv, int ptr_tid,
                               int *ptid, u8 *ra)
 {
         int tid;
diff --git a/drivers/net/wireless/mwifiex/11n_aggr.c b/drivers/net/wireless/mwifiex/11n_aggr.c
index c2abced66957..c9fb0627de43 100644
--- a/drivers/net/wireless/mwifiex/11n_aggr.c
+++ b/drivers/net/wireless/mwifiex/11n_aggr.c
@@ -44,8 +44,7 @@
  * MSDU => |DA|SA|Length|SNAP|......   ..|
  */
 static int
-mwifiex_11n_form_amsdu_pkt(struct mwifiex_adapter *adapter,
-                           struct sk_buff *skb_aggr,
+mwifiex_11n_form_amsdu_pkt(struct sk_buff *skb_aggr,
                            struct sk_buff *skb_src, int *pad)
 
 {
@@ -324,7 +323,7 @@ mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
 
                 spin_unlock_irqrestore(&priv->wmm.ra_list_spinlock,
                                        ra_list_flags);
-                mwifiex_11n_form_amsdu_pkt(adapter, skb_aggr, skb_src, &pad);
+                mwifiex_11n_form_amsdu_pkt(skb_aggr, skb_src, &pad);
 
                 mwifiex_write_data_complete(adapter, skb_src, 0);
 
diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.c b/drivers/net/wireless/mwifiex/11n_rxreorder.c
index 8e94e620e6f4..755e5d533c03 100644
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.c
@@ -309,8 +309,6 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
         spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
         list_add_tail(&new_node->list, &priv->rx_reorder_tbl_ptr);
         spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
-
-        return;
 }
 
 /*
@@ -321,8 +319,7 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
  *      - Setting add BA request buffer
  *      - Ensuring correct endian-ness
  */
-int mwifiex_cmd_11n_addba_req(struct mwifiex_private *priv,
-                              struct host_cmd_ds_command *cmd, void *data_buf)
+int mwifiex_cmd_11n_addba_req(struct host_cmd_ds_command *cmd, void *data_buf)
 {
         struct host_cmd_ds_11n_addba_req *add_ba_req =
                 (struct host_cmd_ds_11n_addba_req *)
@@ -393,8 +390,7 @@ int mwifiex_cmd_11n_addba_rsp_gen(struct mwifiex_private *priv,
  *      - Setting del BA request buffer
  *      - Ensuring correct endian-ness
  */
-int mwifiex_cmd_11n_delba(struct mwifiex_private *priv,
-                          struct host_cmd_ds_command *cmd, void *data_buf)
+int mwifiex_cmd_11n_delba(struct host_cmd_ds_command *cmd, void *data_buf)
 {
         struct host_cmd_ds_11n_delba *del_ba = (struct host_cmd_ds_11n_delba *)
                 &cmd->params.del_ba;
@@ -609,9 +605,7 @@ void mwifiex_11n_ba_stream_timeout(struct mwifiex_private *priv,
         delba.del_ba_param_set |= cpu_to_le16(
                 (u16) event->origninator << DELBA_INITIATOR_POS);
         delba.reason_code = cpu_to_le16(WLAN_REASON_QSTA_TIMEOUT);
-        mwifiex_prepare_cmd(priv, HostCmd_CMD_11N_DELBA, 0, 0, NULL, &delba);
-
-        return;
+        mwifiex_send_cmd_async(priv, HostCmd_CMD_11N_DELBA, 0, 0, &delba);
 }
 
 /*
diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.h b/drivers/net/wireless/mwifiex/11n_rxreorder.h
index 42f569035745..f3ca8c8c18f9 100644
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.h
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.h
@@ -49,14 +49,12 @@ void mwifiex_11n_ba_stream_timeout(struct mwifiex_private *priv,
 int mwifiex_ret_11n_addba_resp(struct mwifiex_private *priv,
                                struct host_cmd_ds_command
                                *resp);
-int mwifiex_cmd_11n_delba(struct mwifiex_private *priv,
-                          struct host_cmd_ds_command *cmd,
+int mwifiex_cmd_11n_delba(struct host_cmd_ds_command *cmd,
                           void *data_buf);
 int mwifiex_cmd_11n_addba_rsp_gen(struct mwifiex_private *priv,
                                   struct host_cmd_ds_command
                                   *cmd, void *data_buf);
-int mwifiex_cmd_11n_addba_req(struct mwifiex_private *priv,
-                              struct host_cmd_ds_command *cmd,
+int mwifiex_cmd_11n_addba_req(struct host_cmd_ds_command *cmd,
                               void *data_buf);
 void mwifiex_11n_cleanup_reorder_tbl(struct mwifiex_private *priv);
 struct mwifiex_rx_reorder_tbl *mwifiex_11n_get_rxreorder_tbl(struct
diff --git a/drivers/net/wireless/mwifiex/README b/drivers/net/wireless/mwifiex/README
index 338377f7093b..b55badef4660 100644
--- a/drivers/net/wireless/mwifiex/README
+++ b/drivers/net/wireless/mwifiex/README
@@ -157,7 +157,7 @@ info
         mp_wr_bitmap = <SDIO multi-port write bitmap>
         cmd_resp_received = <0/1, no cmd response to process/response received and yet to process>
         event_received = <0/1, no event to process/event received and yet to process>
-        ioctl_pending = <number of ioctl pending>
+        cmd_pending = <number of cmd pending>
         tx_pending = <number of Tx packet pending>
         rx_pending = <number of Rx packet pending>
 
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index ec0895f4e8d3..74b6cf20da04 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -139,8 +139,16 @@ mwifiex_cfg80211_set_tx_power(struct wiphy *wiphy,
 {
         int ret = 0;
         struct mwifiex_private *priv = mwifiex_cfg80211_get_priv(wiphy);
+        struct mwifiex_power_cfg power_cfg;
 
-        ret = mwifiex_set_tx_power(priv, type, dbm);
+        if (type == NL80211_TX_POWER_FIXED) {
+                power_cfg.is_power_auto = 0;
+                power_cfg.power_level = dbm;
+        } else {
+                power_cfg.is_power_auto = 1;
+        }
+
+        ret = mwifiex_set_tx_power(priv, &power_cfg);
 
         return ret;
 }
@@ -157,13 +165,15 @@ mwifiex_cfg80211_set_power_mgmt(struct wiphy *wiphy,
 {
         int ret = 0;
         struct mwifiex_private *priv = mwifiex_cfg80211_get_priv(wiphy);
+        u32 ps_mode;
 
         if (timeout)
                 wiphy_dbg(wiphy,
                         "info: ignoring the timeout value"
                         " for IEEE power save\n");
 
-        ret = mwifiex_drv_set_power(priv, enabled);
+        ps_mode = enabled;
+        ret = mwifiex_drv_set_power(priv, &ps_mode);
 
         return ret;
 }
@@ -291,8 +301,8 @@ static int mwifiex_send_domain_info_cmd_fw(struct wiphy *wiphy)
 
         domain_info->no_of_triplet = no_of_triplet;
         /* Send cmd to FW to set domain info */
-        ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_802_11D_DOMAIN_INFO,
-                                  HostCmd_ACT_GEN_SET, 0, NULL, NULL);
+        ret = mwifiex_send_cmd_async(priv, HostCmd_CMD_802_11D_DOMAIN_INFO,
+                                     HostCmd_ACT_GEN_SET, 0, NULL);
         if (ret)
                 wiphy_err(wiphy, "11D: setting domain info in FW\n");
 
@@ -347,7 +357,6 @@ mwifiex_set_rf_channel(struct mwifiex_private *priv,
 {
         struct mwifiex_chan_freq_power cfp;
         int ret = 0;
-        int status = 0;
         struct mwifiex_ds_band_cfg band_cfg;
         u32 config_bands = 0;
         struct wiphy *wiphy = priv->wdev->wiphy;
@@ -370,10 +379,9 @@ mwifiex_set_rf_channel(struct mwifiex_private *priv,
                 band_cfg.sec_chan_offset =
                         mwifiex_cfg80211_channel_type_to_mwifiex_channels
                         (channel_type);
-                status = mwifiex_radio_ioctl_band_cfg(priv, HostCmd_ACT_GEN_SET,
-                                                      &band_cfg);
+                ret = mwifiex_set_radio_band_cfg(priv, &band_cfg);
 
-                if (status)
+                if (ret)
                         return -EFAULT;
                 mwifiex_send_domain_info_cmd_fw(wiphy);
         }
@@ -389,8 +397,8 @@ mwifiex_set_rf_channel(struct mwifiex_private *priv,
         /* Convert frequency to channel */
         cfp.channel = ieee80211_frequency_to_channel(chan->center_freq);
 
-        status = mwifiex_bss_ioctl_channel(priv, HostCmd_ACT_GEN_SET, &cfp);
-        if (status)
+        ret = mwifiex_bss_set_channel(priv, &cfp);
+        if (ret)
                 return -EFAULT;
 
         ret = mwifiex_drv_change_adhoc_chan(priv, cfp.channel);
@@ -422,66 +430,45 @@ mwifiex_cfg80211_set_channel(struct wiphy *wiphy, struct net_device *dev,
 /*
  * This function sets the fragmentation threshold.
  *
- * This function creates an IOCTL request, populates it accordingly
- * and issues an IOCTL.
- *
- * The fragmentation threshold value must lies between MWIFIEX_FRAG_MIN_VALUE
+ * The fragmentation threshold value must lie between MWIFIEX_FRAG_MIN_VALUE
  * and MWIFIEX_FRAG_MAX_VALUE.
  */
 static int
 mwifiex_set_frag(struct mwifiex_private *priv, u32 frag_thr)
 {
         int ret = 0;
-        int status = 0;
-        struct mwifiex_wait_queue *wait = NULL;
-        u8 wait_option = MWIFIEX_IOCTL_WAIT;
 
         if (frag_thr < MWIFIEX_FRAG_MIN_VALUE
             || frag_thr > MWIFIEX_FRAG_MAX_VALUE)
                 return -EINVAL;
 
-        wait = mwifiex_alloc_fill_wait_queue(priv, wait_option);
-        if (!wait)
-                return -ENOMEM;
-
-        status = mwifiex_snmp_mib_ioctl(priv, wait, FRAG_THRESH_I,
-                                        HostCmd_ACT_GEN_SET, &frag_thr);
-
-        if (mwifiex_request_ioctl(priv, wait, status, wait_option))
-                ret = -EFAULT;
+        /* Send request to firmware */
+        ret = mwifiex_send_cmd_sync(priv, HostCmd_CMD_802_11_SNMP_MIB,
+                                    HostCmd_ACT_GEN_SET, FRAG_THRESH_I,
+                                    &frag_thr);
 
-        kfree(wait);
         return ret;
 }
 
 /*
  * This function sets the RTS threshold.
- *
- * This function creates an IOCTL request, populates it accordingly
- * and issues an IOCTL.
+
+ * The rts value must lie between MWIFIEX_RTS_MIN_VALUE
+ * and MWIFIEX_RTS_MAX_VALUE.
  */
 static int
 mwifiex_set_rts(struct mwifiex_private *priv, u32 rts_thr)
 {
         int ret = 0;
-        struct mwifiex_wait_queue *wait = NULL;
-        int status = 0;
-        u8 wait_option = MWIFIEX_IOCTL_WAIT;
 
         if (rts_thr < MWIFIEX_RTS_MIN_VALUE || rts_thr > MWIFIEX_RTS_MAX_VALUE)
                 rts_thr = MWIFIEX_RTS_MAX_VALUE;
 
-        wait = mwifiex_alloc_fill_wait_queue(priv, wait_option);
-        if (!wait)
-                return -ENOMEM;
+        /* Send request to firmware */
+        ret = mwifiex_send_cmd_sync(priv, HostCmd_CMD_802_11_SNMP_MIB,
+                                    HostCmd_ACT_GEN_SET, RTS_THRESH_I,
+                                    &rts_thr);
 
-        status = mwifiex_snmp_mib_ioctl(priv, wait, RTS_THRESH_I,
-                                        HostCmd_ACT_GEN_SET, &rts_thr);
-
-        if (mwifiex_request_ioctl(priv, wait, status, wait_option))
-                ret = -EFAULT;
-
-        kfree(wait);
         return ret;
 }
 
@@ -518,7 +505,6 @@ mwifiex_cfg80211_change_virtual_intf(struct wiphy *wiphy,
 {
         int ret = 0;
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
-        struct mwifiex_wait_queue *wait = NULL;
 
         if (priv->bss_mode == type) {
                 wiphy_warn(wiphy, "already set to required type\n");
@@ -545,24 +531,13 @@ mwifiex_cfg80211_change_virtual_intf(struct wiphy *wiphy,
                 return -EINVAL;
         }
 
-        wait = mwifiex_alloc_fill_wait_queue(priv, MWIFIEX_IOCTL_WAIT);
-        if (!wait)
-                return -ENOMEM;
-
-        mwifiex_deauthenticate(priv, wait, NULL);
+        mwifiex_deauthenticate(priv, NULL);
 
         priv->sec_info.authentication_mode = NL80211_AUTHTYPE_OPEN_SYSTEM;
 
-        ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_SET_BSS_MODE,
-                                  HostCmd_ACT_GEN_SET, 0, wait, NULL);
-        if (!ret)
-                ret = -EINPROGRESS;
+        ret = mwifiex_send_cmd_sync(priv, HostCmd_CMD_SET_BSS_MODE,
+                                    HostCmd_ACT_GEN_SET, 0, NULL);
 
-        ret = mwifiex_request_ioctl(priv, wait, ret, MWIFIEX_IOCTL_WAIT);
-        if (ret)
-                ret = -EFAULT;
-
-        kfree(wait);
         return ret;
 }
 
@@ -592,7 +567,7 @@ mwifiex_dump_station_info(struct mwifiex_private *priv,
 
         /* Get signal information from the firmware */
         memset(&signal, 0, sizeof(struct mwifiex_ds_get_signal));
-        if (mwifiex_get_signal_info(priv, MWIFIEX_IOCTL_WAIT, &signal)) {
+        if (mwifiex_get_signal_info(priv, &signal)) {
                 dev_err(priv->adapter->dev, "getting signal information\n");
                 ret = -EFAULT;
         }
@@ -750,7 +725,7 @@ mwifiex_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *dev,
                 return -EBUSY;
 
         priv->disconnect = 1;
-        if (mwifiex_disconnect(priv, MWIFIEX_IOCTL_WAIT, NULL))
+        if (mwifiex_deauthenticate(priv, NULL))
                 return -EFAULT;
 
         wiphy_dbg(wiphy, "info: successfully disconnected from %pM:"
@@ -838,8 +813,8 @@ static int mwifiex_inform_bss_from_scan_result(struct mwifiex_private *priv,
         u8 element_id, element_len;
 
         memset(&scan_resp, 0, sizeof(scan_resp));
-        if (mwifiex_get_scan_table(priv, MWIFIEX_IOCTL_WAIT, &scan_resp))
-                return -EFAULT;
+        scan_resp.scan_table = (u8 *) priv->adapter->scan_table;
+        scan_resp.num_in_scan_table = priv->adapter->num_in_scan_table;
 
 #define MAX_IE_BUF      2048
         ie_buf = kzalloc(MAX_IE_BUF, GFP_KERNEL);
@@ -986,7 +961,7 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len, u8 *ssid,
         }
 
         /* disconnect before try to associate */
-        mwifiex_disconnect(priv, MWIFIEX_IOCTL_WAIT, NULL);
+        mwifiex_deauthenticate(priv, NULL);
 
         if (channel)
                 ret = mwifiex_set_rf_channel(priv, channel,
@@ -1046,7 +1021,7 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len, u8 *ssid,
         }
 done:
         /* Do specific SSID scanning */
-        if (mwifiex_request_scan(priv, MWIFIEX_IOCTL_WAIT, &req_ssid)) {
+        if (mwifiex_request_scan(priv, &req_ssid)) {
                 dev_err(priv->adapter->dev, "scan error\n");
                 return -EFAULT;
         }
@@ -1055,8 +1030,7 @@ done:
         memcpy(&ssid_bssid.ssid, &req_ssid, sizeof(struct mwifiex_802_11_ssid));
 
         if (mode != NL80211_IFTYPE_ADHOC) {
-                if (mwifiex_find_best_bss(priv, MWIFIEX_IOCTL_WAIT,
-                                          &ssid_bssid))
+                if (mwifiex_find_best_bss(priv, &ssid_bssid))
                         return -EFAULT;
                 /* Inform the BSS information to kernel, otherwise
                  * kernel will give a panic after successful assoc */
@@ -1072,7 +1046,10 @@ done:
         /* Connect to BSS by ESSID */
         memset(&ssid_bssid.bssid, 0, ETH_ALEN);
 
-        if (mwifiex_bss_start(priv, MWIFIEX_IOCTL_WAIT, &ssid_bssid))
+        if (!netif_queue_stopped(priv->netdev))
+                netif_stop_queue(priv->netdev);
+
+        if (mwifiex_bss_start(priv, &ssid_bssid))
                 return -EFAULT;
 
         if (mode == NL80211_IFTYPE_ADHOC) {
@@ -1176,7 +1153,7 @@ mwifiex_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
 
         wiphy_dbg(wiphy, "info: disconnecting from essid %pM\n",
                         priv->cfg_bssid);
-        if (mwifiex_disconnect(priv, MWIFIEX_IOCTL_WAIT, NULL))
+        if (mwifiex_deauthenticate(priv, NULL))
                 return -EFAULT;
 
         queue_work(priv->workqueue, &priv->cfg_workqueue);
@@ -1451,6 +1428,4 @@ done:
                 memset(priv->cfg_bssid, 0, ETH_ALEN);
                 priv->disconnect = 0;
         }
-
-        return;
 }
diff --git a/drivers/net/wireless/mwifiex/cfp.c b/drivers/net/wireless/mwifiex/cfp.c
index 07187a405fee..bb73cfe14aeb 100644
--- a/drivers/net/wireless/mwifiex/cfp.c
+++ b/drivers/net/wireless/mwifiex/cfp.c
@@ -75,8 +75,7 @@ u8 supported_rates_n[N_SUPPORTED_RATES] = { 0x02, 0x04, 0 };
  * This function maps an index in supported rates table into
  * the corresponding data rate.
  */
-u32 mwifiex_index_to_data_rate(struct mwifiex_adapter *adapter, u8 index,
-                               u8 ht_info)
+u32 mwifiex_index_to_data_rate(u8 index, u8 ht_info)
 {
         u16 mcs_rate[4][8] = {
                 {0x1b, 0x36, 0x51, 0x6c, 0xa2, 0xd8, 0xf3, 0x10e}
@@ -126,7 +125,7 @@ u32 mwifiex_index_to_data_rate(struct mwifiex_adapter *adapter, u8 index,
  * This function maps a data rate value into corresponding index in supported
  * rates table.
  */
-u8 mwifiex_data_rate_to_index(struct mwifiex_adapter *adapter, u32 rate)
+u8 mwifiex_data_rate_to_index(u32 rate)
 {
         u16 *ptr;
 
@@ -265,9 +264,7 @@ mwifiex_is_rate_auto(struct mwifiex_private *priv)
 /*
  * This function converts rate bitmap into rate index.
  */
-int
-mwifiex_get_rate_index(struct mwifiex_adapter *adapter, u16 *rate_bitmap,
-                       int size)
+int mwifiex_get_rate_index(u16 *rate_bitmap, int size)
 {
         int i;
 
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index a9aeb31af455..776146a104ec 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -36,11 +36,12 @@
 static void
 mwifiex_init_cmd_node(struct mwifiex_private *priv,
                       struct cmd_ctrl_node *cmd_node,
-                      u32 cmd_oid, void *wait_queue, void *data_buf)
+                      u32 cmd_oid, void *data_buf)
 {
         cmd_node->priv = priv;
         cmd_node->cmd_oid = cmd_oid;
-        cmd_node->wq_buf = wait_queue;
+        cmd_node->wait_q_enabled = priv->adapter->cmd_wait_q_required;
+        priv->adapter->cmd_wait_q_required = false;
         cmd_node->data_buf = data_buf;
         cmd_node->cmd_skb = cmd_node->skb;
 }
@@ -86,39 +87,13 @@ mwifiex_clean_cmd_node(struct mwifiex_adapter *adapter,
 {
         cmd_node->cmd_oid = 0;
         cmd_node->cmd_flag = 0;
-        cmd_node->wq_buf = NULL;
         cmd_node->data_buf = NULL;
+        cmd_node->wait_q_enabled = false;
 
         if (cmd_node->resp_skb) {
                 mwifiex_recv_complete(adapter, cmd_node->resp_skb, 0);
                 cmd_node->resp_skb = NULL;
         }
-
-        return;
-}
-
-/*
- * This function returns a command node from the pending queue which
- * matches the given IOCTL request.
- */
-static struct cmd_ctrl_node *
-mwifiex_get_pending_ioctl_cmd(struct mwifiex_adapter *adapter,
-                              struct mwifiex_wait_queue *wait_queue)
-{
-        unsigned long flags;
-        struct cmd_ctrl_node *cmd_node;
-
-        spin_lock_irqsave(&adapter->cmd_pending_q_lock, flags);
-        list_for_each_entry(cmd_node, &adapter->cmd_pending_q, list) {
-                if (cmd_node->wq_buf == wait_queue) {
-                        spin_unlock_irqrestore(&adapter->cmd_pending_q_lock,
-                                               flags);
-                        return cmd_node;
-                }
-        }
-        spin_unlock_irqrestore(&adapter->cmd_pending_q_lock, flags);
-
-        return NULL;
 }
 
 /*
@@ -155,7 +130,6 @@ static int mwifiex_dnld_cmd_to_fw(struct mwifiex_private *priv,
         struct mwifiex_adapter *adapter = priv->adapter;
         int ret = 0;
         struct host_cmd_ds_command *host_cmd;
-        struct mwifiex_wait_queue *wait_queue = NULL;
         uint16_t cmd_code;
         uint16_t cmd_size;
         struct timeval tstamp;
@@ -165,15 +139,13 @@ static int mwifiex_dnld_cmd_to_fw(struct mwifiex_private *priv,
                 return -1;
 
         host_cmd = (struct host_cmd_ds_command *) (cmd_node->cmd_skb->data);
-        if (cmd_node->wq_buf)
-                wait_queue = (struct mwifiex_wait_queue *) cmd_node->wq_buf;
 
         /* Sanity test */
         if (host_cmd == NULL || host_cmd->size == 0) {
                 dev_err(adapter->dev, "DNLD_CMD: host_cmd is null"
                         " or cmd size is 0, not sending\n");
-                if (wait_queue)
-                        wait_queue->status = MWIFIEX_ERROR_CMD_DNLD_FAIL;
+                if (cmd_node->wait_q_enabled)
+                        adapter->cmd_wait_q.status = -1;
                 mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
                 return -1;
         }
@@ -206,10 +178,12 @@ static int mwifiex_dnld_cmd_to_fw(struct mwifiex_private *priv,
                                              cmd_node->cmd_skb->data,
                                              cmd_node->cmd_skb->len, NULL);
 
+        skb_pull(cmd_node->cmd_skb, INTF_HEADER_LEN);
+
         if (ret == -1) {
                 dev_err(adapter->dev, "DNLD_CMD: host to card failed\n");
-                if (wait_queue)
-                        wait_queue->status = MWIFIEX_ERROR_CMD_DNLD_FAIL;
+                if (cmd_node->wait_q_enabled)
+                        adapter->cmd_wait_q.status = -1;
                 mwifiex_insert_cmd_to_free_q(adapter, adapter->curr_cmd);
 
                 spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
@@ -435,7 +409,31 @@ int mwifiex_process_event(struct mwifiex_adapter *adapter)
 }
 
 /*
- * This function prepares a command before sending it to the firmware.
+ * This function is used to send synchronous command to the firmware.
+ *
+ * it allocates a wait queue for the command and wait for the command
+ * response.
+ */
+int mwifiex_send_cmd_sync(struct mwifiex_private *priv, uint16_t cmd_no,
+                          u16 cmd_action, u32 cmd_oid, void *data_buf)
+{
+        int ret = 0;
+        struct mwifiex_adapter *adapter = priv->adapter;
+
+        adapter->cmd_wait_q_required = true;
+        adapter->cmd_wait_q.condition = false;
+
+        ret = mwifiex_send_cmd_async(priv, cmd_no, cmd_action, cmd_oid,
+                                     data_buf);
+        if (!ret)
+                ret = mwifiex_wait_queue_complete(adapter);
+
+        return ret;
+}
+
+
+/*
+ * This function prepares a command and asynchronously send it to the firmware.
  *
  * Preparation includes -
  *      - Sanity tests to make sure the card is still present or the FW
@@ -445,9 +443,8 @@ int mwifiex_process_event(struct mwifiex_adapter *adapter)
  *      - Fill up the non-default parameters and buffer pointers
  *      - Add the command to pending queue
  */
-int mwifiex_prepare_cmd(struct mwifiex_private *priv, uint16_t cmd_no,
-                        u16 cmd_action, u32 cmd_oid,
-                        void *wait_queue, void *data_buf)
+int mwifiex_send_cmd_async(struct mwifiex_private *priv, uint16_t cmd_no,
+                           u16 cmd_action, u32 cmd_oid, void *data_buf)
 {
         int ret = 0;
         struct mwifiex_adapter *adapter = priv->adapter;
@@ -485,7 +482,7 @@ int mwifiex_prepare_cmd(struct mwifiex_private *priv, uint16_t cmd_no,
         }
 
         /* Initialize the command node */
-        mwifiex_init_cmd_node(priv, cmd_node, cmd_oid, wait_queue, data_buf);
+        mwifiex_init_cmd_node(priv, cmd_node, cmd_oid, data_buf);
 
         if (!cmd_node->cmd_skb) {
                 dev_err(adapter->dev, "PREP_CMD: no free cmd buf\n");
@@ -535,18 +532,13 @@ void
 mwifiex_insert_cmd_to_free_q(struct mwifiex_adapter *adapter,
                              struct cmd_ctrl_node *cmd_node)
 {
-        struct mwifiex_wait_queue *wait_queue = NULL;
         unsigned long flags;
 
-        if (cmd_node == NULL)
+        if (!cmd_node)
                 return;
-        if (cmd_node->wq_buf) {
-                wait_queue = (struct mwifiex_wait_queue *) cmd_node->wq_buf;
-                if (wait_queue->status != MWIFIEX_ERROR_NO_ERROR)
-                        mwifiex_ioctl_complete(adapter, wait_queue, -1);
-                else
-                        mwifiex_ioctl_complete(adapter, wait_queue, 0);
-        }
+
+        if (cmd_node->wait_q_enabled)
+                mwifiex_complete_cmd(adapter);
         /* Clean the node */
         mwifiex_clean_cmd_node(adapter, cmd_node);
 
@@ -554,8 +546,6 @@ mwifiex_insert_cmd_to_free_q(struct mwifiex_adapter *adapter,
         spin_lock_irqsave(&adapter->cmd_free_q_lock, flags);
         list_add_tail(&cmd_node->list, &adapter->cmd_free_q);
         spin_unlock_irqrestore(&adapter->cmd_free_q_lock, flags);
-
-        return;
 }
 
 /*
@@ -600,8 +590,6 @@ mwifiex_insert_cmd_to_pending_q(struct mwifiex_adapter *adapter,
         spin_unlock_irqrestore(&adapter->cmd_pending_q_lock, flags);
 
         dev_dbg(adapter->dev, "cmd: QUEUE_CMD: cmd=%#x is queued\n", command);
-
-        return;
 }
 
 /*
@@ -692,7 +680,6 @@ int mwifiex_process_cmdresp(struct mwifiex_adapter *adapter)
         uint16_t orig_cmdresp_no;
         uint16_t cmdresp_no;
         uint16_t cmdresp_result;
-        struct mwifiex_wait_queue *wait_queue = NULL;
         struct timeval tstamp;
         unsigned long flags;
 
@@ -706,10 +693,6 @@ int mwifiex_process_cmdresp(struct mwifiex_adapter *adapter)
                 return -1;
         }
 
-        if (adapter->curr_cmd->wq_buf)
-                wait_queue = (struct mwifiex_wait_queue *)
-                                adapter->curr_cmd->wq_buf;
-
         adapter->num_cmd_timeout = 0;
 
         resp = (struct host_cmd_ds_command *) adapter->curr_cmd->resp_skb->data;
@@ -764,8 +747,8 @@ int mwifiex_process_cmdresp(struct mwifiex_adapter *adapter)
 
         if (!(orig_cmdresp_no & HostCmd_RET_BIT)) {
                 dev_err(adapter->dev, "CMD_RESP: invalid cmd resp\n");
-                if (wait_queue)
-                        wait_queue->status = MWIFIEX_ERROR_FW_CMDRESP;
+                if (adapter->curr_cmd->wait_q_enabled)
+                        adapter->cmd_wait_q.status = -1;
 
                 mwifiex_insert_cmd_to_free_q(adapter, adapter->curr_cmd);
                 spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
@@ -781,8 +764,7 @@ int mwifiex_process_cmdresp(struct mwifiex_adapter *adapter)
                         ret = mwifiex_ret_802_11_hs_cfg(priv, resp);
         } else {
                 /* handle response */
-                ret = mwifiex_process_sta_cmdresp(priv, cmdresp_no, resp,
-                                                  wait_queue);
+                ret = mwifiex_process_sta_cmdresp(priv, cmdresp_no, resp);
         }
 
         /* Check init command response */
@@ -797,10 +779,10 @@ int mwifiex_process_cmdresp(struct mwifiex_adapter *adapter)
         }
 
         if (adapter->curr_cmd) {
-                if (wait_queue && (!ret))
-                        wait_queue->status = MWIFIEX_ERROR_NO_ERROR;
-                else if (wait_queue && (ret == -1))
-                        wait_queue->status = MWIFIEX_ERROR_CMD_RESP_FAIL;
+                if (adapter->curr_cmd->wait_q_enabled && (!ret))
+                        adapter->cmd_wait_q.status = 0;
+                else if (adapter->curr_cmd->wait_q_enabled && (ret == -1))
+                        adapter->cmd_wait_q.status = -1;
 
                 /* Clean up and put current command back to cmd_free_q */
                 mwifiex_insert_cmd_to_free_q(adapter, adapter->curr_cmd);
@@ -824,7 +806,6 @@ mwifiex_cmd_timeout_func(unsigned long function_context)
         struct mwifiex_adapter *adapter =
                 (struct mwifiex_adapter *) function_context;
         struct cmd_ctrl_node *cmd_node = NULL;
-        struct mwifiex_wait_queue *wait_queue = NULL;
         struct timeval tstamp;
 
         adapter->num_cmd_timeout++;
@@ -834,10 +815,8 @@ mwifiex_cmd_timeout_func(unsigned long function_context)
                 return;
         }
         cmd_node = adapter->curr_cmd;
-        if (cmd_node->wq_buf) {
-                wait_queue = (struct mwifiex_wait_queue *) cmd_node->wq_buf;
-                wait_queue->status = MWIFIEX_ERROR_CMD_TIMEOUT;
-        }
+        if (cmd_node->wait_q_enabled)
+                adapter->cmd_wait_q.status = -ETIMEDOUT;
 
         if (cmd_node) {
                 adapter->dbg.timeout_cmd_id =
@@ -886,8 +865,6 @@ mwifiex_cmd_timeout_func(unsigned long function_context)
         }
         if (adapter->hw_status == MWIFIEX_HW_STATUS_INITIALIZING)
                 mwifiex_init_fw_complete(adapter);
-
-        return;
 }
 
 /*
@@ -901,18 +878,15 @@ void
 mwifiex_cancel_all_pending_cmd(struct mwifiex_adapter *adapter)
 {
         struct cmd_ctrl_node *cmd_node = NULL, *tmp_node = NULL;
-        struct mwifiex_wait_queue *wait_queue = NULL;
         unsigned long flags;
 
         /* Cancel current cmd */
-        if ((adapter->curr_cmd) && (adapter->curr_cmd->wq_buf)) {
-                wait_queue =
-                        (struct mwifiex_wait_queue *) adapter->curr_cmd->wq_buf;
+        if ((adapter->curr_cmd) && (adapter->curr_cmd->wait_q_enabled)) {
                 spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
-                adapter->curr_cmd->wq_buf = NULL;
+                adapter->curr_cmd->wait_q_enabled = false;
                 spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
-                wait_queue->status = MWIFIEX_ERROR_CMD_CANCEL;
-                mwifiex_ioctl_complete(adapter, wait_queue, -1);
+                adapter->cmd_wait_q.status = -1;
+                mwifiex_complete_cmd(adapter);
         }
         /* Cancel all pending command */
         spin_lock_irqsave(&adapter->cmd_pending_q_lock, flags);
@@ -921,12 +895,10 @@ mwifiex_cancel_all_pending_cmd(struct mwifiex_adapter *adapter)
                 list_del(&cmd_node->list);
                 spin_unlock_irqrestore(&adapter->cmd_pending_q_lock, flags);
 
-                if (cmd_node->wq_buf) {
-                        wait_queue =
-                                (struct mwifiex_wait_queue *) cmd_node->wq_buf;
-                        wait_queue->status = MWIFIEX_ERROR_CMD_CANCEL;
-                        mwifiex_ioctl_complete(adapter, wait_queue, -1);
-                        cmd_node->wq_buf = NULL;
+                if (cmd_node->wait_q_enabled) {
+                        adapter->cmd_wait_q.status = -1;
+                        mwifiex_complete_cmd(adapter);
+                        cmd_node->wait_q_enabled = false;
                 }
                 mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
                 spin_lock_irqsave(&adapter->cmd_pending_q_lock, flags);
@@ -940,7 +912,7 @@ mwifiex_cancel_all_pending_cmd(struct mwifiex_adapter *adapter)
                 list_del(&cmd_node->list);
                 spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
 
-                cmd_node->wq_buf = NULL;
+                cmd_node->wait_q_enabled = false;
                 mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
                 spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);
         }
@@ -962,8 +934,7 @@ mwifiex_cancel_all_pending_cmd(struct mwifiex_adapter *adapter)
  * are cancelled.
  */
 void
-mwifiex_cancel_pending_ioctl(struct mwifiex_adapter *adapter,
-                             struct mwifiex_wait_queue *wait_queue)
+mwifiex_cancel_pending_ioctl(struct mwifiex_adapter *adapter)
 {
         struct cmd_ctrl_node *cmd_node = NULL, *tmp_node = NULL;
         unsigned long cmd_flags;
@@ -972,45 +943,33 @@ mwifiex_cancel_pending_ioctl(struct mwifiex_adapter *adapter,
         uint16_t cancel_scan_cmd = false;
 
         if ((adapter->curr_cmd) &&
-            (adapter->curr_cmd->wq_buf == wait_queue)) {
+             (adapter->curr_cmd->wait_q_enabled)) {
                 spin_lock_irqsave(&adapter->mwifiex_cmd_lock, cmd_flags);
                 cmd_node = adapter->curr_cmd;
-                cmd_node->wq_buf = NULL;
+                cmd_node->wait_q_enabled = false;
                 cmd_node->cmd_flag |= CMD_F_CANCELED;
-                spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, cmd_flags);
-        }
-
-        spin_lock_irqsave(&adapter->mwifiex_cmd_lock, cmd_flags);
-        while (1) {
-                cmd_node = mwifiex_get_pending_ioctl_cmd(adapter, wait_queue);
-                if (!cmd_node)
-                        break;
-
                 spin_lock_irqsave(&adapter->cmd_pending_q_lock,
                                   cmd_pending_q_flags);
                 list_del(&cmd_node->list);
                 spin_unlock_irqrestore(&adapter->cmd_pending_q_lock,
                                        cmd_pending_q_flags);
-
-                cmd_node->wq_buf = NULL;
                 mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
+                spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, cmd_flags);
         }
-        spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, cmd_flags);
+
         /* Cancel all pending scan command */
         spin_lock_irqsave(&adapter->scan_pending_q_lock,
                           scan_pending_q_flags);
         list_for_each_entry_safe(cmd_node, tmp_node,
                                  &adapter->scan_pending_q, list) {
-                if (cmd_node->wq_buf == wait_queue) {
-                        list_del(&cmd_node->list);
-                        spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
-                                               scan_pending_q_flags);
-                        cmd_node->wq_buf = NULL;
-                        mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
-                        spin_lock_irqsave(&adapter->scan_pending_q_lock,
-                                          scan_pending_q_flags);
-                        cancel_scan_cmd = true;
-                }
+                list_del(&cmd_node->list);
+                spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
+                                       scan_pending_q_flags);
+                cmd_node->wait_q_enabled = false;
+                mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
+                spin_lock_irqsave(&adapter->scan_pending_q_lock,
+                                  scan_pending_q_flags);
+                cancel_scan_cmd = true;
         }
         spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
                                scan_pending_q_flags);
@@ -1020,10 +979,8 @@ mwifiex_cancel_pending_ioctl(struct mwifiex_adapter *adapter,
                 adapter->scan_processing = false;
                 spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, cmd_flags);
         }
-        wait_queue->status = MWIFIEX_ERROR_CMD_CANCEL;
-        mwifiex_ioctl_complete(adapter, wait_queue, -1);
-
-        return;
+        adapter->cmd_wait_q.status = -1;
+        mwifiex_complete_cmd(adapter);
 }
 
 /*
@@ -1127,7 +1084,6 @@ mwifiex_process_hs_config(struct mwifiex_adapter *adapter)
         adapter->is_hs_configured = false;
         mwifiex_hs_activated_event(mwifiex_get_priv(adapter,
                                    MWIFIEX_BSS_ROLE_ANY), false);
-        return;
 }
 
 /*
diff --git a/drivers/net/wireless/mwifiex/debugfs.c b/drivers/net/wireless/mwifiex/debugfs.c
index 63b09692f27d..7ddcb062f103 100644
--- a/drivers/net/wireless/mwifiex/debugfs.c
+++ b/drivers/net/wireless/mwifiex/debugfs.c
@@ -129,8 +129,8 @@ static struct mwifiex_debug_data items[] = {
          item_addr(event_received), 1},
 
         /* variables defined in struct mwifiex_adapter */
-        {"ioctl_pending", adapter_item_size(ioctl_pending),
-         adapter_item_addr(ioctl_pending), 1},
+        {"cmd_pending", adapter_item_size(cmd_pending),
+         adapter_item_addr(cmd_pending), 1},
         {"tx_pending", adapter_item_size(tx_pending),
          adapter_item_addr(tx_pending), 1},
         {"rx_pending", adapter_item_size(rx_pending),
@@ -735,8 +735,6 @@ mwifiex_dev_debugfs_init(struct mwifiex_private *priv)
         MWIFIEX_DFS_ADD_FILE(getlog);
         MWIFIEX_DFS_ADD_FILE(regrdwr);
         MWIFIEX_DFS_ADD_FILE(rdeeprom);
-
-        return;
 }
 
 /*
@@ -749,7 +747,6 @@ mwifiex_dev_debugfs_remove(struct mwifiex_private *priv)
                 return;
 
         debugfs_remove_recursive(priv->dfs_dev_dir);
-        return;
 }
 
 /*
diff --git a/drivers/net/wireless/mwifiex/decl.h b/drivers/net/wireless/mwifiex/decl.h
index c3c15f9e757e..8364b62c3298 100644
--- a/drivers/net/wireless/mwifiex/decl.h
+++ b/drivers/net/wireless/mwifiex/decl.h
@@ -61,23 +61,6 @@
 
 #define MWIFIEX_BUF_FLAG_REQUEUED_PKT      BIT(0)
 
-enum mwifiex_error_code {
-        MWIFIEX_ERROR_NO_ERROR = 0,
-        MWIFIEX_ERROR_FW_NOT_READY = 0x00000001,
-        MWIFIEX_ERROR_FW_BUSY,
-        MWIFIEX_ERROR_FW_CMDRESP,
-        MWIFIEX_ERROR_PKT_SIZE_INVALID = 0x80000001,
-        MWIFIEX_ERROR_PKT_TIMEOUT,
-        MWIFIEX_ERROR_CMD_INVALID,
-        MWIFIEX_ERROR_CMD_TIMEOUT,
-        MWIFIEX_ERROR_CMD_DNLD_FAIL,
-        MWIFIEX_ERROR_CMD_CANCEL,
-        MWIFIEX_ERROR_CMD_RESP_FAIL,
-        MWIFIEX_ERROR_ASSOC_FAIL,
-        MWIFIEX_ERROR_EVENT_UNKNOWN,
-        MWIFIEX_ERROR_INVALID_PARAMETER,
-};
-
 enum mwifiex_bss_type {
         MWIFIEX_BSS_TYPE_STA = 0,
         MWIFIEX_BSS_TYPE_UAP = 1,
@@ -112,12 +95,9 @@ struct mwifiex_802_11_ssid {
 };
 
 struct mwifiex_wait_queue {
-        u32 bss_index;
-        wait_queue_head_t *wait;
-        u16 *condition;
-        u32 start_time;
+        wait_queue_head_t wait;
+        u16 condition;
         int status;
-        u32 enabled;
 };
 
 struct mwifiex_rxinfo {
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index 2b938115b26a..f8c008f8f476 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -72,33 +72,12 @@ enum KEY_TYPE_ID {
         KEY_TYPE_ID_AES,
         KEY_TYPE_ID_WAPI,
 };
-
-enum KEY_INFO_WEP {
-        KEY_INFO_WEP_MCAST = 0x01,
-        KEY_INFO_WEP_UNICAST = 0x02,
-        KEY_INFO_WEP_ENABLED = 0x04
-};
-
-enum KEY_INFO_TKIP {
-        KEY_INFO_TKIP_MCAST = 0x01,
-        KEY_INFO_TKIP_UNICAST = 0x02,
-        KEY_INFO_TKIP_ENABLED = 0x04
-};
-
-enum KEY_INFO_AES {
-        KEY_INFO_AES_MCAST = 0x01,
-        KEY_INFO_AES_UNICAST = 0x02,
-        KEY_INFO_AES_ENABLED = 0x04
-};
+#define KEY_MCAST       BIT(0)
+#define KEY_UNICAST     BIT(1)
+#define KEY_ENABLED     BIT(2)
 
 #define WAPI_KEY_LEN                    50
 
-enum KEY_INFO_WAPI {
-        KEY_INFO_WAPI_MCAST = 0x01,
-        KEY_INFO_WAPI_UNICAST = 0x02,
-        KEY_INFO_WAPI_ENABLED = 0x04
-};
-
 #define MAX_POLL_TRIES                  100
 
 #define MAX_MULTI_INTERFACE_POLL_TRIES  1000
diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c
index 8189862da1f9..1b79a5ac9214 100644
--- a/drivers/net/wireless/mwifiex/init.c
+++ b/drivers/net/wireless/mwifiex/init.c
@@ -35,7 +35,6 @@ static int mwifiex_add_bss_prio_tbl(struct mwifiex_private *priv)
 {
         struct mwifiex_adapter *adapter = priv->adapter;
         struct mwifiex_bss_prio_node *bss_prio;
-        int status = 0;
         unsigned long flags;
 
         bss_prio = kzalloc(sizeof(struct mwifiex_bss_prio_node), GFP_KERNEL);
@@ -59,7 +58,7 @@ static int mwifiex_add_bss_prio_tbl(struct mwifiex_private *priv)
         spin_unlock_irqrestore(&adapter->bss_prio_tbl[priv->bss_priority]
                         .bss_prio_lock, flags);
 
-        return status;
+        return 0;
 }
 
 /*
@@ -300,8 +299,6 @@ static void mwifiex_init_adapter(struct mwifiex_adapter *adapter)
         adapter->adhoc_awake_period = 0;
         memset(&adapter->arp_filter, 0, sizeof(adapter->arp_filter));
         adapter->arp_filter_size = 0;
-
-        return;
 }
 
 /*
@@ -340,8 +337,6 @@ mwifiex_free_adapter(struct mwifiex_adapter *adapter)
         adapter->if_ops.cleanup_if(adapter);
 
         dev_kfree_skb_any(adapter->sleep_cfm);
-
-        return;
 }
 
 /*
@@ -429,8 +424,6 @@ void mwifiex_free_lock_list(struct mwifiex_adapter *adapter)
                         list_del(&priv->rx_reorder_tbl_ptr);
                 }
         }
-
-        return;
 }
 
 /*
diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
index 7a9e0b5962ed..60d25c690c07 100644
--- a/drivers/net/wireless/mwifiex/join.c
+++ b/drivers/net/wireless/mwifiex/join.c
@@ -590,11 +590,10 @@ int mwifiex_cmd_802_11_associate(struct mwifiex_private *priv,
  * an association success (0) or failure (non-zero).
  */
 int mwifiex_ret_802_11_associate(struct mwifiex_private *priv,
-                             struct host_cmd_ds_command *resp, void *wq_buf)
+                             struct host_cmd_ds_command *resp)
 {
+        struct mwifiex_adapter *adapter = priv->adapter;
         int ret = 0;
-        struct mwifiex_wait_queue *wait_queue =
-                (struct mwifiex_wait_queue *) wq_buf;
         struct ieee_types_assoc_rsp *assoc_rsp;
         struct mwifiex_bssdescriptor *bss_desc;
         u8 enable_data = true;
@@ -718,16 +717,11 @@ int mwifiex_ret_802_11_associate(struct mwifiex_private *priv,
 
 done:
         /* Need to indicate IOCTL complete */
-        if (wait_queue) {
-                if (ret) {
-                        if (assoc_rsp->status_code)
-                                wait_queue->status =
-                                        le16_to_cpu(assoc_rsp->status_code);
-                        else
-                                wait_queue->status = MWIFIEX_ERROR_ASSOC_FAIL;
-                } else {
-                        wait_queue->status = MWIFIEX_ERROR_NO_ERROR;
-                }
+        if (adapter->curr_cmd->wait_q_enabled) {
+                if (ret)
+                        adapter->cmd_wait_q.status = -1;
+                else
+                        adapter->cmd_wait_q.status = 0;
         }
 
         return ret;
@@ -885,9 +879,9 @@ mwifiex_cmd_802_11_ad_hoc_start(struct mwifiex_private *priv,
         mwifiex_get_active_data_rates(priv, adhoc_start->DataRate);
         if ((adapter->adhoc_start_band & BAND_G) &&
             (priv->curr_pkt_filter & HostCmd_ACT_MAC_ADHOC_G_PROTECTION_ON)) {
-                ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_MAC_CONTROL,
-                                          HostCmd_ACT_GEN_SET,
-                                          0, NULL, &priv->curr_pkt_filter);
+                ret = mwifiex_send_cmd_async(priv, HostCmd_CMD_MAC_CONTROL,
+                                             HostCmd_ACT_GEN_SET, 0,
+                                             &priv->curr_pkt_filter);
 
                 if (ret) {
                         dev_err(adapter->dev,
@@ -1066,9 +1060,9 @@ mwifiex_cmd_802_11_ad_hoc_join(struct mwifiex_private *priv,
                         priv->
                         curr_pkt_filter | HostCmd_ACT_MAC_ADHOC_G_PROTECTION_ON;
 
-                ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_MAC_CONTROL,
-                                          HostCmd_ACT_GEN_SET, 0, NULL,
-                                          &curr_pkt_filter);
+                ret = mwifiex_send_cmd_async(priv, HostCmd_CMD_MAC_CONTROL,
+                                             HostCmd_ACT_GEN_SET, 0,
+                                             &curr_pkt_filter);
                 if (ret) {
                         dev_err(priv->adapter->dev,
                                "ADHOC_J_CMD: G Protection config failed\n");
@@ -1192,11 +1186,10 @@ mwifiex_cmd_802_11_ad_hoc_join(struct mwifiex_private *priv,
  * saves the beacon buffer.
  */
 int mwifiex_ret_802_11_ad_hoc(struct mwifiex_private *priv,
-                              struct host_cmd_ds_command *resp, void *wq_buf)
+                              struct host_cmd_ds_command *resp)
 {
         int ret = 0;
-        struct mwifiex_wait_queue *wait_queue =
-                (struct mwifiex_wait_queue *) wq_buf;
+        struct mwifiex_adapter *adapter = priv->adapter;
         struct host_cmd_ds_802_11_ad_hoc_result *adhoc_result;
         struct mwifiex_bssdescriptor *bss_desc;
         u16 command = le16_to_cpu(resp->command);
@@ -1264,11 +1257,11 @@ int mwifiex_ret_802_11_ad_hoc(struct mwifiex_private *priv,
 
 done:
         /* Need to indicate IOCTL complete */
-        if (wait_queue) {
+        if (adapter->curr_cmd->wait_q_enabled) {
                 if (ret)
-                        wait_queue->status = MWIFIEX_ERROR_ASSOC_FAIL;
+                        adapter->cmd_wait_q.status = -1;
                 else
-                        wait_queue->status = MWIFIEX_ERROR_NO_ERROR;
+                        adapter->cmd_wait_q.status = 0;
 
         }
 
@@ -1283,7 +1276,7 @@ done:
  * command to firmware.
  */
 int mwifiex_associate(struct mwifiex_private *priv,
-                      void *wait_queue, struct mwifiex_bssdescriptor *bss_desc)
+                      struct mwifiex_bssdescriptor *bss_desc)
 {
         int ret = 0;
         u8 current_bssid[ETH_ALEN];
@@ -1301,9 +1294,8 @@ int mwifiex_associate(struct mwifiex_private *priv,
            retrieval */
         priv->assoc_rsp_size = 0;
 
-        ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_802_11_ASSOCIATE,
-                                  HostCmd_ACT_GEN_SET, 0, wait_queue,
-                                  bss_desc);
+        ret = mwifiex_send_cmd_sync(priv, HostCmd_CMD_802_11_ASSOCIATE,
+                                    HostCmd_ACT_GEN_SET, 0, bss_desc);
 
         return ret;
 }
@@ -1315,7 +1307,7 @@ int mwifiex_associate(struct mwifiex_private *priv,
  */
 int
 mwifiex_adhoc_start(struct mwifiex_private *priv,
-                    void *wait_queue, struct mwifiex_802_11_ssid *adhoc_ssid)
+                    struct mwifiex_802_11_ssid *adhoc_ssid)
 {
         int ret = 0;
 
@@ -1326,9 +1318,8 @@ mwifiex_adhoc_start(struct mwifiex_private *priv,
         dev_dbg(priv->adapter->dev, "info: curr_bss_params.band = %d\n",
                priv->curr_bss_params.band);
 
-        ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_802_11_AD_HOC_START,
-                                  HostCmd_ACT_GEN_SET, 0, wait_queue,
-                                  adhoc_ssid);
+        ret = mwifiex_send_cmd_sync(priv, HostCmd_CMD_802_11_AD_HOC_START,
+                                    HostCmd_ACT_GEN_SET, 0, adhoc_ssid);
 
         return ret;
 }
@@ -1340,7 +1331,7 @@ mwifiex_adhoc_start(struct mwifiex_private *priv,
  * if already not connected to the requested SSID.
  */
 int mwifiex_adhoc_join(struct mwifiex_private *priv,
-                       void *wait_queue, struct mwifiex_bssdescriptor *bss_desc)
+                       struct mwifiex_bssdescriptor *bss_desc)
 {
         int ret = 0;
 
@@ -1369,9 +1360,8 @@ int mwifiex_adhoc_join(struct mwifiex_private *priv,
         dev_dbg(priv->adapter->dev, "info: curr_bss_params.band = %c\n",
                priv->curr_bss_params.band);
 
-        ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_802_11_AD_HOC_JOIN,
-                                  HostCmd_ACT_GEN_SET, 0, wait_queue,
-                                  bss_desc);
+        ret = mwifiex_send_cmd_sync(priv, HostCmd_CMD_802_11_AD_HOC_JOIN,
+                                    HostCmd_ACT_GEN_SET, 0, bss_desc);
 
         return ret;
 }
@@ -1380,9 +1370,7 @@ int mwifiex_adhoc_join(struct mwifiex_private *priv,
  * This function deauthenticates/disconnects from infra network by sending
  * deauthentication request.
  */
-static int mwifiex_deauthenticate_infra(struct mwifiex_private *priv,
-                                        struct mwifiex_wait_queue *wait,
-                                        u8 *mac)
+static int mwifiex_deauthenticate_infra(struct mwifiex_private *priv, u8 *mac)
 {
         u8 mac_address[ETH_ALEN];
         int ret = 0;
@@ -1400,11 +1388,8 @@ static int mwifiex_deauthenticate_infra(struct mwifiex_private *priv,
                        bss_descriptor.mac_address, ETH_ALEN);
         }
 
-        ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_802_11_DEAUTHENTICATE,
-                                  HostCmd_ACT_GEN_SET, 0, wait, &mac_address);
-
-        if (!ret && wait)
-                ret = -EINPROGRESS;
+        ret = mwifiex_send_cmd_sync(priv, HostCmd_CMD_802_11_DEAUTHENTICATE,
+                                    HostCmd_ACT_GEN_SET, 0, &mac_address);
 
         return ret;
 }
@@ -1415,26 +1400,23 @@ static int mwifiex_deauthenticate_infra(struct mwifiex_private *priv,
  * In case of infra made, it sends deauthentication request, and
  * in case of ad-hoc mode, a stop network request is sent to the firmware.
  */
-int mwifiex_deauthenticate(struct mwifiex_private *priv,
-                           struct mwifiex_wait_queue *wait, u8 *mac)
+int mwifiex_deauthenticate(struct mwifiex_private *priv, u8 *mac)
 {
         int ret = 0;
 
         if (priv->media_connected) {
                 if (priv->bss_mode == NL80211_IFTYPE_STATION) {
-                        ret = mwifiex_deauthenticate_infra(priv, wait, mac);
+                        ret = mwifiex_deauthenticate_infra(priv, mac);
                 } else if (priv->bss_mode == NL80211_IFTYPE_ADHOC) {
-                        ret = mwifiex_prepare_cmd(priv,
-                                        HostCmd_CMD_802_11_AD_HOC_STOP,
-                                        HostCmd_ACT_GEN_SET, 0, wait, NULL);
-
-                        if (!ret && wait)
-                                ret = -EINPROGRESS;
+                        ret = mwifiex_send_cmd_sync(priv,
+                                                HostCmd_CMD_802_11_AD_HOC_STOP,
+                                                HostCmd_ACT_GEN_SET, 0, NULL);
                 }
         }
 
         return ret;
 }
+EXPORT_SYMBOL_GPL(mwifiex_deauthenticate);
 
 /*
  * This function converts band to radio type used in channel TLV.
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index ed89ca41a902..77abfc3d6c32 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -505,7 +505,6 @@ mwifiex_fill_buffer(struct sk_buff *skb)
          */
         do_gettimeofday(&tv);
         skb->tstamp = timeval_to_ktime(tv);
-        return;
 }
 
 /*
@@ -597,16 +596,23 @@ mwifiex_set_mac_address(struct net_device *dev, void *addr)
 {
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
         struct sockaddr *hw_addr = (struct sockaddr *) addr;
+        int ret = 0;
 
         memcpy(priv->curr_addr, hw_addr->sa_data, ETH_ALEN);
 
-        if (mwifiex_request_set_mac_address(priv)) {
-                dev_err(priv->adapter->dev, "set MAC address failed\n");
-                return -EFAULT;
-        }
+        /* Send request to firmware */
+        ret = mwifiex_send_cmd_sync(priv, HostCmd_CMD_802_11_MAC_ADDRESS,
+                                    HostCmd_ACT_GEN_SET, 0, NULL);
+
+        if (!ret)
+                memcpy(priv->netdev->dev_addr, priv->curr_addr, ETH_ALEN);
+        else
+                dev_err(priv->adapter->dev, "set mac address failed: ret=%d"
+                                            "\n", ret);
+
         memcpy(dev->dev_addr, priv->curr_addr, ETH_ALEN);
 
-        return 0;
+        return ret;
 }
 
 /*
@@ -615,7 +621,20 @@ mwifiex_set_mac_address(struct net_device *dev, void *addr)
 static void mwifiex_set_multicast_list(struct net_device *dev)
 {
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
-        mwifiex_request_set_multicast_list(priv, dev);
+        struct mwifiex_multicast_list mcast_list;
+
+        if (dev->flags & IFF_PROMISC) {
+                mcast_list.mode = MWIFIEX_PROMISC_MODE;
+        } else if (dev->flags & IFF_ALLMULTI ||
+                   netdev_mc_count(dev) > MWIFIEX_MAX_MULTICAST_LIST_SIZE) {
+                mcast_list.mode = MWIFIEX_ALL_MULTI_MODE;
+        } else {
+                mcast_list.mode = MWIFIEX_MULTICAST_MODE;
+                if (netdev_mc_count(dev))
+                        mcast_list.num_multicast_addr =
+                                mwifiex_copy_mcast_addr(&mcast_list, dev);
+        }
+        mwifiex_request_set_multicast_list(priv, &mcast_list);
 }
 
 /*
@@ -677,9 +696,6 @@ mwifiex_init_priv_params(struct mwifiex_private *priv, struct net_device *dev)
 {
         dev->netdev_ops = &mwifiex_netdev_ops;
         /* Initialize private structure */
-        init_waitqueue_head(&priv->ioctl_wait_q);
-        init_waitqueue_head(&priv->cmd_wait_q);
-        init_waitqueue_head(&priv->w_stats_wait_q);
         priv->current_key_index = 0;
         priv->media_connected = false;
         memset(&priv->nick_name, 0, sizeof(priv->nick_name));
@@ -803,35 +819,7 @@ mwifiex_remove_interface(struct mwifiex_adapter *adapter, u8 bss_index)
         wiphy_unregister(priv->wdev->wiphy);
         wiphy_free(priv->wdev->wiphy);
         kfree(priv->wdev);
-
-        return;
-}
-
-/*
- * Sends IOCTL request to shutdown firmware.
- *
- * This function allocates the IOCTL request buffer, fills it
- * with requisite parameters and calls the IOCTL handler.
- */
-int mwifiex_shutdown_fw(struct mwifiex_private *priv, u8 wait_option)
-{
-        struct mwifiex_wait_queue *wait = NULL;
-        int status = 0;
-
-        /* Allocate an IOCTL request buffer */
-        wait = mwifiex_alloc_fill_wait_queue(priv, wait_option);
-        if (!wait)
-                return -ENOMEM;
-
-        status = mwifiex_misc_ioctl_init_shutdown(priv->adapter, wait,
-                                                  MWIFIEX_FUNC_SHUTDOWN);
-
-        status = mwifiex_request_ioctl(priv, wait, status, wait_option);
-
-        kfree(wait);
-        return status;
 }
-EXPORT_SYMBOL_GPL(mwifiex_shutdown_fw);
 
 /*
  * This function check if command is pending.
@@ -927,6 +915,10 @@ mwifiex_add_card(void *card, struct semaphore *sem,
         adapter->is_suspended = false;
         adapter->hs_activated = false;
         init_waitqueue_head(&adapter->hs_activate_wait_q);
+        adapter->cmd_wait_q_required = false;
+        init_waitqueue_head(&adapter->cmd_wait_q.wait);
+        adapter->cmd_wait_q.condition = false;
+        adapter->cmd_wait_q.status = 0;
 
         /* Create workqueue */
         adapter->workqueue = create_workqueue("MWIFIEX_WORK_QUEUE");
@@ -1038,12 +1030,12 @@ int mwifiex_remove_card(struct mwifiex_adapter *adapter, struct semaphore *sem)
         dev_dbg(adapter->dev, "cmd: mwifiex_shutdown_drv done\n");
         if (atomic_read(&adapter->rx_pending) ||
             atomic_read(&adapter->tx_pending) ||
-            atomic_read(&adapter->ioctl_pending)) {
+            atomic_read(&adapter->cmd_pending)) {
                 dev_err(adapter->dev, "rx_pending=%d, tx_pending=%d, "
-                       "ioctl_pending=%d\n",
+                       "cmd_pending=%d\n",
                        atomic_read(&adapter->rx_pending),
                        atomic_read(&adapter->tx_pending),
-                       atomic_read(&adapter->ioctl_pending));
+                       atomic_read(&adapter->cmd_pending));
         }
 
         /* Remove interface */
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index 43ff149de9db..2d296dcc210e 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -42,11 +42,8 @@ extern const char driver_version[];
 extern struct mwifiex_adapter *g_adapter;
 
 enum {
-        MWIFIEX_NO_WAIT,
-        MWIFIEX_IOCTL_WAIT,
-        MWIFIEX_CMD_WAIT,
-        MWIFIEX_PROC_WAIT,
-        MWIFIEX_WSTATS_WAIT
+        MWIFIEX_ASYNC_CMD,
+        MWIFIEX_SYNC_CMD
 };
 
 #define DRV_MODE_STA       0x1
@@ -468,10 +465,6 @@ struct mwifiex_private {
         u32 curr_bcn_size;
         /* spin lock for beacon buffer */
         spinlock_t curr_bcn_buf_lock;
-        u16 ioctl_wait_q_woken;
-        wait_queue_head_t ioctl_wait_q;
-        u16 cmd_wait_q_woken;
-        wait_queue_head_t cmd_wait_q;
         struct wireless_dev *wdev;
         struct mwifiex_chan_freq_power cfp;
         char version_str[128];
@@ -480,8 +473,6 @@ struct mwifiex_private {
 #endif
         u8 nick_name[16];
         struct iw_statistics w_stats;
-        u16 w_stats_wait_q_woken;
-        wait_queue_head_t w_stats_wait_q;
         u16 current_key_index;
         struct semaphore async_sem;
         u8 scan_pending_on_block;
@@ -552,7 +543,7 @@ struct cmd_ctrl_node {
         struct sk_buff *cmd_skb;
         struct sk_buff *resp_skb;
         void *data_buf;
-        void *wq_buf;
+        u32 wait_q_enabled;
         struct sk_buff *skb;
 };
 
@@ -590,7 +581,7 @@ struct mwifiex_adapter {
         struct mwifiex_if_ops if_ops;
         atomic_t rx_pending;
         atomic_t tx_pending;
-        atomic_t ioctl_pending;
+        atomic_t cmd_pending;
         struct workqueue_struct *workqueue;
         struct work_struct main_work;
         struct mwifiex_bss_prio_tbl bss_prio_tbl[MWIFIEX_MAX_BSS_NUM];
@@ -684,6 +675,8 @@ struct mwifiex_adapter {
         struct mwifiex_dbg dbg;
         u8 arp_filter[ARP_FILTER_MAX_BUF_SIZE];
         u32 arp_filter_size;
+        u16 cmd_wait_q_required;
+        struct mwifiex_wait_queue cmd_wait_q;
 };
 
 int mwifiex_init_lock_list(struct mwifiex_adapter *adapter);
@@ -707,29 +700,23 @@ int mwifiex_recv_packet(struct mwifiex_adapter *, struct sk_buff *skb);
 
 int mwifiex_process_event(struct mwifiex_adapter *adapter);
 
-int mwifiex_ioctl_complete(struct mwifiex_adapter *adapter,
-                           struct mwifiex_wait_queue *ioctl_wq,
-                           int status);
+int mwifiex_complete_cmd(struct mwifiex_adapter *adapter);
 
-int mwifiex_prepare_cmd(struct mwifiex_private *priv,
-                        uint16_t cmd_no,
-                        u16 cmd_action,
-                        u32 cmd_oid,
-                        void *wait_queue, void *data_buf);
+int mwifiex_send_cmd_async(struct mwifiex_private *priv, uint16_t cmd_no,
+                           u16 cmd_action, u32 cmd_oid, void *data_buf);
+
+int mwifiex_send_cmd_sync(struct mwifiex_private *priv, uint16_t cmd_no,
+                          u16 cmd_action, u32 cmd_oid, void *data_buf);
 
 void mwifiex_cmd_timeout_func(unsigned long function_context);
 
-int mwifiex_misc_ioctl_init_shutdown(struct mwifiex_adapter *adapter,
-                                     struct mwifiex_wait_queue *wait_queue,
-                                     u32 func_init_shutdown);
 int mwifiex_get_debug_info(struct mwifiex_private *,
                            struct mwifiex_debug_info *);
 
 int mwifiex_alloc_cmd_buffer(struct mwifiex_adapter *adapter);
 int mwifiex_free_cmd_buffer(struct mwifiex_adapter *adapter);
 void mwifiex_cancel_all_pending_cmd(struct mwifiex_adapter *adapter);
-void mwifiex_cancel_pending_ioctl(struct mwifiex_adapter *adapter,
-                                  struct mwifiex_wait_queue *ioctl_wq);
+void mwifiex_cancel_pending_ioctl(struct mwifiex_adapter *adapter);
 
 void mwifiex_insert_cmd_to_free_q(struct mwifiex_adapter *adapter,
                                   struct cmd_ctrl_node *cmd_node);
@@ -772,24 +759,20 @@ int mwifiex_sta_prepare_cmd(struct mwifiex_private *, uint16_t cmd_no,
                             u16 cmd_action, u32 cmd_oid,
                             void *data_buf, void *cmd_buf);
 int mwifiex_process_sta_cmdresp(struct mwifiex_private *, u16 cmdresp_no,
-                                void *cmd_buf, void *ioctl);
+                                void *cmd_buf);
 int mwifiex_process_sta_rx_packet(struct mwifiex_adapter *,
                                   struct sk_buff *skb);
 int mwifiex_process_sta_event(struct mwifiex_private *);
 void *mwifiex_process_sta_txpd(struct mwifiex_private *, struct sk_buff *skb);
 int mwifiex_sta_init_cmd(struct mwifiex_private *, u8 first_sta);
-int mwifiex_scan_networks(struct mwifiex_private *priv, void *wait_queue,
-                          u16 action,
-                          const struct mwifiex_user_scan_cfg
-                          *user_scan_in, struct mwifiex_scan_resp *);
-int mwifiex_cmd_802_11_scan(struct mwifiex_private *priv,
-                            struct host_cmd_ds_command *cmd,
+int mwifiex_scan_networks(struct mwifiex_private *priv,
+                          const struct mwifiex_user_scan_cfg *user_scan_in);
+int mwifiex_cmd_802_11_scan(struct host_cmd_ds_command *cmd,
                             void *data_buf);
 void mwifiex_queue_scan_cmd(struct mwifiex_private *priv,
                             struct cmd_ctrl_node *cmd_node);
 int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
-                            struct host_cmd_ds_command *resp,
-                            void *wait_queue);
+                            struct host_cmd_ds_command *resp);
 s32 mwifiex_find_ssid_in_list(struct mwifiex_private *priv,
                                 struct mwifiex_802_11_ssid *ssid, u8 *bssid,
                                 u32 mode);
@@ -799,23 +782,20 @@ int mwifiex_find_best_network(struct mwifiex_private *priv,
                               struct mwifiex_ssid_bssid *req_ssid_bssid);
 s32 mwifiex_ssid_cmp(struct mwifiex_802_11_ssid *ssid1,
                        struct mwifiex_802_11_ssid *ssid2);
-int mwifiex_associate(struct mwifiex_private *priv, void *wait_queue,
+int mwifiex_associate(struct mwifiex_private *priv,
                       struct mwifiex_bssdescriptor *bss_desc);
 int mwifiex_cmd_802_11_associate(struct mwifiex_private *priv,
                                  struct host_cmd_ds_command
                                  *cmd, void *data_buf);
 int mwifiex_ret_802_11_associate(struct mwifiex_private *priv,
-                                 struct host_cmd_ds_command *resp,
-                                 void *wait_queue);
+                                 struct host_cmd_ds_command *resp);
 void mwifiex_reset_connect_state(struct mwifiex_private *priv);
 void mwifiex_2040_coex_event(struct mwifiex_private *priv);
 u8 mwifiex_band_to_radio_type(u8 band);
-int mwifiex_deauthenticate(struct mwifiex_private *priv,
-                           struct mwifiex_wait_queue *wait_queue,
-                           u8 *mac);
-int mwifiex_adhoc_start(struct mwifiex_private *priv, void *wait_queue,
+int mwifiex_deauthenticate(struct mwifiex_private *priv, u8 *mac);
+int mwifiex_adhoc_start(struct mwifiex_private *priv,
                         struct mwifiex_802_11_ssid *adhoc_ssid);
-int mwifiex_adhoc_join(struct mwifiex_private *priv, void *wait_queue,
+int mwifiex_adhoc_join(struct mwifiex_private *priv,
                        struct mwifiex_bssdescriptor *bss_desc);
 int mwifiex_cmd_802_11_ad_hoc_start(struct mwifiex_private *priv,
                                     struct host_cmd_ds_command *cmd,
@@ -824,11 +804,8 @@ int mwifiex_cmd_802_11_ad_hoc_join(struct mwifiex_private *priv,
                                    struct host_cmd_ds_command *cmd,
                                    void *data_buf);
 int mwifiex_ret_802_11_ad_hoc(struct mwifiex_private *priv,
-                              struct host_cmd_ds_command *resp,
-                              void *wait_queue);
-int mwifiex_cmd_802_11_bg_scan_query(struct mwifiex_private *priv,
-                                     struct host_cmd_ds_command *cmd,
-                                     void *data_buf);
+                              struct host_cmd_ds_command *resp);
+int mwifiex_cmd_802_11_bg_scan_query(struct host_cmd_ds_command *cmd);
 struct mwifiex_chan_freq_power *
                         mwifiex_get_cfp_by_band_and_channel_from_cfg80211(
                                                 struct mwifiex_private *priv,
@@ -836,20 +813,16 @@ struct mwifiex_chan_freq_power *
 struct mwifiex_chan_freq_power *mwifiex_get_cfp_by_band_and_freq_from_cfg80211(
                                                 struct mwifiex_private *priv,
                                                 u8 band, u32 freq);
-u32 mwifiex_index_to_data_rate(struct mwifiex_adapter *adapter, u8 index,
-                                 u8 ht_info);
+u32 mwifiex_index_to_data_rate(u8 index, u8 ht_info);
 u32 mwifiex_find_freq_from_band_chan(u8, u8);
 int mwifiex_cmd_append_vsie_tlv(struct mwifiex_private *priv, u16 vsie_mask,
                                 u8 **buffer);
-u32 mwifiex_index_to_data_rate(struct mwifiex_adapter *adapter, u8 index,
-                                 u8 ht_info);
 u32 mwifiex_get_active_data_rates(struct mwifiex_private *priv,
                                     u8 *rates);
 u32 mwifiex_get_supported_rates(struct mwifiex_private *priv, u8 *rates);
-u8 mwifiex_data_rate_to_index(struct mwifiex_adapter *adapter, u32 rate);
+u8 mwifiex_data_rate_to_index(u32 rate);
 u8 mwifiex_is_rate_auto(struct mwifiex_private *priv);
-int mwifiex_get_rate_index(struct mwifiex_adapter *adapter,
-                           u16 *rateBitmap, int size);
+int mwifiex_get_rate_index(u16 *rateBitmap, int size);
 extern u16 region_code_index[MWIFIEX_MAX_REGION_CODE];
 void mwifiex_save_curr_bcn(struct mwifiex_private *priv);
 void mwifiex_free_curr_bcn(struct mwifiex_private *priv);
@@ -943,52 +916,34 @@ mwifiex_netdev_get_priv(struct net_device *dev)
         return (struct mwifiex_private *) (*(unsigned long *) netdev_priv(dev));
 }
 
-struct mwifiex_wait_queue *mwifiex_alloc_fill_wait_queue(
-                                struct mwifiex_private *,
-                                u8 wait_option);
 struct mwifiex_private *mwifiex_bss_index_to_priv(struct mwifiex_adapter
                                                 *adapter, u8 bss_index);
-int mwifiex_shutdown_fw(struct mwifiex_private *, u8);
-
+int mwifiex_init_shutdown_fw(struct mwifiex_private *priv,
+                             u32 func_init_shutdown);
 int mwifiex_add_card(void *, struct semaphore *, struct mwifiex_if_ops *);
 int mwifiex_remove_card(struct mwifiex_adapter *, struct semaphore *);
 
 void mwifiex_get_version(struct mwifiex_adapter *adapter, char *version,
                          int maxlen);
-int mwifiex_request_set_mac_address(struct mwifiex_private *priv);
-void mwifiex_request_set_multicast_list(struct mwifiex_private *priv,
-                                        struct net_device *dev);
-int mwifiex_request_ioctl(struct mwifiex_private *priv,
-                          struct mwifiex_wait_queue *req,
-                          int, u8 wait_option);
-int mwifiex_disconnect(struct mwifiex_private *, u8, u8 *);
+int mwifiex_request_set_multicast_list(struct mwifiex_private *priv,
+                        struct mwifiex_multicast_list *mcast_list);
+int mwifiex_copy_mcast_addr(struct mwifiex_multicast_list *mlist,
+                            struct net_device *dev);
+int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter);
 int mwifiex_bss_start(struct mwifiex_private *priv,
-                      u8 wait_option,
                       struct mwifiex_ssid_bssid *ssid_bssid);
 int mwifiex_set_hs_params(struct mwifiex_private *priv,
-                              u16 action, u8 wait_option,
+                              u16 action, int cmd_type,
                               struct mwifiex_ds_hs_cfg *hscfg);
-int mwifiex_cancel_hs(struct mwifiex_private *priv, u8 wait_option);
+int mwifiex_cancel_hs(struct mwifiex_private *priv, int cmd_type);
 int mwifiex_enable_hs(struct mwifiex_adapter *adapter);
-void mwifiex_process_ioctl_resp(struct mwifiex_private *priv,
-                                struct mwifiex_wait_queue *req);
-u32 mwifiex_get_mode(struct mwifiex_private *priv, u8 wait_option);
 int mwifiex_get_signal_info(struct mwifiex_private *priv,
-                            u8 wait_option,
                             struct mwifiex_ds_get_signal *signal);
 int mwifiex_drv_get_data_rate(struct mwifiex_private *priv,
                               struct mwifiex_rate_cfg *rate);
-int mwifiex_get_channel_list(struct mwifiex_private *priv,
-                             u8 wait_option,
-                             struct mwifiex_chan_list *chanlist);
-int mwifiex_get_scan_table(struct mwifiex_private *priv,
-                           u8 wait_option,
-                           struct mwifiex_scan_resp *scanresp);
-int mwifiex_enable_wep_key(struct mwifiex_private *priv, u8 wait_option);
-int mwifiex_find_best_bss(struct mwifiex_private *priv, u8 wait_option,
+int mwifiex_find_best_bss(struct mwifiex_private *priv,
                           struct mwifiex_ssid_bssid *ssid_bssid);
 int mwifiex_request_scan(struct mwifiex_private *priv,
-                         u8 wait_option,
                          struct mwifiex_802_11_ssid *req_ssid);
 int mwifiex_set_user_scan_ioctl(struct mwifiex_private *priv,
                                 struct mwifiex_user_scan_cfg *scan_req);
@@ -1024,27 +979,22 @@ int mwifiex_set_tx_rate_cfg(struct mwifiex_private *priv, int tx_rate_index);
 
 int mwifiex_get_tx_rate_cfg(struct mwifiex_private *priv, int *tx_rate_index);
 
-int mwifiex_drv_set_power(struct mwifiex_private *priv, bool power_on);
+int mwifiex_drv_set_power(struct mwifiex_private *priv, u32 *ps_mode);
 
 int mwifiex_drv_get_driver_version(struct mwifiex_adapter *adapter,
                                    char *version, int max_len);
 
-int mwifiex_set_tx_power(struct mwifiex_private *priv, int type, int dbm);
+int mwifiex_set_tx_power(struct mwifiex_private *priv,
+                         struct mwifiex_power_cfg *power_cfg);
 
 int mwifiex_main_process(struct mwifiex_adapter *);
 
-int mwifiex_bss_ioctl_channel(struct mwifiex_private *,
-                              u16 action,
-                              struct mwifiex_chan_freq_power *cfp);
+int mwifiex_bss_set_channel(struct mwifiex_private *,
+                            struct mwifiex_chan_freq_power *cfp);
 int mwifiex_bss_ioctl_find_bss(struct mwifiex_private *,
-                               struct mwifiex_wait_queue *,
                                struct mwifiex_ssid_bssid *);
-int mwifiex_radio_ioctl_band_cfg(struct mwifiex_private *,
-                                 u16 action,
-                                 struct mwifiex_ds_band_cfg *);
-int mwifiex_snmp_mib_ioctl(struct mwifiex_private *,
-                           struct mwifiex_wait_queue *,
-                           u32 cmd_oid, u16 action, u32 *value);
+int mwifiex_set_radio_band_cfg(struct mwifiex_private *,
+                         struct mwifiex_ds_band_cfg *);
 int mwifiex_get_bss_info(struct mwifiex_private *,
                          struct mwifiex_bss_info *);
 
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 6bb52d0e6cfa..84742715893f 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -178,9 +178,8 @@ mwifiex_ssid_cmp(struct mwifiex_802_11_ssid *ssid1,
  * with requisite parameters and calls the IOCTL handler.
  */
 int mwifiex_find_best_bss(struct mwifiex_private *priv,
-                          u8 wait_option, struct mwifiex_ssid_bssid *ssid_bssid)
+                          struct mwifiex_ssid_bssid *ssid_bssid)
 {
-        struct mwifiex_wait_queue *wait = NULL;
         struct mwifiex_ssid_bssid tmp_ssid_bssid;
         int ret = 0;
         u8 *mac = NULL;
@@ -188,14 +187,9 @@ int mwifiex_find_best_bss(struct mwifiex_private *priv,
         if (!ssid_bssid)
                 return -1;
 
-        /* Allocate wait request buffer */
-        wait = mwifiex_alloc_fill_wait_queue(priv, wait_option);
-        if (!wait)
-                return -ENOMEM;
-
         memcpy(&tmp_ssid_bssid, ssid_bssid,
                sizeof(struct mwifiex_ssid_bssid));
-        ret = mwifiex_bss_ioctl_find_bss(priv, wait, &tmp_ssid_bssid);
+        ret = mwifiex_bss_ioctl_find_bss(priv, &tmp_ssid_bssid);
 
         if (!ret) {
                 memcpy(ssid_bssid, &tmp_ssid_bssid,
@@ -205,7 +199,6 @@ int mwifiex_find_best_bss(struct mwifiex_private *priv,
                                 " %pM\n", ssid_bssid->ssid.ssid, mac);
         }
 
-        kfree(wait);
         return ret;
 }
 
@@ -221,22 +214,14 @@ int mwifiex_find_best_bss(struct mwifiex_private *priv,
 int mwifiex_set_user_scan_ioctl(struct mwifiex_private *priv,
                                 struct mwifiex_user_scan_cfg *scan_req)
 {
-        struct mwifiex_wait_queue *wait = NULL;
         int status = 0;
-        u8 wait_option = MWIFIEX_IOCTL_WAIT;
-
-        /* Allocate an IOCTL request buffer */
-        wait = mwifiex_alloc_fill_wait_queue(priv, wait_option);
-        if (!wait)
-                return -ENOMEM;
 
-        status = mwifiex_scan_networks(priv, wait, HostCmd_ACT_GEN_SET,
-                                       scan_req, NULL);
+        priv->adapter->cmd_wait_q.condition = false;
 
-        status = mwifiex_request_ioctl(priv, wait, status, wait_option);
+        status = mwifiex_scan_networks(priv, scan_req);
+        if (!status)
+                status = mwifiex_wait_queue_complete(priv->adapter);
 
-        if (wait && (status != -EINPROGRESS))
-                kfree(wait);
         return status;
 }
 
@@ -674,7 +659,7 @@ mwifiex_scan_create_channel_list(struct mwifiex_private *priv,
  * along with the other TLVs, to the firmware.
  */
 static int
-mwifiex_scan_channel_list(struct mwifiex_private *priv, void *wait_buf,
+mwifiex_scan_channel_list(struct mwifiex_private *priv,
                           u32 max_chan_per_scan, u8 filtered_scan,
                           struct mwifiex_scan_cmd_config *scan_cfg_out,
                           struct mwifiex_ie_types_chan_list_param_set
@@ -808,9 +793,9 @@ mwifiex_scan_channel_list(struct mwifiex_private *priv, void *wait_buf,
 
                 /* Send the scan command to the firmware with the specified
                    cfg */
-                ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_802_11_SCAN,
-                                          HostCmd_ACT_GEN_SET,
-                                          0, wait_buf, scan_cfg_out);
+                ret = mwifiex_send_cmd_async(priv, HostCmd_CMD_802_11_SCAN,
+                                             HostCmd_ACT_GEN_SET, 0,
+                                             scan_cfg_out);
                 if (ret)
                         break;
         }
@@ -2271,9 +2256,7 @@ mwifiex_scan_delete_ssid_table_entry(struct mwifiex_private *priv,
  * update the internal driver scan table.
  */
 int mwifiex_scan_networks(struct mwifiex_private *priv,
-                          void *wait_buf, u16 action,
-                          const struct mwifiex_user_scan_cfg *user_scan_in,
-                          struct mwifiex_scan_resp *scan_resp)
+                          const struct mwifiex_user_scan_cfg *user_scan_in)
 {
         int ret = 0;
         struct mwifiex_adapter *adapter = priv->adapter;
@@ -2288,18 +2271,7 @@ int mwifiex_scan_networks(struct mwifiex_private *priv,
         u8 max_chan_per_scan;
         unsigned long flags;
 
-        if (action == HostCmd_ACT_GEN_GET) {
-                if (scan_resp) {
-                        scan_resp->scan_table = (u8 *) adapter->scan_table;
-                        scan_resp->num_in_scan_table =
-                                adapter->num_in_scan_table;
-                } else {
-                        ret = -1;
-                }
-                return ret;
-        }
-
-        if (adapter->scan_processing && action == HostCmd_ACT_GEN_SET) {
+        if (adapter->scan_processing) {
                 dev_dbg(adapter->dev, "cmd: Scan already in process...\n");
                 return ret;
         }
@@ -2308,7 +2280,7 @@ int mwifiex_scan_networks(struct mwifiex_private *priv,
         adapter->scan_processing = true;
         spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
 
-        if (priv->scan_block && action == HostCmd_ACT_GEN_SET) {
+        if (priv->scan_block) {
                 dev_dbg(adapter->dev,
                         "cmd: Scan is blocked during association...\n");
                 return ret;
@@ -2348,9 +2320,9 @@ int mwifiex_scan_networks(struct mwifiex_private *priv,
                 adapter->bcn_buf_end = adapter->bcn_buf;
         }
 
-        ret = mwifiex_scan_channel_list(priv, wait_buf, max_chan_per_scan,
-                                        filtered_scan, &scan_cfg_out->config,
-                                        chan_list_out, scan_chan_list);
+        ret = mwifiex_scan_channel_list(priv, max_chan_per_scan, filtered_scan,
+                                        &scan_cfg_out->config, chan_list_out,
+                                        scan_chan_list);
 
         /* Get scan command from scan_pending_q and put to cmd_pending_q */
         if (!ret) {
@@ -2367,7 +2339,6 @@ int mwifiex_scan_networks(struct mwifiex_private *priv,
                         spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
                                                flags);
                 }
-                ret = -EINPROGRESS;
         } else {
                 spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
                 adapter->scan_processing = true;
@@ -2393,8 +2364,7 @@ int mwifiex_scan_networks(struct mwifiex_private *priv,
  *      - Setting command ID, and proper size
  *      - Ensuring correct endian-ness
  */
-int mwifiex_cmd_802_11_scan(struct mwifiex_private *priv,
-                            struct host_cmd_ds_command *cmd, void *data_buf)
+int mwifiex_cmd_802_11_scan(struct host_cmd_ds_command *cmd, void *data_buf)
 {
         struct host_cmd_ds_802_11_scan *scan_cmd = &cmd->params.scan;
         struct mwifiex_scan_cmd_config *scan_cfg;
@@ -2437,11 +2407,10 @@ int mwifiex_cmd_802_11_scan(struct mwifiex_private *priv,
  *      .-------------------------------------------------------------.
  */
 int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
-                            struct host_cmd_ds_command *resp, void *wq_buf)
+                            struct host_cmd_ds_command *resp)
 {
         int ret = 0;
         struct mwifiex_adapter *adapter = priv->adapter;
-        struct mwifiex_wait_queue *wait_queue = NULL;
         struct cmd_ctrl_node *cmd_node = NULL;
         struct host_cmd_ds_802_11_scan_rsp *scan_rsp = NULL;
         struct mwifiex_bssdescriptor *bss_new_entry = NULL;
@@ -2653,13 +2622,9 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                 mwifiex_process_scan_results(priv);
 
                 /* Need to indicate IOCTL complete */
-                wait_queue = (struct mwifiex_wait_queue *) wq_buf;
-                if (wait_queue) {
-                        wait_queue->status = MWIFIEX_ERROR_NO_ERROR;
-
-                        /* Indicate ioctl complete */
-                        mwifiex_ioctl_complete(adapter,
-                               (struct mwifiex_wait_queue *) wait_queue, 0);
+                if (adapter->curr_cmd->wait_q_enabled) {
+                        adapter->cmd_wait_q.status = 0;
+                        mwifiex_complete_cmd(adapter);
                 }
                 if (priv->report_scan_result)
                         priv->report_scan_result = false;
@@ -2692,9 +2657,7 @@ done:
  *      - Setting background scan flush parameter
  *      - Ensuring correct endian-ness
  */
-int mwifiex_cmd_802_11_bg_scan_query(struct mwifiex_private *priv,
-                                     struct host_cmd_ds_command *cmd,
-                                     void *data_buf)
+int mwifiex_cmd_802_11_bg_scan_query(struct host_cmd_ds_command *cmd)
 {
         struct host_cmd_ds_802_11_bg_scan_query *bg_query =
                 &cmd->params.bg_scan_query;
@@ -2853,6 +2816,7 @@ mwifiex_queue_scan_cmd(struct mwifiex_private *priv,
         struct mwifiex_adapter *adapter = priv->adapter;
         unsigned long flags;
 
+        cmd_node->wait_q_enabled = true;
         spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);
         list_add_tail(&cmd_node->list, &adapter->scan_pending_q);
         spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
@@ -2899,9 +2863,7 @@ int mwifiex_find_best_network(struct mwifiex_private *priv,
  * firmware, filtered on a specific SSID.
  */
 static int mwifiex_scan_specific_ssid(struct mwifiex_private *priv,
-                                      void *wait_buf, u16 action,
-                                      struct mwifiex_802_11_ssid *req_ssid,
-                                      struct mwifiex_scan_resp *scan_resp)
+                                      struct mwifiex_802_11_ssid *req_ssid)
 {
         struct mwifiex_adapter *adapter = priv->adapter;
         int ret = 0;
@@ -2910,24 +2872,12 @@ static int mwifiex_scan_specific_ssid(struct mwifiex_private *priv,
         if (!req_ssid)
                 return -1;
 
-        if (action == HostCmd_ACT_GEN_GET) {
-                if (scan_resp) {
-                        scan_resp->scan_table =
-                                (u8 *) &priv->curr_bss_params.bss_descriptor;
-                        scan_resp->num_in_scan_table =
-                                adapter->num_in_scan_table;
-                } else {
-                        ret = -1;
-                }
-                return ret;
-        }
-
-        if (adapter->scan_processing && action == HostCmd_ACT_GEN_SET) {
+        if (adapter->scan_processing) {
                 dev_dbg(adapter->dev, "cmd: Scan already in process...\n");
                 return ret;
         }
 
-        if (priv->scan_block && action == HostCmd_ACT_GEN_SET) {
+        if (priv->scan_block) {
                 dev_dbg(adapter->dev,
                         "cmd: Scan is blocked during association...\n");
                 return ret;
@@ -2945,7 +2895,7 @@ static int mwifiex_scan_specific_ssid(struct mwifiex_private *priv,
                req_ssid->ssid_len);
         scan_cfg->keep_previous_scan = true;
 
-        ret = mwifiex_scan_networks(priv, wait_buf, action, scan_cfg, NULL);
+        ret = mwifiex_scan_networks(priv, scan_cfg);
 
         kfree(scan_cfg);
         return ret;
@@ -2960,12 +2910,10 @@ static int mwifiex_scan_specific_ssid(struct mwifiex_private *priv,
  * Scan command can be issued for both normal scan and specific SSID
  * scan, depending upon whether an SSID is provided or not.
  */
-int mwifiex_request_scan(struct mwifiex_private *priv, u8 wait_option,
+int mwifiex_request_scan(struct mwifiex_private *priv,
                          struct mwifiex_802_11_ssid *req_ssid)
 {
         int ret = 0;
-        struct mwifiex_wait_queue *wait = NULL;
-        int status = 0;
 
         if (down_interruptible(&priv->async_sem)) {
                 dev_err(priv->adapter->dev, "%s: acquire semaphore\n",
@@ -2974,32 +2922,23 @@ int mwifiex_request_scan(struct mwifiex_private *priv, u8 wait_option,
         }
         priv->scan_pending_on_block = true;
 
-        /* Allocate wait request buffer */
-        wait = mwifiex_alloc_fill_wait_queue(priv, wait_option);
-        if (!wait) {
-                ret = -1;
-                goto done;
-        }
+        priv->adapter->cmd_wait_q.condition = false;
 
         if (req_ssid && req_ssid->ssid_len != 0)
                 /* Specific SSID scan */
-                status = mwifiex_scan_specific_ssid(priv, wait,
-                                                    HostCmd_ACT_GEN_SET,
-                                                    req_ssid, NULL);
+                ret = mwifiex_scan_specific_ssid(priv, req_ssid);
         else
                 /* Normal scan */
-                status = mwifiex_scan_networks(priv, wait, HostCmd_ACT_GEN_SET,
-                                               NULL, NULL);
-        status = mwifiex_request_ioctl(priv, wait, status, wait_option);
-        if (status == -1)
-                ret = -1;
-done:
-        if ((wait) && (status != -EINPROGRESS))
-                kfree(wait);
+                ret = mwifiex_scan_networks(priv, NULL);
+
+        if (!ret)
+                ret = mwifiex_wait_queue_complete(priv->adapter);
+
         if (ret == -1) {
                 priv->scan_pending_on_block = false;
                 up(&priv->async_sem);
         }
+
         return ret;
 }
 
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index f21e5cd19839..41c087d3f0f5 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -208,7 +208,7 @@ static int mwifiex_sdio_resume(struct device *dev)
 
         /* Disable Host Sleep */
         mwifiex_cancel_hs(mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_STA),
-                              MWIFIEX_NO_WAIT);
+                          MWIFIEX_ASYNC_CMD);
 
         return 0;
 }
@@ -282,7 +282,7 @@ mwifiex_read_reg(struct mwifiex_adapter *adapter, u32 reg, u32 *data)
  */
 static int
 mwifiex_write_data_sync(struct mwifiex_adapter *adapter,
-                        u8 *buffer, u32 pkt_len, u32 port, u32 timeout)
+                        u8 *buffer, u32 pkt_len, u32 port)
 {
         struct sdio_mmc_card *card = adapter->card;
         int ret = -1;
@@ -314,9 +314,8 @@ mwifiex_write_data_sync(struct mwifiex_adapter *adapter,
 /*
  * This function reads multiple data from SDIO card memory.
  */
-static int mwifiex_read_data_sync(struct mwifiex_adapter *adapter,
-                                  u8 *buffer, u32 len,
-                       u32 port, u32 timeout, u8 claim)
+static int mwifiex_read_data_sync(struct mwifiex_adapter *adapter, u8 *buffer,
+                                  u32 len, u32 port, u8 claim)
 {
         struct sdio_mmc_card *card = adapter->card;
         int ret = -1;
@@ -430,8 +429,7 @@ static int mwifiex_write_data_to_card(struct mwifiex_adapter *adapter,
         int ret = 0;
 
         do {
-                ret = mwifiex_write_data_sync(adapter, payload, pkt_len,
-                                                                port, 0);
+                ret = mwifiex_write_data_sync(adapter, payload, pkt_len, port);
                 if (ret) {
                         i++;
                         dev_err(adapter->dev, "host_to_card, write iomem"
@@ -630,7 +628,7 @@ static int mwifiex_sdio_card_to_host(struct mwifiex_adapter *adapter,
                 return -1;
         }
 
-        ret = mwifiex_read_data_sync(adapter, buffer, npayload, ioport, 0, 1);
+        ret = mwifiex_read_data_sync(adapter, buffer, npayload, ioport, 1);
 
         if (ret) {
                 dev_err(adapter->dev, "%s: read iomem failed: %d\n", __func__,
@@ -769,7 +767,7 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
 
                 ret = mwifiex_write_data_sync(adapter, fwbuf, tx_blocks *
                                               MWIFIEX_SDIO_BLOCK_SIZE,
-                                              adapter->ioport, 0);
+                                              adapter->ioport);
                 if (ret) {
                         dev_err(adapter->dev, "FW download, write iomem (%d)"
                                         " failed @ %d\n", i, offset);
@@ -842,7 +840,7 @@ static void mwifiex_interrupt_status(struct mwifiex_adapter *adapter)
         unsigned long flags;
 
         if (mwifiex_read_data_sync(adapter, card->mp_regs, MAX_MP_REGS,
-                                   REG_PORT | MWIFIEX_SDIO_BYTE_MODE_MASK, 0,
+                                   REG_PORT | MWIFIEX_SDIO_BYTE_MODE_MASK,
                                    0)) {
                 dev_err(adapter->dev, "read mp_regs failed\n");
                 return;
@@ -859,8 +857,6 @@ static void mwifiex_interrupt_status(struct mwifiex_adapter *adapter)
                 adapter->int_status |= sdio_ireg;
                 spin_unlock_irqrestore(&adapter->int_lock, flags);
         }
-
-        return;
 }
 
 /*
@@ -891,8 +887,6 @@ mwifiex_sdio_interrupt(struct sdio_func *func)
 
         mwifiex_interrupt_status(adapter);
         queue_work(adapter->workqueue, &adapter->main_work);
-
-        return;
 }
 
 /*
@@ -1054,7 +1048,7 @@ static int mwifiex_sdio_card_to_host_mp_aggr(struct mwifiex_adapter *adapter,
                                            card->mpa_rx.buf_len,
                                            (adapter->ioport | 0x1000 |
                                             (card->mpa_rx.ports << 4)) +
-                                           card->mpa_rx.start_port, 0, 1))
+                                           card->mpa_rx.start_port, 1))
                         return -1;
 
                 curr_ptr = card->mpa_rx.buf;
@@ -1745,13 +1739,12 @@ mwifiex_sdio_cleanup_module(void)
         for (i = 0; i < adapter->priv_num; i++)
                 if ((GET_BSS_ROLE(adapter->priv[i]) == MWIFIEX_BSS_ROLE_STA) &&
                     adapter->priv[i]->media_connected)
-                        mwifiex_disconnect(adapter->priv[i], MWIFIEX_CMD_WAIT,
-                                           NULL);
+                        mwifiex_deauthenticate(adapter->priv[i], NULL);
 
         if (!adapter->surprise_removed)
-                mwifiex_shutdown_fw(mwifiex_get_priv
-                                    (adapter, MWIFIEX_BSS_ROLE_ANY),
-                                    MWIFIEX_CMD_WAIT);
+                mwifiex_init_shutdown_fw(mwifiex_get_priv(adapter,
+                                                          MWIFIEX_BSS_ROLE_ANY),
+                                         MWIFIEX_FUNC_SHUTDOWN);
 
 exit:
         up(&add_remove_card_sem);
diff --git a/drivers/net/wireless/mwifiex/sta_cmd.c b/drivers/net/wireless/mwifiex/sta_cmd.c
index 6fff26153e26..33c8ba1f5e33 100644
--- a/drivers/net/wireless/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/mwifiex/sta_cmd.c
@@ -190,8 +190,7 @@ static int mwifiex_cmd_802_11_snmp_mib(struct mwifiex_private *priv,
  *      - Ensuring correct endian-ness
  */
 static int
-mwifiex_cmd_802_11_get_log(struct mwifiex_private *priv,
-                           struct host_cmd_ds_command *cmd)
+mwifiex_cmd_802_11_get_log(struct host_cmd_ds_command *cmd)
 {
         cmd->command = cpu_to_le16(HostCmd_CMD_802_11_GET_LOG);
         cmd->size = cpu_to_le16(sizeof(struct host_cmd_ds_802_11_get_log) +
@@ -272,8 +271,7 @@ static int mwifiex_cmd_tx_rate_cfg(struct mwifiex_private *priv,
  *        (as required)
  *      - Ensuring correct endian-ness
  */
-static int mwifiex_cmd_tx_power_cfg(struct mwifiex_private *priv,
-                                    struct host_cmd_ds_command *cmd,
+static int mwifiex_cmd_tx_power_cfg(struct host_cmd_ds_command *cmd,
                                     u16 cmd_action, void *data_buf)
 {
         struct mwifiex_types_power_group *pg_tlv = NULL;
@@ -407,8 +405,7 @@ static int mwifiex_cmd_802_11_mac_address(struct mwifiex_private *priv,
  *      - Setting MAC multicast address
  *      - Ensuring correct endian-ness
  */
-static int mwifiex_cmd_mac_multicast_adr(struct mwifiex_private *priv,
-                                         struct host_cmd_ds_command *cmd,
+static int mwifiex_cmd_mac_multicast_adr(struct host_cmd_ds_command *cmd,
                                          u16 cmd_action, void *data_buf)
 {
         struct mwifiex_multicast_list *mcast_list =
@@ -463,8 +460,7 @@ static int mwifiex_cmd_802_11_deauthenticate(struct mwifiex_private *priv,
  *      - Setting command ID and proper size
  *      - Ensuring correct endian-ness
  */
-static int mwifiex_cmd_802_11_ad_hoc_stop(struct mwifiex_private *priv,
-                                          struct host_cmd_ds_command *cmd)
+static int mwifiex_cmd_802_11_ad_hoc_stop(struct host_cmd_ds_command *cmd)
 {
         cmd->command = cpu_to_le16(HostCmd_CMD_802_11_AD_HOC_STOP);
         cmd->size = cpu_to_le16(S_DS_GEN);
@@ -500,9 +496,8 @@ mwifiex_set_keyparamset_wep(struct mwifiex_private *priv,
                         key_param_set->key_type_id =
                                 cpu_to_le16(KEY_TYPE_ID_WEP);
                         key_param_set->key_info =
-                                cpu_to_le16(KEY_INFO_WEP_ENABLED |
-                                            KEY_INFO_WEP_UNICAST |
-                                            KEY_INFO_WEP_MCAST);
+                                cpu_to_le16(KEY_ENABLED | KEY_UNICAST |
+                                            KEY_MCAST);
                         key_param_set->key_len =
                                 cpu_to_le16(priv->wep_key[i].key_length);
                         /* Set WEP key index */
@@ -589,10 +584,10 @@ static int mwifiex_cmd_802_11_key_material(struct mwifiex_private *priv,
                         cpu_to_le16(KEY_TYPE_ID_WAPI);
                 if (cmd_oid == KEY_INFO_ENABLED)
                         key_material->key_param_set.key_info =
-                                cpu_to_le16(KEY_INFO_WAPI_ENABLED);
+                                cpu_to_le16(KEY_ENABLED);
                 else
                         key_material->key_param_set.key_info =
-                                cpu_to_le16(!KEY_INFO_WAPI_ENABLED);
+                                cpu_to_le16(!KEY_ENABLED);
 
                 key_material->key_param_set.key[0] = enc_key->key_index;
                 if (!priv->sec_info.wapi_key_on)
@@ -604,10 +599,10 @@ static int mwifiex_cmd_802_11_key_material(struct mwifiex_private *priv,
                 if (0 != memcmp(enc_key->mac_addr, bc_mac, sizeof(bc_mac))) {
                         /* WAPI pairwise key: unicast */
                         key_material->key_param_set.key_info |=
-                                cpu_to_le16(KEY_INFO_WAPI_UNICAST);
+                                cpu_to_le16(KEY_UNICAST);
                 } else {        /* WAPI group key: multicast */
                         key_material->key_param_set.key_info |=
-                                cpu_to_le16(KEY_INFO_WAPI_MCAST);
+                                cpu_to_le16(KEY_MCAST);
                         priv->sec_info.wapi_key_on = true;
                 }
 
@@ -634,32 +629,32 @@ static int mwifiex_cmd_802_11_key_material(struct mwifiex_private *priv,
                         cpu_to_le16(KEY_TYPE_ID_AES);
                 if (cmd_oid == KEY_INFO_ENABLED)
                         key_material->key_param_set.key_info =
-                                cpu_to_le16(KEY_INFO_AES_ENABLED);
+                                cpu_to_le16(KEY_ENABLED);
                 else
                         key_material->key_param_set.key_info =
-                                cpu_to_le16(!KEY_INFO_AES_ENABLED);
+                                cpu_to_le16(!KEY_ENABLED);
 
                 if (enc_key->key_index & MWIFIEX_KEY_INDEX_UNICAST)
                                 /* AES pairwise key: unicast */
                         key_material->key_param_set.key_info |=
-                                cpu_to_le16(KEY_INFO_AES_UNICAST);
+                                cpu_to_le16(KEY_UNICAST);
                 else            /* AES group key: multicast */
                         key_material->key_param_set.key_info |=
-                                cpu_to_le16(KEY_INFO_AES_MCAST);
+                                cpu_to_le16(KEY_MCAST);
         } else if (enc_key->key_len == WLAN_KEY_LEN_TKIP) {
                 dev_dbg(priv->adapter->dev, "cmd: WPA_TKIP\n");
                 key_material->key_param_set.key_type_id =
                         cpu_to_le16(KEY_TYPE_ID_TKIP);
                 key_material->key_param_set.key_info =
-                        cpu_to_le16(KEY_INFO_TKIP_ENABLED);
+                        cpu_to_le16(KEY_ENABLED);
 
                 if (enc_key->key_index & MWIFIEX_KEY_INDEX_UNICAST)
                                 /* TKIP pairwise key: unicast */
                         key_material->key_param_set.key_info |=
-                                cpu_to_le16(KEY_INFO_TKIP_UNICAST);
+                                cpu_to_le16(KEY_UNICAST);
                 else            /* TKIP group key: multicast */
                         key_material->key_param_set.key_info |=
-                                cpu_to_le16(KEY_INFO_TKIP_MCAST);
+                                cpu_to_le16(KEY_MCAST);
         }
 
         if (key_material->key_param_set.key_type_id) {
@@ -778,8 +773,7 @@ static int mwifiex_cmd_802_11_rf_channel(struct mwifiex_private *priv,
  *      - Setting status to enable or disable (for SET only)
  *      - Ensuring correct endian-ness
  */
-static int mwifiex_cmd_ibss_coalescing_status(struct mwifiex_private *priv,
-                                              struct host_cmd_ds_command *cmd,
+static int mwifiex_cmd_ibss_coalescing_status(struct host_cmd_ds_command *cmd,
                                               u16 cmd_action, void *data_buf)
 {
         struct host_cmd_ds_802_11_ibss_status *ibss_coal =
@@ -947,7 +941,7 @@ int mwifiex_sta_prepare_cmd(struct mwifiex_private *priv, uint16_t cmd_no,
                                                      cmd_action);
                 break;
         case HostCmd_CMD_MAC_MULTICAST_ADR:
-                ret = mwifiex_cmd_mac_multicast_adr(priv, cmd_ptr, cmd_action,
+                ret = mwifiex_cmd_mac_multicast_adr(cmd_ptr, cmd_action,
                                                     data_buf);
                 break;
         case HostCmd_CMD_TX_RATE_CFG:
@@ -955,7 +949,7 @@ int mwifiex_sta_prepare_cmd(struct mwifiex_private *priv, uint16_t cmd_no,
                                               data_buf);
                 break;
         case HostCmd_CMD_TXPWR_CFG:
-                ret = mwifiex_cmd_tx_power_cfg(priv, cmd_ptr, cmd_action,
+                ret = mwifiex_cmd_tx_power_cfg(cmd_ptr, cmd_action,
                                                data_buf);
                 break;
         case HostCmd_CMD_802_11_PS_MODE_ENH:
@@ -967,11 +961,10 @@ int mwifiex_sta_prepare_cmd(struct mwifiex_private *priv, uint16_t cmd_no,
                                 (struct mwifiex_hs_config_param *) data_buf);
                 break;
         case HostCmd_CMD_802_11_SCAN:
-                ret = mwifiex_cmd_802_11_scan(priv, cmd_ptr, data_buf);
+                ret = mwifiex_cmd_802_11_scan(cmd_ptr, data_buf);
                 break;
         case HostCmd_CMD_802_11_BG_SCAN_QUERY:
-                ret = mwifiex_cmd_802_11_bg_scan_query(priv, cmd_ptr,
-                                                       data_buf);
+                ret = mwifiex_cmd_802_11_bg_scan_query(cmd_ptr);
                 break;
         case HostCmd_CMD_802_11_ASSOCIATE:
                 ret = mwifiex_cmd_802_11_associate(priv, cmd_ptr, data_buf);
@@ -985,14 +978,14 @@ int mwifiex_sta_prepare_cmd(struct mwifiex_private *priv, uint16_t cmd_no,
                                                       data_buf);
                 break;
         case HostCmd_CMD_802_11_GET_LOG:
-                ret = mwifiex_cmd_802_11_get_log(priv, cmd_ptr);
+                ret = mwifiex_cmd_802_11_get_log(cmd_ptr);
                 break;
         case HostCmd_CMD_802_11_AD_HOC_JOIN:
                 ret = mwifiex_cmd_802_11_ad_hoc_join(priv, cmd_ptr,
                                                      data_buf);
                 break;
         case HostCmd_CMD_802_11_AD_HOC_STOP:
-                ret = mwifiex_cmd_802_11_ad_hoc_stop(priv, cmd_ptr);
+                ret = mwifiex_cmd_802_11_ad_hoc_stop(cmd_ptr);
                 break;
         case HostCmd_CMD_RSSI_INFO:
                 ret = mwifiex_cmd_802_11_rssi_info(priv, cmd_ptr, cmd_action);
@@ -1037,10 +1030,10 @@ int mwifiex_sta_prepare_cmd(struct mwifiex_private *priv, uint16_t cmd_no,
                 cmd_ptr->size = cpu_to_le16(S_DS_GEN);
                 break;
         case HostCmd_CMD_11N_ADDBA_REQ:
-                ret = mwifiex_cmd_11n_addba_req(priv, cmd_ptr, data_buf);
+                ret = mwifiex_cmd_11n_addba_req(cmd_ptr, data_buf);
                 break;
         case HostCmd_CMD_11N_DELBA:
-                ret = mwifiex_cmd_11n_delba(priv, cmd_ptr, data_buf);
+                ret = mwifiex_cmd_11n_delba(cmd_ptr, data_buf);
                 break;
         case HostCmd_CMD_11N_ADDBA_RSP:
                 ret = mwifiex_cmd_11n_addba_rsp_gen(priv, cmd_ptr, data_buf);
@@ -1059,11 +1052,11 @@ int mwifiex_sta_prepare_cmd(struct mwifiex_private *priv, uint16_t cmd_no,
                                                data_buf);
                 break;
         case HostCmd_CMD_AMSDU_AGGR_CTRL:
-                ret = mwifiex_cmd_amsdu_aggr_ctrl(priv, cmd_ptr, cmd_action,
+                ret = mwifiex_cmd_amsdu_aggr_ctrl(cmd_ptr, cmd_action,
                                                   data_buf);
                 break;
         case HostCmd_CMD_11N_CFG:
-                ret = mwifiex_cmd_11n_cfg(priv, cmd_ptr, cmd_action,
+                ret = mwifiex_cmd_11n_cfg(cmd_ptr, cmd_action,
                                           data_buf);
                 break;
         case HostCmd_CMD_WMM_GET_STATUS:
@@ -1076,8 +1069,8 @@ int mwifiex_sta_prepare_cmd(struct mwifiex_private *priv, uint16_t cmd_no,
                 ret = 0;
                 break;
         case HostCmd_CMD_802_11_IBSS_COALESCING_STATUS:
-                ret = mwifiex_cmd_ibss_coalescing_status(priv, cmd_ptr,
-                                                         cmd_action, data_buf);
+                ret = mwifiex_cmd_ibss_coalescing_status(cmd_ptr, cmd_action,
+                                                         data_buf);
                 break;
         case HostCmd_CMD_MAC_REG_ACCESS:
         case HostCmd_CMD_BBP_REG_ACCESS:
@@ -1136,65 +1129,66 @@ int mwifiex_sta_init_cmd(struct mwifiex_private *priv, u8 first_sta)
 
         if (first_sta) {
 
-                ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_FUNC_INIT,
-                                          HostCmd_ACT_GEN_SET, 0, NULL, NULL);
+                ret = mwifiex_send_cmd_async(priv, HostCmd_CMD_FUNC_INIT,
+                                             HostCmd_ACT_GEN_SET, 0, NULL);
                 if (ret)
                         return -1;
                 /* Read MAC address from HW */
-                ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_GET_HW_SPEC,
-                                          HostCmd_ACT_GEN_GET, 0, NULL, NULL);
+                ret = mwifiex_send_cmd_async(priv, HostCmd_CMD_GET_HW_SPEC,
+                                             HostCmd_ACT_GEN_GET, 0, NULL);
                 if (ret)
                         return -1;
 
                 /* Reconfigure tx buf size */
-                ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_RECONFIGURE_TX_BUFF,
-                                          HostCmd_ACT_GEN_SET, 0, NULL,
-                                          &priv->adapter->tx_buf_size);
+                ret = mwifiex_send_cmd_async(priv,
+                                             HostCmd_CMD_RECONFIGURE_TX_BUFF,
+                                             HostCmd_ACT_GEN_SET, 0,
+                                             &priv->adapter->tx_buf_size);
                 if (ret)
                         return -1;
 
                 /* Enable IEEE PS by default */
                 priv->adapter->ps_mode = MWIFIEX_802_11_POWER_MODE_PSP;
-                ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_802_11_PS_MODE_ENH,
-                                          EN_AUTO_PS, BITMAP_STA_PS, NULL,
-                                          NULL);
+                ret = mwifiex_send_cmd_async(priv,
+                                             HostCmd_CMD_802_11_PS_MODE_ENH,
+                                             EN_AUTO_PS, BITMAP_STA_PS, NULL);
                 if (ret)
                         return -1;
         }
 
         /* get tx rate */
-        ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_TX_RATE_CFG,
-                                  HostCmd_ACT_GEN_GET, 0, NULL, NULL);
+        ret = mwifiex_send_cmd_async(priv, HostCmd_CMD_TX_RATE_CFG,
+                                     HostCmd_ACT_GEN_GET, 0, NULL);
         if (ret)
                 return -1;
         priv->data_rate = 0;
 
         /* get tx power */
-        ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_TXPWR_CFG,
-                                  HostCmd_ACT_GEN_GET, 0, NULL, NULL);
+        ret = mwifiex_send_cmd_async(priv, HostCmd_CMD_TXPWR_CFG,
+                                     HostCmd_ACT_GEN_GET, 0, NULL);
         if (ret)
                 return -1;
 
         /* set ibss coalescing_status */
-        ret = mwifiex_prepare_cmd(priv,
-                                  HostCmd_CMD_802_11_IBSS_COALESCING_STATUS,
-                                  HostCmd_ACT_GEN_SET, 0, NULL, &enable);
+        ret = mwifiex_send_cmd_async(priv,
+                                     HostCmd_CMD_802_11_IBSS_COALESCING_STATUS,
+                                     HostCmd_ACT_GEN_SET, 0, &enable);
         if (ret)
                 return -1;
 
         memset(&amsdu_aggr_ctrl, 0, sizeof(amsdu_aggr_ctrl));
         amsdu_aggr_ctrl.enable = true;
         /* Send request to firmware */
-        ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_AMSDU_AGGR_CTRL,
-                                  HostCmd_ACT_GEN_SET, 0, NULL,
-                                  (void *) &amsdu_aggr_ctrl);
+        ret = mwifiex_send_cmd_async(priv, HostCmd_CMD_AMSDU_AGGR_CTRL,
+                                     HostCmd_ACT_GEN_SET, 0,
+                                     (void *) &amsdu_aggr_ctrl);
         if (ret)
                 return -1;
         /* MAC Control must be the last command in init_fw */
         /* set MAC Control */
-        ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_MAC_CONTROL,
-                                  HostCmd_ACT_GEN_SET, 0, NULL,
-                                  &priv->curr_pkt_filter);
+        ret = mwifiex_send_cmd_async(priv, HostCmd_CMD_MAC_CONTROL,
+                                     HostCmd_ACT_GEN_SET, 0,
+                                     &priv->curr_pkt_filter);
         if (ret)
                 return -1;
 
@@ -1202,19 +1196,18 @@ int mwifiex_sta_init_cmd(struct mwifiex_private *priv, u8 first_sta)
                 /* Enable auto deep sleep */
                 auto_ds.auto_ds = DEEP_SLEEP_ON;
                 auto_ds.idle_time = DEEP_SLEEP_IDLE_TIME;
-                ret = mwifiex_prepare_cmd(priv,
-                                HostCmd_CMD_802_11_PS_MODE_ENH,
-                                EN_AUTO_PS, BITMAP_AUTO_DS, NULL,
-                                &auto_ds);
+                ret = mwifiex_send_cmd_async(priv,
+                                             HostCmd_CMD_802_11_PS_MODE_ENH,
+                                             EN_AUTO_PS, BITMAP_AUTO_DS,
+                                             &auto_ds);
                 if (ret)
                         return -1;
         }
 
         /* Send cmd to FW to enable/disable 11D function */
         state_11d = ENABLE_11D;
-        ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_802_11_SNMP_MIB,
-                                  HostCmd_ACT_GEN_SET, DOT11D_I,
-                                  NULL, &state_11d);
+        ret = mwifiex_send_cmd_async(priv, HostCmd_CMD_802_11_SNMP_MIB,
+                                     HostCmd_ACT_GEN_SET, DOT11D_I, &state_11d);
         if (ret)
                 dev_err(priv->adapter->dev, "11D: failed to enable 11D\n");
 
diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c
index 74add45b99b6..7f4f10b752fb 100644
--- a/drivers/net/wireless/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c
@@ -41,8 +41,7 @@
  */
 static void
 mwifiex_process_cmdresp_error(struct mwifiex_private *priv,
-                              struct host_cmd_ds_command *resp,
-                              struct mwifiex_wait_queue *wq_buf)
+                              struct host_cmd_ds_command *resp)
 {
         struct cmd_ctrl_node *cmd_node = NULL, *tmp_node = NULL;
         struct mwifiex_adapter *adapter = priv->adapter;
@@ -51,8 +50,9 @@ mwifiex_process_cmdresp_error(struct mwifiex_private *priv,
 
         dev_err(adapter->dev, "CMD_RESP: cmd %#x error, result=%#x\n",
                         resp->command, resp->result);
-        if (wq_buf)
-                wq_buf->status = MWIFIEX_ERROR_FW_CMDRESP;
+
+        if (adapter->curr_cmd->wait_q_enabled)
+                adapter->cmd_wait_q.status = -1;
 
         switch (le16_to_cpu(resp->command)) {
         case HostCmd_CMD_802_11_PS_MODE_ENH:
@@ -103,8 +103,6 @@ mwifiex_process_cmdresp_error(struct mwifiex_private *priv,
         spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
         adapter->curr_cmd = NULL;
         spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
-
-        return;
 }
 
 /*
@@ -282,7 +280,6 @@ static int mwifiex_ret_tx_rate_cfg(struct mwifiex_private *priv,
                                    struct host_cmd_ds_command *resp,
                                    void *data_buf)
 {
-        struct mwifiex_adapter *adapter = priv->adapter;
         struct mwifiex_rate_cfg *ds_rate = NULL;
         struct host_cmd_ds_tx_rate_cfg *rate_cfg = &resp->params.tx_rate_cfg;
         struct mwifiex_rate_scope *rate_scope;
@@ -328,9 +325,9 @@ static int mwifiex_ret_tx_rate_cfg(struct mwifiex_private *priv,
         if (priv->is_data_rate_auto)
                 priv->data_rate = 0;
         else
-                ret = mwifiex_prepare_cmd(priv,
+                ret = mwifiex_send_cmd_async(priv,
                                           HostCmd_CMD_802_11_TX_RATE_QUERY,
-                                          HostCmd_ACT_GEN_GET, 0, NULL, NULL);
+                                          HostCmd_ACT_GEN_GET, 0, NULL);
 
         if (data_buf) {
                 ds_rate = (struct mwifiex_rate_cfg *) data_buf;
@@ -338,9 +335,7 @@ static int mwifiex_ret_tx_rate_cfg(struct mwifiex_private *priv,
                         if (priv->is_data_rate_auto) {
                                 ds_rate->is_rate_auto = 1;
                         } else {
-                                ds_rate->rate =
-                                        mwifiex_get_rate_index(adapter,
-                                                               priv->
+                                ds_rate->rate = mwifiex_get_rate_index(priv->
                                                                bitmap_rates,
                                                                sizeof(priv->
                                                                bitmap_rates));
@@ -516,13 +511,11 @@ static int mwifiex_ret_mac_multicast_adr(struct mwifiex_private *priv,
 static int mwifiex_ret_802_11_tx_rate_query(struct mwifiex_private *priv,
                                             struct host_cmd_ds_command *resp)
 {
-        struct mwifiex_adapter *adapter = priv->adapter;
-
         priv->tx_rate = resp->params.tx_rate.tx_rate;
         priv->tx_htinfo = resp->params.tx_rate.ht_info;
         if (!priv->is_data_rate_auto)
                 priv->data_rate =
-                        mwifiex_index_to_data_rate(adapter, priv->tx_rate,
+                        mwifiex_index_to_data_rate(priv->tx_rate,
                                                    priv->tx_htinfo);
 
         return 0;
@@ -574,8 +567,7 @@ static int mwifiex_ret_802_11_key_material(struct mwifiex_private *priv,
                 &resp->params.key_material;
 
         if (le16_to_cpu(key->action) == HostCmd_ACT_GEN_SET) {
-                if ((le16_to_cpu(key->key_param_set.key_info) &
-                     KEY_INFO_TKIP_MCAST)) {
+                if ((le16_to_cpu(key->key_param_set.key_info) & KEY_MCAST)) {
                         dev_dbg(priv->adapter->dev, "info: key: GTK is set\n");
                         priv->wpa_is_gtk_set = true;
                         priv->scan_block = false;
@@ -834,19 +826,17 @@ static int mwifiex_ret_ibss_coalescing_status(struct mwifiex_private *priv,
  * response handlers based on the command ID.
  */
 int mwifiex_process_sta_cmdresp(struct mwifiex_private *priv,
-                                u16 cmdresp_no, void *cmd_buf, void *wq_buf)
+                                u16 cmdresp_no, void *cmd_buf)
 {
         int ret = 0;
         struct mwifiex_adapter *adapter = priv->adapter;
         struct host_cmd_ds_command *resp =
                 (struct host_cmd_ds_command *) cmd_buf;
-        struct mwifiex_wait_queue *wait_queue =
-                (struct mwifiex_wait_queue *) wq_buf;
         void *data_buf = adapter->curr_cmd->data_buf;
 
         /* If the command is not successful, cleanup and return failure */
         if (resp->result != HostCmd_RESULT_OK) {
-                mwifiex_process_cmdresp_error(priv, resp, wait_queue);
+                mwifiex_process_cmdresp_error(priv, resp);
                 return -1;
         }
         /* Command successful, handle response */
@@ -866,12 +856,11 @@ int mwifiex_process_sta_cmdresp(struct mwifiex_private *priv,
                 ret = mwifiex_ret_tx_rate_cfg(priv, resp, data_buf);
                 break;
         case HostCmd_CMD_802_11_SCAN:
-                ret = mwifiex_ret_802_11_scan(priv, resp, wait_queue);
-                wait_queue = NULL;
-                adapter->curr_cmd->wq_buf = NULL;
+                ret = mwifiex_ret_802_11_scan(priv, resp);
+                adapter->curr_cmd->wait_q_enabled = false;
                 break;
         case HostCmd_CMD_802_11_BG_SCAN_QUERY:
-                ret = mwifiex_ret_802_11_scan(priv, resp, wait_queue);
+                ret = mwifiex_ret_802_11_scan(priv, resp);
                 dev_dbg(adapter->dev,
                         "info: CMD_RESP: BG_SCAN result is ready!\n");
                 break;
@@ -885,14 +874,14 @@ int mwifiex_process_sta_cmdresp(struct mwifiex_private *priv,
                 ret = mwifiex_ret_802_11_hs_cfg(priv, resp);
                 break;
         case HostCmd_CMD_802_11_ASSOCIATE:
-                ret = mwifiex_ret_802_11_associate(priv, resp, wait_queue);
+                ret = mwifiex_ret_802_11_associate(priv, resp);
                 break;
         case HostCmd_CMD_802_11_DEAUTHENTICATE:
                 ret = mwifiex_ret_802_11_deauthenticate(priv, resp);
                 break;
         case HostCmd_CMD_802_11_AD_HOC_START:
         case HostCmd_CMD_802_11_AD_HOC_JOIN:
-                ret = mwifiex_ret_802_11_ad_hoc(priv, resp, wait_queue);
+                ret = mwifiex_ret_802_11_ad_hoc(priv, resp);
                 break;
         case HostCmd_CMD_802_11_AD_HOC_STOP:
                 ret = mwifiex_ret_802_11_ad_hoc_stop(priv, resp);
@@ -952,7 +941,7 @@ int mwifiex_process_sta_cmdresp(struct mwifiex_private *priv,
                                                 mp_end_port));
                 break;
         case HostCmd_CMD_AMSDU_AGGR_CTRL:
-                ret = mwifiex_ret_amsdu_aggr_ctrl(priv, resp, data_buf);
+                ret = mwifiex_ret_amsdu_aggr_ctrl(resp, data_buf);
                 break;
         case HostCmd_CMD_WMM_GET_STATUS:
                 ret = mwifiex_ret_wmm_get_status(priv, resp);
@@ -971,7 +960,7 @@ int mwifiex_process_sta_cmdresp(struct mwifiex_private *priv,
         case HostCmd_CMD_SET_BSS_MODE:
                 break;
         case HostCmd_CMD_11N_CFG:
-                ret = mwifiex_ret_11n_cfg(priv, resp, data_buf);
+                ret = mwifiex_ret_11n_cfg(resp, data_buf);
                 break;
         default:
                 dev_err(adapter->dev, "CMD_RESP: unknown cmd response %#x\n",
diff --git a/drivers/net/wireless/mwifiex/sta_event.c b/drivers/net/wireless/mwifiex/sta_event.c
index 936d7c175e75..fc265cab0907 100644
--- a/drivers/net/wireless/mwifiex/sta_event.c
+++ b/drivers/net/wireless/mwifiex/sta_event.c
@@ -271,8 +271,9 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
 
         case EVENT_HS_ACT_REQ:
                 dev_dbg(adapter->dev, "event: HS_ACT_REQ\n");
-                ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_802_11_HS_CFG_ENH,
-                                          0, 0, NULL, NULL);
+                ret = mwifiex_send_cmd_async(priv,
+                                             HostCmd_CMD_802_11_HS_CFG_ENH,
+                                             0, 0, NULL);
                 break;
 
         case EVENT_MIC_ERR_UNICAST:
@@ -303,9 +304,9 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
                        sizeof(struct mwifiex_bssdescriptor) * IW_MAX_AP);
                 adapter->num_in_scan_table = 0;
                 adapter->bcn_buf_end = adapter->bcn_buf;
-                ret = mwifiex_prepare_cmd(priv,
-                                          HostCmd_CMD_802_11_BG_SCAN_QUERY,
-                                          HostCmd_ACT_GEN_GET, 0, NULL, NULL);
+                ret = mwifiex_send_cmd_async(priv,
+                                             HostCmd_CMD_802_11_BG_SCAN_QUERY,
+                                             HostCmd_ACT_GEN_GET, 0, NULL);
                 break;
 
         case EVENT_PORT_RELEASE:
@@ -314,8 +315,8 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
 
         case EVENT_WMM_STATUS_CHANGE:
                 dev_dbg(adapter->dev, "event: WMM status changed\n");
-                ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_WMM_GET_STATUS,
-                                          0, 0, NULL, NULL);
+                ret = mwifiex_send_cmd_async(priv, HostCmd_CMD_WMM_GET_STATUS,
+                                             0, 0, NULL);
                 break;
 
         case EVENT_RSSI_LOW:
@@ -353,15 +354,15 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
                 break;
         case EVENT_IBSS_COALESCED:
                 dev_dbg(adapter->dev, "event: IBSS_COALESCED\n");
-                ret = mwifiex_prepare_cmd(priv,
+                ret = mwifiex_send_cmd_async(priv,
                                 HostCmd_CMD_802_11_IBSS_COALESCING_STATUS,
-                                HostCmd_ACT_GEN_GET, 0, NULL, NULL);
+                                HostCmd_ACT_GEN_GET, 0, NULL);
                 break;
         case EVENT_ADDBA:
                 dev_dbg(adapter->dev, "event: ADDBA Request\n");
-                mwifiex_prepare_cmd(priv, HostCmd_CMD_11N_ADDBA_RSP,
-                                    HostCmd_ACT_GEN_SET, 0, NULL,
-                                    adapter->event_body);
+                mwifiex_send_cmd_async(priv, HostCmd_CMD_11N_ADDBA_RSP,
+                                       HostCmd_ACT_GEN_SET, 0,
+                                       adapter->event_body);
                 break;
         case EVENT_DELBA:
                 dev_dbg(adapter->dev, "event: DELBA Request\n");
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index b163507b1fe0..6489f264ef5f 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -33,9 +33,8 @@
  * size, and the calling function must ensure enough memory is
  * available.
  */
-static int
-mwifiex_copy_mcast_addr(struct mwifiex_multicast_list *mlist,
-                        struct net_device *dev)
+int mwifiex_copy_mcast_addr(struct mwifiex_multicast_list *mlist,
+                            struct net_device *dev)
 {
         int i = 0;
         struct netdev_hw_addr *ha;
@@ -47,216 +46,51 @@ mwifiex_copy_mcast_addr(struct mwifiex_multicast_list *mlist,
 }
 
 /*
- * Allocate and fills a wait queue with proper parameters.
- *
- * This function needs to be called before an IOCTL request can be made.
- * It can handle the following wait options:
- *      MWIFIEX_NO_WAIT     - Waiting is disabled
- *      MWIFIEX_IOCTL_WAIT  - Waiting is done on IOCTL wait queue
- *      MWIFIEX_CMD_WAIT    - Waiting is done on command wait queue
- *      MWIFIEX_WSTATS_WAIT - Waiting is done on stats wait queue
- */
-struct mwifiex_wait_queue *
-mwifiex_alloc_fill_wait_queue(struct mwifiex_private *priv,
-                              u8 wait_option)
-{
-        struct mwifiex_wait_queue *wait = NULL;
-
-        wait = (struct mwifiex_wait_queue *)
-                kzalloc(sizeof(struct mwifiex_wait_queue), GFP_ATOMIC);
-        if (!wait) {
-                dev_err(priv->adapter->dev, "%s: fail to alloc buffer\n",
-                                                __func__);
-                return wait;
-        }
-
-        wait->bss_index = priv->bss_index;
-
-        switch (wait_option) {
-        case MWIFIEX_NO_WAIT:
-                wait->enabled = 0;
-                break;
-        case MWIFIEX_IOCTL_WAIT:
-                priv->ioctl_wait_q_woken = false;
-                wait->start_time = jiffies;
-                wait->wait = &priv->ioctl_wait_q;
-                wait->condition = &priv->ioctl_wait_q_woken;
-                wait->enabled = 1;
-                break;
-        case MWIFIEX_CMD_WAIT:
-                priv->cmd_wait_q_woken = false;
-                wait->start_time = jiffies;
-                wait->wait = &priv->cmd_wait_q;
-                wait->condition = &priv->cmd_wait_q_woken;
-                wait->enabled = 1;
-                break;
-        case MWIFIEX_WSTATS_WAIT:
-                priv->w_stats_wait_q_woken = false;
-                wait->start_time = jiffies;
-                wait->wait = &priv->w_stats_wait_q;
-                wait->condition = &priv->w_stats_wait_q_woken;
-                wait->enabled = 1;
-                break;
-        }
-
-        return wait;
-}
-
-/*
  * Wait queue completion handler.
  *
- * This function waits on a particular wait queue.
- * For NO_WAIT option, it returns immediately. It also cancels the
- * pending IOCTL request after waking up, in case of errors.
+ * This function waits on a cmd wait queue. It also cancels the pending
+ * request after waking up, in case of errors.
  */
-static void
-mwifiex_wait_ioctl_complete(struct mwifiex_private *priv,
-                            struct mwifiex_wait_queue *wait,
-                            u8 wait_option)
+int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter)
 {
         bool cancel_flag = false;
+        int status = adapter->cmd_wait_q.status;
 
-        switch (wait_option) {
-        case MWIFIEX_NO_WAIT:
-                break;
-        case MWIFIEX_IOCTL_WAIT:
-                wait_event_interruptible(priv->ioctl_wait_q,
-                                         priv->ioctl_wait_q_woken);
-                if (!priv->ioctl_wait_q_woken)
-                        cancel_flag = true;
-                break;
-        case MWIFIEX_CMD_WAIT:
-                wait_event_interruptible(priv->cmd_wait_q,
-                                         priv->cmd_wait_q_woken);
-                if (!priv->cmd_wait_q_woken)
-                        cancel_flag = true;
-                break;
-        case MWIFIEX_WSTATS_WAIT:
-                wait_event_interruptible(priv->w_stats_wait_q,
-                                         priv->w_stats_wait_q_woken);
-                if (!priv->w_stats_wait_q_woken)
-                        cancel_flag = true;
-                break;
-        }
-        if (cancel_flag) {
-                mwifiex_cancel_pending_ioctl(priv->adapter, wait);
-                dev_dbg(priv->adapter->dev, "cmd: IOCTL cancel: wait=%p, wait_option=%d\n",
-                        wait, wait_option);
-        }
+        dev_dbg(adapter->dev, "cmd pending\n");
+        atomic_inc(&adapter->cmd_pending);
 
-        return;
-}
+        /* Status pending, wake up main process */
+        queue_work(adapter->workqueue, &adapter->main_work);
 
-/*
- * The function waits for the request to complete and issues the
- * completion handler, if required.
- */
-int mwifiex_request_ioctl(struct mwifiex_private *priv,
-                          struct mwifiex_wait_queue *wait,
-                          int status, u8 wait_option)
-{
-        switch (status) {
-        case -EINPROGRESS:
-                dev_dbg(priv->adapter->dev, "cmd: IOCTL pending: wait=%p, wait_option=%d\n",
-                                wait, wait_option);
-                atomic_inc(&priv->adapter->ioctl_pending);
-                /* Status pending, wake up main process */
-                queue_work(priv->adapter->workqueue, &priv->adapter->main_work);
-
-                /* Wait for completion */
-                if (wait_option) {
-                        mwifiex_wait_ioctl_complete(priv, wait, wait_option);
-                        status = wait->status;
-                }
-                break;
-        case 0:
-        case -1:
-        case -EBUSY:
-        default:
-                break;
-        }
-        return status;
-}
-EXPORT_SYMBOL_GPL(mwifiex_request_ioctl);
+        /* Wait for completion */
+        wait_event_interruptible(adapter->cmd_wait_q.wait,
+                                        adapter->cmd_wait_q.condition);
+        if (!adapter->cmd_wait_q.condition)
+                cancel_flag = true;
 
-/*
- * IOCTL request handler to set/get MAC address.
- *
- * This function prepares the correct firmware command and
- * issues it to get the extended version information.
- */
-static int mwifiex_bss_ioctl_mac_address(struct mwifiex_private *priv,
-                                         struct mwifiex_wait_queue *wait,
-                                         u8 action, u8 *mac)
-{
-        int ret = 0;
-
-        if ((action == HostCmd_ACT_GEN_GET) && mac) {
-                memcpy(mac, priv->curr_addr, ETH_ALEN);
-                return 0;
+        if (cancel_flag) {
+                mwifiex_cancel_pending_ioctl(adapter);
+                dev_dbg(adapter->dev, "cmd cancel\n");
         }
+        adapter->cmd_wait_q.status = 0;
 
-        /* Send request to firmware */
-        ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_802_11_MAC_ADDRESS,
-                                  action, 0, wait, mac);
-        if (!ret)
-                ret = -EINPROGRESS;
-
-        return ret;
-}
-
-/*
- * Sends IOCTL request to set MAC address.
- *
- * This function allocates the IOCTL request buffer, fills it
- * with requisite parameters and calls the IOCTL handler.
- */
-int mwifiex_request_set_mac_address(struct mwifiex_private *priv)
-{
-        struct mwifiex_wait_queue *wait = NULL;
-        int status = 0;
-        u8 wait_option = MWIFIEX_CMD_WAIT;
-
-        /* Allocate wait buffer */
-        wait = mwifiex_alloc_fill_wait_queue(priv, wait_option);
-        if (!wait)
-                return -ENOMEM;
-
-        status = mwifiex_bss_ioctl_mac_address(priv, wait, HostCmd_ACT_GEN_SET,
-                                               NULL);
-
-        status = mwifiex_request_ioctl(priv, wait, status, wait_option);
-        if (!status)
-                memcpy(priv->netdev->dev_addr, priv->curr_addr, ETH_ALEN);
-        else
-                dev_err(priv->adapter->dev, "set mac address failed: status=%d"
-                                " error_code=%#x\n", status, wait->status);
-
-        kfree(wait);
         return status;
 }
 
 /*
- * IOCTL request handler to set multicast list.
- *
  * This function prepares the correct firmware command and
  * issues it to set the multicast list.
  *
  * This function can be used to enable promiscuous mode, or enable all
  * multicast packets, or to enable selective multicast.
  */
-static int
-mwifiex_bss_ioctl_multicast_list(struct mwifiex_private *priv,
-                                 struct mwifiex_wait_queue *wait,
-                                 u16 action,
-                                 struct mwifiex_multicast_list *mcast_list)
+int mwifiex_request_set_multicast_list(struct mwifiex_private *priv,
+                                struct mwifiex_multicast_list *mcast_list)
 {
         int ret = 0;
         u16 old_pkt_filter;
 
         old_pkt_filter = priv->curr_pkt_filter;
-        if (action == HostCmd_ACT_GEN_GET)
-                return -1;
 
         if (mcast_list->mode == MWIFIEX_PROMISC_MODE) {
                 dev_dbg(priv->adapter->dev, "info: Enable Promiscuous mode\n");
@@ -281,16 +115,15 @@ mwifiex_bss_ioctl_multicast_list(struct mwifiex_private *priv,
                                 /* Set multicast addresses to firmware */
                                 if (old_pkt_filter == priv->curr_pkt_filter) {
                                         /* Send request to firmware */
-                                        ret = mwifiex_prepare_cmd(priv,
+                                        ret = mwifiex_send_cmd_async(priv,
                                                 HostCmd_CMD_MAC_MULTICAST_ADR,
-                                                action, 0, wait, mcast_list);
-                                        if (!ret)
-                                                ret = -EINPROGRESS;
+                                                HostCmd_ACT_GEN_SET, 0,
+                                                mcast_list);
                                 } else {
                                         /* Send request to firmware */
-                                        ret = mwifiex_prepare_cmd(priv,
+                                        ret = mwifiex_send_cmd_async(priv,
                                                 HostCmd_CMD_MAC_MULTICAST_ADR,
-                                                action, 0, NULL,
+                                                HostCmd_ACT_GEN_SET, 0,
                                                 mcast_list);
                                 }
                         }
@@ -300,101 +133,21 @@ mwifiex_bss_ioctl_multicast_list(struct mwifiex_private *priv,
                 "info: old_pkt_filter=%#x, curr_pkt_filter=%#x\n",
                old_pkt_filter, priv->curr_pkt_filter);
         if (old_pkt_filter != priv->curr_pkt_filter) {
-                ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_MAC_CONTROL, action,
-                                          0, wait, &priv->curr_pkt_filter);
-                if (!ret)
-                        ret = -EINPROGRESS;
+                ret = mwifiex_send_cmd_async(priv, HostCmd_CMD_MAC_CONTROL,
+                                             HostCmd_ACT_GEN_SET,
+                                             0, &priv->curr_pkt_filter);
         }
 
         return ret;
 }
 
 /*
- * Sends IOCTL request to set multicast list.
- *
- * This function allocates the IOCTL request buffer, fills it
- * with requisite parameters and calls the IOCTL handler.
- */
-void
-mwifiex_request_set_multicast_list(struct mwifiex_private *priv,
-                                   struct net_device *dev)
-{
-        struct mwifiex_wait_queue *wait = NULL;
-        struct mwifiex_multicast_list mcast_list;
-        u8 wait_option = MWIFIEX_NO_WAIT;
-        int status = 0;
-
-        /* Allocate wait buffer */
-        wait = mwifiex_alloc_fill_wait_queue(priv, wait_option);
-        if (!wait)
-                return;
-
-        if (dev->flags & IFF_PROMISC) {
-                mcast_list.mode = MWIFIEX_PROMISC_MODE;
-        } else if (dev->flags & IFF_ALLMULTI ||
-                   netdev_mc_count(dev) > MWIFIEX_MAX_MULTICAST_LIST_SIZE) {
-                mcast_list.mode = MWIFIEX_ALL_MULTI_MODE;
-        } else {
-                mcast_list.mode = MWIFIEX_MULTICAST_MODE;
-                if (netdev_mc_count(dev))
-                        mcast_list.num_multicast_addr =
-                                mwifiex_copy_mcast_addr(&mcast_list, dev);
-        }
-        status = mwifiex_bss_ioctl_multicast_list(priv, wait,
-                                                  HostCmd_ACT_GEN_SET,
-                                                  &mcast_list);
-
-        status = mwifiex_request_ioctl(priv, wait, status, wait_option);
-        if (wait && status != -EINPROGRESS)
-                kfree(wait);
-
-        return;
-}
-
-/*
- * IOCTL request handler to disconnect from a BSS/IBSS.
- */
-static int mwifiex_bss_ioctl_stop(struct mwifiex_private *priv,
-                                  struct mwifiex_wait_queue *wait, u8 *mac)
-{
-        return mwifiex_deauthenticate(priv, wait, mac);
-}
-
-/*
- * Sends IOCTL request to disconnect from a BSS.
- *
- * This function allocates the IOCTL request buffer, fills it
- * with requisite parameters and calls the IOCTL handler.
- */
-int mwifiex_disconnect(struct mwifiex_private *priv, u8 wait_option, u8 *mac)
-{
-        struct mwifiex_wait_queue *wait = NULL;
-        int status = 0;
-
-        /* Allocate wait buffer */
-        wait = mwifiex_alloc_fill_wait_queue(priv, wait_option);
-        if (!wait)
-                return -ENOMEM;
-
-        status = mwifiex_bss_ioctl_stop(priv, wait, mac);
-
-        status = mwifiex_request_ioctl(priv, wait, status, wait_option);
-
-        kfree(wait);
-        return status;
-}
-EXPORT_SYMBOL_GPL(mwifiex_disconnect);
-
-/*
- * IOCTL request handler to join a BSS/IBSS.
- *
  * In Ad-Hoc mode, the IBSS is created if not found in scan list.
  * In both Ad-Hoc and infra mode, an deauthentication is performed
  * first.
  */
-static int mwifiex_bss_ioctl_start(struct mwifiex_private *priv,
-                                   struct mwifiex_wait_queue *wait,
-                                   struct mwifiex_ssid_bssid *ssid_bssid)
+int mwifiex_bss_start(struct mwifiex_private *priv,
+                      struct mwifiex_ssid_bssid *ssid_bssid)
 {
         int ret = 0;
         struct mwifiex_adapter *adapter = priv->adapter;
@@ -406,7 +159,7 @@ static int mwifiex_bss_ioctl_start(struct mwifiex_private *priv,
 
         if (priv->bss_mode == NL80211_IFTYPE_STATION) {
                 /* Infra mode */
-                ret = mwifiex_deauthenticate(priv, NULL, NULL);
+                ret = mwifiex_deauthenticate(priv, NULL);
                 if (ret)
                         return ret;
 
@@ -427,7 +180,7 @@ static int mwifiex_bss_ioctl_start(struct mwifiex_private *priv,
                 /* Clear any past association response stored for
                  * application retrieval */
                 priv->assoc_rsp_size = 0;
-                ret = mwifiex_associate(priv, wait, &adapter->scan_table[i]);
+                ret = mwifiex_associate(priv, &adapter->scan_table[i]);
                 if (ret)
                         return ret;
         } else {
@@ -441,7 +194,7 @@ static int mwifiex_bss_ioctl_start(struct mwifiex_private *priv,
 
                 /* Exit Adhoc mode first */
                 dev_dbg(adapter->dev, "info: Sending Adhoc Stop\n");
-                ret = mwifiex_deauthenticate(priv, NULL, NULL);
+                ret = mwifiex_deauthenticate(priv, NULL);
                 if (ret)
                         return ret;
 
@@ -460,75 +213,39 @@ static int mwifiex_bss_ioctl_start(struct mwifiex_private *priv,
                 if (i >= 0) {
                         dev_dbg(adapter->dev, "info: network found in scan"
                                                         " list. Joining...\n");
-                        ret = mwifiex_adhoc_join(priv, wait,
-                                                 &adapter->scan_table[i]);
+                        ret = mwifiex_adhoc_join(priv, &adapter->scan_table[i]);
                         if (ret)
                                 return ret;
                 } else {        /* i >= 0 */
                         dev_dbg(adapter->dev, "info: Network not found in "
                                 "the list, creating adhoc with ssid = %s\n",
                                ssid_bssid->ssid.ssid);
-                        ret = mwifiex_adhoc_start(priv, wait,
-                                                  &ssid_bssid->ssid);
+                        ret = mwifiex_adhoc_start(priv, &ssid_bssid->ssid);
                         if (ret)
                                 return ret;
                 }
         }
 
-        if (!ret)
-                ret = -EINPROGRESS;
-
         return ret;
 }
 
 /*
- * Sends IOCTL request to connect with a BSS.
- *
- * This function allocates the IOCTL request buffer, fills it
- * with requisite parameters and calls the IOCTL handler.
- */
-int mwifiex_bss_start(struct mwifiex_private *priv, u8 wait_option,
-                      struct mwifiex_ssid_bssid *ssid_bssid)
-{
-        struct mwifiex_wait_queue *wait = NULL;
-        struct mwifiex_ssid_bssid tmp_ssid_bssid;
-        int status = 0;
-
-        /* Stop the O.S. TX queue if needed */
-        if (!netif_queue_stopped(priv->netdev))
-                netif_stop_queue(priv->netdev);
-
-        /* Allocate wait buffer */
-        wait = mwifiex_alloc_fill_wait_queue(priv, wait_option);
-        if (!wait)
-                return -ENOMEM;
-
-        if (ssid_bssid)
-                memcpy(&tmp_ssid_bssid, ssid_bssid,
-                       sizeof(struct mwifiex_ssid_bssid));
-        status = mwifiex_bss_ioctl_start(priv, wait, &tmp_ssid_bssid);
-
-        status = mwifiex_request_ioctl(priv, wait, status, wait_option);
-
-        kfree(wait);
-        return status;
-}
-
-/*
  * IOCTL request handler to set host sleep configuration.
  *
  * This function prepares the correct firmware command and
  * issues it.
  */
-static int
-mwifiex_pm_ioctl_hs_cfg(struct mwifiex_private *priv,
-                        struct mwifiex_wait_queue *wait,
-                        u16 action, struct mwifiex_ds_hs_cfg *hs_cfg)
+int mwifiex_set_hs_params(struct mwifiex_private *priv, u16 action,
+                          int cmd_type, struct mwifiex_ds_hs_cfg *hs_cfg)
+
 {
         struct mwifiex_adapter *adapter = priv->adapter;
         int status = 0;
         u32 prev_cond = 0;
 
+        if (!hs_cfg)
+                return -ENOMEM;
+
         switch (action) {
         case HostCmd_ACT_GEN_SET:
                 if (adapter->pps_uapsd_mode) {
@@ -561,12 +278,16 @@ mwifiex_pm_ioctl_hs_cfg(struct mwifiex_private *priv,
                                 status = -1;
                                 break;
                         }
-                        status = mwifiex_prepare_cmd(priv,
-                                        HostCmd_CMD_802_11_HS_CFG_ENH,
-                                        HostCmd_ACT_GEN_SET,
-                                        0, wait, &adapter->hs_cfg);
-                        if (!status)
-                                status = -EINPROGRESS;
+                        if (cmd_type == MWIFIEX_SYNC_CMD)
+                                status = mwifiex_send_cmd_sync(priv,
+                                                HostCmd_CMD_802_11_HS_CFG_ENH,
+                                                HostCmd_ACT_GEN_SET, 0,
+                                                &adapter->hs_cfg);
+                        else
+                                status = mwifiex_send_cmd_async(priv,
+                                                HostCmd_CMD_802_11_HS_CFG_ENH,
+                                                HostCmd_ACT_GEN_SET, 0,
+                                                &adapter->hs_cfg);
                         if (hs_cfg->conditions == HOST_SLEEP_CFG_CANCEL)
                                 /* Restore previous condition */
                                 adapter->hs_cfg.conditions =
@@ -592,42 +313,12 @@ mwifiex_pm_ioctl_hs_cfg(struct mwifiex_private *priv,
 }
 
 /*
- * Sends IOCTL request to set Host Sleep parameters.
- *
- * This function allocates the IOCTL request buffer, fills it
- * with requisite parameters and calls the IOCTL handler.
- */
-int mwifiex_set_hs_params(struct mwifiex_private *priv, u16 action,
-                              u8 wait_option,
-                              struct mwifiex_ds_hs_cfg *hscfg)
-{
-        int ret = 0;
-        struct mwifiex_wait_queue *wait = NULL;
-
-        if (!hscfg)
-                return -ENOMEM;
-
-        /* Allocate wait buffer */
-        wait = mwifiex_alloc_fill_wait_queue(priv, wait_option);
-        if (!wait)
-                return -ENOMEM;
-
-        ret = mwifiex_pm_ioctl_hs_cfg(priv, wait, action, hscfg);
-
-        ret = mwifiex_request_ioctl(priv, wait, ret, wait_option);
-
-        if (wait && (ret != -EINPROGRESS))
-                kfree(wait);
-        return ret;
-}
-
-/*
  * Sends IOCTL request to cancel the existing Host Sleep configuration.
  *
  * This function allocates the IOCTL request buffer, fills it
  * with requisite parameters and calls the IOCTL handler.
  */
-int mwifiex_cancel_hs(struct mwifiex_private *priv, u8 wait_option)
+int mwifiex_cancel_hs(struct mwifiex_private *priv, int cmd_type)
 {
         int ret = 0;
         struct mwifiex_ds_hs_cfg hscfg;
@@ -636,7 +327,7 @@ int mwifiex_cancel_hs(struct mwifiex_private *priv, u8 wait_option)
         hscfg.conditions = HOST_SLEEP_CFG_CANCEL;
         hscfg.is_invoke_hostcmd = true;
         ret = mwifiex_set_hs_params(priv, HostCmd_ACT_GEN_SET,
-                                        wait_option, &hscfg);
+                                    cmd_type, &hscfg);
 
         return ret;
 }
@@ -665,8 +356,8 @@ int mwifiex_enable_hs(struct mwifiex_adapter *adapter)
 
         if (mwifiex_set_hs_params(mwifiex_get_priv(adapter,
                                                        MWIFIEX_BSS_ROLE_STA),
-                                      HostCmd_ACT_GEN_SET,
-                                      MWIFIEX_IOCTL_WAIT, &hscfg)) {
+                                  HostCmd_ACT_GEN_SET, MWIFIEX_SYNC_CMD,
+                                  &hscfg)) {
                 dev_err(adapter->dev, "IOCTL request HS enable failed\n");
                 return false;
         }
@@ -679,69 +370,6 @@ int mwifiex_enable_hs(struct mwifiex_adapter *adapter)
 EXPORT_SYMBOL_GPL(mwifiex_enable_hs);
 
 /*
- * IOCTL request handler to get signal information.
- *
- * This function prepares the correct firmware command and
- * issues it to get the signal (RSSI) information.
- *
- * This only works in the connected mode.
- */
-static int mwifiex_get_info_signal(struct mwifiex_private *priv,
-                                   struct mwifiex_wait_queue *wait,
-                                   struct mwifiex_ds_get_signal *signal)
-{
-        int ret = 0;
-
-        if (!wait) {
-                dev_err(priv->adapter->dev, "WAIT information is not present\n");
-                return -1;
-        }
-
-        /* Signal info can be obtained only if connected */
-        if (!priv->media_connected) {
-                dev_dbg(priv->adapter->dev,
-                        "info: Can not get signal in disconnected state\n");
-                return -1;
-        }
-
-        /* Send request to firmware */
-        ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_RSSI_INFO,
-                                  HostCmd_ACT_GEN_GET, 0, wait, signal);
-
-        if (!ret)
-                ret = -EINPROGRESS;
-
-        return ret;
-}
-
-/*
- * IOCTL request handler to get statistics.
- *
- * This function prepares the correct firmware command and
- * issues it to get the statistics (RSSI) information.
- */
-static int mwifiex_get_info_stats(struct mwifiex_private *priv,
-                           struct mwifiex_wait_queue *wait,
-                           struct mwifiex_ds_get_stats *log)
-{
-        int ret = 0;
-
-        if (!wait) {
-                dev_err(priv->adapter->dev, "MWIFIEX IOCTL information is not present\n");
-                return -1;
-        }
-
-        /* Send request to firmware */
-        ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_802_11_GET_LOG,
-                                  HostCmd_ACT_GEN_GET, 0, wait, log);
-
-        if (!ret)
-                ret = -EINPROGRESS;
-
-        return ret;
-}
-
-/*
  * IOCTL request handler to get BSS information.
  *
  * This function collates the information from different driver structures
@@ -813,90 +441,20 @@ int mwifiex_get_bss_info(struct mwifiex_private *priv,
 }
 
 /*
- * IOCTL request handler to get extended version information.
- *
- * This function prepares the correct firmware command and
- * issues it to get the extended version information.
- */
-static int mwifiex_get_info_ver_ext(struct mwifiex_private *priv,
-                                    struct mwifiex_wait_queue *wait,
-                                    struct mwifiex_ver_ext *ver_ext)
-{
-        int ret = 0;
-
-        /* Send request to firmware */
-        ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_VERSION_EXT,
-                                  HostCmd_ACT_GEN_GET, 0, wait, ver_ext);
-        if (!ret)
-                ret = -EINPROGRESS;
-
-        return ret;
-}
-
-/*
- * IOCTL request handler to set/get SNMP MIB parameters.
- *
- * This function prepares the correct firmware command and
- * issues it.
+ * The function sets band configurations.
  *
- * Currently the following parameters are supported -
- *      Set/get RTS Threshold
- *      Set/get fragmentation threshold
- *      Set/get retry count
- */
-int mwifiex_snmp_mib_ioctl(struct mwifiex_private *priv,
-                           struct mwifiex_wait_queue *wait,
-                           u32 cmd_oid, u16 action, u32 *value)
-{
-        int ret = 0;
-
-        if (!value)
-                return -1;
-
-        /* Send request to firmware */
-        ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_802_11_SNMP_MIB,
-                                  action, cmd_oid, wait, value);
-
-        if (!ret)
-                ret = -EINPROGRESS;
-
-        return ret;
-}
-
-/*
- * IOCTL request handler to set/get band configurations.
- *
- * For SET operation, it performs extra checks to make sure the Ad-Hoc
+ * it performs extra checks to make sure the Ad-Hoc
  * band and channel are compatible. Otherwise it returns an error.
  *
- * For GET operation, this function retrieves the following information -
- *      - Infra bands
- *      - Ad-hoc band
- *      - Ad-hoc channel
- *      - Secondary channel offset
  */
-int mwifiex_radio_ioctl_band_cfg(struct mwifiex_private *priv,
-                                 u16 action,
-                                 struct mwifiex_ds_band_cfg *radio_cfg)
+int mwifiex_set_radio_band_cfg(struct mwifiex_private *priv,
+                               struct mwifiex_ds_band_cfg *radio_cfg)
 {
         struct mwifiex_adapter *adapter = priv->adapter;
         u8 infra_band = 0;
         u8 adhoc_band = 0;
         u32 adhoc_channel = 0;
 
-        if (action == HostCmd_ACT_GEN_GET) {
-                /* Infra Bands */
-                radio_cfg->config_bands = adapter->config_bands;
-                /* Adhoc Band */
-                radio_cfg->adhoc_start_band = adapter->adhoc_start_band;
-                /* Adhoc channel */
-                radio_cfg->adhoc_channel = priv->adhoc_channel;
-                /* Secondary channel offset */
-                radio_cfg->sec_chan_offset = adapter->chan_offset;
-                return 0;
-        }
-
-        /* For action = SET */
         infra_band = (u8) radio_cfg->config_bands;
         adhoc_band = (u8) radio_cfg->adhoc_start_band;
         adhoc_channel = radio_cfg->adhoc_channel;
@@ -950,8 +508,8 @@ int mwifiex_radio_ioctl_band_cfg(struct mwifiex_private *priv,
  * This function performs validity checking on channel/frequency
  * compatibility and returns failure if not valid.
  */
-int mwifiex_bss_ioctl_channel(struct mwifiex_private *priv, u16 action,
-                              struct mwifiex_chan_freq_power *chan)
+int mwifiex_bss_set_channel(struct mwifiex_private *priv,
+                            struct mwifiex_chan_freq_power *chan)
 {
         struct mwifiex_adapter *adapter = priv->adapter;
         struct mwifiex_chan_freq_power *cfp = NULL;
@@ -959,16 +517,6 @@ int mwifiex_bss_ioctl_channel(struct mwifiex_private *priv, u16 action,
         if (!chan)
                 return -1;
 
-        if (action == HostCmd_ACT_GEN_GET) {
-                cfp = mwifiex_get_cfp_by_band_and_channel_from_cfg80211(priv,
-                                priv->curr_bss_params.band,
-                                (u16) priv->curr_bss_params.bss_descriptor.
-                                        channel);
-                chan->channel = cfp->channel;
-                chan->freq = cfp->freq;
-
-                return 0;
-        }
         if (!chan->channel && !chan->freq)
                 return -1;
         if (adapter->adhoc_start_band & BAND_AN)
@@ -1024,7 +572,6 @@ int mwifiex_bss_ioctl_channel(struct mwifiex_private *priv, u16 action,
  * issues it to set or get the ad-hoc channel.
  */
 static int mwifiex_bss_ioctl_ibss_channel(struct mwifiex_private *priv,
-                                          struct mwifiex_wait_queue *wait,
                                           u16 action, u16 *channel)
 {
         int ret = 0;
@@ -1039,10 +586,8 @@ static int mwifiex_bss_ioctl_ibss_channel(struct mwifiex_private *priv,
         }
 
         /* Send request to firmware */
-        ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_802_11_RF_CHANNEL,
-                                  action, 0, wait, channel);
-        if (!ret)
-                ret = -EINPROGRESS;
+        ret = mwifiex_send_cmd_sync(priv, HostCmd_CMD_802_11_RF_CHANNEL,
+                                    action, 0, channel);
 
         return ret;
 }
@@ -1054,7 +599,6 @@ static int mwifiex_bss_ioctl_ibss_channel(struct mwifiex_private *priv,
  * these are provided, just the best BSS (best RSSI) is returned.
  */
 int mwifiex_bss_ioctl_find_bss(struct mwifiex_private *priv,
-                               struct mwifiex_wait_queue *wait,
                                struct mwifiex_ssid_bssid *ssid_bssid)
 {
         struct mwifiex_adapter *adapter = priv->adapter;
@@ -1114,10 +658,7 @@ int
 mwifiex_drv_change_adhoc_chan(struct mwifiex_private *priv, int channel)
 {
         int ret = 0;
-        int status = 0;
         struct mwifiex_bss_info bss_info;
-        struct mwifiex_wait_queue *wait = NULL;
-        u8 wait_option = MWIFIEX_IOCTL_WAIT;
         struct mwifiex_ssid_bssid ssid_bssid;
         u16 curr_chan = 0;
 
@@ -1127,19 +668,10 @@ mwifiex_drv_change_adhoc_chan(struct mwifiex_private *priv, int channel)
         if (mwifiex_get_bss_info(priv, &bss_info))
                 return -1;
 
-        /* Allocate wait buffer */
-        wait = mwifiex_alloc_fill_wait_queue(priv, wait_option);
-        if (!wait)
-                return -ENOMEM;
-
         /* Get current channel */
-        status = mwifiex_bss_ioctl_ibss_channel(priv, wait, HostCmd_ACT_GEN_GET,
-                                                &curr_chan);
+        ret = mwifiex_bss_ioctl_ibss_channel(priv, HostCmd_ACT_GEN_GET,
+                                             &curr_chan);
 
-        if (mwifiex_request_ioctl(priv, wait, status, wait_option)) {
-                ret = -1;
-                goto done;
-        }
         if (curr_chan == channel) {
                 ret = 0;
                 goto done;
@@ -1154,23 +686,13 @@ mwifiex_drv_change_adhoc_chan(struct mwifiex_private *priv, int channel)
 
         /* Do disonnect */
         memset(&ssid_bssid, 0, ETH_ALEN);
-        status = mwifiex_bss_ioctl_stop(priv, wait, ssid_bssid.bssid);
+        ret = mwifiex_deauthenticate(priv, ssid_bssid.bssid);
 
-        if (mwifiex_request_ioctl(priv, wait, status, wait_option)) {
-                ret = -1;
-                goto done;
-        }
-
-        status = mwifiex_bss_ioctl_ibss_channel(priv, wait, HostCmd_ACT_GEN_SET,
-                                                (u16 *) &channel);
-
-        if (mwifiex_request_ioctl(priv, wait, status, wait_option)) {
-                ret = -1;
-                goto done;
-        }
+        ret = mwifiex_bss_ioctl_ibss_channel(priv, HostCmd_ACT_GEN_SET,
+                                             (u16 *) &channel);
 
         /* Do specific SSID scanning */
-        if (mwifiex_request_scan(priv, wait_option, &bss_info.ssid)) {
+        if (mwifiex_request_scan(priv, &bss_info.ssid)) {
                 ret = -1;
                 goto done;
         }
@@ -1179,13 +701,8 @@ mwifiex_drv_change_adhoc_chan(struct mwifiex_private *priv, int channel)
         memcpy(&ssid_bssid.ssid, &bss_info.ssid,
                sizeof(struct mwifiex_802_11_ssid));
 
-        status = mwifiex_bss_ioctl_start(priv, wait, &ssid_bssid);
-
-        if (mwifiex_request_ioctl(priv, wait, status, wait_option))
-                ret = -1;
-
+        ret = mwifiex_bss_start(priv, &ssid_bssid);
 done:
-        kfree(wait);
         return ret;
 }
 
@@ -1198,7 +715,6 @@ done:
  * for the band.
  */
 static int mwifiex_rate_ioctl_get_rate_value(struct mwifiex_private *priv,
-                                             struct mwifiex_wait_queue *wait,
                                              struct mwifiex_rate_cfg *rate_cfg)
 {
         struct mwifiex_adapter *adapter = priv->adapter;
@@ -1242,11 +758,9 @@ static int mwifiex_rate_ioctl_get_rate_value(struct mwifiex_private *priv,
                 }
         } else {
                 /* Send request to firmware */
-                ret = mwifiex_prepare_cmd(priv,
-                                          HostCmd_CMD_802_11_TX_RATE_QUERY,
-                                          HostCmd_ACT_GEN_GET, 0, wait, NULL);
-                if (!ret)
-                        ret = -EINPROGRESS;
+                ret = mwifiex_send_cmd_sync(priv,
+                                            HostCmd_CMD_802_11_TX_RATE_QUERY,
+                                            HostCmd_ACT_GEN_GET, 0, NULL);
         }
 
         return ret;
@@ -1261,7 +775,6 @@ static int mwifiex_rate_ioctl_get_rate_value(struct mwifiex_private *priv,
  * The function also performs validation checking on the supplied value.
  */
 static int mwifiex_rate_ioctl_set_rate_value(struct mwifiex_private *priv,
-                                             struct mwifiex_wait_queue *wait,
                                              struct mwifiex_rate_cfg *rate_cfg)
 {
         u8 rates[MWIFIEX_SUPPORTED_RATES];
@@ -1299,8 +812,7 @@ static int mwifiex_rate_ioctl_set_rate_value(struct mwifiex_private *priv,
                 }
                 memset(bitmap_rates, 0, sizeof(bitmap_rates));
 
-                rate_index =
-                        mwifiex_data_rate_to_index(adapter, rate_cfg->rate);
+                rate_index = mwifiex_data_rate_to_index(rate_cfg->rate);
 
                 /* Only allow b/g rates to be set */
                 if (rate_index >= MWIFIEX_RATE_INDEX_HRDSSS0 &&
@@ -1316,10 +828,8 @@ static int mwifiex_rate_ioctl_set_rate_value(struct mwifiex_private *priv,
         }
 
         /* Send request to firmware */
-        ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_TX_RATE_CFG,
-                                  HostCmd_ACT_GEN_SET, 0, wait, bitmap_rates);
-        if (!ret)
-                ret = -EINPROGRESS;
+        ret = mwifiex_send_cmd_sync(priv, HostCmd_CMD_TX_RATE_CFG,
+                                    HostCmd_ACT_GEN_SET, 0, bitmap_rates);
 
         return ret;
 }
@@ -1331,7 +841,6 @@ static int mwifiex_rate_ioctl_set_rate_value(struct mwifiex_private *priv,
  * rate index.
  */
 static int mwifiex_rate_ioctl_cfg(struct mwifiex_private *priv,
-                                  struct mwifiex_wait_queue *wait,
                                   struct mwifiex_rate_cfg *rate_cfg)
 {
         int status = 0;
@@ -1340,11 +849,9 @@ static int mwifiex_rate_ioctl_cfg(struct mwifiex_private *priv,
                 return -1;
 
         if (rate_cfg->action == HostCmd_ACT_GEN_GET)
-                status = mwifiex_rate_ioctl_get_rate_value(
-                                priv, wait, rate_cfg);
+                status = mwifiex_rate_ioctl_get_rate_value(priv, rate_cfg);
         else
-                status = mwifiex_rate_ioctl_set_rate_value(
-                                priv, wait, rate_cfg);
+                status = mwifiex_rate_ioctl_set_rate_value(priv, rate_cfg);
 
         return status;
 }
@@ -1359,30 +866,21 @@ int mwifiex_drv_get_data_rate(struct mwifiex_private *priv,
                               struct mwifiex_rate_cfg *rate)
 {
         int ret = 0;
-        struct mwifiex_wait_queue *wait = NULL;
-        u8 wait_option = MWIFIEX_IOCTL_WAIT;
-
-        /* Allocate wait buffer */
-        wait = mwifiex_alloc_fill_wait_queue(priv, wait_option);
-        if (!wait)
-                return -ENOMEM;
 
         memset(rate, 0, sizeof(struct mwifiex_rate_cfg));
         rate->action = HostCmd_ACT_GEN_GET;
-        ret = mwifiex_rate_ioctl_cfg(priv, wait, rate);
+        ret = mwifiex_rate_ioctl_cfg(priv, rate);
 
-        ret = mwifiex_request_ioctl(priv, wait, ret, wait_option);
         if (!ret) {
                 if (rate && rate->is_rate_auto)
-                        rate->rate = mwifiex_index_to_data_rate(priv->adapter,
-                                        priv->tx_rate, priv->tx_htinfo);
+                        rate->rate = mwifiex_index_to_data_rate(priv->tx_rate,
+                                                        priv->tx_htinfo);
                 else if (rate)
                         rate->rate = priv->data_rate;
         } else {
                 ret = -1;
         }
 
-        kfree(wait);
         return ret;
 }
 
@@ -1398,9 +896,8 @@ int mwifiex_drv_get_data_rate(struct mwifiex_private *priv,
  *      - Modulation class HTBW20
  *      - Modulation class HTBW40
  */
-static int mwifiex_power_ioctl_set_power(struct mwifiex_private *priv,
-                                         struct mwifiex_wait_queue *wait,
-                                         struct mwifiex_power_cfg *power_cfg)
+int mwifiex_set_tx_power(struct mwifiex_private *priv,
+                         struct mwifiex_power_cfg *power_cfg)
 {
         int ret = 0;
         struct host_cmd_ds_txpwr_cfg *txp_cfg = NULL;
@@ -1473,12 +970,10 @@ static int mwifiex_power_ioctl_set_power(struct mwifiex_private *priv,
                 pg->ht_bandwidth = HT_BW_40;
         }
         /* Send request to firmware */
-        ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_TXPWR_CFG,
-                                  HostCmd_ACT_GEN_SET, 0, wait, buf);
-        if (!ret)
-                ret = -EINPROGRESS;
-        kfree(buf);
+        ret = mwifiex_send_cmd_sync(priv, HostCmd_CMD_TXPWR_CFG,
+                                    HostCmd_ACT_GEN_SET, 0, buf);
 
+        kfree(buf);
         return ret;
 }
 
@@ -1488,33 +983,23 @@ static int mwifiex_power_ioctl_set_power(struct mwifiex_private *priv,
  * This function prepares the correct firmware command and
  * issues it.
  */
-static int mwifiex_pm_ioctl_ps_mode(struct mwifiex_private *priv,
-                                    struct mwifiex_wait_queue *wait,
-                                    u32 *ps_mode, u16 action)
+int mwifiex_drv_set_power(struct mwifiex_private *priv, u32 *ps_mode)
 {
         int ret = 0;
         struct mwifiex_adapter *adapter = priv->adapter;
         u16 sub_cmd;
 
-        if (action == HostCmd_ACT_GEN_SET) {
-                if (*ps_mode)
-                        adapter->ps_mode = MWIFIEX_802_11_POWER_MODE_PSP;
-                else
-                        adapter->ps_mode = MWIFIEX_802_11_POWER_MODE_CAM;
-                sub_cmd = (*ps_mode) ? EN_AUTO_PS : DIS_AUTO_PS;
-                ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_802_11_PS_MODE_ENH,
-                                          sub_cmd, BITMAP_STA_PS, wait, NULL);
-                if ((!ret) && (sub_cmd == DIS_AUTO_PS))
-                        ret = mwifiex_prepare_cmd(priv,
-                                        HostCmd_CMD_802_11_PS_MODE_ENH, GET_PS,
-                                        0, NULL, NULL);
-        } else {
-                ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_802_11_PS_MODE_ENH,
-                                          GET_PS, 0, wait, NULL);
-        }
-
-        if (!ret)
-                ret = -EINPROGRESS;
+        if (*ps_mode)
+                adapter->ps_mode = MWIFIEX_802_11_POWER_MODE_PSP;
+        else
+                adapter->ps_mode = MWIFIEX_802_11_POWER_MODE_CAM;
+        sub_cmd = (*ps_mode) ? EN_AUTO_PS : DIS_AUTO_PS;
+        ret = mwifiex_send_cmd_sync(priv, HostCmd_CMD_802_11_PS_MODE_ENH,
+                                    sub_cmd, BITMAP_STA_PS, NULL);
+        if ((!ret) && (sub_cmd == DIS_AUTO_PS))
+                ret = mwifiex_send_cmd_async(priv,
+                                HostCmd_CMD_802_11_PS_MODE_ENH, GET_PS,
+                                0, NULL);
 
         return ret;
 }
@@ -1600,18 +1085,14 @@ static int mwifiex_set_wapi_ie(struct mwifiex_private *priv,
  * This function prepares the correct firmware command and
  * issues it.
  */
-static int mwifiex_sec_ioctl_set_wapi_key(struct mwifiex_adapter *adapter,
-                               struct mwifiex_wait_queue *wait,
+static int mwifiex_sec_ioctl_set_wapi_key(struct mwifiex_private *priv,
                                struct mwifiex_ds_encrypt_key *encrypt_key)
 {
         int ret = 0;
-        struct mwifiex_private *priv = adapter->priv[wait->bss_index];
 
-        ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_802_11_KEY_MATERIAL,
-                                  HostCmd_ACT_GEN_SET, KEY_INFO_ENABLED,
-                                  wait, encrypt_key);
-        if (!ret)
-                ret = -EINPROGRESS;
+        ret = mwifiex_send_cmd_sync(priv, HostCmd_CMD_802_11_KEY_MATERIAL,
+                                    HostCmd_ACT_GEN_SET, KEY_INFO_ENABLED,
+                                    encrypt_key);
 
         return ret;
 }
@@ -1622,12 +1103,10 @@ static int mwifiex_sec_ioctl_set_wapi_key(struct mwifiex_adapter *adapter,
  * This function prepares the correct firmware command and
  * issues it, after validation checks.
  */
-static int mwifiex_sec_ioctl_set_wep_key(struct mwifiex_adapter *adapter,
-                              struct mwifiex_wait_queue *wait,
+static int mwifiex_sec_ioctl_set_wep_key(struct mwifiex_private *priv,
                               struct mwifiex_ds_encrypt_key *encrypt_key)
 {
         int ret = 0;
-        struct mwifiex_private *priv = adapter->priv[wait->bss_index];
         struct mwifiex_wep_key *wep_key = NULL;
         int index;
 
@@ -1641,7 +1120,7 @@ static int mwifiex_sec_ioctl_set_wep_key(struct mwifiex_adapter *adapter,
                 /* Copy the required key as the current key */
                 wep_key = &priv->wep_key[index];
                 if (!wep_key->key_length) {
-                        dev_err(adapter->dev,
+                        dev_err(priv->adapter->dev,
                                 "key not set, so cannot enable it\n");
                         return -1;
                 }
@@ -1661,8 +1140,9 @@ static int mwifiex_sec_ioctl_set_wep_key(struct mwifiex_adapter *adapter,
         }
         if (wep_key->key_length) {
                 /* Send request to firmware */
-                ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_802_11_KEY_MATERIAL,
-                                          HostCmd_ACT_GEN_SET, 0, NULL, NULL);
+                ret = mwifiex_send_cmd_async(priv,
+                                             HostCmd_CMD_802_11_KEY_MATERIAL,
+                                             HostCmd_ACT_GEN_SET, 0, NULL);
                 if (ret)
                         return ret;
         }
@@ -1672,11 +1152,9 @@ static int mwifiex_sec_ioctl_set_wep_key(struct mwifiex_adapter *adapter,
                 priv->curr_pkt_filter &= ~HostCmd_ACT_MAC_WEP_ENABLE;
 
         /* Send request to firmware */
-        ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_MAC_CONTROL,
-                                  HostCmd_ACT_GEN_SET, 0, wait,
-                                  &priv->curr_pkt_filter);
-        if (!ret)
-                ret = -EINPROGRESS;
+        ret = mwifiex_send_cmd_sync(priv, HostCmd_CMD_MAC_CONTROL,
+                                    HostCmd_ACT_GEN_SET, 0,
+                                    &priv->curr_pkt_filter);
 
         return ret;
 }
@@ -1691,18 +1169,16 @@ static int mwifiex_sec_ioctl_set_wep_key(struct mwifiex_adapter *adapter,
  *
  * This function can also be used to disable a currently set key.
  */
-static int mwifiex_sec_ioctl_set_wpa_key(struct mwifiex_adapter *adapter,
-                              struct mwifiex_wait_queue *wait,
+static int mwifiex_sec_ioctl_set_wpa_key(struct mwifiex_private *priv,
                               struct mwifiex_ds_encrypt_key *encrypt_key)
 {
         int ret = 0;
-        struct mwifiex_private *priv = adapter->priv[wait->bss_index];
         u8 remove_key = false;
         struct host_cmd_ds_802_11_key_material *ibss_key;
 
         /* Current driver only supports key length of up to 32 bytes */
         if (encrypt_key->key_len > MWIFIEX_MAX_KEY_LENGTH) {
-                dev_err(adapter->dev, "key length too long\n");
+                dev_err(priv->adapter->dev, "key length too long\n");
                 return -1;
         }
 
@@ -1713,9 +1189,10 @@ static int mwifiex_sec_ioctl_set_wpa_key(struct mwifiex_adapter *adapter,
                  */
                 /* Send the key as PTK to firmware */
                 encrypt_key->key_index = MWIFIEX_KEY_INDEX_UNICAST;
-                ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_802_11_KEY_MATERIAL,
-                                          HostCmd_ACT_GEN_SET, KEY_INFO_ENABLED,
-                                          NULL, encrypt_key);
+                ret = mwifiex_send_cmd_async(priv,
+                                        HostCmd_CMD_802_11_KEY_MATERIAL,
+                                        HostCmd_ACT_GEN_SET, KEY_INFO_ENABLED,
+                                        encrypt_key);
                 if (ret)
                         return ret;
 
@@ -1729,8 +1206,7 @@ static int mwifiex_sec_ioctl_set_wpa_key(struct mwifiex_adapter *adapter,
                        sizeof(ibss_key->key_param_set.key_len));
                 ibss_key->key_param_set.key_type_id
                         = cpu_to_le16(KEY_TYPE_ID_TKIP);
-                ibss_key->key_param_set.key_info
-                        = cpu_to_le16(KEY_INFO_TKIP_ENABLED);
+                ibss_key->key_param_set.key_info = cpu_to_le16(KEY_ENABLED);
 
                 /* Send the key as GTK to firmware */
                 encrypt_key->key_index = ~MWIFIEX_KEY_INDEX_UNICAST;
@@ -1741,18 +1217,16 @@ static int mwifiex_sec_ioctl_set_wpa_key(struct mwifiex_adapter *adapter,
 
         if (remove_key)
                 /* Send request to firmware */
-                ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_802_11_KEY_MATERIAL,
-                                          HostCmd_ACT_GEN_SET,
-                                          !(KEY_INFO_ENABLED),
-                                          wait, encrypt_key);
+                ret = mwifiex_send_cmd_sync(priv,
+                                       HostCmd_CMD_802_11_KEY_MATERIAL,
+                                       HostCmd_ACT_GEN_SET, !(KEY_INFO_ENABLED),
+                                       encrypt_key);
         else
                 /* Send request to firmware */
-                ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_802_11_KEY_MATERIAL,
-                                          HostCmd_ACT_GEN_SET, KEY_INFO_ENABLED,
-                                          wait, encrypt_key);
-
-        if (!ret)
-                ret = -EINPROGRESS;
+                ret = mwifiex_send_cmd_sync(priv,
+                                        HostCmd_CMD_802_11_KEY_MATERIAL,
+                                        HostCmd_ACT_GEN_SET, KEY_INFO_ENABLED,
+                                        encrypt_key);
 
         return ret;
 }
@@ -1765,21 +1239,16 @@ static int mwifiex_sec_ioctl_set_wpa_key(struct mwifiex_adapter *adapter,
  */
 static int
 mwifiex_sec_ioctl_encrypt_key(struct mwifiex_private *priv,
-                              struct mwifiex_wait_queue *wait,
                               struct mwifiex_ds_encrypt_key *encrypt_key)
 {
         int status = 0;
-        struct mwifiex_adapter *adapter = priv->adapter;
 
         if (encrypt_key->is_wapi_key)
-                status = mwifiex_sec_ioctl_set_wapi_key(adapter, wait,
-                                                        encrypt_key);
+                status = mwifiex_sec_ioctl_set_wapi_key(priv, encrypt_key);
         else if (encrypt_key->key_len > WLAN_KEY_LEN_WEP104)
-                status = mwifiex_sec_ioctl_set_wpa_key(adapter, wait,
-                                                       encrypt_key);
+                status = mwifiex_sec_ioctl_set_wpa_key(priv, encrypt_key);
         else
-                status = mwifiex_sec_ioctl_set_wep_key(adapter, wait,
-                                                       encrypt_key);
+                status = mwifiex_sec_ioctl_set_wep_key(priv, encrypt_key);
         return status;
 }
 
@@ -1807,94 +1276,31 @@ mwifiex_drv_get_driver_version(struct mwifiex_adapter *adapter, char *version,
 }
 
 /*
- * Sends IOCTL request to set Tx power. It can be set to either auto
- * or a fixed value.
- *
- * This function allocates the IOCTL request buffer, fills it
- * with requisite parameters and calls the IOCTL handler.
- */
-int
-mwifiex_set_tx_power(struct mwifiex_private *priv, int type, int dbm)
-{
-        struct mwifiex_power_cfg power_cfg;
-        struct mwifiex_wait_queue *wait = NULL;
-        int status = 0;
-        int ret = 0;
-
-        wait = mwifiex_alloc_fill_wait_queue(priv, MWIFIEX_IOCTL_WAIT);
-        if (!wait)
-                return -ENOMEM;
-
-        if (type == NL80211_TX_POWER_FIXED) {
-                power_cfg.is_power_auto = 0;
-                power_cfg.power_level = dbm;
-        } else {
-                power_cfg.is_power_auto = 1;
-        }
-        status = mwifiex_power_ioctl_set_power(priv, wait, &power_cfg);
-
-        ret = mwifiex_request_ioctl(priv, wait, status, MWIFIEX_IOCTL_WAIT);
-
-        kfree(wait);
-        return ret;
-}
-
-/*
- * Sends IOCTL request to get scan table.
- *
- * This function allocates the IOCTL request buffer, fills it
- * with requisite parameters and calls the IOCTL handler.
- */
-int mwifiex_get_scan_table(struct mwifiex_private *priv, u8 wait_option,
-                           struct mwifiex_scan_resp *scan_resp)
-{
-        struct mwifiex_wait_queue *wait = NULL;
-        struct mwifiex_scan_resp scan;
-        int status = 0;
-
-        /* Allocate wait buffer */
-        wait = mwifiex_alloc_fill_wait_queue(priv, wait_option);
-        if (!wait)
-                return -ENOMEM;
-
-        status = mwifiex_scan_networks(priv, wait, HostCmd_ACT_GEN_GET,
-                                       NULL, &scan);
-
-        status = mwifiex_request_ioctl(priv, wait, status, wait_option);
-        if (!status) {
-                if (scan_resp)
-                        memcpy(scan_resp, &scan,
-                               sizeof(struct mwifiex_scan_resp));
-        }
-
-        if (wait && (status != -EINPROGRESS))
-                kfree(wait);
-        return status;
-}
-
-/*
  * Sends IOCTL request to get signal information.
  *
  * This function allocates the IOCTL request buffer, fills it
  * with requisite parameters and calls the IOCTL handler.
  */
-int mwifiex_get_signal_info(struct mwifiex_private *priv, u8 wait_option,
+int mwifiex_get_signal_info(struct mwifiex_private *priv,
                             struct mwifiex_ds_get_signal *signal)
 {
         struct mwifiex_ds_get_signal info;
-        struct mwifiex_wait_queue *wait = NULL;
         int status = 0;
 
-        /* Allocate wait buffer */
-        wait = mwifiex_alloc_fill_wait_queue(priv, wait_option);
-        if (!wait)
-                return -ENOMEM;
-
+        memset(&info, 0, sizeof(struct mwifiex_ds_get_signal));
         info.selector = ALL_RSSI_INFO_MASK;
 
-        status = mwifiex_get_info_signal(priv, wait, &info);
+        /* Signal info can be obtained only if connected */
+        if (!priv->media_connected) {
+                dev_dbg(priv->adapter->dev,
+                        "info: Can not get signal in disconnected state\n");
+                return -1;
+        }
+
+        /* Send request to firmware */
+        status = mwifiex_send_cmd_sync(priv, HostCmd_CMD_RSSI_INFO,
+                                       HostCmd_ACT_GEN_GET, 0, signal);
 
-        status = mwifiex_request_ioctl(priv, wait, status, wait_option);
         if (!status) {
                 if (signal)
                         memcpy(signal, &info,
@@ -1905,8 +1311,6 @@ int mwifiex_get_signal_info(struct mwifiex_private *priv, u8 wait_option,
                         priv->w_stats.qual.noise = info.bcn_nf_avg;
         }
 
-        if (wait && (status != -EINPROGRESS))
-                kfree(wait);
         return status;
 }
 
@@ -1919,15 +1323,9 @@ int mwifiex_get_signal_info(struct mwifiex_private *priv, u8 wait_option,
 int mwifiex_set_encode(struct mwifiex_private *priv, const u8 *key,
                         int key_len, u8 key_index, int disable)
 {
-        struct mwifiex_wait_queue *wait = NULL;
         struct mwifiex_ds_encrypt_key encrypt_key;
-        int status = 0;
         int ret = 0;
 
-        wait = mwifiex_alloc_fill_wait_queue(priv, MWIFIEX_IOCTL_WAIT);
-        if (!wait)
-                return -ENOMEM;
-
         memset(&encrypt_key, 0, sizeof(struct mwifiex_ds_encrypt_key));
         encrypt_key.key_len = key_len;
         if (!disable) {
@@ -1938,40 +1336,8 @@ int mwifiex_set_encode(struct mwifiex_private *priv, const u8 *key,
                 encrypt_key.key_disable = true;
         }
 
-        status = mwifiex_sec_ioctl_encrypt_key(priv, wait, &encrypt_key);
-
-        if (mwifiex_request_ioctl(priv, wait, status, MWIFIEX_IOCTL_WAIT))
-                ret = -EFAULT;
-
-        kfree(wait);
-        return ret;
-}
-
-/*
- * Sends IOCTL request to set power management parameters.
- *
- * This function allocates the IOCTL request buffer, fills it
- * with requisite parameters and calls the IOCTL handler.
- */
-int
-mwifiex_drv_set_power(struct mwifiex_private *priv, bool power_on)
-{
-        int ret = 0;
-        int status = 0;
-        struct mwifiex_wait_queue *wait = NULL;
-        u32 ps_mode;
-
-        wait = mwifiex_alloc_fill_wait_queue(priv, MWIFIEX_IOCTL_WAIT);
-        if (!wait)
-                return -ENOMEM;
-
-        ps_mode = power_on;
-        status = mwifiex_pm_ioctl_ps_mode(priv, wait, &ps_mode,
-                                          HostCmd_ACT_GEN_SET);
+        ret = mwifiex_sec_ioctl_encrypt_key(priv, &encrypt_key);
 
-        ret = mwifiex_request_ioctl(priv, wait, status, MWIFIEX_IOCTL_WAIT);
-
-        kfree(wait);
         return ret;
 }
 
@@ -1985,26 +1351,17 @@ int
 mwifiex_get_ver_ext(struct mwifiex_private *priv)
 {
         struct mwifiex_ver_ext ver_ext;
-        struct mwifiex_wait_queue *wait = NULL;
-        int status = 0;
         int ret = 0;
-        u8 wait_option = MWIFIEX_IOCTL_WAIT;
-
-        /* Allocate wait buffer */
-        wait = mwifiex_alloc_fill_wait_queue(priv, wait_option);
-        if (!wait)
-                return -ENOMEM;
 
         /* get fw version */
         memset(&ver_ext, 0, sizeof(struct host_cmd_ds_version_ext));
-        status = mwifiex_get_info_ver_ext(priv, wait, &ver_ext);
-
-        ret = mwifiex_request_ioctl(priv, wait, status, wait_option);
+        /* Send request to firmware */
+        ret = mwifiex_send_cmd_sync(priv, HostCmd_CMD_VERSION_EXT,
+                                    HostCmd_ACT_GEN_GET, 0, &ver_ext);
 
         if (ret)
                 ret = -1;
 
-        kfree(wait);
         return ret;
 }
 
@@ -2019,21 +1376,13 @@ mwifiex_get_stats_info(struct mwifiex_private *priv,
                        struct mwifiex_ds_get_stats *log)
 {
         int ret = 0;
-        int status = 0;
-        struct mwifiex_wait_queue *wait = NULL;
         struct mwifiex_ds_get_stats get_log;
-        u8 wait_option = MWIFIEX_IOCTL_WAIT;
-
-        /* Allocate wait buffer */
-        wait = mwifiex_alloc_fill_wait_queue(priv, wait_option);
-        if (!wait)
-                return -ENOMEM;
 
         memset(&get_log, 0, sizeof(struct mwifiex_ds_get_stats));
-        status = mwifiex_get_info_stats(priv, wait, &get_log);
+        /* Send request to firmware */
+        ret = mwifiex_send_cmd_sync(priv, HostCmd_CMD_802_11_GET_LOG,
+                                    HostCmd_ACT_GEN_GET, 0, &get_log);
 
-        /* Send IOCTL request to MWIFIEX */
-        ret = mwifiex_request_ioctl(priv, wait, status, wait_option);
         if (!ret) {
                 if (log)
                         memcpy(log, &get_log, sizeof(struct
@@ -2043,7 +1392,6 @@ mwifiex_get_stats_info(struct mwifiex_private *priv,
                 priv->w_stats.discard.misc = get_log.ack_failure;
         }
 
-        kfree(wait);
         return ret;
 }
 
@@ -2061,7 +1409,6 @@ mwifiex_get_stats_info(struct mwifiex_private *priv,
  *      - CAU
  */
 static int mwifiex_reg_mem_ioctl_reg_rw(struct mwifiex_private *priv,
-                                        struct mwifiex_wait_queue *wait,
                                         struct mwifiex_ds_reg_rw *reg_rw,
                                         u16 action)
 {
@@ -2089,10 +1436,7 @@ static int mwifiex_reg_mem_ioctl_reg_rw(struct mwifiex_private *priv,
         }
 
         /* Send request to firmware */
-        ret = mwifiex_prepare_cmd(priv, cmd_no, action, 0, wait, reg_rw);
-
-        if (!ret)
-                ret = -EINPROGRESS;
+        ret = mwifiex_send_cmd_sync(priv, cmd_no, action, 0, reg_rw);
 
         return ret;
 }
@@ -2108,23 +1452,13 @@ mwifiex_reg_write(struct mwifiex_private *priv, u32 reg_type,
                   u32 reg_offset, u32 reg_value)
 {
         int ret = 0;
-        int status = 0;
-        struct mwifiex_wait_queue *wait = NULL;
         struct mwifiex_ds_reg_rw reg_rw;
 
-        wait = mwifiex_alloc_fill_wait_queue(priv, MWIFIEX_IOCTL_WAIT);
-        if (!wait)
-                return -ENOMEM;
-
         reg_rw.type = cpu_to_le32(reg_type);
         reg_rw.offset = cpu_to_le32(reg_offset);
         reg_rw.value = cpu_to_le32(reg_value);
-        status = mwifiex_reg_mem_ioctl_reg_rw(priv, wait, &reg_rw,
-                                              HostCmd_ACT_GEN_SET);
+        ret = mwifiex_reg_mem_ioctl_reg_rw(priv, &reg_rw, HostCmd_ACT_GEN_SET);
 
-        ret = mwifiex_request_ioctl(priv, wait, status, MWIFIEX_IOCTL_WAIT);
-
-        kfree(wait);
         return ret;
 }
 
@@ -2139,50 +1473,18 @@ mwifiex_reg_read(struct mwifiex_private *priv, u32 reg_type,
                  u32 reg_offset, u32 *value)
 {
         int ret = 0;
-        int status = 0;
-        struct mwifiex_wait_queue *wait = NULL;
         struct mwifiex_ds_reg_rw reg_rw;
 
-        wait = mwifiex_alloc_fill_wait_queue(priv, MWIFIEX_IOCTL_WAIT);
-        if (!wait)
-                return -ENOMEM;
-
         reg_rw.type = cpu_to_le32(reg_type);
         reg_rw.offset = cpu_to_le32(reg_offset);
-        status = mwifiex_reg_mem_ioctl_reg_rw(priv, wait, &reg_rw,
-                                              HostCmd_ACT_GEN_GET);
+        ret = mwifiex_reg_mem_ioctl_reg_rw(priv, &reg_rw, HostCmd_ACT_GEN_GET);
 
-        ret = mwifiex_request_ioctl(priv, wait, status, MWIFIEX_IOCTL_WAIT);
         if (ret)
                 goto done;
 
         *value = le32_to_cpu(reg_rw.value);
 
 done:
-        kfree(wait);
-        return ret;
-}
-
-/*
- * IOCTL request handler to read EEPROM.
- *
- * This function prepares the correct firmware command and
- * issues it.
- */
-static int
-mwifiex_reg_mem_ioctl_read_eeprom(struct mwifiex_private *priv,
-                                  struct mwifiex_wait_queue *wait,
-                                  struct mwifiex_ds_read_eeprom *rd_eeprom)
-{
-        int ret = 0;
-
-        /* Send request to firmware */
-        ret = mwifiex_prepare_cmd(priv, HostCmd_CMD_802_11_EEPROM_ACCESS,
-                                  HostCmd_ACT_GEN_GET, 0, wait, rd_eeprom);
-
-        if (!ret)
-                ret = -EINPROGRESS;
-
         return ret;
 }
 
@@ -2197,25 +1499,17 @@ mwifiex_eeprom_read(struct mwifiex_private *priv, u16 offset, u16 bytes,
                     u8 *value)
 {
         int ret = 0;
-        int status = 0;
-        struct mwifiex_wait_queue *wait = NULL;
         struct mwifiex_ds_read_eeprom rd_eeprom;
 
-        wait = mwifiex_alloc_fill_wait_queue(priv, MWIFIEX_IOCTL_WAIT);
-        if (!wait)
-                return -ENOMEM;
-
         rd_eeprom.offset = cpu_to_le16((u16) offset);
         rd_eeprom.byte_count = cpu_to_le16((u16) bytes);
-        status = mwifiex_reg_mem_ioctl_read_eeprom(priv, wait, &rd_eeprom);
 
-        ret = mwifiex_request_ioctl(priv, wait, status, MWIFIEX_IOCTL_WAIT);
-        if (ret)
-                goto done;
+        /* Send request to firmware */
+        ret = mwifiex_send_cmd_sync(priv, HostCmd_CMD_802_11_EEPROM_ACCESS,
+                                    HostCmd_ACT_GEN_GET, 0, &rd_eeprom);
 
-        memcpy(value, rd_eeprom.value, MAX_EEPROM_DATA);
-done:
-        kfree(wait);
+        if (!ret)
+                memcpy(value, rd_eeprom.value, MAX_EEPROM_DATA);
         return ret;
 }
 
diff --git a/drivers/net/wireless/mwifiex/sta_tx.c b/drivers/net/wireless/mwifiex/sta_tx.c
index e8db6bd021c6..b261d812c4d3 100644
--- a/drivers/net/wireless/mwifiex/sta_tx.c
+++ b/drivers/net/wireless/mwifiex/sta_tx.c
@@ -51,7 +51,7 @@ void *mwifiex_process_sta_txpd(struct mwifiex_private *priv,
         if (!skb->len) {
                 dev_err(adapter->dev, "Tx: bad packet length: %d\n",
                        skb->len);
-                tx_info->status_code = MWIFIEX_ERROR_PKT_SIZE_INVALID;
+                tx_info->status_code = -1;
                 return skb->data;
         }
 
diff --git a/drivers/net/wireless/mwifiex/util.c b/drivers/net/wireless/mwifiex/util.c
index 205022aa52f5..9f65587622fd 100644
--- a/drivers/net/wireless/mwifiex/util.c
+++ b/drivers/net/wireless/mwifiex/util.c
@@ -55,17 +55,12 @@ int mwifiex_shutdown_fw_complete(struct mwifiex_adapter *adapter)
 }
 
 /*
- * IOCTL request handler to send function init/shutdown command
+ * This function sends init/shutdown command
  * to firmware.
- *
- * This function prepares the correct firmware command and
- * issues it.
  */
-int mwifiex_misc_ioctl_init_shutdown(struct mwifiex_adapter *adapter,
-                                     struct mwifiex_wait_queue *wait,
-                                     u32 func_init_shutdown)
+int mwifiex_init_shutdown_fw(struct mwifiex_private *priv,
+                             u32 func_init_shutdown)
 {
-        struct mwifiex_private *priv = adapter->priv[wait->bss_index];
         int ret;
         u16 cmd;
 
@@ -74,19 +69,16 @@ int mwifiex_misc_ioctl_init_shutdown(struct mwifiex_adapter *adapter,
         } else if (func_init_shutdown == MWIFIEX_FUNC_SHUTDOWN) {
                 cmd = HostCmd_CMD_FUNC_SHUTDOWN;
         } else {
-                dev_err(adapter->dev, "unsupported parameter\n");
+                dev_err(priv->adapter->dev, "unsupported parameter\n");
                 return -1;
         }
 
         /* Send command to firmware */
-        ret = mwifiex_prepare_cmd(priv, cmd, HostCmd_ACT_GEN_SET,
-                                  0, wait, NULL);
-
-        if (!ret)
-                ret = -EINPROGRESS;
+        ret = mwifiex_send_cmd_sync(priv, cmd, HostCmd_ACT_GEN_SET, 0, NULL);
 
         return ret;
 }
+EXPORT_SYMBOL_GPL(mwifiex_init_shutdown_fw);
 
 /*
  * IOCTL request handler to set/get debug information.
@@ -222,31 +214,18 @@ int mwifiex_recv_complete(struct mwifiex_adapter *adapter,
  * corresponding waiting function. Otherwise, it processes the
  * IOCTL response and frees the response buffer.
  */
-int mwifiex_ioctl_complete(struct mwifiex_adapter *adapter,
-                           struct mwifiex_wait_queue *wait_queue,
-                           int status)
+int mwifiex_complete_cmd(struct mwifiex_adapter *adapter)
 {
-        enum mwifiex_error_code status_code =
-                (enum mwifiex_error_code) wait_queue->status;
-
-        atomic_dec(&adapter->ioctl_pending);
+        atomic_dec(&adapter->cmd_pending);
+        dev_dbg(adapter->dev, "cmd completed: status=%d\n",
+                                        adapter->cmd_wait_q.status);
 
-        dev_dbg(adapter->dev, "cmd: IOCTL completed: status=%d,"
-                        " status_code=%#x\n", status, status_code);
+        adapter->cmd_wait_q.condition = true;
 
-        if (wait_queue->enabled) {
-                *wait_queue->condition = true;
-                wait_queue->status = status;
-                if (status && (status_code == MWIFIEX_ERROR_CMD_TIMEOUT))
-                        dev_err(adapter->dev, "cmd timeout\n");
-                else
-                        wake_up_interruptible(wait_queue->wait);
-        } else {
-                if (status)
-                        dev_err(adapter->dev, "cmd failed: status_code=%#x\n",
-                               status_code);
-                kfree(wait_queue);
-        }
+        if (adapter->cmd_wait_q.status == -ETIMEDOUT)
+                dev_err(adapter->dev, "cmd timeout\n");
+        else
+                wake_up_interruptible(&adapter->cmd_wait_q.wait);
 
         return 0;
 }
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index 1cfbc6bed692..99e8431c1e93 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -177,8 +177,7 @@ static void mwifiex_wmm_default_queue_priorities(struct mwifiex_private *priv)
  * This function map ACs to TIDs.
  */
 static void
-mwifiex_wmm_queue_priorities_tid(struct mwifiex_private *priv,
-                                 u8 queue_priority[])
+mwifiex_wmm_queue_priorities_tid(u8 queue_priority[])
 {
         int i;
 
@@ -247,7 +246,7 @@ mwifiex_wmm_setup_queue_priorities(struct mwifiex_private *priv,
                 }
         }
 
-        mwifiex_wmm_queue_priorities_tid(priv, priv->wmm.queue_priority);
+        mwifiex_wmm_queue_priorities_tid(priv->wmm.queue_priority);
 }
 
 /*
@@ -416,7 +415,7 @@ mwifiex_wmm_lists_empty(struct mwifiex_adapter *adapter)
                 priv = adapter->priv[j];
                 if (priv) {
                         for (i = 0; i < MAX_NUM_TID; i++)
-                                if (!mwifiex_wmm_is_ra_list_empty(adapter,
+                                if (!mwifiex_wmm_is_ra_list_empty(
                                              &priv->wmm.tid_tbl_ptr[i].ra_list))
                                         return false;
                 }
@@ -1161,7 +1160,7 @@ mwifiex_dequeue_tx_packet(struct mwifiex_adapter *adapter)
         if (!ptr)
                 return -1;
 
-        tid = mwifiex_get_tid(priv->adapter, ptr);
+        tid = mwifiex_get_tid(ptr);
 
         dev_dbg(adapter->dev, "data: tid=%d\n", tid);
 
@@ -1186,14 +1185,14 @@ mwifiex_dequeue_tx_packet(struct mwifiex_adapter *adapter)
                 /* ra_list_spinlock has been freed in
                    mwifiex_send_single_packet() */
         } else {
-                if (mwifiex_is_ampdu_allowed(priv, ptr, tid)) {
-                        if (mwifiex_is_ba_stream_avail(priv)) {
+                if (mwifiex_is_ampdu_allowed(priv, tid)) {
+                        if (mwifiex_space_avail_for_new_ba_stream(adapter)) {
                                 mwifiex_11n_create_tx_ba_stream_tbl(priv,
                                                 ptr->ra, tid,
                                                 BA_STREAM_SETUP_INPROGRESS);
                                 mwifiex_send_addba(priv, tid, ptr->ra);
                         } else if (mwifiex_find_stream_to_delete
-                                   (priv, ptr, tid, &tid_del, ra)) {
+                                   (priv, tid, &tid_del, ra)) {
                                 mwifiex_11n_create_tx_ba_stream_tbl(priv,
                                                 ptr->ra, tid,
                                                 BA_STREAM_SETUP_INPROGRESS);
@@ -1202,7 +1201,7 @@ mwifiex_dequeue_tx_packet(struct mwifiex_adapter *adapter)
                 }
 /* Minimum number of AMSDU */
 #define MIN_NUM_AMSDU 2
-                if (mwifiex_is_amsdu_allowed(priv, ptr, tid) &&
+                if (mwifiex_is_amsdu_allowed(priv, tid) &&
                     (mwifiex_num_pkts_in_txq(priv, ptr, adapter->tx_buf_size) >=
                      MIN_NUM_AMSDU))
                         mwifiex_11n_aggregate_pkt(priv, ptr, INTF_HEADER_LEN,
@@ -1232,6 +1231,4 @@ mwifiex_wmm_process_tx(struct mwifiex_adapter *adapter)
                 if (mwifiex_dequeue_tx_packet(adapter))
                         break;
         } while (true);
-
-        return;
 }
diff --git a/drivers/net/wireless/mwifiex/wmm.h b/drivers/net/wireless/mwifiex/wmm.h
index 241f1b0b77f9..fcea1f68792f 100644
--- a/drivers/net/wireless/mwifiex/wmm.h
+++ b/drivers/net/wireless/mwifiex/wmm.h
@@ -35,8 +35,7 @@ enum ieee_types_wmm_ecw_bitmasks {
  * This function retrieves the TID of the given RA list.
  */
 static inline int
-mwifiex_get_tid(struct mwifiex_adapter *adapter,
-                struct mwifiex_ra_list_tbl *ptr)
+mwifiex_get_tid(struct mwifiex_ra_list_tbl *ptr)
 {
         struct sk_buff *skb;
 
@@ -52,7 +51,7 @@ mwifiex_get_tid(struct mwifiex_adapter *adapter,
  * This function gets the length of a list.
  */
 static inline int
-mwifiex_wmm_list_len(struct mwifiex_adapter *adapter, struct list_head *head)
+mwifiex_wmm_list_len(struct list_head *head)
 {
         struct list_head *pos;
         int count = 0;
@@ -67,8 +66,7 @@ mwifiex_wmm_list_len(struct mwifiex_adapter *adapter, struct list_head *head)
  * This function checks if a RA list is empty or not.
  */
 static inline u8
-mwifiex_wmm_is_ra_list_empty(struct mwifiex_adapter *adapter,
-                             struct list_head *ra_list_hhead)
+mwifiex_wmm_is_ra_list_empty(struct list_head *ra_list_hhead)
 {
         struct mwifiex_ra_list_tbl *ra_list;
         int is_list_empty;
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 8913180a7bd3..28ebaec80be6 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -289,10 +289,17 @@ struct mwl8k_vif {
 #define MWL8K_VIF(_vif) ((struct mwl8k_vif *)&((_vif)->drv_priv))
 #define IEEE80211_KEY_CONF(_u8) ((struct ieee80211_key_conf *)(_u8))
 
+struct tx_traffic_info {
+        u32 start_time;
+        u32 pkts;
+};
+
+#define MWL8K_MAX_TID 8
 struct mwl8k_sta {
         /* Index into station database. Returned by UPDATE_STADB.  */
         u8 peer_id;
         u8 is_ampdu_allowed;
+        struct tx_traffic_info tx_stats[MWL8K_MAX_TID];
 };
 #define MWL8K_STA(_sta) ((struct mwl8k_sta *)&((_sta)->drv_priv))
 
@@ -701,7 +708,7 @@ static int mwl8k_load_firmware(struct ieee80211_hw *hw)
                                "helper image\n", pci_name(priv->pdev));
                         return rc;
                 }
-                msleep(5);
+                msleep(20);
 
                 rc = mwl8k_feed_fw_image(priv, fw->data, fw->size);
         } else {
@@ -823,8 +830,8 @@ static void mwl8k_encapsulate_tx_frame(struct sk_buff *skb)
         /*
          * Make sure the packet header is in the DMA header format (4-address
          * without QoS), the necessary crypto padding between the header and the
-         * payload has already been provided by mac80211, but it doesn't add tail
-         * padding when HW crypto is enabled.
+         * payload has already been provided by mac80211, but it doesn't add
+         * tail padding when HW crypto is enabled.
          *
          * We have the following trailer padding requirements:
          * - WEP: 4 trailer bytes (ICV)
@@ -1487,9 +1494,8 @@ static int mwl8k_tx_wait_empty(struct ieee80211_hw *hw)
 
                 if (timeout) {
                         WARN_ON(priv->pending_tx_pkts);
-                        if (retry) {
+                        if (retry)
                                 wiphy_notice(hw->wiphy, "tx rings drained\n");
-                        }
                         break;
                 }
 
@@ -1649,8 +1655,8 @@ mwl8k_txq_reclaim(struct ieee80211_hw *hw, int index, int limit, int force)
                 /* Rate control is happening in the firmware.
                  * Ensure no tx rate is being reported.
                  */
-                info->status.rates[0].idx = -1;
-                info->status.rates[0].count = 1;
+                info->status.rates[0].idx = -1;
+                info->status.rates[0].count = 1;
 
                 if (MWL8K_TXD_SUCCESS(status))
                         info->flags |= IEEE80211_TX_STAT_ACK;
@@ -1688,7 +1694,7 @@ static void mwl8k_txq_deinit(struct ieee80211_hw *hw, int index)
 }
 
 /* caller must hold priv->stream_lock when calling the stream functions */
-struct mwl8k_ampdu_stream *
+static struct mwl8k_ampdu_stream *
 mwl8k_add_stream(struct ieee80211_hw *hw, struct ieee80211_sta *sta, u8 tid)
 {
         struct mwl8k_ampdu_stream *stream;
@@ -1755,6 +1761,41 @@ mwl8k_lookup_stream(struct ieee80211_hw *hw, u8 *addr, u8 tid)
         return NULL;
 }
 
+#define MWL8K_AMPDU_PACKET_THRESHOLD 64
+static inline bool mwl8k_ampdu_allowed(struct ieee80211_sta *sta, u8 tid)
+{
+        struct mwl8k_sta *sta_info = MWL8K_STA(sta);
+        struct tx_traffic_info *tx_stats;
+
+        BUG_ON(tid >= MWL8K_MAX_TID);
+        tx_stats = &sta_info->tx_stats[tid];
+
+        return sta_info->is_ampdu_allowed &&
+                tx_stats->pkts > MWL8K_AMPDU_PACKET_THRESHOLD;
+}
+
+static inline void mwl8k_tx_count_packet(struct ieee80211_sta *sta, u8 tid)
+{
+        struct mwl8k_sta *sta_info = MWL8K_STA(sta);
+        struct tx_traffic_info *tx_stats;
+
+        BUG_ON(tid >= MWL8K_MAX_TID);
+        tx_stats = &sta_info->tx_stats[tid];
+
+        if (tx_stats->start_time == 0)
+                tx_stats->start_time = jiffies;
+
+        /* reset the packet count after each second elapses.  If the number of
+         * packets ever exceeds the ampdu_min_traffic threshold, we will allow
+         * an ampdu stream to be started.
+         */
+        if (jiffies - tx_stats->start_time > HZ) {
+                tx_stats->pkts = 0;
+                tx_stats->start_time = 0;
+        } else
+                tx_stats->pkts++;
+}
+
 static void
 mwl8k_txq_xmit(struct ieee80211_hw *hw, int index, struct sk_buff *skb)
 {
@@ -1841,6 +1882,7 @@ mwl8k_txq_xmit(struct ieee80211_hw *hw, int index, struct sk_buff *skb)
             skb->protocol != cpu_to_be16(ETH_P_PAE) &&
             sta->ht_cap.ht_supported && priv->ap_fw) {
                 tid = qos & 0xf;
+                mwl8k_tx_count_packet(sta, tid);
                 spin_lock(&priv->stream_lock);
                 stream = mwl8k_lookup_stream(hw, sta->addr, tid);
                 if (stream != NULL) {
@@ -1881,7 +1923,7 @@ mwl8k_txq_xmit(struct ieee80211_hw *hw, int index, struct sk_buff *skb)
                          * prevents sequence number mismatch at the recepient
                          * as described above.
                          */
-                        if (MWL8K_STA(sta)->is_ampdu_allowed) {
+                        if (mwl8k_ampdu_allowed(sta, tid)) {
                                 stream = mwl8k_add_stream(hw, sta, tid);
                                 if (stream != NULL)
                                         start_ba_session = true;
@@ -2657,7 +2699,7 @@ struct mwl8k_cmd_tx_power {
         __le16 bw;
         __le16 sub_ch;
         __le16 power_level_list[MWL8K_TX_POWER_LEVEL_TOTAL];
-} __attribute__((packed));
+} __packed;
 
 static int mwl8k_cmd_tx_power(struct ieee80211_hw *hw,
                                      struct ieee80211_conf *conf,
@@ -3520,13 +3562,13 @@ static int mwl8k_cmd_bss_start(struct ieee80211_hw *hw,
 #define BASTREAM_FLAG_DIRECTION_UPSTREAM        0x00
 #define BASTREAM_FLAG_IMMEDIATE_TYPE            0x01
 
-enum {
+enum ba_stream_action_type {
         MWL8K_BA_CREATE,
         MWL8K_BA_UPDATE,
         MWL8K_BA_DESTROY,
         MWL8K_BA_FLUSH,
         MWL8K_BA_CHECK,
-} ba_stream_action_type;
+};
 
 
 struct mwl8k_create_ba_stream {
@@ -3780,7 +3822,7 @@ struct mwl8k_cmd_update_encryption {
         __u8 mac_addr[6];
         __u8 encr_type;
 
-} __attribute__((packed));
+} __packed;
 
 struct mwl8k_cmd_set_key {
         struct mwl8k_cmd_pkt header;
@@ -3800,7 +3842,7 @@ struct mwl8k_cmd_set_key {
         __le16 tkip_tsc_low;
         __le32 tkip_tsc_high;
         __u8 mac_addr[6];
-} __attribute__((packed));
+} __packed;
 
 enum {
         MWL8K_ENCR_ENABLE,
@@ -4285,6 +4327,8 @@ static int mwl8k_start(struct ieee80211_hw *hw)
 
         /* Enable interrupts */
         iowrite32(MWL8K_A2H_EVENTS, priv->regs + MWL8K_HIU_A2H_INTERRUPT_MASK);
+        iowrite32(MWL8K_A2H_EVENTS,
+                  priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS_MASK);
 
         rc = mwl8k_fw_lock(hw);
         if (!rc) {
@@ -4502,7 +4546,7 @@ mwl8k_bss_info_changed_sta(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                            struct ieee80211_bss_conf *info, u32 changed)
 {
         struct mwl8k_priv *priv = hw->priv;
-        u32 ap_legacy_rates;
+        u32 ap_legacy_rates = 0;
         u8 ap_mcs_rates[16];
         int rc;
 
@@ -5283,7 +5327,8 @@ static int mwl8k_probe_hw(struct ieee80211_hw *hw)
         iowrite32(MWL8K_A2H_INT_TX_DONE|MWL8K_A2H_INT_RX_READY|
                   MWL8K_A2H_INT_BA_WATCHDOG,
                   priv->regs + MWL8K_HIU_A2H_INTERRUPT_CLEAR_SEL);
-        iowrite32(0xffffffff, priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS_MASK);
+        iowrite32(MWL8K_A2H_INT_OPC_DONE,
+                  priv->regs + MWL8K_HIU_A2H_INTERRUPT_STATUS_MASK);
 
         rc = request_irq(priv->pdev->irq, mwl8k_interrupt,
                          IRQF_SHARED, MWL8K_NAME, hw);
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 6ba31a0e8f78..d2f5c87305a4 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -710,6 +710,16 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x8516, 0x3070), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x8516, 0x3071), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x8516, 0x3072), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Alpha Networks */
+        { USB_DEVICE(0x14b2, 0x3c06), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x14b2, 0x3c07), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x14b2, 0x3c09), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x14b2, 0x3c12), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x14b2, 0x3c23), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x14b2, 0x3c25), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x14b2, 0x3c27), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x14b2, 0x3c28), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x14b2, 0x3c2c), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Amit */
         { USB_DEVICE(0x15c5, 0x0008), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Askey */
@@ -736,15 +746,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* Buffalo */
         { USB_DEVICE(0x0411, 0x00e8), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0411, 0x016f), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Conceptronic */
-        { USB_DEVICE(0x14b2, 0x3c06), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x14b2, 0x3c07), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x14b2, 0x3c09), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x14b2, 0x3c12), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x14b2, 0x3c23), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x14b2, 0x3c25), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x14b2, 0x3c27), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x14b2, 0x3c28), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0411, 0x01a2), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Corega */
         { USB_DEVICE(0x07aa, 0x002f), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x07aa, 0x003c), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -776,6 +778,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x1740, 0x9707), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1740, 0x9708), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1740, 0x9709), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Gemtek */
+        { USB_DEVICE(0x15a9, 0x0012), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Gigabyte */
         { USB_DEVICE(0x1044, 0x800b), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1044, 0x800d), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -792,6 +796,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x04bb, 0x0947), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x04bb, 0x0948), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Linksys */
+        { USB_DEVICE(0x13b1, 0x0031), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1737, 0x0070), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1737, 0x0071), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Logitec */
@@ -870,8 +875,9 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x15a9, 0x0006), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Sweex */
         { USB_DEVICE(0x177f, 0x0302), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* U-Media*/
+        /* U-Media */
         { USB_DEVICE(0x157e, 0x300e), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x157e, 0x3013), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* ZCOM */
         { USB_DEVICE(0x0cde, 0x0022), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0cde, 0x0025), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -883,6 +889,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* Zyxel */
         { USB_DEVICE(0x0586, 0x3416), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0586, 0x3418), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0586, 0x341e), USB_DEVICE_DATA(&rt2800usb_ops) },
 #ifdef CONFIG_RT2800USB_RT33XX
         /* Ralink */
         { USB_DEVICE(0x148f, 0x3370), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -901,6 +908,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x1740, 0x9801), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* I-O DATA */
         { USB_DEVICE(0x04bb, 0x0944), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Linksys */
+        { USB_DEVICE(0x13b1, 0x002f), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Ralink */
         { USB_DEVICE(0x148f, 0x3572), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Sitecom */
@@ -915,6 +924,9 @@ static struct usb_device_id rt2800usb_device_table[] = {
          * Unclear what kind of devices these are (they aren't supported by the
          * vendor linux driver).
          */
+        /* Alpha Networks */
+        { USB_DEVICE(0x14b2, 0x3c08), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x14b2, 0x3c11), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Amigo */
         { USB_DEVICE(0x0e0b, 0x9031), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0e0b, 0x9041), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -933,9 +945,6 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x0411, 0x0148), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0411, 0x0150), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0411, 0x015d), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Conceptronic */
-        { USB_DEVICE(0x14b2, 0x3c08), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x14b2, 0x3c11), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Corega */
         { USB_DEVICE(0x07aa, 0x0041), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x07aa, 0x0042), USB_DEVICE_DATA(&rt2800usb_ops) },
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index dd5318ed7872..9477785f1168 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -251,14 +251,16 @@ void rtl_init_rfkill(struct ieee80211_hw *hw)
         bool blocked;
         u8 valid = 0;
 
-        radio_state = rtlpriv->cfg->ops->radio_onoff_checking(hw, &valid);
+        /*set init state to on */
+        rtlpriv->rfkill.rfkill_state = 1;
+        wiphy_rfkill_set_hw_state(hw->wiphy, 0);
 
-        /*set init state to that of switch */
-        rtlpriv->rfkill.rfkill_state = radio_state;
-        printk(KERN_INFO "rtlwifi: wireless switch is %s\n",
-               rtlpriv->rfkill.rfkill_state ? "on" : "off");
+        radio_state = rtlpriv->cfg->ops->radio_onoff_checking(hw, &valid);
 
         if (valid) {
+                printk(KERN_INFO "rtlwifi: wireless switch is %s\n",
+                                rtlpriv->rfkill.rfkill_state ? "on" : "off");
+
                 rtlpriv->rfkill.rfkill_state = radio_state;
 
                 blocked = (rtlpriv->rfkill.rfkill_state == 1) ? 0 : 1;
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index efded435d596..59a150ce3064 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -1785,7 +1785,8 @@ void rtl_pci_disconnect(struct pci_dev *pdev)
 
         rtl_pci_deinit(hw);
         rtl_deinit_core(hw);
-        rtlpriv->cfg->ops->deinit_sw_leds(hw);
+        if (rtlpriv->cfg->ops->deinit_sw_leds)
+                rtlpriv->cfg->ops->deinit_sw_leds(hw);
         _rtl_pci_io_handler_release(hw);
         rtlpriv->cfg->ops->deinit_sw_vars(hw);
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
index bb023274414c..c228b9ee3711 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
@@ -634,7 +634,7 @@ static void rtl92c_dm_txpower_tracking_callback_thermalmeter(struct ieee80211_hw
         u8 thermalvalue, delta, delta_lck, delta_iqk;
         long ele_a, ele_d, temp_cck, val_x, value32;
         long val_y, ele_c;
-        u8 ofdm_index[2], cck_index, ofdm_index_old[2], cck_index_old;
+        u8 ofdm_index[2], cck_index = 0, ofdm_index_old[2], cck_index_old = 0;
         int i;
         bool is2t = IS_92C_SERIAL(rtlhal->version);
         u8 txpwr_level[2] = {0, 0};
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
index f107660f545d..bc9d24134ac4 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
@@ -293,7 +293,7 @@ static void _rtl92c_fill_h2c_command(struct ieee80211_hw *hw,
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
         u8 boxnum;
-        u16 box_reg, box_extreg;
+        u16 box_reg = 0, box_extreg = 0;
         u8 u1b_tmp;
         bool isfw_read = false;
         bool bwrite_sucess = false;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/led.c b/drivers/net/wireless/rtlwifi/rtl8192ce/led.c
index 7b1da8d7508f..d21b934b5c33 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/led.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/led.c
@@ -32,6 +32,14 @@
 #include "reg.h"
 #include "led.h"
 
+static void _rtl92ce_init_led(struct ieee80211_hw *hw,
+                              struct rtl_led *pled, enum rtl_led_pin ledpin)
+{
+        pled->hw = hw;
+        pled->ledpin = ledpin;
+        pled->ledon = false;
+}
+
 void rtl92ce_sw_led_on(struct ieee80211_hw *hw, struct rtl_led *pled)
 {
         u8 ledcfg;
@@ -97,10 +105,10 @@ void rtl92ce_sw_led_off(struct ieee80211_hw *hw, struct rtl_led *pled)
 
 void rtl92ce_init_sw_leds(struct ieee80211_hw *hw)
 {
-}
+        struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw);
 
-void rtl92ce_deinit_sw_leds(struct ieee80211_hw *hw)
-{
+        _rtl92ce_init_led(hw, &(pcipriv->ledctl.sw_led0), LED_PIN_LED0);
+        _rtl92ce_init_led(hw, &(pcipriv->ledctl.sw_led1), LED_PIN_LED1);
 }
 
 void _rtl92ce_sw_led_control(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/led.h b/drivers/net/wireless/rtlwifi/rtl8192ce/led.h
index 10da3018f4b7..94332b3af5b1 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/led.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/led.h
@@ -31,7 +31,6 @@
 #define __RTL92CE_LED_H__
 
 void rtl92ce_init_sw_leds(struct ieee80211_hw *hw);
-void rtl92ce_deinit_sw_leds(struct ieee80211_hw *hw);
 void rtl92ce_sw_led_on(struct ieee80211_hw *hw, struct rtl_led *pled);
 void rtl92ce_sw_led_off(struct ieee80211_hw *hw, struct rtl_led *pled);
 void rtl92ce_led_control(struct ieee80211_hw *hw, enum led_ctl_mode ledaction);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/rf.c b/drivers/net/wireless/rtlwifi/rtl8192ce/rf.c
index 669b1168dbec..e301b12e281a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/rf.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/rf.c
@@ -202,7 +202,7 @@ static void _rtl92c_get_txpower_writeval_by_regulatory(struct ieee80211_hw *hw,
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_phy *rtlphy = &(rtlpriv->phy);
         struct rtl_efuse *rtlefuse = rtl_efuse(rtl_priv(hw));
-        u8 i, chnlgroup, pwr_diff_limit[4];
+        u8 i, chnlgroup = 0, pwr_diff_limit[4];
         u32 writeVal, customer_limit, rf;
 
         for (rf = 0; rf < 2; rf++) {
@@ -447,7 +447,7 @@ static bool _rtl92c_phy_rf6052_config_parafile(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_phy *rtlphy = &(rtlpriv->phy);
-        u32 u4_regvalue;
+        u32 u4_regvalue = 0;
         u8 rfpath;
         bool rtstatus;
         struct bb_reg_def *pphyreg;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
index b1cc4d44f534..f4e2f3dcccae 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
@@ -131,7 +131,6 @@ static struct rtl_hal_ops rtl8192ce_hal_ops = {
         .enable_hw_sec = rtl92ce_enable_hw_security_config,
         .set_key = rtl92ce_set_key,
         .init_sw_leds = rtl92ce_init_sw_leds,
-        .deinit_sw_leds = rtl92ce_deinit_sw_leds,
         .get_bbreg = rtl92c_phy_query_bb_reg,
         .set_bbreg = rtl92c_phy_set_bb_reg,
         .get_rfreg = rtl92ce_phy_query_rf_reg,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
index 9444e76838cf..e43be2547827 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
@@ -921,7 +921,7 @@ static void _rtl92cu_init_chipT_queue_priority(struct ieee80211_hw *hw,
                                                u8 out_ep_num,
                                                u8 queue_sel)
 {
-        u8      hq_sele;
+        u8 hq_sele = 0;
         struct rtl_priv *rtlpriv = rtl_priv(hw);
 
         switch (out_ep_num) {
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index 16eea7229e99..be8df57b789d 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -410,6 +410,16 @@
  *      notification. This event is used to indicate that an unprotected
  *      disassociation frame was dropped when MFP is in use.
  *
+ * @NL80211_CMD_NEW_PEER_CANDIDATE: Notification on the reception of a
+ *      beacon or probe response from a compatible mesh peer.  This is only
+ *      sent while no station information (sta_info) exists for the new peer
+ *      candidate and when @NL80211_MESH_SETUP_USERSPACE_AUTH is set.  On
+ *      reception of this notification, userspace may decide to create a new
+ *      station (@NL80211_CMD_NEW_STATION).  To stop this notification from
+ *      reoccurring, the userspace authentication daemon may want to create the
+ *      new station with the AUTHENTICATED flag unset and maybe change it later
+ *      depending on the authentication result.
+ *
  * @NL80211_CMD_MAX: highest used command number
  * @__NL80211_CMD_AFTER_LAST: internal use
  */
@@ -522,6 +532,8 @@ enum nl80211_commands {
         NL80211_CMD_UNPROT_DEAUTHENTICATE,
         NL80211_CMD_UNPROT_DISASSOCIATE,
 
+        NL80211_CMD_NEW_PEER_CANDIDATE,
+
         /* add new commands above here */
 
         /* used to define NL80211_CMD_MAX below */
@@ -545,6 +557,7 @@ enum nl80211_commands {
 /* source-level API compatibility */
 #define NL80211_CMD_GET_MESH_PARAMS NL80211_CMD_GET_MESH_CONFIG
 #define NL80211_CMD_SET_MESH_PARAMS NL80211_CMD_SET_MESH_CONFIG
+#define NL80211_MESH_SETUP_VENDOR_PATH_SEL_IE NL80211_MESH_SETUP_IE
 
 /**
  * enum nl80211_attrs - nl80211 netlink attributes
@@ -886,6 +899,9 @@ enum nl80211_commands {
  *      changed once the mesh is active.
  * @NL80211_ATTR_MESH_CONFIG: Mesh configuration parameters, a nested attribute
  *      containing attributes from &enum nl80211_meshconf_params.
+ * @NL80211_ATTR_SUPPORT_MESH_AUTH: Currently, this means the underlying driver
+ *      allows auth frames in a mesh to be passed to userspace for processing via
+ *      the @NL80211_MESH_SETUP_USERSPACE_AUTH flag.
  *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
@@ -1074,6 +1090,8 @@ enum nl80211_attrs {
         NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
         NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
 
+        NL80211_ATTR_SUPPORT_MESH_AUTH,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -1168,6 +1186,7 @@ enum nl80211_iftype {
  *      with short barker preamble
  * @NL80211_STA_FLAG_WME: station is WME/QoS capable
  * @NL80211_STA_FLAG_MFP: station uses management frame protection
+ * @NL80211_STA_FLAG_AUTHENTICATED: station is authenticated
  * @NL80211_STA_FLAG_MAX: highest station flag number currently defined
  * @__NL80211_STA_FLAG_AFTER_LAST: internal use
  */
@@ -1177,6 +1196,7 @@ enum nl80211_sta_flags {
         NL80211_STA_FLAG_SHORT_PREAMBLE,
         NL80211_STA_FLAG_WME,
         NL80211_STA_FLAG_MFP,
+        NL80211_STA_FLAG_AUTHENTICATED,
 
         /* keep last */
         __NL80211_STA_FLAG_AFTER_LAST,
@@ -1277,6 +1297,7 @@ enum nl80211_sta_bss_param {
  *      attribute, like NL80211_STA_INFO_TX_BITRATE.
  * @NL80211_STA_INFO_BSS_PARAM: current station's view of BSS, nested attribute
  *     containing info as possible, see &enum nl80211_sta_bss_param
+ * @NL80211_STA_INFO_CONNECTED_TIME: time since the station is last connected
  * @__NL80211_STA_INFO_AFTER_LAST: internal
  * @NL80211_STA_INFO_MAX: highest possible station info attribute
  */
@@ -1297,6 +1318,7 @@ enum nl80211_sta_info {
         NL80211_STA_INFO_SIGNAL_AVG,
         NL80211_STA_INFO_RX_BITRATE,
         NL80211_STA_INFO_BSS_PARAM,
+        NL80211_STA_INFO_CONNECTED_TIME,
 
         /* keep last */
         __NL80211_STA_INFO_AFTER_LAST,
@@ -1719,9 +1741,12 @@ enum nl80211_meshconf_params {
  * vendor specific path metric or disable it to use the default Airtime
  * metric.
  *
- * @NL80211_MESH_SETUP_VENDOR_PATH_SEL_IE: A vendor specific information
- * element that vendors will use to identify the path selection methods and
- * metrics in use.
+ * @NL80211_MESH_SETUP_IE: Information elements for this mesh, for instance, a
+ * robust security network ie, or a vendor specific information element that
+ * vendors will use to identify the path selection methods and metrics in use.
+ *
+ * @NL80211_MESH_SETUP_USERSPACE_AUTH: Enable this option if an authentication
+ * daemon will be authenticating mesh candidates.
  *
  * @NL80211_MESH_SETUP_ATTR_MAX: highest possible mesh setup attribute number
  * @__NL80211_MESH_SETUP_ATTR_AFTER_LAST: Internal use
@@ -1730,7 +1755,8 @@ enum nl80211_mesh_setup_params {
         __NL80211_MESH_SETUP_INVALID,
         NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL,
         NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC,
-        NL80211_MESH_SETUP_VENDOR_PATH_SEL_IE,
+        NL80211_MESH_SETUP_IE,
+        NL80211_MESH_SETUP_USERSPACE_AUTH,
 
         /* keep last */
         __NL80211_MESH_SETUP_ATTR_AFTER_LAST,
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index ba7384acf4e0..d30eada7c6cd 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -423,6 +423,7 @@ struct station_parameters {
  * @STATION_INFO_SIGNAL_AVG: @signal_avg filled
  * @STATION_INFO_RX_BITRATE: @rxrate fields are filled
  * @STATION_INFO_BSS_PARAM: @bss_param filled
+ * @STATION_INFO_CONNECTED_TIME: @connected_time filled
  */
 enum station_info_flags {
         STATION_INFO_INACTIVE_TIME      = 1<<0,
@@ -441,6 +442,7 @@ enum station_info_flags {
         STATION_INFO_SIGNAL_AVG         = 1<<13,
         STATION_INFO_RX_BITRATE         = 1<<14,
         STATION_INFO_BSS_PARAM          = 1<<15,
+        STATION_INFO_CONNECTED_TIME     = 1<<16
 };
 
 /**
@@ -511,6 +513,7 @@ struct sta_bss_parameters {
  * Station information filled by driver for get_station() and dump_station.
  *
  * @filled: bitflag of flags from &enum station_info_flags
+ * @connected_time: time(in secs) since a station is last connected
  * @inactive_time: time since last station activity (tx/rx) in milliseconds
  * @rx_bytes: bytes received from this station
  * @tx_bytes: bytes transmitted to this station
@@ -533,6 +536,7 @@ struct sta_bss_parameters {
  */
 struct station_info {
         u32 filled;
+        u32 connected_time;
         u32 inactive_time;
         u32 rx_bytes;
         u32 tx_bytes;
@@ -689,8 +693,9 @@ struct mesh_config {
  * @mesh_id_len: length of the mesh ID, at least 1 and at most 32 bytes
  * @path_sel_proto: which path selection protocol to use
  * @path_metric: which metric to use
- * @vendor_ie: vendor information elements (optional)
- * @vendor_ie_len: length of vendor information elements
+ * @ie: vendor information elements (optional)
+ * @ie_len: length of vendor information elements
+ * @is_secure: or not
  *
  * These parameters are fixed when the mesh is created.
  */
@@ -699,8 +704,9 @@ struct mesh_setup {
         u8 mesh_id_len;
         u8  path_sel_proto;
         u8  path_metric;
-        const u8 *vendor_ie;
-        u8 vendor_ie_len;
+        const u8 *ie;
+        u8 ie_len;
+        bool is_secure;
 };
 
 /**
@@ -1451,6 +1457,8 @@ struct cfg80211_ops {
  * @WIPHY_FLAG_IBSS_RSN: The device supports IBSS RSN.
  * @WIPHY_FLAG_SUPPORTS_SEPARATE_DEFAULT_KEYS: The device supports separate
  *      unicast and multicast TX keys.
+ * @WIPHY_FLAG_MESH_AUTH: The device supports mesh authentication by routing
+ *      auth frames to userspace. See @NL80211_MESH_SETUP_USERSPACE_AUTH.
  */
 enum wiphy_flags {
         WIPHY_FLAG_CUSTOM_REGULATORY            = BIT(0),
@@ -1463,6 +1471,7 @@ enum wiphy_flags {
         WIPHY_FLAG_CONTROL_PORT_PROTOCOL        = BIT(7),
         WIPHY_FLAG_IBSS_RSN                     = BIT(8),
         WIPHY_FLAG_SUPPORTS_SEPARATE_DEFAULT_KEYS= BIT(9),
+        WIPHY_FLAG_MESH_AUTH                    = BIT(10),
 };
 
 struct mac_address {
@@ -2484,6 +2493,22 @@ void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
 void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp);
 
 /**
+ * cfg80211_notify_new_candidate - notify cfg80211 of a new mesh peer candidate
+ *
+ * @dev: network device
+ * @macaddr: the MAC address of the new candidate
+ * @ie: information elements advertised by the peer candidate
+ * @ie_len: lenght of the information elements buffer
+ * @gfp: allocation flags
+ *
+ * This function notifies cfg80211 that the mesh peer candidate has been
+ * detected, most likely via a beacon or, less likely, via a probe response.
+ * cfg80211 then sends a notification to userspace.
+ */
+void cfg80211_notify_new_peer_candidate(struct net_device *dev,
+                const u8 *macaddr, const u8 *ie, u8 ie_len, gfp_t gfp);
+
+/**
  * DOC: RFkill integration
  *
  * RFkill integration in cfg80211 is almost invisible to drivers,
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 965f1b16e53a..361bc5d85b1a 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1819,6 +1819,9 @@ enum ieee80211_ampdu_mlme_action {
  * @set_ringparam: Set tx and rx ring sizes.
  *
  * @get_ringparam: Get tx and rx ring current and maximum sizes.
+ *
+ * @tx_frames_pending: Check if there is any pending frame in the hardware
+ *      queues before entering power save.
  */
 struct ieee80211_ops {
         void (*tx)(struct ieee80211_hw *hw, struct sk_buff *skb);
@@ -1906,6 +1909,7 @@ struct ieee80211_ops {
         int (*set_ringparam)(struct ieee80211_hw *hw, u32 tx, u32 rx);
         void (*get_ringparam)(struct ieee80211_hw *hw,
                               u32 *tx, u32 *tx_max, u32 *rx, u32 *rx_max);
+        bool (*tx_frames_pending)(struct ieee80211_hw *hw);
 };
 
 /**
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index bf5d28da46e6..a6d191f2a0fe 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -330,6 +330,7 @@ static void rate_idx_to_bitrate(struct rate_info *rate, struct sta_info *sta, in
 static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct timespec uptime;
 
         sinfo->generation = sdata->local->sta_generation;
 
@@ -343,7 +344,11 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                         STATION_INFO_TX_BITRATE |
                         STATION_INFO_RX_BITRATE |
                         STATION_INFO_RX_DROP_MISC |
-                        STATION_INFO_BSS_PARAM;
+                        STATION_INFO_BSS_PARAM |
+                        STATION_INFO_CONNECTED_TIME;
+
+        do_posix_clock_monotonic_gettime(&uptime);
+        sinfo->connected_time = uptime.tv_sec - sta->last_connected;
 
         sinfo->inactive_time = jiffies_to_msecs(jiffies - sta->last_rx);
         sinfo->rx_bytes = sta->rx_bytes;
@@ -686,6 +691,12 @@ static void sta_apply_parameters(struct ieee80211_local *local,
                 if (set & BIT(NL80211_STA_FLAG_MFP))
                         sta->flags |= WLAN_STA_MFP;
         }
+
+        if (mask & BIT(NL80211_STA_FLAG_AUTHENTICATED)) {
+                sta->flags &= ~WLAN_STA_AUTH;
+                if (set & BIT(NL80211_STA_FLAG_AUTHENTICATED))
+                        sta->flags |= WLAN_STA_AUTH;
+        }
         spin_unlock_irqrestore(&sta->flaglock, flags);
 
         /*
@@ -1034,26 +1045,26 @@ static int copy_mesh_setup(struct ieee80211_if_mesh *ifmsh,
         u8 *new_ie;
         const u8 *old_ie;
 
-        /* first allocate the new vendor information element */
+        /* allocate information elements */
         new_ie = NULL;
-        old_ie = ifmsh->vendor_ie;
+        old_ie = ifmsh->ie;
 
-        ifmsh->vendor_ie_len = setup->vendor_ie_len;
-        if (setup->vendor_ie_len) {
-                new_ie = kmemdup(setup->vendor_ie, setup->vendor_ie_len,
+        if (setup->ie_len) {
+                new_ie = kmemdup(setup->ie, setup->ie_len,
                                 GFP_KERNEL);
                 if (!new_ie)
                         return -ENOMEM;
         }
+        ifmsh->ie_len = setup->ie_len;
+        ifmsh->ie = new_ie;
+        kfree(old_ie);
 
         /* now copy the rest of the setup parameters */
         ifmsh->mesh_id_len = setup->mesh_id_len;
         memcpy(ifmsh->mesh_id, setup->mesh_id, ifmsh->mesh_id_len);
         ifmsh->mesh_pp_id = setup->path_sel_proto;
         ifmsh->mesh_pm_id = setup->path_metric;
-        ifmsh->vendor_ie = new_ie;
-
-        kfree(old_ie);
+        ifmsh->is_secure = setup->is_secure;
 
         return 0;
 }
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index c04a1396cf8d..c008232731eb 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -92,6 +92,31 @@ static ssize_t sta_inactive_ms_read(struct file *file, char __user *userbuf,
 }
 STA_OPS(inactive_ms);
 
+
+static ssize_t sta_connected_time_read(struct file *file, char __user *userbuf,
+                                        size_t count, loff_t *ppos)
+{
+        struct sta_info *sta = file->private_data;
+        struct timespec uptime;
+        struct tm result;
+        long connected_time_secs;
+        char buf[100];
+        int res;
+        do_posix_clock_monotonic_gettime(&uptime);
+        connected_time_secs = uptime.tv_sec - sta->last_connected;
+        time_to_tm(connected_time_secs, 0, &result);
+        result.tm_year -= 70;
+        result.tm_mday -= 1;
+        res = scnprintf(buf, sizeof(buf),
+                "years  - %d\nmonths - %d\ndays   - %d\nclock  - %d:%d:%d\n\n",
+                        result.tm_year, result.tm_mon, result.tm_mday,
+                        result.tm_hour, result.tm_min, result.tm_sec);
+        return simple_read_from_buffer(userbuf, count, ppos, buf, res);
+}
+STA_OPS(connected_time);
+
+
+
 static ssize_t sta_last_seq_ctrl_read(struct file *file, char __user *userbuf,
                                       size_t count, loff_t *ppos)
 {
@@ -324,6 +349,7 @@ void ieee80211_sta_debugfs_add(struct sta_info *sta)
         DEBUGFS_ADD(flags);
         DEBUGFS_ADD(num_ps_buf_frames);
         DEBUGFS_ADD(inactive_ms);
+        DEBUGFS_ADD(connected_time);
         DEBUGFS_ADD(last_seq_ctrl);
         DEBUGFS_ADD(agg_status);
         DEBUGFS_ADD(dev);
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 9c0d62bb0ea3..00a0685f2403 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -552,4 +552,17 @@ static inline void drv_get_ringparam(struct ieee80211_local *local,
         trace_drv_return_void(local);
 }
 
+static inline bool drv_tx_frames_pending(struct ieee80211_local *local)
+{
+        bool ret = false;
+
+        might_sleep();
+
+        trace_drv_tx_frames_pending(local);
+        if (local->ops->tx_frames_pending)
+                ret = local->ops->tx_frames_pending(&local->hw);
+        trace_drv_return_bool(local, ret);
+
+        return ret;
+}
 #endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index 45aab80738e2..c8c934d48b7a 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -74,6 +74,21 @@ TRACE_EVENT(drv_return_int,
         TP_printk(LOCAL_PR_FMT " - %d", LOCAL_PR_ARG, __entry->ret)
 );
 
+TRACE_EVENT(drv_return_bool,
+        TP_PROTO(struct ieee80211_local *local, bool ret),
+        TP_ARGS(local, ret),
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(bool, ret)
+        ),
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->ret = ret;
+        ),
+        TP_printk(LOCAL_PR_FMT " - %s", LOCAL_PR_ARG, (__entry->ret) ?
+                  "true" : "false")
+);
+
 TRACE_EVENT(drv_return_u64,
         TP_PROTO(struct ieee80211_local *local, u64 ret),
         TP_ARGS(local, ret),
@@ -964,6 +979,11 @@ TRACE_EVENT(drv_get_ringparam,
         )
 );
 
+DEFINE_EVENT(local_only_evt, drv_tx_frames_pending,
+        TP_PROTO(struct ieee80211_local *local),
+        TP_ARGS(local)
+);
+
 DEFINE_EVENT(local_only_evt, drv_offchannel_tx_cancel_wait,
         TP_PROTO(struct ieee80211_local *local),
         TP_ARGS(local)
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 6eb2c8523eeb..8d6d6e3d95da 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -488,8 +488,9 @@ struct ieee80211_if_mesh {
         struct mesh_config mshcfg;
         u32 mesh_seqnum;
         bool accepting_plinks;
-        const u8 *vendor_ie;
-        u8 vendor_ie_len;
+        const u8 *ie;
+        u8 ie_len;
+        bool is_secure;
 };
 
 #ifdef CONFIG_MAC80211_MESH
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index dc50fc3153e5..0ab2a8df312d 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -545,7 +545,9 @@ ieee80211_default_mgmt_stypes[NUM_NL80211_IFTYPES] = {
         },
         [NL80211_IFTYPE_MESH_POINT] = {
                 .tx = 0xffff,
-                .rx = BIT(IEEE80211_STYPE_ACTION >> 4),
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                        BIT(IEEE80211_STYPE_AUTH >> 4) |
+                        BIT(IEEE80211_STYPE_DEAUTH >> 4),
         },
 };
 
@@ -760,6 +762,11 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         local->hw.wiphy->interface_modes &= ~BIT(NL80211_IFTYPE_MESH_POINT);
 #endif
 
+        /* if the underlying driver supports mesh, mac80211 will (at least)
+         * provide routing of mesh authentication frames to userspace */
+        if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_MESH_POINT))
+                local->hw.wiphy->flags |= WIPHY_FLAG_MESH_AUTH;
+
         /* mac80211 supports control port protocol changing */
         local->hw.wiphy->flags |= WIPHY_FLAG_CONTROL_PORT_PROTOCOL;
 
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 2a57cc02c618..11207979e2e2 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -279,9 +279,9 @@ void mesh_mgmt_ies_add(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
             MESHCONF_CAPAB_ACCEPT_PLINKS : 0x00;
         *pos++ = 0x00;
 
-        if (sdata->u.mesh.vendor_ie) {
-                int len = sdata->u.mesh.vendor_ie_len;
-                const u8 *data = sdata->u.mesh.vendor_ie;
+        if (sdata->u.mesh.ie) {
+                int len = sdata->u.mesh.ie_len;
+                const u8 *data = sdata->u.mesh.ie;
                 if (skb_tailroom(skb) > len)
                         memcpy(skb_put(skb, len), data, len);
         }
@@ -573,6 +573,10 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
         ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
                                &elems);
 
+        /* ignore beacons from secure mesh peers if our security is off */
+        if (elems.rsn_len && !sdata->u.mesh.is_secure)
+                return;
+
         if (elems.ds_params && elems.ds_params_len == 1)
                 freq = ieee80211_channel_to_frequency(elems.ds_params[0], band);
         else
@@ -586,9 +590,7 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
         if (elems.mesh_id && elems.mesh_config &&
             mesh_matches_local(&elems, sdata)) {
                 supp_rates = ieee80211_sta_get_rates(local, &elems, band);
-
-                mesh_neighbour_update(mgmt->sa, supp_rates, sdata,
-                                      mesh_peer_accepts_plinks(&elems));
+                mesh_neighbour_update(mgmt->sa, supp_rates, sdata, &elems);
         }
 }
 
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index b99e230fe31c..10acf1cc8082 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -226,7 +226,8 @@ void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
 int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata);
 /* Mesh plinks */
 void mesh_neighbour_update(u8 *hw_addr, u32 rates,
-                struct ieee80211_sub_if_data *sdata, bool add);
+                struct ieee80211_sub_if_data *sdata,
+                struct ieee802_11_elems *ie);
 bool mesh_peer_accepts_plinks(struct ieee802_11_elems *ie);
 void mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata);
 void mesh_plink_broken(struct sta_info *sta);
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 8d65b47d9837..7776ae5a8f15 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -65,42 +65,37 @@ void mesh_table_free(struct mesh_table *tbl, bool free_leafs)
         __mesh_table_free(tbl);
 }
 
-static struct mesh_table *mesh_table_grow(struct mesh_table *tbl)
+static int mesh_table_grow(struct mesh_table *oldtbl,
+                struct mesh_table *newtbl)
 {
-        struct mesh_table *newtbl;
         struct hlist_head *oldhash;
         struct hlist_node *p, *q;
         int i;
 
-        if (atomic_read(&tbl->entries)
-                        < tbl->mean_chain_len * (tbl->hash_mask + 1))
-                goto endgrow;
+        if (atomic_read(&oldtbl->entries)
+                        < oldtbl->mean_chain_len * (oldtbl->hash_mask + 1))
+                return -EAGAIN;
 
-        newtbl = mesh_table_alloc(tbl->size_order + 1);
-        if (!newtbl)
-                goto endgrow;
 
-        newtbl->free_node = tbl->free_node;
-        newtbl->mean_chain_len = tbl->mean_chain_len;
-        newtbl->copy_node = tbl->copy_node;
-        atomic_set(&newtbl->entries, atomic_read(&tbl->entries));
+        newtbl->free_node = oldtbl->free_node;
+        newtbl->mean_chain_len = oldtbl->mean_chain_len;
+        newtbl->copy_node = oldtbl->copy_node;
+        atomic_set(&newtbl->entries, atomic_read(&oldtbl->entries));
 
-        oldhash = tbl->hash_buckets;
-        for (i = 0; i <= tbl->hash_mask; i++)
+        oldhash = oldtbl->hash_buckets;
+        for (i = 0; i <= oldtbl->hash_mask; i++)
                 hlist_for_each(p, &oldhash[i])
-                        if (tbl->copy_node(p, newtbl) < 0)
+                        if (oldtbl->copy_node(p, newtbl) < 0)
                                 goto errcopy;
 
-        return newtbl;
+        return 0;
 
 errcopy:
         for (i = 0; i <= newtbl->hash_mask; i++) {
                 hlist_for_each_safe(p, q, &newtbl->hash_buckets[i])
-                        tbl->free_node(p, 0);
+                        oldtbl->free_node(p, 0);
         }
-        __mesh_table_free(newtbl);
-endgrow:
-        return NULL;
+        return -ENOMEM;
 }
 
 
@@ -334,10 +329,13 @@ void mesh_mpath_table_grow(void)
 {
         struct mesh_table *oldtbl, *newtbl;
 
+        newtbl = mesh_table_alloc(mesh_paths->size_order + 1);
+        if (!newtbl)
+                return;
         write_lock(&pathtbl_resize_lock);
         oldtbl = mesh_paths;
-        newtbl = mesh_table_grow(mesh_paths);
-        if (!newtbl) {
+        if (mesh_table_grow(mesh_paths, newtbl) < 0) {
+                __mesh_table_free(newtbl);
                 write_unlock(&pathtbl_resize_lock);
                 return;
         }
@@ -352,10 +350,13 @@ void mesh_mpp_table_grow(void)
 {
         struct mesh_table *oldtbl, *newtbl;
 
+        newtbl = mesh_table_alloc(mpp_paths->size_order + 1);
+        if (!newtbl)
+                return;
         write_lock(&pathtbl_resize_lock);
         oldtbl = mpp_paths;
-        newtbl = mesh_table_grow(mpp_paths);
-        if (!newtbl) {
+        if (mesh_table_grow(mpp_paths, newtbl) < 0) {
+                __mesh_table_free(newtbl);
                 write_unlock(&pathtbl_resize_lock);
                 return;
         }
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 44b53931ba5e..84e5b056af02 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -105,7 +105,7 @@ static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
         if (!sta)
                 return NULL;
 
-        sta->flags = WLAN_STA_AUTHORIZED;
+        sta->flags = WLAN_STA_AUTHORIZED | WLAN_STA_AUTH;
         sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
         rate_control_rate_init(sta);
 
@@ -161,7 +161,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                 __le16 reason) {
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400 +
-                        sdata->u.mesh.vendor_ie_len);
+                        sdata->u.mesh.ie_len);
         struct ieee80211_mgmt *mgmt;
         bool include_plid = false;
         static const u8 meshpeeringproto[] = { 0x00, 0x0F, 0xAC, 0x2A };
@@ -237,8 +237,9 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
-void mesh_neighbour_update(u8 *hw_addr, u32 rates, struct ieee80211_sub_if_data *sdata,
-                           bool peer_accepting_plinks)
+void mesh_neighbour_update(u8 *hw_addr, u32 rates,
+                struct ieee80211_sub_if_data *sdata,
+                struct ieee802_11_elems *elems)
 {
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
@@ -248,8 +249,14 @@ void mesh_neighbour_update(u8 *hw_addr, u32 rates, struct ieee80211_sub_if_data
         sta = sta_info_get(sdata, hw_addr);
         if (!sta) {
                 rcu_read_unlock();
-
-                sta = mesh_plink_alloc(sdata, hw_addr, rates);
+                /* Userspace handles peer allocation when security is enabled
+                 * */
+                if (sdata->u.mesh.is_secure)
+                        cfg80211_notify_new_peer_candidate(sdata->dev, hw_addr,
+                                        elems->ie_start, elems->total_len,
+                                        GFP_KERNEL);
+                else
+                        sta = mesh_plink_alloc(sdata, hw_addr, rates);
                 if (!sta)
                         return;
                 if (sta_info_insert_rcu(sta)) {
@@ -260,7 +267,8 @@ void mesh_neighbour_update(u8 *hw_addr, u32 rates, struct ieee80211_sub_if_data
 
         sta->last_rx = jiffies;
         sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
-        if (peer_accepting_plinks && sta->plink_state == PLINK_LISTEN &&
+        if (mesh_peer_accepts_plinks(elems) &&
+                        sta->plink_state == PLINK_LISTEN &&
                         sdata->u.mesh.accepting_plinks &&
                         sdata->u.mesh.mshcfg.auto_open_plinks)
                 mesh_plink_open(sta);
@@ -372,6 +380,9 @@ int mesh_plink_open(struct sta_info *sta)
         __le16 llid;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
 
+        if (!test_sta_flags(sta, WLAN_STA_AUTH))
+                return -EPERM;
+
         spin_lock_bh(&sta->lock);
         get_random_bytes(&llid, 2);
         sta->llid = llid;
@@ -449,6 +460,10 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 mpl_dbg("Mesh plink: missing necessary peer link ie\n");
                 return;
         }
+        if (elems.rsn_len && !sdata->u.mesh.is_secure) {
+                mpl_dbg("Mesh plink: can't establish link with secure peer\n");
+                return;
+        }
 
         ftype = mgmt->u.action.u.plink_action.action_code;
         ie_len = elems.peer_link_len;
@@ -480,6 +495,12 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 return;
         }
 
+        if (sta && !test_sta_flags(sta, WLAN_STA_AUTH)) {
+                mpl_dbg("Mesh plink: Action frame from non-authed peer\n");
+                rcu_read_unlock();
+                return;
+        }
+
         if (sta && sta->plink_state == PLINK_BLOCKED) {
                 rcu_read_unlock();
                 return;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 865fed4cc18b..a41f234bd486 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -761,15 +761,16 @@ void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
         if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
             (!(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED))) {
                 netif_tx_stop_all_queues(sdata->dev);
-                /*
-                 * Flush all the frames queued in the driver before
-                 * going to power save
-                 */
-                drv_flush(local, false);
-                ieee80211_send_nullfunc(local, sdata, 1);
 
-                /* Flush once again to get the tx status of nullfunc frame */
-                drv_flush(local, false);
+                if (drv_tx_frames_pending(local))
+                        mod_timer(&local->dynamic_ps_timer, jiffies +
+                                  msecs_to_jiffies(
+                                  local->hw.conf.dynamic_ps_timeout));
+                else {
+                        ieee80211_send_nullfunc(local, sdata, 1);
+                        /* Flush to get the tx status of nullfunc frame */
+                        drv_flush(local, false);
+                }
         }
 
         if (!((local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) &&
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index fc2ff78582ca..54858a68abd7 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -502,7 +502,8 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 
                 if (ieee80211_is_probe_req(hdr->frame_control) ||
                     ieee80211_is_probe_resp(hdr->frame_control) ||
-                    ieee80211_is_beacon(hdr->frame_control))
+                    ieee80211_is_beacon(hdr->frame_control) ||
+                    ieee80211_is_auth(hdr->frame_control))
                         return RX_CONTINUE;
 
                 return RX_DROP_MONITOR;
@@ -1585,7 +1586,7 @@ ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
 }
 
 static int
-__ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
+__ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
 {
         struct ieee80211_sub_if_data *sdata = rx->sdata;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
@@ -1593,6 +1594,7 @@ __ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
         struct ethhdr *ehdr;
         int ret;
 
+        *port_control = false;
         if (ieee80211_has_a4(hdr->frame_control) &&
             sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
                 return -1;
@@ -1611,11 +1613,13 @@ __ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
                 return -1;
 
         ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
-        if (ret < 0 || !check_port_control)
+        if (ret < 0)
                 return ret;
 
         ehdr = (struct ethhdr *) rx->skb->data;
-        if (ehdr->h_proto != rx->sdata->control_port_protocol)
+        if (ehdr->h_proto == rx->sdata->control_port_protocol)
+                *port_control = true;
+        else if (check_port_control)
                 return -1;
 
         return 0;
@@ -1916,6 +1920,7 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
         struct net_device *dev = sdata->dev;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
         __le16 fc = hdr->frame_control;
+        bool port_control;
         int err;
 
         if (unlikely(!ieee80211_is_data(hdr->frame_control)))
@@ -1932,13 +1937,21 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
             sdata->vif.type == NL80211_IFTYPE_AP)
                 return RX_DROP_MONITOR;
 
-        err = __ieee80211_data_to_8023(rx);
+        err = __ieee80211_data_to_8023(rx, &port_control);
         if (unlikely(err))
                 return RX_DROP_UNUSABLE;
 
         if (!ieee80211_frame_allowed(rx, fc))
                 return RX_DROP_MONITOR;
 
+        if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+            unlikely(port_control) && sdata->bss) {
+                sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
+                                     u.ap);
+                dev = sdata->dev;
+                rx->sdata = sdata;
+        }
+
         rx->skb->dev = dev;
 
         dev->stats.rx_packets++;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 999f8fbf0b4b..8a9068ac0673 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -228,6 +228,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
+        struct timespec uptime;
         int i;
 
         sta = kzalloc(sizeof(*sta) + local->hw.sta_data_size, gfp);
@@ -245,6 +246,8 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         sta->sdata = sdata;
         sta->last_rx = jiffies;
 
+        do_posix_clock_monotonic_gettime(&uptime);
+        sta->last_connected = uptime.tv_sec;
         ewma_init(&sta->avg_signal, 1024, 8);
 
         if (sta_prepare_rate_control(local, sta, gfp)) {
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 43238e99cfb3..984a03db3553 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -226,6 +226,7 @@ enum plink_state {
  * @rx_bytes: Number of bytes received from this STA
  * @wep_weak_iv_count: number of weak WEP IVs received from this station
  * @last_rx: time (in jiffies) when last frame was received from this STA
+ * @last_connected: time (in seconds) when a station got connected
  * @num_duplicates: number of duplicate frames received from this STA
  * @rx_fragments: number of received MPDUs
  * @rx_dropped: number of dropped MPDUs from this STA
@@ -295,6 +296,7 @@ struct sta_info {
         unsigned long rx_packets, rx_bytes;
         unsigned long wep_weak_iv_count;
         unsigned long last_rx;
+        long last_connected;
         unsigned long num_duplicates;
         unsigned long rx_fragments;
         unsigned long rx_dropped;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index ce4596ed1268..17b10be31f55 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2262,7 +2262,7 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
 
                 /* headroom, head length, tail length and maximum TIM length */
                 skb = dev_alloc_skb(local->tx_headroom + 400 +
-                                sdata->u.mesh.vendor_ie_len);
+                                sdata->u.mesh.ie_len);
                 if (!skb)
                         goto out;
 
diff --git a/net/wireless/mesh.c b/net/wireless/mesh.c
index 73e39c171ffb..5c116083eeca 100644
--- a/net/wireless/mesh.c
+++ b/net/wireless/mesh.c
@@ -1,5 +1,6 @@
 #include <linux/ieee80211.h>
 #include <net/cfg80211.h>
+#include "nl80211.h"
 #include "core.h"
 
 /* Default values, timeouts in ms */
@@ -53,8 +54,9 @@ const struct mesh_config default_mesh_config = {
 const struct mesh_setup default_mesh_setup = {
         .path_sel_proto = IEEE80211_PATH_PROTOCOL_HWMP,
         .path_metric = IEEE80211_PATH_METRIC_AIRTIME,
-        .vendor_ie = NULL,
-        .vendor_ie_len = 0,
+        .ie = NULL,
+        .ie_len = 0,
+        .is_secure = false,
 };
 
 int __cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
@@ -72,6 +74,10 @@ int __cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
                 return -EOPNOTSUPP;
 
+        if (!(rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
+              setup->is_secure)
+                return -EOPNOTSUPP;
+
         if (wdev->mesh_id_len)
                 return -EALREADY;
 
@@ -105,6 +111,19 @@ int cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
         return err;
 }
 
+void cfg80211_notify_new_peer_candidate(struct net_device *dev,
+                const u8 *macaddr, const u8* ie, u8 ie_len, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
+                return;
+
+        nl80211_send_new_peer_candidate(wiphy_to_dev(wdev->wiphy), dev,
+                        macaddr, ie, ie_len, gfp);
+}
+EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
+
 static int __cfg80211_leave_mesh(struct cfg80211_registered_device *rdev,
                                  struct net_device *dev)
 {
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 297d7ce4117b..0efa7fd01150 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -124,6 +124,7 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 
         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
+        [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 
         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
                                          .len = NL80211_HT_CAPABILITY_LEN },
@@ -594,6 +595,8 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 
         if (dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)
                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_IBSS_RSN);
+        if (dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH)
+                NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_MESH_AUTH);
 
         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
                 sizeof(u32) * dev->wiphy.n_cipher_suites,
@@ -1922,6 +1925,7 @@ static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
+        [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
 };
 
 static int parse_station_flags(struct genl_info *info,
@@ -2016,6 +2020,9 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
         if (!sinfoattr)
                 goto nla_put_failure;
+        if (sinfo->filled & STATION_INFO_CONNECTED_TIME)
+                NLA_PUT_U32(msg, NL80211_STA_INFO_CONNECTED_TIME,
+                            sinfo->connected_time);
         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
                             sinfo->inactive_time);
@@ -2281,7 +2288,9 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                         err = -EINVAL;
                 if (params.supported_rates)
                         err = -EINVAL;
-                if (params.sta_flags_mask)
+                if (params.sta_flags_mask &
+                                ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
+                                  BIT(NL80211_STA_FLAG_AUTHORIZED)))
                         err = -EINVAL;
                 break;
         default:
@@ -2343,11 +2352,16 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
                 params.ht_capa =
                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
 
+        if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
+                params.plink_action =
+                    nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
+
         if (parse_station_flags(info, &params))
                 return -EINVAL;
 
         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
                 return -EINVAL;
 
@@ -2823,7 +2837,8 @@ static const struct nla_policy
         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
-        [NL80211_MESH_SETUP_VENDOR_PATH_SEL_IE] = { .type = NLA_BINARY,
+        [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
+        [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
                 .len = IEEE80211_MAX_DATA_LEN },
 };
 
@@ -2925,14 +2940,16 @@ static int nl80211_parse_mesh_setup(struct genl_info *info,
                  IEEE80211_PATH_METRIC_VENDOR :
                  IEEE80211_PATH_METRIC_AIRTIME;
 
-        if (tb[NL80211_MESH_SETUP_VENDOR_PATH_SEL_IE]) {
+
+        if (tb[NL80211_MESH_SETUP_IE]) {
                 struct nlattr *ieattr =
-                        tb[NL80211_MESH_SETUP_VENDOR_PATH_SEL_IE];
+                        tb[NL80211_MESH_SETUP_IE];
                 if (!is_valid_ie_attr(ieattr))
                         return -EINVAL;
-                setup->vendor_ie = nla_data(ieattr);
-                setup->vendor_ie_len = nla_len(ieattr);
+                setup->ie = nla_data(ieattr);
+                setup->ie_len = nla_len(ieattr);
         }
+        setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
 
         return 0;
 }
@@ -5804,6 +5821,44 @@ void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
         nlmsg_free(msg);
 }
 
+void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
+                struct net_device *netdev,
+                const u8 *macaddr, const u8* ie, u8 ie_len,
+                gfp_t gfp)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr);
+        if (ie_len && ie)
+                NLA_PUT(msg, NL80211_ATTR_IE, ie_len , ie);
+
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+
 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
                                  struct net_device *netdev, const u8 *addr,
                                  enum nl80211_key_type key_type, int key_id,
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index dcac5cd6f017..f2af6955a665 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -50,6 +50,10 @@ void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
                                struct net_device *netdev, u16 reason,
                                const u8 *ie, size_t ie_len, bool from_ap);
 
+void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
+                                     struct net_device *netdev,
+                                     const u8 *macaddr, const u8* ie, u8 ie_len,
+                                     gfp_t gfp);
 void
 nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
                             struct net_device *netdev, const u8 *addr,